diff --git a/.github/workflows/publish-sim-cli.yml b/.github/workflows/publish-sim-cli.yml
index 53418f763d4..852423f1231 100644
--- a/.github/workflows/publish-sim-cli.yml
+++ b/.github/workflows/publish-sim-cli.yml
@@ -15,6 +15,13 @@ concurrency:
 
 jobs:
   publish-npm:
+    # Job-level, not on the build step: `bun publish` runs `prepublishOnly`,
+    # which rebuilds `dist` a second time, and that second build is the one
+    # that ships. A build without the token reports nothing. See
+    # docs/cli/usage-data.
+    env:
+      SIM_CLI_TELEMETRY_KEY: ${{ vars.SIM_CLI_TELEMETRY_KEY }}
+      SIM_CLI_TELEMETRY_HOST: ${{ vars.SIM_CLI_TELEMETRY_HOST }}
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
@@ -63,11 +70,6 @@ jobs:
 
       - name: Build package
         working-directory: packages/sim-cli
-        env:
-          # Public PostHog project token for anonymous CLI usage reporting; a
-          # build without it reports nothing. See docs/cli/usage-data.
-          SIM_CLI_TELEMETRY_KEY: ${{ vars.SIM_CLI_TELEMETRY_KEY }}
-          SIM_CLI_TELEMETRY_HOST: ${{ vars.SIM_CLI_TELEMETRY_HOST }}
         run: bun run build
 
       - name: Resolve release channel
diff --git a/apps/docs/content/docs/knowledgebase/connectors.mdx b/apps/docs/content/docs/knowledgebase/connectors.mdx
index 52da0ef7f74..31110c79c1c 100644
--- a/apps/docs/content/docs/knowledgebase/connectors.mdx
+++ b/apps/docs/content/docs/knowledgebase/connectors.mdx
@@ -8,7 +8,7 @@ import { Step, Steps } from 'fumadocs-ui/components/steps'
 import { Image } from '@/components/ui/image'
 import { FAQ } from '@/components/ui/faq'
 
-For workspace Search with each person's source permissions, use the [Search connector guides](/search). This page covers connectors inside general knowledge bases.
+For organization Search with each person's source permissions, use the [Search connector guides](/search). This page covers connectors inside general knowledge bases.
 
 Connectors continuously sync documents from external services into your knowledge base, so you never have to upload files manually. New content is added, changed content is re-processed, and deleted content is removed — all automatically.
 
diff --git a/apps/docs/content/docs/platform/enterprise/index.mdx b/apps/docs/content/docs/platform/enterprise/index.mdx
index a781bcc40d9..be354a1a18e 100644
--- a/apps/docs/content/docs/platform/enterprise/index.mdx
+++ b/apps/docs/content/docs/platform/enterprise/index.mdx
@@ -11,6 +11,7 @@ Sim Enterprise adds organization controls for access, provisioning, operations,
 | [Single sign-on](/platform/enterprise/sso) | Connect a SAML or OIDC identity provider |
 | [Verified domains](/platform/enterprise/verified-domains) | Prove domain ownership for SSO and provisioning |
 | [Directory provisioning](/platform/enterprise/scim) | Sync users and group-based access from your directory |
+| [Security](/platform/enterprise/security) | Manage session policies and view configured outbound IP addresses |
 | [Session policies](/platform/enterprise/session-policies) | Set session lifetimes and revoke member sessions |
 | [Audit logs](/platform/enterprise/audit-logs) | Investigate configuration and security events |
 | [Usage tracking](/platform/enterprise/usage-tracking) | Review usage by member, workspace, model, and source |
diff --git a/apps/docs/content/docs/platform/enterprise/meta.json b/apps/docs/content/docs/platform/enterprise/meta.json
index 123eec90b29..c87d6bad42d 100644
--- a/apps/docs/content/docs/platform/enterprise/meta.json
+++ b/apps/docs/content/docs/platform/enterprise/meta.json
@@ -5,6 +5,7 @@
     "sso",
     "scim",
     "verified-domains",
+    "security",
     "session-policies",
     "access-control",
     "custom-blocks",
diff --git a/apps/docs/content/docs/platform/enterprise/security.mdx b/apps/docs/content/docs/platform/enterprise/security.mdx
new file mode 100644
index 00000000000..0a67efba9cd
--- /dev/null
+++ b/apps/docs/content/docs/platform/enterprise/security.mdx
@@ -0,0 +1,34 @@
+---
+title: Security
+description: Manage organization session policies and view configured outbound IP addresses
+---
+
+Organization owners and admins open **Settings → Security** to manage session policies and view outbound IP addresses.
+
+## Session policies
+
+Set **Max session lifetime** and **Idle timeout** in hours, then select **Save**. Leave either field empty to use its default behavior. **Discard** restores your saved values.
+
+**Sign out all members** opens a confirmation before revoking the organization's browser sessions, except your current session. It does not revoke API keys.
+
+See [Session policies](/platform/enterprise/session-policies) for limits, defaults, and how changes affect existing sessions.
+
+## Outbound IP addresses
+
+Copy your organization's configured addresses in `/32` format and allowlist **every listed address** on the destination firewall. These addresses apply to supported HTTPS connections from Sim and its background workers.
+
+Contact Sim support or your deployment administrator to configure dedicated IPs and confirm connection coverage.
+
+### Connection coverage
+
+Dedicated routing supports public IPv4 destinations over HTTPS on port 443. It applies to supported Search connector API requests, HTTP request blocks, MCP and A2A connections, and HTTP requests made through Sim's local Function runtime. Background jobs use the same organization assignment.
+
+Native database connections, AWS SDK integrations, remote sandbox traffic, and browser requests keep their existing network paths. Other provider SDKs and OAuth authorization or token refresh calls require separate coverage confirmation. Dedicated IPs do not change access permissions in connected services.
+
+Google Drive, Fireflies, Google Workspace user and group discovery, and Atlassian OAuth site discovery currently use their existing network paths.
+
+If dedicated routing is unavailable, affected requests fail instead of using shared IPs. Organizations without dedicated routing keep their existing behavior.
+
+## Availability
+
+On Sim Cloud, Security settings require an Enterprise organization and an owner or admin role. On self-hosted deployments, the outbound IP section is available to organization administrators; session controls appear only when session policies are enabled. See [self-hosted enterprise configuration](/platform/enterprise/self-hosted).
diff --git a/apps/docs/content/docs/platform/enterprise/session-policies.mdx b/apps/docs/content/docs/platform/enterprise/session-policies.mdx
index 73ddd8fd2a4..b4b0d4267dd 100644
--- a/apps/docs/content/docs/platform/enterprise/session-policies.mdx
+++ b/apps/docs/content/docs/platform/enterprise/session-policies.mdx
@@ -11,7 +11,7 @@ Session Policies let organization owners and admins on Enterprise plans control
 
 ## Setup
 
-Go to **Settings → Organization → Session policies** in your organization settings.
+Go to **Settings → Security → Session policies** in your organization settings.
 
 Both limits are optional. Leave a field empty to keep the default behavior: sessions last 30 days and extend automatically while a member stays active.
 
diff --git a/apps/docs/content/docs/search/confluence.mdx b/apps/docs/content/docs/search/confluence.mdx
index 1f7887a2de1..5d63dbe45b7 100644
--- a/apps/docs/content/docs/search/confluence.mdx
+++ b/apps/docs/content/docs/search/confluence.mdx
@@ -56,8 +56,6 @@ Each teammate completes this identity connection. An existing authorized account
 </Step>
 </Steps>
 
-For workspace Search, start from **Search → Add source**. Available methods depend on the enabled features.
-
 ## Connect member accounts
 
 After an admin configures Confluence, open **Integrations** and select **Connect** beside Confluence. Authorize your account; you do not enter the site's domain or choose its spaces again.
@@ -132,7 +130,7 @@ Central sources combine space permissions, page and ancestor restrictions, and g
 
 Open **Settings → Sources → Confluence**, then a source's **Documents**, **Settings**, or **Sync history**. Invite teammates through **Settings → Members → Invite** or SSO, then have them connect through **Integrations**. **People → Request connections** only requests a provider connection; it does not invite people to the organization.
 
-Syncing runs automatically. Admins can use **Sync now** for an immediate update, **Pause syncing** to stop scheduled syncs, or **Resume syncing** to restart them. **Full resync**, available for service-account connections, fetches unchanged content again and asks for confirmation. Successful manual syncs have a one-minute cooldown; failed syncs can be retried immediately.
+Syncing runs automatically. Admins can use **Sync now** for an immediate update, **Pause syncing** to stop scheduled syncs, or **Resume syncing** to restart them. Successful manual syncs have a one-minute cooldown; failed syncs can be retried immediately.
 
 ## Troubleshooting
 
diff --git a/apps/docs/content/docs/search/connect-your-account.mdx b/apps/docs/content/docs/search/connect-your-account.mdx
index 353fc520956..b82cdf817a2 100644
--- a/apps/docs/content/docs/search/connect-your-account.mdx
+++ b/apps/docs/content/docs/search/connect-your-account.mdx
@@ -78,7 +78,7 @@ On the main **Integrations** page, select **Reconnect** beside the integration i
 
 Admins manage setup from **Settings → Sources**. Open an integration, then its connection to see **Documents**, **Settings**, and **Sync history**. **People** shows account contributors across integrations and supports filtering by integration. This does not grant the admin access to every document.
 
-Syncing runs automatically. Admins can use **Sync now** when they need an update; another manual run is available 60 seconds after a successful sync finishes. Failed or partial runs can be retried immediately. The connection header also offers **Pause syncing** or **Resume syncing**, and **Remove connection**. Where supported, **Full resync** fetches and reindexes all content and asks for confirmation first.
+Syncing runs automatically. Admins can use **Sync now** when they need an update; another manual run is available 60 seconds after a successful sync finishes. Failed or partial runs can be retried immediately. The connection header also offers **Pause syncing** or **Resume syncing**, and **Remove connection**.
 
 Removing a Search connection also removes its indexed documents from Sim. The originals remain in the connected app.
 
diff --git a/apps/docs/content/docs/search/github.mdx b/apps/docs/content/docs/search/github.mdx
index 516e03cf2a6..18b737e4efc 100644
--- a/apps/docs/content/docs/search/github.mdx
+++ b/apps/docs/content/docs/search/github.mdx
@@ -9,7 +9,7 @@ import { Image } from '@/components/ui/image'
 
 GitHub Search indexes repository text files and supported PDF and Office documents on `github.com`. An organization admin can install the GitHub App once and use it to index selected repositories. Each person connects their own GitHub account once to search the repositories they can access. Installing the App does not connect teammates or give them the installer's permissions.
 
-Admin setup uses your organization's **Settings → Sources** page. Teammates connect from **Integrations** in the main sidebar. Installation indexing is available for organization Search. For workspace Search, use **Search → Add source** with member accounts or a dedicated user account.
+Admin setup uses your organization's **Settings → Sources** page. Teammates connect from **Integrations** in the main sidebar. Installation indexing is available for organization Search.
 
 ## Before you start
 
diff --git a/apps/docs/content/docs/search/gitlab.mdx b/apps/docs/content/docs/search/gitlab.mdx
index 7dbc4f15fa5..b82a0664b76 100644
--- a/apps/docs/content/docs/search/gitlab.mdx
+++ b/apps/docs/content/docs/search/gitlab.mdx
@@ -9,7 +9,7 @@ import { Image } from '@/components/ui/image'
 
 Connect one GitLab project per source. Choose an **Administrator token** to refresh permissions from GitLab, or a **Non-admin token** with two CSV files to manage access in Sim. Teammates do not connect individual GitLab accounts.
 
-Organization admins set up sources in **Settings → Sources**. For workspace Search, use **Search → Add source**. The same token paths are available when adding a GitLab connector to a regular knowledge base.
+Organization admins set up sources in **Settings → Sources**. The same token paths are available when adding a GitLab connector to a regular knowledge base.
 
 ## Choose a token path
 
@@ -146,7 +146,7 @@ Open a project to use these administrator actions:
 | **Settings** | Change the token, project, filters, or CSV permissions. |
 | **Remove connection** | Confirm removal of the connection and its indexed documents. Documents cannot be retained without the connection that maintains their permissions. |
 
-GitLab does not expose a separate **Full resync** action. Each sync checks the selected content. CSV grants change only when you replace the files.
+Each sync checks the selected content. CSV grants change only when you replace the files.
 
 ## Troubleshooting
 
diff --git a/apps/docs/content/docs/search/gmail.mdx b/apps/docs/content/docs/search/gmail.mdx
index 8945d725c4b..c030c526062 100644
--- a/apps/docs/content/docs/search/gmail.mdx
+++ b/apps/docs/content/docs/search/gmail.mdx
@@ -9,7 +9,7 @@ import { Image } from '@/components/ui/image'
 
 Search email threads from your Gmail account. Members can connect their own accounts, or an administrator can index Google Workspace mailboxes with a service account. In either case, each mailbox stays private to its owner.
 
-Admin setup uses your organization's **Settings → Sources** page. Teammates connect from **Integrations** in the main sidebar. For workspace Search, use **Search → Add source** instead.
+Admin setup uses your organization's **Settings → Sources** page. Teammates connect from **Integrations** in the main sidebar.
 
 ## Choose your setup
 
diff --git a/apps/docs/content/docs/search/google-calendar.mdx b/apps/docs/content/docs/search/google-calendar.mdx
index 246252a3a6a..2f302719ebc 100644
--- a/apps/docs/content/docs/search/google-calendar.mdx
+++ b/apps/docs/content/docs/search/google-calendar.mdx
@@ -9,7 +9,7 @@ import { Image } from '@/components/ui/image'
 
 Search meetings and event details available to your Google account. Members can connect personal accounts, or a Google Workspace administrator can configure a central service-account crawl. Both paths keep each person's own view of events separate.
 
-Admin setup uses your organization's **Settings → Sources** page. Teammates connect from **Integrations** in the main sidebar. For workspace Search, use **Search → Add source** instead.
+Admin setup uses your organization's **Settings → Sources** page. Teammates connect from **Integrations** in the main sidebar.
 
 ## Choose your setup
 
diff --git a/apps/docs/content/docs/search/google-drive.mdx b/apps/docs/content/docs/search/google-drive.mdx
index c1e01e57347..0565a5289f7 100644
--- a/apps/docs/content/docs/search/google-drive.mdx
+++ b/apps/docs/content/docs/search/google-drive.mdx
@@ -9,7 +9,7 @@ import { Image } from '@/components/ui/image'
 
 Search Google Docs, Sheets, Slides, and supported files in Drive. Members can connect their own accounts after an admin allows Google Drive, or an admin can configure a central service-account crawl.
 
-Admin setup uses your organization's **Settings → Sources** page. Teammates connect from **Integrations** in the main sidebar. For workspace Search, use **Search → Add source** instead.
+Admin setup uses your organization's **Settings → Sources** page. Teammates connect from **Integrations** in the main sidebar.
 
 ## Choose your setup
 
diff --git a/apps/docs/content/docs/search/index.mdx b/apps/docs/content/docs/search/index.mdx
index 68b53e20f2a..f2e080397ab 100644
--- a/apps/docs/content/docs/search/index.mdx
+++ b/apps/docs/content/docs/search/index.mdx
@@ -104,7 +104,7 @@ Edit **Settings** to change an existing connection's filters. Adding another con
 
 **Sync using** shows the method selected when the source was created. Add a new connection to change that method. To replace a supported indexing credential, select its replacement and use **Change service account** or **Change account**, as shown.
 
-The connection header offers **Sync now**, **Pause syncing** or **Resume syncing**, **Remove connection**, and, where supported, **Full resync**. Full resync fetches all content again and requires confirmation. Manual runs have a 60-second cooldown after a successful sync finishes; failed or partial runs can be retried immediately. **Pause syncing** becomes available when the current sync finishes.
+The connection header offers **Sync now**, **Pause syncing** or **Resume syncing**, and **Remove connection**. Manual runs have a 60-second cooldown after a successful sync finishes; failed or partial runs can be retried immediately. **Pause syncing** becomes available when the current sync finishes.
 
 To deactivate an entire integration, open it from **Settings → Sources**, select **Deactivate**, and confirm. Its content becomes unavailable in Search, Assistant, and MCP; saved connections remain. Select **Activate** on that integration to enable it again.
 
@@ -120,10 +120,6 @@ To deactivate an entire integration, open it from **Settings → Sources**, sele
 
 To use these sources from Claude, Codex, Claude Code, Cursor, or another compatible app, open **Settings → Search MCP**. Each person signs in with their own Sim account. The server provides `search`, `read_document`, and `chat`; `chat` starts a new private Sim conversation. See [Search MCP](/search/mcp) for app setup, permissions, and limits.
 
-## Existing workspace Search
-
-Workspace Search remains separate. Workspace admins add sources through **Search → Add source**; the member-account action is **Create & Invite**. Teammates need workspace access and connect from its source list. Organization Search does not automatically include workspace sources or grant access to workspace content.
-
 ## Check that it works
 
 1. Let the first sync finish, then search for a distinctive phrase in a document you can open in the source.
diff --git a/apps/docs/content/docs/search/jira.mdx b/apps/docs/content/docs/search/jira.mdx
index bb41c9f9581..9faacf30110 100644
--- a/apps/docs/content/docs/search/jira.mdx
+++ b/apps/docs/content/docs/search/jira.mdx
@@ -71,8 +71,6 @@ Each teammate follows this step. Sim reuses an existing authorized account where
 </Step>
 </Steps>
 
-For workspace Search, start from **Search → Add source**; its source-creation button is **Create & Invite**. Search manages the sync schedule and hides item limits.
-
 ## Connect before a source exists
 
 After an admin approves Jira, a teammate can select **Connect** on the Jira row in **Integrations**. To add another site or project selection later, open the Jira row's actions menu (**…**) and select **Add projects**:
diff --git a/apps/docs/content/docs/search/slack.mdx b/apps/docs/content/docs/search/slack.mdx
index bd158b43996..26544966a73 100644
--- a/apps/docs/content/docs/search/slack.mdx
+++ b/apps/docs/content/docs/search/slack.mdx
@@ -134,8 +134,6 @@ Compare **OAuth & Permissions → Scopes → User Token Scopes** with the table
 
 Existing workflow account pools retain their configured permissions; preserve those scopes when updating the shared app.
 
-For existing **workspace** Search, use **Search → Add source → Slack**. That flow uses the custom-bot wizard and **Connected accounts → Access → Search documents**, which requests read-only channel, DM, and identity scopes. Its bot installation is separate from the organization setup described here.
-
 See Slack's [app manifest reference](https://docs.slack.dev/reference/app-manifest/) and [user token access model](https://docs.slack.dev/authentication/tokens/).
 
 ## Troubleshooting
diff --git a/apps/realtime/src/database/operations.test.ts b/apps/realtime/src/database/operations.test.ts
new file mode 100644
index 00000000000..fb81bbd304d
--- /dev/null
+++ b/apps/realtime/src/database/operations.test.ts
@@ -0,0 +1,171 @@
+/** @vitest-environment node */
+import { OPERATION_TARGETS, SUBBLOCK_OPERATIONS } from '@sim/realtime-protocol/constants'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockTransaction, mockSelectWhere, mockSet } = vi.hoisted(() => ({
+  mockTransaction: vi.fn(),
+  mockSelectWhere: vi.fn(),
+  mockSet: vi.fn(),
+}))
+
+vi.mock('@sim/audit', () => ({ AuditAction: {}, AuditResourceType: {}, recordAudit: vi.fn() }))
+vi.mock('@sim/db', () => ({
+  instrumentPoolClient: vi.fn(),
+  resolveDbUrl: vi.fn(() => 'postgres://localhost/test'),
+  workflow: { id: 'workflow.id' },
+  workflowBlocks: { id: 'block.id', workflowId: 'block.workflowId' },
+  workflowEdges: {},
+  workflowSubflows: {},
+}))
+vi.mock('@sim/db/timestamps', () => ({ withUtcTimestamps: (options: unknown) => options }))
+vi.mock('@sim/logger', () => ({
+  createLogger: () => ({ info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() }),
+}))
+vi.mock('@sim/platform-authz/workflow', () => ({
+  getActiveWorkflowContext: vi.fn().mockResolvedValue({ id: 'workflow-1' }),
+}))
+vi.mock('@sim/workflow-persistence/load', () => ({
+  loadWorkflowFromNormalizedTablesRaw: vi.fn(),
+}))
+vi.mock('@sim/workflow-persistence/subblocks', () => ({ mergeSubBlockValues: vi.fn() }))
+vi.mock('drizzle-orm', () => ({
+  and: vi.fn(),
+  eq: vi.fn(),
+  inArray: vi.fn(),
+  isNull: vi.fn(),
+  or: vi.fn(),
+  sql: vi.fn(),
+}))
+vi.mock('drizzle-orm/postgres-js', () => ({ drizzle: () => ({ transaction: mockTransaction }) }))
+vi.mock('postgres', () => ({ default: vi.fn() }))
+vi.mock('@/env', () => ({
+  env: { DATABASE_URL: 'postgres://localhost/test' },
+}))
+
+import { persistWorkflowOperation } from '@/database/operations'
+
+const transaction = {
+  select: () => ({ from: () => ({ where: mockSelectWhere }) }),
+  update: () => ({ set: mockSet }),
+  delete: vi.fn(),
+  insert: vi.fn(),
+}
+
+describe('search replacement persistence', () => {
+  const expected = [
+    {
+      type: 'function',
+      params: { language: 'javascript', code: 'return 1' },
+      usageControl: 'none',
+    },
+  ]
+  const replacement = [{ ...expected[0], params: { ...expected[0].params, code: 'return 2' } }]
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockTransaction.mockImplementation(
+      async (callback: (tx: typeof transaction) => Promise<void>) => callback(transaction)
+    )
+    mockSet.mockReturnValue({ where: vi.fn().mockResolvedValue(undefined) })
+  })
+
+  function replaceTools(stored: unknown, expectedValue: unknown = expected) {
+    mockSelectWhere.mockResolvedValue([
+      {
+        id: 'agent-1',
+        type: 'agent',
+        locked: false,
+        data: {},
+        subBlocks: { tools: { id: 'tools', type: 'tool-input', value: stored } },
+      },
+    ])
+    return persistWorkflowOperation('workflow-1', {
+      operation: SUBBLOCK_OPERATIONS.BATCH_UPDATE,
+      target: OPERATION_TARGETS.SUBBLOCK,
+      timestamp: Date.now(),
+      payload: {
+        updates: [{ blockId: 'agent-1', subblockId: 'tools', value: replacement, expectedValue }],
+      },
+    })
+  }
+
+  it('accepts equivalent nested tool objects after JSONB changes their key order', async () => {
+    const stored = [
+      {
+        usageControl: 'none',
+        params: { code: 'return 1', language: 'javascript' },
+        type: 'function',
+      },
+    ]
+
+    await expect(replaceTools(stored)).resolves.toBeUndefined()
+    expect(mockSet).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        subBlocks: { tools: { id: 'tools', type: 'tool-input', value: replacement } },
+      })
+    )
+  })
+
+  it('still rejects a tool parameter changed by another editor', async () => {
+    await expect(
+      replaceTools([{ ...expected[0], params: { ...expected[0].params, code: 'return 3' } }])
+    ).rejects.toThrow('changed since replacement was planned')
+    expect(mockSet).toHaveBeenCalledTimes(1)
+  })
+
+  it('still rejects reordered tool arrays', async () => {
+    const another = { ...expected[0], params: { ...expected[0].params, code: 'return 3' } }
+    await expect(replaceTools([another, expected[0]], [expected[0], another])).rejects.toThrow(
+      'changed since replacement was planned'
+    )
+    expect(mockSet).toHaveBeenCalledTimes(1)
+  })
+})
+
+describe('subblock update with canonical modes persistence', () => {
+  const tools = [{ type: 'jira', params: { manualProjectId: '{{PROJECT}}' } }]
+  const canonicalModes = { '0:projectId': 'advanced' as const, model: 'basic' as const }
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockTransaction.mockImplementation(
+      async (callback: (tx: typeof transaction) => Promise<void>) => callback(transaction)
+    )
+    mockSet.mockReturnValue({ where: vi.fn().mockResolvedValue(undefined) })
+  })
+
+  function updateTools(block: Record<string, unknown>) {
+    mockSelectWhere.mockResolvedValue([
+      {
+        id: 'agent-1',
+        locked: false,
+        data: { width: 350, canonicalModes: { '1:projectId': 'advanced' } },
+        subBlocks: { tools: { id: 'tools', type: 'tool-input', value: [] } },
+        ...block,
+      },
+    ])
+    return persistWorkflowOperation('workflow-1', {
+      operation: SUBBLOCK_OPERATIONS.UPDATE_WITH_CANONICAL_MODES,
+      target: OPERATION_TARGETS.SUBBLOCK,
+      timestamp: Date.now(),
+      payload: { blockId: 'agent-1', subblockId: 'tools', value: tools, canonicalModes },
+    })
+  }
+
+  it('writes the subblock value and replaces canonical modes in one block update', async () => {
+    await expect(updateTools({})).resolves.toBeUndefined()
+
+    expect(mockSet).toHaveBeenCalledTimes(2)
+    expect(mockSet).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        subBlocks: { tools: { id: 'tools', type: 'tool-input', value: tools } },
+        data: { width: 350, canonicalModes },
+      })
+    )
+  })
+
+  it('rejects a locked block without writing either field', async () => {
+    await expect(updateTools({ locked: true })).rejects.toThrow('is locked')
+    expect(mockSet).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/apps/realtime/src/database/operations.ts b/apps/realtime/src/database/operations.ts
index f28543a8004..cd4316448bf 100644
--- a/apps/realtime/src/database/operations.ts
+++ b/apps/realtime/src/database/operations.ts
@@ -1,3 +1,4 @@
+import { isDeepStrictEqual } from 'node:util'
 import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import * as schema from '@sim/db'
 import {
@@ -25,6 +26,7 @@ import {
 import { randomFloat } from '@sim/utils/random'
 import { loadWorkflowFromNormalizedTablesRaw } from '@sim/workflow-persistence/load'
 import { mergeSubBlockValues } from '@sim/workflow-persistence/subblocks'
+import type { DbOrTx } from '@sim/workflow-persistence/types'
 import {
   filterAcyclicEdges,
   filterUniqueWorkflowEdges,
@@ -1988,8 +1990,36 @@ async function handleSubflowOperationTx(
   }
 }
 
-function valuesEqual(left: unknown, right: unknown): boolean {
-  return JSON.stringify(left) === JSON.stringify(right)
+/** Every block in the workflow by id, for the locked-container check subblock writes need. */
+async function loadSubblockUpdateBlocks(tx: DbOrTx, workflowId: string) {
+  const allBlocks = await tx
+    .select({
+      id: workflowBlocks.id,
+      subBlocks: workflowBlocks.subBlocks,
+      locked: workflowBlocks.locked,
+      data: workflowBlocks.data,
+    })
+    .from(workflowBlocks)
+    .where(eq(workflowBlocks.workflowId, workflowId))
+  return Object.fromEntries(allBlocks.map((block) => [block.id, block]))
+}
+
+/**
+ * The block a subblock write targets, rejecting one that is missing, locked, or in a locked
+ * container.
+ */
+function getWritableSubblockUpdateBlock(
+  blocksById: Awaited<ReturnType<typeof loadSubblockUpdateBlocks>>,
+  blockId: string
+) {
+  const block = blocksById[blockId]
+  if (!block) {
+    throw new Error(`Block ${blockId} not found`)
+  }
+  if (isWorkflowBlockProtected(blockId, blocksById)) {
+    throw new Error(`Block ${blockId} is locked or inside a locked container`)
+  }
+  return block
 }
 
 // Subblock operations - targeted value updates without replacing workflow state
@@ -2006,20 +2036,7 @@ async function handleSubblockOperationTx(
         return
       }
 
-      const allBlocks = await tx
-        .select({
-          id: workflowBlocks.id,
-          subBlocks: workflowBlocks.subBlocks,
-          locked: workflowBlocks.locked,
-          data: workflowBlocks.data,
-        })
-        .from(workflowBlocks)
-        .where(eq(workflowBlocks.workflowId, workflowId))
-
-      type SubblockUpdateBlockRecord = (typeof allBlocks)[number]
-      const blocksById: Record<string, SubblockUpdateBlockRecord> = Object.fromEntries(
-        allBlocks.map((block: SubblockUpdateBlockRecord) => [block.id, block])
-      )
+      const blocksById = await loadSubblockUpdateBlocks(tx, workflowId)
 
       for (const update of updates) {
         const { blockId, subblockId, value, expectedValue } = update
@@ -2027,19 +2044,13 @@ async function handleSubblockOperationTx(
           throw new Error('Missing required fields for subblock batch update')
         }
 
-        const block = blocksById[blockId]
-        if (!block) {
-          throw new Error(`Block ${blockId} not found`)
-        }
-
-        if (isWorkflowBlockProtected(blockId, blocksById)) {
-          throw new Error(`Block ${blockId} is locked or inside a locked container`)
-        }
+        const block = getWritableSubblockUpdateBlock(blocksById, blockId)
 
         const subBlocks = { ...((block.subBlocks as Record<string, any>) || {}) }
         const currentSubBlock = subBlocks[subblockId]
         const currentValue = currentSubBlock?.value
-        if (expectedValue !== undefined && !valuesEqual(currentValue, expectedValue)) {
+        /** JSONB can reorder object keys; changed values and array order must still conflict. */
+        if (expectedValue !== undefined && !isDeepStrictEqual(currentValue, expectedValue)) {
           throw new Error(`Subblock ${blockId}.${subblockId} changed since replacement was planned`)
         }
 
@@ -2062,6 +2073,36 @@ async function handleSubblockOperationTx(
       break
     }
 
+    case SUBBLOCK_OPERATIONS.UPDATE_WITH_CANONICAL_MODES: {
+      const { blockId, subblockId, value, canonicalModes } = payload
+      if (!blockId || !subblockId || !canonicalModes) {
+        throw new Error('Missing required fields for subblock update with canonical modes')
+      }
+
+      const blocksById = await loadSubblockUpdateBlocks(tx, workflowId)
+      const block = getWritableSubblockUpdateBlock(blocksById, blockId)
+
+      const subBlocks = {
+        ...((block.subBlocks as Record<string, Record<string, unknown>> | null) || {}),
+      }
+      const currentSubBlock = subBlocks[subblockId]
+      subBlocks[subblockId] = currentSubBlock
+        ? { ...currentSubBlock, value }
+        : { id: subblockId, type: 'unknown', value }
+
+      await tx
+        .update(workflowBlocks)
+        .set({
+          subBlocks,
+          data: { ...((block.data as Record<string, unknown>) || {}), canonicalModes },
+          updatedAt: new Date(),
+        })
+        .where(and(eq(workflowBlocks.id, blockId), eq(workflowBlocks.workflowId, workflowId)))
+
+      logger.debug(`Updated subblock ${blockId}.${subblockId} with canonical modes`)
+      break
+    }
+
     default:
       logger.warn(`Unknown subblock operation: ${operation}`)
       throw new Error(`Unsupported subblock operation: ${operation}`)
diff --git a/apps/realtime/src/middleware/permissions.test.ts b/apps/realtime/src/middleware/permissions.test.ts
index 4edc05d795a..97f32b1d2d2 100644
--- a/apps/realtime/src/middleware/permissions.test.ts
+++ b/apps/realtime/src/middleware/permissions.test.ts
@@ -114,6 +114,11 @@ describe('checkRolePermission', () => {
       const result = checkRolePermission('write', 'subblock-batch-update')
       expectPermissionAllowed(result)
     })
+
+    it('should allow subblock-update-with-canonical-modes operation', () => {
+      const result = checkRolePermission('write', 'subblock-update-with-canonical-modes')
+      expectPermissionAllowed(result)
+    })
   })
 
   describe('read role', () => {
@@ -155,6 +160,11 @@ describe('checkRolePermission', () => {
       expectPermissionDenied(result, 'read')
     })
 
+    it('should deny subblock-update-with-canonical-modes operation for read role', () => {
+      const result = checkRolePermission('read', 'subblock-update-with-canonical-modes')
+      expectPermissionDenied(result, 'read')
+    })
+
     it('should deny toggle-enabled operation for read role', () => {
       const result = checkRolePermission('read', 'toggle-enabled')
       expectPermissionDenied(result, 'read')
diff --git a/apps/realtime/src/middleware/permissions.ts b/apps/realtime/src/middleware/permissions.ts
index e17678461a6..a007de6c8b2 100644
--- a/apps/realtime/src/middleware/permissions.ts
+++ b/apps/realtime/src/middleware/permissions.ts
@@ -52,6 +52,7 @@ const WRITE_OPERATIONS: string[] = [
   // Subblock operations
   SUBBLOCK_OPERATIONS.UPDATE,
   SUBBLOCK_OPERATIONS.BATCH_UPDATE,
+  SUBBLOCK_OPERATIONS.UPDATE_WITH_CANONICAL_MODES,
   // Variable operations
   VARIABLE_OPERATIONS.UPDATE,
   // Workflow operations
diff --git a/apps/sim/app/(landing)/components/hero/components/hero-chat-loop/hero-tool-call-item.tsx b/apps/sim/app/(landing)/components/hero/components/hero-chat-loop/hero-tool-call-item.tsx
index b659eae8b45..068a27599da 100644
--- a/apps/sim/app/(landing)/components/hero/components/hero-chat-loop/hero-tool-call-item.tsx
+++ b/apps/sim/app/(landing)/components/hero/components/hero-chat-loop/hero-tool-call-item.tsx
@@ -2,7 +2,10 @@ import { Table } from '@sim/emcn/icons'
 import { SlackIcon } from '@/components/icons'
 import { ActivityStatus } from '@/components/ui/activity-status'
 import { getToolStatusDisplayTitle } from '@/lib/copilot/tools/tool-display'
-import type { ToolCallItemProps } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item'
+import type {
+  ToolActivityPresentation,
+  ToolCallItemProps,
+} from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item'
 import { getToolIcon } from '@/app/workspace/[workspaceId]/home/components/message-content/utils'
 
 /** Demo fixtures have known brands, so the landing page never loads the block registry. */
@@ -11,6 +14,7 @@ export function HeroToolCallItem({
   renderStatus,
   toolName,
   displayTitle,
+  activityDescription,
   status,
 }: ToolCallItemProps) {
   const Icon =
@@ -19,12 +23,16 @@ export function HeroToolCallItem({
       : toolCallId === 'hero-read-table'
         ? Table
         : getToolIcon(toolName)
-  const activity = (
-    <ActivityStatus
-      label={getToolStatusDisplayTitle(displayTitle, status, toolName)}
-      isActive={status === 'executing'}
-      icon={<Icon className='size-full' />}
-    />
-  )
-  return renderStatus ? renderStatus(activity) : activity
+  const activity: ToolActivityPresentation = {
+    label: getToolStatusDisplayTitle(displayTitle, status, toolName, activityDescription),
+    activeLabel: getToolStatusDisplayTitle(
+      displayTitle,
+      status === 'success' ? 'executing' : status,
+      toolName,
+      activityDescription
+    ),
+    isActive: status === 'executing',
+    icon: <Icon className='size-full' />,
+  }
+  return renderStatus ? renderStatus(activity) : <ActivityStatus {...activity} />
 }
diff --git a/apps/sim/app/api/auth/sso/register/route.test.ts b/apps/sim/app/api/auth/sso/register/route.test.ts
index b4c4ef1704f..db55de96da8 100644
--- a/apps/sim/app/api/auth/sso/register/route.test.ts
+++ b/apps/sim/app/api/auth/sso/register/route.test.ts
@@ -88,6 +88,7 @@ const OIDC_BODY = {
   providerId: 'acme-oidc',
   issuer: 'https://idp.acme.com',
   domain: 'acme.com',
+  orgId: 'org1',
   clientId: 'client-id',
   clientSecret: 'client-secret',
   authorizationEndpoint: 'https://idp.acme.com/authorize',
@@ -137,21 +138,21 @@ describe('POST /api/auth/sso/register', () => {
 
   it('rejects callers without an Enterprise plan', async () => {
     mockHasSSOAccess.mockResolvedValue(false)
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     expect(res.status).toBe(403)
     expect(mockRegisterSSOProvider).not.toHaveBeenCalled()
   })
 
   it('rejects callers who are not an admin/owner of the target org', async () => {
     queueMembers([{ organizationId: 'org1', role: 'member' }])
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     expect(res.status).toBe(403)
     expect(mockRegisterSSOProvider).not.toHaveBeenCalled()
   })
 
   it('rejects an invalid domain', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
-    const res = await POST(request({ ...OIDC_BODY, domain: 'not-a-domain', orgId: 'org1' }))
+    const res = await POST(request({ ...OIDC_BODY, domain: 'not-a-domain' }))
     expect(res.status).toBe(400)
     expect(mockRegisterSSOProvider).not.toHaveBeenCalled()
   })
@@ -160,7 +161,7 @@ describe('POST /api/auth/sso/register', () => {
     resetDbChainMock()
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
     queueTableRows(schemaMock.ssoDomain, []) // no verified sso_domain row
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     const json = await res.json()
     expect(res.status).toBe(403)
     expect(json.code).toBe('SSO_DOMAIN_NOT_VERIFIED')
@@ -172,7 +173,7 @@ describe('POST /api/auth/sso/register', () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
     queueTableRows(schemaMock.ssoDomain, [{ id: 'v' }]) // entry gate: verified
     queueTableRows(schemaMock.ssoDomain, []) // re-check before write: revoked
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     const json = await res.json()
     expect(res.status).toBe(403)
     expect(json.code).toBe('SSO_DOMAIN_NOT_VERIFIED')
@@ -185,7 +186,7 @@ describe('POST /api/auth/sso/register', () => {
     queueTableRows(schemaMock.ssoDomain, [{ id: 'v' }]) // entry gate: verified
     queueTableRows(schemaMock.ssoDomain, [{ id: 'v' }]) // pre-write re-check: verified
     queueTableRows(schemaMock.ssoDomain, []) // locking read in the grant: proof gone
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     const json = await res.json()
     expect(res.status).toBe(403)
     expect(json.code).toBe('SSO_DOMAIN_NOT_VERIFIED')
@@ -221,7 +222,7 @@ describe('POST /api/auth/sso/register', () => {
     queueProviders([
       { domain: 'acme.com', userId: 'u1', organizationId: 'org1', providerId: 'acme-saml' },
     ])
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     const json = await res.json()
     expect(res.status).toBe(409)
     expect(json.code).toBe('SSO_DOMAIN_ALREADY_ROUTED')
@@ -238,7 +239,7 @@ describe('POST /api/auth/sso/register', () => {
         constraint_name: 'sso_provider_org_domain_unique',
       })
     )
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     const json = await res.json()
     expect(res.status).toBe(409)
     expect(json.code).toBe('SSO_DOMAIN_ALREADY_ROUTED')
@@ -248,14 +249,14 @@ describe('POST /api/auth/sso/register', () => {
   it('lets the organization add a provider for a different verified domain', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
     queueProviders([])
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1', domain: 'eng.acme.com' }))
+    const res = await POST(request({ ...OIDC_BODY, domain: 'eng.acme.com' }))
     expect(res.status).toBe(200)
     expect(mockRegisterSSOProvider).toHaveBeenCalledTimes(1)
   })
 
   it('registers when the domain is unclaimed', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     expect(res.status).toBe(200)
     expect(mockRegisterSSOProvider).toHaveBeenCalledTimes(1)
   })
@@ -286,7 +287,7 @@ describe('POST /api/auth/sso/register', () => {
   it('does not treat the caller’s own provider as a providerId conflict', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
     queueProviders([], [{ domain: 'acme.com', userId: 'u1', organizationId: 'org1' }])
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     expect(res.status).toBe(200)
   })
 
@@ -298,7 +299,7 @@ describe('POST /api/auth/sso/register', () => {
    */
   it('marks the provider domain-verified after registering', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     expect(res.status).toBe(200)
     expect(dbChainMockFns.set).toHaveBeenCalledWith({
       domainVerified: true,
@@ -311,7 +312,7 @@ describe('POST /api/auth/sso/register', () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
     queueProviders([])
     queueTableRows(schemaMock.ssoProvider, [{ id: 'p1' }])
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     expect(res.status).toBe(200)
     expect(mockUpdateSSOProvider).toHaveBeenCalledTimes(1)
     expect(dbChainMockFns.set).toHaveBeenCalledWith({
@@ -346,7 +347,7 @@ describe('POST /api/auth/sso/register', () => {
       },
     ]) // provider already owned → update path
 
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     expect(res.status).toBe(403)
     expect(mockUpdateSSOProvider).toHaveBeenCalledTimes(1)
     // The conditional grant UPDATE is still issued — it simply matches no rows once
@@ -376,7 +377,7 @@ describe('POST /api/auth/sso/register', () => {
     ])
     dbChainMockFns.returning.mockRejectedValueOnce(new Error('trust write failed'))
 
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1', jitProvisioningEnabled: false }))
+    const res = await POST(request({ ...OIDC_BODY, jitProvisioningEnabled: false }))
 
     expect(res.status).toBe(500)
     expect(mockUpdateSSOProvider).toHaveBeenCalledTimes(1)
@@ -397,41 +398,28 @@ describe('POST /api/auth/sso/register', () => {
     queueTableRows(schemaMock.ssoDomain, [{ id: 'verified-domain' }])
     queueTableRows(schemaMock.ssoDomain, [{ id: 'verified-domain' }])
     queueTableRows(schemaMock.ssoDomain, []) // locking read in the grant: proof gone
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     expect(res.status).toBe(403)
     expect(mockRegisterSSOProvider).toHaveBeenCalledTimes(1) // it was created…
     expect(dbChainMockFns.delete).toHaveBeenCalled() // …then rolled back
   })
 
   /**
-   * A personal provider has no verified domain behind it. On the hosted
-   * multi-tenant deployment that must grant no linking authority, or anyone able
-   * to register one could claim a domain they do not own and have their own IdP
-   * auto-link to existing accounts on it.
+   * An org-less provider has no `sso_domain` proof behind its domain, and domain
+   * trust is what auto-links an SSO sign-in into an existing same-email account,
+   * so the route refuses one before any write.
    */
-  it('does not grant domain trust to a personal provider when hosted', async () => {
-    setEnvFlags({ isSsoEnabled: true, isHosted: true })
-    const res = await POST(request(OIDC_BODY))
-    expect(res.status).toBe(200)
-    expect(dbChainMockFns.set).toHaveBeenCalledWith({
-      domainVerified: false,
-      jitProvisioningEnabled: true,
-    })
-  })
-
-  it('grants domain trust to a personal provider when self-hosted', async () => {
-    setEnvFlags({ isSsoEnabled: true, isHosted: false })
-    const res = await POST(request(OIDC_BODY))
-    expect(res.status).toBe(200)
-    expect(dbChainMockFns.set).toHaveBeenCalledWith({
-      domainVerified: true,
-      jitProvisioningEnabled: true,
-    })
+  it('refuses a provider without an organization', async () => {
+    const { orgId: _orgId, ...orgLessBody } = OIDC_BODY
+    const res = await POST(request(orgLessBody))
+    expect(res.status).toBe(400)
+    expect((await res.json()).error).toContain('Organization ID is required')
+    expect(mockRegisterSSOProvider).not.toHaveBeenCalled()
   })
 
   it('persists invite-only provisioning without changing Better Auth provider config', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1', jitProvisioningEnabled: false }))
+    const res = await POST(request({ ...OIDC_BODY, jitProvisioningEnabled: false }))
     expect(res.status).toBe(200)
     expect(dbChainMockFns.set).toHaveBeenCalledWith({
       domainVerified: true,
@@ -516,9 +504,7 @@ describe('POST /api/auth/sso/register', () => {
 
   it('nests the attribute mapping inside oidcConfig (Better Auth reads it there)', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
-    await POST(
-      request({ ...OIDC_BODY, orgId: 'org1', mapping: { id: 'oid', email: 'upn', name: 'name' } })
-    )
+    await POST(request({ ...OIDC_BODY, mapping: { id: 'oid', email: 'upn', name: 'name' } }))
     expect(mockRegisterSSOProvider).toHaveBeenCalledTimes(1)
     const sent = mockRegisterSSOProvider.mock.calls[0][0].body
     expect(sent.mapping).toBeUndefined() // not passed at the top level (silently ignored there)
@@ -529,7 +515,7 @@ describe('POST /api/auth/sso/register', () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
     queueProviders([]) // no providerId or domain conflicts on either pass
     queueTableRows(schemaMock.ssoProvider, [{ id: 'p1' }]) // provider already owned → edit
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     expect(res.status).toBe(200)
     const body = await res.json()
     expect(body.message).toContain('updated')
@@ -540,15 +526,15 @@ describe('POST /api/auth/sso/register', () => {
   it('allows the owning tenant to update its own provider for the same domain', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
     queueProviders([{ domain: 'acme.com', userId: 'u1', organizationId: 'org1' }])
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     expect(res.status).toBe(200)
     expect(mockRegisterSSOProvider).toHaveBeenCalledTimes(1)
   })
 
-  it('lets an org admin adopt their own user-scoped provider for the same domain', async () => {
+  it("does not report the caller's own org-less provider as another tenant's claim", async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
     queueProviders([{ domain: 'acme.com', userId: 'u1', organizationId: null }])
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     expect(res.status).toBe(200)
     expect(mockRegisterSSOProvider).toHaveBeenCalledTimes(1)
   })
@@ -556,14 +542,14 @@ describe('POST /api/auth/sso/register', () => {
   it("still blocks an org admin from claiming another user's user-scoped domain", async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
     queueProviders([{ domain: 'acme.com', userId: 'someone-else', organizationId: null }])
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     expect(res.status).toBe(409)
     expect(mockRegisterSSOProvider).not.toHaveBeenCalled()
   })
 
   it('normalizes the domain before persisting it', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
-    const res = await POST(request({ ...OIDC_BODY, domain: 'ACME.com', orgId: 'org1' }))
+    const res = await POST(request({ ...OIDC_BODY, domain: 'ACME.com' }))
     expect(res.status).toBe(200)
     expect(mockRegisterSSOProvider).toHaveBeenCalledTimes(1)
     const config = mockRegisterSSOProvider.mock.calls[0][0].body
@@ -572,7 +558,7 @@ describe('POST /api/auth/sso/register', () => {
 
   it('passes skipDiscovery since Sim already resolved and validated the OIDC endpoints', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     expect(res.status).toBe(200)
     const config = mockRegisterSSOProvider.mock.calls[0][0].body
     expect(config.oidcConfig.skipDiscovery).toBe(true)
@@ -580,7 +566,7 @@ describe('POST /api/auth/sso/register', () => {
 
   it('omits userInfoEndpoint when skipUserInfoEndpoint is requested, forcing ID token claims', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
-    const res = await POST(request({ ...OIDC_BODY, skipUserInfoEndpoint: true, orgId: 'org1' }))
+    const res = await POST(request({ ...OIDC_BODY, skipUserInfoEndpoint: true }))
     expect(res.status).toBe(200)
     const config = mockRegisterSSOProvider.mock.calls[0][0].body
     expect(config.oidcConfig.userInfoEndpoint).toBeUndefined()
@@ -594,7 +580,7 @@ describe('POST /api/auth/sso/register', () => {
       }
       return { isValid: true, resolvedIP: '1.2.3.4' }
     })
-    const res = await POST(request({ ...OIDC_BODY, skipUserInfoEndpoint: true, orgId: 'org1' }))
+    const res = await POST(request({ ...OIDC_BODY, skipUserInfoEndpoint: true }))
     expect(res.status).toBe(200)
     const config = mockRegisterSSOProvider.mock.calls[0][0].body
     expect(config.oidcConfig.userInfoEndpoint).toBeUndefined()
@@ -624,7 +610,7 @@ describe('POST /api/auth/sso/register', () => {
       jwksEndpoint: undefined,
       skipUserInfoEndpoint: true,
     }
-    const res = await POST(request({ ...discoveredBody, orgId: 'org1' }))
+    const res = await POST(request(discoveredBody))
     expect(res.status).toBe(200)
     const config = mockRegisterSSOProvider.mock.calls[0][0].body
     expect(config.oidcConfig.userInfoEndpoint).toBeUndefined()
@@ -632,7 +618,7 @@ describe('POST /api/auth/sso/register', () => {
 
   it('keeps userInfoEndpoint when skipUserInfoEndpoint is not requested', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     expect(res.status).toBe(200)
     const config = mockRegisterSSOProvider.mock.calls[0][0].body
     expect(config.oidcConfig.userInfoEndpoint).toBe('https://idp.acme.com/userinfo')
@@ -656,7 +642,7 @@ describe('POST /api/auth/sso/register', () => {
       tokenEndpoint: undefined,
       jwksEndpoint: undefined,
     }
-    const res = await POST(request({ ...discoveredBody, orgId: 'org1' }))
+    const res = await POST(request(discoveredBody))
     expect(res.status).toBe(200)
     const config = mockRegisterSSOProvider.mock.calls[0][0].body
     expect(config.oidcConfig.tokenEndpointAuthentication).toBe('client_secret_post')
@@ -670,7 +656,7 @@ describe('POST /api/auth/sso/register', () => {
         token_endpoint_auth_methods_supported: ['client_secret_post'],
       }),
     })
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     expect(res.status).toBe(200)
     const config = mockRegisterSSOProvider.mock.calls[0][0].body
     expect(config.oidcConfig.tokenEndpointAuthentication).toBe('client_secret_post')
@@ -680,7 +666,7 @@ describe('POST /api/auth/sso/register', () => {
   it('registers successfully when discovery is unreachable and all endpoints are explicit', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
     mockSecureFetchWithPinnedIP.mockRejectedValue(new Error('ECONNREFUSED'))
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     expect(res.status).toBe(200)
     const config = mockRegisterSSOProvider.mock.calls[0][0].body
     expect(config.oidcConfig.skipDiscovery).toBe(true)
@@ -696,7 +682,7 @@ describe('POST /api/auth/sso/register', () => {
         token_endpoint_auth_methods_supported: ['client_secret_basic', 'client_secret_post'],
       }),
     })
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     expect(res.status).toBe(200)
     const config = mockRegisterSSOProvider.mock.calls[0][0].body
     expect(config.oidcConfig.tokenEndpointAuthentication).toBe('client_secret_post')
@@ -708,7 +694,7 @@ describe('POST /api/auth/sso/register', () => {
       ok: true,
       json: async () => ({}),
     })
-    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1' }))
+    const res = await POST(request(OIDC_BODY))
     expect(res.status).toBe(200)
     const config = mockRegisterSSOProvider.mock.calls[0][0].body
     expect(config.oidcConfig.tokenEndpointAuthentication).toBe('client_secret_post')
@@ -728,7 +714,7 @@ describe('POST /api/auth/sso/register', () => {
       tokenEndpoint: undefined,
       jwksEndpoint: undefined,
     }
-    const res = await POST(request({ ...discoveredBody, orgId: 'org1' }))
+    const res = await POST(request(discoveredBody))
     const json = await res.json()
     expect(res.status).toBe(400)
     expect(json.error).toContain('resolves to a private IP address')
diff --git a/apps/sim/app/api/auth/sso/register/route.ts b/apps/sim/app/api/auth/sso/register/route.ts
index c4991dc4271..913eccc4386 100644
--- a/apps/sim/app/api/auth/sso/register/route.ts
+++ b/apps/sim/app/api/auth/sso/register/route.ts
@@ -2,13 +2,14 @@ import { db, member, ssoDomain, ssoProvider } from '@sim/db'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, getPostgresConstraintName } from '@sim/utils/errors'
 import { normalizeSSODomain } from '@sim/utils/sso-domain'
-import { and, eq, isNull, sql } from 'drizzle-orm'
+import { and, eq, sql } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { ssoRegistrationContract } from '@/lib/api/contracts/auth'
 import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
 import { auth, getSession } from '@/lib/auth'
 import { hasSSOAccess } from '@/lib/billing'
-import { isHosted, isSsoEnabled } from '@/lib/core/config/env-flags'
+import { isSsoEnabled } from '@/lib/core/config/env-flags'
+import { runWithOutboundOrganization } from '@/lib/core/network/context.server'
 import {
   secureFetchWithPinnedIP,
   validateUrlWithDNS,
@@ -116,18 +117,20 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     const body = parsed.data.body
     const { providerId, issuer, providerType, mapping, orgId, jitProvisioningEnabled } = body
 
-    if (orgId) {
-      const [membership] = await db
-        .select({ organizationId: member.organizationId, role: member.role })
-        .from(member)
-        .where(and(eq(member.userId, session.user.id), eq(member.organizationId, orgId)))
-        .limit(1)
-      if (!membership) {
-        return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
-      }
-      if (membership.role !== 'owner' && membership.role !== 'admin') {
-        return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
-      }
+    /**
+     * Always org-scoped: an org-less provider has no `sso_domain` proof, so only
+     * operators create one, via `packages/db/scripts/register-sso-provider.ts`.
+     */
+    const [membership] = await db
+      .select({ organizationId: member.organizationId, role: member.role })
+      .from(member)
+      .where(and(eq(member.userId, session.user.id), eq(member.organizationId, orgId)))
+      .limit(1)
+    if (!membership) {
+      return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+    }
+    if (membership.role !== 'owner' && membership.role !== 'admin') {
+      return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
     }
 
     const domain = normalizeSSODomain(body.domain)
@@ -142,20 +145,19 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     /**
      * Configuring org SSO for a domain requires DNS-proven ownership; without it
      * a first-come claim lets any org wire another company's domain to their own
-     * IdP. Migration 0266 grandfathered existing domains. Org-less SSO is not gated.
+     * IdP. Migration 0266 grandfathered existing domains.
      */
+    const verifiedDomainClause = and(
+      eq(ssoDomain.organizationId, orgId),
+      eq(ssoDomain.domain, domain),
+      eq(ssoDomain.status, 'verified')
+    )
+
     const isOrgDomainVerified = async (): Promise<boolean> => {
-      if (!orgId) return true
       const [verified] = await db
         .select({ id: ssoDomain.id })
         .from(ssoDomain)
-        .where(
-          and(
-            eq(ssoDomain.organizationId, orgId),
-            eq(ssoDomain.domain, domain),
-            eq(ssoDomain.status, 'verified')
-          )
-        )
+        .where(verifiedDomainClause)
         .limit(1)
       return Boolean(verified)
     }
@@ -173,13 +175,21 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     // window where the proof is removed while discovery is in flight.
     if (!(await isOrgDomainVerified())) return domainNotVerifiedResponse()
 
+    /**
+     * An org-less provider the caller created counts as theirs, so its claim on
+     * a domain is not reported as another tenant's.
+     */
     const isOwnedByCaller = (provider: {
       userId: string | null
       organizationId: string | null
-    }): boolean => {
-      if (provider.userId === session.user.id && !provider.organizationId) return true
-      return orgId ? provider.organizationId === orgId : false
-    }
+    }): boolean =>
+      provider.organizationId === orgId ||
+      (provider.userId === session.user.id && !provider.organizationId)
+
+    const ownerClause = and(
+      eq(ssoProvider.providerId, providerId),
+      eq(ssoProvider.organizationId, orgId)
+    )
 
     /**
      * Refuses the domain when another tenant has claimed it, or when the caller
@@ -236,10 +246,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     const findProviderIdConflict = async () =>
       (
         await db
-          .select({
-            userId: ssoProvider.userId,
-            organizationId: ssoProvider.organizationId,
-          })
+          .select({ userId: ssoProvider.userId, organizationId: ssoProvider.organizationId })
           .from(ssoProvider)
           .where(eq(ssoProvider.providerId, providerId))
       ).find((provider) => !isOwnedByCaller(provider))
@@ -274,7 +281,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       providerId,
       issuer,
       domain,
-      ...(orgId ? { organizationId: orgId } : {}),
+      organizationId: orgId,
     }
 
     if (providerType === 'oidc') {
@@ -292,13 +299,6 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
       let clientSecret = rawClientSecret
       if (rawClientSecret === REDACTED_MARKER) {
-        const ownerClause = orgId
-          ? and(eq(ssoProvider.providerId, providerId), eq(ssoProvider.organizationId, orgId))
-          : and(
-              eq(ssoProvider.providerId, providerId),
-              eq(ssoProvider.userId, session.user.id),
-              isNull(ssoProvider.organizationId)
-            )
         const [existing] = await db
           .select({ oidcConfig: ssoProvider.oidcConfig })
           .from(ssoProvider)
@@ -370,7 +370,9 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         !oidcConfig.authorizationEndpoint || !oidcConfig.tokenEndpoint || !oidcConfig.jwksEndpoint
 
       const discoveryUrl = `${issuer.replace(/\/$/, '')}/.well-known/openid-configuration`
-      const discoveryResult = await fetchOIDCDiscoveryDocument(discoveryUrl)
+      const discoveryResult = await runWithOutboundOrganization(membership.organizationId, () =>
+        fetchOIDCDiscoveryDocument(discoveryUrl)
+      )
 
       if (needsDiscovery) {
         logger.info('Fetching OIDC discovery document for missing endpoints', {
@@ -632,18 +634,6 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     // edit through updateSSOProvider so re-saving an SSO config works instead of
     // failing. The verification gate above already ran against the target domain,
     // so an edit that moves SSO to an unverified domain is still blocked.
-    // The personal branch MUST require a null org: org providers store
-    // userId = their creator, so without it an org admin could send a
-    // personal-mode request (which skips the membership check and the
-    // verification gate) yet still match — and then update — their org's
-    // provider, moving it to an unverified domain. Mirrors isOwnedByCaller.
-    const ownerClause = orgId
-      ? and(eq(ssoProvider.providerId, providerId), eq(ssoProvider.organizationId, orgId))
-      : and(
-          eq(ssoProvider.providerId, providerId),
-          eq(ssoProvider.userId, session.user.id),
-          isNull(ssoProvider.organizationId)
-        )
     // Config columns are captured, not just the id: an update whose trust grant is
     // refused has to be undone, or the rejected config stays stored and goes live
     // the moment the domain is verified again.
@@ -668,29 +658,13 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
      * UPDATE waits can still grant trust after ownership is gone. `FOR SHARE`
      * orders the two — the delete blocks until this commits, and if it committed
      * first the SELECT finds nothing.
-     *
-     * Org-less SSO is self-host-only (Sim's UI always registers org-scoped) and
-     * has no proof behind it, so it is trusted only when self-hosted.
      */
-    const grantProviderDomainTrust = async (): Promise<boolean> => {
-      if (!orgId) {
-        await db
-          .update(ssoProvider)
-          .set({ domainVerified: !isHosted, jitProvisioningEnabled })
-          .where(ownerClause)
-        return true
-      }
-      return db.transaction(async (tx) => {
+    const grantProviderDomainTrust = (): Promise<boolean> =>
+      db.transaction(async (tx) => {
         const [proof] = await tx
           .select({ id: ssoDomain.id })
           .from(ssoDomain)
-          .where(
-            and(
-              eq(ssoDomain.organizationId, orgId),
-              eq(ssoDomain.domain, domain),
-              eq(ssoDomain.status, 'verified')
-            )
-          )
+          .where(verifiedDomainClause)
           .limit(1)
           .for('share')
         if (!proof) return false
@@ -702,7 +676,6 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
           .returning({ id: ssoProvider.id })
         return granted.length > 0
       })
-    }
 
     if (existingOwnedProvider) {
       const revertProviderUpdate = async (): Promise<void> => {
@@ -784,12 +757,10 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       // registerSSOProvider spreads the created row's `id` at runtime, but the
       // typed return omits it — read it defensively and only delete when it's a
       // real id, so a future shape change can't turn the rollback into a silent
-      // no-op that leaves a provider on an unverified domain. `orgId` is checked
-      // only to narrow it: the org-less path grants unconditionally, so a refused
-      // grant always means an org-scoped registration.
+      // no-op that leaves a provider on an unverified domain.
       // double-cast-allowed: Better Auth's return type omits the runtime `id`
       const createdRowId = (registration as unknown as { id?: unknown }).id
-      if (orgId && typeof createdRowId === 'string' && createdRowId.length > 0) {
+      if (typeof createdRowId === 'string' && createdRowId.length > 0) {
         await db
           .delete(ssoProvider)
           .where(and(eq(ssoProvider.id, createdRowId), eq(ssoProvider.organizationId, orgId)))
diff --git a/apps/sim/app/api/knowledge/member-connectors/route.ts b/apps/sim/app/api/knowledge/member-connectors/route.ts
index 4467c3ec35e..3b7d453ea6e 100644
--- a/apps/sim/app/api/knowledge/member-connectors/route.ts
+++ b/apps/sim/app/api/knowledge/member-connectors/route.ts
@@ -12,7 +12,9 @@ export const GET = defineInternalJsonRoute({
   contract: listWorkspaceMemberConnectorsContract,
   auth: internalSessionAuth,
   operation: knowledgeOperations.listWorkspaceMemberConnectors,
-  rateLimit: internalRateLimits.none({ reason: 'One small read per visit to the Search tab' }),
+  rateLimit: internalRateLimits.none({
+    reason: 'Preserve existing internal connector listing behavior',
+  }),
   errorPolicy: internalKnowledgeErrorPolicies.connectors,
   mapInput: ({ query }) => ({ workspaceId: query.workspaceId }),
   useCase: listWorkspaceMemberConnectors,
diff --git a/apps/sim/app/api/knowledge/search/route.test.ts b/apps/sim/app/api/knowledge/search/route.test.ts
index e02b67e4203..445fe171c63 100644
--- a/apps/sim/app/api/knowledge/search/route.test.ts
+++ b/apps/sim/app/api/knowledge/search/route.test.ts
@@ -19,7 +19,11 @@ describe('workspace search route', () => {
       user: { id: 'user-1', email: 'reader@fixture.test', name: 'Reader' },
       session: { id: 'session-1' },
     })
-    mocks.search.mockResolvedValue({ results: [], knowledgeBases: [] })
+    mocks.search.mockResolvedValue({
+      results: [],
+      knowledgeBases: [],
+      retrieval: { status: 'complete', timedOutLegs: [] },
+    })
   })
 
   it('passes the authenticated request cancellation signal through the existing operation', async () => {
@@ -41,11 +45,49 @@ describe('workspace search route', () => {
     expect(call.input).not.toHaveProperty('knowledgeBaseIds')
     expect(call.input.filters).toEqual({ source: 'slack', documentIds: ['doc-1'] })
     expect(call.input.signal).toBe(request.signal)
+    expect(call.input.allowPartialResults).toBe(true)
+    expect(call.input.vectorBudgetMs).toBe(3000)
     controller.abort()
     expect(call.input.signal.aborted).toBe(true)
     await expect(response.json()).resolves.toEqual({
       success: true,
-      data: { query: 'Orion', results: [] },
+      data: { query: 'Orion', results: [], retrieval: { status: 'complete', timedOutLegs: [] } },
+    })
+  })
+
+  it('preserves usable matches and incomplete coverage when one retrieval leg times out', async () => {
+    mocks.search.mockResolvedValueOnce({
+      knowledgeBases: [{ id: 'knowledge-1', name: 'Search index' }],
+      retrieval: { status: 'partial', timedOutLegs: ['vector'] },
+      results: [
+        {
+          documentId: 'document-1',
+          knowledgeBaseId: 'knowledge-1',
+          documentName: 'Release plan',
+          sourceUrl: null,
+          connectorType: null,
+          sourceModifiedAt: null,
+          metadata: {},
+          content: 'Orion release',
+          chunkIndex: 0,
+          similarity: 0.9,
+        },
+      ],
+    })
+    const response = await POST(
+      new NextRequest('http://localhost/api/knowledge/search', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ organizationId: 'organization-1', query: 'Orion' }),
+      })
+    )
+    expect(response.status).toBe(200)
+    await expect(response.json()).resolves.toMatchObject({
+      success: true,
+      data: {
+        results: [{ documentId: 'document-1', content: 'Orion release' }],
+        retrieval: { status: 'partial', timedOutLegs: ['vector'] },
+      },
     })
   })
 
diff --git a/apps/sim/app/api/knowledge/search/route.ts b/apps/sim/app/api/knowledge/search/route.ts
index cc9ae79fb8b..b1db5e04d39 100644
--- a/apps/sim/app/api/knowledge/search/route.ts
+++ b/apps/sim/app/api/knowledge/search/route.ts
@@ -9,6 +9,8 @@ import { knowledgeOperations } from '@/lib/knowledge/application/operations'
 import { searchScopedKnowledge } from '@/lib/knowledge/application/workspace-search'
 import { sourceAuthor } from '@/lib/knowledge/search/author'
 
+const DIRECT_SEARCH_VECTOR_BUDGET_MS = 3000
+
 export const POST = defineInternalJsonRoute({
   contract: searchWorkspaceKnowledgeContract,
   auth: internalSessionAuth,
@@ -24,16 +26,19 @@ export const POST = defineInternalJsonRoute({
     filters: body.filters,
     query: body.query,
     topK: body.topK,
+    allowPartialResults: true,
+    vectorBudgetMs: DIRECT_SEARCH_VECTOR_BUDGET_MS,
     surface: 'dashboard' as const,
     signal: request.signal,
   }),
   useCase: searchScopedKnowledge,
-  present: ({ results, knowledgeBases }, { input }) => {
+  present: ({ results, knowledgeBases, retrieval }, { input }) => {
     const knowledgeBaseNames = new Map(knowledgeBases.map((kb) => [kb.id, kb.name]))
     return {
       success: true as const,
       data: {
         query: input.query ?? '',
+        retrieval,
         results: results.map((result) => ({
           documentId: result.documentId,
           knowledgeBaseId: result.knowledgeBaseId,
diff --git a/apps/sim/app/api/link-preview/route.ts b/apps/sim/app/api/link-preview/route.ts
index 8aaba14c0db..27e810a593a 100644
--- a/apps/sim/app/api/link-preview/route.ts
+++ b/apps/sim/app/api/link-preview/route.ts
@@ -10,6 +10,7 @@ import { getLinkPreviewContract } from '@/lib/api/contracts/link-preview'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { getRedisClient } from '@/lib/core/config/redis'
+import { runWithOutboundOrganization } from '@/lib/core/network/context.server'
 import { enforceUserRateLimit } from '@/lib/core/rate-limiter/route-helpers'
 import { secureFetchWithValidation } from '@/lib/core/security/input-validation.server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
@@ -104,7 +105,8 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
 
   let preview: LinkPreview = null
   try {
-    preview = await fetchPreview(url)
+    /** Link previews have no organization owner and use a shared URL cache. */
+    preview = await runWithOutboundOrganization(null, () => fetchPreview(url))
   } catch (error) {
     logger.info('Link preview fetch failed; returning null preview', {
       host: new URL(url).hostname,
diff --git a/apps/sim/app/api/mcp/oauth/callback/route.ts b/apps/sim/app/api/mcp/oauth/callback/route.ts
index dd31f4a24b2..6b7655ec2b0 100644
--- a/apps/sim/app/api/mcp/oauth/callback/route.ts
+++ b/apps/sim/app/api/mcp/oauth/callback/route.ts
@@ -8,6 +8,7 @@ import { NextResponse } from 'next/server'
 import { mcpOauthCallbackContract } from '@/lib/api/contracts/mcp'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
+import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { credentialGroupOAuthAttemptPrincipal } from '@/lib/credential-groups/application/enrollment-auth'
 import { completePublicCredentialGroupMcpOAuth } from '@/lib/credential-groups/application/public-enrollment'
@@ -238,11 +239,10 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
     const provider = new SimMcpOauthProvider({ row, preregistered })
     let result: Awaited<ReturnType<typeof mcpAuthGuarded>>
     try {
-      result = await timedStep('mcpAuthGuarded', 120_000, () =>
-        mcpAuthGuarded(provider, {
-          serverUrl,
-          authorizationCode: code,
-        })
+      result = await withResourceOutboundScope({ workspaceId: serverWorkspaceId }, () =>
+        timedStep('mcpAuthGuarded', 120_000, () =>
+          mcpAuthGuarded(provider, { serverUrl, authorizationCode: code })
+        )
       )
     } catch (e) {
       logger.error('Token exchange failed during MCP OAuth callback', e)
@@ -267,7 +267,9 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
     try {
       // forceRefresh: skip any stale cache from before re-auth.
       await timedStep('discoverServerTools', 60_000, () =>
-        mcpService.discoverServerTools(session.user.id, server.id, serverWorkspaceId, 'force')
+        withResourceOutboundScope({ workspaceId: serverWorkspaceId }, () =>
+          mcpService.discoverServerTools(session.user.id, server.id, serverWorkspaceId, 'force')
+        )
       )
     } catch (e) {
       logger.warn('Post-auth tools refresh failed', toError(e).message)
diff --git a/apps/sim/app/api/organizations/[id]/data-drains/[drainId]/test/route.ts b/apps/sim/app/api/organizations/[id]/data-drains/[drainId]/test/route.ts
index 5550ff9eb4c..c14d01b3c02 100644
--- a/apps/sim/app/api/organizations/[id]/data-drains/[drainId]/test/route.ts
+++ b/apps/sim/app/api/organizations/[id]/data-drains/[drainId]/test/route.ts
@@ -4,6 +4,7 @@ import { toError } from '@sim/utils/errors'
 import { type NextRequest, NextResponse } from 'next/server'
 import { testDataDrainContract } from '@/lib/api/contracts/data-drains'
 import { parseRequest } from '@/lib/api/server'
+import { runWithOutboundOrganization } from '@/lib/core/network/context.server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { authorizeDrainAccess, loadDrain } from '@/lib/data-drains/access'
 import { getDestination } from '@/lib/data-drains/destinations/registry'
@@ -29,7 +30,8 @@ export const POST = withRouteHandler(async (request: NextRequest, context: Route
   }
 
   const destination = getDestination(drain.destinationType)
-  if (!destination.test) {
+  const testConnection = destination.test
+  if (!testConnection) {
     return NextResponse.json(
       { error: `Destination '${drain.destinationType}' does not support connection testing` },
       { status: 400 }
@@ -44,7 +46,9 @@ export const POST = withRouteHandler(async (request: NextRequest, context: Route
   const controller = new AbortController()
   const timeout = setTimeout(() => controller.abort(), TEST_TIMEOUT_MS)
   try {
-    await destination.test({ config, credentials, signal: controller.signal })
+    await runWithOutboundOrganization(drain.organizationId, () =>
+      testConnection({ config, credentials, signal: controller.signal })
+    )
     recordAudit({
       workspaceId: null,
       actorId: access.session.user.id,
diff --git a/apps/sim/app/api/organizations/[id]/network/route.ts b/apps/sim/app/api/organizations/[id]/network/route.ts
new file mode 100644
index 00000000000..a6e87d2cb75
--- /dev/null
+++ b/apps/sim/app/api/organizations/[id]/network/route.ts
@@ -0,0 +1,24 @@
+import { getOrganizationNetworkContract } from '@/lib/api/contracts/organization-network'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import {
+  readOrganizationNetwork,
+  readOrganizationNetworkOperation,
+} from '@/lib/core/network/application/read-organization-network'
+
+export const dynamic = 'force-dynamic'
+
+export const GET = defineInternalJsonRoute({
+  contract: getOrganizationNetworkContract,
+  auth: internalSessionAuth,
+  operation: readOrganizationNetworkOperation,
+  rateLimit: internalRateLimits.user({ bucketName: 'organization-network-read' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ params }) => ({ organizationId: params.id }),
+  useCase: readOrganizationNetwork,
+  staticResponseHeaders: { 'Cache-Control': 'private, no-store' },
+})
diff --git a/apps/sim/app/api/v2/knowledge/search/route.provenance.test.ts b/apps/sim/app/api/v2/knowledge/search/route.provenance.test.ts
index 3971a4c4ca5..7e847cb2797 100644
--- a/apps/sim/app/api/v2/knowledge/search/route.provenance.test.ts
+++ b/apps/sim/app/api/v2/knowledge/search/route.provenance.test.ts
@@ -59,7 +59,10 @@ vi.mock('@/lib/knowledge/embeddings', () => ({
 
 vi.mock('@/lib/knowledge/search/queries', () => ({
   generateSearchEmbedding: mocks.generateEmbedding,
-  executeKnowledgeSearch: mocks.executeSearch,
+  retrieveKnowledgeSearch: async (...args: unknown[]) => ({
+    rows: await mocks.executeSearch(...args),
+    retrieval: { status: 'complete', timedOutLegs: [] },
+  }),
   getDocumentMetadataByIds: mocks.getDocumentMetadata,
 }))
 
diff --git a/apps/sim/app/credential-groups/enroll/[token]/page.test.tsx b/apps/sim/app/credential-groups/enroll/[token]/page.test.tsx
index 2ef014a73a6..39bfb5f40e5 100644
--- a/apps/sim/app/credential-groups/enroll/[token]/page.test.tsx
+++ b/apps/sim/app/credential-groups/enroll/[token]/page.test.tsx
@@ -225,9 +225,9 @@ describe('focused Search enrollment', () => {
     expect(document.querySelector('form')).toBeNull()
     expect(
       Array.from(document.querySelectorAll('a'))
-        .find((link) => link.textContent === 'Return to Search')
+        .find((link) => link.textContent === 'Open knowledge bases')
         ?.getAttribute('href')
-    ).toBe('/workspace/canonical-workspace/search')
+    ).toBe('/workspace/canonical-workspace/knowledge')
     expect(document.body.textContent).not.toContain('Setup guide')
     expect(mocks.read).toHaveBeenCalledWith({ principal, input: { optionId: 'site-two' } })
   })
@@ -243,7 +243,7 @@ describe('focused Search enrollment', () => {
       expect(document.body.textContent).toContain('Ask an admin')
       expect(oauthLinks()).toHaveLength(0)
       expect(document.querySelector('form')).toBeNull()
-      expect(document.body.textContent).toContain('Return to Search')
+      expect(document.body.textContent).toContain('Open knowledge bases')
     }
   )
 
@@ -255,7 +255,7 @@ describe('focused Search enrollment', () => {
     expect(document.body.textContent).toContain('Connection unavailable')
     expect(document.body.textContent).toContain('Ask an admin')
     expect(document.querySelector('a')?.getAttribute('href')).toBe(
-      '/workspace/canonical-workspace/search'
+      '/workspace/canonical-workspace/knowledge'
     )
   })
 
@@ -274,7 +274,7 @@ describe('focused Search enrollment', () => {
     expect(document.querySelector('h1')?.textContent).toBe('Confluence connected')
     expect(oauthLinks()).toHaveLength(0)
     expect(document.querySelector('form')).toBeNull()
-    expect(document.body.textContent).toContain('Return to Search')
+    expect(document.body.textContent).toContain('Open knowledge bases')
   })
 
   it('does not treat a success query marker as a connected account', async () => {
diff --git a/apps/sim/app/credential-groups/enroll/[token]/page.tsx b/apps/sim/app/credential-groups/enroll/[token]/page.tsx
index c819e8c122a..4550345da53 100644
--- a/apps/sim/app/credential-groups/enroll/[token]/page.tsx
+++ b/apps/sim/app/credential-groups/enroll/[token]/page.tsx
@@ -184,8 +184,12 @@ export default async function CredentialGroupEnrollmentPage({
   const canReturnToSearch =
     returnToSearch &&
     ('canSearch' in enrollmentResult ? enrollmentResult.canSearch : !principal.organizationId)
-  const returnHref = canReturnToSearch ? searchReturnPath(principal) : APP_ENTRY_PATH
-  const returnLabel = canReturnToSearch ? 'Return to Search' : 'Open Sim'
+  const returnHref = canReturnToSearch ? sourceReturnPath(principal) : APP_ENTRY_PATH
+  const returnLabel = canReturnToSearch
+    ? principal.organizationId
+      ? 'Return to Search'
+      : 'Open knowledge bases'
+    : 'Open Sim'
   if (!enrollment)
     return <UnavailableSearchConnection returnHref={returnHref} returnLabel={returnLabel} />
 
@@ -328,9 +332,9 @@ export default async function CredentialGroupEnrollmentPage({
   )
 }
 
-function searchReturnPath(owner: ResourceOwner): string {
+function sourceReturnPath(owner: ResourceOwner): string {
   const scope = resourceScopeFromOwner(owner)
   return scope.kind === 'workspace'
-    ? `/workspace/${encodeURIComponent(scope.workspaceId)}/search`
+    ? `/workspace/${encodeURIComponent(scope.workspaceId)}/knowledge`
     : organizationRoutes(scope.organizationId).search
 }
diff --git a/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-footer/organization-footer.test.tsx b/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-footer/organization-footer.test.tsx
index 8a39e94a9fe..0d1077648d7 100644
--- a/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-footer/organization-footer.test.tsx
+++ b/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-footer/organization-footer.test.tsx
@@ -5,19 +5,27 @@ import { act, type ComponentProps } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockNavigate, mockPush } = vi.hoisted(() => ({
+const { mockNavigate, mockPush, context } = vi.hoisted(() => ({
   mockNavigate: vi.fn(),
   mockPush: vi.fn(),
+  context: {
+    organization: { id: 'org-1' },
+  },
 }))
 
 vi.mock('next/navigation', () => ({
   useRouter: () => ({ push: mockPush }),
+  usePathname: () => '/o/org-1/home',
 }))
 vi.mock('next/link', () => ({
   default: ({
     onNavigate,
+    prefetch: _prefetch,
     ...props
-  }: ComponentProps<'a'> & { onNavigate?: (event: { preventDefault: () => void }) => void }) => (
+  }: ComponentProps<'a'> & {
+    prefetch?: boolean
+    onNavigate?: (event: { preventDefault: () => void }) => void
+  }) => (
     <a
       {...props}
       href={props.href}
@@ -34,6 +42,7 @@ vi.mock('next/link', () => ({
     />
   ),
 }))
+vi.mock('@/lib/auth/sign-out', () => ({ signOutAndRedirect: vi.fn() }))
 vi.mock('@/lib/desktop', () => ({ getDesktopUpdates: () => null }))
 vi.mock('@/hooks/use-desktop-update-state', () => ({
   useDesktopUpdateState: () => ({ status: 'idle' }),
@@ -42,12 +51,14 @@ vi.mock('@/hooks/queries/user-profile', () => ({
   useUserProfile: () => ({ data: { id: 'user-1', name: 'Ada', email: 'ada@example.com' } }),
 }))
 vi.mock('@/app/o/[organizationId]/providers/organization-provider', () => ({
-  useOrganizationContext: () => ({ organization: { id: 'org-1' } }),
+  useOrganizationContext: () => context,
 }))
 vi.mock('@/app/workspace/[workspaceId]/w/components/sidebar/components', () => ({
   SidebarTooltip: ({ children }: { children: React.ReactNode }) => children,
 }))
-vi.mock('@/components/icons', () => ({ SlackIcon: () => <svg /> }))
+vi.mock('@/components/icons', () => ({
+  SlackIcon: () => <svg />,
+}))
 
 import { OrganizationFooter } from '@/app/o/[organizationId]/components/organization-sidebar/components/organization-footer/organization-footer'
 import { useSettingsDirtyStore } from '@/stores/settings/dirty/store'
@@ -71,7 +82,7 @@ afterEach(async () => {
   vi.unstubAllGlobals()
 })
 
-async function selectSettings() {
+async function openProfileMenu() {
   await act(async () => {
     root.render(
       <OrganizationFooter
@@ -80,6 +91,7 @@ async function selectSettings() {
         showCollapsedTooltips={false}
         onOpenDocs={() => {}}
         onJoinSlack={() => {}}
+        onContactSupport={() => {}}
       />
     )
   })
@@ -88,15 +100,27 @@ async function selectSettings() {
   await act(async () => {
     trigger.dispatchEvent(new MouseEvent('pointerdown', { bubbles: true, button: 0 }))
   })
+}
+
+async function selectSettings() {
+  await openProfileMenu()
   const link = document.querySelector<HTMLAnchorElement>('a[href="/o/org-1/settings/general"]')
   if (!link) throw new Error('Settings link is missing')
   await act(async () => link.click())
 }
 
 describe('OrganizationFooter settings navigation', () => {
+  it('keeps only Settings and Sign out in the organization profile menu', async () => {
+    await openProfileMenu()
+    expect(
+      [...document.querySelectorAll('[role="menuitem"]')].map((item) => item.textContent)
+    ).toEqual(['Settings', 'Sign out'])
+    expect(document.querySelector('[role="separator"]')).toBeNull()
+  })
+
   it('navigates immediately when settings are clean', async () => {
     await selectSettings()
-    expect(mockNavigate).toHaveBeenCalledWith('/o/org-1/settings/general')
+    expect(mockPush).toHaveBeenCalledWith('/o/org-1/settings/general')
     expect(useSettingsDirtyStore.getState().pendingLeave).toBeNull()
   })
 
diff --git a/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-footer/organization-footer.tsx b/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-footer/organization-footer.tsx
index ecc37a12e01..125ab4202af 100644
--- a/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-footer/organization-footer.tsx
+++ b/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-footer/organization-footer.tsx
@@ -1,242 +1,28 @@
 'use client'
 
-import type { DesktopUpdateState } from '@sim/desktop-bridge'
-import {
-  Chip,
-  chipContentLabelClass,
-  chipPrimaryFillTokens,
-  chipVariants,
-  cn,
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuItemLabel,
-  DropdownMenuSeparator,
-  DropdownMenuTrigger,
-  OverflowText,
-  Skeleton,
-} from '@sim/emcn'
-import { BookOpen, Download, HelpCircle, Settings } from '@sim/emcn/icons'
-import { SlackIcon } from '@/components/icons'
-import { SettingsGuardedLink } from '@/components/settings/settings-guarded-link'
-import { getDesktopUpdates } from '@/lib/desktop'
+import type { ComponentProps } from 'react'
+import { useRouter } from 'next/navigation'
 import { organizationRoutes } from '@/lib/navigation/paths'
-import { getUserColor } from '@/lib/workspaces/colors'
 import { useOrganizationContext } from '@/app/o/[organizationId]/providers/organization-provider'
-import { SidebarTooltip } from '@/app/workspace/[workspaceId]/w/components/sidebar/components'
-import {
-  SIDEBAR_ITEM_GAP_CLASS,
-  SIDEBAR_RAIL_CHIP_CLASS,
-} from '@/app/workspace/[workspaceId]/w/components/sidebar/constants'
-import { useUserProfile } from '@/hooks/queries/user-profile'
-import { useDesktopUpdateState } from '@/hooks/use-desktop-update-state'
+import { SidebarFooter } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/sidebar-footer/sidebar-footer'
 
-function hasAvailableDesktopUpdate(state: DesktopUpdateState): boolean {
-  return state.status === 'available' || state.status === 'downloading' || state.status === 'ready'
-}
-
-function desktopUpdateActionLabel(state: DesktopUpdateState): string {
-  if (state.status === 'downloading') {
-    return state.percent === undefined
-      ? 'Downloading update…'
-      : `Downloading update ${state.percent}%`
-  }
-  return state.status === 'ready' ? 'Restart to update' : 'Update'
-}
-
-/** Compact primary update circle using the same footprint as the surrounding sidebar icons. */
-function DesktopUpdateIcon({ className }: { className?: string }) {
-  return (
-    <div
-      className={cn(
-        className,
-        'flex size-[17px] shrink-0 items-center justify-center rounded-full',
-        chipPrimaryFillTokens
-      )}
-    >
-      {/* Download's default viewBox is asymmetric around its paths. Center the
-          artwork itself, not merely its SVG box, inside the avatar-sized circle. */}
-      <Download className='size-[11px]' viewBox='-1.75 -1.75 24 24' />
-    </div>
-  )
-}
+interface OrganizationFooterProps
+  extends Omit<
+    ComponentProps<typeof SidebarFooter>,
+    'accountSettingsHref' | 'onOpenAccountSettings' | 'navigationLinks'
+  > {}
 
-interface OrganizationFooterProps {
-  /**
-   * True while the scroll region above still hides rows beyond its bottom edge —
-   * the same test the divider under the pinned nav applies at the top. The bar's
-   * top rule is drawn only then, so a list that fits meets the footer with no line.
-   */
-  showDivider: boolean
-  isCollapsed: boolean
-  showCollapsedTooltips: boolean
-  onOpenDocs: () => void
-  onJoinSlack: () => void
-}
-
-/**
- * Pinned bottom bar of the organization sidebar: the viewer's avatar and name,
- * which open their account settings, plus a help menu. Same two elements and the
- * same layout as the workspace footer — expanded they share one row with help hard
- * right, collapsed they stack as icon chips with help on top.
- *
- * Collapsed reverses the flex direction instead of reordering the DOM, which keeps
- * both elements (and the help menu's trigger) alive across a toggle.
- */
-export function OrganizationFooter({
-  showDivider,
-  isCollapsed,
-  showCollapsedTooltips,
-  onOpenDocs,
-  onJoinSlack,
-}: OrganizationFooterProps) {
+export function OrganizationFooter(props: OrganizationFooterProps) {
   const { organization } = useOrganizationContext()
-  const { data: profile } = useUserProfile()
-  const updateState = useDesktopUpdateState()
-
-  const name = profile ? profile.name?.trim() || profile.email : ''
-  const updateAvailable = hasAvailableDesktopUpdate(updateState)
-
-  const handleUpdateSelect = () => {
-    const updates = getDesktopUpdates()
-    if (updateState.status === 'ready') {
-      updates?.install()
-    } else if (updateState.status === 'available') {
-      updates?.check()
-    }
-  }
-
-  /**
-   * Plain `img`/`div` rather than the emcn `Avatar`, whose Radix root renders a
-   * `<span>` — and globals fade every `span` in the collapsed rail to `opacity: 0`,
-   * which would blank the avatar exactly where it is the only thing left to see.
-   */
-  const avatar = !profile ? (
-    <Skeleton className='size-[16px] shrink-0 rounded-full' />
-  ) : profile.image ? (
-    <img
-      src={profile.image}
-      alt=''
-      referrerPolicy='no-referrer'
-      className='size-[16px] shrink-0 rounded-full object-cover'
-    />
-  ) : (
-    <div
-      className='flex size-[16px] shrink-0 items-center justify-center rounded-full text-[9px] text-white leading-none'
-      style={{ backgroundColor: getUserColor(profile.id) }}
-    >
-      {name.charAt(0).toUpperCase()}
-    </div>
-  )
-
-  /**
-   * Expanded, the chip hugs its content (`max-w-full` so a long name truncates
-   * rather than overflowing); collapsed, `fullWidth` fills the narrow rail and
-   * `min-w-0` lets the hidden label give up its box so the chip never overflows it.
-   * The name is the button's accessible name — no `aria-label`, which would
-   * override the visible text.
-   */
-  const profileMenu = (
-    <DropdownMenu>
-      <SidebarTooltip label={name} enabled={showCollapsedTooltips && Boolean(name)}>
-        <DropdownMenuTrigger asChild>
-          <button
-            type='button'
-            data-item-id='profile'
-            className={cn(
-              chipVariants({ fullWidth: isCollapsed }),
-              isCollapsed ? 'min-w-0' : 'max-w-full',
-              SIDEBAR_RAIL_CHIP_CLASS
-            )}
-          >
-            {avatar}
-            {profile ? (
-              <OverflowText
-                label={name}
-                className={cn('sidebar-collapse-hide flex-1', chipContentLabelClass)}
-                tooltipEnabled={!isCollapsed && !showCollapsedTooltips}
-                focusTarget='nearest-interactive'
-              />
-            ) : (
-              /* Fixed width — the chip hugs its content, so a flexible bar would collapse to nothing. */
-              <Skeleton className='sidebar-collapse-hide h-[14px] w-[96px] rounded-sm' />
-            )}
-          </button>
-        </DropdownMenuTrigger>
-      </SidebarTooltip>
-      <DropdownMenuContent align='start' side='top' sideOffset={4}>
-        <DropdownMenuItem asChild>
-          <SettingsGuardedLink
-            href={organizationRoutes(organization.id).settingsSection('general')}
-          >
-            <Settings className='size-[14px]' />
-            <DropdownMenuItemLabel label='Settings' />
-          </SettingsGuardedLink>
-        </DropdownMenuItem>
-      </DropdownMenuContent>
-    </DropdownMenu>
-  )
-
-  /**
-   * One node across both states; only `fullWidth` changes, so the same Radix menu
-   * survives the transition. `shrink-0` keeps the chip off the avatar while the rail
-   * is briefly narrower than the row — the aside's clip hides it until there is room.
-   */
-  const helpMenu = (
-    <DropdownMenu>
-      <SidebarTooltip
-        label={updateAvailable ? 'Help — update available' : 'Help'}
-        enabled={showCollapsedTooltips}
-      >
-        <DropdownMenuTrigger asChild>
-          <Chip
-            data-item-id='help'
-            aria-label={updateAvailable ? 'Help, update available' : 'Help'}
-            leftIcon={updateAvailable ? DesktopUpdateIcon : HelpCircle}
-            fullWidth={isCollapsed}
-            className={cn('shrink-0', SIDEBAR_RAIL_CHIP_CLASS)}
-          />
-        </DropdownMenuTrigger>
-      </SidebarTooltip>
-      {/* Anchored to whichever edge the trigger sits on, so the menu never overhangs the rail. */}
-      <DropdownMenuContent align={isCollapsed ? 'start' : 'end'} side='top' sideOffset={4}>
-        {updateAvailable && (
-          <>
-            <DropdownMenuItem
-              onSelect={handleUpdateSelect}
-              disabled={updateState.status === 'downloading'}
-            >
-              <img src='/favicon/favicon-32x32.png' alt='' className='size-[14px] rounded-[3px]' />
-              {desktopUpdateActionLabel(updateState)}
-            </DropdownMenuItem>
-            <DropdownMenuSeparator />
-          </>
-        )}
-        <DropdownMenuItem onSelect={onOpenDocs}>
-          <BookOpen className='size-[14px]' />
-          Docs
-        </DropdownMenuItem>
-        <DropdownMenuItem onSelect={onJoinSlack}>
-          <SlackIcon className='size-[14px]' />
-          Join Slack
-        </DropdownMenuItem>
-      </DropdownMenuContent>
-    </DropdownMenu>
-  )
+  const router = useRouter()
+  const accountSettingsHref = organizationRoutes(organization.id).settingsSection('general')
 
   return (
-    <div
-      className={cn(
-        'flex shrink-0 border-t px-2 pt-[9px] pb-2 transition-colors duration-150',
-        !showDivider && 'border-transparent',
-        isCollapsed ? cn(SIDEBAR_ITEM_GAP_CLASS, 'flex-col-reverse') : 'items-center'
-      )}
-    >
-      {/* Expanded, claims the row's free width so the help button lands hard right.
-          `flex` makes the inline-flex chip a flex item, so the wrapper is exactly the
-          chip's 30px rather than a line box padded by the strut's half-leading. */}
-      <div className={cn('flex min-w-0', !isCollapsed && 'flex-1')}>{profileMenu}</div>
-      {helpMenu}
-    </div>
+    <SidebarFooter
+      {...props}
+      accountSettingsHref={accountSettingsHref}
+      onOpenAccountSettings={() => router.push(accountSettingsHref)}
+      navigationLinks={[]}
+    />
   )
 }
diff --git a/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-header/organization-header.test.tsx b/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-header/organization-header.test.tsx
index 665eea639dc..e3d69feee22 100644
--- a/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-header/organization-header.test.tsx
+++ b/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-header/organization-header.test.tsx
@@ -7,7 +7,13 @@ import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const mocks = vi.hoisted(() => ({ upload: vi.fn(), refresh: vi.fn() }))
+const mocks = vi.hoisted(() => ({ upload: vi.fn(), refresh: vi.fn(), invite: vi.fn() }))
+vi.mock('@/app/workspace/[workspaceId]/components/invite-modal', () => ({
+  InviteModal: (props: object) => {
+    mocks.invite(props)
+    return null
+  },
+}))
 vi.mock('@/lib/uploads/client/session-upload', () => ({
   uploadInternalFileSession: mocks.upload,
 }))
@@ -49,7 +55,12 @@ afterEach(async () => {
   vi.unstubAllGlobals()
 })
 
-async function render(canEditLogo = true, isCollapsed = false, onExpandSidebar = vi.fn()) {
+async function render(
+  canEditLogo = true,
+  isCollapsed = false,
+  onExpandSidebar = vi.fn(),
+  canInviteMembers = canEditLogo
+) {
   await act(async () => {
     root.render(
       <QueryClientProvider client={queryClient}>
@@ -57,6 +68,7 @@ async function render(canEditLogo = true, isCollapsed = false, onExpandSidebar =
           <OrganizationHeader
             organization={organization}
             canEditLogo={canEditLogo}
+            canInviteMembers={canInviteMembers}
             isCollapsed={isCollapsed}
             onExpandSidebar={onExpandSidebar}
           />
@@ -189,3 +201,35 @@ describe('OrganizationHeader logo upload', () => {
     expect(mocks.refresh).toHaveBeenCalledOnce()
   })
 })
+
+describe('OrganizationHeader member actions', () => {
+  it('opens the existing invitation flow for the current organization', async () => {
+    await render()
+    await openMenu()
+    const invite = [...document.querySelectorAll<HTMLElement>('[role="menuitem"]')].find(
+      (item) => item.textContent === 'Invite people'
+    )!
+    await act(async () => invite.click())
+    expect(mocks.invite).toHaveBeenCalledWith(
+      expect.objectContaining({
+        open: true,
+        organizationId: 'org-1',
+        isOrganizationAdmin: true,
+        canInvite: true,
+      })
+    )
+  })
+
+  it.each([false, true])(
+    'keeps settings access but hides disallowed invitations (admin=%s)',
+    async (admin) => {
+      await render(admin, false, vi.fn(), false)
+      await openMenu()
+      expect(document.querySelector('a[href="/o/org-1/settings/members"]')).toHaveTextContent(
+        'Settings'
+      )
+      expect(document.querySelector('[role="menu"]')).not.toHaveTextContent('Invite people')
+      expect(mocks.invite).not.toHaveBeenCalled()
+    }
+  )
+})
diff --git a/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-header/organization-header.tsx b/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-header/organization-header.tsx
index 19a580ae22b..3075628dbc7 100644
--- a/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-header/organization-header.tsx
+++ b/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-header/organization-header.tsx
@@ -1,6 +1,6 @@
 'use client'
 
-import { useRef } from 'react'
+import { useRef, useState } from 'react'
 import {
   Chip,
   ChipChevronDown,
@@ -12,13 +12,14 @@ import {
   Tooltip,
   toast,
 } from '@sim/emcn'
-import { PanelLeft, Settings } from '@sim/emcn/icons'
+import { PanelLeft, Send, Settings } from '@sim/emcn/icons'
 import { useRouter } from 'next/navigation'
 import { IdentityTile } from '@/components/identity-tile/identity-tile'
 import { getOrganizationSettingsHref } from '@/components/settings/navigation'
 import { SettingsGuardedLink } from '@/components/settings/settings-guarded-link'
 import type { OrganizationSurfaceOrganization } from '@/lib/organizations/surface'
 import { LOGO_ACCEPT_ATTRIBUTE } from '@/lib/uploads/client/logo-file'
+import { InviteModal } from '@/app/workspace/[workspaceId]/components/invite-modal'
 import { SIDEBAR_RAIL_CHIP_CLASS } from '@/app/workspace/[workspaceId]/w/components/sidebar/constants'
 import { useUploadOrganizationLogo } from '@/hooks/queries/organization-logo'
 
@@ -29,6 +30,7 @@ function getOrganizationInitial(name: string): string {
 interface OrganizationHeaderProps {
   organization: OrganizationSurfaceOrganization
   canEditLogo: boolean
+  canInviteMembers: boolean
   isCollapsed: boolean
   /** Expands the rail; the collapsed header is itself the expand control. */
   onExpandSidebar: () => void
@@ -44,6 +46,7 @@ interface OrganizationHeaderProps {
 export function OrganizationHeader({
   organization,
   canEditLogo,
+  canInviteMembers,
   isCollapsed,
   onExpandSidebar,
 }: OrganizationHeaderProps) {
@@ -52,6 +55,7 @@ export function OrganizationHeader({
   const { mutate: uploadLogo, isPending: isUploadingLogo } = useUploadOrganizationLogo(
     organization.id
   )
+  const [isInviteModalOpen, setIsInviteModalOpen] = useState(false)
   const initial = getOrganizationInitial(organization.name)
 
   if (isCollapsed) {
@@ -131,7 +135,7 @@ export function OrganizationHeader({
                     aria-label='Change organization logo'
                     aria-busy={isUploadingLogo}
                     textValue='Change organization logo'
-                    className='h-auto shrink-0 p-1'
+                    className='h-auto shrink-0 p-0 hover-hover:opacity-70 focus-visible:opacity-70'
                     disabled={isUploadingLogo}
                     onSelect={(event) => {
                       event.preventDefault()
@@ -161,8 +165,23 @@ export function OrganizationHeader({
               Settings
             </SettingsGuardedLink>
           </DropdownMenuItem>
+          {canInviteMembers && (
+            <DropdownMenuItem onSelect={() => setIsInviteModalOpen(true)}>
+              <Send className='size-[14px]' />
+              Invite people
+            </DropdownMenuItem>
+          )}
         </DropdownMenuContent>
       </DropdownMenu>
+      {isInviteModalOpen && (
+        <InviteModal
+          open={isInviteModalOpen}
+          onOpenChange={setIsInviteModalOpen}
+          organizationId={organization.id}
+          isOrganizationAdmin={canEditLogo}
+          canInvite={canInviteMembers}
+        />
+      )}
     </div>
   )
 }
diff --git a/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/workspaces-section/workspace-list.test.tsx b/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/workspaces-section/workspace-list.test.tsx
index e4ce1404ee2..2a08c775fb9 100644
--- a/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/workspaces-section/workspace-list.test.tsx
+++ b/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/workspaces-section/workspace-list.test.tsx
@@ -45,6 +45,22 @@ vi.mock('@/hooks/queries/workspace', () => ({
 }))
 
 import { WorkspaceList } from '@/app/o/[organizationId]/components/organization-sidebar/components/workspaces-section/workspace-list'
+import { useHoverMenu } from '@/app/workspace/[workspaceId]/w/components/sidebar/hooks/use-hover-menu'
+
+function KeyboardWorkspaceFlyout() {
+  const hover = useHoverMenu()
+  return (
+    <DropdownMenu
+      open={hover.isOpen}
+      onOpenChange={(open) => (open ? hover.open() : hover.close())}
+    >
+      <DropdownMenuTrigger>Workspaces</DropdownMenuTrigger>
+      <DropdownMenuContent>
+        <WorkspaceList organizationId='org-1' flyout={hover} />
+      </DropdownMenuContent>
+    </DropdownMenu>
+  )
+}
 
 let container: HTMLDivElement
 let root: Root
@@ -91,6 +107,18 @@ async function render() {
 }
 
 describe('WorkspaceList rail view', () => {
+  it('keeps the flyout open when opened from the keyboard without pointer hover', async () => {
+    workspacesState.workspaces = [{ id: 'ws-1', name: 'Design' }]
+    await act(async () => root.render(<KeyboardWorkspaceFlyout />))
+    const trigger = container.querySelector('button')!
+    await act(async () => {
+      trigger.focus()
+      trigger.dispatchEvent(new KeyboardEvent('keydown', { key: 'Enter', bubbles: true }))
+    })
+    expect(document.querySelector('[role="menu"]')).not.toBeNull()
+    expect(document.querySelector('a[href="/workspace/ws-1"]')).toHaveTextContent('Design')
+  })
+
   it('lists every workspace as a link into it', async () => {
     workspacesState.workspaces = [
       { id: 'ws-1', name: 'Design' },
diff --git a/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/workspaces-section/workspace-list.tsx b/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/workspaces-section/workspace-list.tsx
index c0085b6b92c..8d1bfa0b942 100644
--- a/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/workspaces-section/workspace-list.tsx
+++ b/apps/sim/app/o/[organizationId]/components/organization-sidebar/components/workspaces-section/workspace-list.tsx
@@ -52,11 +52,13 @@ export function WorkspaceList({ organizationId, pathname, flyout }: WorkspaceLis
     },
   })
   const lockFlyout = flyout?.setLocked
+  const isInteracting = menu.isOpen || rename.editingId !== null
 
   useEffect(() => {
-    lockFlyout?.(menu.isOpen || rename.editingId !== null)
-    return () => lockFlyout?.(false)
-  }, [lockFlyout, menu.isOpen, rename.editingId])
+    if (!lockFlyout || !isInteracting) return
+    lockFlyout(true)
+    return () => lockFlyout(false)
+  }, [lockFlyout, isInteracting])
 
   const visibleWorkspaces = flyout ? workspaces : workspaces.slice(0, visibleCount)
   const hasMore = workspaces.length > visibleCount
@@ -90,7 +92,11 @@ export function WorkspaceList({ organizationId, pathname, flyout }: WorkspaceLis
               initial={getWorkspaceInitial(workspace.name)}
               logoUrl={workspace.logoUrl}
             />
-            <OverflowText label={workspace.name} className='flex-1 text-[var(--text-body)]' />
+            <OverflowText
+              label={workspace.name}
+              className='flex-1 text-[var(--text-body)]'
+              focusTarget='nearest-interactive'
+            />
           </>
         )
         const onMoreClick = (event: React.MouseEvent<HTMLButtonElement>) => {
@@ -136,6 +142,16 @@ export function WorkspaceList({ organizationId, pathname, flyout }: WorkspaceLis
               onPointerMove={(event) => {
                 if (menu.isOpen || rename.editingId) event.preventDefault()
               }}
+              actionIndicator={
+                isPinned ? (
+                  <Pin
+                    aria-hidden={false}
+                    className='size-[12px] text-[var(--text-icon)]'
+                    aria-label='Pinned'
+                    role='img'
+                  />
+                ) : undefined
+              }
               action={
                 <DropdownMenuItemAction
                   aria-label={`Options for ${workspace.name}`}
@@ -151,7 +167,6 @@ export function WorkspaceList({ organizationId, pathname, flyout }: WorkspaceLis
                 onContextMenu={(event) => openMenu(event, workspace.id)}
               >
                 {label}
-                {isPinned && <Pin className='size-[12px]' aria-label='Pinned' role='img' />}
               </SettingsGuardedLink>
             </DropdownMenuItem>
           )
diff --git a/apps/sim/app/o/[organizationId]/components/organization-sidebar/organization-sidebar.tsx b/apps/sim/app/o/[organizationId]/components/organization-sidebar/organization-sidebar.tsx
index 363e229f6ec..c4434335f55 100644
--- a/apps/sim/app/o/[organizationId]/components/organization-sidebar/organization-sidebar.tsx
+++ b/apps/sim/app/o/[organizationId]/components/organization-sidebar/organization-sidebar.tsx
@@ -27,6 +27,7 @@ import { useSidebarChrome } from '@/app/workspace/[workspaceId]/components/works
 import { useRegisterGlobalCommands } from '@/app/workspace/[workspaceId]/providers/global-commands-provider'
 import { createCommands } from '@/app/workspace/[workspaceId]/utils/commands-utils'
 import {
+  HelpModal,
   isNavItemActive,
   NavItemContextMenu,
   SidebarNavChip,
@@ -94,6 +95,7 @@ export const OrganizationSidebar = memo(function OrganizationSidebar() {
   const settingsPath = organizationRoutes(organization.id).settings
   const isSettings = pathname === settingsPath || pathname?.startsWith(`${settingsPath}/`)
 
+  const [isHelpModalOpen, setIsHelpModalOpen] = useState(false)
   const [menuHref, setMenuHref] = useState<string | null>(null)
   const {
     isOpen: isHrefMenuOpen,
@@ -182,6 +184,7 @@ export const OrganizationSidebar = memo(function OrganizationSidebar() {
             <OrganizationHeader
               organization={organization}
               canEditLogo={viewer.isAdmin}
+              canInviteMembers={viewer.canInviteMembers}
               isCollapsed={isCollapsed}
               onExpandSidebar={toggleCollapsed}
             />
@@ -282,6 +285,7 @@ export const OrganizationSidebar = memo(function OrganizationSidebar() {
             showCollapsedTooltips={showCollapsedTooltips}
             onOpenDocs={handleOpenDocs}
             onJoinSlack={handleOpenSlackCommunity}
+            onContactSupport={() => setIsHelpModalOpen(true)}
           />
 
           <NavItemContextMenu
@@ -295,6 +299,8 @@ export const OrganizationSidebar = memo(function OrganizationSidebar() {
         </div>
       </aside>
 
+      <HelpModal open={isHelpModalOpen} onOpenChange={setIsHelpModalOpen} />
+
       {/* Not on the peek card: the resize hook writes an inline `--sidebar-width` that
           out-specifies the `[data-peek]` rule, stranding the card at a stale width. */}
       {!isPeeking && (
diff --git a/apps/sim/app/o/[organizationId]/integrations/disconnect-account-menu.test.tsx b/apps/sim/app/o/[organizationId]/integrations/disconnect-account-menu.test.tsx
index b29d1b481cc..9db4e9751da 100644
--- a/apps/sim/app/o/[organizationId]/integrations/disconnect-account-menu.test.tsx
+++ b/apps/sim/app/o/[organizationId]/integrations/disconnect-account-menu.test.tsx
@@ -11,30 +11,9 @@ vi.mock('@/app/workspace/[workspaceId]/integrations/components/integrations-show
   IntegrationTile: () => null,
 }))
 
-import type { SearchSourceSummary } from '@/lib/api/contracts/knowledge/connectors'
 import { DisconnectAccountMenu } from '@/app/o/[organizationId]/integrations/disconnect-account-menu'
-import { SearchSourceRow } from '@/app/workspace/[workspaceId]/search/components/search-source-row'
 
 const accounts = [{ credentialId: 'my-gmail', displayName: 'me@example.test' }]
-const source: SearchSourceSummary = {
-  knowledgeBaseId: 'kb',
-  connectorId: 'gmail',
-  connectorType: 'gmail',
-  sourceDescription: '',
-  accessMode: 'members',
-  availability: 'available',
-  enabled: true,
-  isSyncing: true,
-  lastSyncAt: null,
-  hasSyncError: false,
-  viewerDocumentCount: 0,
-  viewerFailedDocumentCount: 0,
-  viewerEmailVerified: true,
-  connectionRequired: true,
-  viewerMembership: 'connected',
-  viewerAccounts: accounts,
-}
-
 describe('personal integration disconnect', () => {
   let root: Root
   let container: HTMLDivElement
@@ -56,25 +35,10 @@ describe('personal integration disconnect', () => {
     container.remove()
     vi.unstubAllGlobals()
   })
-  async function render(overrides: Partial<SearchSourceSummary> = {}) {
+  async function render() {
     await act(async () =>
       root.render(
-        <SearchSourceRow
-          source={{ ...source, ...overrides } as SearchSourceSummary}
-          scope={{ kind: 'organization', organizationId: 'org' }}
-          canAdmin={false}
-          available={false}
-          waiting
-          isPending
-          onConnect={vi.fn()}
-          accountActions={
-            <DisconnectAccountMenu
-              organizationId='org'
-              integrationName='Gmail'
-              accounts={accounts}
-            />
-          }
-        />
+        <DisconnectAccountMenu organizationId='org' integrationName='Gmail' accounts={accounts} />
       )
     )
   }
@@ -96,15 +60,8 @@ describe('personal integration disconnect', () => {
     )!
   }
 
-  it.each([
-    ['indexing', {}],
-    ['failed', { hasSyncError: true }],
-    ['paused', { enabled: false }],
-    ['deactivated', { approved: false }],
-    ['reconnect', { viewerMembership: 'needs_reauth' }],
-    ['unavailable', { availability: 'unavailable', viewerMembership: null }],
-  ] as const)('allows disconnect while %s without requiring admin access', async (_, overrides) => {
-    await render(overrides)
+  it('requires confirmation before disconnecting an account', async () => {
+    await render()
     await openDisconnect()
     expect(document.body.textContent).toContain(
       'Disconnect me@example.test from all Gmail connections in this organization.'
diff --git a/apps/sim/app/o/[organizationId]/integrations/member-integration-row.tsx b/apps/sim/app/o/[organizationId]/integrations/member-integration-row.tsx
index 70c9061b950..a80ca7184f1 100644
--- a/apps/sim/app/o/[organizationId]/integrations/member-integration-row.tsx
+++ b/apps/sim/app/o/[organizationId]/integrations/member-integration-row.tsx
@@ -3,9 +3,9 @@
 import { Chip, ChipLink } from '@sim/emcn'
 import { organizationRoutes } from '@/lib/navigation/paths'
 import { connectorDisplayName } from '@/lib/sim-search/connectors'
+import { getSearchSourceStatus } from '@/lib/sim-search/source-status'
 import { DisconnectAccountMenu } from '@/app/o/[organizationId]/integrations/disconnect-account-menu'
 import { IntegrationTile } from '@/app/workspace/[workspaceId]/integrations/components/integrations-showcase'
-import { getSearchSourceStatus } from '@/app/workspace/[workspaceId]/search/components/search-source-row-status'
 import type { RowAction } from '@/app/workspace/[workspaceId]/settings/components/row-actions-menu'
 import { SettingsResourceRow } from '@/app/workspace/[workspaceId]/settings/components/settings-resource-row'
 import { CONNECTOR_META_REGISTRY } from '@/connectors/registry'
diff --git a/apps/sim/app/o/[organizationId]/knowledge/[knowledgeBaseId]/[documentId]/page.tsx b/apps/sim/app/o/[organizationId]/knowledge/[knowledgeBaseId]/[documentId]/page.tsx
index ebabd37f6fc..6cd806b52bc 100644
--- a/apps/sim/app/o/[organizationId]/knowledge/[knowledgeBaseId]/[documentId]/page.tsx
+++ b/apps/sim/app/o/[organizationId]/knowledge/[knowledgeBaseId]/[documentId]/page.tsx
@@ -1,16 +1,21 @@
 import { ChipLink } from '@sim/emcn'
 import { notFound, redirect } from 'next/navigation'
+import type { SearchParams } from 'nuqs/server'
 import { readSearchDocumentResultSchema } from '@/lib/api/contracts/knowledge/documents'
 import { getSession } from '@/lib/auth'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { readSearchDocument } from '@/lib/knowledge/application/read-search-document'
 import { buildAuthCrossLink } from '@/app/(auth)/auth-redirect'
+import {
+  loadDocumentReadParams,
+  serializeDocumentReadParams,
+} from '@/app/o/[organizationId]/knowledge/[knowledgeBaseId]/[documentId]/search-params'
 import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
 interface OrganizationDocumentPageProps {
   params: Promise<{ organizationId: string; knowledgeBaseId: string; documentId: string }>
-  searchParams: Promise<{ offset?: string }>
+  searchParams: Promise<SearchParams>
 }
 
 export default async function OrganizationDocumentPage({
@@ -18,15 +23,15 @@ export default async function OrganizationDocumentPage({
   searchParams,
 }: OrganizationDocumentPageProps) {
   const { organizationId, knowledgeBaseId, documentId } = await params
-  const { offset: rawOffset } = await searchParams
-  const offset = rawOffset === undefined ? 0 : Number(rawOffset)
-  if (!Number.isInteger(offset) || offset < 0 || offset > 5000) notFound()
+  const position = await loadDocumentReadParams(searchParams, { strict: true }).catch(() =>
+    notFound()
+  )
   const href = `/o/${encodeURIComponent(organizationId)}/knowledge/${encodeURIComponent(knowledgeBaseId)}/${encodeURIComponent(documentId)}`
   const session = await getSession()
   if (!session?.user) {
     redirect(
       buildAuthCrossLink('/login', {
-        callbackUrl: offset ? `${href}?offset=${offset}` : href,
+        callbackUrl: serializeDocumentReadParams(href, position),
         isInviteFlow: false,
       })
     )
@@ -39,15 +44,15 @@ export default async function OrganizationDocumentPage({
       input: {
         documentId,
         assertedOrganizationId: organizationId,
-        offset,
-        limit: 20,
+        ...position,
+        limit: 3,
         resultSecretRegistry: registry,
       },
     })
   } catch (error) {
     if (
       error instanceof OrchestrationError &&
-      (error.code === 'not_found' || error.code === 'forbidden')
+      (error.code === 'not_found' || error.code === 'forbidden' || error.code === 'validation')
     )
       notFound()
     throw error
@@ -71,11 +76,11 @@ export default async function OrganizationDocumentPage({
           </p>
         ))}
         <nav className='flex gap-2' aria-label='Document pages'>
-          {offset > 0 && (
-            <ChipLink href={`${href}?offset=${Math.max(0, offset - 20)}`}>Previous</ChipLink>
+          {(position.startChunkIndex > 0 || position.startOffset > 0) && (
+            <ChipLink href={href}>Start</ChipLink>
           )}
-          {document.nextOffset !== null && (
-            <ChipLink href={`${href}?offset=${document.nextOffset}`}>Next</ChipLink>
+          {document.next && (
+            <ChipLink href={serializeDocumentReadParams(href, document.next)}>Next</ChipLink>
           )}
         </nav>
       </article>
diff --git a/apps/sim/app/o/[organizationId]/knowledge/[knowledgeBaseId]/[documentId]/search-params.ts b/apps/sim/app/o/[organizationId]/knowledge/[knowledgeBaseId]/[documentId]/search-params.ts
new file mode 100644
index 00000000000..42f9dd224e8
--- /dev/null
+++ b/apps/sim/app/o/[organizationId]/knowledge/[knowledgeBaseId]/[documentId]/search-params.ts
@@ -0,0 +1,25 @@
+import { createLoader, createParser, createSerializer } from 'nuqs/server'
+
+const parseAsDocumentPosition = createParser({
+  parse: (value) => {
+    if (!/^\d+$/.test(value)) return null
+    const position = Number(value)
+    return Number.isSafeInteger(position) && position <= 2147483647 ? position : null
+  },
+  serialize: String,
+}).withDefault(0)
+
+export const documentReadParams = {
+  startChunkIndex: parseAsDocumentPosition,
+  startOffset: parseAsDocumentPosition,
+}
+
+const documentReadUrlKeys = {
+  urlKeys: {
+    startChunkIndex: 'start-chunk-index',
+    startOffset: 'start-offset',
+  },
+} as const
+
+export const loadDocumentReadParams = createLoader(documentReadParams, documentReadUrlKeys)
+export const serializeDocumentReadParams = createSerializer(documentReadParams, documentReadUrlKeys)
diff --git a/apps/sim/app/o/[organizationId]/search/search.test.tsx b/apps/sim/app/o/[organizationId]/search/search.test.tsx
index 41db4871567..9b9a6f78714 100644
--- a/apps/sim/app/o/[organizationId]/search/search.test.tsx
+++ b/apps/sim/app/o/[organizationId]/search/search.test.tsx
@@ -90,7 +90,12 @@ beforeEach(() => {
       chunkIndex: 0,
       similarity: 1,
     }
-    return { data: [result], isPending: false, isFetching: false, isError: false }
+    return {
+      data: { query, results: [result], retrieval: { status: 'complete', timedOutLegs: [] } },
+      isPending: false,
+      isFetching: false,
+      isError: false,
+    }
   })
   container = document.createElement('div')
   document.body.appendChild(container)
diff --git a/apps/sim/app/o/[organizationId]/settings/[section]/settings.tsx b/apps/sim/app/o/[organizationId]/settings/[section]/settings.tsx
index f5adfa63f19..94221fc31fc 100644
--- a/apps/sim/app/o/[organizationId]/settings/[section]/settings.tsx
+++ b/apps/sim/app/o/[organizationId]/settings/[section]/settings.tsx
@@ -51,11 +51,6 @@ const AuditLogs = dynamic(() =>
   import('@/ee/audit-logs/components/audit-logs').then((m) => m.AuditLogs)
 )
 const SSO = dynamic(() => import('@/ee/sso/components/sso-settings').then((m) => m.SSO))
-const SessionPolicySettings = dynamic(() =>
-  import('@/ee/session-policy/components/session-policy-settings').then(
-    (m) => m.SessionPolicySettings
-  )
-)
 const DataRetentionSettings = dynamic(() =>
   import('@/ee/data-retention/components/data-retention-settings').then(
     (m) => m.DataRetentionSettings
@@ -64,6 +59,9 @@ const DataRetentionSettings = dynamic(() =>
 const DataDrainsSettings = dynamic(() =>
   import('@/ee/data-drains/components/data-drains-settings').then((m) => m.DataDrainsSettings)
 )
+const OrganizationSecuritySettings = dynamic(() =>
+  import('@/components/settings/organization-security').then((m) => m.OrganizationSecuritySettings)
+)
 const UsageMonitoring = dynamic(() =>
   import('@/ee/organization-usage/components/usage-monitoring').then((m) => m.UsageMonitoring)
 )
@@ -113,7 +111,7 @@ export function OrganizationSettings({ section }: OrganizationSettingsProps) {
         />
       )}
       {section === 'sso' && <SSO organizationId={organizationId} />}
-      {section === 'sessions' && <SessionPolicySettings organizationId={organizationId} />}
+      {section === 'security' && <OrganizationSecuritySettings organizationId={organizationId} />}
       {section === 'data-retention' && <DataRetentionSettings organizationId={organizationId} />}
       {section === 'data-drains' && <DataDrainsSettings organizationId={organizationId} />}
       {section === 'whitelabeling' && <WhitelabelingSettings organizationId={organizationId} />}
diff --git a/apps/sim/app/o/[organizationId]/settings/components/integrations/organization-integrations-setup.test.tsx b/apps/sim/app/o/[organizationId]/settings/components/integrations/organization-integrations-setup.test.tsx
index bb3eab8e511..416f7f7746e 100644
--- a/apps/sim/app/o/[organizationId]/settings/components/integrations/organization-integrations-setup.test.tsx
+++ b/apps/sim/app/o/[organizationId]/settings/components/integrations/organization-integrations-setup.test.tsx
@@ -43,7 +43,7 @@ vi.mock('@/hooks/queries/search-integrations', () => ({
 vi.mock('@/hooks/use-permission-config', () => ({
   usePermissionConfig: mocks.availability,
 }))
-vi.mock('@/app/workspace/[workspaceId]/search/components/search-source-setup', () => ({
+vi.mock('@/app/o/[organizationId]/settings/components/integrations/search-source-setup', () => ({
   SearchSourceSetup: () => null,
 }))
 vi.mock('@/app/o/[organizationId]/settings/components/integrations/slack-account-setup', () => ({
diff --git a/apps/sim/app/o/[organizationId]/settings/components/integrations/organization-integrations-setup.tsx b/apps/sim/app/o/[organizationId]/settings/components/integrations/organization-integrations-setup.tsx
index 359388941bd..4215fd58bab 100644
--- a/apps/sim/app/o/[organizationId]/settings/components/integrations/organization-integrations-setup.tsx
+++ b/apps/sim/app/o/[organizationId]/settings/components/integrations/organization-integrations-setup.tsx
@@ -6,16 +6,13 @@ import { useQueryStates } from 'nuqs'
 import { SettingsPanel } from '@/components/settings/settings-panel'
 import { organizationRoutes } from '@/lib/navigation/paths'
 import { getConnectorAccessAvailability, SEARCH_SOURCE_TYPES } from '@/lib/sim-search/connectors'
+import { searchSetupAccessParam, searchSetupParam } from '@/lib/sim-search/search-params'
 import { useOrganizationContext } from '@/app/o/[organizationId]/providers/organization-provider'
 import { AddOrganizationSourceModal } from '@/app/o/[organizationId]/settings/components/integrations/add-organization-source-modal'
 import { organizationSearchStatusLabel } from '@/app/o/[organizationId]/settings/components/integrations/organization-search-status'
+import { SearchSourceSetup } from '@/app/o/[organizationId]/settings/components/integrations/search-source-setup'
 import { OrganizationSlackAccountSetup } from '@/app/o/[organizationId]/settings/components/integrations/slack-account-setup'
 import { IntegrationTile } from '@/app/workspace/[workspaceId]/integrations/components/integrations-showcase'
-import { SearchSourceSetup } from '@/app/workspace/[workspaceId]/search/components/search-source-setup'
-import {
-  searchSetupAccessParam,
-  searchSetupParam,
-} from '@/app/workspace/[workspaceId]/search/search-params'
 import {
   SettingsEmptyState,
   SettingsQueryErrorState,
diff --git a/apps/sim/app/workspace/[workspaceId]/search/components/search-source-pagination.tsx b/apps/sim/app/o/[organizationId]/settings/components/integrations/search-source-pagination.tsx
similarity index 100%
rename from apps/sim/app/workspace/[workspaceId]/search/components/search-source-pagination.tsx
rename to apps/sim/app/o/[organizationId]/settings/components/integrations/search-source-pagination.tsx
diff --git a/apps/sim/app/workspace/[workspaceId]/search/components/search-source-setup.test.tsx b/apps/sim/app/o/[organizationId]/settings/components/integrations/search-source-setup.test.tsx
similarity index 79%
rename from apps/sim/app/workspace/[workspaceId]/search/components/search-source-setup.test.tsx
rename to apps/sim/app/o/[organizationId]/settings/components/integrations/search-source-setup.test.tsx
index 3266b86d157..267977e0ead 100644
--- a/apps/sim/app/workspace/[workspaceId]/search/components/search-source-setup.test.tsx
+++ b/apps/sim/app/o/[organizationId]/settings/components/integrations/search-source-setup.test.tsx
@@ -23,7 +23,6 @@ const mocks = vi.hoisted(() => ({
   userId: 'user-1',
   urlUpdate: vi.fn(),
   oauthReturn: vi.fn(),
-  sourceStatus: vi.fn(),
   features: { knowledgeMemberAccess: true, knowledgeSourceMirroredAccess: true },
   create: vi.fn(),
   update: vi.fn(),
@@ -105,16 +104,10 @@ vi.mock('@/hooks/use-permission-config', () => ({
     refetchIntegrationAvailability: mocks.refetchAvailability,
   }),
 }))
-vi.mock('@/app/workspace/[workspaceId]/search/components/search-source-status', () => ({
-  SearchSourceStatus: (props: { knowledgeBaseId: string; connectorType: string }) => {
-    mocks.sourceStatus(props)
-    return <div role='dialog'>Source sync status</div>
-  },
-}))
 vi.mock('next/navigation', () => ({
   useRouter: () => ({ replace: mocks.replace, push: mocks.push }),
   useParams: () => ({ workspaceId: 'workspace-1' }),
-  usePathname: () => '/workspace/workspace-1/search',
+  usePathname: () => '/o/org-1/settings/integrations',
 }))
 vi.mock('@/app/workspace/[workspaceId]/providers/workspace-host-provider', () => ({
   useWorkspaceHostContext: () => ({ ownerBilling: {}, features: mocks.features }),
@@ -209,10 +202,10 @@ vi.mock('@/hooks/use-credential-refresh-triggers', () => ({
 
 import type { ConnectorData } from '@/lib/api/contracts/knowledge/connectors'
 import { SEARCH_CONNECTORS } from '@/lib/sim-search/connectors'
+import { SearchSourceSetup } from '@/app/o/[organizationId]/settings/components/integrations/search-source-setup'
 import { SourceSetupModal } from '@/app/workspace/[workspaceId]/home/components/search-sources/source-setup-modal'
 import { AddConnectorModal } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/add-connector-modal'
 import { EditConnectorModal } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal'
-import { SearchSourceSetup } from '@/app/workspace/[workspaceId]/search/components/search-source-setup'
 import { useConnectorSetupStore } from '@/stores/connector-setup/store'
 
 let root: Root | null = null
@@ -382,17 +375,6 @@ afterEach(async () => {
   vi.restoreAllMocks()
 })
 
-function setup() {
-  return (
-    <SearchSourceSetup
-      workspaceId='workspace-1'
-      canAdmin={mocks.canAdmin}
-      memberAccessAvailable={mocks.features.knowledgeMemberAccess}
-      mirroredAccessAvailable={mocks.features.knowledgeSourceMirroredAccess}
-    />
-  )
-}
-
 function organizationSetup() {
   return (
     <SearchSourceSetup
@@ -405,6 +387,26 @@ function organizationSetup() {
 }
 
 describe('organization setup entry points', () => {
+  it.each([false, true])('does not load setup while closed (admin=%s)', async (canAdmin) => {
+    mocks.canAdmin = canAdmin
+    await render(organizationSetup())
+    expect(document.querySelector('[role="dialog"]')).toBeNull()
+    expect(mocks.basesQuery).toHaveBeenLastCalledWith('org-1', { enabled: false })
+    expect(mocks.prepare).not.toHaveBeenCalled()
+  })
+
+  it.each(['?addConnector=gitlab', '?manage-source=source-one'])(
+    'blocks reader setup at %s',
+    async (query) => {
+      mocks.canAdmin = false
+      await render(organizationSetup(), query)
+      expect(document.querySelector('[role="dialog"]')).toBeNull()
+      expect(mocks.basesQuery).toHaveBeenLastCalledWith('org-1', { enabled: false })
+      expect(mocks.prepare).not.toHaveBeenCalled()
+      expect(mocks.replace).not.toHaveBeenCalled()
+    }
+  )
+
   it.each([
     { type: 'google_drive', mode: 'admin', name: 'Connect Google Drive service account' },
     { type: 'gmail', mode: 'admin', name: 'Connect Gmail service account' },
@@ -477,15 +479,6 @@ describe('organization setup entry points', () => {
     }
   )
 
-  it('keeps the broad provider picker without automatically preparing an index', async () => {
-    mocks.bases = []
-    await render(setup(), '?addConnector=')
-    expect(document.body.textContent).toContain('Find a source')
-    expect(document.body.textContent).toContain('Google Drive')
-    expect(document.body.textContent).toContain('Confluence')
-    expect(mocks.prepare).not.toHaveBeenCalled()
-  })
-
   it('retries failed preparation only when requested', async () => {
     mocks.bases = []
     await render(organizationSetup(), '?addConnector=google_drive')
@@ -568,7 +561,7 @@ describe('organization setup entry points', () => {
       await render(organizationSetup(), `?addConnector=${type}`)
       expect(mocks.replace).toHaveBeenCalledWith('/o/org-1/integrations')
       expect(mocks.basesQuery).toHaveBeenLastCalledWith('org-1', { enabled: false })
-      expect(mocks.connectorsQuery).toHaveBeenLastCalledWith(undefined)
+      expect(mocks.connectorsQuery).not.toHaveBeenCalled()
       expect(document.querySelector('[role="dialog"]')).toBeNull()
       expect(mocks.prepare).not.toHaveBeenCalled()
     }
@@ -760,181 +753,11 @@ describe('Search source setup with real connector dialogs', () => {
       )
       if (source === 'source-one') expect(mocks.replace).toHaveBeenCalledWith(destination)
       else expect(mocks.replace).not.toHaveBeenCalled()
-      expect(mocks.connectorsQuery).toHaveBeenLastCalledWith(undefined)
-      expect(document.querySelector('[role="dialog"]')).toBeNull()
-    }
-  )
-
-  it.each([false, true])(
-    'does not fetch admin data while closed for canAdmin=%s',
-    async (canAdmin) => {
-      mocks.canAdmin = canAdmin
-      await render(setup())
-      expect(document.querySelector('[role="dialog"]')).toBeNull()
-      expect(mocks.basesQuery).toHaveBeenLastCalledWith('workspace-1', { enabled: false })
-      expect(mocks.connectorsQuery).toHaveBeenLastCalledWith(undefined)
-    }
-  )
-
-  it.each(['?addConnector=gitlab', '?manage-source=site-one', '?manage-source=confluence'])(
-    'does not expose the catalog or admin queries to a reader opening %s',
-    async (searchParams) => {
-      mocks.canAdmin = false
-      await render(setup(), searchParams)
+      expect(mocks.connectorsQuery).not.toHaveBeenCalled()
       expect(document.querySelector('[role="dialog"]')).toBeNull()
-      expect(mocks.basesQuery).toHaveBeenLastCalledWith('workspace-1', { enabled: false })
-      expect(mocks.connectorsQuery).toHaveBeenLastCalledWith(undefined)
-      expect(mocks.prepare).not.toHaveBeenCalled()
-    }
-  )
-
-  it('closes source management and disables admin queries when the viewer loses admin access', async () => {
-    mocks.connectors = [
-      { id: 'site-one', connectorType: 'confluence', accessMode: 'admin', status: 'active' },
-    ]
-    await render(setup(), '?manage-source=site-one')
-    expect(document.querySelector('[role="dialog"]')).not.toBeNull()
-    mocks.canAdmin = false
-    mocks.sourceStatus.mockClear()
-    await render(setup(), '?manage-source=site-one')
-    expect(document.querySelector('[role="dialog"]')).toBeNull()
-    expect(mocks.basesQuery).toHaveBeenLastCalledWith('workspace-1', { enabled: false })
-    expect(mocks.connectorsQuery).toHaveBeenLastCalledWith(undefined)
-    expect(mocks.sourceStatus).not.toHaveBeenCalled()
-  })
-
-  it('lists each eligible provider once and filters the add-source catalog', async () => {
-    await render(setup(), '?addConnector=')
-    expect(
-      Array.from(document.querySelectorAll('button')).filter(
-        (node) => node.textContent === 'Set up'
-      )
-    ).toHaveLength(8)
-    for (const name of [
-      'Confluence',
-      'GitHub',
-      'GitLab',
-      'Gmail',
-      'Google Calendar',
-      'Google Drive',
-      'Jira',
-      'Slack',
-    ]) {
-      expect(document.body.textContent).toContain(name)
-    }
-    await fill('Find a source…', 'no-such-source')
-    expect(document.body.textContent).toContain('No matching sources.')
-    expect(document.body.textContent).not.toContain('Google Drive')
-    expect(mocks.connectorsQuery).toHaveBeenLastCalledWith(undefined)
-  })
-
-  it('waits for availability and offers a retry after it fails', async () => {
-    mocks.availabilityReady = false
-    mocks.availabilityLoading = true
-    await render(setup(), '?addConnector=')
-    expect(document.body.textContent).toContain('Loading sources…')
-    expect(
-      Array.from(document.querySelectorAll('button')).some((node) => node.textContent === 'Set up')
-    ).toBe(false)
-    mocks.availabilityLoading = false
-    mocks.availabilityError = new Error('Availability failed')
-    await render(setup(), '?addConnector=')
-    expect(document.body.textContent).toContain('Availability failed')
-    await click(button('Try again'))
-    expect(mocks.refetchAvailability).toHaveBeenCalledOnce()
-  })
-
-  it('does not offer GitHub App setup when only its workflow token integration is available', async () => {
-    mocks.unavailableProviders = ['github-repositories']
-    await render(setup(), '?addConnector=')
-    expect(
-      Array.from(document.querySelectorAll('button')).filter(
-        (node) => node.textContent === 'Set up'
-      )
-    ).toHaveLength(7)
-    expect(document.body.textContent).toContain('GitHub')
-    expect(document.body.textContent).toContain('Not available in this workspace')
-  })
-
-  it('preserves a setup draft while an availability refresh fails and recovers', async () => {
-    await render(setup(), '?addConnector=github')
-    await fill('owner/repo', 'acme/docs')
-    expect(button('Create & Invite').disabled).toBe(false)
-    mocks.availabilityReady = false
-    mocks.availabilityError = new Error('Availability refresh failed')
-    await render(setup(), '?addConnector=github')
-    expect(document.querySelector<HTMLInputElement>('input[placeholder="owner/repo"]')?.value).toBe(
-      'acme/docs'
-    )
-    expect(button('Create & Invite').disabled).toBe(true)
-    await click(button('Try again'))
-    expect(mocks.refetchAvailability).toHaveBeenCalledOnce()
-    mocks.availabilityReady = true
-    mocks.availabilityError = null
-    await render(setup(), '?addConnector=github')
-    expect(button('Create & Invite').disabled).toBe(false)
-  })
-
-  it.each(['gmail', 'jira', 'github', 'google_calendar'])(
-    'retains %s member setup without workspace-wide access',
-    async (type) => {
-      await render(setup(), `?addConnector=${type}`)
-      if (type === 'gmail' || type === 'google_calendar') {
-        await click(button('Member accounts'))
-      }
-      expect(document.body.textContent).toContain('Member accounts')
-      expect(
-        Array.from(document.querySelectorAll('button')).some(
-          (node) => node.textContent === 'Workspace'
-        )
-      ).toBe(false)
-      expect(document.body.textContent).not.toContain('Sync Frequency')
-      expect(document.body.textContent).not.toContain('Max Threads')
-      expect(document.body.textContent).not.toContain('Max Events')
-      expect(document.body.textContent).not.toContain('Max Files')
-      expect(document.body.textContent).not.toContain('Max Issues')
-      if (type === 'github') await fill('owner/repo', 'acme/docs')
-      if (type === 'jira') {
-        expect(button('Create & Invite').disabled).toBe(true)
-        await fill('yoursite.atlassian.net', 'acme.atlassian.net')
-        const modeToggle = document.querySelector<HTMLButtonElement>(
-          'button[aria-label="Switch Projects to manual input"]'
-        )
-        expect(modeToggle).not.toBeNull()
-        await click(modeToggle!)
-        await fill('e.g. ENG, PROJ (comma-separated for multiple)', 'ENG')
-      }
-      if (type === 'gmail') {
-        expect(document.body.textContent).not.toContain('Browse with')
-        expect(
-          document.querySelector('input[placeholder="e.g. INBOX, Engineering (comma-separated)"]')
-        ).not.toBeNull()
-        expect(document.querySelector('button[aria-label="Switch Labels to selector"]')).toBeNull()
-      }
-      expect(button('Create & Invite').disabled).toBe(false)
-      await click(button('Create & Invite'))
-      expect(mocks.create).toHaveBeenCalledWith(
-        expect.objectContaining({
-          knowledgeBaseId: 'kb-search',
-          connectorType: type,
-          accessMode: 'members',
-        }),
-        expect.any(Object)
-      )
     }
   )
 
-  it('prepares a canonical index instead of an ordinary base with the Search name', async () => {
-    mocks.bases = [{ id: 'ordinary-base', name: 'Sim Search', isSearchIndex: false }]
-    await render(setup(), '?addConnector=gitlab')
-    expect(mocks.prepare).toHaveBeenCalledWith({
-      workspaceId: 'workspace-1',
-      connectorType: 'gitlab',
-      accessMode: 'admin',
-    })
-    expect(mocks.connectorsQuery).toHaveBeenLastCalledWith(undefined)
-  })
-
   it('prepares organization connected-account indexing in members mode even when central access is available', async () => {
     mocks.bases = []
     await render(
@@ -952,169 +775,6 @@ describe('Search source setup with real connector dialogs', () => {
       accessMode: 'members',
     })
   })
-
-  it('does not reuse mutation data after the current index has been removed', async () => {
-    mocks.prepareData = { knowledgeBaseId: 'kb-search' }
-    mocks.bases = []
-    await render(setup(), '?addConnector=gitlab')
-    expect(mocks.prepare).toHaveBeenCalled()
-    expect(document.querySelector('input[placeholder="Enter your GitLab PAT"]')).toBeNull()
-  })
-
-  it.each(['bases', 'connectors'] as const)(
-    'retries a failed %s discovery query',
-    async (query) => {
-      if (query === 'bases') mocks.basesError = new Error('Base discovery failed')
-      else mocks.connectorsError = new Error('Connector discovery failed')
-      await render(setup(), query === 'bases' ? '?addConnector=' : '?manage-source=gitlab-1')
-      expect(document.body.textContent).toContain('discovery failed')
-      await click(button('Try again'))
-      expect(
-        query === 'bases' ? mocks.refetchBases : mocks.refetchConnectors
-      ).toHaveBeenCalledOnce()
-    }
-  )
-
-  it('manages the exact source ID in a renamed canonical index', async () => {
-    mocks.bases = [
-      { id: 'ordinary-base', name: 'Sim Search', isSearchIndex: false },
-      { id: 'renamed-index', name: 'Company knowledge', isSearchIndex: true },
-    ]
-    mocks.connectors = [
-      { id: 'site-one', connectorType: 'confluence', accessMode: 'members', status: 'active' },
-      { id: 'site-two', connectorType: 'confluence', accessMode: 'admin', status: 'active' },
-    ]
-    await render(setup(), '?manage-source=site-two')
-    expect(mocks.connectorsQuery).toHaveBeenLastCalledWith('renamed-index')
-    expect(mocks.sourceStatus).toHaveBeenLastCalledWith(
-      expect.objectContaining({
-        knowledgeBaseId: 'renamed-index',
-        connectorType: 'confluence',
-        connectors: [mocks.connectors[1]],
-      })
-    )
-    expect(mocks.prepare).not.toHaveBeenCalled()
-  })
-
-  it.each(['unknown-source', 'deleted-source'])(
-    'shows unavailable for a missing connector ID: %s',
-    async (id) => {
-      mocks.connectors = [
-        {
-          id: 'existing-source',
-          connectorType: 'confluence',
-          accessMode: 'members',
-          status: 'active',
-        },
-      ]
-      await render(setup(), `?manage-source=${id}`)
-      expect(document.body.textContent).toContain('This source is no longer available.')
-      expect(document.body.textContent).not.toContain('Source sync status')
-      expect(mocks.sourceStatus).not.toHaveBeenCalled()
-    }
-  )
-
-  it('waits for connector discovery before declaring a management link unavailable', async () => {
-    mocks.connectorsPending = true
-    await render(setup(), '?manage-source=site-one')
-    expect(mocks.sourceStatus).toHaveBeenLastCalledWith(
-      expect.objectContaining({ isLoading: true, connectors: [] })
-    )
-    expect(document.body.textContent).not.toContain('This source is no longer available.')
-    mocks.connectorsPending = false
-    mocks.connectors = [
-      { id: 'site-one', connectorType: 'confluence', accessMode: 'members', status: 'active' },
-    ]
-    await render(setup(), '?manage-source=site-one')
-    expect(document.body.textContent).toContain('Source sync status')
-    expect(document.body.textContent).not.toContain('This source is no longer available.')
-    expect(mocks.sourceStatus).toHaveBeenLastCalledWith(
-      expect.objectContaining({ connectorType: 'confluence', connectors: mocks.connectors })
-    )
-  })
-
-  it('keeps a failed connector lookup retryable instead of treating it as deletion', async () => {
-    mocks.connectorsError = new Error('Source lookup failed')
-    await render(setup(), '?manage-source=site-one')
-    expect(document.body.textContent).toContain('Source lookup failed')
-    expect(document.body.textContent).not.toContain('This source is no longer available.')
-    expect(mocks.sourceStatus).not.toHaveBeenCalled()
-    await click(button('Try again'))
-    expect(mocks.refetchConnectors).toHaveBeenCalledOnce()
-    mocks.connectorsError = null
-    await render(setup(), '?manage-source=site-one')
-    expect(document.body.textContent).toContain('This source is no longer available.')
-  })
-
-  it('preserves existing provider-based management URLs', async () => {
-    mocks.connectors = [
-      { id: 'site-one', connectorType: 'confluence', accessMode: 'members', status: 'active' },
-      { id: 'site-two', connectorType: 'confluence', accessMode: 'admin', status: 'active' },
-    ]
-    await render(setup(), '?manage-source=confluence')
-    expect(mocks.sourceStatus).toHaveBeenLastCalledWith(
-      expect.objectContaining({ connectors: mocks.connectors })
-    )
-  })
-
-  it('opens GitLab token tabs and submits the custom host and PAT with managed access', async () => {
-    await render(setup(), '?addConnector=gitlab')
-    expect(button('Administrator token')).toHaveAttribute('aria-checked', 'true')
-    expect(button('Non-admin token')).toHaveAttribute('aria-checked', 'false')
-    expect(document.body.textContent).not.toContain('Connection method')
-    expect(document.body.textContent).not.toContain('Member accounts')
-    expect(button('Connect & Sync')).toBeDisabled()
-    await fill('Enter your GitLab PAT', 'test-pat')
-    await fill('group/project or numeric ID', 'engineering/search')
-    expect(button('Connect & Sync')).toBeDisabled()
-    await fill('gitlab.example.com', 'gitlab.example.test')
-    expect(button('Connect & Sync')).toBeEnabled()
-    await click(button('Connect & Sync'))
-    expect(mocks.create).toHaveBeenCalledWith(
-      expect.objectContaining({
-        knowledgeBaseId: 'kb-search',
-        connectorType: 'gitlab',
-        accessMode: 'admin',
-        apiKey: 'test-pat',
-        sourceConfig: expect.objectContaining({
-          host: 'gitlab.example.test',
-          project: 'engineering/search',
-        }),
-        syncIntervalMinutes: 60,
-      }),
-      expect.any(Object)
-    )
-    expect(mocks.create.mock.calls[0][0]).not.toHaveProperty('credentialId')
-  })
-
-  it('prepares Slack in members mode when mirrored access is disabled', async () => {
-    mocks.features.knowledgeSourceMirroredAccess = false
-    mocks.bases = []
-    await render(setup(), '?addConnector=slack')
-    expect(mocks.prepare).toHaveBeenCalledWith({
-      workspaceId: 'workspace-1',
-      connectorType: 'slack',
-      accessMode: 'members',
-    })
-  })
-
-  it('blocks unavailable catalog providers and duplicate preparation while preserving retry feedback', async () => {
-    mocks.features.knowledgeMemberAccess = false
-    mocks.features.knowledgeSourceMirroredAccess = false
-    await render(setup(), '?addConnector=')
-    expect(document.body.textContent).toContain('Not available in this workspace')
-    expect(
-      Array.from(document.querySelectorAll('button')).some((node) => node.textContent === 'Set up')
-    ).toBe(false)
-    mocks.features.knowledgeSourceMirroredAccess = true
-    mocks.bases = []
-    mocks.preparePending = true
-    mocks.prepareError = new Error('Source preparation failed')
-    await render(setup(), '?addConnector=')
-    await fill('Find a source…', 'gitlab')
-    expect(button('Set up')).toBeDisabled()
-    expect(document.body.textContent).toContain('Source preparation failed')
-  })
 })
 
 describe('member content credentials in real add and edit dialogs', () => {
@@ -2061,27 +1721,6 @@ describe('canonical Search connector safety', () => {
 describe('resuming Search source setup', () => {
   const key = 'user-1:workspace-1:kb-search:slack:choose'
 
-  it('reopens the source from the URL even when the source filter hides its row', async () => {
-    await render(setup(), '?search=nothing-matches&addConnector=gitlab&credentialDraftId=draft-1')
-    expect(button('Administrator token')).toHaveAttribute('aria-checked', 'true')
-    expect(button('Non-admin token')).toHaveAttribute('aria-checked', 'false')
-    expect(document.body.textContent).not.toContain('Connection method')
-    expect(document.body.textContent).toContain('Add GitLab project')
-    expect(document.body.textContent).not.toContain('Sync Frequency')
-    expect(document.body.textContent).not.toContain('Sync automatically')
-    expect(mocks.prepare).not.toHaveBeenCalled()
-  })
-
-  it('keeps the picker open when changing sources and updates the configuration selection', async () => {
-    await render(setup(), '?addConnector=google_drive')
-    await click(button('Choose another source'))
-    expect(document.querySelector('[role="dialog"]')).not.toBeNull()
-    expect(document.body.textContent).toContain('Add source')
-    await fill('Find a source…', 'confluence')
-    await click(button('Set up'))
-    expect(document.body.textContent).toContain('Connect Confluence site')
-  })
-
   it('restores the source configuration and content account after an account-settings detour', async () => {
     const onCreated = vi.fn()
     const form = (
@@ -2105,7 +1744,7 @@ describe('resuming Search source setup', () => {
     const setup = Array.from(document.querySelectorAll('a')).find(
       (link) => link.textContent === 'Set up Slack'
     )
-    expect(setup?.getAttribute('href')).toContain('search-setup=slack')
+    expect(setup?.getAttribute('href')).toBe('/workspace/workspace-1/settings/credential-groups')
     setup?.addEventListener('click', (event) => event.preventDefault())
     await click(setup!)
     expect(useConnectorSetupStore.getState().getDraft(key)).toMatchObject({
@@ -2220,49 +1859,6 @@ describe('resuming Search source setup', () => {
 })
 
 describe('Search setup guides', () => {
-  it('opens the source guide in a new tab without losing an administrator’s setup', async () => {
-    const open = vi.spyOn(window, 'open').mockReturnValue(null)
-    await render(setup(), '?addConnector=github')
-    await fill('owner/repo', 'acme/docs')
-
-    await click(button('Setup guide'))
-
-    expect(open).toHaveBeenCalledWith(
-      'https://docs.sim.ai/search/github',
-      '_blank',
-      'noopener,noreferrer'
-    )
-    expect(document.querySelector<HTMLInputElement>('input[placeholder="owner/repo"]')?.value).toBe(
-      'acme/docs'
-    )
-    expect(mocks.create).not.toHaveBeenCalled()
-    expect(mocks.urlUpdate).not.toHaveBeenCalled()
-    await click(button('Create & Invite'))
-    expect(mocks.create).toHaveBeenCalledWith(
-      expect.objectContaining({
-        connectorType: 'github',
-        sourceConfig: expect.objectContaining({ repository: 'acme/docs' }),
-      }),
-      expect.any(Object)
-    )
-  })
-
-  it('offers the Slack guide before its custom app is configured', async () => {
-    const open = vi.spyOn(window, 'open').mockReturnValue(null)
-    mocks.credentialGroup = null
-    await render(setup(), '?addConnector=slack')
-
-    await click(button('Setup guide'))
-
-    expect(open).toHaveBeenCalledWith(
-      'https://docs.sim.ai/search/slack',
-      '_blank',
-      'noopener,noreferrer'
-    )
-    expect(document.body.textContent).not.toContain('Create & Invite')
-    expect(mocks.create).not.toHaveBeenCalled()
-  })
-
   it('preserves a member’s required source fields while reading the guide', async () => {
     const open = vi.spyOn(window, 'open').mockReturnValue(null)
     const onClose = vi.fn()
diff --git a/apps/sim/app/workspace/[workspaceId]/search/components/search-source-setup.tsx b/apps/sim/app/o/[organizationId]/settings/components/integrations/search-source-setup.tsx
similarity index 80%
rename from apps/sim/app/workspace/[workspaceId]/search/components/search-source-setup.tsx
rename to apps/sim/app/o/[organizationId]/settings/components/integrations/search-source-setup.tsx
index 81f1c9fb562..1f2817c553d 100644
--- a/apps/sim/app/workspace/[workspaceId]/search/components/search-source-setup.tsx
+++ b/apps/sim/app/o/[organizationId]/settings/components/integrations/search-source-setup.tsx
@@ -18,18 +18,17 @@ import { useSession } from '@/lib/auth/auth-client'
 import {
   type ResourceScope,
   resourceScopeFields,
-  resourceScopeFromOwner,
   resourceScopeKey,
 } from '@/lib/core/resource-scope'
 import { organizationRoutes } from '@/lib/navigation/paths'
 import { getSearchConnectionLabels } from '@/lib/sim-search/connection-labels'
 import { getConnectorAccessAvailability, SEARCH_SOURCE_TYPES } from '@/lib/sim-search/connectors'
-import { IntegrationTile } from '@/app/workspace/[workspaceId]/integrations/components/integrations-showcase'
 import {
   managedSourceParam,
   searchSetupAccessParam,
   searchSetupParam,
-} from '@/app/workspace/[workspaceId]/search/search-params'
+} from '@/lib/sim-search/search-params'
+import { IntegrationTile } from '@/app/workspace/[workspaceId]/integrations/components/integrations-showcase'
 import {
   SettingsEmptyState,
   SettingsQueryErrorState,
@@ -39,11 +38,7 @@ import {
   SettingsResourceRow,
 } from '@/app/workspace/[workspaceId]/settings/components/settings-resource-row'
 import { CONNECTOR_META_REGISTRY } from '@/connectors/registry'
-import {
-  useConnectorList,
-  usePrepareSearchSource,
-  useSearchIndex,
-} from '@/hooks/queries/kb/connectors'
+import { usePrepareSearchSource, useSearchIndex } from '@/hooks/queries/kb/connectors'
 import { usePermissionConfig } from '@/hooks/use-permission-config'
 
 const AddConnectorModal = dynamic(
@@ -53,17 +48,8 @@ const AddConnectorModal = dynamic(
     ),
   { ssr: false }
 )
-const SearchSourceStatus = dynamic(
-  () =>
-    import('@/app/workspace/[workspaceId]/search/components/search-source-status').then(
-      (module) => module.SearchSourceStatus
-    ),
-  { ssr: false }
-)
-
 interface SearchSourceSetupProps {
-  workspaceId?: string
-  scope?: ResourceScope
+  scope: Extract<ResourceScope, { kind: 'organization' }>
   canAdmin: boolean
   memberAccessAvailable: boolean
   mirroredAccessAvailable: boolean
@@ -71,13 +57,11 @@ interface SearchSourceSetupProps {
 
 /** Owns admin setup and existing source management, including bookmarked OAuth return URLs. */
 export function SearchSourceSetup({
-  workspaceId,
-  scope: explicitScope,
+  scope,
   canAdmin,
   memberAccessAvailable,
   mirroredAccessAvailable,
 }: SearchSourceSetupProps) {
-  const scope = explicitScope ?? resourceScopeFromOwner({ workspaceId })
   const { data: session } = useSession()
   const {
     integrationAvailability,
@@ -109,16 +93,14 @@ export function SearchSourceSetup({
   const { mutate: prepareSource, isPending: preparing } = prepare
   const selectedMeta = selectedType ? CONNECTOR_META_REGISTRY[selectedType] : undefined
   const redirectPersonalSetup = Boolean(
-    scope.kind === 'organization' &&
-      canAdmin &&
+    canAdmin &&
       selectedMeta &&
       setup['source-access'] !== 'members' &&
       !selectedMeta.mirrorsSourceAcls &&
       selectedType !== 'slack'
   )
-  const redirectManagement =
-    scope.kind === 'organization' && canAdmin && managedSource !== null && selectedType === null
-  const organizationId = scope.kind === 'organization' ? scope.organizationId : undefined
+  const redirectManagement = canAdmin && managedSource !== null && selectedType === null
+  const { organizationId } = scope
   useEffect(() => {
     if (redirectPersonalSetup && organizationId) {
       router.replace(organizationRoutes(organizationId).integrations)
@@ -138,46 +120,17 @@ export function SearchSourceSetup({
     enabled: canAdmin && open && !redirectManagement && !redirectPersonalSetup,
   })
   const knowledgeBaseId = index.data?.knowledgeBaseId ?? undefined
-  const connectors = useConnectorList(
-    canAdmin && managedSource && !redirectManagement ? knowledgeBaseId : undefined
-  )
 
   const close = () => {
     if (prepare.isPending) return
     if (selectedType !== null) void setSelectedType(null)
     if (managedSource !== null) void setManagedSource(null)
   }
-  const failedQuery = index.isError
-    ? index
-    : managedSource && connectors.isError
-      ? connectors
-      : null
-  const managedConnectors =
-    connectors.data?.filter(
-      (connector) => connector.id === managedSource || connector.connectorType === managedSource
-    ) ?? []
-  const managedType =
-    managedConnectors[0]?.connectorType ??
-    (managedSource && CONNECTOR_META_REGISTRY[managedSource] ? managedSource : undefined)
-  const initialMode = (type: string) => {
-    if (scope.kind === 'organization')
-      return setup['source-access'] === 'members' || type === 'slack'
-        ? ('members' as const)
-        : ('admin' as const)
-    const meta = CONNECTOR_META_REGISTRY[type]
-    if (
-      meta &&
-      getConnectorAccessAvailability(meta, integrationAvailability, {
-        memberAccessAvailable,
-        mirroredAccessAvailable,
-        oauthServiceAvailability,
-        isIntegrationAvailabilityReady:
-          isIntegrationAvailabilityReady || integrationAvailability.size > 0,
-      }).admin
-    )
-      return 'admin' as const
-    return 'members' as const
-  }
+  const failedQuery = index.isError ? index : null
+  const initialMode = (type: string) =>
+    setup['source-access'] === 'members' || type === 'slack'
+      ? ('members' as const)
+      : ('admin' as const)
 
   const selectedAccessMode = selectedType ? initialMode(selectedType) : undefined
   const selectedAvailability = selectedMeta
@@ -189,11 +142,9 @@ export function SearchSourceSetup({
       })
     : undefined
   const selectedAvailable = selectedAvailability
-    ? scope.kind === 'organization'
-      ? selectedAccessMode === 'admin'
-        ? selectedAvailability.admin
-        : selectedAvailability.members
-      : selectedAvailability.admin || selectedAvailability.members
+    ? selectedAccessMode === 'admin'
+      ? selectedAvailability.admin
+      : selectedAvailability.members
     : false
   const canPrepareSelected =
     canAdmin &&
@@ -241,11 +192,9 @@ export function SearchSourceSetup({
   ) {
     if (selectedType && session?.user?.id) {
       const accessMode = initialMode(selectedType)
-      const setupMode =
-        scope.kind === 'organization' &&
-        !(selectedMeta?.mirrorsSourceAcls && selectedMeta.auth.mode === 'oauth')
-          ? accessMode
-          : 'choose'
+      const setupMode = !(selectedMeta?.mirrorsSourceAcls && selectedMeta.auth.mode === 'oauth')
+        ? accessMode
+        : 'choose'
       return (
         <AddConnectorModal
           key={`${session.user.id}:${knowledgeBaseId}:${selectedType}:${setupMode}:${accessMode}`}
@@ -258,32 +207,19 @@ export function SearchSourceSetup({
           isSearchIndex
           initialConnectorType={selectedType}
           initialAccessMode={accessMode}
-          lockConnectorType={scope.kind === 'organization'}
+          lockConnectorType
           lockedAccessMode={setupMode === 'choose' ? undefined : setupMode}
           setupDraftKey={`${session.user.id}:${resourceScopeKey(scope)}:${knowledgeBaseId}:${selectedType}:${setupMode}`}
           onConnectorTypeChange={(type) =>
             void setSelectedType(type !== null ? searchSetupParam.parser.parse(type) : null)
           }
           onCreated={async (_type, connector) => {
-            if (scope.kind !== 'organization') return
             await setSelectedType(null)
             router.push(organizationRoutes(scope.organizationId).searchSource(connector.id))
           }}
         />
       )
     }
-    if (managedSource && (connectors.isPending || managedType)) {
-      return (
-        <SearchSourceStatus
-          scope={scope}
-          knowledgeBaseId={knowledgeBaseId}
-          connectorType={managedType ?? ''}
-          connectors={managedConnectors}
-          isLoading={connectors.isPending}
-          onClose={() => void setManagedSource(null)}
-        />
-      )
-    }
   }
 
   if (
@@ -299,10 +235,7 @@ export function SearchSourceSetup({
   const normalizedSearch = search.trim().toLowerCase()
   const visibleTypes = SEARCH_SOURCE_TYPES.filter(
     ([type, meta]) =>
-      (scope.kind !== 'organization' ||
-        setup['source-access'] === 'members' ||
-        meta.mirrorsSourceAcls ||
-        type === 'slack') &&
+      (setup['source-access'] === 'members' || meta.mirrorsSourceAcls || type === 'slack') &&
       `${meta.name} ${meta.description}`.toLowerCase().includes(normalizedSearch)
   )
 
@@ -400,11 +333,7 @@ export function SearchSourceSetup({
                     }
                   )
                   const available =
-                    scope.kind === 'organization'
-                      ? setup['source-access'] === 'members' || type === 'slack'
-                        ? members
-                        : central
-                      : central || members
+                    setup['source-access'] === 'members' || type === 'slack' ? members : central
                   return (
                     <SettingsResourceRow
                       key={type}
diff --git a/apps/sim/app/o/[organizationId]/settings/components/integrations/slack-account-setup.tsx b/apps/sim/app/o/[organizationId]/settings/components/integrations/slack-account-setup.tsx
index 37d11404811..695983461d0 100644
--- a/apps/sim/app/o/[organizationId]/settings/components/integrations/slack-account-setup.tsx
+++ b/apps/sim/app/o/[organizationId]/settings/components/integrations/slack-account-setup.tsx
@@ -9,12 +9,9 @@ import {
   ChipModalHeader,
 } from '@sim/emcn'
 import { useQueryState } from 'nuqs'
+import { searchSetupParam, searchSetupReturnParam } from '@/lib/sim-search/search-params'
 import { useOrganizationContext } from '@/app/o/[organizationId]/providers/organization-provider'
 import { connectedAccountsParam } from '@/app/o/[organizationId]/settings/components/integrations/search-params'
-import {
-  searchSetupParam,
-  searchSetupReturnParam,
-} from '@/app/workspace/[workspaceId]/search/search-params'
 import { SettingsQueryErrorState } from '@/app/workspace/[workspaceId]/settings/components/settings-empty-state'
 import { SlackManagedUsersModal } from '@/ee/credential-groups/components/slack-managed-users-modal'
 import {
diff --git a/apps/sim/app/o/[organizationId]/settings/integrations/providers/[connectorType]/page.tsx b/apps/sim/app/o/[organizationId]/settings/integrations/providers/[connectorType]/page.tsx
index 5f0762a0e49..b923250f060 100644
--- a/apps/sim/app/o/[organizationId]/settings/integrations/providers/[connectorType]/page.tsx
+++ b/apps/sim/app/o/[organizationId]/settings/integrations/providers/[connectorType]/page.tsx
@@ -5,10 +5,10 @@ import { getSession } from '@/lib/auth'
 import { organizationRoutes } from '@/lib/navigation/paths'
 import { authorizeOrganizationSettingsSection } from '@/lib/settings/application/organization-section-access'
 import { SEARCH_SOURCE_TYPES } from '@/lib/sim-search/connectors'
+import { searchSetupParam } from '@/lib/sim-search/search-params'
 import { buildAuthCrossLink } from '@/app/(auth)/auth-redirect'
 import { serializeOrganizationPeople } from '@/app/o/[organizationId]/settings/components/integrations/search-params'
 import { OrganizationProviderDetail } from '@/app/o/[organizationId]/settings/integrations/providers/[connectorType]/provider-detail'
-import { searchSetupParam } from '@/app/workspace/[workspaceId]/search/search-params'
 import { SettingsEmptyState } from '@/app/workspace/[workspaceId]/settings/components/settings-empty-state'
 
 interface OrganizationProviderPageProps {
diff --git a/apps/sim/app/o/[organizationId]/settings/integrations/providers/[connectorType]/provider-detail.test.tsx b/apps/sim/app/o/[organizationId]/settings/integrations/providers/[connectorType]/provider-detail.test.tsx
index 4d77fb01677..7d4d860870c 100644
--- a/apps/sim/app/o/[organizationId]/settings/integrations/providers/[connectorType]/provider-detail.test.tsx
+++ b/apps/sim/app/o/[organizationId]/settings/integrations/providers/[connectorType]/provider-detail.test.tsx
@@ -105,7 +105,7 @@ vi.mock('@/ee/credential-groups/components/organization-account-people', () => (
     return <p>Provider account connections</p>
   },
 }))
-vi.mock('@/app/workspace/[workspaceId]/search/components/search-source-setup', () => ({
+vi.mock('@/app/o/[organizationId]/settings/components/integrations/search-source-setup', () => ({
   SearchSourceSetup: (props: unknown) => {
     mocks.setup(props)
     return null
diff --git a/apps/sim/app/o/[organizationId]/settings/integrations/providers/[connectorType]/provider-detail.tsx b/apps/sim/app/o/[organizationId]/settings/integrations/providers/[connectorType]/provider-detail.tsx
index ecf0c0f62b5..5e98e688040 100644
--- a/apps/sim/app/o/[organizationId]/settings/integrations/providers/[connectorType]/provider-detail.tsx
+++ b/apps/sim/app/o/[organizationId]/settings/integrations/providers/[connectorType]/provider-detail.tsx
@@ -11,18 +11,15 @@ import { SettingsPanel } from '@/components/settings/settings-panel'
 import { organizationRoutes } from '@/lib/navigation/paths'
 import { getSearchConnectionLabels } from '@/lib/sim-search/connection-labels'
 import { getConnectorAccessAvailability } from '@/lib/sim-search/connectors'
+import { searchSetupAccessParam, searchSetupParam } from '@/lib/sim-search/search-params'
 import { SEARCH_DEBOUNCE_MS } from '@/lib/url-state'
 import { useOrganizationContext } from '@/app/o/[organizationId]/providers/organization-provider'
 import { organizationSearchStatusLabel } from '@/app/o/[organizationId]/settings/components/integrations/organization-search-status'
 import { connectedAccountsParam } from '@/app/o/[organizationId]/settings/components/integrations/search-params'
+import { SearchSourcePagination } from '@/app/o/[organizationId]/settings/components/integrations/search-source-pagination'
+import { SearchSourceSetup } from '@/app/o/[organizationId]/settings/components/integrations/search-source-setup'
 import { OrganizationSlackAccountRemoval } from '@/app/o/[organizationId]/settings/components/integrations/slack-account-removal'
 import { OrganizationSlackAccountSetup } from '@/app/o/[organizationId]/settings/components/integrations/slack-account-setup'
-import { SearchSourcePagination } from '@/app/workspace/[workspaceId]/search/components/search-source-pagination'
-import { SearchSourceSetup } from '@/app/workspace/[workspaceId]/search/components/search-source-setup'
-import {
-  searchSetupAccessParam,
-  searchSetupParam,
-} from '@/app/workspace/[workspaceId]/search/search-params'
 import {
   SettingsEmptyState,
   SettingsQueryErrorState,
diff --git a/apps/sim/app/o/[organizationId]/settings/navigation.test.ts b/apps/sim/app/o/[organizationId]/settings/navigation.test.ts
index 36c23895f8c..94ec37b962a 100644
--- a/apps/sim/app/o/[organizationId]/settings/navigation.test.ts
+++ b/apps/sim/app/o/[organizationId]/settings/navigation.test.ts
@@ -73,6 +73,8 @@ describe('organization settings navigation', () => {
     )
     expect(resolveOrganizationSettingsSection('subscription')).toBe('billing')
     expect(resolveOrganizationSettingsSection('domains')).toBe('sso')
+    expect(resolveOrganizationSettingsSection('sessions')).toBe('security')
+    expect(resolveOrganizationSettingsSection('/o/one/settings/network')).toBeNull()
     expect(resolveOrganizationSettingsSection('skills')).toBeNull()
     expect(buildOrganizationNavItems('org', true).map(({ id }) => id)).toEqual([
       'home',
@@ -92,7 +94,7 @@ describe('organization settings navigation', () => {
       'governance:audit-logs',
       'governance:access-control',
       'governance:sso',
-      'governance:sessions',
+      'governance:security',
       'governance:data-retention',
       'governance:data-drains',
       'sim-search:integrations',
diff --git a/apps/sim/app/o/[organizationId]/settings/navigation.ts b/apps/sim/app/o/[organizationId]/settings/navigation.ts
index 124ff827666..0a96e8a0754 100644
--- a/apps/sim/app/o/[organizationId]/settings/navigation.ts
+++ b/apps/sim/app/o/[organizationId]/settings/navigation.ts
@@ -37,7 +37,13 @@ export function resolveOrganizationSettingsSection(
     path,
     items: ORGANIZATION_SETTINGS_ITEMS,
     defaultSection: null,
-    aliases: { organization: 'members', team: 'members', subscription: 'billing', domains: 'sso' },
+    aliases: {
+      organization: 'members',
+      team: 'members',
+      subscription: 'billing',
+      domains: 'sso',
+      sessions: 'security',
+    },
   })
 }
 
diff --git a/apps/sim/app/workspace/[workspaceId]/components/connect-oauth-modal/connect-oauth-modal.test.tsx b/apps/sim/app/workspace/[workspaceId]/components/connect-oauth-modal/connect-oauth-modal.test.tsx
index b94535be58c..c6050bf0f43 100644
--- a/apps/sim/app/workspace/[workspaceId]/components/connect-oauth-modal/connect-oauth-modal.test.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/components/connect-oauth-modal/connect-oauth-modal.test.tsx
@@ -347,6 +347,8 @@ describe('ConnectOAuthModal reauthorization', () => {
       },
     })
 
+    expect(container.querySelector('header')).toHaveTextContent('Reconnect Slack')
+    expect(container).not.toHaveTextContent('tool requires access')
     await clickConnect()
 
     expect(mocks.writeOAuthReturnContext).toHaveBeenCalledExactlyOnceWith(
@@ -424,6 +426,8 @@ describe('ConnectOAuthModal reauthorization', () => {
       },
     })
 
+    expect(container.querySelector('header')).toHaveTextContent('Connect Slack')
+    expect(container).toHaveTextContent('tool requires access')
     await clickConnect()
 
     expect(mocks.writeOAuthReturnContext).toHaveBeenCalledOnce()
diff --git a/apps/sim/app/workspace/[workspaceId]/components/connect-oauth-modal/connect-oauth-modal.tsx b/apps/sim/app/workspace/[workspaceId]/components/connect-oauth-modal/connect-oauth-modal.tsx
index 4ec62347415..e624f434d0e 100644
--- a/apps/sim/app/workspace/[workspaceId]/components/connect-oauth-modal/connect-oauth-modal.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/components/connect-oauth-modal/connect-oauth-modal.tsx
@@ -506,7 +506,16 @@ export function ConnectOAuthModal(props: ConnectOAuthModalProps) {
       ? `An integration named "${existingCredential.displayName}" already exists.`
       : undefined)
 
-  const title = `Connect ${providerName}`
+  const isConnectorReconnect = !isConnect && props.returnContext?.origin === 'kb-connectors'
+  const connectLabel = isConnectorReconnect
+    ? newScopes.length > 0
+      ? 'Update access'
+      : 'Reconnect'
+    : 'Connect'
+  const title =
+    isConnectorReconnect && newScopes.length > 0
+      ? `Update ${providerName} access`
+      : `${connectLabel} ${providerName}`
 
   return (
     <ChipModal open={open} onOpenChange={onOpenChange} srTitle={title}>
@@ -519,7 +528,11 @@ export function ConnectOAuthModal(props: ConnectOAuthModalProps) {
       <ChipModalBody>
         {!isConnect && (
           <p className='text-[var(--text-tertiary)] text-caption'>
-            The "{props.toolName}" tool requires access to your account.
+            {isConnectorReconnect
+              ? newScopes.length > 0
+                ? 'Approve the requested permissions to continue syncing.'
+                : `Continue to ${providerName} to restore this connection.`
+              : `The "${props.toolName}" tool requires access to your account.`}
           </p>
         )}
 
@@ -651,7 +664,7 @@ export function ConnectOAuthModal(props: ConnectOAuthModalProps) {
             : undefined
         }
         primaryAction={{
-          label: isPending ? 'Connecting...' : 'Connect',
+          label: isPending ? 'Connecting...' : connectLabel,
           onClick: handleConnect,
           disabled: isDisabled,
         }}
diff --git a/apps/sim/app/workspace/[workspaceId]/components/integration-tabs-header/integration-tabs-header.test.tsx b/apps/sim/app/workspace/[workspaceId]/components/integration-tabs-header/integration-tabs-header.test.tsx
index 226c60c89b1..15fd822f500 100644
--- a/apps/sim/app/workspace/[workspaceId]/components/integration-tabs-header/integration-tabs-header.test.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/components/integration-tabs-header/integration-tabs-header.test.tsx
@@ -3,22 +3,13 @@
  */
 import { act } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-
-const { mockMemberAccessAvailable } = vi.hoisted(() => ({
-  mockMemberAccessAvailable: vi.fn(() => true),
-}))
-
-vi.mock('@/hooks/use-member-access', () => ({
-  useMemberAccessAvailable: () => mockMemberAccessAvailable(),
-}))
-
+import { afterEach, describe, expect, it } from 'vitest'
 import { IntegrationTabsHeader } from '@/app/workspace/[workspaceId]/components/integration-tabs-header/integration-tabs-header'
 
 let root: Root | null = null
 let container: HTMLDivElement | null = null
 
-function mount(active: 'integrations' | 'skills' | 'search' = 'integrations') {
+function mount(active: 'integrations' | 'skills' = 'integrations') {
   ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
   container = document.createElement('div')
   document.body.appendChild(container)
@@ -30,10 +21,6 @@ function tabs(): string[] {
   return Array.from(container?.querySelectorAll('a') ?? []).map((node) => node.textContent ?? '')
 }
 
-beforeEach(() => {
-  mockMemberAccessAvailable.mockReturnValue(true)
-})
-
 afterEach(() => {
   if (root) act(() => root?.unmount())
   container?.remove()
@@ -45,20 +32,14 @@ describe('IntegrationTabsHeader', () => {
   it('links every tab to its page in the routed workspace', () => {
     mount()
 
-    expect(tabs()).toEqual(['Integrations', 'Skills', 'Search'])
+    expect(tabs()).toEqual(['Integrations', 'Skills'])
     expect(
       Array.from(container?.querySelectorAll('a') ?? []).map((node) => node.getAttribute('href'))
-    ).toEqual([
-      '/workspace/workspace-1/integrations',
-      '/workspace/workspace-1/skills',
-      '/workspace/workspace-1/search',
-    ])
+    ).toEqual(['/workspace/workspace-1/integrations', '/workspace/workspace-1/skills'])
   })
 
-  it('omits Search where per-member access is off, matching the page that 404s', () => {
-    mockMemberAccessAvailable.mockReturnValue(false)
-    mount()
-
+  it('keeps the same workspace navigation on the Skills tab', () => {
+    mount('skills')
     expect(tabs()).toEqual(['Integrations', 'Skills'])
   })
 })
diff --git a/apps/sim/app/workspace/[workspaceId]/components/integration-tabs-header/integration-tabs-header.tsx b/apps/sim/app/workspace/[workspaceId]/components/integration-tabs-header/integration-tabs-header.tsx
index 248d7936669..11774143550 100644
--- a/apps/sim/app/workspace/[workspaceId]/components/integration-tabs-header/integration-tabs-header.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/components/integration-tabs-header/integration-tabs-header.tsx
@@ -3,38 +3,20 @@
 import type { ReactNode } from 'react'
 import { ChipLink, cn } from '@sim/emcn'
 import { HEADER_ACTION_CLUSTER, PAGE_HEADER_BAR } from '@/components/page-header-bar'
-import { useMemberAccessAvailable } from '@/hooks/use-member-access'
 
 interface IntegrationTabsHeaderProps {
-  active: 'integrations' | 'skills' | 'search'
+  active: 'integrations' | 'skills'
   workspaceId: string
   /** Trailing actions for the owning page (e.g. skills' "Add skill"). */
   rightSlot?: ReactNode
 }
 
-/**
- * Top-of-page tab header shared by the Integrations, Skills, and Search pages —
- * three views of one surface, so each highlights itself and links to its siblings.
- *
- * Lives in the shared workspace components rather than under `integrations/`
- * because every page owns it equally; its former home made Skills reach across
- * into a sibling feature for its own chrome.
- *
- * Search appears only where per-member access is on, matching the page it links
- * to, which 404s otherwise. A client component so the three pages and their
- * Suspense fallbacks all read that one judgement from the workspace host
- * context rather than each resolving it again on the server.
- *
- * The `gap-1` is explicit because chips carry no outer margin — the parent owns the
- * space between them.
- */
+/** Shared navigation for workspace integrations and skills. */
 export function IntegrationTabsHeader({
   active,
   workspaceId,
   rightSlot,
 }: IntegrationTabsHeaderProps) {
-  const memberAccessAvailable = useMemberAccessAvailable()
-
   return (
     <div className={cn(PAGE_HEADER_BAR, 'gap-1')}>
       <ChipLink href={`/workspace/${workspaceId}/integrations`} active={active === 'integrations'}>
@@ -43,11 +25,6 @@ export function IntegrationTabsHeader({
       <ChipLink href={`/workspace/${workspaceId}/skills`} active={active === 'skills'}>
         Skills
       </ChipLink>
-      {memberAccessAvailable && (
-        <ChipLink href={`/workspace/${workspaceId}/search`} active={active === 'search'}>
-          Search
-        </ChipLink>
-      )}
       {rightSlot && <div className={cn('ml-auto', HEADER_ACTION_CLUSTER)}>{rightSlot}</div>}
     </div>
   )
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/knowledge-search-results/knowledge-search-results.test.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/knowledge-search-results/knowledge-search-results.test.tsx
index f41648b121d..6b9617c5d38 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/knowledge-search-results/knowledge-search-results.test.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/knowledge-search-results/knowledge-search-results.test.tsx
@@ -4,30 +4,39 @@ import { NuqsTestingAdapter } from 'nuqs/adapters/testing'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const mocks = vi.hoisted(() => ({ overview: vi.fn() }))
+const mocks = vi.hoisted(() => ({
+  index: vi.fn(),
+  overview: vi.fn(),
+  search: vi.fn(),
+  retry: vi.fn(),
+}))
 vi.mock('@/hooks/queries/kb/connectors', () => ({
-  useSearchIndex: () => ({ data: { knowledgeBaseId: 'index' }, isPending: false }),
+  useSearchIndex: mocks.index,
   useSearchSourceOverview: mocks.overview,
 }))
 vi.mock('@/hooks/queries/kb/knowledge', () => ({
-  useWorkspaceKnowledgeSearch: () => ({
-    data: [],
-    isPending: false,
-    isFetching: false,
-    isError: false,
-  }),
+  useWorkspaceKnowledgeSearch: mocks.search,
 }))
 vi.mock(
   '@/app/workspace/[workspaceId]/home/components/message-content/components/source-card',
-  () => ({ SourceCard: () => null })
+  () => ({ SourceCard: ({ source }: { source: { title: string } }) => <span>{source.title}</span> })
 )
 
+import type { ResourceScope } from '@/lib/core/resource-scope'
 import { KnowledgeSearchResults } from '@/app/workspace/[workspaceId]/home/components/knowledge-search-results/knowledge-search-results'
 
 let root: Root
 let container: HTMLDivElement
 beforeEach(() => {
   vi.clearAllMocks()
+  mocks.index.mockReturnValue({ data: { knowledgeBaseId: 'index' }, isPending: false })
+  mocks.search.mockReturnValue({
+    data: { query: 'launch', results: [], retrieval: { status: 'complete', timedOutLegs: [] } },
+    isPending: false,
+    isFetching: false,
+    isError: false,
+    refetch: mocks.retry,
+  })
   vi.stubGlobal('IS_REACT_ACT_ENVIRONMENT', true)
   container = document.createElement('div')
   root = createRoot(container)
@@ -36,11 +45,11 @@ afterEach(() => {
   act(() => root.unmount())
   vi.unstubAllGlobals()
 })
-async function render() {
+async function render(scope: ResourceScope = { kind: 'workspace', workspaceId: 'workspace' }) {
   await act(async () =>
     root.render(
       <NuqsTestingAdapter>
-        <KnowledgeSearchResults workspaceId='workspace' query='launch' onSummarize={vi.fn()} />
+        <KnowledgeSearchResults scope={scope} query='launch' onSummarize={vi.fn()} />
       </NuqsTestingAdapter>
     )
   )
@@ -66,6 +75,68 @@ describe('source indexing context in search results', () => {
     mocks.overview.mockReturnValue({ data: undefined })
     await render()
     expect(container.textContent).not.toContain('Still indexing')
-    expect(container.textContent).toContain('No documents you can read match')
+    expect(container.textContent).toContain('Search found no results.')
+  })
+})
+
+describe('incomplete search coverage', () => {
+  it.each([false, true])(
+    'shows matches without timeout copy or retry controls (hasResults=%s)',
+    async (hasResults) => {
+      mocks.search.mockReturnValue({
+        data: {
+          query: 'launch',
+          results: hasResults
+            ? [
+                {
+                  documentId: 'document-1',
+                  knowledgeBaseId: 'index',
+                  knowledgeBaseName: 'Search index',
+                  documentName: 'Release plan',
+                  sourceUrl: 'https://fixture.test/release',
+                  connectorType: null,
+                  sourceModifiedAt: null,
+                  author: null,
+                  content: 'launch details',
+                  chunkIndex: 0,
+                  similarity: 0.9,
+                },
+              ]
+            : [],
+          retrieval: { status: 'partial', timedOutLegs: ['vector'] },
+        },
+        isPending: false,
+        isFetching: false,
+        isError: false,
+        refetch: mocks.retry,
+      })
+      await render()
+      expect(container.textContent).not.toContain('Search couldn’t run')
+      expect(container.textContent).not.toContain('No documents')
+      expect(container.textContent).not.toContain('Some results may be missing.')
+      expect(container.textContent).not.toContain('Search is incomplete.')
+      expect(container.textContent).toContain(
+        hasResults ? '1 document' : 'Search found no results.'
+      )
+      if (hasResults) expect(container.textContent).toContain('Release plan')
+      const retry = [...container.querySelectorAll('button')].find(
+        (button) => button.textContent === 'Try again'
+      )
+      expect(retry).toBeUndefined()
+      expect(mocks.retry).not.toHaveBeenCalled()
+    }
+  )
+})
+
+describe('source setup navigation', () => {
+  it.each([
+    [{ kind: 'workspace', workspaceId: 'workspace' }, '/workspace/workspace/knowledge'],
+    [{ kind: 'organization', organizationId: 'organization' }, '/o/organization/integrations'],
+  ] as const)('links empty results to the source page for %j', async (scope, href) => {
+    mocks.index.mockReturnValue({ data: { knowledgeBaseId: null }, isPending: false })
+    mocks.overview.mockReturnValue({ data: undefined })
+    await render(scope)
+    expect(container.textContent).toContain('No sources are set up yet.')
+    expect(container.querySelector('a')?.getAttribute('href')).toBe(href)
   })
 })
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/knowledge-search-results/knowledge-search-results.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/knowledge-search-results/knowledge-search-results.tsx
index 0c8395fd1cb..3c92726ee09 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/knowledge-search-results/knowledge-search-results.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/knowledge-search-results/knowledge-search-results.tsx
@@ -133,7 +133,7 @@ export function KnowledgeSearchResults({
     }
   }, [filters.source, filters.updated])
   const {
-    data: results,
+    data: search,
     isPending,
     isFetching,
     isError: searchFailed,
@@ -143,7 +143,7 @@ export function KnowledgeSearchResults({
   const indexing = (overview?.providers ?? [])
     .filter((provider) => provider.isSyncing)
     .map((provider) => connectorDisplayName(provider.connectorType))
-  const documents = useMemo(() => groupResultsByDocument(results ?? []), [results])
+  const documents = useMemo(() => groupResultsByDocument(search?.results ?? []), [search?.results])
   const sourceTypes = [
     ...new Set([
       ...(filters.source ? [filters.source] : []),
@@ -155,8 +155,7 @@ export function KnowledgeSearchResults({
   const showFilters =
     filtersActive || (documents.length >= FILTERS_MIN_RESULTS && sourceTypes.length > 1)
 
-  /* A failed search says so in one quiet line and offers to run again; the cause is
-     the server's to log, never the reader's to parse. */
+  /** A failed search offers a retry; server diagnostics carry the cause. */
   if (basesFailed || searchFailed) {
     const retrying = basesFetching || isFetching
     return (
@@ -180,7 +179,7 @@ export function KnowledgeSearchResults({
           href={
             scope.kind === 'organization'
               ? `/o/${scope.organizationId}/integrations`
-              : `/workspace/${scope.workspaceId}/search`
+              : `/workspace/${scope.workspaceId}/knowledge`
           }
         >
           View sources
@@ -188,7 +187,7 @@ export function KnowledgeSearchResults({
       </div>
     )
   }
-  if (isPending || (isFetching && !results)) {
+  if (isPending || (isFetching && !search)) {
     return (
       <div className='px-2 py-2'>
         <ActivityStatus label='Searching…' isActive />
@@ -205,10 +204,16 @@ export function KnowledgeSearchResults({
     <div className='flex flex-col'>
       <div className='flex items-center gap-2 px-2 py-2'>
         <span className='min-w-0 flex-1 text-[var(--text-muted)] text-caption'>
-          <span className='tabular-nums'>
-            {documents.length === 1 ? '1 document' : `${documents.length} documents`}
-          </span>
-          {' · searched as you'}
+          {documents.length === 0 ? (
+            'Search found no results.'
+          ) : (
+            <>
+              <span className='tabular-nums'>
+                {documents.length === 1 ? '1 document' : `${documents.length} documents`}
+              </span>
+              {' · searched as you'}
+            </>
+          )}
           {indexingNote && <span className='block'>{indexingNote}</span>}
         </span>
       </div>
@@ -244,13 +249,7 @@ export function KnowledgeSearchResults({
           ))}
         </div>
       )}
-      {documents.length === 0 ? (
-        <p className='px-2 py-2 text-[var(--text-muted)] text-caption'>
-          {filtersActive
-            ? 'No documents match these filters.'
-            : `No documents you can read match “${query}”.`}
-        </p>
-      ) : (
+      {documents.length > 0 && (
         <div className='flex flex-col' onKeyDown={handleResultsKeyDown}>
           {documents.map((result) => {
             const source = toSource(result, query, scope)
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/activity-disclosure.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/activity-disclosure.tsx
index c25f9b774e3..724f22c1929 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/activity-disclosure.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/activity-disclosure.tsx
@@ -1,15 +1,16 @@
 'use client'
 
 import { type ReactNode, useId } from 'react'
-import { ChevronDown, cn, Expandable, ExpandableContent } from '@sim/emcn'
+import { ChevronDown, cn, Expandable, ExpandableContent, handleKeyboardActivation } from '@sim/emcn'
 import { ActivityViewport } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/activity-viewport'
 
-interface ActivityDisclosureProps {
+export interface ActivityDisclosureProps {
   header: ReactNode
   children: ReactNode
   expanded: boolean
   onToggle: () => void
   isStreaming: boolean
+  collapsible?: boolean
   unbounded?: boolean
 }
 
@@ -21,39 +22,51 @@ export function ActivityDisclosure({
   onToggle,
   isStreaming,
   unbounded = false,
+  collapsible = true,
 }: ActivityDisclosureProps) {
   const contentId = useId()
   const headerId = useId()
 
   return (
-    <div className='flex min-w-0 flex-col gap-1.5'>
-      <button
-        type='button'
-        aria-expanded={expanded}
-        aria-controls={contentId}
-        aria-labelledby={headerId}
-        onClick={onToggle}
-        className='group/agent flex w-full min-w-0 cursor-pointer items-center gap-2 text-left'
+    <div className='flex min-w-0 flex-col'>
+      <div
+        role={collapsible ? 'button' : undefined}
+        tabIndex={collapsible ? 0 : undefined}
+        aria-expanded={collapsible ? expanded : undefined}
+        aria-controls={collapsible ? contentId : undefined}
+        aria-labelledby={collapsible ? headerId : undefined}
+        onClick={collapsible ? onToggle : undefined}
+        onKeyDown={collapsible ? (event) => handleKeyboardActivation(event, onToggle) : undefined}
+        className={cn(
+          'flex w-full min-w-0 items-center gap-2 text-left',
+          collapsible && 'group/agent cursor-pointer'
+        )}
       >
         <span id={headerId} className='flex min-w-0'>
           {header}
         </span>
-        <ChevronDown
-          aria-hidden
-          className={cn(
-            'size-[14px] shrink-0 text-[var(--text-icon)] transition-[transform,opacity] duration-150',
-            !expanded &&
-              '-rotate-90 opacity-0 group-hover/agent:opacity-100 group-focus-visible/agent:opacity-100'
-          )}
-        />
-      </button>
-      <Expandable expanded={expanded}>
-        <ExpandableContent id={contentId}>
-          <ActivityViewport isStreaming={isStreaming} unbounded={unbounded}>
-            {children}
-          </ActivityViewport>
-        </ExpandableContent>
-      </Expandable>
+        {collapsible && (
+          <ChevronDown
+            aria-hidden
+            className={cn(
+              'size-[14px] shrink-0 text-[var(--text-icon)] transition-[transform,opacity] duration-150',
+              !expanded &&
+                '-rotate-90 opacity-0 group-hover/agent:opacity-100 group-focus-visible/agent:opacity-100'
+            )}
+          />
+        )}
+      </div>
+      {collapsible && (
+        <Expandable expanded={expanded}>
+          <ExpandableContent id={contentId}>
+            <div className='pt-1.5'>
+              <ActivityViewport isStreaming={isStreaming} unbounded={unbounded}>
+                {children}
+              </ActivityViewport>
+            </div>
+          </ExpandableContent>
+        </Expandable>
+      )}
     </div>
   )
 }
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/activity-stream.test.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/activity-stream.test.tsx
new file mode 100644
index 00000000000..df297e5bdcb
--- /dev/null
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/activity-stream.test.tsx
@@ -0,0 +1,205 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { AgentGroup } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group'
+import type { AgentGroupItem } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group-view'
+import type { ToolCallData, ToolCallStatus } from '@/app/workspace/[workspaceId]/home/types'
+
+function tool(id: string, status: ToolCallStatus = 'executing'): ToolCallData {
+  return { id, toolName: 'read', displayTitle: `Reading ${id}`, status }
+}
+
+function items(tools: ToolCallData[]): AgentGroupItem[] {
+  return tools.map((data) => ({ type: 'tool', data }))
+}
+
+describe.each(['mothership', 'workflow', 'browser', 'deploy'])('%s activity', (agentName) => {
+  let root: Root
+  let container: HTMLDivElement
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.stubGlobal('matchMedia', vi.fn().mockReturnValue({ matches: false }))
+    ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+  })
+  afterEach(() => {
+    act(() => root.unmount())
+    container.remove()
+    vi.useRealTimers()
+    vi.unstubAllGlobals()
+  })
+  const render = (tools: ToolCallData[], active = true) =>
+    act(() =>
+      root.render(
+        <AgentGroup
+          agentName={agentName}
+          agentLabel='Agent prefix'
+          items={items(tools)}
+          isStreaming={active}
+          isLaneOpen={active}
+        />
+      )
+    )
+  const header = () => container.querySelector('[role="status"]')
+  const advance = (ms: number) => act(() => vi.advanceTimersByTime(ms))
+
+  it('leaves empty lanes to the turn indicator and shows the first action immediately', () => {
+    render([])
+    expect(container.childElementCount).toBe(0)
+    advance(100)
+    render([tool('first')])
+    expect(header()?.textContent).toBe('Reading first')
+    const row = header()
+    render([tool('first', 'success')], false)
+    expect(header()?.textContent).toBe('Read first')
+    expect(header()).toBe(row)
+  })
+
+  it('preserves a successful model description in the header and expanded history', () => {
+    const completed = {
+      ...tool('first', 'success'),
+      activityDescription: 'Read the latest inbox emails',
+    }
+    render([completed], false)
+    expect(header()?.textContent).toBe(completed.activityDescription)
+    render([completed, tool('second', 'success')], false)
+    const trigger = container.querySelector<HTMLElement>('[role="button"]')!
+    act(() => trigger.click())
+    expect(container.querySelector('[data-state="open"]')?.textContent).toContain(
+      completed.activityDescription
+    )
+    expect(container.textContent).not.toContain('Completed:')
+  })
+
+  it('shows the first action immediately and coalesces bursts without replaying a backlog', () => {
+    render([])
+    advance(100)
+    render([tool('first')])
+    expect(header()?.textContent).toBe('Reading first')
+    const row = header()
+    const shimmer = container.querySelector('[class*="shimmer"]')
+    advance(100)
+    render([tool('first', 'success')])
+    expect(header()?.textContent).toBe('Reading first')
+    expect(container.querySelector('[class*="shimmer"]')).toBe(shimmer)
+    render([tool('first', 'success'), tool('second')])
+    expect(header()).toBe(row)
+    expect(container.querySelector('[class*="shimmer"]')).toBe(shimmer)
+    expect(header()?.textContent).toBe('Reading first')
+    advance(600)
+    render([tool('first', 'success'), tool('second', 'success'), tool('third')])
+    advance(299)
+    expect(header()?.textContent).toBe('Reading first')
+    advance(1)
+    expect(header()?.textContent).toBe('Reading third')
+    expect(container.textContent).not.toContain('Agent prefix')
+    advance(1000)
+    expect(header()?.textContent).toBe('Reading third')
+  })
+
+  it('keeps live history complete under a stable expanded header with keyboard disclosure', () => {
+    render([tool('first', 'success'), tool('second')])
+    const trigger = container.querySelector<HTMLElement>('[role="button"]')!
+    const event = new KeyboardEvent('keydown', { key: ' ', bubbles: true, cancelable: true })
+    act(() => trigger.dispatchEvent(event))
+    expect(event.defaultPrevented).toBe(true)
+    expect(trigger.getAttribute('aria-expanded')).toBe('true')
+    expect(header()?.textContent).toBe('Tool activity')
+    render([tool('first', 'success'), tool('second', 'success'), tool('third')])
+    expect(header()?.textContent).toBe('Tool activity')
+    expect(container.querySelector('[data-state="open"]')?.textContent).toBe(
+      'Read firstRead secondReading third'
+    )
+    act(() => trigger.dispatchEvent(new KeyboardEvent('keydown', { key: 'Enter', bubbles: true })))
+    expect(trigger.getAttribute('aria-expanded')).toBe('false')
+    expect(header()?.textContent).toBe('Reading third')
+  })
+
+  it.each(['error', 'cancelled', 'interrupted', 'rejected', 'skipped'] as const)(
+    'shows %s immediately and cancels a pending cosmetic update',
+    (status) => {
+      render([tool('first')])
+      advance(100)
+      render([tool('first', 'success'), tool('second')])
+      render([tool('first', 'success'), tool('second', status)])
+      const prefix =
+        status === 'error' || status === 'rejected'
+          ? 'Failed'
+          : status === 'skipped'
+            ? 'Skipped'
+            : 'Stopped'
+      expect(header()?.textContent).toBe(`${prefix} reading second`)
+      expect(container.querySelector('[class*="shimmer"]')).toBeNull()
+      advance(1500)
+      expect(header()?.textContent).toBe(`${prefix} reading second`)
+    }
+  )
+
+  it('shows final completion immediately and never replays the held action', () => {
+    render([tool('first')])
+    advance(100)
+    render([tool('first', 'success'), tool('second')])
+    render([tool('first', 'success'), tool('second', 'success')], false)
+    expect(header()?.textContent).toBe('Read files')
+    expect(container.querySelector('[class*="shimmer"]')).toBeNull()
+    advance(2000)
+    expect(header()?.textContent).toBe('Read files')
+  })
+
+  it.each(['error', 'cancelled', 'interrupted', 'rejected', 'skipped'] as const)(
+    'keeps an earlier parallel call active when the latest one becomes %s',
+    (status) => {
+      render([tool('first'), tool('second')])
+      advance(100)
+      render([tool('first'), tool('second', status)])
+      const outcome =
+        status === 'error' || status === 'rejected'
+          ? 'failed'
+          : status === 'skipped'
+            ? 'skipped'
+            : 'stopped'
+      expect(header()?.textContent).toBe(`Reading first · 1 ${outcome}`)
+      expect(container.querySelector('[class*="shimmer"]')).not.toBeNull()
+      advance(1000)
+      expect(header()?.textContent).toBe(`Reading first · 1 ${outcome}`)
+    }
+  )
+
+  it('surfaces an earlier parallel failure while the latest call keeps working', () => {
+    render([tool('first'), tool('second')])
+    advance(100)
+    render([tool('first', 'error'), tool('second')])
+    expect(header()?.textContent).toBe('Reading second · 1 failed')
+  })
+
+  it('keeps narration from prematurely completing an open lane', () => {
+    act(() =>
+      root.render(
+        <AgentGroup
+          agentName={agentName}
+          agentLabel='Sim'
+          isStreaming
+          isLaneOpen
+          items={[
+            ...items([tool('first', 'success')]),
+            { type: 'text', content: 'Checking another source.' },
+            ...items([tool('second', 'success')]),
+          ]}
+        />
+      )
+    )
+    const rows = container.querySelectorAll('[role="status"]')
+    if (agentName === 'mothership') {
+      expect(rows[0].textContent).toBe('Read first')
+      expect(rows[0].querySelector('[class*="shimmer"]')).toBeNull()
+    }
+    const liveRow = rows[rows.length - 1]
+    expect(liveRow.textContent).toBe('Reading second')
+    expect(liveRow.querySelector('[class*="shimmer"]')).not.toBeNull()
+  })
+})
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/activity-stream.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/activity-stream.tsx
new file mode 100644
index 00000000000..df8539e20c2
--- /dev/null
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/activity-stream.tsx
@@ -0,0 +1,79 @@
+'use client'
+
+import { useEffect, useState } from 'react'
+import { ActivityStatus, type ActivityStatusProps } from '@/components/ui/activity-status'
+import {
+  ActivityDisclosure,
+  type ActivityDisclosureProps,
+} from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/activity-disclosure'
+
+const ACTIVITY_UPDATE_INTERVAL_MS = 1000
+
+interface ActivityStreamProps extends Omit<ActivityDisclosureProps, 'header'> {
+  activity: ActivityStatusProps
+  activityKey?: string
+  attentionKey: string
+  collapsible: boolean
+}
+
+/** Pace only the header; history and interactive tool state continue updating immediately. */
+export function ActivityStream({
+  activity,
+  activityKey,
+  attentionKey,
+  expanded,
+  collapsible,
+  children,
+  onToggle,
+  isStreaming,
+  unbounded,
+}: ActivityStreamProps) {
+  const isExpanded = collapsible && expanded
+  const key = `${activityKey}:${activity.label}`
+  const resetKey = `${activity.isActive}:${isExpanded}:${Boolean(activityKey)}:${attentionKey}`
+  const [visible, setVisible] = useState(() => ({
+    activity,
+    key,
+    resetKey,
+    shownAt: Date.now(),
+  }))
+
+  /** Completion, attention, and disclosure changes bypass the cosmetic delay. */
+  if (visible.resetKey !== resetKey) {
+    setVisible({ activity, key, resetKey, shownAt: Date.now() })
+  }
+
+  useEffect(() => {
+    if (!activity.isActive || isExpanded || key === visible.key) return
+    const remaining = Math.max(0, ACTIVITY_UPDATE_INTERVAL_MS - (Date.now() - visible.shownAt))
+    const flush = () => setVisible({ activity, key, resetKey, shownAt: Date.now() })
+    if (remaining === 0) {
+      flush()
+      return
+    }
+    const timer = setTimeout(flush, remaining)
+    return () => clearTimeout(timer)
+  }, [activity, key, resetKey, isExpanded, visible.key, visible.shownAt])
+
+  const displayed =
+    !activity.isActive || isExpanded || key === visible.key ? activity : visible.activity
+  const header = (
+    <ActivityStatus
+      {...displayed}
+      label={isExpanded && activity.isActive ? 'Tool activity' : displayed.label}
+      isActive={activity.isActive}
+    />
+  )
+  return (
+    <ActivityDisclosure
+      header={header}
+      collapsible={collapsible}
+      expanded={expanded}
+      onToggle={onToggle}
+      isStreaming={isStreaming}
+      unbounded={unbounded}
+    >
+      {children}
+    </ActivityDisclosure>
+  )
+}
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group-content.ts b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group-content.ts
new file mode 100644
index 00000000000..e9f93a653d5
--- /dev/null
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group-content.ts
@@ -0,0 +1,44 @@
+import type {
+  AgentGroupItem,
+  NestedAgentGroup,
+} from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group-view'
+import type { ToolCallData } from '@/app/workspace/[workspaceId]/home/types'
+
+/** Empty agent lanes share the turn's thinking indicator until they have output. */
+export function hasAgentGroupItemContent(item: AgentGroupItem): boolean {
+  switch (item.type) {
+    case 'tool':
+      return true
+    case 'text':
+      return item.content.trim().length > 0
+    case 'agent_group':
+      return item.group.items.some(hasAgentGroupItemContent)
+  }
+}
+
+/** Finds empty live lanes at any depth whose wait belongs to the turn indicator. */
+export function hasPendingAgentGroup(
+  group: Pick<NestedAgentGroup, 'items' | 'isOpen' | 'isDelegating'>
+): boolean {
+  return (
+    ((group.isOpen || group.isDelegating) && !group.items.some(hasAgentGroupItemContent)) ||
+    group.items.some((item) => item.type === 'agent_group' && hasPendingAgentGroup(item.group))
+  )
+}
+
+/**
+ * Every tool in a group, in stream order, including those run by nested
+ * agents. A parent's status line speaks for the whole subtree it delegated,
+ * so a grandchild's work is what surfaces while the parent itself waits.
+ */
+export function collectGroupTools(items: AgentGroupItem[]): ToolCallData[] {
+  const tools: ToolCallData[] = []
+  const walk = (list: AgentGroupItem[]) => {
+    for (const item of list) {
+      if (item.type === 'tool') tools.push(item.data)
+      else if (item.type === 'agent_group') walk(item.group.items)
+    }
+  }
+  walk(items)
+  return tools
+}
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group-view.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group-view.tsx
index c9733459807..fd9b7a5797a 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group-view.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group-view.tsx
@@ -1,16 +1,28 @@
 'use client'
 
-import { type ComponentType, type ReactNode, useMemo, useState } from 'react'
-import { ActivityStatus } from '@/components/ui/activity-status'
+import { type ComponentType, type ReactNode, useState } from 'react'
+import { ThinkingLoader } from '@/components/ui/thinking-loader'
 import { isBrowserAgentAvailable } from '@/lib/browser-agent/transport'
 import { RETIRED_BROWSER_REQUEST_TAKEOVER_ID } from '@/lib/copilot/tools/retired-tools'
-import { ActivityDisclosure } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/activity-disclosure'
+import { getToolStatusDisplayTitle } from '@/lib/copilot/tools/tool-display'
+import { ActivityStream } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/activity-stream'
+import {
+  collectGroupTools,
+  hasAgentGroupItemContent,
+} from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group-content'
 import { BrowserAgentIcon } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/browser-agent-icon'
 import { renderInlineMarkdown } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/inline-markdown'
 import { MainAgentActivity } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/main-agent-activity'
-import { getToolActivitySummary } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-activity-group'
+import {
+  getActiveToolActivityTitle,
+  getActivityStatusTool,
+  getToolActivitySummary,
+} from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-activity-group'
 import type { ToolCallItemProps } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item'
-import { needsToolInput } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-interactions'
+import {
+  getActivityAttentionKey,
+  needsToolInput,
+} from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-interactions'
 import {
   getAgentIcon,
   isToolDone,
@@ -43,7 +55,7 @@ export interface AgentGroupProps {
   items: AgentGroupItem[]
   isDelegating?: boolean
   isStreaming?: boolean
-  /** The subagent lane is still open (no subagent_end yet) — i.e. actively running. */
+  /** This lane can receive work; main lanes close when a later transcript segment begins. */
   isLaneOpen?: boolean
   /** Opens a subagent group on first render. */
   defaultExpanded?: boolean
@@ -51,25 +63,13 @@ export interface AgentGroupProps {
   autoScrollActivity?: boolean
 }
 
-function toolStatusTitle(tool: ToolCallData): string {
-  return tool.displayTitle || String(tool.toolName ?? '')
-}
-
-/**
- * Every tool in a group, in stream order, including those run by nested
- * agents. A parent's status line speaks for the whole subtree it delegated,
- * so a grandchild's work is what surfaces while the parent itself waits.
- */
-function collectGroupTools(items: AgentGroupItem[]): ToolCallData[] {
-  const tools: ToolCallData[] = []
-  const walk = (list: AgentGroupItem[]) => {
-    for (const item of list) {
-      if (item.type === 'tool') tools.push(item.data)
-      else if (item.type === 'agent_group') walk(item.group.items)
-    }
-  }
-  walk(items)
-  return tools
+function activeToolTitle(tool: ToolCallData): string {
+  return getToolStatusDisplayTitle(
+    tool.displayTitle || String(tool.toolName ?? ''),
+    tool.status === ToolCallStatus.success ? ToolCallStatus.executing : tool.status,
+    tool.toolName,
+    tool.activityDescription
+  )
 }
 
 /** Reveal blocking interactions even when a parent group was manually collapsed. */
@@ -140,7 +140,6 @@ interface AgentGroupViewProps extends AgentGroupProps {
 
 export function AgentGroupView({
   agentName,
-  agentLabel,
   items,
   isDelegating = false,
   isStreaming = false,
@@ -151,35 +150,9 @@ export function AgentGroupView({
   renderBrowserTakeover,
 }: AgentGroupViewProps) {
   const AgentIcon = getAgentIcon(agentName)
-  const agentIcon =
-    agentName === 'browser' ? (
-      <BrowserAgentIcon items={items} />
-    ) : (
-      <AgentIcon className='size-full' />
-    )
   const isMainAgent = agentName === 'mothership'
-  /** Open lanes surface their latest work, including work delegated to nested agents. */
-  const status = useMemo(() => {
-    if (isMainAgent || !isLaneOpen) return undefined
-    const tools = collectGroupTools(items)
-    const running = tools.filter((tool) => tool.status === ToolCallStatus.executing)
-    if (running.length > 0) {
-      const latest = running.reduce((newest, tool) =>
-        (tool.startedAt ?? 0) >= (newest.startedAt ?? 0) ? tool : newest
-      )
-      const title = toolStatusTitle(latest)
-      return running.length > 1 ? `${title} + ${running.length - 1}` : title
-    }
-    const last = tools.at(-1)
-    return last ? toolStatusTitle(last) : undefined
-  }, [isLaneOpen, isMainAgent, items])
-  const completedTools = !isMainAgent && !isLaneOpen ? collectGroupTools(items) : []
-  const headerText = status
-    ? `${agentLabel} — ${status}`
-    : completedTools.length > 0
-      ? `${agentLabel} — ${getToolActivitySummary(completedTools)}`
-      : agentLabel
-  const hasItems = items.length > 0
+  const tools = isMainAgent ? [] : collectGroupTools(items)
+  const statusTool = getActivityStatusTool(tools)
   const resolved = isAgentGroupResolved(items)
   const browserAgentAvailable = isBrowserAgentAvailable()
   const activeBrowserTakeover =
@@ -187,6 +160,14 @@ export function AgentGroupView({
   const nestedBrowserTakeover = browserAgentAvailable && hasNestedBrowserTakeover(items)
   const isWorking =
     !activeBrowserTakeover && ((isDelegating && !resolved) || (isStreaming && isLaneOpen))
+  const agentIcon =
+    isWorking && !statusTool ? (
+      <ThinkingLoader size={14} startVariant='corners' />
+    ) : agentName === 'browser' ? (
+      <BrowserAgentIcon items={items} />
+    ) : (
+      <AgentIcon className='size-full' />
+    )
 
   const [manualExpanded, setManualExpanded] = useState(defaultExpanded)
   const [expandedTakeoverId, setExpandedTakeoverId] = useState<string | null>(null)
@@ -197,6 +178,9 @@ export function AgentGroupView({
     nestedBrowserTakeover ||
     (activeBrowserTakeover ? expandedTakeoverId === activeBrowserTakeover.id : manualExpanded)
 
+  const meaningfulItems = items.filter(hasAgentGroupItemContent)
+  if (meaningfulItems.length === 0) return null
+
   const toggleExpanded = () => {
     if (activeBrowserTakeover) {
       setExpandedTakeoverId(expanded ? null : activeBrowserTakeover.id)
@@ -213,6 +197,7 @@ export function AgentGroupView({
           toolCallId={item.data.id}
           toolName={item.data.toolName}
           displayTitle={item.data.displayTitle}
+          activityDescription={item.data.activityDescription}
           status={item.data.status}
           params={item.data.params}
           result={item.data.result}
@@ -237,6 +222,7 @@ export function AgentGroupView({
         />
       )
     }
+    if (!item.content.trim()) return null
     return (
       <NarrationText
         key={`text-${idx}`}
@@ -252,28 +238,49 @@ export function AgentGroupView({
       ToolCallComponent={ToolCallComponent}
       renderItem={renderItem}
       autoScrollActivity={autoScrollActivity}
+      isActive={isStreaming && isLaneOpen}
     />
   ) : (
     <div className='flex min-w-0 flex-col gap-1.5 py-0.5 pl-6'>{items.map(renderItem)}</div>
   )
-  const header = <ActivityStatus label={headerText} isActive={isWorking} icon={agentIcon} />
+  const headerText = isWorking
+    ? statusTool
+      ? getActiveToolActivityTitle(activeToolTitle(statusTool), statusTool, tools)
+      : 'Thinking'
+    : tools.length > 0
+      ? getToolActivitySummary(tools)
+      : 'Tool activity'
+  const headerActive =
+    isWorking &&
+    (!statusTool ||
+      statusTool.status === ToolCallStatus.executing ||
+      statusTool.status === ToolCallStatus.success)
+  const collapsible =
+    meaningfulItems.length > 1 ||
+    meaningfulItems.some(
+      (item) =>
+        item.type !== 'tool' ||
+        needsToolInput(item.data) ||
+        item.data.toolName === RETIRED_BROWSER_REQUEST_TAKEOVER_ID
+    )
 
   return (
     <div className='flex min-w-0 flex-col gap-1.5'>
       {isMainAgent ? (
         activity
-      ) : hasItems ? (
-        <ActivityDisclosure
-          header={header}
+      ) : (
+        <ActivityStream
+          activity={{ label: headerText, isActive: headerActive, icon: agentIcon }}
+          activityKey={statusTool?.id}
+          attentionKey={`${getActivityAttentionKey(tools)}:${activeBrowserTakeover?.id ?? ''}`}
+          collapsible={collapsible}
           expanded={expanded}
           onToggle={toggleExpanded}
           isStreaming={isStreaming && autoScrollActivity}
           unbounded={pendingInteraction || nestedBrowserTakeover}
         >
           {activity}
-        </ActivityDisclosure>
-      ) : (
-        header
+        </ActivityStream>
       )}
       {activeBrowserTakeover && (
         <div key={activeBrowserTakeover.id} className='animate-stream-fade-in'>
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group.test.ts b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group.test.ts
index 8dd4c725517..1b1075a60ce 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group.test.ts
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group.test.ts
@@ -118,8 +118,47 @@ describe('AgentGroup inline main activity', () => {
   afterEach(() => {
     act(() => root.unmount())
     container.remove()
+    vi.useRealTimers()
   })
 
+  it.each(['mothership', 'workflow', 'browser'])(
+    'shows one model-described action without a redundant %s disclosure',
+    (agentName) => {
+      act(() =>
+        root.render(
+          createElement(AgentGroup, {
+            agentName,
+            agentLabel: agentName,
+            defaultExpanded: true,
+            isLaneOpen: true,
+            isStreaming: true,
+            items: [
+              {
+                type: 'tool',
+                data: {
+                  id: 'described-read',
+                  toolName: 'read',
+                  displayTitle: 'Reading files',
+                  activityDescription: 'Checking the project timeline',
+                  status: 'executing',
+                },
+              },
+            ],
+          })
+        )
+      )
+
+      const statuses = [...container.querySelectorAll('[role="status"]')]
+      expect(statuses).toHaveLength(1)
+      expect(container.querySelector<HTMLElement>('[role="button"]')).toBeNull()
+      for (const status of statuses) {
+        expect(status.textContent).toContain('Checking the project timeline')
+      }
+      expect(container.textContent).not.toContain('Reading files')
+      expect(container.querySelector('[class*="shimmer"]')).not.toBeNull()
+    }
+  )
+
   it.each([
     ['executing', 'Reading notes'],
     ['success', 'Read notes'],
@@ -151,12 +190,13 @@ describe('AgentGroup inline main activity', () => {
     )
     expect(container.textContent).toBe(expected)
     expect(container.querySelectorAll('[role="status"]')).toHaveLength(1)
-    expect(container.querySelector('button')).toBeNull()
+    expect(container.querySelector<HTMLElement>('[role="button"]')).toBeNull()
     expect(container.querySelector('[data-state]')).toBeNull()
     expect(Boolean(container.querySelector('[class*="shimmer"]'))).toBe(status === 'executing')
   })
 
-  it('replaces the active status in place and expands the full completed history', () => {
+  it('paces the active status in place and expands the full completed history', () => {
+    vi.useFakeTimers()
     const first: AgentGroupItem = {
       type: 'tool',
       data: { id: 'first', toolName: 'grep', displayTitle: 'Searching files', status: 'executing' },
@@ -180,14 +220,18 @@ describe('AgentGroup inline main activity', () => {
 
     render([first])
     expect(container.textContent).toBe('Searching files')
-    expect(container.querySelector('button')).toBeNull()
+    expect(container.querySelector<HTMLElement>('[role="button"]')).toBeNull()
     const activity = container.firstElementChild
 
     render([first, next])
     expect(container.firstElementChild).toBe(activity)
+    expect(container.textContent).toBe('Searching files')
+    act(() => vi.advanceTimersByTime(1000))
     expect(container.textContent).toBe('Reading notes')
     expect(container.querySelector('[class*="shimmer"]')).not.toBeNull()
-    expect(container.querySelector('button')?.getAttribute('aria-expanded')).toBe('false')
+    expect(
+      container.querySelector<HTMLElement>('[role="button"]')?.getAttribute('aria-expanded')
+    ).toBe('false')
     expect(container.querySelector('svg')).not.toBeNull()
     expect(container.textContent).not.toContain('Sim')
 
@@ -200,7 +244,7 @@ describe('AgentGroup inline main activity', () => {
     )
     expect(container.textContent).toBe('Searched files, read files')
     expect(container.querySelector('[class*="shimmer"]')).toBeNull()
-    const header = container.querySelector('button')
+    const header = container.querySelector<HTMLElement>('[role="button"]')
     act(() => header?.click())
     expect(header?.getAttribute('aria-expanded')).toBe('true')
     expect(container.querySelector('[data-state="open"]')?.textContent).toBe(
@@ -237,7 +281,7 @@ describe('AgentGroup inline main activity', () => {
         )
       )
     render([first, second])
-    act(() => container.querySelector('button')?.click())
+    act(() => container.querySelector<HTMLElement>('[role="button"]')?.click())
     render([
       first,
       second,
@@ -251,7 +295,9 @@ describe('AgentGroup inline main activity', () => {
         },
       },
     ])
-    expect(container.querySelector('button')?.getAttribute('aria-expanded')).toBe('true')
+    expect(
+      container.querySelector<HTMLElement>('[role="button"]')?.getAttribute('aria-expanded')
+    ).toBe('true')
     expect(container.querySelector('[data-state="open"]')?.textContent).toBe(
       'Read notesRead more notesRunning checks'
     )
@@ -290,15 +336,15 @@ describe('AgentGroup inline main activity', () => {
       render([wait])
       act(() => vi.advanceTimersByTime(2000))
       expect(container.textContent).toBe('Waiting 1s')
-      expect(container.querySelector('button')).toBeNull()
+      expect(container.querySelector<HTMLElement>('[role="button"]')).toBeNull()
       render([wait, read])
       expect(container.textContent).toBe('Waiting 1s')
       expect(setIntervalSpy).toHaveBeenCalledTimes(1)
-      const header = container.querySelector('button')
+      const header = container.querySelector<HTMLElement>('[role="button"]')
       act(() => header?.click())
       expect(header?.hasAttribute('aria-label')).toBe(false)
-      expect(header?.textContent).toBe('Waiting 1s')
-      expect(header).toHaveAccessibleName('Waiting 1s')
+      expect(header?.textContent).toBe('Tool activity')
+      expect(header).toHaveAccessibleName('Tool activity')
       expect(container.querySelector('[data-state="open"]')?.textContent).toBe(
         'Waiting 1sRead notes'
       )
@@ -314,8 +360,8 @@ describe('AgentGroup inline main activity', () => {
         read,
         { ...wait, data: { ...wait.data, id: 'wait-second' } },
       ])
-      expect(header?.textContent).toBe('Waiting 3s')
-      expect(header).toHaveAccessibleName('Waiting 3s')
+      expect(header?.textContent).toBe('Tool activity')
+      expect(header).toHaveAccessibleName('Tool activity')
       expect(container.querySelector('.overflow-y-auto')).toBe(viewport)
       expect(container.querySelector('[data-state="open"]')?.textContent).toBe(
         'WaitedRead notesWaiting 3s'
@@ -367,9 +413,9 @@ describe('AgentGroup inline main activity', () => {
           })
         )
       )
-      const header = container.querySelector('button')
-      expect(header?.textContent).toBe('Agent — Read files, ran commands')
-      expect(header).toHaveAccessibleName('Agent — Read files, ran commands')
+      const header = container.querySelector<HTMLElement>('[role="button"]')
+      expect(header?.textContent).toBe('Read files, ran commands')
+      expect(header).toHaveAccessibleName('Read files, ran commands')
       expect(container.querySelectorAll('[data-tool-call-id]')).toHaveLength(0)
       act(() => header?.click())
       expect(
@@ -406,12 +452,19 @@ describe('AgentGroup inline main activity', () => {
           ],
           ToolCallComponent: ({ toolCallId, displayTitle, renderStatus }: ToolCallItemProps) => {
             const status = createElement('div', { 'data-tool-call-id': toolCallId }, displayTitle)
-            return renderStatus ? renderStatus(status) : status
+            return renderStatus
+              ? renderStatus({
+                  label: displayTitle,
+                  activeLabel: displayTitle,
+                  isActive: true,
+                  icon: createElement('svg', { 'data-tool-call-id': toolCallId }),
+                })
+              : status
           },
         })
       )
     )
-    const headers = Array.from(container.querySelectorAll('button'))
+    const headers = Array.from(container.querySelectorAll<HTMLElement>('[role="button"]'))
     expect(headers).toHaveLength(2)
     expect(headers.every((header) => header.getAttribute('aria-expanded') === 'true')).toBe(true)
     act(() => headers[0].click())
@@ -512,7 +565,14 @@ describe('AgentGroup inline main activity', () => {
           isStreaming: true,
           ToolCallComponent: ({ toolCallId, displayTitle, renderStatus }: ToolCallItemProps) => {
             const status = createElement('div', { 'data-tool-call-id': toolCallId }, displayTitle)
-            return renderStatus ? renderStatus(status) : status
+            return renderStatus
+              ? renderStatus({
+                  label: displayTitle,
+                  activeLabel: displayTitle,
+                  isActive: true,
+                  icon: createElement('svg', { 'data-tool-call-id': toolCallId }),
+                })
+              : status
           },
         })
       )
@@ -559,8 +619,8 @@ describe('AgentGroup browser takeover', () => {
     expect(liftedQuestion).toBeDefined()
     expect(collapsedLog?.contains(liftedQuestion ?? null)).toBe(false)
 
-    const header = Array.from(container.querySelectorAll('button')).find((button) =>
-      button.textContent?.includes('Browser Agent')
+    const header = Array.from(container.querySelectorAll<HTMLElement>('[role="button"]')).find(
+      (button) => button.hasAttribute('aria-expanded')
     )
     act(() => header?.click())
     expect(container.querySelector('[data-state="open"]')).not.toBeNull()
@@ -648,7 +708,7 @@ describe('AgentGroup browser takeover', () => {
     expect(container.querySelector('.animate-stream-fade-in')).toBeNull()
     // Groups never auto-expand: the answered question lives inside the
     // collapsed log until the user opens it manually.
-    const headerToggle = container.querySelector('button[class*="group/agent"]')
+    const headerToggle = container.querySelector('[role="button"][class*="group/agent"]')
     expect(headerToggle).not.toBeNull()
     act(() => {
       headerToggle?.dispatchEvent(new MouseEvent('click', { bubbles: true }))
@@ -713,10 +773,10 @@ describe('AgentGroup nested status line', () => {
       namedTool('Reading workflow', 'success' as ToolCallStatus, 1),
       group([namedTool('Deploying Invoice Sync as API', 'executing' as ToolCallStatus, 2)]),
     ])
-    expect(header).toContain('Workflow Agent — Deploying Invoice Sync as API')
+    expect(header).toContain('Deploying Invoice Sync as API')
   })
 
-  it('counts running tools across depths with the + n suffix', () => {
+  it('selects the latest running tool across depths', () => {
     const header = render([
       namedTool('Reading workflow', 'executing' as ToolCallStatus, 1),
       group([
@@ -724,8 +784,8 @@ describe('AgentGroup nested status line', () => {
         namedTool('Checking deployment status', 'executing' as ToolCallStatus, 2),
       ]),
     ])
-    // Latest start wins; the other two running become the overflow count.
-    expect(header).toContain('Deploying Invoice Sync as API + 2')
+    /** The latest start wins across the subtree. */
+    expect(header).toContain('Deploying Invoice Sync as API')
   })
 
   it('falls back to the last tool at any depth when nothing is running', () => {
@@ -733,6 +793,6 @@ describe('AgentGroup nested status line', () => {
       namedTool('Reading workflow', 'success' as ToolCallStatus, 1),
       group([namedTool('Deploying Invoice Sync as API', 'success' as ToolCallStatus, 2)]),
     ])
-    expect(header).toContain('Workflow Agent — Deploying Invoice Sync as API')
+    expect(header).toContain('Deploying Invoice Sync as API')
   })
 })
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/browser-agent-icon.test.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/browser-agent-icon.test.tsx
index 70b38e2bf03..13ee89ed18f 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/browser-agent-icon.test.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/browser-agent-icon.test.tsx
@@ -4,6 +4,7 @@
 import { act } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { AgentGroup } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group'
 import type { AgentGroupItem } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group-view'
 import {
   BrowserAgentIcon,
@@ -227,6 +228,58 @@ describe('BrowserAgentIcon', () => {
     )
   }
 
+  it('keeps a loaded favicon paired with the paced label when disclosure appears and the site changes', () => {
+    vi.useFakeTimers()
+    const first = tool({
+      id: 'first',
+      displayTitle: 'Opening first page',
+      result: undefined,
+      status: 'executing',
+      params: { url: 'https://example.com/' },
+    })
+    const second = tool({
+      id: 'second',
+      displayTitle: 'Opening second page',
+      result: undefined,
+      status: 'executing',
+      params: { url: 'https://example.org/' },
+    })
+    const renderGroup = (items: AgentGroupItem[]) =>
+      act(() =>
+        root.render(
+          <AgentGroup
+            agentName='browser'
+            agentLabel='Browser'
+            isStreaming
+            isLaneOpen
+            items={items}
+          />
+        )
+      )
+    try {
+      openPage('https://example.com/')
+      renderGroup([first])
+      const img = container.querySelector('img')!
+      act(() => img.dispatchEvent(new Event('load')))
+      act(() => vi.advanceTimersByTime(100))
+      openPage('https://example.org/')
+      renderGroup([first, second])
+      expect(container.querySelector('img')).toBe(img)
+      expect(container.querySelector('[role="status"]')?.textContent).toBe('Opening first page')
+      expect(container.querySelector('[role="button"]')).not.toBeNull()
+      act(() => vi.advanceTimersByTime(900))
+      expect(container.querySelector('[role="status"]')?.textContent).toBe('Opening second page')
+      const nextImage = container.querySelector('img')!
+      expect(nextImage).not.toBe(img)
+      expect(nextImage.src).toBe('https://example.org/favicon.ico')
+      act(() => nextImage.dispatchEvent(new Event('error')))
+      expect(container.querySelector('img')).toBeNull()
+      expect(container.querySelector('[role="status"] svg')).not.toBeNull()
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
   it('does not contact sites from history, other chats, or pending navigation', () => {
     render('https://example.com/document')
     expect(container.querySelector('img')).toBeNull()
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/main-agent-activity.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/main-agent-activity.tsx
index 82e62b4e3a4..140ddea8e48 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/main-agent-activity.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/main-agent-activity.tsx
@@ -11,6 +11,7 @@ interface MainAgentActivityProps {
   ToolCallComponent: ComponentType<ToolCallItemProps>
   renderItem: (item: AgentGroupItem, index: number) => ReactNode
   autoScrollActivity: boolean
+  isActive: boolean
 }
 
 /** Keep answers and interactions in the transcript, outside collapsible tool history. */
@@ -27,15 +28,17 @@ export function MainAgentActivity({
   ToolCallComponent,
   renderItem,
   autoScrollActivity,
+  isActive,
 }: MainAgentActivityProps) {
   const activity: ReactNode[] = []
   let tools: ToolCallData[] = []
-  const flushTools = () => {
+  const flushTools = (active = false) => {
     if (tools.length === 0) return
     activity.push(
       <ToolActivityGroup
         key={tools[0].id}
         tools={tools}
+        isActive={active}
         ToolCallComponent={ToolCallComponent}
         autoScrollActivity={autoScrollActivity}
       />
@@ -63,7 +66,7 @@ export function MainAgentActivity({
       </Fragment>
     )
   }
-  flushTools()
+  flushTools(isActive)
 
   return <div className='flex min-w-0 flex-col gap-1.5'>{activity}</div>
 }
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-activity-group.test.ts b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-activity-group.test.ts
index e0b17ababbf..e1c23b42d1b 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-activity-group.test.ts
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-activity-group.test.ts
@@ -24,7 +24,18 @@ describe('getToolActivitySummary', () => {
         tool('browser_type'),
         tool('browser_navigate'),
       ])
-    ).toBe('Navigated pages, read pages +1 more')
+    ).toBe('Navigated, read pages +1 more')
+  })
+
+  it.each([
+    [['browser_navigate', 'browser_read_text'], 'Navigated, read pages'],
+    [['browser_read_text', 'browser_navigate'], 'Read, navigated pages'],
+    [['browser_navigate', 'browser_read_text', 'browser_scroll'], 'Navigated, read pages +1 more'],
+    [['browser_navigate', 'browser_type'], 'Navigated pages, entered text'],
+    [['browser_navigate', 'browser_navigate'], 'Navigated pages'],
+    [['read', 'browser_read_text'], 'Read files, read pages'],
+  ])('compacts only explicit shared objects: %j', (names, expected) => {
+    expect(getToolActivitySummary((names as string[]).map((name) => tool(name)))).toBe(expected)
   })
 
   it('does not describe unsuccessful work as completed actions', () => {
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-activity-group.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-activity-group.tsx
index d426fe587da..11b95a3833e 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-activity-group.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-activity-group.tsx
@@ -2,10 +2,11 @@
 
 import { type ComponentType, Fragment, useState } from 'react'
 import { ActivityStatus } from '@/components/ui/activity-status'
-import { getToolActivityLabel } from '@/lib/copilot/tools/tool-activity'
+import { getToolActivitySummaryActions } from '@/lib/copilot/tools/tool-activity'
 import { getToolStatusDisplayTitle } from '@/lib/copilot/tools/tool-display'
-import { ActivityDisclosure } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/activity-disclosure'
+import { ActivityStream } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/activity-stream'
 import type { ToolCallItemProps } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item'
+import { getActivityAttentionKey } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-interactions'
 import { getToolIcon } from '@/app/workspace/[workspaceId]/home/components/message-content/utils'
 import { type ToolCallData, ToolCallStatus } from '@/app/workspace/[workspaceId]/home/types'
 
@@ -15,94 +16,126 @@ const MAX_SUMMARY_ACTIONS = 2
 export function getToolActivitySummary(tools: ToolCallData[]): string {
   if (tools.length === 1) {
     const tool = tools[0]
-    return getToolStatusDisplayTitle(tool.displayTitle, tool.status, tool.toolName)
+    return getToolStatusDisplayTitle(
+      tool.displayTitle,
+      tool.status,
+      tool.toolName,
+      tool.activityDescription
+    )
   }
-  const labels = new Set<string>()
+  const { labels, additionalActions } = getToolActivitySummaryActions(
+    tools.filter((tool) => tool.status === ToolCallStatus.success),
+    MAX_SUMMARY_ACTIONS
+  )
+  const summary = labels.join(', ')
+  const summaryLabel = summary ? summary[0].toUpperCase() + summary.slice(1) : 'Tool activity'
+  return [
+    additionalActions > 0 ? `${summaryLabel} +${additionalActions} more` : summaryLabel,
+    ...getToolActivityOutcomes(tools),
+  ].join(' · ')
+}
+
+function getToolActivityOutcomes(tools: ToolCallData[]): string[] {
   let failed = 0
   let stopped = 0
   let skipped = 0
   for (const tool of tools) {
-    if (tool.status === ToolCallStatus.success) {
-      labels.add(getToolActivityLabel(tool.toolName, tool.params))
-    } else if (tool.status === ToolCallStatus.error || tool.status === ToolCallStatus.rejected)
-      failed++
+    if (tool.status === ToolCallStatus.error || tool.status === ToolCallStatus.rejected) failed++
     else if (tool.status === ToolCallStatus.cancelled || tool.status === ToolCallStatus.interrupted)
       stopped++
     else if (tool.status === ToolCallStatus.skipped) skipped++
   }
-  const summary = Array.from(labels).slice(0, MAX_SUMMARY_ACTIONS).join(', ')
-  const summaryLabel = summary ? summary[0].toUpperCase() + summary.slice(1) : 'Tool activity'
-  const additionalActions = Math.max(0, labels.size - MAX_SUMMARY_ACTIONS)
-  const outcomes = [
-    failed && `${failed} failed`,
-    stopped && `${stopped} stopped`,
-    skipped && `${skipped} skipped`,
-  ].filter(Boolean)
   return [
-    additionalActions > 0 ? `${summaryLabel} +${additionalActions} more` : summaryLabel,
-    ...outcomes,
-  ].join(' · ')
+    ...(failed ? [`${failed} failed`] : []),
+    ...(stopped ? [`${stopped} stopped`] : []),
+    ...(skipped ? [`${skipped} skipped`] : []),
+  ]
+}
+
+/** Keep earlier parallel failures visible while the latest action continues. */
+export function getActiveToolActivityTitle(
+  label: string,
+  tool: ToolCallData,
+  tools: ToolCallData[]
+): string {
+  return tool.status === ToolCallStatus.executing || tool.status === ToolCallStatus.success
+    ? [label, ...getToolActivityOutcomes(tools)].join(' · ')
+    : label
+}
+
+/** Keep running work visible until every parallel call finishes. */
+export function getActivityStatusTool(tools: ToolCallData[]): ToolCallData | undefined {
+  return (
+    tools.reduce<ToolCallData | undefined>(
+      (newest, tool) =>
+        tool.status === ToolCallStatus.executing &&
+        (!newest || (tool.startedAt ?? 0) >= (newest.startedAt ?? 0))
+          ? tool
+          : newest,
+      undefined
+    ) ?? tools.at(-1)
+  )
 }
 
 interface ToolActivityGroupProps {
   tools: ToolCallData[]
   ToolCallComponent: ComponentType<ToolCallItemProps>
   autoScrollActivity?: boolean
+  isActive?: boolean
 }
 
 export function ToolActivityGroup({
   tools,
   ToolCallComponent,
   autoScrollActivity = true,
+  isActive = false,
 }: ToolActivityGroupProps) {
   const [expanded, setExpanded] = useState(false)
-  let activeTool: ToolCallData | undefined
-  for (let index = tools.length - 1; index >= 0; index--) {
-    if (tools[index].status === ToolCallStatus.executing) {
-      activeTool = tools[index]
-      break
-    }
-  }
-  const statusTool = activeTool ?? tools[tools.length - 1]
+  const statusTool = getActivityStatusTool(tools)
+  if (!statusTool) return null
+  const working = isActive || tools.some((tool) => tool.status === ToolCallStatus.executing)
+  const headerActive =
+    working &&
+    (statusTool.status === ToolCallStatus.executing || statusTool.status === ToolCallStatus.success)
+  const attentionKey = getActivityAttentionKey(tools)
   const SummaryIcon = getToolIcon(tools[0].toolName)
 
   return (
     <ToolCallComponent
       {...statusTool}
       toolCallId={statusTool.id}
-      renderStatus={(status) => {
-        if (tools.length === 1) return status
-        return (
-          <ActivityDisclosure
-            header={
-              activeTool ? (
-                status
-              ) : (
-                <ActivityStatus
-                  label={getToolActivitySummary(tools)}
-                  isActive={false}
-                  icon={<SummaryIcon className='size-full' />}
-                />
-              )
-            }
-            expanded={expanded}
-            onToggle={() => setExpanded(!expanded)}
-            isStreaming={Boolean(activeTool) && autoScrollActivity}
-          >
-            <div className='flex min-w-0 flex-col gap-1.5 py-0.5 pl-6'>
-              {tools.map((tool) => (
-                <Fragment key={tool.id}>
-                  {tool.id === statusTool.id ? (
-                    status
-                  ) : (
-                    <ToolCallComponent {...tool} toolCallId={tool.id} />
-                  )}
-                </Fragment>
-              ))}
-            </div>
-          </ActivityDisclosure>
-        )
-      }}
+      renderStatus={(status) => (
+        <ActivityStream
+          activity={{
+            label: working
+              ? getActiveToolActivityTitle(status.activeLabel, statusTool, tools)
+              : tools.length === 1
+                ? status.label
+                : getToolActivitySummary(tools),
+            isActive: headerActive,
+            icon:
+              working || tools.length === 1 ? status.icon : <SummaryIcon className='size-full' />,
+          }}
+          activityKey={statusTool.id}
+          attentionKey={attentionKey}
+          collapsible={tools.length > 1}
+          expanded={expanded}
+          onToggle={() => setExpanded(!expanded)}
+          isStreaming={working && autoScrollActivity}
+        >
+          <div className='flex min-w-0 flex-col gap-1.5 py-0.5 pl-6'>
+            {tools.map((tool) => (
+              <Fragment key={tool.id}>
+                {tool.id === statusTool.id ? (
+                  <ActivityStatus {...status} />
+                ) : (
+                  <ToolCallComponent {...tool} toolCallId={tool.id} />
+                )}
+              </Fragment>
+            ))}
+          </div>
+        </ActivityStream>
+      )}
     />
   )
 }
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item.test.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item.test.tsx
index b52d7b1b0e6..1692702faec 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item.test.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item.test.tsx
@@ -5,9 +5,11 @@ import { act, type ReactNode, type SVGProps } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
 import { renderToStaticMarkup } from 'react-dom/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { ToolActivityGroup } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-activity-group'
+import { ToolCallItem } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item'
+import type { ToolCallData } from '@/app/workspace/[workspaceId]/home/types'
 import { notifyBlockOverlayChanged } from '@/blocks/custom/client-overlay'
 import { getBlock, getBlockByToolName } from '@/blocks/registry'
-import { ToolCallItem } from './tool-call-item'
 
 vi.mock('@/components/ui', () => ({
   ShimmerText: ({ children }: { children: ReactNode }) => <span>{children}</span>,
@@ -48,6 +50,90 @@ describe('ToolCallItem', () => {
     expect(markup).not.toContain('Writing brief.md')
   })
 
+  it.each([
+    ['executing', 'Checking the invoice totals'],
+    ['success', 'Checked the invoice totals'],
+    ['error', 'Failed checking the invoice totals'],
+    ['cancelled', 'Stopped checking the invoice totals'],
+    ['rejected', 'Failed checking the invoice totals'],
+    ['skipped', 'Skipped checking the invoice totals'],
+  ] as const)(
+    'projects %s from the actual tool status onto the model description',
+    (status, title) => {
+      const markup = renderToStaticMarkup(
+        <ToolCallItem
+          toolName='prepare_file_edit'
+          displayTitle='Editing report.md'
+          activityDescription='Checking the invoice totals'
+          status={status}
+          streamingArgs='{"operation":"patch","title":"report.md"}'
+        />
+      )
+
+      expect(markup).toContain(title)
+      expect(markup).not.toContain('report.md')
+    }
+  )
+
+  it.each(['   ', 'a'.repeat(161)])(
+    'uses the existing title for an invalid description',
+    (activityDescription) => {
+      const markup = renderToStaticMarkup(
+        <ToolCallItem
+          toolName='grep'
+          displayTitle='Searching files'
+          activityDescription={activityDescription}
+          status='executing'
+        />
+      )
+
+      expect(markup).toContain('Searching files')
+    }
+  )
+
+  it('keeps an executing wait countdown in place of the model phrase', () => {
+    const markup = renderToStaticMarkup(
+      <ToolCallItem
+        toolName='wait'
+        displayTitle='Waiting'
+        activityDescription='Waiting for the export'
+        status='executing'
+        params={{ seconds: 10 }}
+      />
+    )
+
+    expect(markup).toContain('10s')
+    expect(markup).not.toContain('Waiting for the export')
+  })
+
+  it('renders model descriptions as text, without interpreting markup', () => {
+    const markup = renderToStaticMarkup(
+      <ToolCallItem
+        toolName='read'
+        displayTitle='Reading a page'
+        activityDescription='Reading <script>alert(1)</script>'
+        status='executing'
+      />
+    )
+
+    expect(markup).toContain('&lt;script&gt;')
+    expect(markup).not.toContain('<script>')
+  })
+
+  it('does not let model-authored outcome wording override a failure', () => {
+    const markup = renderToStaticMarkup(
+      <ToolCallItem
+        toolName='read'
+        displayTitle='Reading a page'
+        activityDescription='Stopped checking invoices'
+        status='error'
+      />
+    )
+
+    expect(markup).toContain('Failed checking invoices')
+    expect(markup).not.toContain('Stopped checking invoices')
+  })
+
   it('defensively applies the completed verb for every successful tool row', () => {
     const markup = renderToStaticMarkup(
       <ToolCallItem toolName='diff_workflows' displayTitle='Comparing workflows' status='success' />
@@ -101,7 +187,8 @@ describe('ToolCallItem', () => {
       />
     )
 
-    expect(markup).toContain('<svg')
+    expect(markup).toContain('data-testid="gmail-icon"')
+    expect(getBlockByToolName).toHaveBeenCalledWith('gmail_read_v2')
     expect(markup).toContain('Searching for invoice emails')
   })
 
@@ -119,10 +206,64 @@ describe('ToolCallItem', () => {
       />
     )
 
-    expect(markup).toContain('<svg')
+    expect(markup).toContain('data-testid="gmail-icon"')
+    expect(getBlockByToolName).toHaveBeenCalledWith('gmail_read_v2')
     expect(markup).toContain('Read recent emails')
   })
 
+  it('keeps the integration icon with its paced action through completion', () => {
+    vi.useFakeTimers()
+    const container = document.createElement('div')
+    const root = createRoot(container)
+    const gmail = (props: SVGProps<SVGSVGElement>) => <svg {...props} data-testid='gmail-icon' />
+    const slack = (props: SVGProps<SVGSVGElement>) => <svg {...props} data-testid='slack-icon' />
+    vi.mocked(getBlockByToolName).mockImplementation(
+      (name) =>
+        ({ name, icon: name === 'gmail_read_v2' ? gmail : slack }) as ReturnType<
+          typeof getBlockByToolName
+        >
+    )
+    const first: ToolCallData = {
+      id: 'mail',
+      toolName: 'gmail_read_v2',
+      displayTitle: 'Reading mail',
+      status: 'executing',
+    }
+    const next: ToolCallData = {
+      id: 'slack',
+      toolName: 'slack_message',
+      displayTitle: 'Reading messages',
+      status: 'executing',
+    }
+    const render = (tools: ToolCallData[], isActive = true) =>
+      act(() =>
+        root.render(
+          <ToolActivityGroup tools={tools} isActive={isActive} ToolCallComponent={ToolCallItem} />
+        )
+      )
+    const header = () => container.querySelector('[role="status"]')!
+    try {
+      render([first])
+      const icon = header().querySelector('[data-testid="gmail-icon"]')
+      expect(icon).not.toBeNull()
+      act(() => vi.advanceTimersByTime(100))
+      render([{ ...first, status: 'success' }, next])
+      expect(header().textContent).toBe('Reading mail')
+      expect(header().querySelector('[data-testid="gmail-icon"]')).toBe(icon)
+      expect(header().querySelector('[data-testid="slack-icon"]')).toBeNull()
+      act(() => vi.advanceTimersByTime(900))
+      expect(header().textContent).toBe('Reading messages')
+      expect(header().querySelector('[data-testid="slack-icon"]')).not.toBeNull()
+      render([{ ...next, status: 'success' }], false)
+      expect(header().querySelector('[data-testid="slack-icon"]')).not.toBeNull()
+      expect(container.querySelector('[role="button"]')).toBeNull()
+    } finally {
+      act(() => root.unmount())
+      vi.mocked(getBlockByToolName).mockReset()
+      vi.useRealTimers()
+    }
+  })
+
   it('refreshes the read icon when custom blocks hydrate after mount', () => {
     vi.mocked(getBlock).mockReturnValue(undefined)
     const container = document.createElement('div')
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item.tsx
index f7a1c4ceaae..7d2bec15dd5 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item.tsx
@@ -1,6 +1,6 @@
 import { type ReactNode, useEffect, useMemo, useState } from 'react'
 import { isPlainRecord } from '@sim/utils/object'
-import { ActivityStatus } from '@/components/ui/activity-status'
+import { ActivityStatus, type ActivityStatusProps } from '@/components/ui/activity-status'
 import {
   CallIntegrationTool,
   PrepareFileEdit,
@@ -45,6 +45,7 @@ export function CircleStop({ className }: { className?: string }) {
 export interface ToolCallItemProps {
   toolName: string
   displayTitle: string
+  activityDescription?: string
   status: ToolCallStatus
   params?: Record<string, unknown>
   result?: ToolCallData['result']
@@ -54,7 +55,12 @@ export interface ToolCallItemProps {
   /** When the call started, used to count down a running `wait`. */
   startedAt?: number
   /** Projects one computed status into a header and history without duplicating tool state. */
-  renderStatus?: (status: ReactNode) => ReactNode
+  renderStatus?: (status: ToolActivityPresentation) => ReactNode
+}
+
+export interface ToolActivityPresentation extends ActivityStatusProps {
+  /** Keep the action in progress while its containing activity group remains open. */
+  activeLabel: string
 }
 
 function stringParam(params: Record<string, unknown> | undefined, key: string): string {
@@ -125,6 +131,7 @@ function useElapsedMs(
 export function ToolCallItem({
   toolName,
   displayTitle,
+  activityDescription,
   status,
   params,
   result,
@@ -188,7 +195,12 @@ export function ToolCallItem({
   const liveTitle = isCountingDown
     ? getWaitCountdownTitle(params, elapsedMs)
     : liveWorkspaceFileTitle || displayTitle
-  const title = getToolStatusDisplayTitle(liveTitle, status, toolName)
+  const title = getToolStatusDisplayTitle(
+    liveTitle,
+    status,
+    toolName,
+    isCountingDown ? undefined : activityDescription
+  )
 
   // A waiting terminal handoff swaps its row for the hand-back chip, the same
   // way a browser takeover does: the row would otherwise spin with nothing
@@ -209,7 +221,7 @@ export function ToolCallItem({
       <ToolPermissionCard
         toolCallId={toolCallId}
         toolName={toolName}
-        displayTitle={liveTitle}
+        displayTitle={title}
         params={params}
       />
     )
@@ -240,18 +252,18 @@ export function ToolCallItem({
     )
   }
 
-  const activity = (
-    <ActivityStatus
-      label={title}
-      isActive={isExecuting}
-      icon={
-        BlockIcon ? (
-          <BrandIcon icon={BlockIcon} className='size-full' />
-        ) : (
-          <ToolIcon className='size-full' />
-        )
-      }
-    />
-  )
-  return renderStatus ? renderStatus(activity) : activity
+  const activity: ToolActivityPresentation = {
+    label: title,
+    activeLabel:
+      status === 'success'
+        ? getToolStatusDisplayTitle(liveTitle, 'executing', toolName, activityDescription)
+        : title,
+    isActive: isExecuting,
+    icon: BlockIcon ? (
+      <BrandIcon icon={BlockIcon} className='size-full' />
+    ) : (
+      <ToolIcon className='size-full' />
+    ),
+  }
+  return renderStatus ? renderStatus(activity) : <ActivityStatus {...activity} />
 }
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-interactions.ts b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-interactions.ts
index 245c0f4a112..e4c5df1a29f 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-interactions.ts
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-interactions.ts
@@ -10,3 +10,15 @@ export function needsToolInput(tool: ToolCallData): boolean {
       tool.params?.operation === 'handoff')
   )
 }
+
+/** Attention changes must never wait for the activity header's cosmetic cadence. */
+export function getActivityAttentionKey(tools: ToolCallData[]): string {
+  return tools
+    .filter(
+      (tool) =>
+        (tool.status !== ToolCallStatus.executing && tool.status !== ToolCallStatus.success) ||
+        needsToolInput(tool)
+    )
+    .map((tool) => `${tool.id}:${tool.status}`)
+    .join('|')
+}
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/message-content-thinking.test.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/message-content-thinking.test.tsx
new file mode 100644
index 00000000000..e7d75c4f3f7
--- /dev/null
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/message-content-thinking.test.tsx
@@ -0,0 +1,200 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { act } from 'react'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { MessageContent } from '@/app/workspace/[workspaceId]/home/components/message-content/message-content'
+import type { ContentBlock, ToolCallStatus } from '@/app/workspace/[workspaceId]/home/types'
+
+vi.mock('@/lib/auth/auth-client', () => ({
+  useSession: vi.fn(() => ({ data: null, isPending: false })),
+}))
+
+function start(name: string, parentSpanId = 'main'): ContentBlock {
+  return { type: 'subagent', content: name, spanId: name, parentSpanId, timestamp: 1 }
+}
+
+function tool(spanId: string, status: ToolCallStatus = 'executing'): ContentBlock {
+  return {
+    type: 'tool_call',
+    spanId,
+    toolCall: {
+      id: `${spanId}-read`,
+      name: 'read',
+      calledBy: spanId,
+      status,
+      activityDescription: `Reading ${spanId} notes`,
+    },
+    timestamp: 2,
+  }
+}
+
+describe('MessageContent shared thinking indicator', () => {
+  let queryClient: QueryClient
+  let root: Root
+  let container: HTMLDivElement
+
+  beforeEach(() => {
+    queryClient = new QueryClient()
+    vi.useFakeTimers()
+    vi.stubGlobal('matchMedia', vi.fn().mockReturnValue({ matches: false }))
+    ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+  })
+
+  afterEach(() => {
+    act(() => root.unmount())
+    container.remove()
+    queryClient.clear()
+    vi.useRealTimers()
+    vi.unstubAllGlobals()
+  })
+
+  const render = (blocks: ContentBlock[], isStreaming = true) =>
+    act(() => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <MessageContent blocks={blocks} fallbackContent='' isStreaming={isStreaming} isLast />
+        </QueryClientProvider>
+      )
+    })
+  const thinking = () => container.querySelectorAll('[aria-hidden="false"] svg')
+  const groups = () => container.querySelectorAll('[data-agent-group]')
+
+  it('shares one indicator across parallel and nested empty agents', () => {
+    render([start('workflow'), start('browser'), start('deploy', 'workflow')])
+    expect(thinking()).toHaveLength(1)
+    expect(groups()).toHaveLength(0)
+    expect(container.querySelector('[role="status"]')).toBeNull()
+  })
+
+  it('hands off immediately to meaningful activity without remounting existing rows', () => {
+    const blocks = [start('workflow'), start('browser')]
+    render(blocks)
+    expect(thinking()).toHaveLength(1)
+    render([...blocks, tool('workflow')])
+    expect(thinking()).toHaveLength(0)
+    expect(groups()).toHaveLength(1)
+    const firstRow = container.querySelector('[role="status"]')
+    expect(firstRow?.textContent).toBe('Reading workflow notes')
+    render([...blocks, tool('workflow'), tool('browser')])
+    expect(groups()).toHaveLength(2)
+    expect(container.querySelector('[role="status"]')).toBe(firstRow)
+    expect(thinking()).toHaveLength(0)
+  })
+
+  it('shows the pending indicator after the only visible agent finishes', () => {
+    const blocks = [start('workflow'), start('browser'), tool('workflow', 'success')]
+    render(blocks)
+    expect(thinking()).toHaveLength(0)
+    render([...blocks, { type: 'subagent_end', spanId: 'workflow', timestamp: 3 }])
+    expect(thinking()).toHaveLength(1)
+    expect(groups()).toHaveLength(1)
+  })
+
+  it('keeps a singleton action flat when its nested agent has no output', () => {
+    render([start('workflow'), tool('workflow'), start('deploy', 'workflow')])
+    expect(groups()).toHaveLength(1)
+    expect(container.querySelectorAll('[role="status"]')).toHaveLength(1)
+    expect(container.querySelector('[role="button"]')).toBeNull()
+    expect(thinking()).toHaveLength(0)
+  })
+
+  it('retains nested activity while another child is empty', () => {
+    render([
+      start('workflow'),
+      start('deploy', 'workflow'),
+      start('browser', 'workflow'),
+      tool('deploy'),
+    ])
+    const trigger = container.querySelector<HTMLElement>('[role="button"]')!
+    act(() => trigger.click())
+    expect(container.querySelector('[data-state="open"]')?.textContent).toContain(
+      'Reading deploy notes'
+    )
+    expect(container.querySelectorAll('[role="status"]')).toHaveLength(2)
+    expect(thinking()).toHaveLength(0)
+  })
+
+  it('preserves narration and skips whitespace-only output', () => {
+    const blocks: ContentBlock[] = [
+      start('workflow'),
+      { type: 'subagent_text', spanId: 'workflow', content: '  ', timestamp: 2 },
+    ]
+    render(blocks)
+    expect(groups()).toHaveLength(0)
+    expect(thinking()).toHaveLength(1)
+    render(
+      [
+        ...blocks,
+        { type: 'subagent_text', spanId: 'workflow', content: 'Checking the setup.', timestamp: 3 },
+      ],
+      false
+    )
+    expect(groups()).toHaveLength(1)
+    act(() => container.querySelector<HTMLElement>('[role="button"]')!.click())
+    expect(container.querySelector('[data-state="open"]')?.textContent).toContain(
+      'Checking the setup.'
+    )
+  })
+
+  it.each(['awaiting_approval', 'error', 'cancelled', 'rejected'] as const)(
+    'keeps %s tool rows visible while another agent is pending',
+    (status) => {
+      render([start('workflow'), start('browser'), tool('workflow', status)])
+      expect(groups()).toHaveLength(1)
+      expect(container.querySelector('[role="status"]')?.textContent).toContain('workflow notes')
+      expect(thinking()).toHaveLength(1)
+    }
+  )
+
+  it('keeps thinking hidden while prose streams and finishes revealing', () => {
+    const blocks: ContentBlock[] = [
+      start('browser'),
+      {
+        type: 'text',
+        content: 'Here is the result of reviewing the project and checking its configuration.',
+        timestamp: 3,
+      },
+    ]
+    render([start('browser'), { type: 'text', content: 'Here is', timestamp: 3 }])
+    render(blocks)
+    act(() => vi.advanceTimersByTime(100))
+    expect(thinking()).toHaveLength(0)
+    render(blocks, false)
+    expect(thinking()).toHaveLength(0)
+  })
+
+  it('waits for the normal quiet period between prose chunks while an agent is pending', () => {
+    const prose = 'Here is the result of reviewing the project and checking its configuration.'
+    const blocks: ContentBlock[] = [
+      start('browser'),
+      { type: 'text', content: prose, timestamp: 3 },
+    ]
+    render(blocks)
+    expect(thinking()).toHaveLength(0)
+    act(() => vi.advanceTimersByTime(1_499))
+    expect(thinking()).toHaveLength(0)
+    act(() => vi.advanceTimersByTime(1))
+    expect(thinking()).toHaveLength(1)
+    render([...blocks, { type: 'text', content: ' The configuration is valid.', timestamp: 4 }])
+    expect(thinking()).toHaveLength(0)
+  })
+
+  it('removes thinking when a turn stops or finishes without agent output', () => {
+    const blocks = [start('workflow'), start('browser')]
+    render(blocks)
+    expect(thinking()).toHaveLength(1)
+    render([...blocks, { type: 'stopped', timestamp: 3 }], false)
+    expect(thinking()).toHaveLength(0)
+    expect(groups()).toHaveLength(0)
+    expect(container.textContent).toContain('Stopped')
+    render(blocks, false)
+    expect(thinking()).toHaveLength(0)
+    expect(groups()).toHaveLength(0)
+  })
+})
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/message-content.test.ts b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/message-content.test.ts
index c89261507ee..19543772721 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/message-content.test.ts
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/message-content.test.ts
@@ -25,7 +25,7 @@ import {
 import { modelToContentBlocks } from '@/app/workspace/[workspaceId]/home/hooks/stream/turn-model-serialize'
 import type { ContentBlock } from '../../types'
 import {
-  assistantMessageHasVisibleExecutingTool,
+  assistantMessageHasVisibleActivity,
   deriveThinkingLabel,
   getOrchestratorMessageText,
   parseBlocks,
@@ -162,6 +162,33 @@ describe('getOrchestratorMessageText', () => {
 })
 
 describe('parseBlocks span-identity tree', () => {
+  it.each(['read', 'respond', 'prepare_file_edit'])(
+    'prefers invocation intent over %s fallback titles',
+    (name) => {
+      const segments = parseBlocks([
+        {
+          type: 'tool_call',
+          toolCall: {
+            id: 'described-tool',
+            name,
+            status: 'success',
+            displayTitle: 'Fallback title',
+            activityDescription: '  Checking\nlaunch updates ',
+            params: { path: 'workspace/files/brief.md' },
+          },
+          timestamp: 1,
+        },
+      ])
+      const group = segments[0]
+      if (group.type !== 'agent_group') throw new Error('expected mothership group')
+      const tool = group.items[0]
+      if (tool?.type !== 'tool') throw new Error('expected tool activity')
+      expect(tool.data.displayTitle).toBe('Checked launch updates')
+      expect(tool.data.activityDescription).toBe('Checking launch updates')
+      expect(tool.data.params).toEqual({ path: 'workspace/files/brief.md' })
+    }
+  )
+
   it('refines a completed credential rename with its previous and new names', () => {
     const segments = parseBlocks([
       {
@@ -786,7 +813,22 @@ describe('parseBlocks legacy — thinking between top-level tools', () => {
   })
 })
 
-describe('assistantMessageHasVisibleExecutingTool', () => {
+describe('assistantMessageHasVisibleActivity', () => {
+  it('keeps the main tail active between calls but closes it when narration follows', () => {
+    const blocks = [mainToolCall('finished', 'read')]
+    expect(assistantMessageHasVisibleActivity(parseBlocks(blocks), true)).toBe(true)
+    expect(assistantMessageHasVisibleActivity(parseBlocks(blocks), false)).toBe(false)
+    expect(
+      assistantMessageHasVisibleActivity(parseBlocks([...blocks, mainText('Done.')]), true)
+    ).toBe(false)
+  })
+
+  it('leaves an empty open subagent to the turn indicator', () => {
+    const segments = parseBlocks([subagentStart('workflow', 'S1', 'main')])
+    expect(assistantMessageHasVisibleActivity(segments, true)).toBe(false)
+    expect(assistantMessageHasVisibleActivity(segments, false)).toBe(false)
+  })
+
   it.each([undefined, 'main'])('retains an earlier running tool with spanId=%s', (spanId) => {
     const blocks: ContentBlock[] = [
       {
@@ -800,14 +842,12 @@ describe('assistantMessageHasVisibleExecutingTool', () => {
     ]
     const segments = parseBlocks(blocks)
     expect(segments.map((segment) => segment.type)).toEqual(['agent_group', 'text', 'agent_group'])
-    expect(assistantMessageHasVisibleExecutingTool(segments)).toBe(true)
+    expect(assistantMessageHasVisibleActivity(segments)).toBe(true)
   })
 
   it('does not treat an open subagent lane as an executing tool row', () => {
     expect(
-      assistantMessageHasVisibleExecutingTool(
-        parseBlocks([subagentStart('workflow', 'S1', 'main')])
-      )
+      assistantMessageHasVisibleActivity(parseBlocks([subagentStart('workflow', 'S1', 'main')]))
     ).toBe(false)
   })
 
@@ -821,7 +861,7 @@ describe('assistantMessageHasVisibleExecutingTool', () => {
         timestamp: 3,
       },
     ]
-    expect(assistantMessageHasVisibleExecutingTool(parseBlocks(blocks))).toBe(true)
+    expect(assistantMessageHasVisibleActivity(parseBlocks(blocks))).toBe(true)
   })
 
   it('does not let open parallel lanes suppress the single turn-level indicator', () => {
@@ -829,7 +869,7 @@ describe('assistantMessageHasVisibleExecutingTool', () => {
       subagentStart('workflow', 'S1', 'main'),
       subagentStart('search', 'S2', 'main'),
     ]
-    expect(assistantMessageHasVisibleExecutingTool(parseBlocks(blocks))).toBe(false)
+    expect(assistantMessageHasVisibleActivity(parseBlocks(blocks))).toBe(false)
   })
 
   it('ignores the executing dispatch tool represented by its subagent lane', () => {
@@ -844,7 +884,7 @@ describe('assistantMessageHasVisibleExecutingTool', () => {
         parentToolCallId: 'dispatch-1',
       },
     ]
-    expect(assistantMessageHasVisibleExecutingTool(parseBlocks(blocks))).toBe(false)
+    expect(assistantMessageHasVisibleActivity(parseBlocks(blocks))).toBe(false)
   })
 })
 
@@ -941,6 +981,6 @@ describe('deriveThinkingLabel', () => {
     expect(deriveThinkingLabel([mainToolCall('t1', 'workflow')])).toBe('Dispatching…')
     expect(deriveThinkingLabel([mainToolCall('t1', 'prepare_file_edit')])).toBe('Dispatching…')
     expect(deriveThinkingLabel([mainToolCall('t1', 'grep')])).toBe('Thinking…')
-    expect(deriveThinkingLabel([subagentStart('workflow', 'S1', 'main')])).toBeNull()
+    expect(deriveThinkingLabel([subagentStart('workflow', 'S1', 'main')])).toBe('Thinking…')
   })
 })
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/message-content.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/message-content.tsx
index 54931cf07dd..da219a9ff30 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/message-content.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/message-content.tsx
@@ -15,12 +15,20 @@ import { PrepareFileEdit, Read as ReadTool } from '@/lib/copilot/generated/tool-
 import { isToolHiddenInUi } from '@/lib/copilot/tools/client/hidden-tools'
 import { resolveToolDisplay } from '@/lib/copilot/tools/client/store-utils'
 import { ClientToolCallState } from '@/lib/copilot/tools/client/tool-call-state'
+import { RETIRED_BROWSER_REQUEST_TAKEOVER_ID } from '@/lib/copilot/tools/retired-tools'
 import {
   getToolDisplayTitle,
   getToolStatusDisplayTitle,
   humanizeToolName,
+  normalizeToolActivityDescription,
 } from '@/lib/copilot/tools/tool-display'
 import { useChatSurface } from '@/app/workspace/[workspaceId]/home/components/chat-surface-context'
+import {
+  collectGroupTools,
+  hasAgentGroupItemContent,
+  hasPendingAgentGroup,
+} from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group-content'
+import { getActivityStatusTool } from '@/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-activity-group'
 import type { CredentialSubmissionPayload } from '@/app/workspace/[workspaceId]/home/components/message-content/components/special-tags'
 import { collectMessageSources } from '@/app/workspace/[workspaceId]/home/components/message-content/message-sources'
 import { resolveMessageCitations } from '@/app/workspace/[workspaceId]/home/components/message-content/resolve-citations'
@@ -200,15 +208,22 @@ function getOverrideDisplayTitle(tc: NonNullable<ContentBlock['toolCall']>): str
 }
 
 function toToolData(tc: NonNullable<ContentBlock['toolCall']>): ToolCallData {
+  const activityDescription = normalizeToolActivityDescription(tc.activityDescription)
   const overrideDisplayTitle = getOverrideDisplayTitle(tc)
   const resolvedTitle =
     overrideDisplayTitle || tc.displayTitle || getToolDisplayTitle(tc.name, tc.params)
-  const displayTitle = getToolStatusDisplayTitle(resolvedTitle, tc.status, tc.name)
+  const displayTitle = getToolStatusDisplayTitle(
+    resolvedTitle,
+    tc.status,
+    tc.name,
+    activityDescription
+  )
 
   return {
     id: tc.id,
     toolName: tc.name,
     displayTitle,
+    activityDescription,
     status: tc.status,
     params: tc.params,
     result: tc.result,
@@ -755,21 +770,37 @@ export function assistantMessageHasRenderableContent(
       : fallbackContent.trim()
         ? [{ type: 'text' as const, id: 'text-fallback', content: fallbackContent }]
         : []
-  return segments.length > 0
+  return segments.some(
+    (segment) => segment.type !== 'agent_group' || segment.items.some(hasAgentGroupItemContent)
+  )
 }
 
-/** True when the transcript is already rendering an executing tool row. */
-export function assistantMessageHasVisibleExecutingTool(segments: MessageSegment[]): boolean {
-  const hasExecutingTool = (items: AgentGroupItem[]): boolean =>
-    items.some((item) =>
-      item.type === 'tool'
-        ? item.data.status === 'executing'
-        : item.type === 'agent_group' && hasExecutingTool(item.group.items)
+/** The transcript already owns an activity indicator, including gaps between calls. */
+export function assistantMessageHasVisibleActivity(
+  segments: MessageSegment[],
+  isStreaming = false
+): boolean {
+  return segments.some((segment, index) => {
+    if (segment.type !== 'agent_group' || !segment.items.some(hasAgentGroupItemContent)) {
+      return false
+    }
+    const tools = collectGroupTools(segment.items)
+    if (tools.some((tool) => tool.status === 'executing')) return true
+    if (!isStreaming) return false
+    if (segment.agentName !== 'mothership') {
+      const statusTool = getActivityStatusTool(tools)
+      return (
+        (segment.isOpen || segment.isDelegating) && (!statusTool || statusTool.status === 'success')
+      )
+    }
+    const lastItem = segment.items.at(-1)
+    return (
+      index === segments.length - 1 &&
+      lastItem?.type === 'tool' &&
+      lastItem.data.status === 'success' &&
+      lastItem.data.toolName !== RETIRED_BROWSER_REQUEST_TAKEOVER_ID
     )
-
-  return segments.some(
-    (segment) => segment.type === 'agent_group' && hasExecutingTool(segment.items)
-  )
+  })
 }
 
 export function shouldSmoothTextSegment({
@@ -792,15 +823,12 @@ const DISPATCH_TOOL_NAMES = new Set([...SUBAGENT_KEYS, ...Object.values(SUBAGENT
  * phrase describes the wait, not the output: a stall after streamed text is
  * the agent deciding what's next — Thinking — never "Generating" (while text
  * actually generates the shimmer is hidden). Dispatching covers only the
- * dispatch call itself (whose tool row the parser absorbs, so nothing else
- * shows); once the lane is open its own delegating shimmer owns the state and
- * the turn-level one stays hidden (`null`).
+ * dispatch call itself (whose tool row the parser absorbs). Empty agent lanes
+ * share this indicator until a visible activity row takes over.
  */
-export function deriveThinkingLabel(blocks: ContentBlock[]): string | null {
+export function deriveThinkingLabel(blocks: ContentBlock[]): string {
   const last = blocks[blocks.length - 1]
   switch (last?.type) {
-    case 'subagent':
-      return null
     case 'subagent_end':
       return 'Returning…'
     case 'tool_call':
@@ -949,18 +977,21 @@ function MessageContentInner({
 
   if (segments.length === 0 && !isLast) return null
 
-  // A visible executing tool row already spins — the turn-level shimmer would
-  // double it. (A null label means a just-opened lane's shimmer owns the state.)
+  /** Open activity groups own the shimmer through gaps between tool calls. */
   // A mid-stream special tag renders nothing until complete, so its bytes are a
   // wait, not output — the shimmer bridges it without the quiet-period delay.
   const thinkingLabel = deriveThinkingLabel(blocks)
-  const hasExecutingTool = assistantMessageHasVisibleExecutingTool(segments)
+  const hasActivityIndicator = assistantMessageHasVisibleActivity(segments, isStreaming)
+  const hasPendingAgents =
+    isStreaming &&
+    segments.some((segment) => segment.type === 'agent_group' && hasPendingAgentGroup(segment))
   const showShimmer =
     thinkingExpanded &&
-    thinkingLabel !== null &&
     (segments.length === 0 ||
       trailingPendingTag ||
-      (isStreamIdle && !trailingStreamActivity && !hasExecutingTool))
+      (((hasPendingAgents && revealTailIndex < 0) || isStreamIdle) &&
+        !trailingStreamActivity &&
+        !hasActivityIndicator))
 
   const actionsRow = (
     <div className='flex items-center gap-0.5'>
@@ -971,7 +1002,7 @@ function MessageContentInner({
 
   return (
     <div>
-      <div className='space-y-[10px]'>
+      <div className='space-y-[10px] [&>[data-agent-group]:has(+[data-agent-group])]:mb-4'>
         {segments.map((segment, i) => {
           switch (segment.type) {
             case 'text':
@@ -1004,9 +1035,11 @@ function MessageContentInner({
                 />
               )
             case 'agent_group': {
+              if (!segment.items.some(hasAgentGroupItemContent)) return null
               return (
                 <div
                   key={segment.id}
+                  data-agent-group
                   className={isStreaming ? 'animate-stream-fade-in' : undefined}
                 >
                   <AgentGroup
@@ -1016,7 +1049,11 @@ function MessageContentInner({
                     items={segment.items}
                     isDelegating={segment.isDelegating}
                     isStreaming={isStreaming}
-                    isLaneOpen={segment.isOpen}
+                    isLaneOpen={
+                      segment.agentName === 'mothership'
+                        ? i === segments.length - 1
+                        : segment.isOpen
+                    }
                   />
                 </div>
               )
@@ -1051,7 +1088,7 @@ function MessageContentInner({
               showShimmer ? 'opacity-100' : 'opacity-0'
             )}
           >
-            <PendingTagIndicator label={thinkingLabel ?? 'Thinking…'} />
+            <PendingTagIndicator label={thinkingLabel} />
           </div>
         </div>
       ) : // The settled tail takes the slot's place in the SAME render and at the
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-tabs/resource-tabs.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-tabs/resource-tabs.tsx
index 66d91c0e0be..9f1d18d94ad 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-tabs/resource-tabs.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-tabs/resource-tabs.tsx
@@ -408,11 +408,21 @@ export function ResourceTabs({
 
   const handleClose = useCallback(
     (id: string) => {
-      const resource = resources.find((r) => r.id === id)
+      const index = resources.findIndex((r) => r.id === id)
+      const resource = resources[index]
       if (!resource) return
       const isMulti = selectedIds.has(resource.id) && selectedIds.size > 1
       const targets = isMulti ? resources.filter((r) => selectedIds.has(r.id)) : [resource]
       if (!confirmClosingRunningTerminals(targets, terminalTabs)) return
+      // Closing the shown tab moves to its neighbour, right then left, so the
+      // strip does not fall back to its last tab and jump. For a desktop tab
+      // this is also the neighbour the desktop app itself picks.
+      if (!isMulti && activeId === resource.id) {
+        const sameKind = new Set(resources.filter((r) => r.type === resource.type).map((r) => r.id))
+        const nextId =
+          findNearestId(resources, index, sameKind) ?? findNearestId(resources, index, null)
+        if (nextId) selectResource(nextId)
+      }
       // A browser tab's page is closed natively and its resource dropped at
       // once; the tab list then confirms the removal. A shell's close answers
       // with the tab list, so its resource follows that list instead — a
@@ -451,7 +461,16 @@ export function ResourceTabs({
       }
     },
     // eslint-disable-next-line react-hooks/exhaustive-deps
-    [chatId, desktopScopeId, onRemoveResource, resources, selectedIds, terminalTabs]
+    [
+      activeId,
+      chatId,
+      desktopScopeId,
+      onRemoveResource,
+      resources,
+      selectResource,
+      selectedIds,
+      terminalTabs,
+    ]
   )
 
   /**
diff --git a/apps/sim/app/workspace/[workspaceId]/home/home.tsx b/apps/sim/app/workspace/[workspaceId]/home/home.tsx
index c169af084e8..05e78e0d2f1 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/home.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/home.tsx
@@ -224,7 +224,7 @@ export function Home({ chatId, userName, userId }: HomeProps) {
   const resourceSelectionOwnedByUserRef = useRef(false)
 
   function handleResourceEvent(resourceId: string, options?: ResourceEventOptions) {
-    const activeResourceId = activeResourceParamRef.current
+    const activeResourceId = effectiveActiveResourceIdRef.current
     const presentation = resolveResourceEventPresentation({
       activeResourceId,
       activationRequested: shouldActivateResourceEvent(activeResourceId, resourceId, options),
@@ -317,7 +317,7 @@ export function Home({ chatId, userName, userId }: HomeProps) {
   const expandResource = () => {
     resourceCollapseOwnedByUserRef.current = false
     resourceSelectionOwnedByUserRef.current = true
-    const activeResourceId = activeResourceParamRef.current
+    const activeResourceId = effectiveActiveResourceIdRef.current
     if (activeResourceId) clearResourceActivity(activeResourceId)
     setResourceCollapsed(false)
   }
@@ -334,24 +334,18 @@ export function Home({ chatId, userName, userId }: HomeProps) {
     [setActiveResourceId, clearResourceActivity]
   )
 
-  const desktopTabResourceCallbacks = {
+  const desktopTabResourceOptions = {
+    scopeId: desktopScopeId,
+    resources,
+    activeResourceId,
+    selectedResourceId: activeResourceParam,
     addResource,
     removeResource,
     selectResource: selectResourceFromUser,
     onResourceEvent: handleResourceEvent,
   }
-  useBrowserTabResources({
-    scopeId: desktopScopeId,
-    resources,
-    activeResourceId,
-    ...desktopTabResourceCallbacks,
-  })
-  useTerminalTabResources({
-    scopeId: desktopScopeId,
-    resources,
-    activeResourceId,
-    ...desktopTabResourceCallbacks,
-  })
+  useBrowserTabResources(desktopTabResourceOptions)
+  useTerminalTabResources(desktopTabResourceOptions)
 
   const addResourceFromUser = useCallback(
     (resource: MothershipResource) => {
diff --git a/apps/sim/app/workspace/[workspaceId]/home/hooks/stream/turn-model-serialize.test.ts b/apps/sim/app/workspace/[workspaceId]/home/hooks/stream/turn-model-serialize.test.ts
index a764b32fa9b..242f236c5ba 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/hooks/stream/turn-model-serialize.test.ts
+++ b/apps/sim/app/workspace/[workspaceId]/home/hooks/stream/turn-model-serialize.test.ts
@@ -112,6 +112,107 @@ function blocksByType(blocks: ReturnType<typeof modelToContentBlocks>, type: str
   return blocks.filter((b) => b.type === type)
 }
 
+describe('model-authored tool activities', () => {
+  it.each(['main', 'subagent'] as const)(
+    'keeps %s descriptions stable through completion and snapshot replay',
+    (lane) => {
+      const scope: Scope | undefined =
+        lane === 'subagent'
+          ? { lane, spanId: 'browser-span', parentSpanId: 'main', agentId: 'browser' }
+          : undefined
+      const m = build([
+        env(
+          1,
+          'tool',
+          {
+            phase: 'call',
+            toolCallId: 'activity-call',
+            toolName: 'browser_click',
+            partial: true,
+          },
+          scope
+        ),
+      ])
+      expect(
+        modelToContentBlocks(m).find((b) => b.toolCall)?.toolCall?.activityDescription
+      ).toBeUndefined()
+      reduceEvent(
+        m,
+        env(
+          2,
+          'tool',
+          {
+            phase: 'call',
+            toolCallId: 'activity-call',
+            toolName: 'browser_click',
+            arguments: { ref: 'button-1' },
+            activityDescription: '  Opening  the export menu ',
+          },
+          scope
+        )
+      )
+      reduceEvent(
+        m,
+        env(
+          3,
+          'tool',
+          {
+            phase: 'result',
+            toolCallId: 'activity-call',
+            toolName: 'browser_click',
+            success: true,
+          },
+          scope
+        )
+      )
+      reduceEvent(
+        m,
+        env(
+          4,
+          'tool',
+          {
+            phase: 'call',
+            toolCallId: 'activity-call',
+            toolName: 'browser_click',
+            arguments: { ref: 'button-1' },
+            activityDescription: 'Opening another menu',
+          },
+          scope
+        )
+      )
+      const blocks = modelToContentBlocks(m)
+      const expected = {
+        status: 'success',
+        activityDescription: 'Opening the export menu',
+        displayTitle: 'Opening the export menu',
+        params: { ref: 'button-1' },
+      }
+      expect(blocks.find((b) => b.toolCall)?.toolCall).toMatchObject(expected)
+      const replayed = modelToContentBlocks(contentBlocksToModel(blocks))
+      expect(replayed.find((b) => b.toolCall)?.toolCall).toMatchObject(expected)
+    }
+  )
+
+  it.each([undefined, '', '   ', 12, 'x'.repeat(161)])(
+    'falls back to deterministic wording for invalid metadata %s',
+    (activityDescription) => {
+      const blocks = modelToContentBlocks(
+        build([
+          env(1, 'tool', {
+            phase: 'call',
+            toolCallId: 'fallback-call',
+            toolName: 'run_function',
+            arguments: { title: 'Checking the project setup' },
+            activityDescription,
+          }),
+        ])
+      )
+      expect(blocks[0].toolCall).toMatchObject({ displayTitle: 'Checking the project setup' })
+      expect(blocks[0].toolCall?.activityDescription).toBeUndefined()
+    }
+  )
+})
+
 describe('modelToContentBlocks', () => {
   it('emits main-lane blocks without spanId and subagent-lane blocks with spanId', () => {
     const blocks = modelToContentBlocks(build(fileDelegationEvents()))
diff --git a/apps/sim/app/workspace/[workspaceId]/home/hooks/stream/turn-model-serialize.ts b/apps/sim/app/workspace/[workspaceId]/home/hooks/stream/turn-model-serialize.ts
index 6088ee0419a..4cc1f5e7233 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/hooks/stream/turn-model-serialize.ts
+++ b/apps/sim/app/workspace/[workspaceId]/home/hooks/stream/turn-model-serialize.ts
@@ -44,12 +44,13 @@ function isOpenToolStatus(status: ToolCallStatus): boolean {
 
 /**
  * Resolves a tool row's display title with the same precedence the live handler
- * used: the integration gateway's model-authored activity description first
- * (live even mid-argument-stream; the integration brand is the row icon), then
+ * used: the per-call model-authored activity description, then the legacy
+ * integration gateway description (live even mid-argument-stream), then
  * the streaming-args title while args stream, then the arg-derived title, then
  * the explicit `ui.title`.
  */
 function toolDisplayTitle(node: ToolNode): string | undefined {
+  if (node.activityDescription) return node.activityDescription
   const integrationTitle = resolveIntegrationToolDisplayTitle(node)
   if (integrationTitle) return integrationTitle
   const streamingTitle = node.streamingArgs
@@ -136,6 +137,7 @@ export function modelToContentBlocks(model: TurnModel): ContentBlock[] {
             name: node.name,
             status: nodeToToolStatus(node.status),
             ...(displayTitle ? { displayTitle } : {}),
+            ...(node.activityDescription ? { activityDescription: node.activityDescription } : {}),
             ...(node.integrationDescription
               ? { integrationDescription: node.integrationDescription }
               : {}),
@@ -308,6 +310,7 @@ export function contentBlocksToModel(blocks: ContentBlock[]): TurnModel {
             toolCallId: tc.id,
             toolName: tc.name,
             arguments: tc.params,
+            ...(tc.activityDescription ? { activityDescription: tc.activityDescription } : {}),
             // Carries an unanswered permission prompt across a snapshot rebuild
             // so the reloaded row is still actionable rather than a spinner.
             ...(tc.status === ToolCallStatus.awaiting_approval
diff --git a/apps/sim/app/workspace/[workspaceId]/home/hooks/stream/turn-model.ts b/apps/sim/app/workspace/[workspaceId]/home/hooks/stream/turn-model.ts
index 6097a22cf76..0b3bf5992d5 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/hooks/stream/turn-model.ts
+++ b/apps/sim/app/workspace/[workspaceId]/home/hooks/stream/turn-model.ts
@@ -11,7 +11,10 @@ import {
 import { CallIntegrationTool } from '@/lib/copilot/generated/tool-catalog-v1'
 import type { PersistedStreamEventEnvelope } from '@/lib/copilot/request/session/contract'
 import { extractStreamingStringArgument } from '@/lib/copilot/tools/streaming-args'
-import { CONTEXT_COMPACTION_DISPLAY_TITLE } from '@/lib/copilot/tools/tool-display'
+import {
+  CONTEXT_COMPACTION_DISPLAY_TITLE,
+  normalizeToolActivityDescription,
+} from '@/lib/copilot/tools/tool-display'
 
 /**
  * The single deterministic model of one assistant turn, derived purely from the
@@ -65,6 +68,8 @@ export interface ToolNode extends NodeBase {
   args?: Record<string, unknown>
   streamingArgs?: string
   uiTitle?: string
+  /** Model-authored activity text preserved across stream and snapshot replay. */
+  activityDescription?: string
   /**
    * Model-authored activity phrase for a gateway-resolved integration call
    * (e.g. "Reading recent emails"). Captured when the authoritative resolved
@@ -513,6 +518,7 @@ export function reduceEvent(model: TurnModel, envelope: PersistedStreamEventEnve
           tsMs
         )
         rebindResolvedIntegrationCall(node, toolName)
+        node.activityDescription ??= normalizeToolActivityDescription(payload.activityDescription)
         // Sim stamps this onto the call frame for a tool it is holding behind a
         // permission prompt. Only ever moves a live node INTO the waiting state;
         // a node that already has a result stays terminal, so a replayed call
@@ -531,8 +537,6 @@ export function reduceEvent(model: TurnModel, envelope: PersistedStreamEventEnve
         // description across a preserve-state rebuild.
         const restoredDescription = asString(payload.integrationDescription)
         if (restoredDescription) node.integrationDescription = restoredDescription
-        // Tool-call titles are derived from the tool name (+args) at serialize
-        // time; the stream only carries behavioral flags now.
         const ui = isRecordLike(payload.ui) ? payload.ui : undefined
         if (ui?.hidden === true) node.hidden = true
       } else if (phase === MothershipStreamV1ToolPhase.args_delta) {
diff --git a/apps/sim/app/workspace/[workspaceId]/home/hooks/use-browser-tab-resources.test.tsx b/apps/sim/app/workspace/[workspaceId]/home/hooks/use-browser-tab-resources.test.tsx
index 2563e158eac..274b908ab54 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/hooks/use-browser-tab-resources.test.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/hooks/use-browser-tab-resources.test.tsx
@@ -6,6 +6,7 @@ import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { MothershipResource } from '@/lib/copilot/resources/types'
 import { useBrowserTabResources } from '@/app/workspace/[workspaceId]/home/hooks/use-browser-tab-resources'
+import type { DesktopTabResourceOptions } from '@/app/workspace/[workspaceId]/home/hooks/use-desktop-tab-resources'
 import { useBrowserSessionStore } from '@/stores/browser-session/store'
 
 const { sendBrowserPanelAction, openUrlInNewBrowserTab, openInPanelListeners } = vi.hoisted(() => ({
@@ -37,17 +38,7 @@ function pushTabs(scopeId: string, tabs: ReturnType<typeof tab>[], activeTabId:
   })
 }
 
-interface HostProps {
-  scopeId: string
-  resources: MothershipResource[]
-  activeResourceId: string | null
-  addResource: (resource: MothershipResource) => void
-  removeResource: (type: MothershipResource['type'], id: string) => void
-  selectResource: (id: string) => void
-  onResourceEvent: (id: string, options?: { activate?: boolean }) => void
-}
-
-function Host(props: HostProps) {
+function Host(props: DesktopTabResourceOptions) {
   useBrowserTabResources(props)
   return null
 }
@@ -60,11 +51,12 @@ describe('useBrowserTabResources', () => {
   const selectResource = vi.fn()
   const onResourceEvent = vi.fn()
 
-  function render(overrides: Partial<HostProps> = {}) {
-    const props: HostProps = {
+  function render(overrides: Partial<DesktopTabResourceOptions> = {}) {
+    const props: DesktopTabResourceOptions = {
       scopeId: SCOPE,
       resources: [],
       activeResourceId: null,
+      selectedResourceId: null,
       addResource,
       removeResource,
       selectResource,
@@ -72,7 +64,12 @@ describe('useBrowserTabResources', () => {
       ...overrides,
     }
     act(() => root.render(<Host {...props} />))
-    return (next: Partial<HostProps>) => act(() => root.render(<Host {...props} {...next} />))
+    /** `alsoInThisCommit` lands a store push and the new props together. */
+    return (next: Partial<DesktopTabResourceOptions>, alsoInThisCommit?: () => void) =>
+      act(() => {
+        alsoInThisCommit?.()
+        root.render(<Host {...props} {...next} />)
+      })
   }
 
   beforeEach(() => {
@@ -153,11 +150,11 @@ describe('useBrowserTabResources', () => {
       { type: 'browser', id: '1', title: 'Page 1' },
       { type: 'browser', id: '2', title: 'Page 2' },
     ]
-    const rerender = render({ resources, activeResourceId: '1' })
+    const rerender = render({ resources, activeResourceId: '1', selectedResourceId: '1' })
     pushTabs(SCOPE, [tab('1', true), tab('2')], '1')
     expect(sendBrowserPanelAction).not.toHaveBeenCalled()
 
-    rerender({ activeResourceId: '2' })
+    rerender({ activeResourceId: '2', selectedResourceId: '2' })
     expect(sendBrowserPanelAction).toHaveBeenCalledExactlyOnceWith(
       'switch-tab',
       { tabId: '2', claim: false },
@@ -169,13 +166,62 @@ describe('useBrowserTabResources', () => {
     expect(selectResource).not.toHaveBeenCalled()
   })
 
+  it('shows a page selected before the pages landed, once it arrives', () => {
+    render({ selectedResourceId: '2', activeResourceId: '2' })
+    expect(sendBrowserPanelAction).not.toHaveBeenCalled()
+
+    pushTabs(SCOPE, [tab('1', true), tab('2')], '1')
+    expect(sendBrowserPanelAction).toHaveBeenCalledExactlyOnceWith(
+      'switch-tab',
+      { tabId: '2', claim: false },
+      SCOPE
+    )
+  })
+
+  it('does not claim the scope first report as a user switch', () => {
+    const resources: MothershipResource[] = [
+      { type: 'browser', id: '1', title: 'Page 1' },
+      { type: 'browser', id: '2', title: 'Page 2' },
+    ]
+    const rerender = render()
+    pushTabs(SCOPE, [tab('1'), tab('2')], null)
+    rerender({ resources, activeResourceId: '2', selectedResourceId: null })
+
+    // The desktop app reports the page it restored. The strip resolves to that
+    // page on its own, so there is nothing here to claim for the user.
+    pushTabs(SCOPE, [tab('1', true), tab('2')], '1')
+    expect(selectResource).not.toHaveBeenCalled()
+    expect(sendBrowserPanelAction).not.toHaveBeenCalled()
+  })
+
+  it('claims a native switch away from a page it was already showing', () => {
+    const resources: MothershipResource[] = [
+      { type: 'browser', id: '1', title: 'Page 1' },
+      { type: 'browser', id: '2', title: 'Page 2' },
+    ]
+    const rerender = render()
+    pushTabs(SCOPE, [tab('1', true), tab('2')], '1')
+    rerender({ resources, activeResourceId: '1', selectedResourceId: null })
+    expect(selectResource).not.toHaveBeenCalled()
+
+    // A keyboard shortcut in the page moves the desktop app to page 2. With no
+    // explicit selection the strip resolves to that page in the same commit,
+    // so the switch is only visible against the page the desktop app left.
+    rerender({ resources, activeResourceId: '2' }, () => {
+      useBrowserSessionStore
+        .getState()
+        .setTabsState({ scopeId: SCOPE, tabs: [tab('1'), tab('2', true)], activeTabId: '2' })
+    })
+    expect(selectResource).toHaveBeenCalledExactlyOnceWith('2')
+  })
+
   it('follows a native switch into the strip only while the user is on the browser', () => {
     const resources: MothershipResource[] = [
       { type: 'browser', id: '1', title: 'Page 1' },
       { type: 'browser', id: '2', title: 'Page 2' },
       { type: 'file', id: 'f', title: 'notes.md' },
     ]
-    const rerender = render({ resources, activeResourceId: '1' })
+    const rerender = render({ resources, activeResourceId: '1', selectedResourceId: '1' })
     pushTabs(SCOPE, [tab('1', true), tab('2')], '1')
 
     pushTabs(SCOPE, [tab('1'), tab('2', true)], '2')
@@ -183,7 +229,7 @@ describe('useBrowserTabResources', () => {
     expect(sendBrowserPanelAction).not.toHaveBeenCalled()
 
     selectResource.mockClear()
-    rerender({ activeResourceId: 'f' })
+    rerender({ activeResourceId: 'f', selectedResourceId: 'f' })
     pushTabs(SCOPE, [tab('1', true), tab('2')], '1')
     expect(selectResource).not.toHaveBeenCalled()
   })
@@ -192,6 +238,7 @@ describe('useBrowserTabResources', () => {
     render({
       resources: [{ type: 'browser', id: '1', title: 'Page 1' }],
       activeResourceId: '1',
+      selectedResourceId: '1',
     })
     pushTabs(SCOPE, [tab('1', true)], '1')
     act(() => {
diff --git a/apps/sim/app/workspace/[workspaceId]/home/hooks/use-browser-tab-resources.ts b/apps/sim/app/workspace/[workspaceId]/home/hooks/use-browser-tab-resources.ts
index 51885bd161f..93fdb488d8a 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/hooks/use-browser-tab-resources.ts
+++ b/apps/sim/app/workspace/[workspaceId]/home/hooks/use-browser-tab-resources.ts
@@ -5,9 +5,8 @@ import { getErrorMessage } from '@sim/utils/errors'
 import { onOpenInBrowserPanel } from '@/lib/browser-agent/open-in-panel'
 import { browserTabTitle } from '@/lib/browser-agent/tab-label'
 import { openUrlInNewBrowserTab, sendBrowserPanelAction } from '@/lib/browser-agent/transport'
-import type { MothershipResource } from '@/lib/copilot/resources/types'
 import {
-  type DesktopTabResourceCallbacks,
+  type DesktopTabResourceOptions,
   useDesktopTabResources,
 } from '@/app/workspace/[workspaceId]/home/hooks/use-desktop-tab-resources'
 import { useBrowserSessionStore } from '@/stores/browser-session/store'
@@ -16,13 +15,6 @@ const logger = createLogger('BrowserTabResources')
 
 const EMPTY_BROWSER_TABS: BrowserTabState[] = []
 
-interface UseBrowserTabResourcesOptions extends DesktopTabResourceCallbacks {
-  /** Desktop browser scope whose pages back this chat's browser tabs. */
-  scopeId: string
-  resources: readonly MothershipResource[]
-  activeResourceId: string | null
-}
-
 function switchBrowserTab(tabId: string, scopeId: string): void {
   sendBrowserPanelAction('switch-tab', { tabId, claim: false }, scopeId)
 }
@@ -31,15 +23,8 @@ function switchBrowserTab(tabId: string, scopeId: string): void {
  * Projects the desktop app's live browser pages into `browser` resource tabs,
  * one per page. See {@link useDesktopTabResources} for the shared model.
  */
-export function useBrowserTabResources({
-  scopeId,
-  resources,
-  activeResourceId,
-  addResource,
-  removeResource,
-  selectResource,
-  onResourceEvent,
-}: UseBrowserTabResourcesOptions): void {
+export function useBrowserTabResources(options: DesktopTabResourceOptions): void {
+  const { scopeId, selectResource } = options
   const hasSession = useBrowserSessionStore((state) => state.sessions[scopeId] !== undefined)
   const browserTabs = useBrowserSessionStore(
     (state) => state.sessions[scopeId]?.tabs ?? EMPTY_BROWSER_TABS
@@ -64,19 +49,13 @@ export function useBrowserTabResources({
   selectResourceRef.current = selectResource
 
   useDesktopTabResources({
+    ...options,
     type: 'browser',
-    scopeId,
     tabs,
     hasSession,
     activeTabId,
     agentTabId,
     switchTab: switchBrowserTab,
-    resources,
-    activeResourceId,
-    addResource,
-    removeResource,
-    selectResource,
-    onResourceEvent,
   })
 
   // Chat links clicked in the desktop app open in a new browser tab. The user
diff --git a/apps/sim/app/workspace/[workspaceId]/home/hooks/use-chat.ts b/apps/sim/app/workspace/[workspaceId]/home/hooks/use-chat.ts
index 0ac26689ac1..c2ede00f541 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/hooks/use-chat.ts
+++ b/apps/sim/app/workspace/[workspaceId]/home/hooks/use-chat.ts
@@ -117,6 +117,8 @@ import {
   dispatchStreamEvent,
   finalizeResidualToolCalls,
 } from '@/app/workspace/[workspaceId]/home/hooks/stream'
+import { useNativeActiveTabIds } from '@/app/workspace/[workspaceId]/home/hooks/use-desktop-tab-resources'
+import { resolveEffectiveResourceId } from '@/app/workspace/[workspaceId]/home/resource-view-policy'
 import {
   fetchMothershipChatHistory,
   type MothershipChatHistory,
@@ -825,6 +827,9 @@ function toRawPersistedContentBlockBody(block: ContentBlock): Record<string, unk
           id: block.toolCall.id,
           name: block.toolCall.name,
           state: block.toolCall.status,
+          ...(block.toolCall.activityDescription
+            ? { activityDescription: block.toolCall.activityDescription }
+            : {}),
           ...(block.toolCall.params ? { params: block.toolCall.params } : {}),
           ...(block.toolCall.result ? { result: block.toolCall.result } : {}),
           ...(block.toolCall.calledBy ? { calledBy: block.toolCall.calledBy } : {}),
@@ -1306,6 +1311,12 @@ export interface UseChatOptions {
    * selection intentionally stays out of the URL.
    */
   activeResourceState?: [string | null, Dispatch<SetStateAction<string | null>>]
+  /**
+   * Whether this surface projects the desktop app's browser and terminal tabs
+   * into its resources. Only then does the shown resource depend on which tab
+   * the desktop app displays.
+   */
+  projectsDesktopTabs?: boolean
   /** Fired when the server's `traceparent` response header arrives, before any stream content. */
   onRequestStarted?: (info: { requestId: string; userMessageId: string }) => void
 }
@@ -1335,6 +1346,7 @@ export function getMothershipUseChatOptions(
   return {
     apiPath: MOTHERSHIP_CHAT_API_PATH,
     stopPath: '/api/mothership/chat/stop',
+    projectsDesktopTabs: true,
     ...options,
   }
 }
@@ -1446,14 +1458,33 @@ export function useChat(
   const pendingResourceReordersRef = useRef(new Map<string, MothershipResource[]>())
   const pendingResourceReorderFlushesRef = useRef(new Map<string, Promise<void>>())
 
-  // Derive the effective active resource ID for rendering without writing a
-  // passive fallback back into the user's URL selection.
-  const effectiveActiveResourceId = useMemo(() => {
-    if (resources.length === 0) return null
-    if (activeResourceId && resources.some((r) => r.id === activeResourceId))
-      return activeResourceId
-    return resources[resources.length - 1].id
-  }, [resources, activeResourceId])
+  // Sentinel used while no `chatId` is resolved; `adoptResolvedChatId`
+  // migrates this bucket onto the real chatId on first send. Rotated on
+  // home reset so a new pending chat starts with an empty bucket.
+  const pendingChatKeyRef = useRef<string>(`${PENDING_CHAT_KEY_PREFIX}${generateShortId()}`)
+  const pendingDesktopScopeIdRef = useRef(
+    desktopChatScopeId(scopeKey, undefined, pendingChatKeyRef.current)
+  )
+  const initialDesktopScopeId = desktopChatScopeId(
+    scopeKey,
+    initialChatId,
+    pendingChatKeyRef.current
+  )
+  const desktopScopeIdRef = useRef(initialDesktopScopeId)
+  const [desktopScopeId, setDesktopScopeId] = useState(initialDesktopScopeId)
+  const nativeActiveTabIds = useNativeActiveTabIds(
+    options?.projectsDesktopTabs ? desktopScopeId : null
+  )
+
+  const nativeActiveTabIdsRef = useRef(nativeActiveTabIds)
+  nativeActiveTabIdsRef.current = nativeActiveTabIds
+
+  // Derived for rendering rather than written back, so nothing the user did not
+  // choose ever lands in their selection.
+  const effectiveActiveResourceId = useMemo(
+    () => resolveEffectiveResourceId(resources, activeResourceId, nativeActiveTabIds),
+    [resources, activeResourceId, nativeActiveTabIds]
+  )
 
   const activeResourceIdRef = useRef(effectiveActiveResourceId)
   activeResourceIdRef.current = effectiveActiveResourceId
@@ -1502,10 +1533,6 @@ export function useChat(
     [queryClient]
   )
 
-  // Sentinel used while no `chatId` is resolved; `adoptResolvedChatId`
-  // migrates this bucket onto the real chatId on first send. Rotated on
-  // home reset so a new pending chat starts with an empty bucket.
-  const pendingChatKeyRef = useRef<string>(`${PENDING_CHAT_KEY_PREFIX}${generateShortId()}`)
   const [chatKey, setChatKey] = useState<string>(initialChatId ?? pendingChatKeyRef.current)
   const chatKeyRef = useRef<string>(chatKey)
   chatKeyRef.current = chatKey
@@ -1567,16 +1594,6 @@ export function useChat(
   const detachedChatResolutionControllersRef = useRef<Set<AbortController>>(new Set())
   const streamReaderRef = useRef<ReadableStreamDefaultReader<Uint8Array> | null>(null)
   const chatIdRef = useRef<string | undefined>(initialChatId)
-  const pendingDesktopScopeIdRef = useRef(
-    desktopChatScopeId(scopeKey, undefined, pendingChatKeyRef.current)
-  )
-  const initialDesktopScopeId = desktopChatScopeId(
-    scopeKey,
-    initialChatId,
-    pendingChatKeyRef.current
-  )
-  const desktopScopeIdRef = useRef(initialDesktopScopeId)
-  const [desktopScopeId, setDesktopScopeId] = useState(initialDesktopScopeId)
   /** Panel/chat selection — drives createNewChat + request chatId; may differ from chatIdRef while a stream is still finishing. */
   const selectedChatIdRef = useRef<string | undefined>(initialChatId)
   selectedChatIdRef.current = initialChatId
@@ -2476,22 +2493,27 @@ export function useChat(
       )
 
     if (mergedResources.length > 0) {
-      // An explicit selection wins. Otherwise fall back to the last resource
-      // the server holds, not the last on screen: local-only browser tabs can
-      // land before the history does, and which side arrives first must not
-      // decide which tab the chat opens on.
+      // An explicit selection wins. Otherwise pin the last resource the server
+      // holds, not the last on screen: local-only browser tabs can land before
+      // the history does, and which side arrives first must not decide which
+      // tab the chat opens on. When the server holds nothing it writes no
+      // fallback at all: the selection stays empty so the shown resource can be
+      // resolved against the tab the desktop app remembers.
       const selectedResourceId = selectedResourceIdRef.current
       const hydratedActiveResourceId =
         selectedResourceId && mergedResources.some((resource) => resource.id === selectedResourceId)
           ? selectedResourceId
-          : (
-              restorableResources[restorableResources.length - 1] ??
-              mergedResources[mergedResources.length - 1]
-            ).id
+          : (restorableResources[restorableResources.length - 1]?.id ?? null)
       // Replacing the array with an identical one still re-renders the tab
       // strip and panel — skip the no-op so open panels don't flash.
       if (!resourcesUnchanged) {
-        activeResourceIdRef.current = hydratedActiveResourceId
+        // The ref is set eagerly so a request sent in this commit still
+        // attaches a resource, through the same rule the render path uses.
+        activeResourceIdRef.current = resolveEffectiveResourceId(
+          mergedResources,
+          hydratedActiveResourceId,
+          nativeActiveTabIdsRef.current
+        )
         setResources(mergedResources)
         setActiveResourceId(hydratedActiveResourceId)
       }
@@ -3582,6 +3604,9 @@ export function useChat(
               name: block.toolCall.name,
               state: isCancelled ? MothershipStreamV1ToolOutcome.cancelled : block.toolCall.status,
               params: block.toolCall.params,
+              ...(block.toolCall.activityDescription
+                ? { activityDescription: block.toolCall.activityDescription }
+                : {}),
               result: block.toolCall.result,
               ...(display ? { display } : {}),
               calledBy: block.toolCall.calledBy,
diff --git a/apps/sim/app/workspace/[workspaceId]/home/hooks/use-desktop-tab-resources.ts b/apps/sim/app/workspace/[workspaceId]/home/hooks/use-desktop-tab-resources.ts
index 865ad133f15..a2a06067d1d 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/hooks/use-desktop-tab-resources.ts
+++ b/apps/sim/app/workspace/[workspaceId]/home/hooks/use-desktop-tab-resources.ts
@@ -1,6 +1,29 @@
-import { useEffect, useRef } from 'react'
+import { useEffect, useMemo, useRef } from 'react'
 import type { MothershipResource, MothershipResourceType } from '@/lib/copilot/resources/types'
+import { terminalResourceId } from '@/lib/terminal/resource-id'
 import type { ResourceEventHandler } from '@/app/workspace/[workspaceId]/home/hooks/use-chat'
+import type { NativeActiveTabIds } from '@/app/workspace/[workspaceId]/home/resource-view-policy'
+import { useBrowserSessionStore } from '@/stores/browser-session/store'
+import { useCopilotTerminalStore } from '@/stores/copilot-terminal/store'
+
+/**
+ * The tab the desktop app currently shows for a chat, per kind, as resource
+ * ids. The strip prefers these over its own last-resource fallback. Pass null
+ * from a surface that projects no desktop tabs, so it never re-renders for a
+ * native switch it cannot show.
+ */
+export function useNativeActiveTabIds(scopeId: string | null): NativeActiveTabIds {
+  const browser = useBrowserSessionStore((state) =>
+    scopeId === null ? null : (state.sessions[scopeId]?.activeTabId ?? null)
+  )
+  const terminal = useCopilotTerminalStore((state) =>
+    scopeId === null ? null : (state.sessions[scopeId]?.tabs.activeTerminalId ?? null)
+  )
+  return useMemo(
+    () => ({ browser, terminal: terminal ? terminalResourceId(terminal) : null }),
+    [browser, terminal]
+  )
+}
 
 /** One live desktop tab, as the strip needs to know it. */
 export interface DesktopTab {
@@ -8,7 +31,15 @@ export interface DesktopTab {
   title: string
 }
 
-export interface DesktopTabResourceCallbacks {
+/** What the strip shares with every kind of desktop-backed resource tab. */
+export interface DesktopTabResourceOptions {
+  /** Desktop scope whose live tabs back this chat's resource tabs. */
+  scopeId: string
+  resources: readonly MothershipResource[]
+  /** The resource the strip shows: the explicit selection or its fallback. */
+  activeResourceId: string | null
+  /** The explicit selection alone, without the strip's fallback. */
+  selectedResourceId: string | null
   /** Adds a tab without activating it; activation goes through {@link onResourceEvent}. */
   addResource: (resource: MothershipResource) => void
   removeResource: (resourceType: MothershipResourceType, resourceId: string) => void
@@ -18,10 +49,8 @@ export interface DesktopTabResourceCallbacks {
   onResourceEvent: ResourceEventHandler
 }
 
-interface UseDesktopTabResourcesOptions extends DesktopTabResourceCallbacks {
+interface UseDesktopTabResourcesOptions extends DesktopTabResourceOptions {
   type: 'browser' | 'terminal'
-  /** Desktop scope whose live tabs back this chat's resource tabs. */
-  scopeId: string
   /** The desktop app's live tab list for the scope, in its order. */
   tabs: readonly DesktopTab[]
   /**
@@ -36,8 +65,15 @@ interface UseDesktopTabResourcesOptions extends DesktopTabResourceCallbacks {
   agentTabId: string | null
   /** Shows a tab natively without claiming it for the user. */
   switchTab: (tabId: string, scopeId: string) => void
-  resources: readonly MothershipResource[]
-  activeResourceId: string | null
+}
+
+/** Whether the resource the strip shows is a tab of this kind. */
+function stripShowsKind(
+  resources: readonly MothershipResource[],
+  activeResourceId: string | null,
+  type: MothershipResourceType
+): boolean {
+  return resources.find((resource) => resource.id === activeResourceId)?.type === type
 }
 
 /**
@@ -49,7 +85,9 @@ interface UseDesktopTabResourcesOptions extends DesktopTabResourceCallbacks {
  * a resource tab closes its native tab at the strip, which then comes back
  * through the same list. Visible selection is routed the same way — choosing
  * a resource tab switches the native tab, and a native switch follows into the
- * strip while the user is on that kind of tab.
+ * strip while the user is on that kind of tab. Which resource the strip shows
+ * when nothing is selected is resolved by `resolveEffectiveResourceId`, not
+ * here.
  *
  * The agent never moves the visible tab itself. Its tab is announced as
  * resource activity, so the existing view policy decides whether to show it or
@@ -65,6 +103,7 @@ export function useDesktopTabResources({
   switchTab,
   resources,
   activeResourceId,
+  selectedResourceId,
   addResource,
   removeResource,
   selectResource,
@@ -83,14 +122,18 @@ export function useDesktopTabResources({
   const requestedTabIdRef = useRef<string | null>(null)
   const scopeIdRef = useRef(scopeId)
   scopeIdRef.current = scopeId
-  const tabsRef = useRef(tabs)
-  tabsRef.current = tabs
   const activeTabIdRef = useRef(activeTabId)
   activeTabIdRef.current = activeTabId
   const resourcesRef = useRef(resources)
   resourcesRef.current = resources
   const activeResourceIdRef = useRef(activeResourceId)
   activeResourceIdRef.current = activeResourceId
+  /**
+   * The last tab the desktop app reported showing. Unset until its first
+   * report, which carries the tab it remembers rather than a switch. Never
+   * unset again by an empty tab list, so reopening a tab still reads as a move.
+   */
+  const previousActiveTabIdRef = useRef<string | null>(null)
   const switchTabRef = useRef(switchTab)
   switchTabRef.current = switchTab
   const selectResourceRef = useRef(selectResource)
@@ -105,6 +148,7 @@ export function useDesktopTabResources({
       knownScopeRef.current = scopeId
       known.clear()
       requestedTabIdRef.current = null
+      previousActiveTabIdRef.current = null
     }
     const resourceTabIds = new Set(
       resources.filter((resource) => resource.type === type).map((resource) => resource.id)
@@ -127,29 +171,39 @@ export function useDesktopTabResources({
     }
   }, [addResource, hasSession, removeResource, resources, scopeId, tabs, type])
 
-  // Selecting a resource tab shows its native tab. Keyed on the selection
-  // alone: a native push must not re-assert a selection it just moved away
-  // from, or the two sides would trade switches forever.
+  const selectedTabIsLive =
+    selectedResourceId !== null && tabs.some((tab) => tab.id === selectedResourceId)
+
+  // Selecting a resource tab shows its native tab. Keyed on the explicit
+  // selection alone — the strip's fallback is not a choice to impose on the
+  // desktop app, and a native push must not re-assert a selection it just
+  // moved away from, or the two sides would trade switches forever — and on
+  // that tab being live, so a selection made before the desktop app published
+  // its tab list is shown once the tab arrives rather than dropped.
   useEffect(() => {
-    if (!activeResourceId || activeResourceId === activeTabIdRef.current) return
-    if (!tabsRef.current.some((tab) => tab.id === activeResourceId)) return
-    requestedTabIdRef.current = activeResourceId
-    switchTabRef.current(activeResourceId, scopeIdRef.current)
-  }, [activeResourceId])
+    if (!selectedResourceId || !selectedTabIsLive) return
+    if (selectedResourceId === activeTabIdRef.current) return
+    requestedTabIdRef.current = selectedResourceId
+    switchTabRef.current(selectedResourceId, scopeIdRef.current)
+  }, [selectedResourceId, selectedTabIsLive])
 
-  // A native switch while the user is on this kind of tab follows into the
-  // strip. The switch this hook requested itself is not a native change of mind.
+  // A native switch while the user is on this kind of tab claims the selection
+  // the way a click on the tab would, so later agent activity only badges
+  // rather than taking the view. Measured against the tab the desktop app was
+  // showing, not the one the strip shows: with no explicit selection those are
+  // the same tab, and comparing them would never see a switch. Two switches
+  // are not the user's — the one this hook requested itself, and the scope's
+  // first report, which carries the tab the desktop app remembers.
   useEffect(() => {
+    const previousActiveTabId = previousActiveTabIdRef.current
+    if (activeTabId !== null) previousActiveTabIdRef.current = activeTabId
     if (requestedTabIdRef.current === activeTabId) {
       requestedTabIdRef.current = null
       return
     }
-    const activeResource = resourcesRef.current.find(
-      (resource) => resource.id === activeResourceIdRef.current
-    )
-    if (!activeTabId || activeResource?.type !== type || activeResource.id === activeTabId) {
-      return
-    }
+    if (!activeTabId || previousActiveTabId === null) return
+    if (activeTabId === previousActiveTabId) return
+    if (!stripShowsKind(resourcesRef.current, activeResourceIdRef.current, type)) return
     selectResourceRef.current(activeTabId)
   }, [activeTabId, type])
 
diff --git a/apps/sim/app/workspace/[workspaceId]/home/hooks/use-terminal-tab-resources.test.tsx b/apps/sim/app/workspace/[workspaceId]/home/hooks/use-terminal-tab-resources.test.tsx
index ef79b3ed7c2..013a36d540d 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/hooks/use-terminal-tab-resources.test.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/hooks/use-terminal-tab-resources.test.tsx
@@ -6,6 +6,7 @@ import type { TerminalTabState } from '@sim/terminal-protocol'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { MothershipResource } from '@/lib/copilot/resources/types'
+import type { DesktopTabResourceOptions } from '@/app/workspace/[workspaceId]/home/hooks/use-desktop-tab-resources'
 import { useTerminalTabResources } from '@/app/workspace/[workspaceId]/home/hooks/use-terminal-tab-resources'
 import { useCopilotTerminalStore } from '@/stores/copilot-terminal/store'
 
@@ -38,17 +39,7 @@ function pushTabs(scopeId: string, tabs: TerminalTabState[], activeTerminalId: s
   })
 }
 
-interface HostProps {
-  scopeId: string
-  resources: MothershipResource[]
-  activeResourceId: string | null
-  addResource: (resource: MothershipResource) => void
-  removeResource: (type: MothershipResource['type'], id: string) => void
-  selectResource: (id: string) => void
-  onResourceEvent: (id: string, options?: { activate?: boolean }) => void
-}
-
-function Host(props: HostProps) {
+function Host(props: DesktopTabResourceOptions) {
   useTerminalTabResources(props)
   return null
 }
@@ -61,11 +52,12 @@ describe('useTerminalTabResources', () => {
   const selectResource = vi.fn()
   const onResourceEvent = vi.fn()
 
-  function render(overrides: Partial<HostProps> = {}) {
-    const props: HostProps = {
+  function render(overrides: Partial<DesktopTabResourceOptions> = {}) {
+    const props: DesktopTabResourceOptions = {
       scopeId: SCOPE,
       resources: [],
       activeResourceId: null,
+      selectedResourceId: null,
       addResource,
       removeResource,
       selectResource,
@@ -73,7 +65,8 @@ describe('useTerminalTabResources', () => {
       ...overrides,
     }
     act(() => root.render(<Host {...props} />))
-    return (next: Partial<HostProps>) => act(() => root.render(<Host {...props} {...next} />))
+    return (next: Partial<DesktopTabResourceOptions>) =>
+      act(() => root.render(<Host {...props} {...next} />))
   }
 
   beforeEach(() => {
@@ -120,11 +113,15 @@ describe('useTerminalTabResources', () => {
       { type: 'terminal', id: 'terminal:1', title: 'dir-1' },
       { type: 'terminal', id: 'terminal:2', title: 'dir-2' },
     ]
-    const rerender = render({ resources, activeResourceId: 'terminal:1' })
+    const rerender = render({
+      resources,
+      activeResourceId: 'terminal:1',
+      selectedResourceId: 'terminal:1',
+    })
     pushTabs(SCOPE, [shell('1', true), shell('2')], '1')
     expect(switchTerminal).not.toHaveBeenCalled()
 
-    rerender({ activeResourceId: 'terminal:2' })
+    rerender({ activeResourceId: 'terminal:2', selectedResourceId: 'terminal:2' })
     expect(switchTerminal).toHaveBeenCalledExactlyOnceWith('2', SCOPE, { claim: false })
 
     pushTabs(SCOPE, [shell('1'), shell('2', true)], '2')
@@ -137,14 +134,18 @@ describe('useTerminalTabResources', () => {
       { type: 'terminal', id: 'terminal:2', title: 'dir-2' },
       { type: 'file', id: 'f', title: 'notes.md' },
     ]
-    const rerender = render({ resources, activeResourceId: 'terminal:1' })
+    const rerender = render({
+      resources,
+      activeResourceId: 'terminal:1',
+      selectedResourceId: 'terminal:1',
+    })
     pushTabs(SCOPE, [shell('1', true), shell('2')], '1')
 
     pushTabs(SCOPE, [shell('1'), shell('2', true)], '2')
     expect(selectResource).toHaveBeenCalledExactlyOnceWith('terminal:2')
 
     selectResource.mockClear()
-    rerender({ activeResourceId: 'f' })
+    rerender({ activeResourceId: 'f', selectedResourceId: 'f' })
     pushTabs(SCOPE, [shell('1', true), shell('2')], '1')
     expect(selectResource).not.toHaveBeenCalled()
   })
@@ -156,6 +157,7 @@ describe('useTerminalTabResources', () => {
         { type: 'terminal', id: 'terminal:2', title: 'dir-2' },
       ],
       activeResourceId: 'terminal:1',
+      selectedResourceId: 'terminal:1',
     })
     pushTabs(SCOPE, [shell('1', true), shell('2')], '1')
     act(() => {
diff --git a/apps/sim/app/workspace/[workspaceId]/home/hooks/use-terminal-tab-resources.ts b/apps/sim/app/workspace/[workspaceId]/home/hooks/use-terminal-tab-resources.ts
index e794b0debd7..ae5432d192e 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/hooks/use-terminal-tab-resources.ts
+++ b/apps/sim/app/workspace/[workspaceId]/home/hooks/use-terminal-tab-resources.ts
@@ -1,23 +1,15 @@
 import { useMemo } from 'react'
 import type { TerminalTabState } from '@sim/terminal-protocol'
-import type { MothershipResource } from '@/lib/copilot/resources/types'
 import { terminalIdFromResourceId, terminalResourceId } from '@/lib/terminal/resource-id'
 import { switchTerminal } from '@/lib/terminal/transport'
 import {
-  type DesktopTabResourceCallbacks,
+  type DesktopTabResourceOptions,
   useDesktopTabResources,
 } from '@/app/workspace/[workspaceId]/home/hooks/use-desktop-tab-resources'
 import { useCopilotTerminalStore } from '@/stores/copilot-terminal/store'
 
 const EMPTY_TERMINAL_TABS: TerminalTabState[] = []
 
-interface UseTerminalTabResourcesOptions extends DesktopTabResourceCallbacks {
-  /** Desktop terminal scope whose shells back this chat's terminal tabs. */
-  scopeId: string
-  resources: readonly MothershipResource[]
-  activeResourceId: string | null
-}
-
 function showTerminal(resourceId: string, scopeId: string): void {
   void switchTerminal(terminalIdFromResourceId(resourceId), scopeId, { claim: false }).catch(
     () => {}
@@ -28,15 +20,8 @@ function showTerminal(resourceId: string, scopeId: string): void {
  * Projects the desktop app's live shells into `terminal` resource tabs, one
  * per shell. See {@link useDesktopTabResources} for the shared model.
  */
-export function useTerminalTabResources({
-  scopeId,
-  resources,
-  activeResourceId,
-  addResource,
-  removeResource,
-  selectResource,
-  onResourceEvent,
-}: UseTerminalTabResourcesOptions): void {
+export function useTerminalTabResources(options: DesktopTabResourceOptions): void {
+  const { scopeId } = options
   const hasSession = useCopilotTerminalStore((state) => state.sessions[scopeId] !== undefined)
   const terminalTabs = useCopilotTerminalStore(
     (state) => state.sessions[scopeId]?.tabs.tabs ?? EMPTY_TERMINAL_TABS
@@ -60,18 +45,12 @@ export function useTerminalTabResources({
   )
 
   useDesktopTabResources({
+    ...options,
     type: 'terminal',
-    scopeId,
     tabs,
     hasSession,
-    activeTabId: activeTerminalId && terminalResourceId(activeTerminalId),
-    agentTabId: agentTerminalId && terminalResourceId(agentTerminalId),
+    activeTabId: activeTerminalId ? terminalResourceId(activeTerminalId) : null,
+    agentTabId: agentTerminalId ? terminalResourceId(agentTerminalId) : null,
     switchTab: showTerminal,
-    resources,
-    activeResourceId,
-    addResource,
-    removeResource,
-    selectResource,
-    onResourceEvent,
   })
 }
diff --git a/apps/sim/app/workspace/[workspaceId]/home/resource-view-policy.test.ts b/apps/sim/app/workspace/[workspaceId]/home/resource-view-policy.test.ts
index a16456d5add..80435314cf0 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/resource-view-policy.test.ts
+++ b/apps/sim/app/workspace/[workspaceId]/home/resource-view-policy.test.ts
@@ -1,9 +1,72 @@
 import { describe, expect, it } from 'vitest'
+import type { MothershipResource } from '@/lib/copilot/resources/types'
 import {
+  resolveEffectiveResourceId,
   resolveResourceEventPresentation,
   resolveResourceSelectionUpdate,
 } from '@/app/workspace/[workspaceId]/home/resource-view-policy'
 
+const PAGES: MothershipResource[] = [
+  { type: 'browser', id: '1', title: 'Page 1' },
+  { type: 'browser', id: '2', title: 'Page 2' },
+  { type: 'browser', id: '3', title: 'Page 3' },
+]
+const NOTES: MothershipResource = { type: 'file', id: 'notes', title: 'notes.md' }
+const SHELLS: MothershipResource[] = [
+  { type: 'terminal', id: 'terminal:1', title: 'one' },
+  { type: 'terminal', id: 'terminal:2', title: 'two' },
+]
+const NO_NATIVE = { browser: null, terminal: null }
+
+describe('resolveEffectiveResourceId', () => {
+  it('shows nothing when the strip is empty', () => {
+    expect(resolveEffectiveResourceId([], null, NO_NATIVE)).toBeNull()
+    expect(resolveEffectiveResourceId([], 'anything', NO_NATIVE)).toBeNull()
+  })
+
+  it('shows the selected resource while it is on screen', () => {
+    expect(resolveEffectiveResourceId(PAGES, '1', { browser: '3', terminal: null })).toBe('1')
+  })
+
+  it('falls back when the selection is no longer on screen', () => {
+    expect(resolveEffectiveResourceId(PAGES, 'deleted', NO_NATIVE)).toBe('3')
+  })
+
+  it('prefers the page the desktop app shows over the last one', () => {
+    expect(resolveEffectiveResourceId(PAGES, null, { browser: '2', terminal: null })).toBe('2')
+  })
+
+  it('prefers the shell the desktop app shows over the last one', () => {
+    expect(
+      resolveEffectiveResourceId(SHELLS, null, { browser: null, terminal: 'terminal:1' })
+    ).toBe('terminal:1')
+  })
+
+  it('keeps the last resource when the desktop app reports nothing', () => {
+    expect(resolveEffectiveResourceId(PAGES, null, NO_NATIVE)).toBe('3')
+    expect(resolveEffectiveResourceId(PAGES, null)).toBe('3')
+  })
+
+  it('ignores a page the strip no longer holds, such as one just closed', () => {
+    expect(resolveEffectiveResourceId(PAGES, null, { browser: 'closed', terminal: null })).toBe('3')
+  })
+
+  it('ignores the desktop app when the last resource is not one of its tabs', () => {
+    expect(
+      resolveEffectiveResourceId([...PAGES, NOTES], null, { browser: '2', terminal: null })
+    ).toBe('notes')
+  })
+
+  it('does not cross the two desktop kinds', () => {
+    expect(resolveEffectiveResourceId(PAGES, null, { browser: null, terminal: 'terminal:1' })).toBe(
+      '3'
+    )
+    expect(resolveEffectiveResourceId(SHELLS, null, { browser: '1', terminal: null })).toBe(
+      'terminal:2'
+    )
+  })
+})
+
 const DEFAULT_INPUT = {
   activeResourceId: 'file-1',
   activationRequested: true,
diff --git a/apps/sim/app/workspace/[workspaceId]/home/resource-view-policy.ts b/apps/sim/app/workspace/[workspaceId]/home/resource-view-policy.ts
index d163b95259e..378f9ad8947 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/resource-view-policy.ts
+++ b/apps/sim/app/workspace/[workspaceId]/home/resource-view-policy.ts
@@ -1,4 +1,44 @@
 import type { SetStateAction } from 'react'
+import type { MothershipResource } from '@/lib/copilot/resources/types'
+
+/** The tab each desktop-backed kind currently shows, as resource ids. */
+export interface NativeActiveTabIds {
+  browser: string | null
+  terminal: string | null
+}
+
+/**
+ * Which resource the panel shows.
+ *
+ * An explicit selection wins whenever it is still on screen. Otherwise the
+ * strip falls back to its last resource — except for the desktop-backed kinds,
+ * where the desktop app is already showing the tab the user left the chat on.
+ * Preferring that tab is what makes reopening a chat land where the user left
+ * it, and deriving it here rather than writing it back means no arrival order
+ * of tabs, history or native state can leave a tab the user did not pick
+ * stored as their selection.
+ */
+export function resolveEffectiveResourceId(
+  resources: readonly MothershipResource[],
+  selectedResourceId: string | null,
+  nativeActiveTabIds?: NativeActiveTabIds
+): string | null {
+  if (resources.length === 0) return null
+  if (selectedResourceId && resources.some((resource) => resource.id === selectedResourceId)) {
+    return selectedResourceId
+  }
+  const fallback = resources[resources.length - 1]
+  if (fallback.type === 'browser' || fallback.type === 'terminal') {
+    const nativeId = nativeActiveTabIds?.[fallback.type] ?? null
+    if (
+      nativeId &&
+      resources.some((resource) => resource.type === fallback.type && resource.id === nativeId)
+    ) {
+      return nativeId
+    }
+  }
+  return fallback.id
+}
 
 export function resolveResourceSelectionUpdate(
   currentResourceId: string | null,
diff --git a/apps/sim/app/workspace/[workspaceId]/home/types.ts b/apps/sim/app/workspace/[workspaceId]/home/types.ts
index 15e8d9a1e1c..3844d7beea9 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/types.ts
+++ b/apps/sim/app/workspace/[workspaceId]/home/types.ts
@@ -73,6 +73,7 @@ export interface ToolCallData {
   id: string
   toolName: string
   displayTitle: string
+  activityDescription?: string
   status: ToolCallStatus
   params?: Record<string, unknown>
   result?: ToolCallResult
@@ -86,6 +87,8 @@ export interface ToolCallInfo {
   name: string
   status: ToolCallStatus
   displayTitle?: string
+  /** Model-authored activity text, separate from executable tool arguments. */
+  activityDescription?: string
   /** Model-authored activity phrase for a gateway-resolved integration call. */
   integrationDescription?: string
   params?: Record<string, unknown>
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/add-connector-modal/add-connector-modal.test.tsx b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/add-connector-modal/add-connector-modal.test.tsx
index 4c848f9bc01..a8ca013792d 100644
--- a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/add-connector-modal/add-connector-modal.test.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/add-connector-modal/add-connector-modal.test.tsx
@@ -41,7 +41,7 @@ const mocks = vi.hoisted(() => ({
 
 vi.mock('next/navigation', () => ({
   useParams: () => ({ workspaceId: 'workspace-1' }),
-  usePathname: () => '/workspace/workspace-1/search',
+  usePathname: () => '/o/org-1/settings/integrations',
 }))
 vi.mock('@/app/workspace/[workspaceId]/providers/workspace-host-provider', () => ({
   useWorkspaceHostContext: () => ({
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connector-access-field/connector-access-field.test.tsx b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connector-access-field/connector-access-field.test.tsx
index 70ca5117317..4ecbc389925 100644
--- a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connector-access-field/connector-access-field.test.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connector-access-field/connector-access-field.test.tsx
@@ -233,33 +233,40 @@ describe('connection method selection', () => {
 })
 
 describe('Slack setup continuity', () => {
-  it('keeps the setup link and draft callback when the method selector is hidden', async () => {
-    const onNavigate = vi.fn()
-    await render({
-      connectorConfig: slackConnectorMeta,
-      allowAdmin: false,
-      searchSetupSource: 'slack',
-      slackSetupOnly: true,
-      onSetupNavigate: onNavigate,
-      footer: <button type='button'>Apply changes</button>,
-    })
-    expect(container.querySelector('[role="radiogroup"]')).toBeNull()
-    expect(container.textContent).toContain('Slack app')
-    expect(container.textContent).not.toContain('Member accounts')
-    const link = container.querySelector('a')
-    const target = new URL(link?.getAttribute('href') ?? '', 'http://localhost')
-    expect(target.pathname).toBe('/workspace/workspace-1/settings/credential-groups')
-    expect(target.searchParams.get('search-setup')).toBe('slack')
-    expect(target.searchParams.get('credential-group-provider')).toBe('slack')
-    link?.addEventListener('click', (event) => event.preventDefault())
-    await act(async () => link?.click())
-    expect(onNavigate).toHaveBeenCalledOnce()
-    expect(container.textContent).toContain('Apply changes')
-    expect(mocks.accounts).toHaveBeenLastCalledWith({
-      kind: 'workspace',
-      workspaceId: 'workspace-1',
-    })
-  })
+  it.each([
+    {
+      scope: { kind: 'workspace', workspaceId: 'workspace-1' },
+      href: '/workspace/workspace-1/settings/credential-groups',
+    },
+    {
+      scope: { kind: 'organization', organizationId: 'org-1' },
+      href: '/o/org-1/settings/integrations?search-setup=slack&connectedAccounts=slack',
+    },
+  ] as const)(
+    'keeps the $scope.kind setup link and draft callback when the method selector is hidden',
+    async ({ scope, href }) => {
+      const onNavigate = vi.fn()
+      await render({
+        scope,
+        connectorConfig: slackConnectorMeta,
+        allowAdmin: false,
+        searchSetupSource: 'slack',
+        slackSetupOnly: true,
+        onSetupNavigate: onNavigate,
+        footer: <button type='button'>Apply changes</button>,
+      })
+      expect(container.querySelector('[role="radiogroup"]')).toBeNull()
+      expect(container.textContent).toContain('Slack app')
+      expect(container.textContent).not.toContain('Member accounts')
+      const link = container.querySelector('a')
+      expect(link).toHaveAttribute('href', href)
+      link?.addEventListener('click', (event) => event.preventDefault())
+      await act(async () => link?.click())
+      expect(onNavigate).toHaveBeenCalledOnce()
+      expect(container.textContent).toContain('Apply changes')
+      expect(mocks.accounts).toHaveBeenLastCalledWith(scope)
+    }
+  )
 
   it.each(['loading', 'configured'] as const)('hides the Slack detour while %s', async (state) => {
     mocks.loading = state === 'loading'
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connector-access-field/connector-access-field.tsx b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connector-access-field/connector-access-field.tsx
index 79507a3e70b..7e85e99cc36 100644
--- a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connector-access-field/connector-access-field.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connector-access-field/connector-access-field.tsx
@@ -237,8 +237,8 @@ export function SlackMemberSetup({
 }: SlackMemberSetupProps) {
   const scope = explicitScope ?? resourceScopeFromOwner({ workspaceId })
   const href =
-    scope.kind === 'organization' || searchSetupSource
-      ? slackSearchSetupHref(scope, searchSetupSource ?? 'search')
+    scope.kind === 'organization'
+      ? slackSearchSetupHref(scope.organizationId, searchSetupSource ?? 'search')
       : `/workspace/${scope.workspaceId}/settings/credential-groups`
   return (
     <ChipLink href={href} onClick={onNavigate}>
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connector-documents/connector-document-status-filter.tsx b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connector-documents/connector-document-status-filter.tsx
new file mode 100644
index 00000000000..749b08d852c
--- /dev/null
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connector-documents/connector-document-status-filter.tsx
@@ -0,0 +1,39 @@
+'use client'
+
+import { ChipDropdown } from '@sim/emcn'
+import type {
+  ConnectorDocumentFilter,
+  ConnectorDocumentsData,
+} from '@/lib/api/contracts/knowledge/connectors'
+
+interface ConnectorDocumentStatusFilterProps {
+  filter: ConnectorDocumentFilter
+  onFilterChange: (filter: ConnectorDocumentFilter) => void
+  counts?: ConnectorDocumentsData['counts']
+  isLoading: boolean
+}
+
+export function ConnectorDocumentStatusFilter({
+  filter,
+  onFilterChange,
+  counts = { active: 0, excluded: 0, failed: 0, skipped: 0 },
+  isLoading,
+}: ConnectorDocumentStatusFilterProps) {
+  return (
+    <ChipDropdown
+      aria-label='Document status'
+      value={filter}
+      onChange={(value) => {
+        if (value === 'active' || value === 'excluded' || value === 'failed' || value === 'skipped')
+          onFilterChange(value)
+      }}
+      matchTriggerWidth={false}
+      options={[
+        { value: 'active', label: isLoading ? 'Included' : `Included (${counts.active})` },
+        { value: 'excluded', label: isLoading ? 'Excluded' : `Excluded (${counts.excluded})` },
+        { value: 'failed', label: isLoading ? 'Failed' : `Failed (${counts.failed})` },
+        { value: 'skipped', label: isLoading ? 'Skipped' : `Skipped (${counts.skipped})` },
+      ]}
+    />
+  )
+}
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connector-documents/connector-documents.tsx b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connector-documents/connector-documents.tsx
index a63cf633a05..7323a54c0ac 100644
--- a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connector-documents/connector-documents.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connector-documents/connector-documents.tsx
@@ -1,10 +1,11 @@
 'use client'
 
-import { Chip, ChipDropdown, ChipInput, ChipLink, Skeleton } from '@sim/emcn'
+import { Chip, ChipInput, ChipLink, Skeleton } from '@sim/emcn'
 import { RefreshCw, Search, SquareArrowUpRight } from '@sim/emcn/icons'
 import type { ConnectorDocumentFilter } from '@/lib/api/contracts/knowledge/connectors'
 import type { ResourceScope } from '@/lib/core/resource-scope'
 import { getDocumentIndexingStatus } from '@/lib/knowledge/documents/types'
+import { ConnectorDocumentStatusFilter } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/connector-documents/connector-document-status-filter'
 import {
   SettingsEmptyState,
   SettingsQueryErrorState,
@@ -25,6 +26,7 @@ interface ConnectorDocumentsProps {
   connectorId: string
   search?: string
   searchControl?: { value: string; onChange: (value: string) => void }
+  showToolbar?: boolean
   progressScope?: ResourceScope
   isSearchIndex?: boolean
   syncing?: boolean
@@ -38,6 +40,7 @@ export function ConnectorDocuments({
   filter,
   search,
   searchControl,
+  showToolbar = true,
   progressScope,
   isSearchIndex = false,
   syncing,
@@ -79,41 +82,26 @@ export function ConnectorDocuments({
         {isSearchIndex && (
           <p className='text-[var(--text-body)] text-sm'>Documents you can access</p>
         )}
-        <div className='flex items-center gap-2'>
-          {searchControl && (
-            <ChipInput
-              icon={Search}
-              placeholder='Search documents...'
-              value={searchControl.value}
-              onChange={(event) => searchControl.onChange(event.target.value)}
-              autoComplete='off'
-              className='min-w-0 flex-1'
+        {showToolbar && (
+          <div className='flex items-center gap-2'>
+            {searchControl && (
+              <ChipInput
+                icon={Search}
+                placeholder='Search documents...'
+                value={searchControl.value}
+                onChange={(event) => searchControl.onChange(event.target.value)}
+                autoComplete='off'
+                className='min-w-0 flex-1'
+              />
+            )}
+            <ConnectorDocumentStatusFilter
+              filter={filter}
+              onFilterChange={onFilterChange}
+              counts={counts}
+              isLoading={isLoading}
             />
-          )}
-          <ChipDropdown
-            aria-label='Document status'
-            value={filter}
-            onChange={(value) => {
-              if (
-                value === 'active' ||
-                value === 'excluded' ||
-                value === 'failed' ||
-                value === 'skipped'
-              )
-                onFilterChange(value)
-            }}
-            matchTriggerWidth={false}
-            options={[
-              { value: 'active', label: isLoading ? 'Included' : `Included (${counts.active})` },
-              {
-                value: 'excluded',
-                label: isLoading ? 'Excluded' : `Excluded (${counts.excluded})`,
-              },
-              { value: 'failed', label: isLoading ? 'Failed' : `Failed (${counts.failed})` },
-              { value: 'skipped', label: isLoading ? 'Skipped' : `Skipped (${counts.skipped})` },
-            ]}
-          />
-        </div>
+          </div>
+        )}
         <div className={RESOURCE_LIST_STACK}>
           {query.isError && !query.isFetchNextPageError ? (
             <SettingsQueryErrorState
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connector-actions.tsx b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connector-actions.tsx
index 7e59ac05ffc..14e4a1b464d 100644
--- a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connector-actions.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connector-actions.tsx
@@ -1,25 +1,96 @@
 'use client'
 
-import { useId } from 'react'
-import { Checkbox, ChipConfirmModal, ChipModalError, ChipModalField } from '@sim/emcn'
-import { SettingsActionChips } from '@/components/settings/settings-header'
+import { Fragment, type Ref, useId } from 'react'
 import {
-  type ConnectorActionState,
-  type ConnectorActionsOptions,
-  useConnectorActions,
-} from '@/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/use-connector-actions'
+  Checkbox,
+  Chip,
+  ChipConfirmModal,
+  ChipModalError,
+  ChipModalField,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+  Tooltip,
+} from '@sim/emcn'
+import { MoreHorizontal } from '@sim/emcn/icons'
+import { orderHeaderActions, type SettingsAction } from '@/components/settings/settings-header'
+import type { ConnectorActionState } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/use-connector-actions'
 import { SettingsEmptyState } from '@/app/workspace/[workspaceId]/settings/components/settings-empty-state'
 
-export function ConnectorActions(props: ConnectorActionsOptions) {
-  const state = useConnectorActions(props)
-  if (!state.canEdit) return null
+interface ConnectorActionsProps {
+  state: ConnectorActionState
+  triggerRef?: Ref<HTMLButtonElement>
+  history?: {
+    expanded: boolean
+    contentId: string
+    onToggle: () => void
+  }
+}
+
+export function ConnectorActions({ state, triggerRef, history }: ConnectorActionsProps) {
+  if (!state.canEdit && !history) return null
+  const actions = orderHeaderActions([
+    ...state.actions,
+    ...(history
+      ? [
+          {
+            id: 'history',
+            text: history.expanded ? 'Hide history' : 'Sync history',
+            onSelect: history.onToggle,
+          },
+        ]
+      : []),
+  ])
   return (
-    <div className='flex flex-col gap-2'>
-      <div className='flex flex-wrap items-center gap-1'>
-        <SettingsActionChips actions={state.actions} />
-      </div>
-      <ConnectorActionFeedback state={state} />
-    </div>
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild>
+        <Chip ref={triggerRef} aria-label='Connection actions' leftIcon={MoreHorizontal} />
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align='end'>
+        {actions.map(({ action }, index) => (
+          <Fragment key={action.id}>
+            {action.id === 'delete' && index > 0 && <DropdownMenuSeparator />}
+            <ConnectorActionMenuItem
+              action={action}
+              history={action.id === 'history' ? history : undefined}
+            />
+          </Fragment>
+        ))}
+      </DropdownMenuContent>
+    </DropdownMenu>
+  )
+}
+
+interface ConnectorActionMenuItemProps {
+  action: SettingsAction
+  history?: ConnectorActionsProps['history']
+}
+
+function ConnectorActionMenuItem({ action, history }: ConnectorActionMenuItemProps) {
+  const item = (
+    <DropdownMenuItem
+      onSelect={action.onSelect}
+      disabled={action.disabled}
+      aria-label={
+        action.disabled && action.tooltip ? `${action.text} — ${action.tooltip}` : action.text
+      }
+      aria-expanded={history?.expanded}
+      aria-controls={history?.contentId}
+    >
+      {action.text}
+    </DropdownMenuItem>
+  )
+  return action.tooltip ? (
+    <Tooltip.Root>
+      <Tooltip.Trigger asChild>
+        <span className='block'>{item}</span>
+      </Tooltip.Trigger>
+      <Tooltip.Content>{action.tooltip}</Tooltip.Content>
+    </Tooltip.Root>
+  ) : (
+    item
   )
 }
 
@@ -30,7 +101,7 @@ interface ConnectorActionFeedbackProps {
 export function ConnectorActionFeedback({ state }: ConnectorActionFeedbackProps) {
   const deleteDocumentsId = useId()
   if (!state.canEdit) return null
-  const { removal, fullResync } = state
+  const { removal } = state
   return (
     <>
       {state.error && (
@@ -38,22 +109,6 @@ export function ConnectorActionFeedback({ state }: ConnectorActionFeedbackProps)
           {state.error.message}
         </SettingsEmptyState>
       )}
-      <ChipConfirmModal
-        open={fullResync.open}
-        onOpenChange={fullResync.onOpenChange}
-        title='Full resync?'
-        text='Fetch all content again for this connection, including unchanged documents. This can take longer than a regular sync.'
-        confirm={{
-          label: 'Full resync',
-          variant: 'primary',
-          pending: fullResync.pending,
-          disabled: fullResync.disabled,
-          pendingLabel: 'Queuing…',
-          onClick: fullResync.onConfirm,
-        }}
-      >
-        <ChipModalError>{fullResync.error?.message}</ChipModalError>
-      </ChipConfirmModal>
       <ChipConfirmModal
         open={removal.open}
         onOpenChange={removal.onOpenChange}
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connector-recovery.tsx b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connector-recovery.tsx
index 88c5ff856bf..f175c9bde2e 100644
--- a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connector-recovery.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connector-recovery.tsx
@@ -48,7 +48,8 @@ export function ConnectorRecovery({
   const requiresAccountSettings =
     (connectorDef &&
       !isConnectorCredentialTypeAllowed(connectorDef.auth, connector.accessMode, 'oauth')) ||
-    selectedCredential?.type === 'service_account'
+    selectedCredential?.type === 'service_account' ||
+    Boolean(connector.credentialId && !selectedCredential && !credentialsLoading)
   const missingScopes = selectedCredential
     ? getMissingRequiredScopes(selectedCredential, requiredScopes)
     : []
@@ -60,20 +61,10 @@ export function ConnectorRecovery({
   )
 
   useEffect(() => {
-    if (
-      showOAuthModal &&
-      (requiresAccountSettings ||
-        (connector.credentialId && !selectedCredential && !credentialsLoading))
-    ) {
+    if (showOAuthModal && requiresAccountSettings) {
       setShowOAuthModal(false)
     }
-  }, [
-    showOAuthModal,
-    connector.credentialId,
-    selectedCredential,
-    credentialsLoading,
-    requiresAccountSettings,
-  ])
+  }, [showOAuthModal, requiresAccountSettings])
 
   function openReconnect() {
     if (!canEdit || disabled || requiresAccountSettings) return
@@ -102,13 +93,14 @@ export function ConnectorRecovery({
       )}
       {connector.status === 'disabled' ? (
         <SettingsResourceRow
-          title='Sync paused after repeated failures'
-          description={
-            requiresAccountSettings
-              ? 'Update the source account in Settings, then resume syncing.'
-              : serviceId
-                ? 'Reconnect the source account to resume syncing.'
-                : 'Resume the source to retry syncing.'
+          title={
+            !canEdit
+              ? 'Sync paused after repeated failures'
+              : requiresAccountSettings
+                ? 'Update the source account, then resume syncing'
+                : serviceId
+                  ? 'Reconnect to resume syncing'
+                  : 'Sync paused after repeated failures'
           }
           trailing={
             canEdit && requiresAccountSettings && onEdit ? (
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connector-sync-state.ts b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connector-sync-state.ts
index e048fe75b63..935e2ac6772 100644
--- a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connector-sync-state.ts
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connector-sync-state.ts
@@ -1,5 +1,4 @@
 import type { ConnectorData } from '@/lib/api/contracts/knowledge/connectors'
-import { CONNECTOR_META_REGISTRY } from '@/connectors/registry'
 import { isConnectorSyncingOrPending } from '@/hooks/queries/kb/connectors'
 
 const MEMBER_STATUS = {
@@ -16,15 +15,11 @@ export function getConnectorSyncState(connector: ConnectorData) {
   const syncInFlight = isConnectorSyncingOrPending(connector)
   const canResume = connector.status === 'paused' || connector.status === 'disabled'
   const memberSyncDisabled = syncsPerMember && connector.memberSyncStatus === 'disabled'
-  const canFullResync =
-    Boolean(CONNECTOR_META_REGISTRY[connector.connectorType]?.rehydrateOnFullSync) &&
-    !syncsPerMember
 
   return {
     syncsPerMember,
     syncInFlight,
     canResume,
-    canFullResync,
     syncDisabled: syncInFlight || canResume || memberSyncDisabled,
     effectiveStatus:
       syncsPerMember && connector.status === 'active'
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connectors-section.test.tsx b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connectors-section.test.tsx
index bca08b7bd35..b8559b55027 100644
--- a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connectors-section.test.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connectors-section.test.tsx
@@ -144,12 +144,11 @@ vi.mock('@sim/emcn', () => ({
     children,
     disabled,
     onSelect,
-  }: {
-    children?: ReactNode
-    disabled?: boolean
+    ...props
+  }: React.ButtonHTMLAttributes<HTMLButtonElement> & {
     onSelect: () => void
   }) => (
-    <button type='button' disabled={disabled} onClick={onSelect}>
+    <button type='button' disabled={disabled} onClick={onSelect} {...props}>
       {children}
     </button>
   ),
@@ -252,14 +251,29 @@ vi.mock('@/hooks/use-credential-refresh-triggers', () => ({
 }))
 
 import {
-  ConnectorActions,
+  ConnectorActions as ConnectorActionMenu,
   ConnectorRecovery,
   ConnectorSyncHistory,
   ConnectorsSection,
   SyncHistory,
 } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section'
+import { ConnectorActionFeedback } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connector-actions'
+import {
+  type ConnectorActionsOptions,
+  useConnectorActions,
+} from '@/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/use-connector-actions'
 import { type ConnectorData, useConnectorDetail } from '@/hooks/queries/kb/connectors'
 
+function ConnectorActions(props: ConnectorActionsOptions) {
+  const state = useConnectorActions(props)
+  return (
+    <>
+      <ConnectorActionMenu state={state} />
+      <ConnectorActionFeedback state={state} />
+    </>
+  )
+}
+
 let root: Root | null = null
 
 function makeLog(overrides: Partial<SyncLogData> & Pick<SyncLogData, 'status'>): SyncLogData {
@@ -373,6 +387,37 @@ afterEach(() => {
 })
 
 describe('Connector credential reauthorization', () => {
+  it('expands each connection history independently through its labeled control', () => {
+    const container = renderSection(makeConnector(), [makeConnector({ id: 'connector-2' })])
+    const controls = Array.from(
+      container.querySelectorAll<HTMLButtonElement>('button[aria-label="Sync history"]')
+    )
+    expect(controls).toHaveLength(2)
+    const historyId = controls[0].getAttribute('aria-controls')
+    expect(historyId).toBeTruthy()
+    expect(historyId).not.toBe(controls[1].getAttribute('aria-controls'))
+
+    act(() => controls[0].click())
+
+    expect(controls[0].getAttribute('aria-expanded')).toBe('true')
+    expect(controls[1].getAttribute('aria-expanded')).toBe('false')
+    const history = document.getElementById(historyId!)!
+    const collapse = findButton(history, 'Hide history')
+    expect(collapse.getAttribute('aria-controls')).toBe(historyId)
+    expect(collapse.getAttribute('aria-expanded')).toBe('true')
+    act(() => {
+      collapse.focus()
+      collapse.click()
+    })
+    expect(document.getElementById(historyId!)).toBeNull()
+    expect(controls[0].getAttribute('aria-expanded')).toBe('false')
+    expect(controls[1].getAttribute('aria-expanded')).toBe('false')
+    expect(document.activeElement).toBe(
+      container.querySelector('button[aria-label="Connection actions"]')
+    )
+    expect(lifecycle.sync.mutate).not.toHaveBeenCalled()
+  })
+
   it('distinguishes configured sites and spaces without exposing credential fields', () => {
     const container = renderSection(
       makeConnector({
@@ -392,19 +437,45 @@ describe('Connector credential reauthorization', () => {
     expect(container.textContent).not.toContain('private-token')
   })
 
-  it('fails closed when the connector credential cannot be resolved', () => {
-    const container = renderSection(makeConnector())
-    const reconnectButton = Array.from(container.querySelectorAll('button')).find(
-      (button) => button.textContent === 'Reconnect'
+  it('routes an unavailable credential to settings without starting OAuth', () => {
+    const onEdit = vi.fn()
+    const container = renderComponent(
+      <ConnectorRecovery
+        connector={makeConnector()}
+        knowledgeBaseId='knowledge-1'
+        scope={{ kind: 'workspace', workspaceId: 'workspace-1' }}
+        canEdit
+        onEdit={onEdit}
+      />
     )
+    act(() => findButton(container, 'Settings').click())
+    expect(onEdit).toHaveBeenCalledOnce()
+    expect(connectOAuthModalMock).not.toHaveBeenCalled()
+  })
 
-    expect(reconnectButton?.disabled).toBe(true)
-
-    act(() => reconnectButton?.click())
-
+  it('waits for credential loading before deciding how to recover', () => {
+    oauthCredentialsState.isFetching = true
+    const container = renderSection(makeConnector())
+    expect(findButton(container, 'Reconnect')).toBeDisabled()
     expect(connectOAuthModalMock).not.toHaveBeenCalled()
   })
 
+  it.each([true, false])('renders loading and empty states with canEdit=%s', (canEdit) => {
+    const renderEmpty = (isLoading: boolean) => (
+      <ConnectorsSection
+        workspaceId='workspace-1'
+        knowledgeBaseId='knowledge-1'
+        connectors={[]}
+        canEdit={canEdit}
+        isLoading={isLoading}
+      />
+    )
+    const container = renderComponent(renderEmpty(true))
+    expect(container.textContent).toContain('Loading connections…')
+    act(() => root?.render(renderEmpty(false)))
+    expect(container.textContent).toContain('No connected sources yet.')
+  })
+
   it('reauthorizes with the resolved credential provider and identity', () => {
     oauthCredentialsState.current = [
       { id: 'credential-1', name: 'Workspace Slack', provider: 'slack-custom' },
@@ -515,6 +586,15 @@ describe('Connector credential reauthorization', () => {
     expect(connectOAuthModalMock).not.toHaveBeenCalled()
   })
 
+  it('keeps successful-sync notices available when history is opened', () => {
+    const notice = 'Deletion reconciliation deferred until the next complete listing.'
+    const container = renderSection(makeConnector({ status: 'active', lastSyncError: notice }))
+    expect(container.textContent).not.toContain(notice)
+    act(() => findButton(container, 'Sync history').click())
+    expect(container.textContent).toContain(notice)
+    expect(lifecycle.sync.mutate).not.toHaveBeenCalled()
+  })
+
   it('preserves pending OAuth return context when the recovery modal closes', () => {
     oauthCredentialsState.current = [
       { id: 'credential-1', name: 'Workspace Slack', provider: 'slack-custom' },
@@ -741,32 +821,25 @@ describe('Connector credential reauthorization', () => {
 })
 
 describe('shared connector lifecycle actions', () => {
-  it('distinguishes an incremental sync from a supported full resync', () => {
-    const container = renderComponent(
-      <ConnectorActions
-        connector={makeConnector({ status: 'active' })}
-        knowledgeBaseId='knowledge-1'
-        canEdit
-      />
-    )
-    act(() => findButton(container, 'Sync now').click())
-    expect(lifecycle.sync.mutate).toHaveBeenLastCalledWith({
-      knowledgeBaseId: 'knowledge-1',
-      connectorId: 'connector-1',
-      rehydrate: false,
-    })
-    lifecycle.sync.mutate.mockClear()
-    act(() => findButton(container, 'Full resync').click())
-    expect(lifecycle.sync.mutate).not.toHaveBeenCalled()
-    const dialog = container.querySelector('[role="dialog"]')!
-    act(() => findButton(dialog, 'Full resync').click())
-    expect(lifecycle.sync.mutate).toHaveBeenLastCalledWith(
-      { knowledgeBaseId: 'knowledge-1', connectorId: 'connector-1', rehydrate: true },
-      expect.objectContaining({ onSuccess: expect.any(Function) })
-    )
-    act(() => lifecycle.sync.mutate.mock.lastCall![1].onSuccess())
-    expect(container.querySelector('[role="dialog"]')).toBeNull()
-  })
+  it.each(['confluence', 'databricks', 'github', 'gitlab'])(
+    'offers only normal sync for %s',
+    (connectorType) => {
+      const container = renderComponent(
+        <ConnectorActions
+          connector={makeConnector({ status: 'active', connectorType })}
+          knowledgeBaseId='knowledge-1'
+          canEdit
+        />
+      )
+      expect(container.textContent).not.toContain('Full resync')
+      act(() => findButton(container, 'Sync now').click())
+      expect(lifecycle.sync.mutate).toHaveBeenCalledExactlyOnceWith({
+        knowledgeBaseId: 'knowledge-1',
+        connectorId: 'connector-1',
+      })
+      expect(container.querySelector('[role="dialog"]')).toBeNull()
+    }
+  )
 
   it.each(['pending', 'running', 'disabled'] as const)(
     'does not offer content resync or dispatch work while the member engine is %s',
@@ -793,20 +866,6 @@ describe('shared connector lifecycle actions', () => {
     }
   )
 
-  it('cancels a full resync without dispatching work', () => {
-    const container = renderComponent(
-      <ConnectorActions
-        connector={makeConnector({ status: 'active' })}
-        knowledgeBaseId='knowledge-1'
-        canEdit
-      />
-    )
-    act(() => findButton(container, 'Full resync').click())
-    act(() => findButton(container.querySelector('[role="dialog"]')!, 'Cancel').click())
-    expect(lifecycle.sync.mutate).not.toHaveBeenCalled()
-    expect(container.querySelector('[role="dialog"]')).toBeNull()
-  })
-
   it.each([
     { status: 'syncing', accessMode: 'admin', memberSyncStatus: 'idle', blocked: true },
     { status: 'active', accessMode: 'members', memberSyncStatus: 'running', blocked: true },
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connectors-section.tsx b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connectors-section.tsx
index 8b8d5c4e68a..b2848f37e64 100644
--- a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connectors-section.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connectors-section.tsx
@@ -1,18 +1,24 @@
 'use client'
 
-import { useState } from 'react'
-import { Badge, Chip, cn, OverflowText, Tooltip } from '@sim/emcn'
-import { ChevronDown, ChevronUp, CircleAlert, Loader, Users } from '@sim/emcn/icons'
+import { useId, useRef, useState } from 'react'
+import { Badge, Chip, cn } from '@sim/emcn'
+import { Loader, Users } from '@sim/emcn/icons'
 import { format, formatDistanceToNow, isPast } from 'date-fns'
 import type { ConnectorData } from '@/lib/api/contracts/knowledge/connectors'
 import { type ResourceScope, resourceScopeFromOwner } from '@/lib/core/resource-scope'
 import { describeSearchSource } from '@/lib/sim-search/source-identity'
 import { IntegrationTile } from '@/app/workspace/[workspaceId]/integrations/components/integrations-showcase'
-import { ConnectorActions } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connector-actions'
+import {
+  ConnectorActionFeedback,
+  ConnectorActions,
+} from '@/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connector-actions'
 import { ConnectorRecovery } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connector-recovery'
 import { ConnectorSyncHistory } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connector-sync-history'
 import { getConnectorSyncState } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connector-sync-state'
+import { useConnectorActions } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/use-connector-actions'
 import { EditConnectorModal } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/edit-connector-modal'
+import { SettingsEmptyState } from '@/app/workspace/[workspaceId]/settings/components/settings-empty-state'
+import { SettingsResourceRow } from '@/app/workspace/[workspaceId]/settings/components/settings-resource-row'
 import { CONNECTOR_META_REGISTRY } from '@/connectors/registry'
 
 interface ConnectorsSectionProps {
@@ -47,18 +53,15 @@ export function ConnectorsSection({
 }: ConnectorsSectionProps) {
   const scope = explicitScope ?? resourceScopeFromOwner({ workspaceId })
   const [editingConnector, setEditingConnector] = useState<ConnectorData | null>(null)
-  if (connectors.length === 0 && !canEdit && !isLoading) return null
 
   return (
     <div className={cn('mt-4', className)}>
       {isLoading ? (
-        <div className='mt-2' />
+        <SettingsEmptyState variant='inline'>Loading connections…</SettingsEmptyState>
       ) : connectors.length === 0 ? (
-        <p className='mt-2 text-[var(--text-muted)] text-small'>
-          No connected sources yet. Connect an external source to automatically sync documents.
-        </p>
+        <SettingsEmptyState variant='inline'>No connected sources yet.</SettingsEmptyState>
       ) : (
-        <div className='mt-2 flex flex-col gap-0.5'>
+        <div className='divide-y divide-[var(--border)] px-2'>
           {connectors.map((connector) => (
             <ConnectorCard
               key={connector.id}
@@ -103,6 +106,9 @@ function ConnectorCard({
   isSearchIndex,
   onEdit,
 }: ConnectorCardProps) {
+  const actionsTriggerRef = useRef<HTMLButtonElement>(null)
+  const actions = useConnectorActions({ connector, knowledgeBaseId, canEdit, onEdit })
+  const historyId = useId()
   const [expanded, setExpanded] = useState(false)
   const connectorDef = CONNECTOR_META_REGISTRY[connector.connectorType]
   const sourceDescription = connectorDef
@@ -113,101 +119,58 @@ function ConnectorCard({
     getConnectorSyncState(connector)
   const statusConfig =
     STATUS_CONFIG[effectiveStatus as keyof typeof STATUS_CONFIG] || STATUS_CONFIG.active
+  const syncDetails = [
+    lastSyncAt && `Last sync: ${format(new Date(lastSyncAt), 'MMM d, h:mm a')}`,
+    !syncsPerMember && connector.lastSyncDocCount !== null && `${connector.lastSyncDocCount} docs`,
+    nextSyncAt &&
+      connector.status === 'active' &&
+      !syncInFlight &&
+      `Next sync: ${
+        isPast(new Date(nextSyncAt))
+          ? 'pending'
+          : formatDistanceToNow(new Date(nextSyncAt), { addSuffix: true })
+      }`,
+  ]
+    .filter(Boolean)
+    .join(' · ')
 
   return (
-    <div
-      className={cn(
-        'overflow-hidden rounded-lg border border-transparent transition-colors duration-100',
-        expanded
-          ? 'border-[var(--border-muted)] bg-[var(--surface-2)]'
-          : 'hover-hover:bg-[var(--surface-active)]'
-      )}
-    >
-      <div className='flex items-center justify-between gap-2 px-2 py-2'>
-        <div className='flex min-w-0 items-center gap-2.5'>
-          {Icon && <IntegrationTile blockType={connector.connectorType} icon={Icon} />}
-          <div className='flex min-w-0 flex-col gap-0.5'>
-            <div className='flex min-w-0 items-center gap-2'>
-              <span className='flex min-w-0 items-center gap-1.5 text-[var(--text-primary)] text-small'>
-                <OverflowText label={connectorDef?.name || connector.connectorType} />
-                {syncInFlight && <Loader className='size-3 text-[var(--text-muted)]' animate />}
-              </span>
-              <Badge variant={statusConfig.variant} size='sm' dot className='shrink-0'>
-                {statusConfig.label}
+    <div className='flex min-w-0 flex-col gap-2 py-2 first:pt-0 last:pb-0'>
+      <SettingsResourceRow
+        icon={Icon && <IntegrationTile blockType={connector.connectorType} icon={Icon} />}
+        iconVariant='custom'
+        title={connectorDef?.name || connector.connectorType}
+        description={sourceDescription || undefined}
+        badge={
+          <>
+            <Badge variant={statusConfig.variant} size='sm' dot>
+              {statusConfig.label}
+            </Badge>
+            {syncsPerMember && (
+              <Badge variant='gray' size='sm' icon={Users}>
+                Per member
               </Badge>
-              {syncsPerMember && (
-                <Badge variant='gray' size='sm' icon={Users} className='shrink-0'>
-                  Per member
-                </Badge>
-              )}
-            </div>
-            {sourceDescription && (
-              <span className='min-w-0 text-[var(--text-muted)] text-xs'>
-                <OverflowText label={sourceDescription} />
-              </span>
             )}
-            <div className='flex min-w-0 flex-wrap items-center gap-x-1.5 gap-y-0.5 text-[var(--text-muted)] text-xs'>
-              {lastSyncAt && (
-                <span>Last sync: {format(new Date(lastSyncAt), 'MMM d, h:mm a')}</span>
-              )}
-              {!syncsPerMember && connector.lastSyncDocCount !== null && (
-                <>
-                  <span>·</span>
-                  <span>{connector.lastSyncDocCount} docs</span>
-                </>
-              )}
-              {nextSyncAt && connector.status === 'active' && !syncInFlight && (
-                <>
-                  <span>·</span>
-                  <span>
-                    Next sync:{' '}
-                    {isPast(new Date(nextSyncAt))
-                      ? 'pending'
-                      : formatDistanceToNow(new Date(nextSyncAt), { addSuffix: true })}
-                  </span>
-                </>
-              )}
-              {lastSyncError && (
-                <Tooltip.Root>
-                  <Tooltip.Trigger asChild>
-                    <CircleAlert className='size-3 text-[var(--text-error)]' />
-                  </Tooltip.Trigger>
-                  <Tooltip.Content>{lastSyncError}</Tooltip.Content>
-                </Tooltip.Root>
-              )}
-              {connector.accessRewritePending && (
-                <>
-                  <span>·</span>
-                  <span className='flex items-center gap-1'>
-                    <Loader className='size-3' animate />
-                    Updating access
-                  </span>
-                </>
-              )}
-            </div>
-          </div>
-        </div>
-
-        <div className='flex shrink-0 items-center gap-0.5'>
+          </>
+        }
+        trailing={
           <ConnectorActions
-            connector={connector}
-            knowledgeBaseId={knowledgeBaseId}
-            canEdit={canEdit}
-            onEdit={onEdit}
+            state={actions}
+            triggerRef={actionsTriggerRef}
+            history={{
+              expanded,
+              contentId: historyId,
+              onToggle: () => setExpanded((previous) => !previous),
+            }}
           />
-          <Tooltip.Root>
-            <Tooltip.Trigger asChild>
-              <Chip
-                onClick={() => setExpanded((prev) => !prev)}
-                aria-label={expanded ? 'Hide history' : 'Sync history'}
-                aria-expanded={expanded}
-                leftIcon={expanded ? ChevronUp : ChevronDown}
-              />
-            </Tooltip.Trigger>
-            <Tooltip.Content>{expanded ? 'Hide history' : 'Sync history'}</Tooltip.Content>
-          </Tooltip.Root>
-        </div>
-      </div>
+        }
+      />
+      {connector.accessRewritePending && (
+        <span className='flex items-center gap-1 text-[var(--text-muted)] text-caption'>
+          <Loader className='size-3' animate />
+          Updating access
+        </span>
+      )}
       <ConnectorRecovery
         connector={connector}
         scope={scope}
@@ -216,8 +179,25 @@ function ConnectorCard({
         canEdit={canEdit}
         onEdit={onEdit}
       />
+      <ConnectorActionFeedback state={actions} />
       {expanded && (
-        <div className='border-[var(--border-muted)] border-t px-2 py-2'>
+        <div id={historyId} className='border-[var(--border)] border-t pt-3'>
+          <div className='mb-2 flex items-start justify-end gap-2'>
+            {syncDetails && (
+              <p className='flex-1 text-[var(--text-muted)] text-caption'>{syncDetails}</p>
+            )}
+            <Chip
+              aria-expanded={expanded}
+              aria-controls={historyId}
+              onClick={() => {
+                setExpanded(false)
+                actionsTriggerRef.current?.focus()
+              }}
+            >
+              Hide history
+            </Chip>
+          </div>
+          {lastSyncError && <SettingsResourceRow title={lastSyncError} />}
           <ConnectorSyncHistory connector={connector} knowledgeBaseId={knowledgeBaseId} />
         </div>
       )}
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/use-connector-actions.ts b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/use-connector-actions.ts
index 7c8f45295c2..9fbbcda5690 100644
--- a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/use-connector-actions.ts
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/use-connector-actions.ts
@@ -33,7 +33,6 @@ export function useConnectorActions({
   const update = useUpdateConnector()
   const remove = useDeleteConnector()
   const [confirmRemove, setConfirmRemove] = useState(false)
-  const [confirmFullResync, setConfirmFullResync] = useState(false)
   const [deleteDocuments, setDeleteDocuments] = useState(false)
   const requiresDocumentDeletion = connector.accessMode !== 'workspace'
   const state = getConnectorSyncState(connector)
@@ -49,13 +48,10 @@ export function useConnectorActions({
     remove.reset()
   }
 
-  function triggerSync(rehydrate = false) {
-    if (!canEdit || actionsDisabled || state.syncDisabled || (rehydrate && !state.canFullResync))
-      return
+  function triggerSync() {
+    if (!canEdit || actionsDisabled || state.syncDisabled) return
     resetErrors()
-    const input = { knowledgeBaseId, connectorId: connector.id, rehydrate }
-    if (rehydrate) sync.mutate(input, { onSuccess: () => setConfirmFullResync(false) })
-    else sync.mutate(input)
+    sync.mutate({ knowledgeBaseId, connectorId: connector.id })
   }
 
   function setRemoveOpen(open: boolean) {
@@ -74,20 +70,6 @@ export function useConnectorActions({
           tooltip: state.syncTooltip,
           onSelect: () => triggerSync(),
         },
-        ...(state.canFullResync
-          ? [
-              {
-                id: 'full-resync',
-                text: 'Full resync',
-                disabled: state.syncDisabled || actionsDisabled,
-                onSelect: () => {
-                  if (!canEdit || actionsDisabled || state.syncDisabled) return
-                  resetErrors()
-                  setConfirmFullResync(true)
-                },
-              },
-            ]
-          : []),
         ...(onEdit
           ? [{ id: 'settings', text: 'Settings', disabled: actionsDisabled, onSelect: onEdit }]
           : []),
@@ -123,19 +105,7 @@ export function useConnectorActions({
     actions,
     actionsDisabled,
     canEdit,
-    error: (confirmFullResync ? null : sync.error) ?? update.error,
-    fullResync: {
-      open: confirmFullResync,
-      onOpenChange: (open: boolean) => {
-        if (sync.isPending) return
-        setConfirmFullResync(open)
-        if (!open) sync.reset()
-      },
-      pending: sync.isPending,
-      disabled: actionsDisabled || state.syncDisabled || !state.canFullResync,
-      error: sync.error,
-      onConfirm: () => triggerSync(true),
-    },
+    error: sync.error ?? update.error,
     removal: {
       open: confirmRemove,
       onOpenChange: setRemoveOpen,
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/connector-documents-tab.test.tsx b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/connector-documents-tab.test.tsx
index d748e7ff572..8405ec68aec 100644
--- a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/connector-documents-tab.test.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/connector-documents-tab.test.tsx
@@ -24,22 +24,65 @@ vi.mock('@/hooks/queries/kb/knowledge', () => ({
   useUpdateDocument: () => ({ ...mocks.retryState, mutate: mocks.retry }),
 }))
 
+vi.mock(
+  '@/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/use-connector-settings-form',
+  () => ({
+    useConnectorSettingsForm: () => ({
+      displayName: 'GitHub',
+      saving: false,
+      canSave: true,
+      save: vi.fn(),
+      fieldsProps: {},
+    }),
+  })
+)
+vi.mock(
+  '@/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/connector-settings-fields',
+  () => ({ ConnectorSettingsFields: () => <div>Settings content</div> })
+)
+
+import type { ConnectorData } from '@/lib/api/contracts/knowledge/connectors'
 import { ConnectorDocuments } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/connector-documents/connector-documents'
-import { ConnectorDocumentsTab } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/connector-documents-tab'
+import { EditConnectorModal } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/edit-connector-modal'
+
+const connector: ConnectorData = {
+  id: 'connector',
+  knowledgeBaseId: 'kb',
+  connectorType: 'github',
+  credentialId: null,
+  sourceConfig: {},
+  syncMode: 'full',
+  syncIntervalMinutes: 60,
+  status: 'active',
+  lastSyncAt: null,
+  lastSyncError: null,
+  lastSyncDocCount: null,
+  nextSyncAt: null,
+  consecutiveFailures: 0,
+  accessMode: 'workspace',
+  viewerMembership: null,
+  credentialGroupId: null,
+  credentialGroupOptionId: null,
+  memberSyncStatus: 'idle',
+  lastMemberSyncAt: null,
+  nextMemberSyncAt: null,
+  lastMemberSyncError: null,
+  memberSyncConsecutiveFailures: 0,
+  accessRewritePending: false,
+  createdAt: '2026-01-01T00:00:00Z',
+  updatedAt: '2026-01-01T00:00:00Z',
+}
 
 let root: Root
-function render() {
+function render(showDocuments = true) {
   root = createRoot(document.createElement('div'))
   rerender()
+  if (showDocuments) act(() => button('Documents').click())
 }
 function rerender() {
   act(() =>
     root.render(
-      <ChipModal open srTitle='Source settings'>
-        <ChipModalBody>
-          <ConnectorDocumentsTab knowledgeBaseId='kb' connectorId='connector' />
-        </ChipModalBody>
-      </ChipModal>
+      <EditConnectorModal open onOpenChange={vi.fn()} knowledgeBaseId='kb' connector={connector} />
     )
   )
 }
@@ -118,6 +161,31 @@ afterEach(() => {
 })
 
 describe('connector document recovery', () => {
+  it('keeps focused navigation mounted and document filters selected across tabs', () => {
+    render(false)
+    expect(mocks.query).not.toHaveBeenCalled()
+    const settings = button('Settings')
+    const documents = button('Documents')
+    act(() => {
+      documents.focus()
+      documents.click()
+    })
+    expect(document.activeElement).toBe(documents)
+    selectStatus('Failed (1)')
+    act(() => {
+      settings.focus()
+      settings.click()
+    })
+    expect(button('Settings')).toBe(settings)
+    expect(button('Documents')).toBe(documents)
+    expect(document.activeElement).toBe(settings)
+    expect(document.querySelector('[aria-label="Document status"]')).toBeNull()
+    act(() => documents.click())
+    expect(document.querySelector('[aria-label="Document status"]')?.textContent).toContain(
+      'Failed (1)'
+    )
+  })
+
   it('labels Search documents by the current viewer access without changing general knowledge bases', () => {
     render()
     expect(document.body.textContent).not.toContain('Documents you can access')
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/connector-documents-tab.tsx b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/connector-documents-tab.tsx
index da2b7a5188d..6acf63c4d06 100644
--- a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/connector-documents-tab.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/connector-documents-tab.tsx
@@ -1,28 +1,49 @@
 'use client'
 
-import { useState } from 'react'
-import { ChipModalField } from '@sim/emcn'
 import type { ConnectorDocumentFilter } from '@/lib/api/contracts/knowledge/connectors'
+import { ConnectorDocumentStatusFilter } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/connector-documents/connector-document-status-filter'
 import { ConnectorDocuments } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/connector-documents/connector-documents'
+import { useConnectorDocuments } from '@/hooks/queries/kb/connectors'
 
 interface ConnectorDocumentsTabProps {
   knowledgeBaseId: string
   connectorId: string
+  filter: ConnectorDocumentFilter
+  onFilterChange: (filter: ConnectorDocumentFilter) => void
 }
 
 export function ConnectorDocumentsTab({
   knowledgeBaseId,
   connectorId,
+  filter,
+  onFilterChange,
 }: ConnectorDocumentsTabProps) {
-  const [filter, setFilter] = useState<ConnectorDocumentFilter>('active')
   return (
-    <ChipModalField type='custom' title='Documents'>
+    <div className='px-2'>
       <ConnectorDocuments
         knowledgeBaseId={knowledgeBaseId}
         connectorId={connectorId}
         filter={filter}
-        onFilterChange={setFilter}
+        onFilterChange={onFilterChange}
+        showToolbar={false}
       />
-    </ChipModalField>
+    </div>
+  )
+}
+
+export function ConnectorDocumentsTabFilter({
+  knowledgeBaseId,
+  connectorId,
+  filter,
+  onFilterChange,
+}: ConnectorDocumentsTabProps) {
+  const query = useConnectorDocuments(knowledgeBaseId, connectorId, { filter })
+  return (
+    <ConnectorDocumentStatusFilter
+      filter={filter}
+      onFilterChange={onFilterChange}
+      counts={query.data?.pages[0]?.counts}
+      isLoading={query.isLoading || query.isPlaceholderData}
+    />
   )
 }
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/edit-connector-modal.tsx b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/edit-connector-modal.tsx
index 1ca946f2895..298ba33260d 100644
--- a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/edit-connector-modal.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/edit-connector-modal.tsx
@@ -8,8 +8,12 @@ import {
   ChipModalHeader,
   ChipModalTabs,
 } from '@sim/emcn'
+import type { ConnectorDocumentFilter } from '@/lib/api/contracts/knowledge/connectors'
 import type { ResourceScope } from '@/lib/core/resource-scope'
-import { ConnectorDocumentsTab } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/connector-documents-tab'
+import {
+  ConnectorDocumentsTab,
+  ConnectorDocumentsTabFilter,
+} from '@/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/connector-documents-tab'
 import { ConnectorSettingsFields } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/connector-settings-fields'
 import { useConnectorSettingsForm } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/use-connector-settings-form'
 import { withBrandIcon } from '@/blocks/brand-icon'
@@ -33,6 +37,7 @@ export function EditConnectorModal({
   scope,
 }: EditConnectorModalProps) {
   const [activeTab, setActiveTab] = useState('settings')
+  const [documentFilter, setDocumentFilter] = useState<ConnectorDocumentFilter>('active')
   const form = useConnectorSettingsForm({
     scope,
     knowledgeBaseId,
@@ -56,19 +61,34 @@ export function EditConnectorModal({
         Edit {form.displayName}
       </ChipModalHeader>
       <ChipModalBody>
-        <ChipModalTabs
-          tabs={[
-            { value: 'settings', label: 'Settings' },
-            { value: 'documents', label: 'Documents' },
-          ]}
-          value={activeTab}
-          onChange={setActiveTab}
-          className='mx-2'
-        />
+        <div className='mx-2 flex shrink-0 items-center justify-between gap-2'>
+          <ChipModalTabs
+            tabs={[
+              { value: 'settings', label: 'Settings' },
+              { value: 'documents', label: 'Documents' },
+            ]}
+            value={activeTab}
+            onChange={setActiveTab}
+            aria-label='Connection views'
+          />
+          {activeTab === 'documents' && (
+            <ConnectorDocumentsTabFilter
+              knowledgeBaseId={knowledgeBaseId}
+              connectorId={connector.id}
+              filter={documentFilter}
+              onFilterChange={setDocumentFilter}
+            />
+          )}
+        </div>
         {activeTab === 'settings' ? (
           <ConnectorSettingsFields {...form.fieldsProps} />
         ) : (
-          <ConnectorDocumentsTab knowledgeBaseId={knowledgeBaseId} connectorId={connector.id} />
+          <ConnectorDocumentsTab
+            knowledgeBaseId={knowledgeBaseId}
+            connectorId={connector.id}
+            filter={documentFilter}
+            onFilterChange={setDocumentFilter}
+          />
         )}
       </ChipModalBody>
       {activeTab === 'settings' && (
diff --git a/apps/sim/app/workspace/[workspaceId]/search/components/member-connectors-section/member-connectors-section.tsx b/apps/sim/app/workspace/[workspaceId]/search/components/member-connectors-section/member-connectors-section.tsx
deleted file mode 100644
index 0c6da1b9df2..00000000000
--- a/apps/sim/app/workspace/[workspaceId]/search/components/member-connectors-section/member-connectors-section.tsx
+++ /dev/null
@@ -1,99 +0,0 @@
-'use client'
-
-import { useMemo } from 'react'
-import { Chip } from '@sim/emcn'
-import { connectorDisplayName } from '@/lib/sim-search/connectors'
-import { IntegrationTile } from '@/app/workspace/[workspaceId]/integrations/components/integrations-showcase'
-import {
-  RESOURCE_LIST_STACK,
-  SettingsResourceRow,
-} from '@/app/workspace/[workspaceId]/settings/components/settings-resource-row'
-import { SettingsSection } from '@/app/workspace/[workspaceId]/settings/components/settings-section/settings-section'
-import { CONNECTOR_META_REGISTRY } from '@/connectors/registry'
-import { memberConnectorKeys, type WorkspaceMemberConnector } from '@/hooks/queries/kb/connectors'
-import {
-  CONNECTABLE_MEMBERSHIPS,
-  describeMembership,
-  enrollmentActionLabel,
-  useMemberEnrollment,
-} from '@/hooks/use-member-enrollment'
-
-const SHARED_WITH_YOU_LABEL = 'Shared with you'
-
-interface MemberConnectorsSectionProps {
-  workspaceId: string
-  /** The per-member connectors to show, already narrowed by the page's search. */
-  connectors: WorkspaceMemberConnector[]
-}
-
-/**
- * The knowledge bases whose connectors sync per member, and where the viewer
- * stands with each. Connecting here is the same enrollment the knowledge base
- * page offers, so a person can do it from whichever surface they are on.
- */
-export function MemberConnectorsSection({ workspaceId, connectors }: MemberConnectorsSectionProps) {
-  const connectedConnectorIds = useMemo(
-    () =>
-      new Set(
-        connectors
-          .filter((connector) => connector.viewerMembership === 'connected')
-          .map((connector) => connector.connectorId)
-      ),
-    [connectors]
-  )
-  const membershipQueryKeys = useMemo(() => [memberConnectorKeys.list(workspaceId)], [workspaceId])
-  const { connect, isAwaiting, isPending, error } = useMemberEnrollment({
-    membershipQueryKeys,
-    connectedConnectorIds,
-  })
-
-  if (connectors.length === 0) return null
-
-  return (
-    <>
-      <SettingsSection label={SHARED_WITH_YOU_LABEL}>
-        <div className={RESOURCE_LIST_STACK}>
-          {connectors.map((connector) => {
-            const meta = CONNECTOR_META_REGISTRY[connector.connectorType]
-            const name = connectorDisplayName(connector.connectorType)
-            const waiting = isAwaiting(connector.connectorId)
-            const state =
-              describeMembership({
-                membership: connector.viewerMembership,
-                memberSyncStatus: connector.memberSyncStatus,
-                waiting,
-                name,
-              }) ?? 'Connected.'
-            return (
-              <SettingsResourceRow
-                key={connector.connectorId}
-                iconVariant='custom'
-                icon={
-                  meta ? (
-                    <IntegrationTile blockType={connector.connectorType} icon={meta.icon} />
-                  ) : undefined
-                }
-                title={name}
-                description={[connector.knowledgeBaseName, connector.sourceDescription, state]
-                  .filter(Boolean)
-                  .join(' · ')}
-                trailing={
-                  CONNECTABLE_MEMBERSHIPS.has(connector.viewerMembership) ? (
-                    <Chip
-                      variant='primary'
-                      onClick={() => connect(connector.knowledgeBaseId, connector.connectorId)}
-                      disabled={isPending}
-                    >
-                      {enrollmentActionLabel(connector.viewerMembership, waiting)}
-                    </Chip>
-                  ) : undefined
-                }
-              />
-            )
-          })}
-        </div>
-      </SettingsSection>
-      {error && <p className='text-[var(--text-error)] text-caption'>{error}</p>}
-    </>
-  )
-}
diff --git a/apps/sim/app/workspace/[workspaceId]/search/components/search-setup-return.test.tsx b/apps/sim/app/workspace/[workspaceId]/search/components/search-setup-return.test.tsx
deleted file mode 100644
index 7b3a9fb4384..00000000000
--- a/apps/sim/app/workspace/[workspaceId]/search/components/search-setup-return.test.tsx
+++ /dev/null
@@ -1,72 +0,0 @@
-/** @vitest-environment jsdom */
-import { act, type ReactNode } from 'react'
-import { NuqsTestingAdapter } from 'nuqs/adapters/testing'
-import { createRoot, type Root } from 'react-dom/client'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-
-const push = vi.hoisted(() => vi.fn())
-vi.mock('next/navigation', () => ({
-  usePathname: () => '/workspace/workspace-1/settings/credential-groups',
-  useRouter: () => ({ push }),
-}))
-
-import { SearchSetupReturn } from '@/app/workspace/[workspaceId]/search/components/search-setup-return'
-
-let root: Root | undefined
-let container: HTMLDivElement
-
-async function render(node: ReactNode, searchParams: string) {
-  container = document.createElement('div')
-  document.body.appendChild(container)
-  root = createRoot(container)
-  await act(async () =>
-    root?.render(
-      <NuqsTestingAdapter hasMemory searchParams={searchParams}>
-        {node}
-      </NuqsTestingAdapter>
-    )
-  )
-}
-
-beforeEach(() => {
-  push.mockReset()
-  vi.stubGlobal('IS_REACT_ACT_ENVIRONMENT', true)
-})
-afterEach(async () => {
-  await act(async () => root?.unmount())
-  container?.remove()
-  vi.unstubAllGlobals()
-})
-
-describe('returning to Search setup', () => {
-  it.each([
-    ['slack', '/workspace/workspace-1/search?addConnector=slack'],
-    ['search', '/workspace/workspace-1/search'],
-  ])('returns to the original %s setup', async (source, href) => {
-    await render(<SearchSetupReturn workspaceId='workspace-1' />, `?search-setup=${source}`)
-    await act(async () => container.querySelector('button')?.click())
-    expect(push).toHaveBeenCalledWith(href)
-  })
-
-  it('lets the existing unsaved-settings guard defer navigation', async () => {
-    const guard = vi.fn()
-    await render(
-      <SearchSetupReturn workspaceId='workspace-1' onNavigate={guard} />,
-      '?search-setup=slack'
-    )
-    await act(async () => container.querySelector('button')?.click())
-    expect(push).not.toHaveBeenCalled()
-    expect(guard).toHaveBeenCalledOnce()
-    guard.mock.calls[0][0]()
-    expect(push).toHaveBeenCalledWith('/workspace/workspace-1/search?addConnector=slack')
-  })
-
-  it('ignores unrecognized destinations', async () => {
-    await render(
-      <SearchSetupReturn workspaceId='workspace-1' />,
-      '?search-setup=https://unrelated.example'
-    )
-    expect(container.querySelector('button')).toBeNull()
-    expect(push).not.toHaveBeenCalled()
-  })
-})
diff --git a/apps/sim/app/workspace/[workspaceId]/search/components/search-setup-return.tsx b/apps/sim/app/workspace/[workspaceId]/search/components/search-setup-return.tsx
deleted file mode 100644
index 8f26e606f74..00000000000
--- a/apps/sim/app/workspace/[workspaceId]/search/components/search-setup-return.tsx
+++ /dev/null
@@ -1,30 +0,0 @@
-'use client'
-
-import { Chip } from '@sim/emcn'
-import { ArrowLeft } from '@sim/emcn/icons'
-import { useRouter } from 'next/navigation'
-import { useQueryState } from 'nuqs'
-import { searchSetupReturnHref } from '@/lib/sim-search/setup-navigation'
-import { searchSetupReturnParam } from '@/app/workspace/[workspaceId]/search/search-params'
-
-interface SearchSetupReturnProps {
-  workspaceId: string
-  onNavigate?: (navigate: () => void) => void
-}
-
-/** Rejoins the original source setup from integrations or connected-account settings. */
-export function SearchSetupReturn({ workspaceId, onNavigate }: SearchSetupReturnProps) {
-  const [source] = useQueryState(searchSetupReturnParam.key, searchSetupReturnParam.parser)
-  const router = useRouter()
-  if (!source) return null
-  const navigate = () => router.push(searchSetupReturnHref(workspaceId, source))
-  return (
-    <Chip
-      className='self-start'
-      leftIcon={ArrowLeft}
-      onClick={() => (onNavigate ? onNavigate(navigate) : navigate())}
-    >
-      Continue Search setup
-    </Chip>
-  )
-}
diff --git a/apps/sim/app/workspace/[workspaceId]/search/components/search-source-row.test.tsx b/apps/sim/app/workspace/[workspaceId]/search/components/search-source-row.test.tsx
deleted file mode 100644
index 44bf273c7c6..00000000000
--- a/apps/sim/app/workspace/[workspaceId]/search/components/search-source-row.test.tsx
+++ /dev/null
@@ -1,237 +0,0 @@
-/** @vitest-environment jsdom */
-import { act } from 'react'
-import { createRoot, type Root } from 'react-dom/client'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type { SearchSourceSummary } from '@/lib/api/contracts/knowledge/connectors'
-
-vi.mock('@/app/workspace/[workspaceId]/integrations/components/integrations-showcase', () => ({
-  IntegrationTile: () => null,
-}))
-
-import { SearchSourceRow } from '@/app/workspace/[workspaceId]/search/components/search-source-row'
-
-const connect = vi.fn()
-const manage = vi.fn()
-let root: Root
-let container: HTMLDivElement
-
-function source(overrides: Partial<SearchSourceSummary> = {}): SearchSourceSummary {
-  return {
-    knowledgeBaseId: 'kb-search',
-    connectorId: 'source-1',
-    connectorType: 'confluence',
-    sourceDescription: 'engineering.atlassian.net · ENG',
-    accessMode: 'members',
-    availability: 'available',
-    enabled: true,
-    isSyncing: false,
-    lastSyncAt: null,
-    hasSyncError: false,
-    viewerDocumentCount: 0,
-    viewerFailedDocumentCount: 0,
-    viewerEmailVerified: true,
-    connectionRequired: true,
-    viewerMembership: 'invited',
-    ...overrides,
-  } as SearchSourceSummary
-}
-
-async function render(
-  data = source(),
-  props: {
-    canAdmin?: boolean
-    available?: boolean
-    waiting?: boolean
-    isPending?: boolean
-    manageHref?: string
-  } = {}
-) {
-  await act(async () =>
-    root.render(
-      <SearchSourceRow
-        source={data}
-        workspaceId='workspace-1'
-        canAdmin={false}
-        available
-        waiting={false}
-        isPending={false}
-        onConnect={connect}
-        onManage={manage}
-        {...props}
-      />
-    )
-  )
-}
-
-function button(label: string) {
-  return Array.from(document.querySelectorAll<HTMLButtonElement>('button')).find(
-    (node) => node.textContent?.trim() === label || node.getAttribute('aria-label') === label
-  )
-}
-
-beforeEach(() => {
-  vi.clearAllMocks()
-  vi.stubGlobal('IS_REACT_ACT_ENVIRONMENT', true)
-  container = document.createElement('div')
-  document.body.appendChild(container)
-  root = createRoot(container)
-})
-
-afterEach(async () => {
-  await act(async () => root.unmount())
-  container.remove()
-  vi.unstubAllGlobals()
-})
-
-describe('Search source viewer actions', () => {
-  it.each(['invited', 'not_enrolled'] as const)(
-    'lets a %s viewer connect their account',
-    async (membership) => {
-      await render(source({ viewerMembership: membership }))
-      expect(document.body.textContent).toContain('engineering.atlassian.net · ENG')
-      expect(document.body.textContent).toContain('Connect your account to search this source')
-      await act(async () => button('Connect account')!.click())
-      expect(connect).toHaveBeenCalledOnce()
-      expect(button('Manage')).toBeUndefined()
-    }
-  )
-
-  it('offers Reconnect and lets a waiting viewer reopen enrollment', async () => {
-    await render(source({ viewerMembership: 'needs_reauth' }))
-    expect(button('Reconnect')).toBeDefined()
-    await render(source({ viewerMembership: 'needs_reauth' }), { waiting: true })
-    expect(document.body.textContent).toContain('Finish connecting in the other tab')
-    await act(async () => button('Open again')!.click())
-    expect(connect).toHaveBeenCalledOnce()
-    await render(source({ viewerMembership: 'needs_reauth' }), { waiting: true, isPending: true })
-    expect(button('Open again')?.disabled).toBe(true)
-  })
-
-  it.each([
-    { change: { availability: 'unavailable' as const }, status: 'Not available in this workspace' },
-    { change: { enabled: false }, status: 'Syncing is paused' },
-    { change: { viewerEmailVerified: false }, status: 'Verify your email' },
-    { change: { viewerMembership: 'unverified_email' as const }, status: 'Verify your email' },
-    { change: { viewerMembership: 'revoked' as const }, status: 'Your access was removed' },
-    { change: { viewerMembership: null }, status: 'Needs admin attention' },
-  ])('blocks connection when $status', async ({ change, status }) => {
-    await render(source({ ...change, isSyncing: true, hasSyncError: true }))
-    expect(document.body.textContent).toContain(status)
-    expect(button('Connect account')).toBeUndefined()
-    expect(button('Reconnect')).toBeUndefined()
-    expect(connect).not.toHaveBeenCalled()
-  })
-
-  it('blocks a cached available source when the client feature is disabled', async () => {
-    await render(source(), { available: false })
-    expect(document.body.textContent).toContain('Not available in this workspace')
-    expect(button('Connect account')).toBeUndefined()
-  })
-
-  it.each([{ enabled: false }, { approved: false }, { availability: 'unavailable' as const }])(
-    'does not offer email recovery while the source is blocked: %o',
-    async (change) => {
-      await render(source({ ...change, viewerEmailVerified: false }))
-      expect(container.querySelector('a[href="/verify"]')).toBeNull()
-      expect(button('Connect account')).toBeUndefined()
-    }
-  )
-
-  it('prioritizes viewer connection over crawler health for central Confluence identity', async () => {
-    await render(source({ accessMode: 'admin', hasSyncError: true, isSyncing: true }))
-    expect(document.body.textContent).toContain('Connect your account to search this source')
-    expect(button('Connect account')).toBeDefined()
-  })
-
-  it.each(['google_drive', 'gitlab'])(
-    'shows central %s status without prompting for a member connection',
-    async (connectorType) => {
-      await render(
-        source({
-          connectorType,
-          accessMode: 'admin',
-          connectionRequired: false,
-          viewerMembership: null,
-          viewerDocumentCount: 1,
-        })
-      )
-      expect(document.body.textContent).toContain('1 searchable document')
-      expect(document.body.textContent).not.toContain('Needs admin attention')
-      expect(button('Connect account')).toBeUndefined()
-    }
-  )
-
-  it.each([
-    {
-      change: { hasSyncError: true, viewerDocumentCount: 4 },
-      status: 'Sync needs attention',
-    },
-    { change: { hasSyncError: true }, status: 'Sync needs attention' },
-    {
-      change: { viewerFailedDocumentCount: 1 },
-      status: 'Sync needs attention',
-    },
-    {
-      change: { viewerFailedDocumentCount: 2, viewerDocumentCount: 4 },
-      status: 'Sync needs attention',
-    },
-    {
-      change: { isSyncing: true, viewerDocumentCount: 4 },
-      status: 'Indexing',
-    },
-    { change: { isSyncing: true }, status: 'Indexing' },
-    { change: { viewerDocumentCount: 4 }, status: '4 searchable documents' },
-    { change: { lastSyncAt: '2026-09-05T12:00:00Z' }, status: 'No searchable documents yet' },
-    { change: {}, status: 'Waiting for the first sync' },
-  ])('reports $status after connection', async ({ change, status }) => {
-    await render(source({ viewerMembership: 'connected', ...change }))
-    expect(document.body.textContent).toContain(status)
-    expect(button('Connect account')).toBeUndefined()
-  })
-
-  it('gives admins Manage after connecting and keeps management secondary before connecting', async () => {
-    await render(source(), { canAdmin: true })
-    expect(button('Connect account')).toBeDefined()
-    expect(button('Confluence source actions')).toBeDefined()
-    expect(button('Manage')).toBeUndefined()
-    await render(source({ viewerMembership: 'connected' }), { canAdmin: true })
-    await act(async () => button('Manage')!.click())
-    expect(manage).toHaveBeenCalledOnce()
-    expect(connect).not.toHaveBeenCalled()
-  })
-
-  it('opens source details through a row link while preserving the separate connection action', async () => {
-    const manageHref = '/o/org-1/settings/integrations/sources/source-1'
-    await render(source(), { canAdmin: true, manageHref })
-    const link = container.querySelector('a')
-    expect(link?.getAttribute('href')).toBe(manageHref)
-    expect(link?.getAttribute('aria-label')).toBe('Open engineering.atlassian.net · ENG')
-    expect(button('Manage')).toBeUndefined()
-    expect(button('Confluence source actions')).toBeUndefined()
-    expect(link?.contains(button('Connect account')!)).toBe(false)
-    await act(async () => button('Connect account')!.click())
-    expect(connect).toHaveBeenCalledOnce()
-    expect(manage).not.toHaveBeenCalled()
-  })
-
-  it('does not expose management navigation to a non-admin', async () => {
-    await render(source(), {
-      canAdmin: false,
-      manageHref: '/o/org-1/settings/integrations/sources/source-1',
-    })
-    expect(container.querySelector('a')).toBeNull()
-    expect(button('Connect account')).toBeDefined()
-  })
-
-  it.each([false, true])(
-    'retains the legacy knowledge-base link for canAdmin=%s',
-    async (canAdmin) => {
-      await render(source({ connectorType: 'airtable' }), { canAdmin })
-      const link = document.querySelector('a')
-      expect(link?.getAttribute('href')).toBe('/workspace/workspace-1/knowledge/kb-search')
-      expect(link?.textContent).toBe(canAdmin ? 'Manage' : 'View')
-      expect(document.body.textContent).toContain('Available in its knowledge base')
-      expect(button('Connect account')).toBeUndefined()
-    }
-  )
-})
diff --git a/apps/sim/app/workspace/[workspaceId]/search/components/search-source-row.tsx b/apps/sim/app/workspace/[workspaceId]/search/components/search-source-row.tsx
deleted file mode 100644
index eedbafd5e1f..00000000000
--- a/apps/sim/app/workspace/[workspaceId]/search/components/search-source-row.tsx
+++ /dev/null
@@ -1,120 +0,0 @@
-'use client'
-
-import type { ReactNode } from 'react'
-import { Chip, ChipLink } from '@sim/emcn'
-import type { SearchSourceSummary } from '@/lib/api/contracts/knowledge/connectors'
-import { type ResourceScope, resourceScopeFromOwner } from '@/lib/core/resource-scope'
-import { connectorDisplayName } from '@/lib/sim-search/connectors'
-import { IntegrationTile } from '@/app/workspace/[workspaceId]/integrations/components/integrations-showcase'
-import { getSearchSourceStatus } from '@/app/workspace/[workspaceId]/search/components/search-source-row-status'
-import { RowActionsMenu } from '@/app/workspace/[workspaceId]/settings/components/row-actions-menu'
-import { SettingsResourceRow } from '@/app/workspace/[workspaceId]/settings/components/settings-resource-row'
-import { CONNECTOR_META_REGISTRY } from '@/connectors/registry'
-import { CONNECTABLE_MEMBERSHIPS } from '@/hooks/use-member-enrollment'
-
-interface SearchSourceRowProps {
-  source: SearchSourceSummary
-  workspaceId?: string
-  scope?: ResourceScope
-  canAdmin: boolean
-  available: boolean
-  waiting: boolean
-  isPending: boolean
-  onConnect: () => void
-  connectLabel?: string
-  manageHref?: string
-  /** Opens management for the source; only a surface that offers management passes it. */
-  onManage?: () => void
-  accountActions?: ReactNode
-}
-
-/** Source health and the viewer's connection are separate; only the viewer's next action is primary. */
-export function SearchSourceRow({
-  source,
-  workspaceId,
-  scope: explicitScope,
-  canAdmin,
-  available,
-  waiting,
-  isPending,
-  onConnect,
-  connectLabel = 'Connect account',
-  manageHref,
-  onManage,
-  accountActions,
-}: SearchSourceRowProps) {
-  const scope = explicitScope ?? resourceScopeFromOwner({ workspaceId })
-  const meta = CONNECTOR_META_REGISTRY[source.connectorType]
-  const name = connectorDisplayName(source.connectorType)
-  const membership = source.viewerMembership
-  const usable = available && source.availability === 'available'
-  const supported = meta?.search === true
-  const managementHref = canAdmin ? manageHref : undefined
-  const connectable =
-    usable &&
-    supported &&
-    source.enabled &&
-    source.approved !== false &&
-    source.viewerEmailVerified &&
-    source.connectionRequired &&
-    membership !== null &&
-    CONNECTABLE_MEMBERSHIPS.has(membership)
-  const status = getSearchSourceStatus({
-    source,
-    scopeKind: scope.kind,
-    supported,
-    usable,
-    connectable,
-    waiting,
-  })
-
-  return (
-    <SettingsResourceRow
-      iconVariant='custom'
-      icon={
-        meta ? <IntegrationTile blockType={source.connectorType} icon={meta.icon} /> : undefined
-      }
-      title={name}
-      description={[source.sourceDescription, status].filter(Boolean).join(' · ')}
-      href={managementHref}
-      clickLabel={managementHref ? `Open ${source.sourceDescription || name}` : undefined}
-      navigable={Boolean(managementHref)}
-      trailing={
-        !supported && scope.kind === 'workspace' ? (
-          <ChipLink href={`/workspace/${scope.workspaceId}/knowledge/${source.knowledgeBaseId}`}>
-            {canAdmin ? 'Manage' : 'View'}
-          </ChipLink>
-        ) : (
-          <div className='flex items-center gap-2'>
-            {usable &&
-              supported &&
-              source.enabled &&
-              source.approved !== false &&
-              !source.viewerEmailVerified && <ChipLink href='/verify'>Verify email</ChipLink>}
-            {connectable && (
-              <Chip variant='primary' disabled={isPending} onClick={onConnect}>
-                {waiting
-                  ? 'Open again'
-                  : membership === 'needs_reauth'
-                    ? 'Reconnect'
-                    : connectLabel}
-              </Chip>
-            )}
-            {canAdmin &&
-              !managementHref &&
-              onManage &&
-              (connectable ? (
-                <RowActionsMenu
-                  label={`${name} source actions`}
-                  actions={[{ label: 'Manage source', onSelect: onManage }]}
-                />
-              ) : (
-                <Chip onClick={onManage}>Manage</Chip>
-              ))}
-            {accountActions}
-          </div>
-        )
-      }
-    />
-  )
-}
diff --git a/apps/sim/app/workspace/[workspaceId]/search/components/search-source-status.test.tsx b/apps/sim/app/workspace/[workspaceId]/search/components/search-source-status.test.tsx
deleted file mode 100644
index 555d3468c92..00000000000
--- a/apps/sim/app/workspace/[workspaceId]/search/components/search-source-status.test.tsx
+++ /dev/null
@@ -1,97 +0,0 @@
-/**
- * @vitest-environment jsdom
- */
-import { act, type ReactNode } from 'react'
-import { createRoot, type Root } from 'react-dom/client'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type { ResourceScope } from '@/lib/core/resource-scope'
-import { SearchSourceStatus } from '@/app/workspace/[workspaceId]/search/components/search-source-status'
-
-const { push, host } = vi.hoisted(() => ({ push: vi.fn(), host: vi.fn() }))
-vi.mock('next/navigation', () => ({ useRouter: () => ({ push }) }))
-vi.mock('@/app/workspace/[workspaceId]/providers/workspace-host-provider', () => ({
-  useOptionalWorkspaceHostContext: host,
-}))
-vi.mock('@/connectors/registry', () => ({ CONNECTOR_META_REGISTRY: {} }))
-vi.mock('@/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section', () => ({
-  ConnectorsSection: () => null,
-}))
-vi.mock('@sim/emcn', () => {
-  const Container = ({ children }: { children: ReactNode }) => <div>{children}</div>
-  return {
-    ChipModal: Container,
-    ChipModalBody: Container,
-    ChipModalField: Container,
-    ChipModalHeader: Container,
-    ChipModalFooter: ({
-      primaryAction,
-    }: {
-      primaryAction: { label: string; onClick: () => void }
-    }) => (
-      <button type='button' onClick={primaryAction.onClick}>
-        {primaryAction.label}
-      </button>
-    ),
-  }
-})
-
-describe('SearchSourceStatus navigation', () => {
-  let container: HTMLDivElement
-  let root: Root
-
-  beforeEach(() => {
-    ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
-    container = document.createElement('div')
-    root = createRoot(container)
-    push.mockClear()
-    host.mockReturnValue(null)
-  })
-
-  afterEach(() => act(() => root.unmount()))
-
-  function render(scope: ResourceScope) {
-    act(() =>
-      root.render(
-        <SearchSourceStatus
-          scope={scope}
-          knowledgeBaseId='kb-1'
-          connectorType='test'
-          connectors={[]}
-          isLoading={false}
-          onClose={vi.fn()}
-        />
-      )
-    )
-  }
-
-  it('opens the owning organization search route', () => {
-    render({ kind: 'organization', organizationId: 'org-1' })
-    act(() => container.querySelector('button')?.click())
-    expect(push).toHaveBeenCalledWith('/o/org-1/search')
-  })
-
-  it.each([
-    ['workspace-1', true, true, true, true],
-    ['workspace-1', false, true, true, false],
-    ['workspace-1', true, false, true, false],
-    ['workspace-1', true, true, false, false],
-    ['another-workspace', true, true, true, false],
-  ])(
-    'gates workspace entry using routed host access: %s %s %s %s',
-    (id, isMember, organizationSearch, knowledgeMemberAccess, visible) => {
-      host.mockReturnValue({
-        workspace: { id },
-        hostOrganizationId: 'org-1',
-        viewer: { isHostOrganizationMember: isMember },
-        features: { organizationSearch, knowledgeMemberAccess },
-      })
-      render({ kind: 'workspace', workspaceId: 'workspace-1' })
-      const button = container.querySelector('button')
-      expect(Boolean(button)).toBe(visible)
-      if (visible) {
-        act(() => button?.click())
-        expect(push).toHaveBeenCalledWith('/o/org-1/search')
-      }
-    }
-  )
-})
diff --git a/apps/sim/app/workspace/[workspaceId]/search/components/search-source-status.tsx b/apps/sim/app/workspace/[workspaceId]/search/components/search-source-status.tsx
deleted file mode 100644
index b9f2ecb2c14..00000000000
--- a/apps/sim/app/workspace/[workspaceId]/search/components/search-source-status.tsx
+++ /dev/null
@@ -1,81 +0,0 @@
-'use client'
-
-import {
-  ChipModal,
-  ChipModalBody,
-  ChipModalField,
-  ChipModalFooter,
-  ChipModalHeader,
-} from '@sim/emcn'
-import { useRouter } from 'next/navigation'
-import type { ResourceScope } from '@/lib/core/resource-scope'
-import { organizationRoutes } from '@/lib/navigation/paths'
-import { ConnectorsSection } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section'
-import { useOptionalWorkspaceHostContext } from '@/app/workspace/[workspaceId]/providers/workspace-host-provider'
-import { CONNECTOR_META_REGISTRY } from '@/connectors/registry'
-import type { ConnectorData } from '@/hooks/queries/kb/connectors'
-
-interface SearchSourceStatusProps {
-  scope: ResourceScope
-  knowledgeBaseId: string
-  connectorType: string
-  connectors: ConnectorData[]
-  isLoading: boolean
-  onClose: () => void
-}
-
-/** Search reuses the connector's sync status, history, and recovery controls. */
-export function SearchSourceStatus({
-  scope,
-  knowledgeBaseId,
-  connectorType,
-  connectors,
-  isLoading,
-  onClose,
-}: SearchSourceStatusProps) {
-  const router = useRouter()
-  const host = useOptionalWorkspaceHostContext()
-  const organizationId =
-    scope.kind === 'organization'
-      ? scope.organizationId
-      : host?.workspace.id === scope.workspaceId &&
-          host.viewer.isHostOrganizationMember &&
-          host.features?.organizationSearch &&
-          host.features.knowledgeMemberAccess
-        ? host.hostOrganizationId
-        : null
-  const title = `${CONNECTOR_META_REGISTRY[connectorType]?.name ?? 'Source'} sources`
-  return (
-    <ChipModal
-      open
-      onOpenChange={(open) => {
-        if (!open) onClose()
-      }}
-      srTitle={title}
-      size='lg'
-    >
-      <ChipModalHeader onClose={onClose}>{title}</ChipModalHeader>
-      <ChipModalBody>
-        <ChipModalField type='custom' title='Sync status'>
-          <ConnectorsSection
-            scope={scope}
-            knowledgeBaseId={knowledgeBaseId}
-            isSearchIndex
-            connectors={connectors}
-            isLoading={isLoading}
-            canEdit
-          />
-        </ChipModalField>
-      </ChipModalBody>
-      {organizationId && (
-        <ChipModalFooter
-          hideCancel
-          primaryAction={{
-            label: 'Start searching',
-            onClick: () => router.push(organizationRoutes(organizationId).search),
-          }}
-        />
-      )}
-    </ChipModal>
-  )
-}
diff --git a/apps/sim/app/workspace/[workspaceId]/search/error.tsx b/apps/sim/app/workspace/[workspaceId]/search/error.tsx
deleted file mode 100644
index d4520d2d64f..00000000000
--- a/apps/sim/app/workspace/[workspaceId]/search/error.tsx
+++ /dev/null
@@ -1,15 +0,0 @@
-'use client'
-
-import { type ErrorBoundaryProps, ErrorState } from '@/app/workspace/[workspaceId]/components'
-
-export default function SearchError({ error, reset }: ErrorBoundaryProps) {
-  return (
-    <ErrorState
-      error={error}
-      reset={reset}
-      title='Failed to load Sim Search'
-      description='Something went wrong while loading your Sim Search connectors. Please try again.'
-      loggerName='SearchError'
-    />
-  )
-}
diff --git a/apps/sim/app/workspace/[workspaceId]/search/page.tsx b/apps/sim/app/workspace/[workspaceId]/search/page.tsx
deleted file mode 100644
index 83ac1cf864f..00000000000
--- a/apps/sim/app/workspace/[workspaceId]/search/page.tsx
+++ /dev/null
@@ -1,44 +0,0 @@
-import { Suspense } from 'react'
-import type { Metadata } from 'next'
-import { notFound, redirect } from 'next/navigation'
-import { getSession } from '@/lib/auth'
-import { getWorkspaceHostContextForViewer } from '@/lib/workspaces/host-context'
-import { IntegrationTabsHeader } from '@/app/workspace/[workspaceId]/components'
-import { Search } from '@/app/workspace/[workspaceId]/search/search'
-
-export const metadata: Metadata = {
-  title: 'Search',
-}
-
-/**
- * Sim Search page entry, served only where per-member access is on: the whole
- * surface is the feature, so with it off the route is not there to be typed,
- * linked, or bookmarked into — the same judgement the tab header hides itself
- * on. The host context is request-memoized, so this re-reads what the workspace
- * layout already resolved.
- *
- * `Search` reads URL query params via nuqs (which uses `useSearchParams`
- * internally), so it must sit under a Suspense boundary. The fallback renders
- * the real page chrome (background + tab header) so a suspend never shows a
- * blank frame.
- */
-export default async function SearchPage({ params }: { params: Promise<{ workspaceId: string }> }) {
-  const session = await getSession()
-  if (!session?.user) redirect('/login')
-
-  const { workspaceId } = await params
-  const hostContext = await getWorkspaceHostContextForViewer(workspaceId, session.user.id)
-  if (!hostContext?.features?.knowledgeMemberAccess) notFound()
-
-  return (
-    <Suspense
-      fallback={
-        <div className='flex h-full flex-col bg-[var(--bg)]'>
-          <IntegrationTabsHeader active='search' workspaceId={workspaceId} />
-        </div>
-      }
-    >
-      <Search />
-    </Suspense>
-  )
-}
diff --git a/apps/sim/app/workspace/[workspaceId]/search/search.test.tsx b/apps/sim/app/workspace/[workspaceId]/search/search.test.tsx
deleted file mode 100644
index 2012833a8f7..00000000000
--- a/apps/sim/app/workspace/[workspaceId]/search/search.test.tsx
+++ /dev/null
@@ -1,410 +0,0 @@
-/** @vitest-environment jsdom */
-import { act } from 'react'
-import { NuqsTestingAdapter } from 'nuqs/adapters/testing'
-import { createRoot, type Root } from 'react-dom/client'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type {
-  SearchSourceSummary,
-  WorkspaceMemberConnector,
-} from '@/lib/api/contracts/knowledge/connectors'
-import { SEARCH_DEBOUNCE_MS } from '@/lib/url-state'
-
-const mocks = vi.hoisted(() => ({
-  canAdmin: false,
-  features: { knowledgeMemberAccess: true, knowledgeSourceMirroredAccess: true },
-  sources: [] as SearchSourceSummary[],
-  shared: [] as WorkspaceMemberConnector[],
-  sourcePending: false,
-  sourceError: null as Error | null,
-  sharedError: null as Error | null,
-  sourceRefetch: vi.fn(),
-  sharedRefetch: vi.fn(),
-  sourceQuery: vi.fn(),
-  sharedQuery: vi.fn(),
-  connect: vi.fn(),
-  setup: vi.fn(),
-  sharedRows: vi.fn(),
-  urlUpdate: vi.fn(),
-}))
-
-vi.mock('next/navigation', () => ({
-  useParams: () => ({ workspaceId: 'workspace-1' }),
-}))
-vi.mock('@/app/workspace/[workspaceId]/providers/workspace-host-provider', () => ({
-  useWorkspaceHostContext: () => ({ features: mocks.features }),
-}))
-vi.mock('@/hooks/use-member-access', () => ({
-  useMemberAccessAvailable: () => mocks.features.knowledgeMemberAccess,
-}))
-vi.mock('@/hooks/queries/workspace', () => ({
-  useWorkspacePermissionsQuery: () => ({ data: { viewer: { isAdmin: mocks.canAdmin } } }),
-}))
-vi.mock('@/hooks/queries/kb/connectors', () => ({
-  useSearchSources: (id: string, options: { search: string }) => {
-    mocks.sourceQuery(id, options)
-    return {
-      data: mocks.sources.filter((source) =>
-        `${source.connectorType.replaceAll('_', ' ')} ${source.sourceDescription}`
-          .toLowerCase()
-          .includes(options.search.trim().toLowerCase())
-      ),
-      isPending: mocks.sourcePending,
-      isError: Boolean(mocks.sourceError),
-      error: mocks.sourceError,
-      isFetching: false,
-      refetch: mocks.sourceRefetch,
-    }
-  },
-  useWorkspaceMemberConnectors: (id: string, options: { enabled: boolean }) => {
-    mocks.sharedQuery(id, options)
-    return {
-      data: mocks.shared,
-      isError: Boolean(mocks.sharedError),
-      error: mocks.sharedError,
-      isFetching: false,
-      refetch: mocks.sharedRefetch,
-    }
-  },
-}))
-vi.mock('@/hooks/use-member-enrollment', () => ({
-  CONNECTABLE_MEMBERSHIPS: new Set(['needs_reauth', 'invited', 'not_enrolled']),
-  useMemberEnrollment: () => ({
-    connect: mocks.connect,
-    isAwaiting: () => false,
-    isPending: false,
-    error: null,
-  }),
-}))
-vi.mock('@/hooks/use-debounced-search-setter', () => ({
-  useDebouncedSearchSetter: (write: (value: string) => void) => write,
-}))
-vi.mock('@/app/workspace/[workspaceId]/integrations/hooks/use-scroll-restoration', () => ({
-  useScrollRestoration: () => undefined,
-}))
-vi.mock('@/app/workspace/[workspaceId]/components', () => ({ IntegrationTabsHeader: () => null }))
-vi.mock('@/app/workspace/[workspaceId]/integrations/components/integrations-showcase', () => ({
-  IntegrationTile: () => null,
-}))
-vi.mock('@/app/workspace/[workspaceId]/search/components/search-source-setup', () => ({
-  SearchSourceSetup: (props: { canAdmin: boolean }) => {
-    mocks.setup(props)
-    return <div data-testid='source-setup' />
-  },
-}))
-vi.mock(
-  '@/app/workspace/[workspaceId]/search/components/member-connectors-section/member-connectors-section',
-  () => ({
-    MemberConnectorsSection: (props: { connectors: WorkspaceMemberConnector[] }) => {
-      mocks.sharedRows(props.connectors)
-      return props.connectors.length ? <div>Shared with you</div> : null
-    },
-  })
-)
-
-import { Search } from '@/app/workspace/[workspaceId]/search/search'
-
-function source(overrides: Partial<SearchSourceSummary> = {}): SearchSourceSummary {
-  return {
-    knowledgeBaseId: 'kb-search',
-    connectorId: 'drive-1',
-    connectorType: 'google_drive',
-    sourceDescription: 'Company files',
-    accessMode: 'admin',
-    availability: 'available',
-    enabled: true,
-    isSyncing: false,
-    lastSyncAt: '2026-09-05T12:00:00Z',
-    hasSyncError: false,
-    viewerDocumentCount: 12,
-    viewerEmailVerified: true,
-    connectionRequired: false,
-    viewerMembership: null,
-    ...overrides,
-  } as SearchSourceSummary
-}
-
-function button(label: string) {
-  return Array.from(document.querySelectorAll<HTMLButtonElement>('button')).find(
-    (node) => node.textContent?.trim() === label || node.getAttribute('aria-label') === label
-  )
-}
-
-let root: Root
-let container: HTMLDivElement
-async function render(searchParams = '') {
-  await act(async () =>
-    root.render(
-      <NuqsTestingAdapter hasMemory searchParams={searchParams} onUrlUpdate={mocks.urlUpdate}>
-        <Search />
-      </NuqsTestingAdapter>
-    )
-  )
-}
-
-beforeEach(() => {
-  vi.clearAllMocks()
-  vi.stubGlobal('IS_REACT_ACT_ENVIRONMENT', true)
-  mocks.canAdmin = false
-  mocks.features = { knowledgeMemberAccess: true, knowledgeSourceMirroredAccess: true }
-  mocks.sources = [source(), source({ connectorId: 'gitlab-1', connectorType: 'gitlab' })]
-  mocks.shared = []
-  mocks.sourcePending = false
-  mocks.sourceError = null
-  mocks.sharedError = null
-  container = document.createElement('div')
-  document.body.appendChild(container)
-  root = createRoot(container)
-})
-
-afterEach(async () => {
-  await act(async () => root.unmount())
-  vi.useRealTimers()
-  container.remove()
-  vi.unstubAllGlobals()
-})
-
-describe('unified Search sources', () => {
-  it('keeps typing responsive and debounces the server search', async () => {
-    vi.useFakeTimers()
-    await render()
-    const input = document.querySelector<HTMLInputElement>('input')!
-    const setValue = Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, 'value')!.set!
-    await act(async () => {
-      setValue.call(input, 'git')
-      input.dispatchEvent(new Event('input', { bubbles: true }))
-    })
-    expect(input.value).toBe('git')
-    expect(mocks.sourceQuery).toHaveBeenLastCalledWith('workspace-1', { search: '' })
-    await act(async () => vi.advanceTimersByTime(SEARCH_DEBOUNCE_MS - 1))
-    expect(mocks.sourceQuery).toHaveBeenLastCalledWith('workspace-1', { search: '' })
-    await act(async () => vi.advanceTimersByTime(1))
-    expect(mocks.sourceQuery).toHaveBeenLastCalledWith('workspace-1', { search: 'git' })
-  })
-
-  it('shows configured central Drive and GitLab sources to readers without setup controls', async () => {
-    await render()
-    expect(document.body.textContent).toContain('Google Drive')
-    expect(document.body.textContent).toContain('GitLab')
-    expect(document.body.textContent).not.toContain('Slack')
-    expect(document.body.textContent).not.toContain('Confluence')
-    expect(button('Add source')).toBeUndefined()
-    expect(button('Manage')).toBeUndefined()
-    expect(button('Connect account')).toBeUndefined()
-    expect(mocks.sourceQuery).toHaveBeenCalledWith('workspace-1', { search: '' })
-    expect(mocks.setup).toHaveBeenLastCalledWith(expect.objectContaining({ canAdmin: false }))
-  })
-
-  it('connects each configured Confluence site using its exact connector ID', async () => {
-    mocks.sources = ['engineering', 'sales'].map((site) =>
-      source({
-        connectorId: `confluence-${site}`,
-        connectorType: 'confluence',
-        sourceDescription: `${site}.atlassian.net`,
-        accessMode: 'members',
-        connectionRequired: true,
-        viewerMembership: 'invited',
-      })
-    )
-    await render()
-    const buttons = Array.from(document.querySelectorAll('button')).filter(
-      (node) => node.textContent === 'Connect account'
-    )
-    expect(buttons).toHaveLength(2)
-    expect(document.body.textContent).toContain('engineering.atlassian.net')
-    expect(document.body.textContent).toContain('sales.atlassian.net')
-    await act(async () => buttons[1]!.click())
-    expect(mocks.connect).toHaveBeenCalledExactlyOnceWith('kb-search', 'confluence-sales')
-  })
-
-  it('offers only the member’s required account actions across mixed source methods', async () => {
-    mocks.sources.push(
-      source({
-        connectorId: 'confluence-central',
-        connectorType: 'confluence',
-        connectionRequired: true,
-        viewerMembership: 'not_enrolled',
-      }),
-      source({
-        connectorId: 'drive-members',
-        accessMode: 'members',
-        connectionRequired: true,
-        viewerMembership: 'connected',
-      }),
-      source({
-        connectorId: 'slack-members',
-        connectorType: 'slack',
-        accessMode: 'members',
-        connectionRequired: true,
-        viewerMembership: 'needs_reauth',
-      })
-    )
-    await render()
-    const actions = Array.from(document.querySelectorAll('button')).map((node) =>
-      node.textContent?.trim()
-    )
-    expect(actions).toEqual(['Connect account', 'Reconnect'])
-    await act(async () => button('Connect account')!.click())
-    await act(async () => button('Reconnect')!.click())
-    expect(mocks.connect.mock.calls).toEqual([
-      ['kb-search', 'confluence-central'],
-      ['kb-search', 'slack-members'],
-    ])
-    expect(mocks.urlUpdate).not.toHaveBeenCalled()
-  })
-
-  it('keeps central email-based sources usable when managed identities become unavailable', async () => {
-    mocks.features.knowledgeMemberAccess = false
-    mocks.sources.push(
-      source({
-        connectorId: 'confluence-central',
-        connectorType: 'confluence',
-        connectionRequired: true,
-        viewerMembership: 'invited',
-      }),
-      source({
-        connectorId: 'slack-members',
-        connectorType: 'slack',
-        accessMode: 'members',
-        connectionRequired: true,
-        viewerMembership: 'needs_reauth',
-      })
-    )
-    await render()
-    expect(document.body.textContent?.match(/12 searchable documents/g)).toHaveLength(2)
-    expect(document.body.textContent?.match(/Not available in this workspace/g)).toHaveLength(2)
-    expect(button('Connect account')).toBeUndefined()
-    expect(button('Reconnect')).toBeUndefined()
-    expect(mocks.sharedQuery).toHaveBeenLastCalledWith('workspace-1', { enabled: false })
-  })
-
-  it('allows admins to add member sources when mirrored access is off', async () => {
-    mocks.canAdmin = true
-    mocks.features.knowledgeSourceMirroredAccess = false
-    await render('?search=slack')
-    expect(button('Add source')).toBeDefined()
-    await act(async () => button('Add source')!.click())
-    await vi.waitFor(() =>
-      expect(mocks.urlUpdate).toHaveBeenCalledWith(
-        expect.objectContaining({ queryString: '?addConnector=' })
-      )
-    )
-    expect(mocks.setup).toHaveBeenLastCalledWith(
-      expect.objectContaining({ memberAccessAvailable: true, mirroredAccessAvailable: false })
-    )
-  })
-
-  it('keeps general-KB enrollments under Shared with you and excludes index duplicates', async () => {
-    const shared: WorkspaceMemberConnector = {
-      knowledgeBaseId: 'kb-sales',
-      knowledgeBaseName: 'Sales',
-      knowledgeBaseIsSearchIndex: false,
-      connectorId: 'sales-drive',
-      connectorType: 'google_drive',
-      sourceDescription: 'Sales folder',
-      memberSyncStatus: 'idle',
-      viewerMembership: 'invited',
-      viewerDocumentCount: 0,
-    }
-    mocks.shared = [shared, { ...shared, connectorId: 'drive-1', knowledgeBaseIsSearchIndex: true }]
-    await render()
-    expect(mocks.sharedRows).toHaveBeenLastCalledWith([shared])
-    expect(document.body.textContent).toContain('Shared with you')
-  })
-
-  it('blocks cached member and identity actions after features turn off', async () => {
-    mocks.canAdmin = true
-    mocks.features = { knowledgeMemberAccess: false, knowledgeSourceMirroredAccess: false }
-    mocks.sources = [
-      source({ accessMode: 'members', connectionRequired: true, viewerMembership: 'invited' }),
-      source({
-        connectorId: 'confluence-1',
-        connectorType: 'confluence',
-        connectionRequired: true,
-        viewerMembership: 'needs_reauth',
-      }),
-    ]
-    await render()
-    expect(document.body.textContent).toContain('Not available in this workspace')
-    expect(button('Connect account')).toBeUndefined()
-    expect(button('Reconnect')).toBeUndefined()
-    expect(button('Add source')).toBeUndefined()
-    expect(mocks.sharedQuery).toHaveBeenLastCalledWith('workspace-1', { enabled: false })
-    expect(mocks.sharedRows).not.toHaveBeenCalled()
-  })
-
-  it.each([false, true])('provides a useful empty state for canAdmin=%s', async (canAdmin) => {
-    mocks.canAdmin = canAdmin
-    mocks.sources = []
-    await render()
-    expect(document.body.textContent).toContain(
-      canAdmin ? 'Add a source to start indexing' : 'Ask a workspace admin to get started'
-    )
-  })
-
-  it('shows loading and then a retryable source error without stale rows', async () => {
-    mocks.sourcePending = true
-    await render()
-    expect(document.body.textContent).toContain('Loading sources…')
-    expect(document.body.textContent).not.toContain('Google Drive')
-    mocks.sourcePending = false
-    mocks.sourceError = new Error('Could not fetch sources')
-    await render()
-    expect(document.body.textContent).toContain('Could not fetch sources')
-    await act(async () => button('Try again')!.click())
-    expect(mocks.sourceRefetch).toHaveBeenCalledOnce()
-    expect(document.body.textContent).not.toContain('Google Drive')
-  })
-
-  it('retries shared-source failures without hiding the configured sources', async () => {
-    mocks.sharedError = new Error('Shared sources failed')
-    await render()
-    expect(document.body.textContent).toContain('Google Drive')
-    expect(document.body.textContent).toContain('Shared sources failed')
-    await act(async () => button('Try again')!.click())
-    expect(mocks.sharedRefetch).toHaveBeenCalledOnce()
-  })
-
-  it('filters by provider and source address while retaining the setup owner for a return URL', async () => {
-    mocks.canAdmin = true
-    await render('?search=missing&addConnector=gitlab&credentialDraftId=draft-1')
-    expect(document.body.textContent).toContain('No matching sources.')
-    expect(document.body.textContent).not.toContain('Google Drive')
-    expect(document.querySelector('[data-testid="source-setup"]')).not.toBeNull()
-    expect(mocks.urlUpdate).not.toHaveBeenCalled()
-  })
-
-  it('pushes source management without replacing the filtered list URL used by Back', async () => {
-    mocks.canAdmin = true
-    await render('?search=gitlab')
-    expect(document.body.textContent).toContain('GitLab')
-    expect(document.body.textContent).not.toContain('Google Drive')
-    await act(async () => button('Manage')!.click())
-    await vi.waitFor(() =>
-      expect(mocks.urlUpdate).toHaveBeenCalledWith(
-        expect.objectContaining({
-          queryString: '?search=gitlab&manage-source=gitlab-1',
-          options: expect.objectContaining({ history: 'push' }),
-        })
-      )
-    )
-    await render('?search=gitlab&manage-source=gitlab-1')
-    await render('?search=gitlab')
-    expect(document.querySelector('input')?.value).toBe('gitlab')
-    expect(document.body.textContent).toContain('GitLab')
-    expect(document.body.textContent).not.toContain('Google Drive')
-  })
-
-  it('opens admin source management by connector ID', async () => {
-    mocks.canAdmin = true
-    await render()
-    await act(async () => button('Manage')!.click())
-    await vi.waitFor(() =>
-      expect(mocks.urlUpdate).toHaveBeenCalledWith(
-        expect.objectContaining({
-          queryString: '?manage-source=drive-1',
-          options: expect.objectContaining({ history: 'push' }),
-        })
-      )
-    )
-  })
-})
diff --git a/apps/sim/app/workspace/[workspaceId]/search/search.tsx b/apps/sim/app/workspace/[workspaceId]/search/search.tsx
deleted file mode 100644
index 39e424a1bf5..00000000000
--- a/apps/sim/app/workspace/[workspaceId]/search/search.tsx
+++ /dev/null
@@ -1,189 +0,0 @@
-'use client'
-
-import { useMemo, useRef } from 'react'
-import { Chip, ChipInput } from '@sim/emcn'
-import { Plus, Search as SearchIcon } from '@sim/emcn/icons'
-import { useParams } from 'next/navigation'
-import { useQueryState } from 'nuqs'
-import { connectorDisplayName } from '@/lib/sim-search/connectors'
-import { SEARCH_DEBOUNCE_MS } from '@/lib/url-state'
-import { IntegrationTabsHeader } from '@/app/workspace/[workspaceId]/components'
-import { IntegrationSection } from '@/app/workspace/[workspaceId]/integrations/components/integration-section'
-import { useScrollRestoration } from '@/app/workspace/[workspaceId]/integrations/hooks/use-scroll-restoration'
-import { useWorkspaceHostContext } from '@/app/workspace/[workspaceId]/providers/workspace-host-provider'
-import { MemberConnectorsSection } from '@/app/workspace/[workspaceId]/search/components/member-connectors-section/member-connectors-section'
-import { SearchSourcePagination } from '@/app/workspace/[workspaceId]/search/components/search-source-pagination'
-import { SearchSourceRow } from '@/app/workspace/[workspaceId]/search/components/search-source-row'
-import { SearchSourceSetup } from '@/app/workspace/[workspaceId]/search/components/search-source-setup'
-import {
-  connectorSearchParam,
-  connectorSearchUrlKeys,
-  managedSourceParam,
-  searchSetupParam,
-} from '@/app/workspace/[workspaceId]/search/search-params'
-import {
-  SettingsEmptyState,
-  SettingsQueryErrorState,
-} from '@/app/workspace/[workspaceId]/settings/components/settings-empty-state'
-import { useSearchSources, useWorkspaceMemberConnectors } from '@/hooks/queries/kb/connectors'
-import { searchSourceKeys } from '@/hooks/queries/utils/search-source-keys'
-import { useWorkspacePermissionsQuery } from '@/hooks/queries/workspace'
-import { useDebounce } from '@/hooks/use-debounce'
-import { useDebouncedSearchSetter } from '@/hooks/use-debounced-search-setter'
-import { useMemberAccessAvailable } from '@/hooks/use-member-access'
-import { useMemberEnrollment } from '@/hooks/use-member-enrollment'
-
-/** One source list for everyone; setup and management remain admin actions. */
-export function Search() {
-  const scrollContainerRef = useRef<HTMLDivElement>(null)
-  const { workspaceId } = useParams<{ workspaceId: string }>()
-  const { features } = useWorkspaceHostContext()
-  const memberAccessAvailable = useMemberAccessAvailable()
-  const mirroredAccessAvailable = features?.knowledgeSourceMirroredAccess === true
-  const { data: permissions } = useWorkspacePermissionsQuery(workspaceId)
-  const canAdmin = permissions?.viewer?.isAdmin ?? false
-  const shared = useWorkspaceMemberConnectors(workspaceId, { enabled: memberAccessAvailable })
-  const [searchTerm, setSearchTermParam] = useQueryState(connectorSearchParam.key, {
-    ...connectorSearchParam.parser,
-    ...connectorSearchUrlKeys,
-  })
-  const sourceSearch = useDebounce(searchTerm.trim(), SEARCH_DEBOUNCE_MS)
-  const sources = useSearchSources(workspaceId, { search: sourceSearch })
-  const [, setSelectedType] = useQueryState(
-    searchSetupParam.key,
-    searchSetupParam.parser.withOptions({ history: 'replace' })
-  )
-  const [, setManagedSource] = useQueryState(
-    managedSourceParam.key,
-    managedSourceParam.parser.withOptions({ history: 'replace' })
-  )
-  const setSearchTerm = useDebouncedSearchSetter(setSearchTermParam)
-  const membershipQueryKeys = useMemo(() => [searchSourceKeys.list(workspaceId)], [workspaceId])
-  const connectedConnectorIds = useMemo(
-    () =>
-      new Set(
-        sources.data
-          ?.filter((source) => source.viewerMembership === 'connected')
-          .map((source) => source.connectorId)
-      ),
-    [sources.data]
-  )
-  const { connect, isAwaiting, isPending, error } = useMemberEnrollment({
-    membershipQueryKeys,
-    connectedConnectorIds,
-  })
-
-  useScrollRestoration(scrollContainerRef, { ready: !sources.isPending })
-
-  const normalizedSearch = searchTerm.trim().toLowerCase()
-  const matches = (type: string, description: string) =>
-    `${connectorDisplayName(type)} ${description}`.toLowerCase().includes(normalizedSearch)
-  const visibleSources = sources.data ?? []
-  const sharedConnectors = memberAccessAvailable
-    ? (shared.data?.filter(
-        (source) =>
-          !source.knowledgeBaseIsSearchIndex &&
-          matches(
-            source.connectorType,
-            `${source.knowledgeBaseName} ${source.sourceDescription ?? ''}`
-          )
-      ) ?? [])
-    : []
-
-  return (
-    <div className='flex h-full flex-col bg-[var(--bg)]'>
-      <IntegrationTabsHeader active='search' workspaceId={workspaceId} />
-      <div
-        ref={scrollContainerRef}
-        className='min-h-0 flex-1 overflow-y-auto px-6 [scrollbar-gutter:stable_both-edges]'
-      >
-        <div className='mx-auto flex max-w-[48rem] flex-col gap-7 pb-3'>
-          <div className='flex items-center justify-between gap-2'>
-            <h1 className='text-[var(--text-body)] text-base'>Search sources</h1>
-            {canAdmin && (memberAccessAvailable || mirroredAccessAvailable) && (
-              <Chip
-                variant='primary'
-                leftIcon={Plus}
-                onClick={() => {
-                  void setSearchTermParam('')
-                  void setSelectedType('')
-                }}
-              >
-                Add source
-              </Chip>
-            )}
-          </div>
-          <ChipInput
-            icon={SearchIcon}
-            placeholder='Find a source...'
-            value={searchTerm}
-            onChange={(event) => setSearchTerm(event.target.value)}
-          />
-          <IntegrationSection label='Sources' layout='list'>
-            {sources.isError && !sources.isFetchNextPageError ? (
-              <SettingsQueryErrorState
-                error={sources.error}
-                fallback='Could not load sources'
-                isRetrying={sources.isFetching}
-                onRetry={() => void sources.refetch()}
-                variant='inline'
-              />
-            ) : sources.isPending ? (
-              <SettingsEmptyState variant='inline'>Loading sources…</SettingsEmptyState>
-            ) : visibleSources.length > 0 ? (
-              visibleSources.map((source) => (
-                <SearchSourceRow
-                  key={source.connectorId}
-                  source={source}
-                  workspaceId={workspaceId}
-                  canAdmin={canAdmin}
-                  available={
-                    source.accessMode === 'members'
-                      ? memberAccessAvailable
-                      : mirroredAccessAvailable &&
-                        (!source.connectionRequired || memberAccessAvailable)
-                  }
-                  waiting={isAwaiting(source.connectorId)}
-                  isPending={isPending}
-                  onConnect={() => connect(source.knowledgeBaseId, source.connectorId)}
-                  onManage={() => void setManagedSource(source.connectorId, { history: 'push' })}
-                />
-              ))
-            ) : !sources.hasNextPage ? (
-              <SettingsEmptyState variant='inline'>
-                {normalizedSearch
-                  ? 'No matching sources.'
-                  : canAdmin
-                    ? 'Add a source to start indexing documents for Search.'
-                    : 'Your workspace hasn’t added any sources yet. Ask a workspace admin to get started.'}
-              </SettingsEmptyState>
-            ) : null}
-            {(!sources.isError || sources.isFetchNextPageError) && (
-              <SearchSourcePagination {...sources} />
-            )}
-          </IntegrationSection>
-          {memberAccessAvailable &&
-            (shared.isError ? (
-              <SettingsQueryErrorState
-                error={shared.error}
-                fallback='Could not load sources shared with you'
-                isRetrying={shared.isFetching}
-                onRetry={() => void shared.refetch()}
-                variant='inline'
-              />
-            ) : (
-              <MemberConnectorsSection workspaceId={workspaceId} connectors={sharedConnectors} />
-            ))}
-          {error && <p className='text-[var(--text-error)] text-caption'>{error}</p>}
-          <SearchSourceSetup
-            key={workspaceId}
-            workspaceId={workspaceId}
-            canAdmin={canAdmin}
-            memberAccessAvailable={memberAccessAvailable}
-            mirroredAccessAvailable={mirroredAccessAvailable}
-          />
-        </div>
-      </div>
-    </div>
-  )
-}
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/[section]/page.test.tsx b/apps/sim/app/workspace/[workspaceId]/settings/[section]/page.test.tsx
index 034c639a179..bfd7f13b9f7 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/[section]/page.test.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/[section]/page.test.tsx
@@ -51,7 +51,7 @@ vi.mock('@/app/workspace/[workspaceId]/settings/navigation', () => ({
       'access-control',
       'audit-logs',
       'sso',
-      'sessions',
+      'security',
       'data-retention',
       'data-drains',
       'whitelabeling',
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/[section]/settings.tsx b/apps/sim/app/workspace/[workspaceId]/settings/[section]/settings.tsx
index 1247284618e..ae626e7a9d9 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/[section]/settings.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/[section]/settings.tsx
@@ -93,11 +93,6 @@ const AuditLogs = dynamic(() =>
   import('@/ee/audit-logs/components/audit-logs').then((m) => m.AuditLogs)
 )
 const SSO = dynamic(() => import('@/ee/sso/components/sso-settings').then((m) => m.SSO))
-const SessionPolicySettings = dynamic(() =>
-  import('@/ee/session-policy/components/session-policy-settings').then(
-    (m) => m.SessionPolicySettings
-  )
-)
 const DataRetentionSettings = dynamic(() =>
   import('@/ee/data-retention/components/data-retention-settings').then(
     (m) => m.DataRetentionSettings
@@ -106,6 +101,9 @@ const DataRetentionSettings = dynamic(() =>
 const DataDrainsSettings = dynamic(() =>
   import('@/ee/data-drains/components/data-drains-settings').then((m) => m.DataDrainsSettings)
 )
+const OrganizationSecuritySettings = dynamic(() =>
+  import('@/components/settings/organization-security').then((m) => m.OrganizationSecuritySettings)
+)
 const UsageMonitoring = dynamic(() =>
   import('@/ee/organization-usage/components/usage-monitoring').then((m) => m.UsageMonitoring)
 )
@@ -201,15 +199,15 @@ export function SettingsPage({ section }: SettingsPageProps) {
         />
       )}
       {effectiveSection === 'sso' && organizationId && <SSO organizationId={organizationId} />}
-      {effectiveSection === 'sessions' && organizationId && (
-        <SessionPolicySettings key={organizationId} organizationId={organizationId} />
-      )}
       {effectiveSection === 'data-retention' && organizationId && (
         <DataRetentionSettings organizationId={organizationId} />
       )}
       {effectiveSection === 'data-drains' && organizationId && (
         <DataDrainsSettings organizationId={organizationId} />
       )}
+      {effectiveSection === 'security' && organizationId && (
+        <OrganizationSecuritySettings organizationId={organizationId} />
+      )}
       {effectiveSection === 'whitelabeling' && organizationId && (
         <WhitelabelingSettings organizationId={organizationId} />
       )}
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/general/general.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/general/general.tsx
index 9ffff5c4db5..bc7e01d96b6 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/general/general.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/general/general.tsx
@@ -23,8 +23,9 @@ import dynamic from 'next/dynamic'
 import Image from 'next/image'
 import { useRouter } from 'next/navigation'
 import { useQueryState } from 'nuqs'
-import { signOut, useSession } from '@/lib/auth/auth-client'
+import { useSession } from '@/lib/auth/auth-client'
 import { ANONYMOUS_USER_ID } from '@/lib/auth/constants'
+import { signOutAndRedirect } from '@/lib/auth/sign-out'
 import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
 import { getBrowserTimezone, getTimezoneOptions } from '@/lib/core/utils/timezone'
 import { getBaseUrl } from '@/lib/core/utils/urls'
@@ -49,7 +50,6 @@ import {
   useUpdateUserProfile,
   useUserProfile,
 } from '@/hooks/queries/user-profile'
-import { clearUserData } from '@/stores'
 
 const AuthorizedApps = dynamic(() =>
   import('@/app/workspace/[workspaceId]/settings/components/authorized-apps/authorized-apps').then(
@@ -195,21 +195,6 @@ export function General() {
     handleUpdateName()
   }
 
-  const handleSignOut = async () => {
-    const logoutUrl = '/login?fromLogout=true'
-    let canNavigateInApp = false
-
-    try {
-      const [, inMemoryResetSucceeded] = await Promise.all([signOut(), clearUserData()])
-      canNavigateInApp = inMemoryResetSucceeded
-    } catch (error) {
-      logger.error('Error signing out:', { error })
-    }
-
-    if (canNavigateInApp) router.push(logoutUrl)
-    else window.location.assign(logoutUrl)
-  }
-
   const handleResetPasswordConfirm = async () => {
     if (!profile?.email) return
 
@@ -299,7 +284,7 @@ export function General() {
       : []),
     ...(session?.user?.id && !isAuthDisabled
       ? [
-          { id: 'sign-out', text: 'Sign out', onSelect: handleSignOut },
+          { id: 'sign-out', text: 'Sign out', onSelect: () => signOutAndRedirect(router.push) },
           {
             id: 'reset-password',
             text: 'Reset password',
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/settings-empty-state/settings-empty-state.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/settings-empty-state/settings-empty-state.tsx
index ec541844f65..cb1ab6b89e7 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/settings-empty-state/settings-empty-state.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/settings-empty-state/settings-empty-state.tsx
@@ -55,7 +55,7 @@ export function SettingsQueryErrorState({
   return (
     <SettingsEmptyState variant={variant} tone='error'>
       <div className='flex flex-col items-center gap-2'>
-        <span>{getErrorMessage(error, fallback)}</span>
+        <span role='alert'>{getErrorMessage(error, fallback)}</span>
         <Chip variant='border' disabled={isRetrying} onClick={onRetry}>
           {isRetrying ? 'Retrying…' : 'Try again'}
         </Chip>
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/navigation.test.ts b/apps/sim/app/workspace/[workspaceId]/settings/navigation.test.ts
index 42172436605..fdad1a693a0 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/navigation.test.ts
+++ b/apps/sim/app/workspace/[workspaceId]/settings/navigation.test.ts
@@ -44,7 +44,7 @@ describe('unified settings navigation', () => {
       { id: 'recently-deleted', label: 'Recently deleted', section: 'workspace' },
       { id: 'self-host', label: 'Self hosting', section: 'platform' },
       { id: 'sso', label: 'Single sign-on', section: 'organization' },
-      { id: 'sessions', label: 'Session policies', section: 'organization' },
+      { id: 'security', label: 'Security', section: 'organization' },
       { id: 'data-retention', label: 'Data retention', section: 'organization' },
       { id: 'data-drains', label: 'Data drains', section: 'organization' },
       { id: 'whitelabeling', label: 'White-labeling', section: 'organization' },
@@ -90,7 +90,7 @@ describe('unified settings navigation', () => {
       'audit-logs',
       'whitelabeling',
       'sso',
-      'sessions',
+      'security',
       'data-retention',
       'data-drains',
     ])
@@ -124,6 +124,7 @@ describe('resolveSettingsSection', () => {
     team: 'organization',
     'api-keys': 'apikeys',
     domains: 'sso',
+    sessions: 'security',
   } as const
 
   it('keeps legacy section links working', () => {
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/navigation.ts b/apps/sim/app/workspace/[workspaceId]/settings/navigation.ts
index 8427439f40a..973e5b78fb5 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/navigation.ts
+++ b/apps/sim/app/workspace/[workspaceId]/settings/navigation.ts
@@ -44,6 +44,7 @@ const SECTION_ALIASES: Readonly<Record<string, SettingsSection>> = {
   'api-keys': 'apikeys',
   /** Verified domains moved into the SSO page. */
   domains: 'sso',
+  sessions: 'security',
 }
 
 export interface ResolvedSettingsSection {
diff --git a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/tool-input.tsx b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/tool-input.tsx
index abd43aa7c1c..40f7c25a165 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/tool-input.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/tool-input.tsx
@@ -392,15 +392,8 @@ export const ToolInput = memo(function ToolInput({
       [blockId]
     )
   )
-  const { collaborativeSetBlockCanonicalMode, collaborativeSetBlockCanonicalModes } =
+  const { collaborativeSetBlockCanonicalMode, collaborativeSetSubblockValueWithCanonicalModes } =
     useCollaborativeWorkflow()
-  const reindexCanonicalModesOnMutate = useCallback(
-    (oldTools: StoredTool[], newTools: StoredTool[]) => {
-      const next = reindexToolCanonicalModes(oldTools, newTools, canonicalModeOverrides)
-      if (next) collaborativeSetBlockCanonicalModes(blockId, next)
-    },
-    [canonicalModeOverrides, collaborativeSetBlockCanonicalModes, blockId]
-  )
 
   const value = isPreview ? previewValue : storeValue
 
@@ -412,6 +405,39 @@ export const ToolInput = memo(function ToolInput({
       ? (value as StoredTool[])
       : []
 
+  /**
+   * Commits a tool list that moves or drops selected tools. Their canonical-mode overrides are
+   * keyed by position, so when any must move they persist in the same operation as the list.
+   * `positionedTools` is the list holding the kept tool references when `nextTools` clones them.
+   */
+  const setToolsWithReindexedModes = useCallback(
+    (nextTools: StoredTool[], positionedTools: StoredTool[] = nextTools) => {
+      const canonicalModes = reindexToolCanonicalModes(
+        selectedTools,
+        positionedTools,
+        canonicalModeOverrides
+      )
+      if (!canonicalModes) {
+        setStoreValue(nextTools)
+        return
+      }
+      collaborativeSetSubblockValueWithCanonicalModes(
+        blockId,
+        subBlockId,
+        structuredClone(nextTools),
+        canonicalModes
+      )
+    },
+    [
+      selectedTools,
+      canonicalModeOverrides,
+      setStoreValue,
+      collaborativeSetSubblockValueWithCanonicalModes,
+      blockId,
+      subBlockId,
+    ]
+  )
+
   // Tool categories the consuming block can't run (declared on its tool-input
   // subBlock): shown in the picker but greyed out with a tooltip instead of added.
   const blockType = useWorkflowStore(useCallback((state) => state.blocks[blockId]?.type, [blockId]))
@@ -857,10 +883,9 @@ export const ToolInput = memo(function ToolInput({
     (toolIndex: number) => {
       if (isPreview || disabled) return
       const updatedTools = selectedTools.filter((_, index) => index !== toolIndex)
-      reindexCanonicalModesOnMutate(selectedTools, updatedTools)
-      setStoreValue(updatedTools)
+      setToolsWithReindexedModes(updatedTools)
     },
-    [isPreview, disabled, selectedTools, reindexCanonicalModesOnMutate, setStoreValue]
+    [isPreview, disabled, selectedTools, setToolsWithReindexedModes]
   )
 
   const handleRemoveAllFromServer = useCallback(
@@ -869,10 +894,9 @@ export const ToolInput = memo(function ToolInput({
       const updatedTools = selectedTools.filter(
         (t) => !(t.type === 'mcp' && t.params?.serverId === serverId)
       )
-      reindexCanonicalModesOnMutate(selectedTools, updatedTools)
-      setStoreValue(updatedTools)
+      setToolsWithReindexedModes(updatedTools)
     },
-    [isPreview, disabled, selectedTools, reindexCanonicalModesOnMutate, setStoreValue]
+    [isPreview, disabled, selectedTools, setToolsWithReindexedModes]
   )
 
   const handleDeleteTool = useCallback(
@@ -900,11 +924,10 @@ export const ToolInput = memo(function ToolInput({
       })
 
       if (updatedTools.length !== selectedTools.length) {
-        reindexCanonicalModesOnMutate(selectedTools, updatedTools)
-        setStoreValue(updatedTools)
+        setToolsWithReindexedModes(updatedTools)
       }
     },
-    [selectedTools, customTools, reindexCanonicalModesOnMutate, setStoreValue]
+    [selectedTools, customTools, setToolsWithReindexedModes]
   )
 
   const handleParamChange = useCallback(
@@ -1077,8 +1100,7 @@ export const ToolInput = memo(function ToolInput({
       newTools.splice(adjustedDropIndex, 0, draggedTool)
     }
 
-    reindexCanonicalModesOnMutate(selectedTools, newTools)
-    setStoreValue(newTools)
+    setToolsWithReindexedModes(newTools)
     setDraggedIndex(null)
     setDragOverIndex(null)
   }
@@ -1177,8 +1199,7 @@ export const ToolInput = memo(function ToolInput({
               ...filteredTools.map((tool) => ({ ...tool, isExpanded: false })),
               serverBinding,
             ]
-            reindexCanonicalModesOnMutate(selectedTools, filteredTools)
-            setStoreValue(nextTools)
+            setToolsWithReindexedModes(nextTools, filteredTools)
             setMcpServerDrilldown(null)
             setOpen(false)
           },
@@ -1445,7 +1466,7 @@ export const ToolInput = memo(function ToolInput({
     supportsAdvancedMcpServer,
     availableWorkflows,
     isToolAlreadySelected,
-    reindexCanonicalModesOnMutate,
+    setToolsWithReindexedModes,
   ])
 
   return (
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/help-modal/help-modal.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/help-modal/help-modal.tsx
index 6e734ec5c31..635ffebb475 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/help-modal/help-modal.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/help-modal/help-modal.tsx
@@ -53,14 +53,14 @@ interface HelpModalProps {
   open: boolean
   onOpenChange: (open: boolean) => void
   workflowId?: string
-  workspaceId: string
+  workspaceId?: string
 }
 
 interface SubmitHelpVariables {
   data: FormValues
   images: ImageWithPreview[]
   workflowId?: string
-  workspaceId: string
+  workspaceId?: string
 }
 
 async function compressImage(file: File): Promise<File> {
@@ -93,7 +93,7 @@ async function submitHelpRequest({ data, images, workflowId, workspaceId }: Subm
   formData.append('subject', data.subject)
   formData.append('message', data.message)
   formData.append('type', data.type)
-  formData.append('workspaceId', workspaceId)
+  if (workspaceId) formData.append('workspaceId', workspaceId)
   formData.append('userAgent', navigator.userAgent)
   if (workflowId) {
     formData.append('workflowId', workflowId)
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/sidebar-footer/sidebar-footer.test.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/sidebar-footer/sidebar-footer.test.tsx
index 22d0f09b014..c4455bac823 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/sidebar-footer/sidebar-footer.test.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/sidebar-footer/sidebar-footer.test.tsx
@@ -1,10 +1,10 @@
 /**
  * @vitest-environment jsdom
  */
-import { act } from 'react'
-import { resetEnvFlagsMock, setEnvFlags } from '@sim/testing'
+import { act, type ComponentProps } from 'react'
+import { Building, Credit, Trash, Users } from '@sim/emcn/icons'
 import { createRoot, type Root } from 'react-dom/client'
-import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const desktopMocks = vi.hoisted(() => ({
   getState: vi.fn(),
@@ -15,15 +15,26 @@ const desktopMocks = vi.hoisted(() => ({
   unsubscribe: vi.fn(),
 }))
 
-const { hostContext } = vi.hoisted(() => ({
-  hostContext: {
-    hostOrganizationId: null as string | null,
-    viewer: { isHostOrganizationMember: false },
-    features: {
-      organizationSearch: undefined as boolean | undefined,
-      knowledgeMemberAccess: false,
-    },
-  },
+const authMocks = vi.hoisted(() => ({ signOut: vi.fn(), userId: 'user-1' }))
+vi.mock('@/lib/auth/sign-out', () => ({ signOutAndRedirect: authMocks.signOut }))
+vi.mock('next/link', () => ({
+  default: ({
+    onNavigate,
+    prefetch: _prefetch,
+    ...props
+  }: ComponentProps<'a'> & {
+    prefetch?: boolean
+    onNavigate?: (event: { preventDefault: () => void }) => void
+  }) => (
+    <a
+      {...props}
+      href={props.href}
+      onClick={(event) => {
+        event.preventDefault()
+        onNavigate?.({ preventDefault: () => {} })
+      }}
+    />
+  ),
 }))
 
 vi.mock('@/lib/desktop', () => ({
@@ -35,23 +46,11 @@ vi.mock('@/lib/desktop', () => ({
   }),
 }))
 vi.mock('@/hooks/queries/user-profile', () => ({
-  useUserProfile: () => ({ data: { id: 'user-1', name: 'Ada', email: 'ada@sim.ai' } }),
+  useUserProfile: () => ({ data: { id: authMocks.userId, name: 'Ada', email: 'ada@sim.ai' } }),
 }))
-vi.mock('@/lib/auth/auth-client', () => ({
-  useSession: () => ({ data: { user: { id: 'user-1' } } }),
-}))
-vi.mock('@/lib/billing/workspace-permissions', () => ({
-  canViewWorkspaceBillingSettings: () => true,
-}))
-/** Billing routes the invitations-disabled row to Subscription; read at render time. */
-beforeAll(() => setEnvFlags({ isBillingEnabled: true }))
-afterAll(resetEnvFlagsMock)
-vi.mock('@/lib/workspaces/colors', () => ({ getUserColor: () => '#000000' }))
-vi.mock('@/hooks/use-workspace-invite-policy', () => ({
-  useWorkspaceInvitePolicy: () => ({ isInvitationsDisabled: false }),
-}))
-vi.mock('@/app/workspace/[workspaceId]/providers/workspace-host-provider', () => ({
-  useWorkspaceHostContext: () => hostContext,
+vi.mock('next/navigation', () => ({
+  useRouter: () => ({ push: vi.fn() }),
+  usePathname: () => '/workspace/ws-emir/home',
 }))
 vi.mock(
   '@/app/workspace/[workspaceId]/w/components/sidebar/components/sidebar-tooltip/sidebar-tooltip',
@@ -63,7 +62,9 @@ vi.mock('@/components/icons', () => ({
   SlackIcon: ({ className }: { className?: string }) => <svg className={className} />,
 }))
 
+import { ANONYMOUS_USER_ID } from '@/lib/auth/constants'
 import { SidebarFooter } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/sidebar-footer/sidebar-footer'
+import { useSettingsDirtyStore } from '@/stores/settings/dirty/store'
 
 let container: HTMLDivElement
 let root: Root
@@ -76,12 +77,31 @@ async function renderFooter(
   await act(async () => {
     root.render(
       <SidebarFooter
-        workspaceId='workspace-1'
         showDivider={false}
         isCollapsed={false}
         showCollapsedTooltips={false}
-        getSettingsHref={(section) => `/workspace/workspace-1/settings/${section}`}
-        onOpenSettings={() => {}}
+        accountSettingsHref='/workspace/workspace-1/settings/general'
+        onOpenAccountSettings={() => {}}
+        navigationLinks={[
+          {
+            label: 'Subscription',
+            icon: Credit,
+            href: '/workspace/workspace-1/settings/billing',
+            onNavigate: () => {},
+          },
+          {
+            label: 'Teammates',
+            icon: Users,
+            href: '/workspace/workspace-1/settings/teammates',
+            onNavigate: () => {},
+          },
+          {
+            label: 'Recently deleted',
+            icon: Trash,
+            href: '/workspace/workspace-1/settings/recently-deleted',
+            onNavigate: () => {},
+          },
+        ]}
         onOpenDocs={() => {}}
         onJoinSlack={() => {}}
         onContactSupport={() => {}}
@@ -129,10 +149,8 @@ function menuItem(label: string): HTMLElement {
 
 beforeEach(() => {
   vi.clearAllMocks()
-  hostContext.hostOrganizationId = null
-  hostContext.viewer.isHostOrganizationMember = false
-  hostContext.features.organizationSearch = undefined
-  hostContext.features.knowledgeMemberAccess = false
+  authMocks.userId = 'user-1'
+  useSettingsDirtyStore.getState().reset()
   desktopMocks.listener = null
   desktopMocks.onState.mockImplementation((listener) => {
     desktopMocks.listener = listener
@@ -150,50 +168,64 @@ afterEach(() => {
 })
 
 describe('SidebarFooter', () => {
-  it('links members back to the organization hosting the current workspace', async () => {
-    hostContext.hostOrganizationId = 'host-org'
-    hostContext.viewer.isHostOrganizationMember = true
-    hostContext.features.organizationSearch = true
+  it('keeps the familiar Settings entry in the profile menu', async () => {
     await renderFooter({ status: 'idle' })
-
     openProfileMenu()
+    expect(
+      [...document.querySelectorAll('[role="menuitem"]')].map((item) => item.textContent)
+    ).toEqual(['Settings', 'Subscription', 'Teammates', 'Recently deleted', 'Sign out'])
+    expect(document.querySelector('[role="separator"]')).toBeNull()
+    expect(menuItem('Settings')).toHaveAttribute('href', '/workspace/workspace-1/settings/general')
+  })
 
-    expect(menuItem('Organization')).toHaveAttribute('href', '/o/host-org')
-    const labels = Array.from(document.querySelectorAll('[role="menuitem"]')).map(
-      (item) => item.textContent
+  it('guards returning to the organization when settings are unsaved', async () => {
+    const onNavigate = vi.fn()
+    await renderFooter(
+      { status: 'idle' },
+      {
+        navigationLinks: [{ label: 'Organization', icon: Building, href: '/o/org-1', onNavigate }],
+      }
     )
-    expect(labels.indexOf('Organization')).toBe(labels.indexOf('Settings') + 1)
-    expect(labels.indexOf('Organization')).toBeLessThan(labels.indexOf('Teammates'))
-    expect(document.querySelector('[role="menu"] [role="separator"]')).toBeNull()
+    useSettingsDirtyStore.getState().setDirty(true)
+    openProfileMenu()
+    expect(menuItem('Organization')).toHaveAttribute('href', '/o/org-1')
+    act(() => menuItem('Organization').click())
+    expect(onNavigate).not.toHaveBeenCalled()
+    act(() => useSettingsDirtyStore.getState().confirmLeave())
+    expect(onNavigate).toHaveBeenCalledOnce()
   })
 
-  it.each([false, undefined])(
-    'keeps the workspace profile menu when org rollout is %s',
-    async (enabled) => {
-      hostContext.hostOrganizationId = 'host-org'
-      hostContext.viewer.isHostOrganizationMember = true
-      hostContext.features.organizationSearch = enabled
-      hostContext.features.knowledgeMemberAccess = true
-      await renderFooter({ status: 'idle' })
-
-      openProfileMenu()
-
-      expect(document.querySelector('[role="menu"]')).not.toHaveTextContent('Organization')
-      expect(menuItem('Settings')).toHaveAttribute(
-        'href',
-        '/workspace/workspace-1/settings/general'
-      )
-    }
-  )
+  it('uses the shared sign-out flow', async () => {
+    await renderFooter({ status: 'idle' })
+    openProfileMenu()
+    await act(async () => menuItem('Sign out').click())
+    expect(authMocks.signOut).toHaveBeenCalledOnce()
+  })
 
-  it.each([null, 'host-org'])('hides Organization without host membership (%s)', async (orgId) => {
-    hostContext.hostOrganizationId = orgId
-    hostContext.features.organizationSearch = true
+  it('defers sign-out while settings are unsaved', async () => {
     await renderFooter({ status: 'idle' })
+    useSettingsDirtyStore.getState().setDirty(true)
+    openProfileMenu()
+    await act(async () => menuItem('Sign out').click())
+    expect(authMocks.signOut).not.toHaveBeenCalled()
+    act(() => useSettingsDirtyStore.getState().confirmLeave())
+    expect(authMocks.signOut).toHaveBeenCalledOnce()
+  })
 
+  it('hides sign-out for auth-disabled deployments', async () => {
+    authMocks.userId = ANONYMOUS_USER_ID
+    await renderFooter({ status: 'idle' })
     openProfileMenu()
+    expect(document.querySelector('[role="menu"]')).not.toHaveTextContent('Sign out')
+    expect(document.querySelector('[role="separator"]')).toBeNull()
+  })
 
-    expect(document.querySelector('[role="menu"]')).not.toHaveTextContent('Organization')
+  it('opens the shared support flow', async () => {
+    const onContactSupport = vi.fn()
+    await renderFooter({ status: 'idle' }, { onContactSupport })
+    openHelpMenu()
+    act(() => menuItem('Contact support').click())
+    expect(onContactSupport).toHaveBeenCalledOnce()
   })
 
   it('keeps the overflow tooltip disabled while the collapsed tooltip still owns the trigger', async () => {
@@ -212,18 +244,6 @@ describe('SidebarFooter', () => {
     expect(document.querySelector('[data-native-surface-overlay]')).toBeNull()
   })
 
-  it('renders profile settings destinations with native link semantics', async () => {
-    await renderFooter({ status: 'idle' })
-
-    openProfileMenu()
-
-    expect(menuItem('Settings')).toHaveAttribute('href', '/workspace/workspace-1/settings/general')
-    expect(menuItem('Subscription')).toHaveAttribute(
-      'href',
-      '/workspace/workspace-1/settings/billing'
-    )
-  })
-
   it('keeps the ordinary help treatment when no update is available', async () => {
     await renderFooter({ status: 'idle' })
 
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/sidebar-footer/sidebar-footer.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/sidebar-footer/sidebar-footer.tsx
index 6963d707b56..1da14a9bf22 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/sidebar-footer/sidebar-footer.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/sidebar-footer/sidebar-footer.tsx
@@ -17,26 +17,14 @@ import {
   OverflowText,
   Skeleton,
 } from '@sim/emcn'
-import {
-  BookOpen,
-  Building,
-  Credit,
-  Download,
-  HelpCircle,
-  Settings,
-  Trash,
-  Users,
-} from '@sim/emcn/icons'
+import { BookOpen, Download, HelpCircle, LogOut, Settings } from '@sim/emcn/icons'
+import { useRouter } from 'next/navigation'
 import { SlackIcon } from '@/components/icons'
 import { SettingsIntentLink } from '@/components/settings/settings-intent-link'
-import { useSession } from '@/lib/auth/auth-client'
-import { canViewWorkspaceBillingSettings } from '@/lib/billing/workspace-permissions'
-import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
+import { ANONYMOUS_USER_ID } from '@/lib/auth/constants'
+import { signOutAndRedirect } from '@/lib/auth/sign-out'
 import { getDesktopUpdates } from '@/lib/desktop'
-import { organizationRoutes } from '@/lib/navigation/paths'
 import { getUserColor } from '@/lib/workspaces/colors'
-import { useWorkspaceHostContext } from '@/app/workspace/[workspaceId]/providers/workspace-host-provider'
-import type { SettingsSection } from '@/app/workspace/[workspaceId]/settings/navigation'
 import { SidebarTooltip } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/sidebar-tooltip'
 import {
   SIDEBAR_ITEM_GAP_CLASS,
@@ -44,28 +32,7 @@ import {
 } from '@/app/workspace/[workspaceId]/w/components/sidebar/constants'
 import { useUserProfile } from '@/hooks/queries/user-profile'
 import { useDesktopUpdateState } from '@/hooks/use-desktop-update-state'
-import { useWorkspaceInvitePolicy } from '@/hooks/use-workspace-invite-policy'
-
-/**
- * Settings destinations reachable from the profile menu, in display order. Labels
- * and icons mirror the settings navigation entries they open, so the menu and the
- * settings sidebar never disagree about what a section is called.
- *
- * Which of them a given viewer actually gets is decided in {@link SidebarFooter} —
- * the same gates the settings sidebar and the section route apply, so the menu
- * never lists a page the server would refuse.
- */
-const PROFILE_MENU_ITEMS: readonly {
-  section: SettingsSection | 'organization'
-  label: string
-  icon: ComponentType<{ className?: string }>
-}[] = [
-  { section: 'general', label: 'Settings', icon: Settings },
-  { section: 'organization', label: 'Organization', icon: Building },
-  { section: 'billing', label: 'Subscription', icon: Credit },
-  { section: 'teammates', label: 'Teammates', icon: Users },
-  { section: 'recently-deleted', label: 'Recently deleted', icon: Trash },
-]
+import { useSettingsDirtyStore } from '@/stores/settings/dirty/store'
 
 function hasAvailableDesktopUpdate(state: DesktopUpdateState): boolean {
   return state.status === 'available' || state.status === 'downloading' || state.status === 'ready'
@@ -97,8 +64,14 @@ function DesktopUpdateIcon({ className }: { className?: string }) {
   )
 }
 
+interface SidebarNavigationLink {
+  label: string
+  icon: ComponentType<{ className?: string }>
+  href: string
+  onNavigate: () => void
+}
+
 interface SidebarFooterProps {
-  workspaceId: string
   /**
    * True while the scroll region above still hides rows beyond its bottom edge —
    * the same test the divider under the pinned nav applies at the top. The bar's
@@ -107,16 +80,16 @@ interface SidebarFooterProps {
   showDivider: boolean
   isCollapsed: boolean
   showCollapsedTooltips: boolean
-  getSettingsHref: (section: SettingsSection) => string
-  onOpenSettings: (section: SettingsSection) => void
+  accountSettingsHref: string
+  onOpenAccountSettings: () => void
+  navigationLinks: readonly SidebarNavigationLink[]
   onOpenDocs: () => void
   onJoinSlack: () => void
   onContactSupport: () => void
 }
 
 /**
- * Pinned bottom bar of the workspace sidebar: the viewer's avatar and name, which
- * open a menu of their settings destinations, plus a help menu.
+ * Shared account and Help menus for the workspace and organization sidebars.
  *
  * Expanded, the two share one row — the profile claims the free width so the help
  * button lands hard right, mirroring the collapse control in the workspace header.
@@ -138,31 +111,23 @@ interface SidebarFooterProps {
  * than remounting a trigger mid-animation.
  */
 export function SidebarFooter({
-  workspaceId,
   showDivider,
   isCollapsed,
   showCollapsedTooltips,
-  getSettingsHref,
-  onOpenSettings,
+  accountSettingsHref,
+  onOpenAccountSettings,
+  navigationLinks,
   onOpenDocs,
   onJoinSlack,
   onContactSupport,
 }: SidebarFooterProps) {
   const { data: profile } = useUserProfile()
-  const { data: session } = useSession()
-  const hostContext = useWorkspaceHostContext()
-  const { billingEnabled } = useDeploymentShape()
-  const { isInvitationsDisabled } = useWorkspaceInvitePolicy(workspaceId)
+  const router = useRouter()
   const updateState = useDesktopUpdateState()
 
   const name = profile ? profile.name?.trim() || profile.email : ''
   const updateAvailable = hasAvailableDesktopUpdate(updateState)
-  const organizationHref =
-    hostContext.hostOrganizationId &&
-    hostContext.viewer.isHostOrganizationMember &&
-    hostContext.features?.organizationSearch
-      ? organizationRoutes(hostContext.hostOrganizationId).root
-      : null
+  const canSignOut = Boolean(profile && profile.id !== ANONYMOUS_USER_ID)
 
   const handleUpdateSelect = () => {
     const updates = getDesktopUpdates()
@@ -173,34 +138,6 @@ export function SidebarFooter({
     }
   }
 
-  /**
-   * Subscription is dropped for viewers the Billing page would turn away — a
-   * deployment with billing off, or anyone who is not the payer (on an
-   * organization-hosted workspace, every member who is not an org admin). The
-   * settings sidebar hides its own Billing entry on exactly this test.
-   */
-  const menuItems = PROFILE_MENU_ITEMS.filter(
-    (item) =>
-      (item.section !== 'organization' || Boolean(organizationHref)) &&
-      (item.section !== 'billing' ||
-        canViewWorkspaceBillingSettings(hostContext, session?.user?.id))
-  )
-
-  /**
-   * Teammates is a dead end on a plan that cannot invite, so a blocked viewer is
-   * sent to the plan itself instead — which resolves to the upgrade page for
-   * anyone who cannot manage the payer. With billing off there is nowhere to send
-   * them and no upgrade to make, so the row simply does nothing. This is the gate
-   * the workspace switcher's "Manage workspace" entry carried before this menu
-   * took the section over.
-   */
-  const resolveMenuDestination = (section: SettingsSection): SettingsSection | null => {
-    if (section === 'teammates' && isInvitationsDisabled) {
-      return billingEnabled ? 'billing' : null
-    }
-    return section
-  }
-
   /**
    * Built from plain `img`/`div` rather than the emcn `Avatar`, whose Radix root
    * renders a `<span>` — and globals fade every `span` in the collapsed rail to
@@ -276,43 +213,40 @@ export function SidebarFooter({
         </DropdownMenuTrigger>
       </SidebarTooltip>
       <DropdownMenuContent align='start' side='top' sideOffset={4}>
-        {menuItems.map(({ section, label, icon: Icon }) => {
-          if (section === 'organization') {
-            if (!organizationHref) return null
-            return (
-              <DropdownMenuItem key={section} asChild>
-                <SettingsIntentLink href={organizationHref}>
-                  <Icon className='size-[14px]' />
-                  <DropdownMenuItemLabel label={label} />
-                </SettingsIntentLink>
-              </DropdownMenuItem>
-            )
-          }
-          const destination = resolveMenuDestination(section)
-          if (!destination) {
-            return (
-              <DropdownMenuItem key={section}>
-                <Icon className='size-[14px]' />
-                {label}
-              </DropdownMenuItem>
-            )
-          }
-
-          return (
-            <DropdownMenuItem key={section} asChild>
-              <SettingsIntentLink
-                href={getSettingsHref(destination)}
-                onNavigate={(event) => {
-                  event.preventDefault()
-                  onOpenSettings(destination)
-                }}
-              >
-                <Icon className='size-[14px]' />
-                <DropdownMenuItemLabel label={label} />
-              </SettingsIntentLink>
-            </DropdownMenuItem>
-          )
-        })}
+        {[
+          {
+            label: 'Settings',
+            icon: Settings,
+            href: accountSettingsHref,
+            onNavigate: onOpenAccountSettings,
+          },
+          ...navigationLinks,
+        ].map(({ label, icon: Icon, href, onNavigate }) => (
+          <DropdownMenuItem key={href} asChild>
+            <SettingsIntentLink
+              href={href}
+              onNavigate={(event) => {
+                event.preventDefault()
+                useSettingsDirtyStore.getState().requestLeave(onNavigate)
+              }}
+            >
+              <Icon className='size-[14px]' />
+              <DropdownMenuItemLabel label={label} />
+            </SettingsIntentLink>
+          </DropdownMenuItem>
+        ))}
+        {canSignOut && (
+          <DropdownMenuItem
+            onSelect={() => {
+              useSettingsDirtyStore.getState().requestLeave(() => {
+                void signOutAndRedirect(router.push)
+              })
+            }}
+          >
+            <LogOut className='size-[14px]' />
+            Sign out
+          </DropdownMenuItem>
+        )}
       </DropdownMenuContent>
     </DropdownMenu>
   )
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/pending-invitations/view-invitations-menu-item.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/pending-invitations/view-invitations-menu-item.tsx
index c0d1e12e5c2..0983e191dca 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/pending-invitations/view-invitations-menu-item.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/pending-invitations/view-invitations-menu-item.tsx
@@ -1,6 +1,6 @@
 'use client'
 
-import { Chip } from '@sim/emcn'
+import { DropdownMenuItem } from '@sim/emcn'
 import { Mail } from '@sim/emcn/icons'
 import { useMyPendingInvitations } from '@/hooks/queries/invitations'
 
@@ -22,8 +22,9 @@ export function ViewInvitationsMenuItem({ onOpen }: ViewInvitationsMenuItemProps
   }
 
   return (
-    <Chip leftIcon={Mail} onClick={onOpen} fullWidth className='select-none'>
+    <DropdownMenuItem size='lg' onSelect={onOpen}>
+      <Mail className='size-[14px]' />
       View invitations
-    </Chip>
+    </DropdownMenuItem>
   )
 }
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/workspace-header.test.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/workspace-header.test.tsx
index bcef7009e6a..2ba35bebcef 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/workspace-header.test.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/workspace-header.test.tsx
@@ -3,21 +3,37 @@
  */
 import { act } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
+import { renderToString } from 'react-dom/server'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockNavigateToSettings, mockWorkspacePermissions } = vi.hoisted(() => ({
+const { mockNavigateToSettings, mockWorkspacePermissions, hostContext } = vi.hoisted(() => ({
   mockNavigateToSettings: vi.fn(),
+  hostContext: {
+    hostOrganizationId: null as string | null,
+    viewer: { isHostOrganizationMember: false },
+    features: { organizationSearch: false as boolean | undefined },
+  },
   mockWorkspacePermissions: { canAdmin: true, canEdit: true, canRead: true },
 }))
 
+vi.mock('@/app/workspace/[workspaceId]/providers/workspace-host-provider', () => ({
+  useWorkspaceHostContext: () => hostContext,
+}))
+
 const onWorkspaceSwitch = vi.fn()
 
 vi.mock('@tanstack/react-query', () => ({
   useQueryClient: () => ({ invalidateQueries: vi.fn(), setQueryData: vi.fn() }),
 }))
+vi.mock('next/navigation', () => ({
+  useRouter: () => ({ push: vi.fn() }),
+  usePathname: () => '/workspace/ws-emir/home',
+}))
 vi.mock('@/lib/auth/auth-client', () => ({ useActiveOrganization: () => ({ data: null }) }))
 vi.mock('@/hooks/use-settings-navigation', () => ({
-  useSettingsNavigation: () => ({ navigateToSettings: mockNavigateToSettings }),
+  useSettingsNavigation: () => ({
+    navigateToSettings: mockNavigateToSettings,
+  }),
 }))
 vi.mock('@/hooks/use-permission-config', () => ({
   usePermissionConfig: () => ({ isInvitationsDisabled: false }),
@@ -89,31 +105,35 @@ function render(overrides: Partial<Parameters<typeof WorkspaceHeader>[0]> = {})
   document.body.appendChild(container)
   root = createRoot(container)
   act(() => {
-    root.render(
-      <WorkspaceHeader
-        activeWorkspace={{ name: "Emir's Workspace" }}
-        workspaceId='ws-emir'
-        workspaces={WORKSPACES}
-        pinnedWorkspaceIds={NO_PINS}
-        onToggleWorkspacePin={() => {}}
-        isWorkspacesLoading={false}
-        isCreatingWorkspace={false}
-        isWorkspaceMenuOpen
-        setIsWorkspaceMenuOpen={() => {}}
-        onWorkspaceSwitch={onWorkspaceSwitch}
-        onCreateWorkspace={async () => {}}
-        onRenameWorkspace={async () => {}}
-        onDeleteWorkspace={async () => {}}
-        isDeletingWorkspace={false}
-        onUploadLogo={() => {}}
-        onLeaveWorkspace={async () => {}}
-        isLeavingWorkspace={false}
-        {...overrides}
-      />
-    )
+    root.render(header(overrides))
   })
 }
 
+function header(overrides: Partial<Parameters<typeof WorkspaceHeader>[0]> = {}) {
+  return (
+    <WorkspaceHeader
+      activeWorkspace={{ name: "Emir's Workspace" }}
+      workspaceId='ws-emir'
+      workspaces={WORKSPACES}
+      pinnedWorkspaceIds={NO_PINS}
+      onToggleWorkspacePin={() => {}}
+      isWorkspacesLoading={false}
+      isCreatingWorkspace={false}
+      isWorkspaceMenuOpen
+      setIsWorkspaceMenuOpen={() => {}}
+      onWorkspaceSwitch={onWorkspaceSwitch}
+      onCreateWorkspace={async () => {}}
+      onRenameWorkspace={async () => {}}
+      onDeleteWorkspace={async () => {}}
+      isDeletingWorkspace={false}
+      onUploadLogo={() => {}}
+      onLeaveWorkspace={async () => {}}
+      isLeavingWorkspace={false}
+      {...overrides}
+    />
+  )
+}
+
 function row(name: string): HTMLElement {
   const found = [...document.querySelectorAll('[data-workspace-row-idx]')].find((el) =>
     el.textContent?.includes(name)
@@ -150,6 +170,9 @@ function typeInto(input: HTMLInputElement, value: string) {
 
 beforeEach(() => {
   vi.clearAllMocks()
+  hostContext.hostOrganizationId = null
+  hostContext.viewer.isHostOrganizationMember = false
+  hostContext.features.organizationSearch = false
   Object.assign(mockWorkspacePermissions, { canAdmin: true, canEdit: true, canRead: true })
   // jsdom implements neither; the component scrolls the active row into view.
   Element.prototype.scrollIntoView = vi.fn()
@@ -161,6 +184,80 @@ afterEach(() => {
 })
 
 describe('WorkspaceHeader workspace switcher highlight', () => {
+  it.each([false, true])(
+    'renders prefetched workspace identity before hydration (collapsed: %s)',
+    (isCollapsed) => {
+      render({ isWorkspaceMenuOpen: false, isCollapsed })
+      const html = renderToString(header({ isWorkspaceMenuOpen: false, isCollapsed }))
+      expect(html).toContain(isCollapsed ? 'Expand sidebar' : 'Switch workspace')
+      expect(html).not.toContain('animate-pulse')
+    }
+  )
+
+  it.each([5, 6])('only shows search once there are six workspaces: %i', (count) => {
+    render({ workspaces: WORKSPACES.slice(0, count) })
+    expect(Boolean(document.querySelector('input[placeholder="Search workspaces..."]'))).toBe(
+      count === 6
+    )
+  })
+
+  it('handles a no-match query without navigating and restores rows when cleared', () => {
+    render()
+    const search = document.querySelector<HTMLInputElement>(
+      'input[placeholder="Search workspaces..."]'
+    )!
+    act(() => typeInto(search, 'no-such-workspace'))
+    expect(document.querySelectorAll('[data-workspace-row-idx]')).toHaveLength(0)
+    expect(document.body).toHaveTextContent('No results for "no-such-workspace"')
+    act(() => search.dispatchEvent(new KeyboardEvent('keydown', { key: 'Enter', bubbles: true })))
+    expect(onWorkspaceSwitch).not.toHaveBeenCalled()
+
+    act(() => typeInto(search, '  ACME  '))
+    expect(document.querySelectorAll('[data-workspace-row-idx]')).toHaveLength(1)
+    expect(isMarked('Acme')).toBe(true)
+    act(() => typeInto(search, ''))
+    expect(document.querySelectorAll('[data-workspace-row-idx]')).toHaveLength(WORKSPACES.length)
+  })
+
+  it('keeps search focused when the pointer crosses a workspace row', () => {
+    render()
+    const search = document.querySelector<HTMLInputElement>(
+      'input[placeholder="Search workspaces..."]'
+    )!
+    act(() => search.focus())
+    const item = row('RVT').querySelector<HTMLElement>('[role="menuitem"]')!
+    const pointerMove = new MouseEvent('pointermove', { bubbles: true, cancelable: true })
+    Object.defineProperty(pointerMove, 'pointerType', { value: 'mouse' })
+    act(() => item.dispatchEvent(pointerMove))
+    expect(document.activeElement).toBe(search)
+    const pointerOut = new MouseEvent('pointerout', { bubbles: true, cancelable: true })
+    Object.defineProperty(pointerOut, 'pointerType', { value: 'mouse' })
+    act(() => item.dispatchEvent(pointerOut))
+    expect(document.activeElement).toBe(search)
+  })
+
+  it('keeps pinned status available to assistive technology', () => {
+    render({ pinnedWorkspaceIds: new Set(['ws-rvt']) })
+    expect(row('RVT').querySelector('[aria-label="Pinned"]')).toHaveAttribute(
+      'aria-hidden',
+      'false'
+    )
+  })
+
+  it('does not open creation when workspace policy disallows it', () => {
+    const setIsWorkspaceMenuOpen = vi.fn()
+    render({
+      workspaceCreationPolicy: { canCreate: false, reason: 'Organization limit reached' },
+      setIsWorkspaceMenuOpen,
+    })
+    const create = [...document.querySelectorAll<HTMLElement>('[role="menuitem"]')].find(
+      (item) => item.textContent?.trim() === 'New workspace'
+    )!
+    expect(create).toHaveAttribute('aria-disabled', 'true')
+    act(() => create.click())
+    expect(setIsWorkspaceMenuOpen).not.toHaveBeenCalled()
+  })
+
   it.each([
     { role: 'viewer', canAdmin: false, canEdit: false },
     { role: 'editor', canAdmin: false, canEdit: true },
@@ -170,14 +267,33 @@ describe('WorkspaceHeader workspace switcher highlight', () => {
     ({ canAdmin, canEdit }) => {
       Object.assign(mockWorkspacePermissions, { canAdmin, canEdit })
       render()
-      const invite = [...document.querySelectorAll('button')].find(
-        (button) => button.textContent?.trim() === 'Invite teammates'
+      const invite = [...document.querySelectorAll('[role="menuitem"]')].find(
+        (item) => item.textContent?.trim() === 'Invite teammates'
       )
       expect(Boolean(invite)).toBe(canAdmin)
       expect(container.querySelector('button[aria-label="Switch workspace"]')).not.toBeDisabled()
     }
   )
 
+  it('selects a workspace through the menu keyboard interaction', () => {
+    render()
+    const item = row('RVT').querySelector<HTMLElement>('[role="menuitem"]')!
+    act(() => item.dispatchEvent(new KeyboardEvent('keydown', { key: 'Enter', bubbles: true })))
+    expect(onWorkspaceSwitch).toHaveBeenCalledOnce()
+    expect(onWorkspaceSwitch).toHaveBeenCalledWith(WORKSPACES[0])
+  })
+
+  it('opens workspace options without switching workspaces', () => {
+    render()
+    const options = row('RVT').querySelector<HTMLButtonElement>('[aria-label="Workspace options"]')!
+    act(() => {
+      options.dispatchEvent(new MouseEvent('pointerdown', { bubbles: true, button: 0 }))
+      options.click()
+    })
+    expect(onWorkspaceSwitch).not.toHaveBeenCalled()
+    expect(isMarked('RVT')).toBe(true)
+  })
+
   it('shows the route workspace identity while the switcher list is unavailable', () => {
     render({
       activeWorkspace: { name: 'Brightwave' },
@@ -286,3 +402,33 @@ describe('WorkspaceHeader workspace switcher highlight', () => {
     expect(isMarked("Emir's Workspace")).toBe(true)
   })
 })
+
+describe('WorkspaceHeader context navigation', () => {
+  it('links to the current host organization for enrolled members', () => {
+    hostContext.hostOrganizationId = 'host-org'
+    hostContext.viewer.isHostOrganizationMember = true
+    hostContext.features.organizationSearch = true
+    render()
+    expect(document.querySelector('a[href="/o/host-org"]')).toHaveTextContent(
+      'Back to organization'
+    )
+  })
+
+  it.each([
+    { org: null, member: true, enabled: true },
+    { org: 'host-org', member: false, enabled: true },
+    { org: 'host-org', member: true, enabled: false },
+    { org: 'host-org', member: true, enabled: undefined },
+  ])('hides inaccessible organization navigation: %j', ({ org, member, enabled }) => {
+    hostContext.hostOrganizationId = org
+    hostContext.viewer.isHostOrganizationMember = member
+    hostContext.features.organizationSearch = enabled
+    render()
+    expect(document.querySelector('a[href^="/o/"]')).toBeNull()
+  })
+
+  it('keeps settings in the profile menu instead of duplicating it in the switcher', () => {
+    render()
+    expect(document.querySelector('a[href="/workspace/ws-emir/settings/teammates"]')).toBeNull()
+  })
+})
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/workspace-header.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/workspace-header.tsx
index c4bf57a223a..e70913f0ba5 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/workspace-header.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/workspace-header.tsx
@@ -8,15 +8,15 @@ import {
   ChipInput,
   chipContentLabelClass,
   chipGeometryClass,
-  chipVariants,
   cn,
   DropdownMenu,
   DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuItemAction,
+  DropdownMenuItemLabel,
   DropdownMenuSeparator,
   DropdownMenuTrigger,
   OverflowText,
-  Plus,
-  Send,
   Skeleton,
   scrollFadeAttributes,
   scrollFadeClass,
@@ -24,16 +24,19 @@ import {
   toast,
   useScrollEdges,
 } from '@sim/emcn'
-import { MoreHorizontal, PanelLeft, Pin, Search } from '@sim/emcn/icons'
+import { ArrowLeft, MoreHorizontal, PanelLeft, Pin, Plus, Search, Send } from '@sim/emcn/icons'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { useQueryClient } from '@tanstack/react-query'
 import { IdentityTile } from '@/components/identity-tile/identity-tile'
+import { SettingsGuardedLink } from '@/components/settings/settings-guarded-link'
 import { WorkspaceContextMenu } from '@/components/workspaces/workspace-context-menu'
 import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
 import { WORKSPACE_SEARCH_THRESHOLD } from '@/lib/workspaces/constants'
 import { getWorkspaceInitial } from '@/lib/workspaces/initials'
+import { getWorkspaceOrganizationHref } from '@/lib/workspaces/organization-navigation'
 import { InviteModal } from '@/app/workspace/[workspaceId]/components/invite-modal'
+import { useWorkspaceHostContext } from '@/app/workspace/[workspaceId]/providers/workspace-host-provider'
 import { useWorkspacePermissionsContext } from '@/app/workspace/[workspaceId]/providers/workspace-permissions-provider'
 import { SidebarRenameRow } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/sidebar-rename-row'
 import { DeleteModal } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/workflow-list/components/delete-modal/delete-modal'
@@ -65,7 +68,9 @@ function DisabledReasonTooltip({ reason, children }: DisabledReasonTooltipProps)
   if (!reason) return children
   return (
     <Tooltip.Root>
-      <Tooltip.Trigger asChild>{children}</Tooltip.Trigger>
+      <Tooltip.Trigger asChild>
+        <div>{children}</div>
+      </Tooltip.Trigger>
       <Tooltip.Content>
         <p>{reason}</p>
       </Tooltip.Content>
@@ -177,6 +182,9 @@ function WorkspaceHeaderImpl({
   const hasInputFocusedRef = useRef(false)
   const renameInputRef = useRef<HTMLInputElement | null>(null)
   const searchInputRef = useRef<HTMLInputElement>(null)
+  const preserveSearchFocus = (event: React.PointerEvent<HTMLDivElement>) => {
+    if (searchInputRef.current === document.activeElement) event.preventDefault()
+  }
   const workspaceListRef = useRef<HTMLDivElement>(null)
   /**
    * Held in state as well as the ref: the list lives in the menu's portal, which
@@ -263,13 +271,10 @@ function WorkspaceHeaderImpl({
     setIsKeyboardNav(false)
   }, [isWorkspaceMenuOpen])
 
-  const [isMounted, setIsMounted] = useState(false)
-  useEffect(() => {
-    setIsMounted(true)
-  }, [])
-
   const { navigateToSettings } = useSettingsNavigation()
   const queryClient = useQueryClient()
+  const hostContext = useWorkspaceHostContext()
+  const organizationHref = getWorkspaceOrganizationHref(hostContext)
 
   const activeWorkspaceFull = workspaces.find((w) => w.id === workspaceId) || null
   const isWorkspaceReady = !isWorkspacesLoading && activeWorkspaceFull !== null
@@ -443,7 +448,7 @@ function WorkspaceHeaderImpl({
 
   return (
     <div className='min-w-0 flex-1'>
-      {isMounted && isCollapsed ? (
+      {isCollapsed ? (
         <Chip
           aria-label='Expand sidebar'
           onClick={onExpandSidebar}
@@ -470,7 +475,7 @@ function WorkspaceHeaderImpl({
             </div>
           }
         />
-      ) : isMounted && isWorkspaceReady ? (
+      ) : isWorkspaceReady ? (
         <DropdownMenu
           open={isWorkspaceMenuOpen}
           onOpenChange={(open) => {
@@ -525,6 +530,17 @@ function WorkspaceHeaderImpl({
                screen with nothing able to scroll to them. */
             className='flex max-h-[var(--radix-dropdown-menu-content-available-height,400px)] w-64 max-w-[calc(100vw-24px)] flex-col overflow-y-auto'
           >
+            {organizationHref && (
+              <>
+                <DropdownMenuItem size='lg' className='shrink-0' asChild>
+                  <SettingsGuardedLink href={organizationHref}>
+                    <ArrowLeft className='size-[14px]' />
+                    Back to organization
+                  </SettingsGuardedLink>
+                </DropdownMenuItem>
+                <DropdownMenuSeparator className='shrink-0' />
+              </>
+            )}
             {isWorkspacesLoading ? (
               <div className='px-2 py-[5px] text-[var(--text-secondary)] text-caption'>
                 Loading workspaces...
@@ -534,6 +550,7 @@ function WorkspaceHeaderImpl({
                 {showSearch && (
                   <ChipInput
                     ref={searchInputRef}
+                    className='shrink-0'
                     icon={Search}
                     placeholder='Search workspaces...'
                     value={workspaceSearch}
@@ -617,6 +634,7 @@ function WorkspaceHeaderImpl({
                       >
                         {editingWorkspaceId === workspace.id ? (
                           <SidebarRenameRow
+                            aria-label={`Rename workspace ${workspace.name}`}
                             leadingAdornment={
                               <IdentityTile
                                 initial={initial}
@@ -665,14 +683,36 @@ function WorkspaceHeaderImpl({
                             disabled={isListRenaming}
                           />
                         ) : (
-                          <div
-                            className={cn(
-                              chipVariants({
-                                active: isActive || isMenuOpen || isKeyboardHighlighted,
-                                fullWidth: true,
-                              }),
-                              'select-none'
-                            )}
+                          <DropdownMenuItem
+                            size='lg'
+                            active={isActive || isMenuOpen || isKeyboardHighlighted}
+                            onSelect={(event) => event.preventDefault()}
+                            onPointerMove={preserveSearchFocus}
+                            onPointerLeave={preserveSearchFocus}
+                            actionIndicator={
+                              pinnedWorkspaceIds.has(workspace.id) ? (
+                                <Pin
+                                  aria-hidden={false}
+                                  role='img'
+                                  aria-label='Pinned'
+                                  className='size-[12px] text-[var(--text-icon)]'
+                                />
+                              ) : undefined
+                            }
+                            action={
+                              <DropdownMenuItemAction
+                                aria-label='Workspace options'
+                                onPointerDown={() => {
+                                  isContextMenuOpeningRef.current = true
+                                }}
+                                onClick={(event) => {
+                                  const rect = event.currentTarget.getBoundingClientRect()
+                                  openContextMenuAt(workspace, rect.right, rect.top)
+                                }}
+                              >
+                                <MoreHorizontal />
+                              </DropdownMenuItemAction>
+                            }
                             onClick={(e) => {
                               if (e.metaKey || e.ctrlKey) {
                                 window.open(`/workspace/${workspace.id}`, '_blank')
@@ -693,81 +733,39 @@ function WorkspaceHeaderImpl({
                               logoUrl={workspace.logoUrl}
                               alt={workspace.name || 'Workspace logo'}
                             />
-                            <OverflowText
-                              label={workspace.name}
-                              className='flex-1 text-[var(--text-body)] text-sm'
-                            />
-                            {/* Pin and options share one fixed slot, as the chat rows do:
-                                the trailing width never changes, so pinning cannot re-truncate
-                                the name under the user's cursor. */}
-                            <div className='relative flex size-[18px] shrink-0 items-center justify-center'>
-                              {pinnedWorkspaceIds.has(workspace.id) && (
-                                <Pin
-                                  aria-hidden={false}
-                                  role='img'
-                                  aria-label='Pinned'
-                                  className={cn(
-                                    'absolute size-[12px] text-[var(--text-icon)] transition-opacity',
-                                    isMenuOpen ? 'opacity-0' : 'group-hover:opacity-0'
-                                  )}
-                                />
-                              )}
-                              <button
-                                type='button'
-                                aria-label='Workspace options'
-                                onMouseDown={() => {
-                                  isContextMenuOpeningRef.current = true
-                                }}
-                                onClick={(e) => {
-                                  e.preventDefault()
-                                  e.stopPropagation()
-                                  const rect = e.currentTarget.getBoundingClientRect()
-                                  openContextMenuAt(workspace, rect.right, rect.top)
-                                }}
-                                className={cn(
-                                  'absolute inset-0 flex items-center justify-center rounded-sm opacity-0 transition-opacity group-hover:opacity-100',
-                                  isMenuOpen && 'opacity-100'
-                                )}
-                              >
-                                <MoreHorizontal className='size-[14px] text-[var(--text-icon)]' />
-                              </button>
-                            </div>
-                          </div>
+                            <DropdownMenuItemLabel label={workspace.name} />
+                          </DropdownMenuItem>
                         )}
                       </div>
                     )
                   })}
                 </div>
 
-                <DropdownMenuSeparator className='mx-0 mt-0' />
+                <DropdownMenuSeparator className='mx-0 mt-0 shrink-0' />
 
-                <div className='flex flex-col gap-0.5'>
+                <div className='flex shrink-0 flex-col gap-0.5'>
                   <DisabledReasonTooltip reason={createWorkspaceDisabledReason}>
-                    <Chip
-                      leftIcon={Plus}
-                      onClick={(e) => {
-                        e.stopPropagation()
-                        if (!canCreateWorkspace) return
+                    <DropdownMenuItem
+                      size='lg'
+                      onSelect={(event) => {
+                        if (!canCreateWorkspace) {
+                          event.preventDefault()
+                          return
+                        }
                         setIsWorkspaceMenuOpen(false)
                         setIsCreateModalOpen(true)
                       }}
-                      disabled={isCreatingWorkspace}
-                      aria-disabled={!canCreateWorkspace || undefined}
-                      fullWidth
-                      className={cn(
-                        'select-none',
-                        !canCreateWorkspace &&
-                          'cursor-not-allowed opacity-60 hover-hover:bg-transparent'
-                      )}
+                      disabled={isCreatingWorkspace || !canCreateWorkspace}
                     >
+                      <Plus className='size-[14px]' />
                       New workspace
-                    </Chip>
+                    </DropdownMenuItem>
                   </DisabledReasonTooltip>
                   {userPermissions.canAdmin && (
                     <DisabledReasonTooltip reason={inviteDisabledReason}>
-                      <Chip
-                        leftIcon={Send}
-                        onClick={() => {
+                      <DropdownMenuItem
+                        size='lg'
+                        onSelect={() => {
                           setIsWorkspaceMenuOpen(false)
                           if (isInvitationsDisabled) {
                             if (billingEnabled) navigateToSettings({ section: 'billing' })
@@ -775,11 +773,10 @@ function WorkspaceHeaderImpl({
                           }
                           setIsInviteModalOpen(true)
                         }}
-                        fullWidth
-                        className='select-none'
                       >
+                        <Send className='size-[14px]' />
                         Invite teammates
-                      </Chip>
+                      </DropdownMenuItem>
                     </DisabledReasonTooltip>
                   )}
                   <ViewInvitationsMenuItem
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/sidebar.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/sidebar.tsx
index 878f915a1b1..dc76a2fa158 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/sidebar.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/sidebar.tsx
@@ -23,6 +23,7 @@ import {
   useScrollEdges,
 } from '@sim/emcn'
 import {
+  Building,
   Database,
   Files,
   Integration,
@@ -39,6 +40,7 @@ import { createLogger } from '@sim/logger'
 import { useParams, usePathname, useRouter } from 'next/navigation'
 import { usePostHog } from 'posthog-js/react'
 import { useSession } from '@/lib/auth/auth-client'
+import { canViewWorkspaceBillingSettings } from '@/lib/billing/workspace-permissions'
 import { focusVisibleBrowserOmnibox } from '@/lib/browser-agent/renderer-shortcuts'
 import { SIM_RESOURCES_DRAG_TYPE } from '@/lib/copilot/resource-types'
 import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
@@ -48,12 +50,16 @@ import { buildFolderTree, getFolderPathNames } from '@/lib/folders/tree'
 import { DOCS_URL, SLACK_COMMUNITY_URL } from '@/lib/help-links'
 import { captureEvent } from '@/lib/posthog/client'
 import { LOGO_ACCEPT_ATTRIBUTE } from '@/lib/uploads/client/logo-file'
+import { getWorkspaceOrganizationHref } from '@/lib/workspaces/organization-navigation'
 import { useSidebarChrome } from '@/app/workspace/[workspaceId]/components/workspace-chrome'
 import { CONNECT_MODE } from '@/app/workspace/[workspaceId]/integrations/connect-route'
 import { useRegisterGlobalCommands } from '@/app/workspace/[workspaceId]/providers/global-commands-provider'
 import { useWorkspaceHostContext } from '@/app/workspace/[workspaceId]/providers/workspace-host-provider'
 import { useUserPermissionsContext } from '@/app/workspace/[workspaceId]/providers/workspace-permissions-provider'
-import type { SettingsSection } from '@/app/workspace/[workspaceId]/settings/navigation'
+import {
+  allNavigationItems,
+  type SettingsSection,
+} from '@/app/workspace/[workspaceId]/settings/navigation'
 import { createCommands } from '@/app/workspace/[workspaceId]/utils/commands-utils'
 import {
   ChatNavigationLink,
@@ -124,6 +130,7 @@ import {
   useRenameMothershipChat,
   useSetMothershipChatPinned,
 } from '@/hooks/queries/mothership-chats'
+import { useUserProfile } from '@/hooks/queries/user-profile'
 import { useUpdateWorkflow } from '@/hooks/queries/workflows'
 import type { Workspace } from '@/hooks/queries/workspace'
 import { useContextMenu } from '@/hooks/use-context-menu'
@@ -375,7 +382,9 @@ export const Sidebar = memo(function Sidebar() {
 
   const posthog = usePostHog()
   const { data: sessionData, isPending: sessionLoading } = useSession()
-  const { workspace: routeWorkspace } = useWorkspaceHostContext()
+  const { data: profile } = useUserProfile()
+  const hostContext = useWorkspaceHostContext()
+  const { workspace: routeWorkspace } = hostContext
   const { hosted, chatEnabled } = useDeploymentShape()
   const { canAdmin, canEdit, isLoading: permissionsLoading } = useUserPermissionsContext()
   const {
@@ -747,12 +756,7 @@ export const Sidebar = memo(function Sidebar() {
           label: 'Integrations',
           icon: Integration,
           href: `/workspace/${workspaceId}/integrations`,
-          /* Skills and Search are tabs of this surface, not their own nav items —
-             keep the entry lit while the user is on either. */
-          additionalActivePaths: [
-            `/workspace/${workspaceId}/skills`,
-            `/workspace/${workspaceId}/search`,
-          ],
+          additionalActivePaths: [`/workspace/${workspaceId}/skills`],
           hidden: permissionConfig.hideIntegrationsTab,
         },
       ].filter((item) => !item.hidden),
@@ -825,6 +829,30 @@ export const Sidebar = memo(function Sidebar() {
     navigateToSettings({ section })
   }
 
+  const profileNavigationLinks = allNavigationItems
+    .filter(
+      ({ id }) =>
+        id === 'teammates' ||
+        id === 'recently-deleted' ||
+        (id === 'billing' && canViewWorkspaceBillingSettings(hostContext, profile?.id))
+    )
+    .map(({ id, label, icon }) => ({
+      label,
+      icon,
+      href: getSettingsHref({ section: id }),
+      onNavigate: () => handleOpenSettings(id),
+    }))
+
+  const organizationHref = getWorkspaceOrganizationHref(hostContext)
+  if (organizationHref) {
+    profileNavigationLinks.push({
+      label: 'Organization',
+      icon: Building,
+      href: organizationHref,
+      onNavigate: () => router.push(organizationHref),
+    })
+  }
+
   const { data: fetchedChats = EMPTY_CHATS, isLoading: chatsLoading } = useMothershipChats(
     workspaceId,
     { enabled: chatEnabled }
@@ -1764,12 +1792,12 @@ export const Sidebar = memo(function Sidebar() {
                 ) : null}
 
                 <SidebarFooter
-                  workspaceId={workspaceId}
                   showDivider={scrollEdges.bottom}
                   isCollapsed={isCollapsed}
                   showCollapsedTooltips={showCollapsedTooltips}
-                  getSettingsHref={(section) => getSettingsHref({ section })}
-                  onOpenSettings={handleOpenSettings}
+                  accountSettingsHref={getSettingsHref({ section: 'general' })}
+                  onOpenAccountSettings={() => handleOpenSettings('general')}
+                  navigationLinks={profileNavigationLinks}
                   onOpenDocs={handleOpenDocs}
                   onJoinSlack={handleOpenSlackCommunity}
                   onContactSupport={handleOpenHelpFromMenu}
diff --git a/apps/sim/app/workspace/[workspaceId]/w/hooks/use-import-workflow.ts b/apps/sim/app/workspace/[workspaceId]/w/hooks/use-import-workflow.ts
index a8f164ed9a7..63074d750f2 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/hooks/use-import-workflow.ts
+++ b/apps/sim/app/workspace/[workspaceId]/w/hooks/use-import-workflow.ts
@@ -1,5 +1,7 @@
 import { useCallback, useRef, useState } from 'react'
+import { toast } from '@sim/emcn'
 import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
 import { useQueryClient } from '@tanstack/react-query'
 import { useRouter } from 'next/navigation'
 import { usePostHog } from 'posthog-js/react'
@@ -34,9 +36,9 @@ interface UseImportWorkflowProps {
  */
 export function useImportWorkflow({ workspaceId }: UseImportWorkflowProps) {
   const router = useRouter()
-  const createWorkflowMutation = useCreateWorkflow()
+  const { mutateAsync: createWorkflow } = useCreateWorkflow()
   const queryClient = useQueryClient()
-  const createFolderMutation = useCreateFolder()
+  const { mutateAsync: createFolder } = useCreateFolder()
   const clearDiff = useWorkflowDiffStore((state) => state.clearDiff)
   const posthog = usePostHog()
   const posthogRef = useRef(posthog)
@@ -56,7 +58,7 @@ export function useImportWorkflow({ workspaceId }: UseImportWorkflowProps) {
         folderId,
         sortOrder,
         createWorkflow: async ({ name, description, workspaceId, folderId, sortOrder }) =>
-          createWorkflowMutation.mutateAsync({
+          createWorkflow({
             name,
             description,
             workspaceId,
@@ -66,9 +68,13 @@ export function useImportWorkflow({ workspaceId }: UseImportWorkflowProps) {
           }),
       })
 
-      return result?.workflowId ?? null
+      if (!result) {
+        throw new Error('The file does not contain valid workflow JSON.')
+      }
+
+      return result.workflowId
     },
-    [clearDiff, createWorkflowMutation, workspaceId]
+    [clearDiff, createWorkflow, workspaceId]
   )
 
   /**
@@ -89,10 +95,16 @@ export function useImportWorkflow({ workspaceId }: UseImportWorkflowProps) {
 
         if (hasZip && fileArray.length === 1) {
           const zipFile = fileArray[0]
-          const { workflows: extractedWorkflows, metadata } = await extractWorkflowsFromZip(zipFile)
+          const { workflows: extractedWorkflows, metadata } = await extractWorkflowsFromZip(
+            zipFile
+          ).catch((error: unknown) => {
+            throw new Error('Failed to import ZIP file. Check that it is a valid ZIP archive.', {
+              cause: error,
+            })
+          })
 
           const folderName = metadata?.workspaceName || zipFile.name.replace(/\.zip$/i, '')
-          const importFolder = await createFolderMutation.mutateAsync({
+          const importFolder = await createFolder({
             name: folderName,
             workspaceId,
           })
@@ -131,7 +143,7 @@ export function useImportWorkflow({ workspaceId }: UseImportWorkflowProps) {
                 parentId = await createFolderRecursive(foldersById.get(folder.parentId)!)
               }
 
-              const newFolder = await createFolderMutation.mutateAsync({
+              const newFolder = await createFolder({
                 name: folder.name,
                 workspaceId,
                 parentId,
@@ -163,7 +175,7 @@ export function useImportWorkflow({ workspaceId }: UseImportWorkflowProps) {
                     const folderNameForSegment = workflow.folderPath[i]
 
                     if (!folderMap.has(pathSegment)) {
-                      const subFolder = await createFolderMutation.mutateAsync({
+                      const subFolder = await createFolder({
                         name: folderNameForSegment,
                         workspaceId,
                         parentId,
@@ -187,6 +199,9 @@ export function useImportWorkflow({ workspaceId }: UseImportWorkflowProps) {
               if (workflowId) importedWorkflowIds.push(workflowId)
             } catch (error) {
               logger.error(`Failed to import ${workflow.name}:`, error)
+              toast.error(`Failed to import ${workflow.name}`, {
+                description: getErrorMessage(error, 'Workflow import failed'),
+              })
             }
           }
         } else if (jsonFiles.length > 0) {
@@ -198,6 +213,9 @@ export function useImportWorkflow({ workspaceId }: UseImportWorkflowProps) {
               if (workflowId) importedWorkflowIds.push(workflowId)
             } catch (error) {
               logger.error(`Failed to import ${workflow.name}:`, error)
+              toast.error(`Failed to import ${workflow.name}`, {
+                description: getErrorMessage(error, 'Workflow import failed'),
+              })
             }
           }
         }
@@ -219,6 +237,7 @@ export function useImportWorkflow({ workspaceId }: UseImportWorkflowProps) {
         }
       } catch (error) {
         logger.error('Failed to import workflows:', error)
+        toast.error(getErrorMessage(error, 'Failed to import workflows'))
       } finally {
         setIsImporting(false)
 
@@ -227,7 +246,7 @@ export function useImportWorkflow({ workspaceId }: UseImportWorkflowProps) {
         }
       }
     },
-    [importSingleWorkflow, workspaceId, router, createFolderMutation, queryClient]
+    [importSingleWorkflow, workspaceId, router, createFolder, queryClient]
   )
 
   return {
diff --git a/apps/sim/background/enrichment-capability-subject.test.ts b/apps/sim/background/enrichment-capability-subject.test.ts
index 1f5361549a4..a89951e86fd 100644
--- a/apps/sim/background/enrichment-capability-subject.test.ts
+++ b/apps/sim/background/enrichment-capability-subject.test.ts
@@ -5,6 +5,10 @@ import { resetDbChainMock } from '@sim/testing'
 import { beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
+  loadWorkspaceApplicationContext: vi.fn(),
+  resolveOutboundRoute: vi.fn(async (_organizationId: string | null | undefined) => ({
+    kind: 'direct',
+  })),
   getTableById: vi.fn(),
   getRowById: vi.fn(),
   updateRow: vi.fn(),
@@ -22,6 +26,14 @@ const mocks = vi.hoisted(() => ({
   loadTableRowSecretProvenance: vi.fn(async () => ({ scope: null, entries: [] })),
 }))
 
+vi.mock('@/lib/core/network/config.server', () => ({
+  isOutboundRoutingEnabled: () => true,
+  resolveOutboundRoute: mocks.resolveOutboundRoute,
+}))
+vi.mock('@/lib/workspaces/application/workspace-context', () => ({
+  loadWorkspaceApplicationContext: mocks.loadWorkspaceApplicationContext,
+}))
+
 vi.mock('@/lib/table/service', () => ({ getTableById: mocks.getTableById }))
 vi.mock('@/lib/table/rows/service', () => ({
   getRowById: mocks.getRowById,
@@ -69,6 +81,7 @@ vi.mock('@/lib/core/rate-limiter/rate-limiter', () => ({
   },
 }))
 
+import { resolveCurrentOutboundRoute } from '@/lib/core/network/context.server'
 import { runRowCascadeLoop } from '@/background/workflow-column-execution'
 
 const GROUP = {
@@ -143,6 +156,7 @@ describe('enrichment cell capability subject', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     resetDbChainMock()
+    mocks.loadWorkspaceApplicationContext.mockResolvedValue({ workspaceOrganizationId: null })
     mocks.getTableById.mockResolvedValue(TABLE)
     mocks.getRowById.mockResolvedValue({
       id: 'row-1',
@@ -162,6 +176,24 @@ describe('enrichment cell capability subject', () => {
     mocks.runEnrichment.mockResolvedValue({ result: {}, cost: 0, detail: {} })
   })
 
+  it.each(['org_reserved', 'org_other', null])(
+    'restores the current workspace owner %s before running a queued enrichment',
+    async (organizationId) => {
+      mocks.loadWorkspaceApplicationContext.mockResolvedValue({
+        workspaceOrganizationId: organizationId,
+      })
+      mocks.runEnrichment.mockImplementationOnce(async () => {
+        await resolveCurrentOutboundRoute()
+        return { result: {}, cost: 0, detail: {} }
+      })
+
+      await runRowCascadeLoop(payload(null, 'billing-owner') as never)
+
+      expect(mocks.resolveOutboundRoute).toHaveBeenCalledExactlyOnceWith(organizationId)
+      expect(mocks.loadWorkspaceApplicationContext).toHaveBeenCalledWith('workspace-1', {})
+    }
+  )
+
   /**
    * A workspace-key write is actorless: nobody's permission group governs it,
    * and the billing owner beside it on the payload is a bystander. Handing that
diff --git a/apps/sim/background/webhook-execution.test.ts b/apps/sim/background/webhook-execution.test.ts
index 9fc447461f9..ec5340c21af 100644
--- a/apps/sim/background/webhook-execution.test.ts
+++ b/apps/sim/background/webhook-execution.test.ts
@@ -19,6 +19,7 @@ import {
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
+  mockWithResourceOutboundScope,
   mockResolveWebhookRecordProviderConfig,
   mockExecuteWorkflowCore,
   mockWasExecutionFinalizedByCore,
@@ -32,6 +33,7 @@ const {
 } = vi.hoisted(() => {
   const mockEnqueue = vi.fn()
   return {
+    mockWithResourceOutboundScope: vi.fn(),
     mockResolveWebhookRecordProviderConfig: vi.fn(),
     mockExecuteWorkflowCore: vi.fn(),
     mockWasExecutionFinalizedByCore: vi.fn(),
@@ -62,6 +64,10 @@ const mockGetExecutionEnvironment = environmentUtilsMockFns.mockGetExecutionEnvi
 
 afterAll(resetEnvironmentUtilsMock)
 
+vi.mock('@/lib/core/network/resource-scope.server', () => ({
+  withResourceOutboundScope: mockWithResourceOutboundScope,
+}))
+
 vi.mock('@/lib/execution/preprocessing', () => executionPreprocessingMock)
 vi.mock('@/lib/logs/execution/logging-session', () => loggingSessionMock)
 
@@ -285,6 +291,7 @@ describe('executeWebhookJob fault vs error handling', () => {
         projectDiagnosticError: loggingSessionMockFns.mockProjectDiagnosticError,
       }
     })
+    mockWithResourceOutboundScope.mockReset().mockImplementation((_owner, run) => run())
     mockRefreshExecutionSlotExpiry.mockReset().mockResolvedValue(true)
     mockReleaseExecutionSlot.mockReset().mockResolvedValue(undefined)
     mockGetProviderHandler.mockReturnValue({})
@@ -856,6 +863,19 @@ describe('executeWebhookJob fault vs error handling', () => {
     expect(mockExecuteWorkflowCore).not.toHaveBeenCalled()
   })
 
+  it('requeues transient organization ownership failures before any workflow block starts', async () => {
+    mockWithResourceOutboundScope.mockRejectedValueOnce(
+      Object.assign(new Error('Connection terminated unexpectedly'), { code: 'ECONNRESET' })
+    )
+
+    await expect(executeWebhookJob(payload)).resolves.toMatchObject({
+      requeued: true,
+    })
+    expect(mockExecuteWorkflowCore).not.toHaveBeenCalled()
+    expect(mockEnqueue).toHaveBeenCalledOnce()
+    expect(loggingSessionMockFns.mockSafeCompleteWithError).not.toHaveBeenCalled()
+  })
+
   it('requeues on retryable infrastructure errors thrown by setup reads', async () => {
     dbChainMockFns.limit.mockRejectedValueOnce(
       Object.assign(new Error('write CONNECT_TIMEOUT'), { code: 'CONNECT_TIMEOUT' })
diff --git a/apps/sim/background/webhook-execution.ts b/apps/sim/background/webhook-execution.ts
index 6ebcac7d17a..5240bc500c9 100644
--- a/apps/sim/background/webhook-execution.ts
+++ b/apps/sim/background/webhook-execution.ts
@@ -45,6 +45,7 @@ import {
   WEBHOOK_IN_PROGRESS_LEASE_SECONDS,
   webhookIdempotency,
 } from '@/lib/core/idempotency'
+import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import {
   type EnvironmentResolutionSnapshot,
   getEffectiveEnvironmentSnapshot,
@@ -831,348 +832,350 @@ async function executeWebhookJobInternal(
   let workflowCoreStarted = false
 
   try {
-    const workflowStatePromise = payload.deploymentVersionId
-      ? loadWorkflowDeploymentVersionState(
-          payload.workflowId,
-          payload.deploymentVersionId,
-          workspaceId
+    return await withResourceOutboundScope({ workspaceId }, async () => {
+      const workflowStatePromise = payload.deploymentVersionId
+        ? loadWorkflowDeploymentVersionState(
+            payload.workflowId,
+            payload.deploymentVersionId,
+            workspaceId
+          )
+        : loadDeployedWorkflowState(payload.workflowId, workspaceId)
+      const [workflowData, webhookRows, resolvedCredentialUserId] = await Promise.all([
+        workflowStatePromise,
+        db.select().from(webhook).where(eq(webhook.id, payload.webhookId)).limit(1),
+        payload.credentialId
+          ? resolveCredentialAccountUserId(payload.credentialId)
+          : Promise.resolve(undefined),
+      ])
+      const credentialAccountUserId = resolvedCredentialUserId
+      if (payload.credentialId && !credentialAccountUserId) {
+        logger.warn(
+          `[${requestId}] Failed to resolve credential account for credential ${payload.credentialId}`
         )
-      : loadDeployedWorkflowState(payload.workflowId, workspaceId)
-    const [workflowData, webhookRows, resolvedCredentialUserId] = await Promise.all([
-      workflowStatePromise,
-      db.select().from(webhook).where(eq(webhook.id, payload.webhookId)).limit(1),
-      payload.credentialId
-        ? resolveCredentialAccountUserId(payload.credentialId)
-        : Promise.resolve(undefined),
-    ])
-    const credentialAccountUserId = resolvedCredentialUserId
-    if (payload.credentialId && !credentialAccountUserId) {
-      logger.warn(
-        `[${requestId}] Failed to resolve credential account for credential ${payload.credentialId}`
-      )
-    }
-
-    if (!workflowData) {
-      throw new Error(
-        'Workflow state not found. The workflow may not be deployed or the deployment data may be corrupted.'
-      )
-    }
+      }
 
-    const { blocks, edges, loops, parallels } = workflowData
-    deploymentVersionId =
-      'deploymentVersionId' in workflowData
-        ? (workflowData.deploymentVersionId as string)
-        : undefined
+      if (!workflowData) {
+        throw new Error(
+          'Workflow state not found. The workflow may not be deployed or the deployment data may be corrupted.'
+        )
+      }
 
-    const handler = getProviderHandler(payload.provider)
+      const { blocks, edges, loops, parallels } = workflowData
+      deploymentVersionId =
+        'deploymentVersionId' in workflowData
+          ? (workflowData.deploymentVersionId as string)
+          : undefined
 
-    let input: Record<string, unknown> | null = null
-    let skipMessage: string | undefined
+      const handler = getProviderHandler(payload.provider)
 
-    const webhookRecord = webhookRows[0]
-    if (!webhookRecord) {
-      throw new Error(`Webhook record not found: ${payload.webhookId}`)
-    }
+      let input: Record<string, unknown> | null = null
+      let skipMessage: string | undefined
 
-    const secretScope = { userId: workflowRecord.userId, workspaceId }
-    let resolvedSecretTraceRegistry = createIncompleteResolvedSecretTraceRegistry(secretScope)
-    const resolvedWebhookRecord = await resolveWebhookExecutionProviderConfig(
-      webhookRecord,
-      payload.provider,
-      workflowRecord.userId,
-      workspaceId,
-      {
-        /**
-         * The identity preprocessing already elected for this run, so the
-         * provider config resolves against exactly the workspace variables the
-         * run's own blocks will see rather than against a second, narrower
-         * selection derived from the workflow owner.
-         */
-        actorUserId,
-        onEnvironmentSnapshot: async (secretEnvironment) => {
-          try {
-            resolvedSecretTraceRegistry = await createResolvedSecretTraceRegistry({
-              personalEncrypted: secretEnvironment.personalEncrypted,
-              workspaceEncrypted: secretEnvironment.workspaceEncrypted,
-              personalDecrypted: secretEnvironment.personalDecrypted,
-              workspaceDecrypted: secretEnvironment.workspaceDecrypted,
-              decryptionFailures: secretEnvironment.decryptionFailures,
-              personalOwners: secretEnvironment.personalOwners,
-              workspaceUnredactedKeys: secretEnvironment.workspaceUnredactedKeys,
-              scope: secretScope,
-            })
-          } catch (error) {
-            logger.warn(
-              `[${requestId}] Failed to build webhook trace secret catalog`,
-              loggingSession.projectDiagnosticError(error)
-            )
-            resolvedSecretTraceRegistry = createIncompleteResolvedSecretTraceRegistry(secretScope)
-          }
-          loggingSession.setResolvedSecretTraceRegistry(resolvedSecretTraceRegistry)
-        },
-        onResolved: (name, value) => {
-          resolvedSecretTraceRegistry.recordResolved(name, value)
-        },
+      const webhookRecord = webhookRows[0]
+      if (!webhookRecord) {
+        throw new Error(`Webhook record not found: ${payload.webhookId}`)
       }
-    )
 
-    if (handler.formatInput) {
-      const result = await handler.formatInput({
-        webhook: resolvedWebhookRecord,
-        workflow: { id: payload.workflowId, userId: payload.userId },
-        body: payload.body,
-        headers: payload.headers,
-        query: payload.query ?? {},
-        method: payload.method ?? '',
-        requestId,
-      })
-      input = result.input as Record<string, unknown> | null
-      skipMessage = result.skip?.message
-    } else {
-      input = payload.body as Record<string, unknown> | null
-    }
+      const secretScope = { userId: workflowRecord.userId, workspaceId }
+      let resolvedSecretTraceRegistry = createIncompleteResolvedSecretTraceRegistry(secretScope)
+      const resolvedWebhookRecord = await resolveWebhookExecutionProviderConfig(
+        webhookRecord,
+        payload.provider,
+        workflowRecord.userId,
+        workspaceId,
+        {
+          /**
+           * The identity preprocessing already elected for this run, so the
+           * provider config resolves against exactly the workspace variables the
+           * run's own blocks will see rather than against a second, narrower
+           * selection derived from the workflow owner.
+           */
+          actorUserId,
+          onEnvironmentSnapshot: async (secretEnvironment) => {
+            try {
+              resolvedSecretTraceRegistry = await createResolvedSecretTraceRegistry({
+                personalEncrypted: secretEnvironment.personalEncrypted,
+                workspaceEncrypted: secretEnvironment.workspaceEncrypted,
+                personalDecrypted: secretEnvironment.personalDecrypted,
+                workspaceDecrypted: secretEnvironment.workspaceDecrypted,
+                decryptionFailures: secretEnvironment.decryptionFailures,
+                personalOwners: secretEnvironment.personalOwners,
+                workspaceUnredactedKeys: secretEnvironment.workspaceUnredactedKeys,
+                scope: secretScope,
+              })
+            } catch (error) {
+              logger.warn(
+                `[${requestId}] Failed to build webhook trace secret catalog`,
+                loggingSession.projectDiagnosticError(error)
+              )
+              resolvedSecretTraceRegistry = createIncompleteResolvedSecretTraceRegistry(secretScope)
+            }
+            loggingSession.setResolvedSecretTraceRegistry(resolvedSecretTraceRegistry)
+          },
+          onResolved: (name, value) => {
+            resolvedSecretTraceRegistry.recordResolved(name, value)
+          },
+        }
+      )
 
-    if (!input && handler.handleEmptyInput) {
-      const skipResult = handler.handleEmptyInput(requestId)
-      if (skipResult) {
-        skipMessage = skipResult.message
+      if (handler.formatInput) {
+        const result = await handler.formatInput({
+          webhook: resolvedWebhookRecord,
+          workflow: { id: payload.workflowId, userId: payload.userId },
+          body: payload.body,
+          headers: payload.headers,
+          query: payload.query ?? {},
+          method: payload.method ?? '',
+          requestId,
+        })
+        input = result.input as Record<string, unknown> | null
+        skipMessage = result.skip?.message
+      } else {
+        input = payload.body as Record<string, unknown> | null
       }
-    }
 
-    if (skipMessage) {
-      await loggingSession.safeStart({
-        userId: actorUserId,
-        actorUserId,
-        billingAttribution,
-        workspaceId,
-        variables: {},
-        triggerData: {
-          isTest: false,
-          correlation,
-        },
-        deploymentVersionId,
-      })
+      if (!input && handler.handleEmptyInput) {
+        const skipResult = handler.handleEmptyInput(requestId)
+        if (skipResult) {
+          skipMessage = skipResult.message
+        }
+      }
 
-      await loggingSession.safeComplete({
-        endedAt: new Date().toISOString(),
-        totalDurationMs: 0,
-        finalOutput: { message: skipMessage },
-        traceSpans: [],
-      })
+      if (skipMessage) {
+        await loggingSession.safeStart({
+          userId: actorUserId,
+          actorUserId,
+          billingAttribution,
+          workspaceId,
+          variables: {},
+          triggerData: {
+            isTest: false,
+            correlation,
+          },
+          deploymentVersionId,
+        })
 
-      return {
-        success: true,
-        workflowId: payload.workflowId,
-        executionId,
-        output: { message: skipMessage },
-        executedAt: new Date().toISOString(),
-      }
-    }
+        await loggingSession.safeComplete({
+          endedAt: new Date().toISOString(),
+          totalDurationMs: 0,
+          finalOutput: { message: skipMessage },
+          traceSpans: [],
+        })
 
-    if (input && payload.blockId && blocks[payload.blockId]) {
-      try {
-        const triggerBlock = blocks[payload.blockId]
-        const rawSelectedTriggerId = triggerBlock?.subBlocks?.selectedTriggerId?.value
-        const rawTriggerId = triggerBlock?.subBlocks?.triggerId?.value
+        return {
+          success: true,
+          workflowId: payload.workflowId,
+          executionId,
+          output: { message: skipMessage },
+          executedAt: new Date().toISOString(),
+        }
+      }
 
-        let resolvedTriggerId = [rawSelectedTriggerId, rawTriggerId].find(
-          (candidate): candidate is string =>
-            typeof candidate === 'string' && isTriggerValid(candidate)
-        )
+      if (input && payload.blockId && blocks[payload.blockId]) {
+        try {
+          const triggerBlock = blocks[payload.blockId]
+          const rawSelectedTriggerId = triggerBlock?.subBlocks?.selectedTriggerId?.value
+          const rawTriggerId = triggerBlock?.subBlocks?.triggerId?.value
+
+          let resolvedTriggerId = [rawSelectedTriggerId, rawTriggerId].find(
+            (candidate): candidate is string =>
+              typeof candidate === 'string' && isTriggerValid(candidate)
+          )
+
+          if (!resolvedTriggerId) {
+            const blockConfig = getBlock(triggerBlock.type)
+            if (blockConfig?.category === 'triggers' && isTriggerValid(triggerBlock.type)) {
+              resolvedTriggerId = triggerBlock.type
+            } else if (triggerBlock.triggerMode && blockConfig?.triggers?.enabled) {
+              const available = blockConfig.triggers?.available?.[0]
+              if (available && isTriggerValid(available)) {
+                resolvedTriggerId = available
+              }
+            }
+          }
 
-        if (!resolvedTriggerId) {
-          const blockConfig = getBlock(triggerBlock.type)
-          if (blockConfig?.category === 'triggers' && isTriggerValid(triggerBlock.type)) {
-            resolvedTriggerId = triggerBlock.type
-          } else if (triggerBlock.triggerMode && blockConfig?.triggers?.enabled) {
-            const available = blockConfig.triggers?.available?.[0]
-            if (available && isTriggerValid(available)) {
-              resolvedTriggerId = available
+          if (resolvedTriggerId) {
+            const triggerConfig = getTrigger(resolvedTriggerId)
+
+            if (triggerConfig.outputs) {
+              const processedInput = await processTriggerFileOutputs(input, triggerConfig.outputs, {
+                workspaceId,
+                workflowId: payload.workflowId,
+                executionId,
+                requestId,
+                userId: payload.userId,
+                projectDiagnosticError: (error, details) =>
+                  loggingSession.projectDiagnosticError(error, details),
+              })
+              safeAssign(input, processedInput as Record<string, unknown>)
             }
           }
+        } catch (error) {
+          logger.error(
+            `[${requestId}] Error processing trigger file outputs`,
+            loggingSession.projectDiagnosticError(error)
+          )
         }
+      }
 
-        if (resolvedTriggerId) {
-          const triggerConfig = getTrigger(resolvedTriggerId)
-
-          if (triggerConfig.outputs) {
-            const processedInput = await processTriggerFileOutputs(input, triggerConfig.outputs, {
-              workspaceId,
-              workflowId: payload.workflowId,
-              executionId,
-              requestId,
-              userId: payload.userId,
-              projectDiagnosticError: (error, details) =>
-                loggingSession.projectDiagnosticError(error, details),
-            })
-            safeAssign(input, processedInput as Record<string, unknown>)
-          }
+      if (input && handler.processInputFiles && payload.blockId && blocks[payload.blockId]) {
+        try {
+          await handler.processInputFiles({
+            input,
+            blocks,
+            blockId: payload.blockId,
+            workspaceId,
+            workflowId: payload.workflowId,
+            executionId,
+            requestId,
+            userId: payload.userId,
+          })
+        } catch (error) {
+          logger.error(
+            `[${requestId}] Error processing provider-specific files`,
+            loggingSession.projectDiagnosticError(error)
+          )
         }
-      } catch (error) {
-        logger.error(
-          `[${requestId}] Error processing trigger file outputs`,
-          loggingSession.projectDiagnosticError(error)
-        )
       }
-    }
 
-    if (input && handler.processInputFiles && payload.blockId && blocks[payload.blockId]) {
-      try {
-        await handler.processInputFiles({
-          input,
+      logger.info(`[${requestId}] Executing workflow for ${payload.provider} webhook`)
+
+      const metadata: ExecutionMetadata = {
+        requestId,
+        executionId,
+        workflowId: payload.workflowId,
+        workspaceId,
+        userId: actorUserId!,
+        principal,
+        billingAttribution,
+        sessionUserId: undefined,
+        workflowUserId: workflowRecord.userId,
+        triggerType: payload.provider || 'webhook',
+        triggerBlockId: payload.blockId,
+        useDraftState: false,
+        startTime: new Date().toISOString(),
+        isClientSession: false,
+        credentialAccountUserId,
+        correlation,
+        workflowStateOverride: {
           blocks,
-          blockId: payload.blockId,
-          workspaceId,
-          workflowId: payload.workflowId,
-          executionId,
-          requestId,
-          userId: payload.userId,
-        })
-      } catch (error) {
-        logger.error(
-          `[${requestId}] Error processing provider-specific files`,
-          loggingSession.projectDiagnosticError(error)
-        )
+          edges,
+          loops: loops || {},
+          parallels: parallels || {},
+          deploymentVersionId,
+        },
       }
-    }
 
-    logger.info(`[${requestId}] Executing workflow for ${payload.provider} webhook`)
+      const triggerInput = input || {}
 
-    const metadata: ExecutionMetadata = {
-      requestId,
-      executionId,
-      workflowId: payload.workflowId,
-      workspaceId,
-      userId: actorUserId!,
-      principal,
-      billingAttribution,
-      sessionUserId: undefined,
-      workflowUserId: workflowRecord.userId,
-      triggerType: payload.provider || 'webhook',
-      triggerBlockId: payload.blockId,
-      useDraftState: false,
-      startTime: new Date().toISOString(),
-      isClientSession: false,
-      credentialAccountUserId,
-      correlation,
-      workflowStateOverride: {
-        blocks,
-        edges,
-        loops: loops || {},
-        parallels: parallels || {},
-        deploymentVersionId,
-      },
-    }
+      /**
+       * Surface the pre-execution latency that per-block timings cannot see: the
+       * gap between webhook receipt and the first block running, and — for
+       * trigger_id-bound providers like Slack — the true age of the interaction
+       * against its 3s expiry window. Logged structured so it is queryable/alarmable.
+       */
+      if (payload.webhookReceivedAt !== undefined || payload.triggerTimestampMs !== undefined) {
+        const now = Date.now()
+        logger.info(`[${requestId}] Webhook dispatch latency`, {
+          workflowId: payload.workflowId,
+          provider: payload.provider,
+          dispatchLatencyMs:
+            payload.webhookReceivedAt !== undefined ? now - payload.webhookReceivedAt : undefined,
+          triggerAgeMs:
+            payload.triggerTimestampMs !== undefined ? now - payload.triggerTimestampMs : undefined,
+        })
+      }
 
-    const triggerInput = input || {}
+      const persistedProviderConfig = isRecordLike(resolvedWebhookRecord.providerConfig)
+        ? resolvedWebhookRecord.providerConfig
+        : {}
+      const slackStreamConfig =
+        payload.provider === 'slack' || payload.provider === 'slack_app'
+          ? readSlackStreamResponseConfig(persistedProviderConfig)
+          : null
+      if (slackStreamConfig && payload.provider !== 'slack') {
+        throw new Error('Slack trigger response streaming is only supported for custom bots')
+      }
+      const slackStreamCredentialId =
+        typeof persistedProviderConfig.credentialId === 'string'
+          ? persistedProviderConfig.credentialId
+          : null
+      if (slackStreamConfig && !slackStreamCredentialId) {
+        throw new Error('Slack stream configuration is missing its custom bot credential')
+      }
+      const slackStreamController = slackStreamConfig
+        ? await SlackExecutionStreamController.create({
+            credentialId: slackStreamCredentialId!,
+            workspaceId,
+            workflowId: payload.workflowId,
+            executionId,
+            userId: actorUserId,
+            triggerInput,
+            config: slackStreamConfig,
+            loggingSession,
+            abortSignal: timeoutController.signal,
+          })
+        : null
 
-    /**
-     * Surface the pre-execution latency that per-block timings cannot see: the
-     * gap between webhook receipt and the first block running, and — for
-     * trigger_id-bound providers like Slack — the true age of the interaction
-     * against its 3s expiry window. Logged structured so it is queryable/alarmable.
-     */
-    if (payload.webhookReceivedAt !== undefined || payload.triggerTimestampMs !== undefined) {
-      const now = Date.now()
-      logger.info(`[${requestId}] Webhook dispatch latency`, {
-        workflowId: payload.workflowId,
-        provider: payload.provider,
-        dispatchLatencyMs:
-          payload.webhookReceivedAt !== undefined ? now - payload.webhookReceivedAt : undefined,
-        triggerAgeMs:
-          payload.triggerTimestampMs !== undefined ? now - payload.triggerTimestampMs : undefined,
-      })
-    }
+      const snapshot = new ExecutionSnapshot(
+        metadata,
+        workflowRecord,
+        triggerInput,
+        workflowVariables,
+        slackStreamController?.selectedOutputs ?? []
+      )
 
-    const persistedProviderConfig = isRecordLike(resolvedWebhookRecord.providerConfig)
-      ? resolvedWebhookRecord.providerConfig
-      : {}
-    const slackStreamConfig =
-      payload.provider === 'slack' || payload.provider === 'slack_app'
-        ? readSlackStreamResponseConfig(persistedProviderConfig)
-        : null
-    if (slackStreamConfig && payload.provider !== 'slack') {
-      throw new Error('Slack trigger response streaming is only supported for custom bots')
-    }
-    const slackStreamCredentialId =
-      typeof persistedProviderConfig.credentialId === 'string'
-        ? persistedProviderConfig.credentialId
-        : null
-    if (slackStreamConfig && !slackStreamCredentialId) {
-      throw new Error('Slack stream configuration is missing its custom bot credential')
-    }
-    const slackStreamController = slackStreamConfig
-      ? await SlackExecutionStreamController.create({
-          credentialId: slackStreamCredentialId!,
-          workspaceId,
-          workflowId: payload.workflowId,
-          executionId,
-          userId: actorUserId,
-          triggerInput,
-          config: slackStreamConfig,
+      workflowCoreStarted = true
+      let executionResult: ExecutionResult
+      try {
+        executionResult = await executeWorkflowCore({
+          snapshot,
+          callbacks: slackStreamController?.callbacks ?? {},
           loggingSession,
+          trustedInitialResolvedSecretTraceProvenance:
+            resolvedSecretTraceRegistry.exportProvenanceForValue(triggerInput),
+          includeFileBase64: false,
+          base64MaxBytes: undefined,
           abortSignal: timeoutController.signal,
         })
-      : null
-
-    const snapshot = new ExecutionSnapshot(
-      metadata,
-      workflowRecord,
-      triggerInput,
-      workflowVariables,
-      slackStreamController?.selectedOutputs ?? []
-    )
+      } catch (error) {
+        if (slackStreamController) {
+          await slackStreamController.finalize({
+            success: false,
+            output: {},
+            error: toError(error).message,
+          })
+        }
+        throw error
+      }
+      if (slackStreamController) {
+        await slackStreamController.finalize(executionResult)
+        slackStreamController.assertSucceeded()
+      }
 
-    workflowCoreStarted = true
-    let executionResult: ExecutionResult
-    try {
-      executionResult = await executeWorkflowCore({
-        snapshot,
-        callbacks: slackStreamController?.callbacks ?? {},
+      await handleExecutionResult(executionResult, {
         loggingSession,
-        trustedInitialResolvedSecretTraceProvenance:
-          resolvedSecretTraceRegistry.exportProvenanceForValue(triggerInput),
-        includeFileBase64: false,
-        base64MaxBytes: undefined,
-        abortSignal: timeoutController.signal,
+        timeoutController,
+        requestId,
+        executionId,
+        workflowId: payload.workflowId,
       })
-    } catch (error) {
-      if (slackStreamController) {
-        await slackStreamController.finalize({
-          success: false,
-          output: {},
-          error: toError(error).message,
-        })
-      }
-      throw error
-    }
-    if (slackStreamController) {
-      await slackStreamController.finalize(executionResult)
-      slackStreamController.assertSucceeded()
-    }
 
-    await handleExecutionResult(executionResult, {
-      loggingSession,
-      timeoutController,
-      requestId,
-      executionId,
-      workflowId: payload.workflowId,
-    })
+      logger.info(`[${requestId}] Webhook execution completed`, {
+        success: executionResult.success,
+        workflowId: payload.workflowId,
+        provider: payload.provider,
+      })
 
-    logger.info(`[${requestId}] Webhook execution completed`, {
-      success: executionResult.success,
-      workflowId: payload.workflowId,
-      provider: payload.provider,
+      return {
+        success: executionResult.success,
+        workflowId: payload.workflowId,
+        executionId,
+        output: executionResult.output,
+        executedAt: new Date().toISOString(),
+        provider: payload.provider,
+      }
     })
-
-    return {
-      success: executionResult.success,
-      workflowId: payload.workflowId,
-      executionId,
-      output: executionResult.output,
-      executedAt: new Date().toISOString(),
-      provider: payload.provider,
-    }
   } catch (error: unknown) {
     const errorMessage = toError(error).message
     const errorStack = error instanceof Error ? error.stack : undefined
diff --git a/apps/sim/background/workflow-column-execution.ts b/apps/sim/background/workflow-column-execution.ts
index 907765d65a8..ef8c5022cf7 100644
--- a/apps/sim/background/workflow-column-execution.ts
+++ b/apps/sim/background/workflow-column-execution.ts
@@ -23,6 +23,7 @@ import {
   isTimeoutAbortReason,
   type TimeoutAbortController,
 } from '@/lib/core/execution-limits'
+import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import { RateLimiter } from '@/lib/core/rate-limiter/rate-limiter'
 import {
   registerManualExecutionAborter,
@@ -681,26 +682,28 @@ async function runWorkflowAndWriteTerminal(
           await enrichmentRegistry.importCrossingProvenance(inputProvenance, enrichInputs, {
             trusted: true,
           })
-          const { result, cost, detail } = await runEnrichment(enrichment, enrichInputs, {
-            tableId,
-            rowId,
-            workspaceId,
-            /**
-             * The person who asked, not who pays. `triggeredByUserId` is an
-             * attribution: for a workspace-API-key run it names the workspace's
-             * billing owner, and running that bystander's tool denylist against
-             * an actorless request is wrong in both directions — it fails cells
-             * nobody meant to govern, and it skips the denylist for the person
-             * who actually triggered one. The governed subject is carried
-             * separately from the dispatch. `null` means no per-tool gate
-             * applies, which is the documented behavior for an actorless run —
-             * stated, because the field is required precisely so it cannot be
-             * skipped by omission.
-             */
-            userId: payload.capabilityGovernedUserId ?? null,
-            signal: attemptSignal,
-            resolvedSecretTraceRegistry: enrichmentRegistry,
-          })
+          const { result, cost, detail } = await withResourceOutboundScope({ workspaceId }, () =>
+            runEnrichment(enrichment, enrichInputs, {
+              tableId,
+              rowId,
+              workspaceId,
+              /**
+               * The person who asked, not who pays. `triggeredByUserId` is an
+               * attribution: for a workspace-API-key run it names the workspace's
+               * billing owner, and running that bystander's tool denylist against
+               * an actorless request is wrong in both directions — it fails cells
+               * nobody meant to govern, and it skips the denylist for the person
+               * who actually triggered one. The governed subject is carried
+               * separately from the dispatch. `null` means no per-tool gate
+               * applies, which is the documented behavior for an actorless run —
+               * stated, because the field is required precisely so it cannot be
+               * skipped by omission.
+               */
+              userId: payload.capabilityGovernedUserId ?? null,
+              signal: attemptSignal,
+              resolvedSecretTraceRegistry: enrichmentRegistry,
+            })
+          )
 
           // An abort during the cascade must not be recorded as a completed cell.
           if (attemptSignal.aborted) {
diff --git a/apps/sim/components/settings/navigation.test.ts b/apps/sim/components/settings/navigation.test.ts
index 7e29f8ca48c..e469f904048 100644
--- a/apps/sim/components/settings/navigation.test.ts
+++ b/apps/sim/components/settings/navigation.test.ts
@@ -116,7 +116,7 @@ describe('settings navigation boundaries', () => {
       'recently-deleted',
       'self-host',
       'sso',
-      'sessions',
+      'security',
       'data-retention',
       'data-drains',
       'whitelabeling',
@@ -237,7 +237,7 @@ describe('settings navigation boundaries', () => {
         'access-control': false,
         'audit-logs': false,
         sso: true,
-        sessions: true,
+        security: true,
         'data-retention': false,
         'data-drains': false,
         usage: true,
@@ -301,7 +301,7 @@ describe('settings navigation boundaries', () => {
       'data-drains',
       'data-retention',
       'organization',
-      'sessions',
+      'security',
       'sso',
       'usage',
       'whitelabeling',
@@ -319,7 +319,7 @@ describe('settings navigation boundaries', () => {
       'access-control': 'access-control',
       'audit-logs': 'audit-logs',
       sso: 'sso',
-      sessions: 'sessions',
+      security: 'security',
       'data-retention': 'data-retention',
       'data-drains': 'data-drains',
       whitelabeling: 'whitelabeling',
diff --git a/apps/sim/components/settings/navigation.ts b/apps/sim/components/settings/navigation.ts
index 2665b09e256..7721f1c7841 100644
--- a/apps/sim/components/settings/navigation.ts
+++ b/apps/sim/components/settings/navigation.ts
@@ -2,7 +2,6 @@ import type { ComponentType } from 'react'
 import {
   ChartColumn,
   ClipboardList,
-  Clock,
   Credit,
   Database,
   Globe,
@@ -55,7 +54,7 @@ export type OrganizationSettingsSection =
   | 'access-control'
   | 'audit-logs'
   | 'sso'
-  | 'sessions'
+  | 'security'
   | 'data-retention'
   | 'data-drains'
   | 'whitelabeling'
@@ -115,7 +114,7 @@ export type UnifiedSettingsSection =
   | 'inbox'
   | 'sandboxes'
   | 'admin'
-  | 'sessions'
+  | 'security'
   | 'data-retention'
   | 'data-drains'
   | 'mothership'
@@ -701,18 +700,18 @@ export const SETTINGS_SECTION_REGISTRY: readonly SettingsSectionRegistryEntry[]
     },
   },
   {
-    label: 'Session policies',
-    icon: Clock,
-    docsLink: 'https://docs.sim.ai/platform/enterprise/session-policies',
+    label: 'Security',
+    icon: Lock,
+    docsLink: 'https://docs.sim.ai/platform/enterprise/security',
     unified: {
-      id: 'sessions',
-      description: 'Limit session lifetimes and sign out members org-wide.',
+      id: 'security',
+      description: 'Manage session policies and view outbound IP addresses.',
       group: 'organization',
       order: 8,
       requiresHosted: true,
       requiresEnterprise: true,
-      selfHostedOverride: 'sessionPolicies',
-      organizationSection: 'sessions',
+      selfHostedOverride: 'always',
+      organizationSection: 'security',
     },
   },
   {
@@ -905,7 +904,7 @@ const ORGANIZATION_SECTION_GROUPS: Record<OrganizationSettingsSection, Organizat
     'audit-logs': 'governance',
     'access-control': 'governance',
     sso: 'governance',
-    sessions: 'governance',
+    security: 'governance',
     'data-retention': 'governance',
     'data-drains': 'governance',
     integrations: 'sim-search',
@@ -1048,7 +1047,7 @@ export function getOrganizationSettingsFeatures(
       'access-control': features.accessControl,
       'audit-logs': features.auditLogs,
       sso: features.sso,
-      sessions: features.sessionPolicies,
+      security: true,
       'data-retention': features.dataRetention,
       'data-drains': features.dataDrains,
       usage: features.usageMonitoring,
diff --git a/apps/sim/components/settings/organization-security.tsx b/apps/sim/components/settings/organization-security.tsx
new file mode 100644
index 00000000000..e5a7ccfd276
--- /dev/null
+++ b/apps/sim/components/settings/organization-security.tsx
@@ -0,0 +1,82 @@
+'use client'
+
+import { ChipCopyInput } from '@sim/emcn'
+import { SettingsPanel } from '@/components/settings/settings-panel'
+import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
+import {
+  SettingsEmptyState,
+  SettingsQueryErrorState,
+} from '@/app/workspace/[workspaceId]/settings/components/settings-empty-state'
+import { SettingsSection } from '@/app/workspace/[workspaceId]/settings/components/settings-section/settings-section'
+import { SessionPolicySettings } from '@/ee/session-policy/components/session-policy-settings'
+import { useOrganizationNetwork } from '@/hooks/queries/organization-network'
+
+interface OrganizationSecuritySettingsProps {
+  organizationId: string
+}
+
+export function OrganizationSecuritySettings({
+  organizationId,
+}: OrganizationSecuritySettingsProps) {
+  const { hosted, features } = useDeploymentShape()
+
+  return (
+    <div className='flex flex-col gap-7'>
+      {hosted || features.sessionPolicies ? (
+        <SettingsSection label='Session policies'>
+          <SessionPolicySettings key={organizationId} organizationId={organizationId} />
+        </SettingsSection>
+      ) : (
+        <SettingsPanel />
+      )}
+      <OrganizationNetworkSection organizationId={organizationId} />
+    </div>
+  )
+}
+
+function OrganizationNetworkSection({ organizationId }: OrganizationSecuritySettingsProps) {
+  const { data, error, isPending, isFetching, refetch } = useOrganizationNetwork(organizationId)
+
+  return (
+    <SettingsSection label='Outbound IP addresses'>
+      {isPending ? (
+        <SettingsEmptyState variant='inline'>
+          <span role='status'>Loading network settings…</span>
+        </SettingsEmptyState>
+      ) : error || data?.mode === 'unavailable' ? (
+        <SettingsQueryErrorState
+          error={error}
+          fallback='Could not load network settings'
+          isRetrying={isFetching}
+          onRetry={() => void refetch()}
+          variant='inline'
+        />
+      ) : data?.mode === 'gateway' && data.publicIps.length > 0 ? (
+        <div className='flex flex-col gap-3'>
+          <p className='text-[var(--text-muted)] text-caption'>
+            Allowlist every address below for supported HTTPS connections.
+          </p>
+          <div className='flex flex-col gap-2'>
+            {data.publicIps.map((ip) => (
+              <ChipCopyInput
+                key={ip}
+                value={`${ip}/32`}
+                aria-label={`Outbound IP ${ip}`}
+                copyLabel={`Copy ${ip}/32`}
+                inputClassName='font-mono'
+              />
+            ))}
+          </div>
+        </div>
+      ) : data ? (
+        <p role='status' className='text-[var(--text-muted)] text-sm'>
+          {data.mode === 'blocked'
+            ? 'Supported HTTPS connections are paused.'
+            : data.mode === 'gateway'
+              ? 'Your outbound IP addresses aren’t available yet.'
+              : 'Outbound IP addresses are not configured for this organization.'}
+        </p>
+      ) : null}
+    </SettingsSection>
+  )
+}
diff --git a/apps/sim/components/ui/activity-status.tsx b/apps/sim/components/ui/activity-status.tsx
index ae24197c9ba..4e603e84c75 100644
--- a/apps/sim/components/ui/activity-status.tsx
+++ b/apps/sim/components/ui/activity-status.tsx
@@ -2,7 +2,7 @@ import type { ReactNode } from 'react'
 import { OverflowText } from '@sim/emcn'
 import { ShimmerText } from '@/components/ui/shimmer-text'
 
-interface ActivityStatusProps {
+export interface ActivityStatusProps {
   label: string
   isActive: boolean
   icon?: ReactNode
diff --git a/apps/sim/connectors/airtable/airtable.ts b/apps/sim/connectors/airtable/airtable.ts
index fdddb724f41..541dc55b8ca 100644
--- a/apps/sim/connectors/airtable/airtable.ts
+++ b/apps/sim/connectors/airtable/airtable.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { airtableConnectorMeta } from '@/connectors/airtable/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
diff --git a/apps/sim/connectors/asana/asana.ts b/apps/sim/connectors/asana/asana.ts
index f6c3758a61a..83fdf9e2a9c 100644
--- a/apps/sim/connectors/asana/asana.ts
+++ b/apps/sim/connectors/asana/asana.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { asanaConnectorMeta } from '@/connectors/asana/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { joinTagArray, parseTagDate } from '@/connectors/utils'
diff --git a/apps/sim/connectors/ashby/ashby.ts b/apps/sim/connectors/ashby/ashby.ts
index 3caf9a9f2dd..ba781a63867 100644
--- a/apps/sim/connectors/ashby/ashby.ts
+++ b/apps/sim/connectors/ashby/ashby.ts
@@ -5,7 +5,8 @@ import {
   readResponseJsonWithLimit,
   readResponseTextWithLimit,
 } from '@/lib/core/utils/stream-limits'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { ashbyConnectorMeta } from '@/connectors/ashby/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { parseTagDate } from '@/connectors/utils'
diff --git a/apps/sim/connectors/azure-devops/azure-devops.ts b/apps/sim/connectors/azure-devops/azure-devops.ts
index 1277e9fff9c..8c5a19fed41 100644
--- a/apps/sim/connectors/azure-devops/azure-devops.ts
+++ b/apps/sim/connectors/azure-devops/azure-devops.ts
@@ -1,7 +1,8 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
 import { decodeTextBuffer } from '@/lib/file-parsers/utils'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { azureDevopsConnectorMeta } from '@/connectors/azure-devops/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
diff --git a/apps/sim/connectors/bitbucket/bitbucket.ts b/apps/sim/connectors/bitbucket/bitbucket.ts
index 03b3d38d3f6..94f1dd28e7c 100644
--- a/apps/sim/connectors/bitbucket/bitbucket.ts
+++ b/apps/sim/connectors/bitbucket/bitbucket.ts
@@ -1,7 +1,8 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
 import { decodeTextBuffer } from '@/lib/file-parsers/utils'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { bitbucketConnectorMeta } from '@/connectors/bitbucket/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
diff --git a/apps/sim/connectors/box/box.test.ts b/apps/sim/connectors/box/box.test.ts
index 1ab7d1b4d6f..4f4bbab61d2 100644
--- a/apps/sim/connectors/box/box.test.ts
+++ b/apps/sim/connectors/box/box.test.ts
@@ -5,9 +5,9 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { mockFetchWithRetry } = vi.hoisted(() => ({ mockFetchWithRetry: vi.fn() }))
 
-vi.mock('@/lib/knowledge/documents/utils', () => ({
+vi.mock('@/lib/knowledge/documents/utils', () => ({ VALIDATE_RETRY_OPTIONS: {} }))
+vi.mock('@/lib/knowledge/documents/secure-fetch.server', () => ({
   fetchWithRetry: mockFetchWithRetry,
-  VALIDATE_RETRY_OPTIONS: {},
 }))
 vi.mock('@/components/icons', () => ({ BoxCompanyIcon: () => null }))
 
diff --git a/apps/sim/connectors/box/box.ts b/apps/sim/connectors/box/box.ts
index d5f453ea759..aa33acd3d33 100644
--- a/apps/sim/connectors/box/box.ts
+++ b/apps/sim/connectors/box/box.ts
@@ -2,7 +2,8 @@ import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { sleep } from '@sim/utils/helpers'
 import { decodeTextBuffer } from '@/lib/file-parsers/utils'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { boxConnectorMeta } from '@/connectors/box/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
diff --git a/apps/sim/connectors/circleback/circleback.test.ts b/apps/sim/connectors/circleback/circleback.test.ts
index f3b653371d2..39795a208f4 100644
--- a/apps/sim/connectors/circleback/circleback.test.ts
+++ b/apps/sim/connectors/circleback/circleback.test.ts
@@ -10,9 +10,9 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { mockFetchWithRetry } = vi.hoisted(() => ({ mockFetchWithRetry: vi.fn() }))
 
-vi.mock('@/lib/knowledge/documents/utils', () => ({
+vi.mock('@/lib/knowledge/documents/utils', () => ({ VALIDATE_RETRY_OPTIONS: {} }))
+vi.mock('@/lib/knowledge/documents/secure-fetch.server', () => ({
   fetchWithRetry: mockFetchWithRetry,
-  VALIDATE_RETRY_OPTIONS: {},
 }))
 vi.mock('@/components/icons', () => ({ CirclebackIcon: () => null }))
 
diff --git a/apps/sim/connectors/circleback/circleback.ts b/apps/sim/connectors/circleback/circleback.ts
index 3f0f82ce5f5..fe4a791d150 100644
--- a/apps/sim/connectors/circleback/circleback.ts
+++ b/apps/sim/connectors/circleback/circleback.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { circlebackConnectorMeta } from '@/connectors/circleback/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { joinTagArray, parseTagDate } from '@/connectors/utils'
diff --git a/apps/sim/connectors/clickup/clickup.ts b/apps/sim/connectors/clickup/clickup.ts
index 87a9ac3bce6..313a572d1f3 100644
--- a/apps/sim/connectors/clickup/clickup.ts
+++ b/apps/sim/connectors/clickup/clickup.ts
@@ -1,7 +1,8 @@
 import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
 import { isRecordLike } from '@sim/utils/object'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { clickupConnectorMeta } from '@/connectors/clickup/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
diff --git a/apps/sim/connectors/confluence/confluence.ts b/apps/sim/connectors/confluence/confluence.ts
index 8a80a0d0ddf..263d50c7db0 100644
--- a/apps/sim/connectors/confluence/confluence.ts
+++ b/apps/sim/connectors/confluence/confluence.ts
@@ -11,9 +11,9 @@ import {
   confluencePageAcl,
 } from '@/lib/knowledge/access/confluence-permissions'
 import type { MirroredDocumentAcl } from '@/lib/knowledge/access/types'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
 import {
   createRetryableHttpError,
-  fetchWithRetry,
   type RetryOptions,
   VALIDATE_RETRY_OPTIONS,
 } from '@/lib/knowledge/documents/utils'
diff --git a/apps/sim/connectors/confluence/permissions.ts b/apps/sim/connectors/confluence/permissions.ts
index 99405116121..e354fc80ba4 100644
--- a/apps/sim/connectors/confluence/permissions.ts
+++ b/apps/sim/connectors/confluence/permissions.ts
@@ -5,7 +5,8 @@ import {
   type ConfluenceRestriction,
   confluenceSubjectToken,
 } from '@/lib/knowledge/access/confluence-permissions'
-import { fetchWithRetry, type RetryOptions } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import type { RetryOptions } from '@/lib/knowledge/documents/utils'
 import { extractCursor } from '@/connectors/confluence/cursor'
 import type {
   ConnectorDirectory,
diff --git a/apps/sim/connectors/databricks/databricks.ts b/apps/sim/connectors/databricks/databricks.ts
index 88f1adfdc80..d29f65a9dd6 100644
--- a/apps/sim/connectors/databricks/databricks.ts
+++ b/apps/sim/connectors/databricks/databricks.ts
@@ -3,7 +3,8 @@ import { getErrorMessage, toError } from '@sim/utils/errors'
 import { truncate } from '@sim/utils/string'
 import { validateDatabricksWorkspaceHost } from '@/lib/core/security/input-validation'
 import { decodeTextBuffer } from '@/lib/file-parsers/utils'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import {
   DATABRICKS_CONTENT_TYPES,
   type DatabricksContentType,
diff --git a/apps/sim/connectors/discord/discord.ts b/apps/sim/connectors/discord/discord.ts
index 27ed685fafd..1fd694d0cb8 100644
--- a/apps/sim/connectors/discord/discord.ts
+++ b/apps/sim/connectors/discord/discord.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { DEFAULT_MAX_MESSAGES, discordConnectorMeta } from '@/connectors/discord/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { computeContentHash, parseTagDate } from '@/connectors/utils'
diff --git a/apps/sim/connectors/docusign/docusign.ts b/apps/sim/connectors/docusign/docusign.ts
index 412ba5ace7d..365d362aa0c 100644
--- a/apps/sim/connectors/docusign/docusign.ts
+++ b/apps/sim/connectors/docusign/docusign.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { getDocusignOAuthUrl, getDocusignWebBase } from '@/lib/oauth/docusign'
 import { docusignConnectorMeta } from '@/connectors/docusign/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
diff --git a/apps/sim/connectors/dropbox/dropbox.ts b/apps/sim/connectors/dropbox/dropbox.ts
index 132e6deb4ea..07226e8d51b 100644
--- a/apps/sim/connectors/dropbox/dropbox.ts
+++ b/apps/sim/connectors/dropbox/dropbox.ts
@@ -1,7 +1,8 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { decodeTextBuffer } from '@/lib/file-parsers/utils'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { dropboxConnectorMeta } from '@/connectors/dropbox/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
diff --git a/apps/sim/connectors/fathom/fathom.ts b/apps/sim/connectors/fathom/fathom.ts
index bce6b9f4ff3..befb45c92bf 100644
--- a/apps/sim/connectors/fathom/fathom.ts
+++ b/apps/sim/connectors/fathom/fathom.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { fathomConnectorMeta } from '@/connectors/fathom/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { parseTagDate } from '@/connectors/utils'
diff --git a/apps/sim/connectors/github/request.ts b/apps/sim/connectors/github/request.ts
index 13198b79ae5..aa1557cd004 100644
--- a/apps/sim/connectors/github/request.ts
+++ b/apps/sim/connectors/github/request.ts
@@ -7,8 +7,8 @@ import {
 } from '@/lib/core/rate-limiter/provider-capacity-error'
 import type { ProviderCapacityQuota } from '@/lib/core/rate-limiter/provider-capacity-state'
 import { readResponseTextWithLimit } from '@/lib/core/utils/stream-limits'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
 import {
-  fetchWithRetry,
   hasRateLimitEvidence,
   type RetryOptions,
   resolveRetryDelayMs,
@@ -69,7 +69,7 @@ export async function fetchGitHubWithRetry(
     .digest('hex')
   return fetchWithRetry(url, options, {
     ...retryOptions,
-    fetcher: async (input, init) => {
+    fetcher: async (input, init, transport) => {
       const signal = init?.signal ?? undefined
       let lease
       try {
@@ -119,7 +119,7 @@ export async function fetchGitHubWithRetry(
       }
 
       try {
-        const response = await fetch(input, init)
+        const response = await transport(input, init)
         quota = readRequestQuota(response.headers)
         let secondaryLimit = false
         let forbiddenBody: string | undefined
diff --git a/apps/sim/connectors/gmail/company-crawl.test.ts b/apps/sim/connectors/gmail/company-crawl.test.ts
index 6918529e1ce..5030a0f4948 100644
--- a/apps/sim/connectors/gmail/company-crawl.test.ts
+++ b/apps/sim/connectors/gmail/company-crawl.test.ts
@@ -9,10 +9,8 @@ const { fetchProvider, listUsers, getUser } = vi.hoisted(() => ({
   getUser: vi.fn(),
 }))
 
-vi.mock('@/lib/knowledge/documents/utils', () => ({
-  fetchWithRetry: fetchProvider,
-  VALIDATE_RETRY_OPTIONS: {},
-}))
+vi.mock('@/lib/knowledge/documents/utils', () => ({ VALIDATE_RETRY_OPTIONS: {} }))
+vi.mock('@/lib/knowledge/documents/secure-fetch.server', () => ({ fetchWithRetry: fetchProvider }))
 vi.mock('@/components/icons', () => ({ GmailIcon: () => null }))
 vi.mock('@/connectors/google-workspace/users', () => ({
   GOOGLE_WORKSPACE_USERS_PAGE_SIZE: 100,
diff --git a/apps/sim/connectors/gmail/gmail.test.ts b/apps/sim/connectors/gmail/gmail.test.ts
index 346021bb07b..f4d80fd1fd4 100644
--- a/apps/sim/connectors/gmail/gmail.test.ts
+++ b/apps/sim/connectors/gmail/gmail.test.ts
@@ -5,9 +5,9 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { mockFetchWithRetry } = vi.hoisted(() => ({ mockFetchWithRetry: vi.fn() }))
 
-vi.mock('@/lib/knowledge/documents/utils', () => ({
+vi.mock('@/lib/knowledge/documents/utils', () => ({ VALIDATE_RETRY_OPTIONS: {} }))
+vi.mock('@/lib/knowledge/documents/secure-fetch.server', () => ({
   fetchWithRetry: mockFetchWithRetry,
-  VALIDATE_RETRY_OPTIONS: {},
 }))
 vi.mock('@/components/icons', () => ({ GmailIcon: () => null }))
 vi.mock('@/lib/knowledge/documents/service', () => ({
diff --git a/apps/sim/connectors/gmail/gmail.ts b/apps/sim/connectors/gmail/gmail.ts
index c85f7df81c0..f63ea781624 100644
--- a/apps/sim/connectors/gmail/gmail.ts
+++ b/apps/sim/connectors/gmail/gmail.ts
@@ -3,7 +3,8 @@ import { getErrorMessage, toError } from '@sim/utils/errors'
 import { isPlainRecord } from '@sim/utils/object'
 import { mapWithConcurrency } from '@/lib/core/utils/concurrency'
 import { isPayloadSizeLimitError, readResponseJsonWithLimit } from '@/lib/core/utils/stream-limits'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { DEFAULT_MAX_THREADS, gmailConnectorMeta } from '@/connectors/gmail/meta'
 import {
   getGoogleWorkspaceDocument,
diff --git a/apps/sim/connectors/gong/gong.ts b/apps/sim/connectors/gong/gong.ts
index 77ed6655aa3..638c572eb0d 100644
--- a/apps/sim/connectors/gong/gong.ts
+++ b/apps/sim/connectors/gong/gong.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { gongConnectorMeta } from '@/connectors/gong/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { joinTagArray, parseTagDate } from '@/connectors/utils'
diff --git a/apps/sim/connectors/google-calendar/google-calendar.ts b/apps/sim/connectors/google-calendar/google-calendar.ts
index b56cd329196..52405ccb028 100644
--- a/apps/sim/connectors/google-calendar/google-calendar.ts
+++ b/apps/sim/connectors/google-calendar/google-calendar.ts
@@ -1,7 +1,8 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { z } from 'zod'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { DEFAULT_MAX_EVENTS, googleCalendarConnectorMeta } from '@/connectors/google-calendar/meta'
 import {
   getGoogleWorkspaceDocument,
diff --git a/apps/sim/connectors/google-chat/google-chat.ts b/apps/sim/connectors/google-chat/google-chat.ts
index 107e2acea72..b726cba04c5 100644
--- a/apps/sim/connectors/google-chat/google-chat.ts
+++ b/apps/sim/connectors/google-chat/google-chat.ts
@@ -1,7 +1,8 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import {
   DEFAULT_MAX_MESSAGES,
   googleChatConnectorMeta,
diff --git a/apps/sim/connectors/google-docs/google-docs.ts b/apps/sim/connectors/google-docs/google-docs.ts
index f5a0d2faac7..411627179bc 100644
--- a/apps/sim/connectors/google-docs/google-docs.ts
+++ b/apps/sim/connectors/google-docs/google-docs.ts
@@ -1,11 +1,8 @@
 import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
 import { isPlainRecord } from '@sim/utils/object'
-import {
-  fetchWithRetry,
-  readBoundedHttpErrorBody,
-  VALIDATE_RETRY_OPTIONS,
-} from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { readBoundedHttpErrorBody, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { googleDocsConnectorMeta } from '@/connectors/google-docs/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
diff --git a/apps/sim/connectors/google-forms/google-forms.ts b/apps/sim/connectors/google-forms/google-forms.ts
index 957e039cb93..c678fb906ee 100644
--- a/apps/sim/connectors/google-forms/google-forms.ts
+++ b/apps/sim/connectors/google-forms/google-forms.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { googleFormsConnectorMeta, MAX_RESPONSES_PER_FORM } from '@/connectors/google-forms/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
diff --git a/apps/sim/connectors/google-meet/google-meet.ts b/apps/sim/connectors/google-meet/google-meet.ts
index 5f7f2a3813d..6eb43c42fa2 100644
--- a/apps/sim/connectors/google-meet/google-meet.ts
+++ b/apps/sim/connectors/google-meet/google-meet.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { googleMeetConnectorMeta } from '@/connectors/google-meet/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { joinTagArray, parseTagDate } from '@/connectors/utils'
diff --git a/apps/sim/connectors/google-sheets/google-sheets.ts b/apps/sim/connectors/google-sheets/google-sheets.ts
index aba40c3d6f8..5604dd899e1 100644
--- a/apps/sim/connectors/google-sheets/google-sheets.ts
+++ b/apps/sim/connectors/google-sheets/google-sheets.ts
@@ -1,7 +1,8 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
 import type { RetryOptions } from '@/lib/knowledge/documents/utils'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { googleSheetsConnectorMeta } from '@/connectors/google-sheets/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
diff --git a/apps/sim/connectors/google-slides/google-slides.ts b/apps/sim/connectors/google-slides/google-slides.ts
index 1257cf60aa5..c0739a728f6 100644
--- a/apps/sim/connectors/google-slides/google-slides.ts
+++ b/apps/sim/connectors/google-slides/google-slides.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { googleSlidesConnectorMeta } from '@/connectors/google-slides/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
diff --git a/apps/sim/connectors/google-vault/google-vault.ts b/apps/sim/connectors/google-vault/google-vault.ts
index 85e912ebb86..5d7f3eb48a1 100644
--- a/apps/sim/connectors/google-vault/google-vault.ts
+++ b/apps/sim/connectors/google-vault/google-vault.ts
@@ -1,10 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
-import {
-  fetchWithRetry,
-  type RetryOptions,
-  VALIDATE_RETRY_OPTIONS,
-} from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { type RetryOptions, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { googleVaultConnectorMeta } from '@/connectors/google-vault/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { computeContentHash, parseTagDate, takeIndexableWithinCap } from '@/connectors/utils'
diff --git a/apps/sim/connectors/grain/grain.ts b/apps/sim/connectors/grain/grain.ts
index 564a334a3b5..54cc21ccf27 100644
--- a/apps/sim/connectors/grain/grain.ts
+++ b/apps/sim/connectors/grain/grain.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { grainConnectorMeta } from '@/connectors/grain/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { joinTagArray, parseTagDate } from '@/connectors/utils'
diff --git a/apps/sim/connectors/granola/granola.test.ts b/apps/sim/connectors/granola/granola.test.ts
index 3b5a8cec4a9..49d469c4ad5 100644
--- a/apps/sim/connectors/granola/granola.test.ts
+++ b/apps/sim/connectors/granola/granola.test.ts
@@ -10,9 +10,9 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { mockFetchWithRetry } = vi.hoisted(() => ({ mockFetchWithRetry: vi.fn() }))
 
-vi.mock('@/lib/knowledge/documents/utils', () => ({
+vi.mock('@/lib/knowledge/documents/utils', () => ({ VALIDATE_RETRY_OPTIONS: {} }))
+vi.mock('@/lib/knowledge/documents/secure-fetch.server', () => ({
   fetchWithRetry: mockFetchWithRetry,
-  VALIDATE_RETRY_OPTIONS: {},
 }))
 vi.mock('@/components/icons', () => ({ GranolaIcon: () => null }))
 
diff --git a/apps/sim/connectors/granola/granola.ts b/apps/sim/connectors/granola/granola.ts
index d92d65974c7..3926000802e 100644
--- a/apps/sim/connectors/granola/granola.ts
+++ b/apps/sim/connectors/granola/granola.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { granolaConnectorMeta } from '@/connectors/granola/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { htmlToPlainText, joinTagArray, looksLikeHtml, parseTagDate } from '@/connectors/utils'
diff --git a/apps/sim/connectors/greenhouse/greenhouse.ts b/apps/sim/connectors/greenhouse/greenhouse.ts
index e4b78e007fa..570a815cfe9 100644
--- a/apps/sim/connectors/greenhouse/greenhouse.ts
+++ b/apps/sim/connectors/greenhouse/greenhouse.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { greenhouseConnectorMeta } from '@/connectors/greenhouse/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { htmlToPlainText, parseTagDate } from '@/connectors/utils'
diff --git a/apps/sim/connectors/hubspot/hubspot.ts b/apps/sim/connectors/hubspot/hubspot.ts
index 936ca11fd73..1f72847125d 100644
--- a/apps/sim/connectors/hubspot/hubspot.ts
+++ b/apps/sim/connectors/hubspot/hubspot.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { hubspotConnectorMeta } from '@/connectors/hubspot/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { htmlToPlainText, looksLikeHtml, parseTagDate } from '@/connectors/utils'
diff --git a/apps/sim/connectors/incidentio/incidentio.ts b/apps/sim/connectors/incidentio/incidentio.ts
index bed02ee269a..5e040dcc06e 100644
--- a/apps/sim/connectors/incidentio/incidentio.ts
+++ b/apps/sim/connectors/incidentio/incidentio.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { incidentioConnectorMeta } from '@/connectors/incidentio/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { htmlToPlainText, parseTagDate } from '@/connectors/utils'
diff --git a/apps/sim/connectors/intercom/intercom.ts b/apps/sim/connectors/intercom/intercom.ts
index 2fba2a0dc52..e44685e89bd 100644
--- a/apps/sim/connectors/intercom/intercom.ts
+++ b/apps/sim/connectors/intercom/intercom.ts
@@ -1,7 +1,8 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
 import { z } from 'zod'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import {
   DEFAULT_INTERCOM_REGION,
   DEFAULT_MAX_ITEMS,
diff --git a/apps/sim/connectors/jira/jira.ts b/apps/sim/connectors/jira/jira.ts
index 917bac7873e..52c0a766a89 100644
--- a/apps/sim/connectors/jira/jira.ts
+++ b/apps/sim/connectors/jira/jira.ts
@@ -7,11 +7,8 @@ import {
   normalizeAtlassianSiteUrl,
   resolveAtlassianCloudId,
 } from '@/lib/atlassian/discovery'
-import {
-  fetchWithRetry,
-  type RetryOptions,
-  VALIDATE_RETRY_OPTIONS,
-} from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { type RetryOptions, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { jiraConnectorMeta } from '@/connectors/jira/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
diff --git a/apps/sim/connectors/jsm/jsm.test.ts b/apps/sim/connectors/jsm/jsm.test.ts
index 6aab2f5e135..797a3150b78 100644
--- a/apps/sim/connectors/jsm/jsm.test.ts
+++ b/apps/sim/connectors/jsm/jsm.test.ts
@@ -5,9 +5,9 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { mockFetchWithRetry } = vi.hoisted(() => ({ mockFetchWithRetry: vi.fn() }))
 
-vi.mock('@/lib/knowledge/documents/utils', () => ({
+vi.mock('@/lib/knowledge/documents/utils', () => ({ VALIDATE_RETRY_OPTIONS: {} }))
+vi.mock('@/lib/knowledge/documents/secure-fetch.server', () => ({
   fetchWithRetry: mockFetchWithRetry,
-  VALIDATE_RETRY_OPTIONS: {},
 }))
 vi.mock('@/components/icons', () => ({ JiraServiceManagementIcon: () => null }))
 vi.mock('@/tools/jira/utils', () => ({
diff --git a/apps/sim/connectors/jsm/jsm.ts b/apps/sim/connectors/jsm/jsm.ts
index a1a05066dca..ebc527b5e1d 100644
--- a/apps/sim/connectors/jsm/jsm.ts
+++ b/apps/sim/connectors/jsm/jsm.ts
@@ -4,7 +4,8 @@ import {
   AtlassianSiteNotAccessibleError,
   AtlassianSiteNotMatchedError,
 } from '@/lib/atlassian/discovery'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { jsmConnectorMeta } from '@/connectors/jsm/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
diff --git a/apps/sim/connectors/linear/linear.test.ts b/apps/sim/connectors/linear/linear.test.ts
index 873612db586..4adba9216b8 100644
--- a/apps/sim/connectors/linear/linear.test.ts
+++ b/apps/sim/connectors/linear/linear.test.ts
@@ -7,9 +7,9 @@ const { mockFetchWithRetry } = vi.hoisted(() => ({
   mockFetchWithRetry: vi.fn(),
 }))
 
-vi.mock('@/lib/knowledge/documents/utils', () => ({
+vi.mock('@/lib/knowledge/documents/utils', () => ({ VALIDATE_RETRY_OPTIONS: { maxRetries: 0 } }))
+vi.mock('@/lib/knowledge/documents/secure-fetch.server', () => ({
   fetchWithRetry: mockFetchWithRetry,
-  VALIDATE_RETRY_OPTIONS: { maxRetries: 0 },
 }))
 
 import { linearConnector } from '@/connectors/linear/linear'
diff --git a/apps/sim/connectors/linear/linear.ts b/apps/sim/connectors/linear/linear.ts
index 47536312153..c4e5fe4531a 100644
--- a/apps/sim/connectors/linear/linear.ts
+++ b/apps/sim/connectors/linear/linear.ts
@@ -2,8 +2,9 @@ import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { sleep } from '@sim/utils/helpers'
 import { backoffWithJitter } from '@sim/utils/retry'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
 import type { RetryOptions } from '@/lib/knowledge/documents/utils'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { linearConnectorMeta } from '@/connectors/linear/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
diff --git a/apps/sim/connectors/microsoft-excel/microsoft-excel.ts b/apps/sim/connectors/microsoft-excel/microsoft-excel.ts
index e9085e137a2..6e39d672d16 100644
--- a/apps/sim/connectors/microsoft-excel/microsoft-excel.ts
+++ b/apps/sim/connectors/microsoft-excel/microsoft-excel.ts
@@ -1,7 +1,8 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
 import type { RetryOptions } from '@/lib/knowledge/documents/utils'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { microsoftExcelConnectorMeta } from '@/connectors/microsoft-excel/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
diff --git a/apps/sim/connectors/microsoft-teams/microsoft-teams.test.ts b/apps/sim/connectors/microsoft-teams/microsoft-teams.test.ts
index 306289f09c5..68663929a18 100644
--- a/apps/sim/connectors/microsoft-teams/microsoft-teams.test.ts
+++ b/apps/sim/connectors/microsoft-teams/microsoft-teams.test.ts
@@ -5,9 +5,9 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { mockFetchWithRetry } = vi.hoisted(() => ({ mockFetchWithRetry: vi.fn() }))
 
-vi.mock('@/lib/knowledge/documents/utils', () => ({
+vi.mock('@/lib/knowledge/documents/utils', () => ({ VALIDATE_RETRY_OPTIONS: {} }))
+vi.mock('@/lib/knowledge/documents/secure-fetch.server', () => ({
   fetchWithRetry: mockFetchWithRetry,
-  VALIDATE_RETRY_OPTIONS: {},
 }))
 vi.mock('@/components/icons', () => ({ MicrosoftTeamsIcon: () => null }))
 
diff --git a/apps/sim/connectors/microsoft-teams/microsoft-teams.ts b/apps/sim/connectors/microsoft-teams/microsoft-teams.ts
index 1ae19ae97ef..958f44c9e05 100644
--- a/apps/sim/connectors/microsoft-teams/microsoft-teams.ts
+++ b/apps/sim/connectors/microsoft-teams/microsoft-teams.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import {
   DEFAULT_MAX_MESSAGES,
   microsoftTeamsConnectorMeta,
diff --git a/apps/sim/connectors/monday/monday.test.ts b/apps/sim/connectors/monday/monday.test.ts
index 7ab350c5cff..46e723dea6c 100644
--- a/apps/sim/connectors/monday/monday.test.ts
+++ b/apps/sim/connectors/monday/monday.test.ts
@@ -5,9 +5,9 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { mockFetchWithRetry } = vi.hoisted(() => ({ mockFetchWithRetry: vi.fn() }))
 
-vi.mock('@/lib/knowledge/documents/utils', () => ({
+vi.mock('@/lib/knowledge/documents/utils', () => ({ VALIDATE_RETRY_OPTIONS: {} }))
+vi.mock('@/lib/knowledge/documents/secure-fetch.server', () => ({
   fetchWithRetry: mockFetchWithRetry,
-  VALIDATE_RETRY_OPTIONS: {},
 }))
 vi.mock('@/components/icons', () => ({ MondayIcon: () => null }))
 
diff --git a/apps/sim/connectors/monday/monday.ts b/apps/sim/connectors/monday/monday.ts
index 0a50a7819e5..25e251da8d7 100644
--- a/apps/sim/connectors/monday/monday.ts
+++ b/apps/sim/connectors/monday/monday.ts
@@ -2,7 +2,8 @@ import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { sleep } from '@sim/utils/helpers'
 import { backoffWithJitter } from '@sim/utils/retry'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { mondayConnectorMeta } from '@/connectors/monday/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
diff --git a/apps/sim/connectors/notion/notion.test.ts b/apps/sim/connectors/notion/notion.test.ts
index a128aa1a383..17ec2ed635a 100644
--- a/apps/sim/connectors/notion/notion.test.ts
+++ b/apps/sim/connectors/notion/notion.test.ts
@@ -9,10 +9,12 @@ const { mockFetchWithRetry, mockReadBoundedHttpErrorPayload } = vi.hoisted(() =>
 }))
 
 vi.mock('@/lib/knowledge/documents/utils', () => ({
-  fetchWithRetry: mockFetchWithRetry,
   readBoundedHttpErrorPayload: mockReadBoundedHttpErrorPayload,
   VALIDATE_RETRY_OPTIONS: {},
 }))
+vi.mock('@/lib/knowledge/documents/secure-fetch.server', () => ({
+  fetchWithRetry: mockFetchWithRetry,
+}))
 vi.mock('@/components/icons', () => ({ NotionIcon: () => null }))
 
 import { notionConnector } from '@/connectors/notion/notion'
diff --git a/apps/sim/connectors/notion/notion.ts b/apps/sim/connectors/notion/notion.ts
index fea1c0f0e69..fa24948695e 100644
--- a/apps/sim/connectors/notion/notion.ts
+++ b/apps/sim/connectors/notion/notion.ts
@@ -1,8 +1,8 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
 import { isPlainRecord } from '@sim/utils/object'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
 import {
-  fetchWithRetry,
   readBoundedHttpErrorPayload,
   VALIDATE_RETRY_OPTIONS,
 } from '@/lib/knowledge/documents/utils'
diff --git a/apps/sim/connectors/onedrive/onedrive.test.ts b/apps/sim/connectors/onedrive/onedrive.test.ts
index 7ce1f708fd7..47d83823da3 100644
--- a/apps/sim/connectors/onedrive/onedrive.test.ts
+++ b/apps/sim/connectors/onedrive/onedrive.test.ts
@@ -6,10 +6,12 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 const { mockFetchWithRetry } = vi.hoisted(() => ({ mockFetchWithRetry: vi.fn() }))
 
 vi.mock('@/lib/knowledge/documents/utils', () => ({
-  fetchWithRetry: mockFetchWithRetry,
   readBoundedHttpErrorBody: async (response: Response) => response.text(),
   VALIDATE_RETRY_OPTIONS: {},
 }))
+vi.mock('@/lib/knowledge/documents/secure-fetch.server', () => ({
+  fetchWithRetry: mockFetchWithRetry,
+}))
 vi.mock('@/components/icons', () => ({ MicrosoftOneDriveIcon: () => null }))
 
 import { onedriveConnector } from '@/connectors/onedrive/onedrive'
diff --git a/apps/sim/connectors/onedrive/onedrive.ts b/apps/sim/connectors/onedrive/onedrive.ts
index dced987dbaf..e095890078f 100644
--- a/apps/sim/connectors/onedrive/onedrive.ts
+++ b/apps/sim/connectors/onedrive/onedrive.ts
@@ -1,10 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
-import {
-  fetchWithRetry,
-  readBoundedHttpErrorBody,
-  VALIDATE_RETRY_OPTIONS,
-} from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { readBoundedHttpErrorBody, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { onedriveConnectorMeta } from '@/connectors/onedrive/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
diff --git a/apps/sim/connectors/outlook/outlook.ts b/apps/sim/connectors/outlook/outlook.ts
index c3a912363ba..0107d53bab9 100644
--- a/apps/sim/connectors/outlook/outlook.ts
+++ b/apps/sim/connectors/outlook/outlook.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { DEFAULT_MAX_CONVERSATIONS, outlookConnectorMeta } from '@/connectors/outlook/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
diff --git a/apps/sim/connectors/pagerduty/pagerduty.ts b/apps/sim/connectors/pagerduty/pagerduty.ts
index f122f7d30ae..371cd27bf80 100644
--- a/apps/sim/connectors/pagerduty/pagerduty.ts
+++ b/apps/sim/connectors/pagerduty/pagerduty.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { pagerdutyConnectorMeta } from '@/connectors/pagerduty/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { htmlToPlainText, joinTagArray, parseMultiValue, parseTagDate } from '@/connectors/utils'
diff --git a/apps/sim/connectors/reddit/reddit.ts b/apps/sim/connectors/reddit/reddit.ts
index cd83f7f59bb..79b7a779e85 100644
--- a/apps/sim/connectors/reddit/reddit.ts
+++ b/apps/sim/connectors/reddit/reddit.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { DEFAULT_MAX_POSTS, redditConnectorMeta } from '@/connectors/reddit/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { parseTagDate } from '@/connectors/utils'
diff --git a/apps/sim/connectors/rootly/rootly.ts b/apps/sim/connectors/rootly/rootly.ts
index a87524df9df..d3d1106a02c 100644
--- a/apps/sim/connectors/rootly/rootly.ts
+++ b/apps/sim/connectors/rootly/rootly.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { rootlyConnectorMeta } from '@/connectors/rootly/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { joinTagArray, parseMultiValue, parseTagDate } from '@/connectors/utils'
diff --git a/apps/sim/connectors/salesforce/salesforce.test.ts b/apps/sim/connectors/salesforce/salesforce.test.ts
index 6bf56c4ceba..f101edefd2f 100644
--- a/apps/sim/connectors/salesforce/salesforce.test.ts
+++ b/apps/sim/connectors/salesforce/salesforce.test.ts
@@ -5,9 +5,9 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { mockFetchWithRetry } = vi.hoisted(() => ({ mockFetchWithRetry: vi.fn() }))
 
-vi.mock('@/lib/knowledge/documents/utils', () => ({
+vi.mock('@/lib/knowledge/documents/utils', () => ({ VALIDATE_RETRY_OPTIONS: {} }))
+vi.mock('@/lib/knowledge/documents/secure-fetch.server', () => ({
   fetchWithRetry: mockFetchWithRetry,
-  VALIDATE_RETRY_OPTIONS: {},
 }))
 vi.mock('@/components/icons', () => ({ SalesforceIcon: () => null }))
 
diff --git a/apps/sim/connectors/salesforce/salesforce.ts b/apps/sim/connectors/salesforce/salesforce.ts
index 522e290d834..28581b2b328 100644
--- a/apps/sim/connectors/salesforce/salesforce.ts
+++ b/apps/sim/connectors/salesforce/salesforce.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { SALESFORCE_LOGIN_HOSTS } from '@/lib/oauth/salesforce'
 import { salesforceConnectorMeta } from '@/connectors/salesforce/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
diff --git a/apps/sim/connectors/servicenow/servicenow.ts b/apps/sim/connectors/servicenow/servicenow.ts
index bf223f89f21..d6f1b0cbd42 100644
--- a/apps/sim/connectors/servicenow/servicenow.ts
+++ b/apps/sim/connectors/servicenow/servicenow.ts
@@ -1,7 +1,8 @@
 import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
 import { validateServiceNowInstanceUrl } from '@/lib/core/security/input-validation'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { DEFAULT_MAX_ITEMS, servicenowConnectorMeta } from '@/connectors/servicenow/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { htmlToPlainText, parseTagDate } from '@/connectors/utils'
diff --git a/apps/sim/connectors/sharepoint/sharepoint.test.ts b/apps/sim/connectors/sharepoint/sharepoint.test.ts
index 9263246515b..7f3e1432182 100644
--- a/apps/sim/connectors/sharepoint/sharepoint.test.ts
+++ b/apps/sim/connectors/sharepoint/sharepoint.test.ts
@@ -6,10 +6,12 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 const { mockFetchWithRetry } = vi.hoisted(() => ({ mockFetchWithRetry: vi.fn() }))
 
 vi.mock('@/lib/knowledge/documents/utils', () => ({
-  fetchWithRetry: mockFetchWithRetry,
   readBoundedHttpErrorBody: async (response: Response) => response.text(),
   VALIDATE_RETRY_OPTIONS: {},
 }))
+vi.mock('@/lib/knowledge/documents/secure-fetch.server', () => ({
+  fetchWithRetry: mockFetchWithRetry,
+}))
 vi.mock('@/components/icons', () => ({ MicrosoftSharepointIcon: () => null }))
 
 import {
diff --git a/apps/sim/connectors/sharepoint/sharepoint.ts b/apps/sim/connectors/sharepoint/sharepoint.ts
index 27f21bd6fab..fa5d434b819 100644
--- a/apps/sim/connectors/sharepoint/sharepoint.ts
+++ b/apps/sim/connectors/sharepoint/sharepoint.ts
@@ -1,11 +1,8 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
 import { isPlainRecord } from '@sim/utils/object'
-import {
-  fetchWithRetry,
-  readBoundedHttpErrorBody,
-  VALIDATE_RETRY_OPTIONS,
-} from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { readBoundedHttpErrorBody, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { sharepointConnectorMeta } from '@/connectors/sharepoint/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
diff --git a/apps/sim/connectors/slack/slack.ts b/apps/sim/connectors/slack/slack.ts
index 22c2ace4b29..3db7efc1617 100644
--- a/apps/sim/connectors/slack/slack.ts
+++ b/apps/sim/connectors/slack/slack.ts
@@ -5,11 +5,8 @@ import { generateId } from '@sim/utils/id'
 import { isPlainRecord } from '@sim/utils/object'
 import { truncate } from '@sim/utils/string'
 import { readResponseJsonWithLimit } from '@/lib/core/utils/stream-limits'
-import {
-  fetchWithRetry,
-  isRateLimitError,
-  VALIDATE_RETRY_OPTIONS,
-} from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { isRateLimitError, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import {
   slackConversationTypes as conversationTypes,
   readSlackConversationSetting as readConversationSetting,
diff --git a/apps/sim/connectors/trello/trello.ts b/apps/sim/connectors/trello/trello.ts
index 9874824b278..9f4df81ff58 100644
--- a/apps/sim/connectors/trello/trello.ts
+++ b/apps/sim/connectors/trello/trello.ts
@@ -1,7 +1,8 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
 import { env } from '@/lib/core/config/env'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { trelloConnectorMeta } from '@/connectors/trello/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { joinTagArray, parseMultiValue, parseTagDate } from '@/connectors/utils'
diff --git a/apps/sim/connectors/typeform/typeform.ts b/apps/sim/connectors/typeform/typeform.ts
index c9890b26595..7c4ce2f03dc 100644
--- a/apps/sim/connectors/typeform/typeform.ts
+++ b/apps/sim/connectors/typeform/typeform.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { typeformConnectorMeta } from '@/connectors/typeform/meta'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { parseTagDate } from '@/connectors/utils'
diff --git a/apps/sim/connectors/types.ts b/apps/sim/connectors/types.ts
index dc36523449b..42636ada4f2 100644
--- a/apps/sim/connectors/types.ts
+++ b/apps/sim/connectors/types.ts
@@ -329,7 +329,7 @@ export interface ConnectorConfigField {
 export interface ConnectorMeta {
   /** Restricts new setup and mode changes; existing sources keep their stored access policy. */
   supportedAccessModes?: readonly ConnectorAccessMode[]
-  /** Opts a source into workspace Search after its indexing and permission paths are verified. */
+  /** Opts a source into Sim Search after its indexing and permission paths are verified. */
   search?: true
   /** Source setup guide shown only in Search connection flows. */
   searchDocsUrl?: string
diff --git a/apps/sim/connectors/utils.test.ts b/apps/sim/connectors/utils.test.ts
index e28549c7262..b8640d29a75 100644
--- a/apps/sim/connectors/utils.test.ts
+++ b/apps/sim/connectors/utils.test.ts
@@ -25,10 +25,8 @@ vi.mock('@/components/icons', () => ({
   RootlyIcon: () => null,
   AzureIcon: () => null,
 }))
-vi.mock('@/lib/knowledge/documents/utils', () => ({
-  fetchWithRetry: vi.fn(),
-  VALIDATE_RETRY_OPTIONS: {},
-}))
+vi.mock('@/lib/knowledge/documents/utils', () => ({ VALIDATE_RETRY_OPTIONS: {} }))
+vi.mock('@/lib/knowledge/documents/secure-fetch.server', () => ({ fetchWithRetry: vi.fn() }))
 vi.mock('@/tools/jira/utils', () => ({ extractAdfText: vi.fn(), getJiraCloudId: vi.fn() }))
 vi.mock('@/tools/confluence/utils', () => ({ getConfluenceCloudId: vi.fn() }))
 vi.mock('@/tools/jsm/utils', () => ({
diff --git a/apps/sim/connectors/webflow/webflow.ts b/apps/sim/connectors/webflow/webflow.ts
index fe96c3a6eff..427521bc8e3 100644
--- a/apps/sim/connectors/webflow/webflow.ts
+++ b/apps/sim/connectors/webflow/webflow.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { htmlToPlainText, parseMultiValue, parseTagDate } from '@/connectors/utils'
 import { webflowConnectorMeta } from '@/connectors/webflow/meta'
diff --git a/apps/sim/connectors/wordpress/wordpress.ts b/apps/sim/connectors/wordpress/wordpress.ts
index 90747709cfc..fccf5d8e123 100644
--- a/apps/sim/connectors/wordpress/wordpress.ts
+++ b/apps/sim/connectors/wordpress/wordpress.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
   CONNECTOR_MAX_FILE_BYTES,
diff --git a/apps/sim/connectors/workday/workday.ts b/apps/sim/connectors/workday/workday.ts
index a19b9bf0ef6..210cfc1310d 100644
--- a/apps/sim/connectors/workday/workday.ts
+++ b/apps/sim/connectors/workday/workday.ts
@@ -1,8 +1,9 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { validatePathSegment, validateWorkdayTenantUrl } from '@/lib/core/security/input-validation'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
 import type { RetryOptions } from '@/lib/knowledge/documents/utils'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
   htmlToPlainText,
diff --git a/apps/sim/connectors/x/x.ts b/apps/sim/connectors/x/x.ts
index b94aaefb13d..8ca68fb5d50 100644
--- a/apps/sim/connectors/x/x.ts
+++ b/apps/sim/connectors/x/x.ts
@@ -1,7 +1,8 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { truncate } from '@sim/utils/string'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { parseMultiValue, parseTagDate } from '@/connectors/utils'
 import { DEFAULT_MAX_POSTS, xConnectorMeta } from '@/connectors/x/meta'
diff --git a/apps/sim/connectors/youtube/youtube.ts b/apps/sim/connectors/youtube/youtube.ts
index 4be5cbfa63a..c4e8d7bbd53 100644
--- a/apps/sim/connectors/youtube/youtube.ts
+++ b/apps/sim/connectors/youtube/youtube.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { joinTagArray, parseTagDate } from '@/connectors/utils'
 import { youtubeConnectorMeta } from '@/connectors/youtube/meta'
diff --git a/apps/sim/connectors/zoho-desk/zoho-desk.ts b/apps/sim/connectors/zoho-desk/zoho-desk.ts
index c1b3c5d5eca..b18d55e07a2 100644
--- a/apps/sim/connectors/zoho-desk/zoho-desk.ts
+++ b/apps/sim/connectors/zoho-desk/zoho-desk.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import { htmlToPlainText, joinTagArray, parseMultiValue, parseTagDate } from '@/connectors/utils'
 import {
diff --git a/apps/sim/connectors/zoom/zoom.test.ts b/apps/sim/connectors/zoom/zoom.test.ts
index decac962516..b99297d3453 100644
--- a/apps/sim/connectors/zoom/zoom.test.ts
+++ b/apps/sim/connectors/zoom/zoom.test.ts
@@ -5,9 +5,9 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { mockFetchWithRetry } = vi.hoisted(() => ({ mockFetchWithRetry: vi.fn() }))
 
-vi.mock('@/lib/knowledge/documents/utils', () => ({
+vi.mock('@/lib/knowledge/documents/utils', () => ({ VALIDATE_RETRY_OPTIONS: {} }))
+vi.mock('@/lib/knowledge/documents/secure-fetch.server', () => ({
   fetchWithRetry: mockFetchWithRetry,
-  VALIDATE_RETRY_OPTIONS: {},
 }))
 
 import { parseVtt, zoomConnector } from '@/connectors/zoom/zoom'
diff --git a/apps/sim/connectors/zoom/zoom.ts b/apps/sim/connectors/zoom/zoom.ts
index 0bba34df117..8dc960b3e0d 100644
--- a/apps/sim/connectors/zoom/zoom.ts
+++ b/apps/sim/connectors/zoom/zoom.ts
@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
-import { fetchWithRetry, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
   CONNECTOR_MAX_FILE_BYTES,
diff --git a/apps/sim/ee/credential-groups/components/credential-group-detail.tsx b/apps/sim/ee/credential-groups/components/credential-group-detail.tsx
index bad80ee1f8b..7776837b1c5 100644
--- a/apps/sim/ee/credential-groups/components/credential-group-detail.tsx
+++ b/apps/sim/ee/credential-groups/components/credential-group-detail.tsx
@@ -9,7 +9,6 @@ import { saveDiscardActions } from '@/components/settings/save-discard-actions'
 import type { CredentialGroupEnrollment } from '@/lib/api/contracts/credential-groups'
 import { SLACK_CUSTOM_BOT_PROVIDER_ID } from '@/lib/oauth/types'
 import { UnsavedChangesModal } from '@/app/workspace/[workspaceId]/components/credential-detail'
-import { SearchSetupReturn } from '@/app/workspace/[workspaceId]/search/components/search-setup-return'
 import {
   credentialGroupPeopleSearchParam,
   credentialGroupPeopleSearchUrlKeys,
@@ -237,7 +236,6 @@ export function CredentialGroupDetail({ workspaceId, groupId }: CredentialGroupD
               : undefined
         }
       >
-        <SearchSetupReturn workspaceId={workspaceId} onNavigate={guard.guardBack} />
         {detail.error ? (
           <SettingsEmptyState tone='error'>
             {getErrorMessage(detail.error, "Couldn't load connected accounts")}
diff --git a/apps/sim/ee/sso/hooks/sso.ts b/apps/sim/ee/sso/hooks/sso.ts
index 28d399e5256..aa854c21b30 100644
--- a/apps/sim/ee/sso/hooks/sso.ts
+++ b/apps/sim/ee/sso/hooks/sso.ts
@@ -52,27 +52,18 @@ export function useSSOProviders({ enabled = true, organizationId }: UseSSOProvid
 /**
  * Configure SSO provider mutation
  */
-type ConfigureSSOParams = Record<string, unknown>
-
 export function useConfigureSSO() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: (config: ConfigureSSOParams) =>
-      requestJson(ssoRegistrationContract, {
-        body: config as SsoRegistrationBody,
-      }),
+    mutationFn: (config: SsoRegistrationBody) =>
+      requestJson(ssoRegistrationContract, { body: config }),
     onSettled: (_data, _error, variables) => {
-      const orgId = typeof variables.orgId === 'string' ? variables.orgId : undefined
       /** Awaited, so the caller navigates against a list that already holds the change. */
       return Promise.all([
         queryClient.invalidateQueries({ queryKey: ssoKeys.providers() }),
-        ...(orgId
-          ? [
-              queryClient.invalidateQueries({ queryKey: organizationKeys.detail(orgId) }),
-              queryClient.invalidateQueries({ queryKey: organizationKeys.lists() }),
-            ]
-          : []),
+        queryClient.invalidateQueries({ queryKey: organizationKeys.detail(variables.orgId) }),
+        queryClient.invalidateQueries({ queryKey: organizationKeys.lists() }),
       ])
     },
   })
diff --git a/apps/sim/executor/handlers/workflow/workflow-handler.ts b/apps/sim/executor/handlers/workflow/workflow-handler.ts
index 3eb08c62779..961606ac8a1 100644
--- a/apps/sim/executor/handlers/workflow/workflow-handler.ts
+++ b/apps/sim/executor/handlers/workflow/workflow-handler.ts
@@ -5,6 +5,7 @@ import { isRecordLike } from '@sim/utils/object'
 import type { Variable, WorkflowState } from '@sim/workflow-types/workflow'
 import { resolveBillingAttribution } from '@/lib/billing/core/billing-attribution'
 import { getExecutionDeadlineAt } from '@/lib/core/execution-limits'
+import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import { asOrchestrationError } from '@/lib/core/orchestration/types'
 import { getExecutionEnvironment } from '@/lib/environment/utils'
 import { buildNextCallChain, validateCallChain } from '@/lib/execution/call-chain'
@@ -908,7 +909,10 @@ export class WorkflowBlockHandler implements BlockHandler {
 
       const startTime = performance.now()
 
-      const result = await subExecutor.execute(workflowId)
+      const executeChild = () => subExecutor.execute(workflowId)
+      const result = await (isCustomBlock
+        ? withResourceOutboundScope({ workspaceId: childWorkspaceId }, executeChild)
+        : executeChild())
       const executionResult = this.toExecutionResult(result)
       const duration = performance.now() - startTime
 
diff --git a/apps/sim/hooks/queries/kb/connectors.test.ts b/apps/sim/hooks/queries/kb/connectors.test.ts
index cba05e736ad..ae98455db5a 100644
--- a/apps/sim/hooks/queries/kb/connectors.test.ts
+++ b/apps/sim/hooks/queries/kb/connectors.test.ts
@@ -52,7 +52,6 @@ import {
   CONNECTOR_SYNC_POLL_INTERVAL_MS,
   connectorKeys,
   isConnectorSyncingOrPending,
-  memberConnectorKeys,
   useConnectorDetail,
   useConnectorDocuments,
   useConnectorList,
@@ -60,26 +59,10 @@ import {
   useSearchSources,
   useTriggerSync,
   useUpdateConnector,
-  type WorkspaceMemberConnector,
 } from '@/hooks/queries/kb/connectors'
 
 const KB_ID = 'kb-1'
 
-function makeMemberConnector(
-  overrides: Partial<WorkspaceMemberConnector> = {}
-): WorkspaceMemberConnector {
-  return {
-    knowledgeBaseId: KB_ID,
-    knowledgeBaseName: 'Sim Search',
-    connectorId: 'connector-1',
-    connectorType: 'hubspot',
-    memberSyncStatus: 'idle',
-    viewerMembership: 'connected',
-    viewerDocumentCount: 0,
-    ...overrides,
-  }
-}
-
 function makeConnector(overrides: Partial<ConnectorData> = {}): ConnectorData {
   return {
     id: 'connector-1',
@@ -331,61 +314,6 @@ describe('useTriggerSync optimistic state', () => {
     })
     expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: searchSourceKeys.lists() })
   })
-
-  it('queues a members connector in the workspace member-connector list as well', async () => {
-    const existing = [
-      makeConnector({ id: 'connector-1', accessMode: 'members', memberSyncStatus: 'idle' }),
-    ]
-    mocks.getQueryData.mockReturnValue(existing)
-
-    useTriggerSync()
-    const options = capturedMutationOptions()
-    const context = await options.onMutate({ knowledgeBaseId: KB_ID, connectorId: 'connector-1' })
-
-    expect(mocks.setQueriesData).toHaveBeenCalledWith(
-      { queryKey: memberConnectorKeys.lists() },
-      expect.any(Function)
-    )
-    const patchMemberList = mocks.setQueriesData.mock.calls.at(-1)?.[1] as (
-      connectors: WorkspaceMemberConnector[] | undefined
-    ) => WorkspaceMemberConnector[] | undefined
-    const memberList = [
-      makeMemberConnector({ connectorId: 'connector-1', memberSyncStatus: 'idle' }),
-      makeMemberConnector({ connectorId: 'connector-2', memberSyncStatus: 'idle' }),
-    ]
-    expect(patchMemberList(memberList)?.map((c) => c.memberSyncStatus)).toEqual(['pending', 'idle'])
-    expect(patchMemberList(undefined)).toBeUndefined()
-
-    options.onError(
-      new Error('boom'),
-      { knowledgeBaseId: KB_ID, connectorId: 'connector-1' },
-      context
-    )
-    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
-      queryKey: memberConnectorKeys.lists(),
-    })
-  })
-
-  it('leaves the workspace member-connector list alone for a workspace connector', async () => {
-    mocks.getQueryData.mockReturnValue([makeConnector({ status: 'active' })])
-
-    useTriggerSync()
-    const options = capturedMutationOptions()
-    const context = await options.onMutate({ knowledgeBaseId: KB_ID, connectorId: 'connector-1' })
-    options.onError(
-      new Error('boom'),
-      { knowledgeBaseId: KB_ID, connectorId: 'connector-1' },
-      context
-    )
-
-    expect(mocks.setQueriesData).not.toHaveBeenCalledWith(
-      { queryKey: memberConnectorKeys.lists() },
-      expect.any(Function)
-    )
-    expect(mocks.invalidateQueries).not.toHaveBeenCalledWith({
-      queryKey: memberConnectorKeys.lists(),
-    })
-  })
 })
 
 describe('direct source detail mutation state', () => {
@@ -457,11 +385,6 @@ describe('direct source detail mutation state', () => {
       mocks.setQueryData.mockClear()
       mutation.onError(new Error('Sync refused'), variables, previous)
       expect(detailUpdater()(queued)).toEqual(detail)
-      if (accessMode === 'members') {
-        expect(mocks.invalidateQueries).toHaveBeenCalledWith({
-          queryKey: memberConnectorKeys.lists(),
-        })
-      }
     }
   )
 
@@ -493,10 +416,6 @@ describe('direct source detail mutation state', () => {
       useTriggerSync()
       expect(await capturedMutation().onMutate(variables)).toBeUndefined()
       expect(mocks.setQueryData).not.toHaveBeenCalled()
-      expect(mocks.setQueriesData).not.toHaveBeenCalledWith(
-        { queryKey: memberConnectorKeys.lists() },
-        expect.any(Function)
-      )
     }
   )
 
diff --git a/apps/sim/hooks/queries/kb/connectors.ts b/apps/sim/hooks/queries/kb/connectors.ts
index f0c284635f2..66d5fee637c 100644
--- a/apps/sim/hooks/queries/kb/connectors.ts
+++ b/apps/sim/hooks/queries/kb/connectors.ts
@@ -21,7 +21,6 @@ import {
   listKnowledgeConnectorDocumentsContract,
   listKnowledgeConnectorsContract,
   listSearchSourcesContract,
-  listWorkspaceMemberConnectorsContract,
   type MemberSyncLogData,
   patchKnowledgeConnectorDocumentsContract,
   type SearchSourceSummary,
@@ -33,7 +32,6 @@ import {
   updateKnowledgeConnectorAccessContract,
   updateKnowledgeConnectorContract,
   type ViewerConnectorMembership,
-  type WorkspaceMemberConnector,
 } from '@/lib/api/contracts/knowledge'
 import type {
   CreateConnectorBody,
@@ -70,7 +68,6 @@ import { searchSourceKeys } from '@/hooks/queries/utils/search-source-keys'
 export type {
   SearchSourceSummary,
   ViewerConnectorMembership,
-  WorkspaceMemberConnector,
   ConnectorData,
   ConnectorDetailData,
   ConnectorMemberSummary,
@@ -266,10 +263,7 @@ function optimisticallySetConnectorStatus(
 /**
  * The optimistic "queued" write for a sync trigger, on whichever engine the
  * connector runs: a members connector queues a member run, so its content
- * status must not flip. The Search surface reads the same member sync status
- * from the workspace member-connector list, so that cache is queued too; it
- * has no poll to reconcile it, and the write cannot stop one, so it is patched
- * rather than refetched. Returns what to restore if the trigger is refused.
+ * status must not flip. Returns what to restore if the trigger is refused.
  */
 function optimisticallyQueueSync(
   queryClient: QueryClient,
@@ -282,15 +276,6 @@ function optimisticallyQueueSync(
     setCachedConnectorStatus(queryClient, knowledgeBaseId, connectorId, {
       memberSyncStatus: 'pending',
     })
-    queryClient.setQueriesData<WorkspaceMemberConnector[]>(
-      { queryKey: memberConnectorKeys.lists() },
-      (connectors) =>
-        connectors?.map((connector) =>
-          connector.connectorId === connectorId
-            ? { ...connector, memberSyncStatus: 'pending' }
-            : connector
-        )
-    )
     return { memberSyncStatus: cached.memberSyncStatus }
   }
   setCachedConnectorStatus(queryClient, knowledgeBaseId, connectorId, { status: 'pending' })
@@ -332,7 +317,6 @@ export function useCreateConnector() {
     onSettled: (_data, _error, { knowledgeBaseId }) => {
       queryClient.invalidateQueries({ queryKey: connectorKeys.all(knowledgeBaseId) })
       queryClient.invalidateQueries({ queryKey: knowledgeKeys.lists() })
-      queryClient.invalidateQueries({ queryKey: memberConnectorKeys.lists() })
       queryClient.invalidateQueries({ queryKey: searchSourceKeys.lists() })
       queryClient.invalidateQueries({ queryKey: searchIntegrationKeys.lists() })
       void invalidateConnectorAccounts(queryClient)
@@ -613,49 +597,6 @@ export function useSearchSources(
   return summary
 }
 
-export const memberConnectorKeys = {
-  all: ['member-connectors'] as const,
-  lists: () => [...memberConnectorKeys.all, 'list'] as const,
-  list: (workspaceId?: string) => [...memberConnectorKeys.lists(), workspaceId ?? ''] as const,
-}
-
-export const WORKSPACE_MEMBER_CONNECTORS_STALE_TIME = 30 * 1000
-/** While a connected source is still indexing for the viewer, its state is worth asking for again. */
-const WORKSPACE_MEMBER_CONNECTORS_INDEXING_POLL_MS = 5 * 1000
-
-async function fetchWorkspaceMemberConnectors(
-  workspaceId: string,
-  signal?: AbortSignal
-): Promise<WorkspaceMemberConnector[]> {
-  const response = await requestJson(listWorkspaceMemberConnectorsContract, {
-    query: { workspaceId },
-    signal,
-  })
-  return response.data
-}
-
-/** Workspace sources that let the viewer connect their own account. */
-export function useWorkspaceMemberConnectors(
-  workspaceId?: string,
-  options?: { enabled?: boolean }
-) {
-  return useQuery({
-    queryKey: memberConnectorKeys.list(workspaceId),
-    queryFn: ({ signal }) => fetchWorkspaceMemberConnectors(workspaceId as string, signal),
-    enabled: Boolean(workspaceId) && (options?.enabled ?? true),
-    staleTime: WORKSPACE_MEMBER_CONNECTORS_STALE_TIME,
-    refetchInterval: (query) =>
-      query.state.data?.some(
-        (connector) =>
-          connector.viewerMembership === 'connected' &&
-          (connector.memberSyncStatus === 'pending' || connector.memberSyncStatus === 'running')
-      )
-        ? WORKSPACE_MEMBER_CONNECTORS_INDEXING_POLL_MS
-        : false,
-    placeholderData: keepPreviousData,
-  })
-}
-
 /** Mints the viewer's enrollment link for a per-member connector; the caller navigates to it. */
 export function useStartConnectorMemberEnrollment() {
   const queryClient = useQueryClient()
@@ -690,9 +631,7 @@ export function useUpdateConnectorAccess() {
         queryKey: knowledgeKeys.detail(knowledgeBaseId),
         exact: true,
       })
-      /** The base list says whether any connector syncs per member, and the Search tab lists them. */
       queryClient.invalidateQueries({ queryKey: knowledgeKeys.lists() })
-      queryClient.invalidateQueries({ queryKey: memberConnectorKeys.lists() })
       queryClient.invalidateQueries({ queryKey: searchSourceKeys.lists() })
       queryClient.invalidateQueries({ queryKey: searchIntegrationKeys.lists() })
       queryClient.invalidateQueries({ queryKey: knowledgeKeys.searches() })
@@ -731,7 +670,6 @@ export function useDeleteConnector() {
      */
     onSettled: (_data, _error, { knowledgeBaseId, deleteDocuments }) => {
       queryClient.invalidateQueries({ queryKey: connectorKeys.all(knowledgeBaseId) })
-      queryClient.invalidateQueries({ queryKey: memberConnectorKeys.lists() })
       queryClient.invalidateQueries({ queryKey: searchSourceKeys.lists() })
       queryClient.invalidateQueries({ queryKey: searchIntegrationKeys.lists() })
       queryClient.invalidateQueries({ queryKey: knowledgeKeys.documentLists(knowledgeBaseId) })
@@ -757,18 +695,12 @@ export function useDeleteConnector() {
 interface TriggerSyncParams {
   knowledgeBaseId: string
   connectorId: string
-  /** Force re-hydration + re-index of rendered content (the "Full resync" action). */
-  rehydrate?: boolean
 }
 
-async function triggerSync({
-  knowledgeBaseId,
-  connectorId,
-  rehydrate,
-}: TriggerSyncParams): Promise<void> {
+async function triggerSync({ knowledgeBaseId, connectorId }: TriggerSyncParams): Promise<void> {
   await requestJson(triggerKnowledgeConnectorSyncContract, {
     params: { id: knowledgeBaseId, connectorId },
-    query: rehydrate ? { rehydrate: true } : {},
+    query: {},
   })
 }
 
@@ -784,10 +716,7 @@ export function useTriggerSync() {
      * takes over through `pending` → `syncing` → `active`.
      */
     onMutate: async ({ knowledgeBaseId, connectorId }) => {
-      await Promise.all([
-        queryClient.cancelQueries({ queryKey: connectorKeys.all(knowledgeBaseId) }),
-        queryClient.cancelQueries({ queryKey: memberConnectorKeys.lists() }),
-      ])
+      await queryClient.cancelQueries({ queryKey: connectorKeys.all(knowledgeBaseId) })
       return optimisticallyQueueSync(queryClient, knowledgeBaseId, connectorId)
     },
     /**
@@ -799,14 +728,8 @@ export function useTriggerSync() {
       if (previous) {
         setCachedConnectorStatus(queryClient, knowledgeBaseId, connectorId, previous)
       }
-      /**
-       * The member-connector list took the same optimistic `pending`; a refetch
-       * is its rollback, and the connector list's own status was restored above,
-       * so it is not refetched over concurrent optimistic patches.
-       */
-      if (previous && 'memberSyncStatus' in previous) {
-        queryClient.invalidateQueries({ queryKey: memberConnectorKeys.lists() })
-      } else {
+      /** Preserve concurrent member sync patches after restoring this connector. */
+      if (!previous || !('memberSyncStatus' in previous)) {
         queryClient.invalidateQueries({ queryKey: connectorKeys.all(knowledgeBaseId) })
       }
     },
@@ -1055,7 +978,6 @@ export function useConnectSimSearchConnector() {
     },
     onSettled: () => {
       queryClient.invalidateQueries({ queryKey: searchIndexKeys.details() })
-      queryClient.invalidateQueries({ queryKey: memberConnectorKeys.lists() })
       queryClient.invalidateQueries({ queryKey: searchSourceKeys.lists() })
       queryClient.invalidateQueries({ queryKey: searchIntegrationKeys.lists() })
       queryClient.invalidateQueries({ queryKey: knowledgeKeys.lists() })
diff --git a/apps/sim/hooks/queries/kb/knowledge.test.ts b/apps/sim/hooks/queries/kb/knowledge.test.ts
index 2d408adf15c..71729ec1bde 100644
--- a/apps/sim/hooks/queries/kb/knowledge.test.ts
+++ b/apps/sim/hooks/queries/kb/knowledge.test.ts
@@ -132,12 +132,17 @@ describe('knowledge query placeholder scope', () => {
   })
 
   it('forwards search cancellation and leaves provider retries to the server', async () => {
-    mocks.requestJson.mockResolvedValueOnce({ data: { results: [] } })
+    const data = {
+      query: 'query',
+      results: [],
+      retrieval: { status: 'partial', timedOutLegs: ['vector'] },
+    }
+    mocks.requestJson.mockResolvedValueOnce({ data })
     const query = captureQuery(() =>
       useWorkspaceKnowledgeSearch('workspace-1', ' query ', { source: 'slack' })
     )
     const controller = new AbortController()
-    await query.queryFn({ signal: controller.signal })
+    await expect(query.queryFn({ signal: controller.signal })).resolves.toEqual(data)
 
     expect(query.retry).toBe(false)
     expect(mocks.requestJson).toHaveBeenLastCalledWith(
diff --git a/apps/sim/hooks/queries/kb/knowledge.ts b/apps/sim/hooks/queries/kb/knowledge.ts
index 5870972170e..bb0a023bcda 100644
--- a/apps/sim/hooks/queries/kb/knowledge.ts
+++ b/apps/sim/hooks/queries/kb/knowledge.ts
@@ -52,7 +52,7 @@ import {
   updateKnowledgeDocumentContract,
   updateKnowledgeDocumentTagsContract,
   type WorkspaceKnowledgeSearchBody,
-  type WorkspaceKnowledgeSearchResult,
+  type WorkspaceKnowledgeSearchData,
 } from '@/lib/api/contracts/knowledge'
 import type { WorkspaceSearchFilters } from '@/lib/api/contracts/knowledge/search'
 import type { ChunkingStrategy, StrategyOptions } from '@/lib/chunkers/types'
@@ -1197,9 +1197,9 @@ export function useBulkDeleteKnowledgeBases(workspaceId: string) {
 async function searchWorkspaceKnowledge(
   body: WorkspaceKnowledgeSearchBody,
   signal?: AbortSignal
-): Promise<WorkspaceKnowledgeSearchResult[]> {
+): Promise<WorkspaceKnowledgeSearchData> {
   const data = await requestJson(searchWorkspaceKnowledgeContract, { body, signal })
-  return data.data.results
+  return data.data
 }
 
 /** Searches the canonical index under the signed-in person's ACLs. */
diff --git a/apps/sim/hooks/queries/organization-network.ts b/apps/sim/hooks/queries/organization-network.ts
new file mode 100644
index 00000000000..12d34343cff
--- /dev/null
+++ b/apps/sim/hooks/queries/organization-network.ts
@@ -0,0 +1,22 @@
+import { useQuery } from '@tanstack/react-query'
+import { requestJson } from '@/lib/api/client/request'
+import { getOrganizationNetworkContract } from '@/lib/api/contracts/organization-network'
+
+export const ORGANIZATION_NETWORK_STALE_TIME = 30_000
+
+export const organizationNetworkKeys = {
+  all: ['organization-network'] as const,
+  details: () => [...organizationNetworkKeys.all, 'detail'] as const,
+  detail: (organizationId: string) =>
+    [...organizationNetworkKeys.details(), organizationId] as const,
+}
+
+export function useOrganizationNetwork(organizationId: string) {
+  return useQuery({
+    queryKey: organizationNetworkKeys.detail(organizationId),
+    queryFn: ({ signal }) =>
+      requestJson(getOrganizationNetworkContract, { params: { id: organizationId }, signal }),
+    enabled: Boolean(organizationId),
+    staleTime: ORGANIZATION_NETWORK_STALE_TIME,
+  })
+}
diff --git a/apps/sim/hooks/queries/personal-source-setup.ts b/apps/sim/hooks/queries/personal-source-setup.ts
index 25a3e0598a6..645b8bd8c97 100644
--- a/apps/sim/hooks/queries/personal-source-setup.ts
+++ b/apps/sim/hooks/queries/personal-source-setup.ts
@@ -8,7 +8,6 @@ import {
   type PersonalSourceSetupQuery,
   personalSourceSetupContract,
 } from '@/lib/api/contracts/knowledge/personal-source-setup'
-import { memberConnectorKeys } from '@/hooks/queries/kb/connectors'
 import { organizationAccountsKeys } from '@/hooks/queries/organization-accounts'
 import { personalSearchIntegrationKeys } from '@/hooks/queries/personal-search-integrations'
 import { searchSourceKeys } from '@/hooks/queries/utils/search-source-keys'
@@ -54,7 +53,6 @@ export function useConnectPersonalSourceSetup() {
       Promise.all([
         client.invalidateQueries({ queryKey: personalSourceSetupKeys.lists() }),
         client.invalidateQueries({ queryKey: personalSearchIntegrationKeys.lists() }),
-        client.invalidateQueries({ queryKey: memberConnectorKeys.lists() }),
         client.invalidateQueries({
           queryKey: searchSourceKeys.list({
             kind: 'organization',
diff --git a/apps/sim/hooks/use-collaborative-workflow.ts b/apps/sim/hooks/use-collaborative-workflow.ts
index eb70e2f9089..85a63969fe1 100644
--- a/apps/sim/hooks/use-collaborative-workflow.ts
+++ b/apps/sim/hooks/use-collaborative-workflow.ts
@@ -59,6 +59,18 @@ import { findAllDescendantNodes, isBlockProtected } from '@/stores/workflows/wor
 
 const logger = createLogger('CollaborativeWorkflow')
 
+/** Applies a subblock value and its block's replacement `canonicalModes` to the local stores. */
+function applySubblockValueWithCanonicalModes(
+  blockId: string,
+  subblockId: string,
+  value: unknown,
+  canonicalModes: Record<string, 'basic' | 'advanced'>
+) {
+  useSubBlockStore.getState().setValue(blockId, subblockId, value)
+  useWorkflowStore.getState().syncDynamicHandleSubblockValue(blockId, subblockId, value)
+  useWorkflowStore.getState().setBlockCanonicalModes(blockId, canonicalModes)
+}
+
 export function useCollaborativeWorkflow() {
   const queryClient = useQueryClient()
   const undoRedo = useUndoRedo()
@@ -259,6 +271,11 @@ export function useCollaborativeWorkflow() {
           }
         } else if (target === OPERATION_TARGETS.SUBBLOCK) {
           switch (operation) {
+            case SUBBLOCK_OPERATIONS.UPDATE_WITH_CANONICAL_MODES: {
+              const { blockId, subblockId, value, canonicalModes } = payload
+              applySubblockValueWithCanonicalModes(blockId, subblockId, value, canonicalModes)
+              break
+            }
             case SUBBLOCK_OPERATIONS.BATCH_UPDATE: {
               const { updates } = payload
               if (Array.isArray(updates)) {
@@ -1362,39 +1379,6 @@ export function useCollaborativeWorkflow() {
     [isBaselineDiffView, activeWorkflowId, addToQueue, session?.user?.id]
   )
 
-  /**
-   * Wholesale-replaces `block.data.canonicalModes`, rather than merging one key like
-   * {@link collaborativeSetBlockCanonicalMode}. Needed to reindex nested tool-input overrides on
-   * reorder/removal: a merge can't atomically drop a now-stale index key, and sequential
-   * per-key sets can clobber each other when two tools swap positions.
-   */
-  const collaborativeSetBlockCanonicalModes = useCallback(
-    (id: string, canonicalModes: Record<string, 'basic' | 'advanced'>) => {
-      if (isBaselineDiffView) {
-        return
-      }
-
-      useWorkflowStore.getState().setBlockCanonicalModes(id, canonicalModes)
-
-      if (!activeWorkflowId) {
-        return
-      }
-
-      const operationId = generateId()
-      addToQueue({
-        id: operationId,
-        operation: {
-          operation: BLOCK_OPERATIONS.REPLACE_CANONICAL_MODES,
-          target: OPERATION_TARGETS.BLOCK,
-          payload: { id, data: { canonicalModes } },
-        },
-        workflowId: activeWorkflowId,
-        userId: session?.user?.id || 'unknown',
-      })
-    },
-    [isBaselineDiffView, activeWorkflowId, addToQueue, session?.user?.id]
-  )
-
   const collaborativeBatchToggleBlockHandles = useCallback(
     (ids: string[]) => {
       if (isBaselineDiffView) {
@@ -1649,6 +1633,43 @@ export function useCollaborativeWorkflow() {
     [activeWorkflowId, addToQueue, session?.user?.id, isBaselineDiffView]
   )
 
+  /**
+   * Sets a subblock value and wholesale-replaces its block's `canonicalModes` as ONE persisted
+   * operation, so a `tool-input` reorder or removal can never save its list without the modes
+   * keyed to its positions.
+   */
+  const collaborativeSetSubblockValueWithCanonicalModes = useCallback(
+    (
+      blockId: string,
+      subblockId: string,
+      value: unknown,
+      canonicalModes: Record<string, 'basic' | 'advanced'>
+    ) => {
+      if (isApplyingRemoteChange.current) return
+
+      if (isBaselineDiffView) {
+        logger.debug('Skipping collaborative subblock update while viewing baseline diff')
+        return
+      }
+
+      applySubblockValueWithCanonicalModes(blockId, subblockId, value, canonicalModes)
+
+      if (!activeWorkflowId) return
+
+      addToQueue({
+        id: generateId(),
+        operation: {
+          operation: SUBBLOCK_OPERATIONS.UPDATE_WITH_CANONICAL_MODES,
+          target: OPERATION_TARGETS.SUBBLOCK,
+          payload: { blockId, subblockId, value, canonicalModes },
+        },
+        workflowId: activeWorkflowId,
+        userId: session?.user?.id || 'unknown',
+      })
+    },
+    [activeWorkflowId, addToQueue, session?.user?.id, isBaselineDiffView]
+  )
+
   const collaborativeBatchSetSubblockValues = useCallback(
     (
       updates: Array<{
@@ -2292,7 +2313,6 @@ export function useCollaborativeWorkflow() {
     collaborativeSetBlockErrorEnabled,
     collaborativeSetBlockRetry,
     collaborativeSetBlockCanonicalMode,
-    collaborativeSetBlockCanonicalModes,
     collaborativeBatchToggleBlockHandles,
     collaborativeBatchToggleLocked,
     collaborativeBatchAddBlocks,
@@ -2300,6 +2320,7 @@ export function useCollaborativeWorkflow() {
     collaborativeBatchAddEdges,
     collaborativeBatchRemoveEdges,
     collaborativeSetSubblockValue,
+    collaborativeSetSubblockValueWithCanonicalModes,
     collaborativeBatchSetSubblockValues,
     collaborativeSetTagSelection,
 
diff --git a/apps/sim/hooks/use-member-enrollment.test.tsx b/apps/sim/hooks/use-member-enrollment.test.tsx
index d279c8a818c..4dbd090da1b 100644
--- a/apps/sim/hooks/use-member-enrollment.test.tsx
+++ b/apps/sim/hooks/use-member-enrollment.test.tsx
@@ -21,7 +21,6 @@ vi.mock('@tanstack/react-query', () => ({
   useQueryClient: () => ({ invalidateQueries: mocks.invalidateQueries }),
 }))
 vi.mock('@/hooks/queries/kb/connectors', () => ({
-  memberConnectorKeys: { lists: () => ['member-connectors', 'list'] },
   useStartConnectorMemberEnrollment: () => ({
     mutate: mocks.enrollmentMutate,
     submittedAt: 0,
@@ -56,7 +55,7 @@ function Harness({
   onConnectionError?: (message: string) => void
 }) {
   latest = useMemberEnrollment({
-    membershipQueryKeys: [],
+    membershipQueryKeys: [['test-memberships']],
     connectedConnectorIds: connected,
     directOAuth,
     onConnectionError,
@@ -443,7 +442,7 @@ describe('useMemberEnrollment', () => {
     act(() => mocks.channels[0].onmessage?.(new MessageEvent('message', { data: 'connected' })))
     expect(enrollment().isAwaiting('connector-1')).toBe(false)
     expect(enrollment().error).toBeNull()
-    expect(mocks.invalidateQueries).toHaveBeenCalled()
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['test-memberships'] })
     expect(mocks.channels[0].close).toHaveBeenCalledOnce()
   })
 
diff --git a/apps/sim/hooks/use-member-enrollment.ts b/apps/sim/hooks/use-member-enrollment.ts
index 07eb32ba0dd..0b62b215c8a 100644
--- a/apps/sim/hooks/use-member-enrollment.ts
+++ b/apps/sim/hooks/use-member-enrollment.ts
@@ -4,6 +4,7 @@ import { useCallback, useEffect, useRef, useState } from 'react'
 import { createLogger } from '@sim/logger'
 import { generateId } from '@sim/utils/id'
 import { type QueryKey, useQueryClient } from '@tanstack/react-query'
+import type { WorkspaceMemberConnector } from '@/lib/api/contracts/knowledge/connectors'
 import {
   type ResourceScope,
   resourceScopeFields,
@@ -17,11 +18,9 @@ import {
 import type { MemberSyncStatus } from '@/lib/knowledge/types'
 import type { SearchConnector } from '@/lib/sim-search/connectors'
 import {
-  memberConnectorKeys,
   useConnectSimSearchConnector,
   useStartConnectorMemberEnrollment,
   type ViewerConnectorMembership,
-  type WorkspaceMemberConnector,
 } from '@/hooks/queries/kb/connectors'
 
 const logger = createLogger('MemberEnrollment')
@@ -120,8 +119,7 @@ interface UseMemberEnrollmentProps {
  * Lets the viewer connect their own account to a per-member connector, by
  * connector or by Sim Search source. Enrollment opens in a new tab, and the
  * membership queries are polled meanwhile so the surface that started it
- * updates on its own once the account is connected; the workspace-wide
- * membership list is refreshed too, so the other surface catches up as well.
+ * updates on its own once the account is connected.
  *
  * The tab is opened in the click itself, before the enrollment link is
  * minted, because a tab opened after a network round trip is outside the
@@ -158,7 +156,6 @@ export function useMemberEnrollment({
     for (const queryKey of membershipQueryKeys) {
       void queryClient.invalidateQueries({ queryKey })
     }
-    void queryClient.invalidateQueries({ queryKey: memberConnectorKeys.lists() })
   }, [membershipQueryKeys, queryClient])
 
   const clearOAuth = (completionId: string) => {
diff --git a/apps/sim/hooks/use-oauth-return-hooks.test.tsx b/apps/sim/hooks/use-oauth-return-hooks.test.tsx
index f227acf17dd..ff40379d2e5 100644
--- a/apps/sim/hooks/use-oauth-return-hooks.test.tsx
+++ b/apps/sim/hooks/use-oauth-return-hooks.test.tsx
@@ -144,7 +144,7 @@ beforeEach(() => {
     NEW_CREDENTIAL,
   ])
   sessionStorage.clear()
-  window.history.replaceState(null, '', '/workspace/workspace-1/search?addConnector=google_drive')
+  window.history.replaceState(null, '', '/o/org-1/settings/integrations?addConnector=google_drive')
   ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
   container = document.createElement('div')
   document.body.appendChild(container)
diff --git a/apps/sim/hooks/use-oauth-return.ts b/apps/sim/hooks/use-oauth-return.ts
index a40f88459b8..61c6c626a93 100644
--- a/apps/sim/hooks/use-oauth-return.ts
+++ b/apps/sim/hooks/use-oauth-return.ts
@@ -28,8 +28,8 @@ import {
 import { getDesktopBridge } from '@/lib/desktop'
 import { organizationRoutes } from '@/lib/navigation/paths'
 import { stripMicrosoftDataverseEnvironmentFromOAuthCallback } from '@/lib/oauth/microsoft-dataverse'
+import { searchSetupAccessParam } from '@/lib/sim-search/search-params'
 import { organizationSearchSetupPath } from '@/lib/sim-search/setup-navigation'
-import { searchSetupAccessParam } from '@/app/workspace/[workspaceId]/search/search-params'
 import { oauthConnectionsKeys } from '@/hooks/queries/oauth/oauth-connections'
 import {
   organizationCredentialKeys,
diff --git a/apps/sim/lib/api/contracts/auth.ts b/apps/sim/lib/api/contracts/auth.ts
index 247df754b9a..2acb8998829 100644
--- a/apps/sim/lib/api/contracts/auth.ts
+++ b/apps/sim/lib/api/contracts/auth.ts
@@ -1,4 +1,5 @@
 import { z } from 'zod'
+import { organizationIdSchema } from '@/lib/api/contracts/primitives'
 import type { ContractJsonResponse } from '@/lib/api/contracts/types'
 import { defineRouteContract } from '@/lib/api/contracts/types'
 
@@ -33,7 +34,7 @@ export const ssoRegistrationBodySchema = z.discriminatedUnion('providerType', [
     providerId: z.string().min(1, 'Provider ID is required'),
     issuer: z.string().url('Issuer must be a valid URL'),
     domain: z.string().min(1, 'Domain is required'),
-    orgId: z.string().optional(),
+    orgId: organizationIdSchema,
     jitProvisioningEnabled: z.boolean().default(true),
     mapping: ssoMappingSchema,
     clientId: z.string().min(1, 'Client ID is required for OIDC'),
@@ -61,7 +62,7 @@ export const ssoRegistrationBodySchema = z.discriminatedUnion('providerType', [
     providerId: z.string().min(1, 'Provider ID is required'),
     issuer: z.string().url('Issuer must be a valid URL'),
     domain: z.string().min(1, 'Domain is required'),
-    orgId: z.string().optional(),
+    orgId: organizationIdSchema,
     jitProvisioningEnabled: z.boolean().default(true),
     mapping: ssoMappingSchema,
     entryPoint: z.string().url('Entry point must be a valid URL for SAML'),
diff --git a/apps/sim/lib/api/contracts/copilot.ts b/apps/sim/lib/api/contracts/copilot.ts
index 7764656c753..5b57bfb830b 100644
--- a/apps/sim/lib/api/contracts/copilot.ts
+++ b/apps/sim/lib/api/contracts/copilot.ts
@@ -203,6 +203,7 @@ const storedToolCallSchema = z
     id: z.string().optional(),
     name: z.string().optional(),
     state: z.string().optional(),
+    activityDescription: z.string().optional(),
     params: z.record(z.string(), z.unknown()).optional(),
     result: z
       .object({
diff --git a/apps/sim/lib/api/contracts/knowledge/documents.ts b/apps/sim/lib/api/contracts/knowledge/documents.ts
index a5219138b05..4b586ff6765 100644
--- a/apps/sim/lib/api/contracts/knowledge/documents.ts
+++ b/apps/sim/lib/api/contracts/knowledge/documents.ts
@@ -429,8 +429,23 @@ export const readSearchDocumentResultSchema = z.object({
   knowledgeBaseId: z.string().min(1),
   documentName: z.string().nullable(),
   sourceUrl: z.string().nullable(),
-  chunks: z.array(z.object({ content: z.string(), chunkIndex: z.number().int().min(0) })).max(50),
+  chunks: z
+    .array(
+      z.object({
+        content: z.string().max(8000),
+        chunkIndex: z.number().int().min(0),
+        startOffset: z.number().int().min(0),
+        endOffset: z.number().int().min(0),
+        totalCharacters: z.number().int().min(0),
+      })
+    )
+    .max(8),
   hasMore: z.boolean(),
-  nextOffset: z.number().int().min(0).nullable(),
+  next: z
+    .object({
+      startChunkIndex: z.number().int().min(0),
+      startOffset: z.number().int().min(0),
+    })
+    .nullable(),
 })
 export type ReadSearchDocumentResult = z.output<typeof readSearchDocumentResultSchema>
diff --git a/apps/sim/lib/api/contracts/knowledge/search.ts b/apps/sim/lib/api/contracts/knowledge/search.ts
index 63c86baeaf6..912ca4690aa 100644
--- a/apps/sim/lib/api/contracts/knowledge/search.ts
+++ b/apps/sim/lib/api/contracts/knowledge/search.ts
@@ -186,6 +186,16 @@ export const workspaceKnowledgeSearchBodySchema = resourceOwnerSchema.safeExtend
 })
 export type WorkspaceKnowledgeSearchBody = z.input<typeof workspaceKnowledgeSearchBodySchema>
 
+export const workspaceKnowledgeSearchDataSchema = z.object({
+  query: z.string(),
+  results: z.array(workspaceKnowledgeSearchResultSchema),
+  retrieval: z.object({
+    status: z.enum(['complete', 'partial']),
+    timedOutLegs: z.array(z.enum(['vector', 'keyword', 'tags'])).max(3),
+  }),
+})
+export type WorkspaceKnowledgeSearchData = z.output<typeof workspaceKnowledgeSearchDataSchema>
+
 /**
  * The search a signed-in person runs from the composer: what their own
  * account may read across the workspace's knowledge bases, presented as
@@ -199,10 +209,7 @@ export const searchWorkspaceKnowledgeContract = defineRouteContract({
     mode: 'json',
     schema: z.object({
       success: z.literal(true),
-      data: z.object({
-        query: z.string(),
-        results: z.array(workspaceKnowledgeSearchResultSchema),
-      }),
+      data: workspaceKnowledgeSearchDataSchema,
     }),
   },
 })
diff --git a/apps/sim/lib/api/contracts/organization-network.ts b/apps/sim/lib/api/contracts/organization-network.ts
new file mode 100644
index 00000000000..bd82581d40a
--- /dev/null
+++ b/apps/sim/lib/api/contracts/organization-network.ts
@@ -0,0 +1,23 @@
+import { z } from 'zod'
+import { organizationIdSchema } from '@/lib/api/contracts/primitives'
+import { defineRouteContract } from '@/lib/api/contracts/types'
+import { gatewayPublicMetadataSchema } from '@/lib/core/network/gateway-metadata'
+
+export const organizationNetworkSchema = z.discriminatedUnion('mode', [
+  z.object({ mode: z.literal('direct') }),
+  z.object({
+    mode: z.literal('gateway'),
+    publicIps: gatewayPublicMetadataSchema.shape.publicIps,
+  }),
+  z.object({ mode: z.literal('blocked') }),
+  z.object({ mode: z.literal('unavailable') }),
+])
+
+export const getOrganizationNetworkContract = defineRouteContract({
+  method: 'GET',
+  path: '/api/organizations/[id]/network',
+  params: z.object({ id: organizationIdSchema }),
+  response: { mode: 'json', schema: organizationNetworkSchema },
+})
+
+export type OrganizationNetwork = z.output<typeof organizationNetworkSchema>
diff --git a/apps/sim/lib/auth/auth.ts b/apps/sim/lib/auth/auth.ts
index ace5b81ed3a..f5c839f6c8e 100644
--- a/apps/sim/lib/auth/auth.ts
+++ b/apps/sim/lib/auth/auth.ts
@@ -1350,9 +1350,10 @@ export const auth = betterAuth({
              * `email_verified` claim substitutes for the domain binding
              * entirely: an IdP could assert any address — including one from a
              * domain it does not own — and auto-link into that user's existing
-             * account. Since a provider row can be registered by any Enterprise
-             * org admin (and by any signed-in user when self-hosted), trusting
-             * the claim makes every account reachable from any tenant's IdP.
+             * account. Since a provider row can be registered by any
+             * organization owner or admin (or by an operator via the register
+             * script), trusting the claim makes every account reachable from
+             * any tenant's IdP.
              *
              * Turning it on only ever set `emailVerified` on the local row; it
              * was never what made linking work. Entra omits the claim, and SAML
diff --git a/apps/sim/lib/auth/sign-out.test.ts b/apps/sim/lib/auth/sign-out.test.ts
new file mode 100644
index 00000000000..e580005abe8
--- /dev/null
+++ b/apps/sim/lib/auth/sign-out.test.ts
@@ -0,0 +1,46 @@
+/**
+ * @vitest-environment node
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({ signOut: vi.fn(), clearUserData: vi.fn() }))
+vi.mock('@/lib/auth/auth-client', () => ({ signOut: mocks.signOut }))
+vi.mock('@/stores', () => ({ clearUserData: mocks.clearUserData }))
+
+import { signOutAndRedirect } from '@/lib/auth/sign-out'
+
+const navigate = vi.fn()
+const assign = vi.fn()
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.signOut.mockResolvedValue(undefined)
+  mocks.clearUserData.mockResolvedValue(true)
+  vi.stubGlobal('window', { location: { assign } })
+})
+afterEach(() => vi.unstubAllGlobals())
+
+describe('signOutAndRedirect', () => {
+  it('ends the session and clears user state before navigating in-app', async () => {
+    await signOutAndRedirect(navigate)
+    expect(mocks.signOut).toHaveBeenCalledOnce()
+    expect(mocks.clearUserData).toHaveBeenCalledOnce()
+    expect(navigate).toHaveBeenCalledWith('/login?fromLogout=true')
+    expect(assign).not.toHaveBeenCalled()
+  })
+
+  it('reloads when in-memory state could not be cleared', async () => {
+    mocks.clearUserData.mockResolvedValue(false)
+    await signOutAndRedirect(navigate)
+    expect(navigate).not.toHaveBeenCalled()
+    expect(assign).toHaveBeenCalledWith('/login?fromLogout=true')
+  })
+
+  it('reloads on sign-out failure and still attempts to clear user state', async () => {
+    mocks.signOut.mockRejectedValue(new Error('offline'))
+    await signOutAndRedirect(navigate)
+    expect(mocks.clearUserData).toHaveBeenCalledOnce()
+    expect(navigate).not.toHaveBeenCalled()
+    expect(assign).toHaveBeenCalledWith('/login?fromLogout=true')
+  })
+})
diff --git a/apps/sim/lib/auth/sign-out.ts b/apps/sim/lib/auth/sign-out.ts
new file mode 100644
index 00000000000..4f0e4927446
--- /dev/null
+++ b/apps/sim/lib/auth/sign-out.ts
@@ -0,0 +1,21 @@
+import { createLogger } from '@sim/logger'
+import { signOut } from '@/lib/auth/auth-client'
+import { clearUserData } from '@/stores'
+
+const logger = createLogger('SignOut')
+
+/** Reloads the page if any in-memory user state could not be cleared. */
+export async function signOutAndRedirect(navigate: (href: string) => void): Promise<void> {
+  const logoutUrl = '/login?fromLogout=true'
+  let canNavigateInApp = false
+
+  try {
+    const [, inMemoryResetSucceeded] = await Promise.all([signOut(), clearUserData()])
+    canNavigateInApp = inMemoryResetSucceeded
+  } catch (error) {
+    logger.error('Error signing out:', { error })
+  }
+
+  if (canNavigateInApp) navigate(logoutUrl)
+  else window.location.assign(logoutUrl)
+}
diff --git a/apps/sim/lib/copilot/chat/display-message.ts b/apps/sim/lib/copilot/chat/display-message.ts
index cce57fe0b7b..d185f2b27a1 100644
--- a/apps/sim/lib/copilot/chat/display-message.ts
+++ b/apps/sim/lib/copilot/chat/display-message.ts
@@ -5,6 +5,7 @@ import {
   MothershipStreamV1ToolOutcome,
 } from '@/lib/copilot/generated/mothership-stream-v1'
 import { isToolHiddenInUi } from '@/lib/copilot/tools/client/hidden-tools'
+import { normalizeToolActivityDescription } from '@/lib/copilot/tools/tool-display'
 import {
   type ChatContextKind,
   type ChatMessage,
@@ -38,11 +39,13 @@ function toToolCallInfo(block: PersistedContentBlock): ToolCallInfo | undefined
   if (!tc) return undefined
   if (isToolHiddenInUi(tc.name)) return undefined
   const status: ToolCallStatus = STATE_TO_STATUS[tc.state] ?? ToolCallStatus.error
+  const activityDescription = normalizeToolActivityDescription(tc.activityDescription)
   return {
     id: tc.id,
     name: tc.name,
     status,
     displayTitle: status === ToolCallStatus.cancelled ? 'Stopped by user' : tc.display?.title,
+    ...(activityDescription ? { activityDescription } : {}),
     params: tc.params,
     calledBy: tc.calledBy,
     result: tc.result,
diff --git a/apps/sim/lib/copilot/chat/effective-transcript.test.ts b/apps/sim/lib/copilot/chat/effective-transcript.test.ts
index c525a2cc81d..92672da3382 100644
--- a/apps/sim/lib/copilot/chat/effective-transcript.test.ts
+++ b/apps/sim/lib/copilot/chat/effective-transcript.test.ts
@@ -39,6 +39,70 @@ function buildUserMessage(id: string, content: string) {
 }
 
 describe('buildEffectiveChatTranscript', () => {
+  it.each(['main', 'subagent'] as const)(
+    'retains each %s activity description when reconstructing live history',
+    (lane) => {
+      const scope =
+        lane === 'subagent'
+          ? {
+              lane,
+              spanId: 'browser-span',
+              parentSpanId: 'main',
+              parentToolCallId: 'browser-parent',
+              agentId: 'browser',
+            }
+          : undefined
+      const call = (seq: number, toolCallId: string, activityDescription?: string) =>
+        toBatchEvent(seq, {
+          v: 1,
+          seq,
+          ts: new Date(seq).toISOString(),
+          type: MothershipStreamV1EventType.tool,
+          stream: { streamId: 'stream-1' },
+          scope,
+          payload: {
+            phase: 'call',
+            executor: 'go',
+            mode: 'sync',
+            toolCallId,
+            toolName: 'browser_click',
+            arguments: { ref: toolCallId },
+            activityDescription,
+          },
+        })
+      const result = buildEffectiveChatTranscript({
+        messages: [buildUserMessage('stream-1', 'Open the project settings')],
+        activeStreamId: 'stream-1',
+        streamSnapshot: {
+          events: [
+            call(1, 'menu-call', 'Opening the project menu'),
+            call(2, 'settings-call', 'Opening the settings page'),
+            call(3, 'menu-call'),
+          ],
+          previewSessions: [],
+          status: 'active',
+        },
+      })
+      const tools = result[1].contentBlocks
+        ?.filter((block) => block.toolCall)
+        .map((block) => block.toolCall)
+      expect(tools).toEqual([
+        expect.objectContaining({
+          id: 'menu-call',
+          activityDescription: 'Opening the project menu',
+          display: { title: 'Opening the project menu' },
+          params: { ref: 'menu-call' },
+        }),
+        expect.objectContaining({
+          id: 'settings-call',
+          activityDescription: 'Opening the settings page',
+          display: { title: 'Opening the settings page' },
+          params: { ref: 'settings-call' },
+        }),
+      ])
+    }
+  )
+
   it('returns the existing transcript when the stream owner is no longer the trailing user', () => {
     const messages = [
       buildUserMessage('stream-1', 'Hello'),
diff --git a/apps/sim/lib/copilot/chat/effective-transcript.ts b/apps/sim/lib/copilot/chat/effective-transcript.ts
index fd1e4423590..882ef7557a2 100644
--- a/apps/sim/lib/copilot/chat/effective-transcript.ts
+++ b/apps/sim/lib/copilot/chat/effective-transcript.ts
@@ -18,6 +18,7 @@ import type { StreamBatchEvent } from '@/lib/copilot/request/session/types'
 import {
   CONTEXT_COMPACTION_DISPLAY_TITLE,
   getToolDisplayTitle,
+  normalizeToolActivityDescription,
 } from '@/lib/copilot/tools/tool-display'
 
 interface StreamSnapshotLike {
@@ -187,6 +188,7 @@ function buildLiveAssistantMessage(params: {
     spanId?: string
     parentSpanId?: string
     displayTitle?: string
+    activityDescription?: string
     params?: Record<string, unknown>
     result?: { success: boolean; output?: unknown; error?: string }
     state?: string
@@ -199,6 +201,10 @@ function buildLiveAssistantMessage(params: {
     if (existingIndex !== undefined) {
       const existing = blocks[existingIndex]
       const existingToolCall = asPayloadRecord(existing.toolCall)
+      const activityDescription =
+        normalizeToolActivityDescription(existingToolCall?.activityDescription) ??
+        input.activityDescription
+      const displayTitle = activityDescription ?? input.displayTitle
       existing.toolCall = {
         ...(existingToolCall ?? {}),
         id: input.toolCallId,
@@ -209,10 +215,11 @@ function buildLiveAssistantMessage(params: {
         ...(ownershipWritable && input.calledBy ? { calledBy: input.calledBy } : {}),
         ...(input.params ? { params: input.params } : {}),
         ...(input.result ? { result: input.result } : {}),
-        ...(input.displayTitle
+        ...(activityDescription ? { activityDescription } : {}),
+        ...(displayTitle
           ? {
               display: {
-                title: input.displayTitle,
+                title: displayTitle,
               },
             }
           : existingToolCall?.display
@@ -247,6 +254,7 @@ function buildLiveAssistantMessage(params: {
         ...(input.calledBy ? { calledBy: input.calledBy } : {}),
         ...(input.params ? { params: input.params } : {}),
         ...(input.result ? { result: input.result } : {}),
+        ...(input.activityDescription ? { activityDescription: input.activityDescription } : {}),
         ...(input.displayTitle
           ? {
               display: {
@@ -366,16 +374,20 @@ function buildLiveAssistantMessage(params: {
           continue
         }
 
+        const activityDescription = normalizeToolActivityDescription(payload.activityDescription)
         ensureToolBlock({
           toolCallId,
           toolName: payload.toolName,
+          activityDescription,
           calledBy: scopedSubagent,
           ...(parentForBlock ? { parentToolCallId: parentForBlock } : {}),
           ...spanIdentity,
-          displayTitle: getToolDisplayTitle(
-            payload.toolName,
-            isRecordLike(payload.arguments) ? payload.arguments : undefined
-          ),
+          displayTitle:
+            activityDescription ??
+            getToolDisplayTitle(
+              payload.toolName,
+              isRecordLike(payload.arguments) ? payload.arguments : undefined
+            ),
           params: isRecordLike(payload.arguments) ? payload.arguments : undefined,
           state: typeof payload.status === 'string' ? payload.status : 'executing',
           isCallFrame: payload.phase === MothershipStreamV1ToolPhase.call,
diff --git a/apps/sim/lib/copilot/chat/persisted-message.test.ts b/apps/sim/lib/copilot/chat/persisted-message.test.ts
index 71a3f292156..015be248d1b 100644
--- a/apps/sim/lib/copilot/chat/persisted-message.test.ts
+++ b/apps/sim/lib/copilot/chat/persisted-message.test.ts
@@ -3,6 +3,7 @@
  */
 
 import { describe, expect, it } from 'vitest'
+import { copilotChatStopBodySchema } from '@/lib/api/contracts/copilot'
 import { toDisplayMessage } from '@/lib/copilot/chat/display-message'
 import type { OrchestratorResult } from '@/lib/copilot/request/types'
 import { resolveMessageCitations } from '@/app/workspace/[workspaceId]/home/components/message-content/resolve-citations'
@@ -15,6 +16,86 @@ import {
 } from './persisted-message'
 
 describe('persisted-message', () => {
+  it.each(['success', 'cancelled'] as const)(
+    'preserves model-authored activity metadata through persisted %s history and stop validation',
+    (status) => {
+      const result: OrchestratorResult = {
+        success: true,
+        content: '',
+        toolCalls: [],
+        contentBlocks: [
+          {
+            type: 'tool_call',
+            timestamp: 1,
+            toolCall: {
+              id: 'activity-call',
+              name: 'read',
+              status,
+              activityDescription: '  Checking   the project setup  ',
+              displayTitle: 'Checking the project setup',
+              params: { path: 'WORKSPACE.md' },
+            },
+          },
+        ],
+      }
+      const persisted = buildPersistedAssistantMessage(result)
+      const stopped = copilotChatStopBodySchema.parse({
+        chatId: 'chat-1',
+        streamId: 'stream-1',
+        content: '',
+        contentBlocks: persisted.contentBlocks,
+      })
+      expect(stopped.contentBlocks?.[0].toolCall?.activityDescription).toBe(
+        'Checking the project setup'
+      )
+      const display = toDisplayMessage(
+        normalizeMessage(persisted as unknown as Record<string, unknown>)
+      )
+      expect(display.contentBlocks?.[0].toolCall).toMatchObject({
+        status,
+        activityDescription: 'Checking the project setup',
+        params: { path: 'WORKSPACE.md' },
+      })
+    }
+  )
+
+  it('preserves activity metadata on legacy tool blocks without inferring it from old titles', () => {
+    const message = normalizeMessage({
+      id: 'message-1',
+      role: 'assistant',
+      content: '',
+      contentBlocks: [
+        {
+          type: 'tool_call',
+          toolCall: {
+            id: 'activity-call',
+            name: 'read',
+            state: 'success',
+            activityDescription: 'Checking the project setup',
+            display: { title: 'Checking the project setup' },
+          },
+        },
+        {
+          type: 'tool_call',
+          toolCall: {
+            id: 'legacy-call',
+            name: 'gmail_read_v2',
+            state: 'success',
+            display: { title: 'Read recent emails' },
+          },
+        },
+      ],
+    })
+    const display = toDisplayMessage(message)
+    expect(display.contentBlocks?.[0].toolCall?.activityDescription).toBe(
+      'Checking the project setup'
+    )
+    expect(display.contentBlocks?.[1].toolCall).toMatchObject({
+      displayTitle: 'Read recent emails',
+    })
+    expect(display.contentBlocks?.[1].toolCall?.activityDescription).toBeUndefined()
+  })
+
   it('round-trips canonical tool blocks through normalizeMessage', () => {
     const blockTimestamp = 1_700_000_000_000
     const result: OrchestratorResult = {
diff --git a/apps/sim/lib/copilot/chat/persisted-message.ts b/apps/sim/lib/copilot/chat/persisted-message.ts
index 85db3536dc6..8a01e6ab60c 100644
--- a/apps/sim/lib/copilot/chat/persisted-message.ts
+++ b/apps/sim/lib/copilot/chat/persisted-message.ts
@@ -22,6 +22,7 @@ import type {
   OrchestratorResult,
 } from '@/lib/copilot/request/types'
 import { RETIRED_BROWSER_REQUEST_TAKEOVER_ID } from '@/lib/copilot/tools/retired-tools'
+import { normalizeToolActivityDescription } from '@/lib/copilot/tools/tool-display'
 import type { BrowserTextSelection, TerminalTextSelection } from '@/stores/panel/types'
 
 export type PersistedToolState = LocalToolCallStatus | MothershipStreamV1ToolOutcome | 'interrupted'
@@ -36,6 +37,7 @@ interface PersistedToolCall {
   calledBy?: string
   durationMs?: number
   display?: { title?: string }
+  activityDescription?: string
 }
 
 export interface PersistedContentBlock {
@@ -284,10 +286,14 @@ function mapContentBlockBody(block: ContentBlock): PersistedContentBlock {
 
       const redactedResult = redactToolCallResult(block.toolCall.name, block.toolCall.result)
 
+      const activityDescription = normalizeToolActivityDescription(
+        block.toolCall.activityDescription
+      )
       const toolCall: PersistedToolCall = {
         id: block.toolCall.id,
         name: block.toolCall.name,
         state,
+        ...(activityDescription ? { activityDescription } : {}),
         ...(isSubagentTool && isNonTerminal ? {} : { result: redactedResult }),
         ...(isSubagentTool && isNonTerminal
           ? {}
@@ -466,6 +472,7 @@ interface RawBlock {
     params?: Record<string, unknown>
     result?: { success: boolean; output?: unknown; error?: string }
     display?: { text?: string; title?: string; phaseLabel?: string }
+    activityDescription?: string
     calledBy?: string
     durationMs?: number
     error?: string
@@ -523,10 +530,12 @@ function normalizeCanonicalBlock(block: RawBlock): PersistedContentBlock {
   if (block.status) result.status = block.status as MothershipStreamV1CompletionStatus
   if (block.parentToolCallId) result.parentToolCallId = block.parentToolCallId
   if (block.toolCall) {
+    const activityDescription = normalizeToolActivityDescription(block.toolCall.activityDescription)
     result.toolCall = {
       id: block.toolCall.id ?? '',
       name: block.toolCall.name ?? '',
       state: normalizeToolState(block.toolCall.state),
+      ...(activityDescription ? { activityDescription } : {}),
       ...(block.toolCall.params ? { params: block.toolCall.params } : {}),
       ...(block.toolCall.result ? { result: block.toolCall.result } : {}),
       ...(block.toolCall.calledBy ? { calledBy: block.toolCall.calledBy } : {}),
@@ -549,6 +558,7 @@ function normalizeCanonicalBlock(block: RawBlock): PersistedContentBlock {
 
 function normalizeLegacyBlock(block: RawBlock): PersistedContentBlock {
   if (block.type === 'tool_call' && block.toolCall) {
+    const activityDescription = normalizeToolActivityDescription(block.toolCall.activityDescription)
     return {
       type: MothershipStreamV1EventType.tool,
       phase: MothershipStreamV1ToolPhase.call,
@@ -556,6 +566,7 @@ function normalizeLegacyBlock(block: RawBlock): PersistedContentBlock {
         id: block.toolCall.id ?? '',
         name: block.toolCall.name ?? '',
         state: normalizeToolState(block.toolCall.state),
+        ...(activityDescription ? { activityDescription } : {}),
         ...(block.toolCall.params ? { params: block.toolCall.params } : {}),
         ...(block.toolCall.result ? { result: block.toolCall.result } : {}),
         ...(block.toolCall.calledBy ? { calledBy: block.toolCall.calledBy } : {}),
diff --git a/apps/sim/lib/copilot/generated/docs-manifest.ts b/apps/sim/lib/copilot/generated/docs-manifest.ts
index 69d6daa5aab..bced482121a 100644
--- a/apps/sim/lib/copilot/generated/docs-manifest.ts
+++ b/apps/sim/lib/copilot/generated/docs-manifest.ts
@@ -383,6 +383,7 @@ export const DOCS_MANIFEST: readonly string[] = [
   'platform/enterprise/scim.mdx',
   'platform/enterprise/scim/entra.mdx',
   'platform/enterprise/scim/okta.mdx',
+  'platform/enterprise/security.mdx',
   'platform/enterprise/self-hosted.mdx',
   'platform/enterprise/session-policies.mdx',
   'platform/enterprise/sso.mdx',
diff --git a/apps/sim/lib/copilot/generated/mothership-stream-v1-schema.ts b/apps/sim/lib/copilot/generated/mothership-stream-v1-schema.ts
index ecf8faf3f82..89cafd97fae 100644
--- a/apps/sim/lib/copilot/generated/mothership-stream-v1-schema.ts
+++ b/apps/sim/lib/copilot/generated/mothership-stream-v1-schema.ts
@@ -1176,6 +1176,10 @@ export const MOTHERSHIP_STREAM_V1_SCHEMA: JsonSchema = {
     MothershipStreamV1ToolCallDescriptor: {
       additionalProperties: false,
       properties: {
+        activityDescription: {
+          maxLength: 160,
+          type: 'string',
+        },
         arguments: {
           $ref: '#/$defs/MothershipStreamV1AdditionalPropertiesMap',
         },
diff --git a/apps/sim/lib/copilot/generated/mothership-stream-v1.ts b/apps/sim/lib/copilot/generated/mothership-stream-v1.ts
index 41a169a8648..421cab83293 100644
--- a/apps/sim/lib/copilot/generated/mothership-stream-v1.ts
+++ b/apps/sim/lib/copilot/generated/mothership-stream-v1.ts
@@ -144,6 +144,7 @@ export interface MothershipStreamV1ToolCallEventEnvelope {
   v: 1
 }
 export interface MothershipStreamV1ToolCallDescriptor {
+  activityDescription?: string
   arguments?: MothershipStreamV1AdditionalPropertiesMap
   executor: MothershipStreamV1ToolExecutor
   mode: MothershipStreamV1ToolMode
diff --git a/apps/sim/lib/copilot/generated/tool-catalog-v1.ts b/apps/sim/lib/copilot/generated/tool-catalog-v1.ts
index b65bebaf7d1..22fb32d4a10 100644
--- a/apps/sim/lib/copilot/generated/tool-catalog-v1.ts
+++ b/apps/sim/lib/copilot/generated/tool-catalog-v1.ts
@@ -4750,16 +4750,24 @@ export const ReadDocument: ToolCatalogEntry = {
         type: 'string',
       },
       limit: {
-        default: 20,
-        description: 'Maximum number of chunks to read.',
-        maximum: 50,
+        default: 3,
+        description:
+          'Maximum chunks to read; the server may return fewer to fit its text budget. Follow next when more context is needed.',
+        maximum: 8,
         minimum: 1,
         type: 'integer',
       },
-      offset: {
-        default: 0,
-        description: 'Number of chunks to skip.',
-        maximum: 5000,
+      startChunkIndex: {
+        description:
+          "Inclusive chunk index from search or a previous read's next object. Gaps from disabled chunks are skipped.",
+        maximum: 2147483647,
+        minimum: 0,
+        type: 'integer',
+      },
+      startOffset: {
+        description:
+          'UTF-16 character offset within startChunkIndex. Omit to read the chunk from its start, or copy next.startOffset to continue a partial chunk.',
+        maximum: 2147483647,
         minimum: 0,
         type: 'integer',
       },
@@ -5616,7 +5624,8 @@ export const SearchWorkspace: ToolCatalogEntry = {
       },
       topK: {
         default: 20,
-        description: 'Maximum number of matching chunks to return.',
+        description:
+          'Maximum number of matching passage previews to return. Retrieval ranking is independent of preview length.',
         maximum: 50,
         minimum: 1,
         type: 'integer',
diff --git a/apps/sim/lib/copilot/generated/tool-schemas-v1.ts b/apps/sim/lib/copilot/generated/tool-schemas-v1.ts
index 388d341ae1f..72e603a3613 100644
--- a/apps/sim/lib/copilot/generated/tool-schemas-v1.ts
+++ b/apps/sim/lib/copilot/generated/tool-schemas-v1.ts
@@ -4694,16 +4694,24 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
           type: 'string',
         },
         limit: {
-          default: 20,
-          description: 'Maximum number of chunks to read.',
-          maximum: 50,
+          default: 3,
+          description:
+            'Maximum chunks to read; the server may return fewer to fit its text budget. Follow next when more context is needed.',
+          maximum: 8,
           minimum: 1,
           type: 'integer',
         },
-        offset: {
-          default: 0,
-          description: 'Number of chunks to skip.',
-          maximum: 5000,
+        startChunkIndex: {
+          description:
+            "Inclusive chunk index from search or a previous read's next object. Gaps from disabled chunks are skipped.",
+          maximum: 2147483647,
+          minimum: 0,
+          type: 'integer',
+        },
+        startOffset: {
+          description:
+            'UTF-16 character offset within startChunkIndex. Omit to read the chunk from its start, or copy next.startOffset to continue a partial chunk.',
+          maximum: 2147483647,
           minimum: 0,
           type: 'integer',
         },
@@ -5518,7 +5526,8 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
         },
         topK: {
           default: 20,
-          description: 'Maximum number of matching chunks to return.',
+          description:
+            'Maximum number of matching passage previews to return. Retrieval ranking is independent of preview length.',
           maximum: 50,
           minimum: 1,
           type: 'integer',
diff --git a/apps/sim/lib/copilot/generated/trace-attributes-v1.ts b/apps/sim/lib/copilot/generated/trace-attributes-v1.ts
index fdc1a5da7ca..df4a808f809 100644
--- a/apps/sim/lib/copilot/generated/trace-attributes-v1.ts
+++ b/apps/sim/lib/copilot/generated/trace-attributes-v1.ts
@@ -478,6 +478,7 @@ export const TraceAttr = {
   LlmStreamChunks: 'llm.stream.chunks',
   LlmStreamFirstChunkBytes: 'llm.stream.first_chunk_bytes',
   LlmStreamFirstChunkMs: 'llm.stream.first_chunk_ms',
+  LlmStreamFirstTokenMs: 'llm.stream.first_token_ms',
   LlmStreamOpenMs: 'llm.stream.open_ms',
   LlmStreamTotalMs: 'llm.stream.total_ms',
   LockAcquired: 'lock.acquired',
@@ -1159,6 +1160,7 @@ export const TraceAttrValues: readonly TraceAttrValue[] = [
   'llm.stream.chunks',
   'llm.stream.first_chunk_bytes',
   'llm.stream.first_chunk_ms',
+  'llm.stream.first_token_ms',
   'llm.stream.open_ms',
   'llm.stream.total_ms',
   'lock.acquired',
diff --git a/apps/sim/lib/copilot/request/handlers/handlers.test.ts b/apps/sim/lib/copilot/request/handlers/handlers.test.ts
index 33b1e718d59..cb1d2f9ea99 100644
--- a/apps/sim/lib/copilot/request/handlers/handlers.test.ts
+++ b/apps/sim/lib/copilot/request/handlers/handlers.test.ts
@@ -1870,6 +1870,7 @@ describe('sse-handlers tool lifecycle', () => {
           toolCallId: 'tool-dynamic-sim',
           toolName: 'gmail_read',
           arguments: { maxResults: 10 },
+          activityDescription: 'Reading the latest project updates',
           executor: MothershipStreamV1ToolExecutor.sim,
           mode: MothershipStreamV1ToolMode.async,
           phase: MothershipStreamV1ToolPhase.call,
@@ -1886,8 +1887,92 @@ describe('sse-handlers tool lifecycle', () => {
     expect(context.toolCalls.get('tool-dynamic-sim')?.status).toBe(
       MothershipStreamV1ToolOutcome.success
     )
+    expect(context.toolCalls.get('tool-dynamic-sim')?.activityDescription).toBe(
+      'Reading the latest project updates'
+    )
   })
 
+  it.each(['main', 'subagent'] as const)(
+    'retains a model-authored description on a finalized %s call without changing arguments',
+    async (lane) => {
+      isSimExecuted.mockReturnValue(false)
+      const handler = lane === 'subagent' ? subAgentHandlers.tool : sseHandlers.tool
+      const scope =
+        lane === 'subagent'
+          ? { lane, parentToolCallId: 'activity-parent', agentId: 'workflow' }
+          : undefined
+      const payload = {
+        toolCallId: `activity-${lane}`,
+        toolName: 'run_function',
+        executor: MothershipStreamV1ToolExecutor.go,
+        mode: MothershipStreamV1ToolMode.sync,
+        phase: MothershipStreamV1ToolPhase.call,
+      } as const
+      await handler(
+        { type: MothershipStreamV1EventType.tool, scope, payload: { ...payload, partial: true } },
+        context,
+        execContext,
+        {}
+      )
+      await handler(
+        {
+          type: MothershipStreamV1EventType.tool,
+          scope,
+          payload: {
+            ...payload,
+            arguments: { code: 'return 1' },
+            activityDescription: '  Checking   the project setup  ',
+          },
+        },
+        context,
+        execContext,
+        {}
+      )
+      const tool = context.toolCalls.get(payload.toolCallId)
+      expect(tool).toMatchObject({
+        activityDescription: 'Checking the project setup',
+        displayTitle: 'Checking the project setup',
+        params: { code: 'return 1' },
+      })
+      if (lane === 'subagent') {
+        expect(context.subAgentToolCalls['activity-parent'][0]).toBe(tool)
+      }
+      expect(executeTool).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(['executing', 'awaiting_approval', 'success'] as const)(
+    'captures late activity metadata for a %s call without reopening or executing it',
+    async (status) => {
+      context.toolCalls.set('activity-late', { id: 'activity-late', name: 'read', status })
+      const event: StreamEvent = {
+        type: MothershipStreamV1EventType.tool,
+        payload: {
+          phase: MothershipStreamV1ToolPhase.call,
+          executor: MothershipStreamV1ToolExecutor.go,
+          mode: MothershipStreamV1ToolMode.sync,
+          toolCallId: 'activity-late',
+          toolName: 'read',
+          arguments: { path: 'WORKSPACE.md' },
+          activityDescription: 'Checking the project setup',
+        },
+      }
+      await sseHandlers.tool(event, context, execContext, {})
+      await sseHandlers.tool(
+        { ...event, payload: { ...event.payload, activityDescription: 'Reading something else' } },
+        context,
+        execContext,
+        {}
+      )
+      expect(context.toolCalls.get('activity-late')).toMatchObject({
+        status,
+        activityDescription: 'Checking the project setup',
+        displayTitle: 'Checking the project setup',
+      })
+      expect(executeTool).not.toHaveBeenCalled()
+    }
+  )
+
   it('rebinds a gateway call to the resolved integration operation and branded activity', async () => {
     isSimExecuted.mockReturnValue(false)
     executeTool.mockResolvedValueOnce({ success: true, output: { emails: [] } })
diff --git a/apps/sim/lib/copilot/request/handlers/tool.ts b/apps/sim/lib/copilot/request/handlers/tool.ts
index cc88538a292..9e563ecd6e8 100644
--- a/apps/sim/lib/copilot/request/handlers/tool.ts
+++ b/apps/sim/lib/copilot/request/handlers/tool.ts
@@ -47,7 +47,10 @@ import { getToolEntry, isSimExecuted } from '@/lib/copilot/tool-executor'
 import { isToolHiddenInUi } from '@/lib/copilot/tools/client/hidden-tools'
 import { isUserLocalVfsToolCall } from '@/lib/copilot/tools/local-filesystem'
 import { extractStreamingStringArgument } from '@/lib/copilot/tools/streaming-args'
-import { getToolDisplayTitle } from '@/lib/copilot/tools/tool-display'
+import {
+  getToolDisplayTitle,
+  normalizeToolActivityDescription,
+} from '@/lib/copilot/tools/tool-display'
 import { isWorkflowToolName, resolveWorkflowToolTargetId } from '@/lib/copilot/tools/workflow-tools'
 import { getBlockByToolName } from '@/blocks/registry'
 import type { ToolScope } from './types'
@@ -71,6 +74,10 @@ const logger = createLogger('CopilotToolHandler')
 
 function applyToolDisplay(toolCall: ToolCallState | undefined): void {
   if (!toolCall?.name) return
+  if (toolCall.activityDescription) {
+    toolCall.displayTitle = toolCall.activityDescription
+    return
+  }
   // Integration rows show only the model-authored activity phrase; the trusted
   // integration branding is the icon, derived client-side from the operation
   // name (or streamed toolId) via the block registry. With no description yet,
@@ -439,7 +446,11 @@ async function handleCallPhase(
   const isGenerating = data.status === TOOL_CALL_STATUS.generating
   const isPartial = data.partial === true || isGenerating
   const existing = context.toolCalls.get(toolCallId)
-  if (existing) existing.agentId ??= agentId
+  const activityDescription = normalizeToolActivityDescription(data.activityDescription)
+  if (existing) {
+    existing.agentId ??= agentId
+    existing.activityDescription ??= activityDescription
+  }
   const isSubagent = scope === 'subagent'
   const ui = getToolCallUI(data)
 
@@ -486,10 +497,21 @@ async function handleCallPhase(
       agentId,
       ui,
       spanIdentity,
-      !isPartial
+      !isPartial,
+      activityDescription
     )
   } else {
-    registerMainToolCall(context, toolCallId, toolName, args, existing, agentId, ui, !isPartial)
+    registerMainToolCall(
+      context,
+      toolCallId,
+      toolName,
+      args,
+      existing,
+      agentId,
+      ui,
+      !isPartial,
+      activityDescription
+    )
   }
 
   if (isPartial) return
@@ -588,7 +610,8 @@ function registerSubagentToolCall(
   agentId: string,
   ui: { title?: string; phaseLabel?: string; hidden?: boolean },
   spanIdentity: { spanId?: string; parentSpanId?: string },
-  finalized: boolean
+  finalized: boolean,
+  activityDescription?: string
 ): void {
   if (!context.subAgentToolCalls[parentToolCallId]) {
     context.subAgentToolCalls[parentToolCallId] = []
@@ -607,6 +630,7 @@ function registerSubagentToolCall(
       name: toolName,
       status: 'pending',
       agentId,
+      ...(activityDescription ? { activityDescription } : {}),
       params: args,
       startTime: Date.now(),
     }
@@ -628,6 +652,7 @@ function registerSubagentToolCall(
   const existingSubagentToolCall = subagentToolCalls.find((tc) => tc.id === toolCallId)
   if (existingSubagentToolCall) {
     existingSubagentToolCall.agentId ??= agentId
+    existingSubagentToolCall.activityDescription ??= activityDescription
     if (!rebindResolvedIntegrationCall(existingSubagentToolCall, toolName, args)) {
       updateToolCallFromFrame(existingSubagentToolCall, toolName, args, finalized)
     }
@@ -645,7 +670,8 @@ function registerMainToolCall(
   existing: ToolCallState | undefined,
   agentId: string,
   ui: { title?: string; phaseLabel?: string; hidden?: boolean },
-  finalized: boolean
+  finalized: boolean,
+  activityDescription?: string
 ): void {
   const hideFromUi = isToolHiddenInUi(toolName) || ui.hidden === true
   if (existing) {
@@ -669,6 +695,7 @@ function registerMainToolCall(
       name: toolName,
       status: 'pending',
       agentId,
+      ...(activityDescription ? { activityDescription } : {}),
       params: args,
       startTime: Date.now(),
     }
diff --git a/apps/sim/lib/copilot/request/types.ts b/apps/sim/lib/copilot/request/types.ts
index 5a720b5bb99..1afdf77e4b8 100644
--- a/apps/sim/lib/copilot/request/types.ts
+++ b/apps/sim/lib/copilot/request/types.ts
@@ -29,6 +29,8 @@ export interface ToolCallState {
   /** Bounded registry ID of the agent that invoked this tool. */
   agentId?: string
   displayTitle?: string
+  /** Model-authored activity text, separate from executable tool arguments. */
+  activityDescription?: string
   /** Model-authored activity text for a gateway-resolved integration call. */
   integrationDescription?: string
   /** Accumulated partial JSON of the arguments while the model streams them. */
diff --git a/apps/sim/lib/copilot/tool-executor/executor.ts b/apps/sim/lib/copilot/tool-executor/executor.ts
index 7b0503f3bf7..e2d77c6315f 100644
--- a/apps/sim/lib/copilot/tool-executor/executor.ts
+++ b/apps/sim/lib/copilot/tool-executor/executor.ts
@@ -6,6 +6,7 @@ import {
   assertAssistantIntegrationCall,
 } from '@/lib/copilot/assistant/tool-policy'
 import { projectToolErrorMessageForCopilot } from '@/lib/copilot/request/tools/resolved-secret-result'
+import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import { DEFAULT_EXECUTION_TIMEOUT_MS } from '@/lib/execution/constants'
 import { recordSecretUsage } from '@/lib/secrets/usage/record'
 import { executeTool as executeAppTool } from '@/tools'
@@ -96,71 +97,76 @@ export async function executeTool(
     }
   }
 
-  const normalizedParams = normalizeToolParams(toolId, params, context)
-
-  const canUseRegisteredHandler =
-    isKnownTool(toolId) && (isSimExecuted(toolId) || usesHeadlessClientFallback)
-  if (!canUseRegisteredHandler) {
-    const appParams = buildAppToolParams(normalizedParams, context)
-    const options = {
-      ...(context.resolvedSecretTraceRegistry
-        ? { resolvedSecretTraceRegistry: context.resolvedSecretTraceRegistry }
-        : {}),
-      ...(context.abortSignal ? { signal: context.abortSignal } : {}),
-      operationContext: {
-        userId: context.userId,
-        workflowId: context.workflowId,
-        workspaceId: context.workspaceId,
-        executionId: context.executionId,
-        chatId: context.chatId,
-        toolCallId: context.toolCallId,
-        mcpBlockId: context.mcpBlockId,
-        executorDelegationOrigin: context.executorDelegationOrigin ?? {
-          subjectUserId: context.userId,
+  return withResourceOutboundScope(context, async () => {
+    const normalizedParams = normalizeToolParams(toolId, params, context)
+
+    const canUseRegisteredHandler =
+      isKnownTool(toolId) && (isSimExecuted(toolId) || usesHeadlessClientFallback)
+    if (!canUseRegisteredHandler) {
+      const appParams = buildAppToolParams(normalizedParams, context)
+      const options = {
+        ...(context.resolvedSecretTraceRegistry
+          ? { resolvedSecretTraceRegistry: context.resolvedSecretTraceRegistry }
+          : {}),
+        ...(context.abortSignal ? { signal: context.abortSignal } : {}),
+        operationContext: {
+          userId: context.userId,
           workflowId: context.workflowId,
-          ...(context.executionId ? { executionId: context.executionId } : {}),
+          workspaceId: context.workspaceId,
+          executionId: context.executionId,
+          chatId: context.chatId,
+          toolCallId: context.toolCallId,
+          mcpBlockId: context.mcpBlockId,
+          executorDelegationOrigin: context.executorDelegationOrigin ?? {
+            subjectUserId: context.userId,
+            workflowId: context.workflowId,
+            ...(context.executionId ? { executionId: context.executionId } : {}),
+          },
+          copilotToolExecution: context.copilotToolExecution,
+          copilotInteractionMode: context.copilotInteractionMode,
+          requestMode: context.requestMode,
+          billingAttribution: context.billingAttribution,
+          resolvedSecretTraceRegistry: context.resolvedSecretTraceRegistry,
         },
-        copilotToolExecution: context.copilotToolExecution,
-        copilotInteractionMode: context.copilotInteractionMode,
-        requestMode: context.requestMode,
-        billingAttribution: context.billingAttribution,
-        resolvedSecretTraceRegistry: context.resolvedSecretTraceRegistry,
-      },
+      }
+      try {
+        return await (Object.keys(options).length > 0
+          ? executeAppTool(toolId, appParams, options)
+          : executeAppTool(toolId, appParams))
+      } finally {
+        recordAppToolSecretUsage(context)
+      }
     }
-    try {
-      return await (Object.keys(options).length > 0
-        ? executeAppTool(toolId, appParams, options)
-        : executeAppTool(toolId, appParams))
-    } finally {
-      recordAppToolSecretUsage(context)
-    }
-  }
 
-  if (context.abortSignal?.aborted) {
-    logger.warn('Tool execution skipped: abort signal already set', {
-      toolId,
-      abortReason: context.abortSignal.reason ?? 'unknown',
-    })
-    return { success: false, error: 'Execution aborted: abort signal was set before tool started' }
-  }
+    if (context.abortSignal?.aborted) {
+      logger.warn('Tool execution skipped: abort signal already set', {
+        toolId,
+        abortReason: context.abortSignal.reason ?? 'unknown',
+      })
+      return {
+        success: false,
+        error: 'Execution aborted: abort signal was set before tool started',
+      }
+    }
 
-  const handler = handlerRegistry.get(toolId)
-  if (!handler) {
-    logger.warn('No handler registered for tool', { toolId })
-    return { success: false, error: `No handler for tool: ${toolId}` }
-  }
+    const handler = handlerRegistry.get(toolId)
+    if (!handler) {
+      logger.warn('No handler registered for tool', { toolId })
+      return { success: false, error: `No handler for tool: ${toolId}` }
+    }
 
-  try {
-    return await handler(normalizedParams, context)
-  } catch (error) {
-    const message = toError(error).message
-    logger.error('Tool execution failed', {
-      toolId,
-      error: projectToolErrorMessageForCopilot(message, context.resolvedSecretTraceRegistry),
-      abortSignalAborted: context.abortSignal?.aborted ?? false,
-    })
-    return { success: false, error: message }
-  }
+    try {
+      return await handler(normalizedParams, context)
+    } catch (error) {
+      const message = toError(error).message
+      logger.error('Tool execution failed', {
+        toolId,
+        error: projectToolErrorMessageForCopilot(message, context.resolvedSecretTraceRegistry),
+        abortSignalAborted: context.abortSignal?.aborted ?? false,
+      })
+      return { success: false, error: message }
+    }
+  })
 }
 
 function normalizeToolParams(
diff --git a/apps/sim/lib/copilot/tools/server/knowledge/workspace-search.test.ts b/apps/sim/lib/copilot/tools/server/knowledge/workspace-search.test.ts
index 1e669a7b45b..f14efc854e8 100644
--- a/apps/sim/lib/copilot/tools/server/knowledge/workspace-search.test.ts
+++ b/apps/sim/lib/copilot/tools/server/knowledge/workspace-search.test.ts
@@ -35,9 +35,6 @@ vi.mock('@/lib/knowledge/application/read-search-document', () => ({
     execute: mocks.read,
   },
 }))
-vi.mock('@/executor/utils/resolved-secret-content-projection', () => ({
-  projectResolvedSecretModelContent: (value: unknown) => ({ safe: true, value }),
-}))
 
 import {
   readDocumentServerTool,
@@ -61,6 +58,7 @@ describe('Assistant retrieval tools', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mocks.search.mockResolvedValue({
+      retrieval: { status: 'complete', timedOutLegs: [] },
       knowledgeBases: [{ id: 'index', name: 'Enterprise Search' }],
       results: [
         {
@@ -83,9 +81,32 @@ describe('Assistant retrieval tools', () => {
       sourceUrl: 'https://source.test/doc',
       chunks: [{ content: 'body', chunkIndex: 0 }],
       hasMore: false,
-      nextOffset: null,
+      next: null,
     })
   })
+  it('returns empty incomplete retrieval as a recoverable search outcome and logs coverage', async () => {
+    mocks.search.mockResolvedValue({
+      retrieval: { status: 'partial', timedOutLegs: ['vector', 'keyword'] },
+      knowledgeBases: [{ id: 'index', name: 'Enterprise Search' }],
+      results: [],
+    })
+
+    const result = await searchWorkspaceServerTool.execute({ query: 'canaries' }, context)
+
+    expect(result).toMatchObject({
+      success: true,
+      message: expect.stringContaining('cannot establish absence or completeness'),
+      data: {
+        retrieval: { status: 'partial', timedOutLegs: ['vector', 'keyword'] },
+        results: [],
+      },
+    })
+    expect(result).not.toHaveProperty('error')
+    expect(mocks.info).toHaveBeenCalledWith(
+      'Knowledge search completed',
+      expect.objectContaining({ passageBytes: 0, originalPassageBytes: 0, outcome: 'success' })
+    )
+  })
   it('pins organization and private chat while reusing the canonical search index and citations', async () => {
     const orgContext = {
       ...context,
@@ -187,11 +208,29 @@ describe('Assistant retrieval tools', () => {
       })
     )
   })
+  it('returns only the projected query to the model', async () => {
+    const secret = 'private-resolved-query-token'
+    const registry = new ResolvedSecretTraceRegistry([
+      { name: 'TOKEN', plaintext: secret, encryptedValue: 'ciphertext' },
+    ])
+    registry.recordResolved('TOKEN', secret)
+    const result = await searchWorkspaceServerTool.execute(
+      { query: `Find ${secret}` },
+      { ...context, resolvedSecretTraceRegistry: registry }
+    )
+    expect(result).toMatchObject({ success: true, data: { query: 'Find {{TOKEN}}' } })
+    expect(mocks.search).toHaveBeenCalledWith(
+      expect.objectContaining({ input: expect.objectContaining({ query: 'Find {{TOKEN}}' }) })
+    )
+    expect(JSON.stringify(result)).not.toContain(secret)
+  })
+
   it.each([0, 20, 50])(
     'measures UTF-8 bytes for %i passages without logging their content',
     async (count) => {
       const content = 'Confidential passage é🔎'.repeat(100)
       mocks.search.mockResolvedValueOnce({
+        retrieval: { status: 'complete', timedOutLegs: [] },
         knowledgeBases: [{ id: 'index', name: 'Enterprise Search' }],
         results: Array.from({ length: count }, (_, index) => ({
           knowledgeBaseId: 'index',
@@ -217,8 +256,9 @@ describe('Assistant retrieval tools', () => {
         expect.objectContaining({
           toolCallId: 'call',
           toolResultBytes: Buffer.byteLength(JSON.stringify(output)),
-          passageBytes: count * Buffer.byteLength(content),
-          maxPassageBytes: count ? Buffer.byteLength(content) : 0,
+          passageBytes: count * Buffer.byteLength(content.slice(0, 1200)),
+          originalPassageBytes: count * Buffer.byteLength(content),
+          maxPassageBytes: count ? Buffer.byteLength(content.slice(0, 1200)) : 0,
           uniqueDocumentCount: Math.min(count, 4),
         })
       )
@@ -245,6 +285,7 @@ describe('Assistant retrieval tools', () => {
   })
   it('projects the provider name for connected-source citations instead of the index name', async () => {
     mocks.search.mockResolvedValueOnce({
+      retrieval: { status: 'complete', timedOutLegs: [] },
       knowledgeBases: [{ id: 'index', name: 'Sim Search' }],
       results: [
         {
@@ -292,20 +333,20 @@ describe('Assistant retrieval tools', () => {
   })
   it('reads a selected document through the shared use case and rejects unbounded pages', async () => {
     expect(
-      await readDocumentServerTool.execute({ documentId: 'doc', offset: 20 }, context)
+      await readDocumentServerTool.execute({ documentId: 'doc', startChunkIndex: 20 }, context)
     ).toMatchObject({ success: true })
     expect(mocks.read).toHaveBeenCalledWith(
       expect.objectContaining({
         input: expect.objectContaining({
           assertedWorkspaceId: 'workspace',
           filters: context.assistantSearch,
-          offset: 20,
-          limit: 20,
+          startChunkIndex: 20,
+          limit: 3,
         }),
       })
     )
     expect(
-      await readDocumentServerTool.execute({ documentId: 'doc', limit: 10000 }, context)
+      await readDocumentServerTool.execute({ documentId: 'doc', limit: 9 }, context)
     ).toMatchObject({ success: false })
     expect(mocks.read).toHaveBeenCalledOnce()
   })
diff --git a/apps/sim/lib/copilot/tools/server/knowledge/workspace-search.ts b/apps/sim/lib/copilot/tools/server/knowledge/workspace-search.ts
index 01f6cb833f5..7d24d5969da 100644
--- a/apps/sim/lib/copilot/tools/server/knowledge/workspace-search.ts
+++ b/apps/sim/lib/copilot/tools/server/knowledge/workspace-search.ts
@@ -15,6 +15,7 @@ import {
   searchWorkspaceKnowledge,
 } from '@/lib/knowledge/application/workspace-search'
 import { sourceAuthor } from '@/lib/knowledge/search/author'
+import { SearchDeadlineError } from '@/lib/knowledge/search/budget'
 import { createKnowledgeDocumentCitation } from '@/lib/knowledge/search/citation'
 import {
   annotateSearchDiagnostics,
@@ -23,6 +24,7 @@ import {
   withSearchDiagnostics,
 } from '@/lib/knowledge/search/diagnostics'
 import { intersectWorkspaceSearchFilters } from '@/lib/knowledge/search/filters'
+import { matchPassage } from '@/lib/knowledge/search/snippet'
 import { connectorDisplayName } from '@/lib/sim-search/connectors'
 import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
 
@@ -33,8 +35,9 @@ const searchInputSchema = workspaceSearchFiltersSchema.extend({
 })
 const readInputSchema = z.object({
   documentId: z.string().min(1).max(200),
-  offset: z.number().int().min(0).max(5000).default(0),
-  limit: z.number().int().min(1).max(50).default(20),
+  limit: z.number().int().min(1).max(8).default(3),
+  startChunkIndex: z.number().int().min(0).max(2147483647).optional(),
+  startOffset: z.number().int().min(0).max(2147483647).optional(),
 })
 
 const CITATION_INSTRUCTION =
@@ -46,6 +49,7 @@ export const searchWorkspaceServerTool: BaseServerTool = {
     return withSearchDiagnostics(
       {
         surface: context?.searchSurface ?? 'copilot',
+        operation: 'search_workspace',
         toolCallId: context?.toolCallId,
         executionId: context?.executionId,
       },
@@ -63,9 +67,11 @@ export const searchWorkspaceServerTool: BaseServerTool = {
               message: 'Search query contains protected content. Rephrase the query.',
             }
           }
+          const safeQuery = projected.value
           const input = {
-            query: projected.value,
+            query: safeQuery,
             topK,
+            allowPartialResults: true,
             filters: intersectWorkspaceSearchFilters(requestedFilters, context?.assistantSearch),
             surface: context?.searchSurface ?? 'copilot',
             resultSecretRegistry: registry,
@@ -87,38 +93,48 @@ export const searchWorkspaceServerTool: BaseServerTool = {
             const names = new Map(result.knowledgeBases.map((base) => [base.id, base.name]))
             const output = {
               success: true,
-              message: `Found ${result.results.length} passages. ${CITATION_INSTRUCTION}`,
+              message: `${result.retrieval.status === 'partial' ? 'Search coverage is incomplete. Continue with a more specific query or source filter; these results cannot establish absence or completeness. ' : ''}Found ${result.results.length} passage previews. Read a document at its chunkIndex for more context. ${CITATION_INSTRUCTION}`,
               data: {
-                query,
-                results: result.results.map((item) => ({
-                  documentId: item.documentId,
-                  knowledgeBaseId: item.knowledgeBaseId,
-                  knowledgeBaseName: names.get(item.knowledgeBaseId) ?? '',
-                  siteName: item.connectorType
-                    ? connectorDisplayName(item.connectorType)
-                    : names.get(item.knowledgeBaseId),
-                  documentName: item.documentName,
-                  sourceUrl: item.sourceUrl,
-                  connectorType: item.connectorType,
-                  sourceModifiedAt: item.sourceModifiedAt?.toISOString() ?? null,
-                  author: sourceAuthor(item.metadata),
-                  content: item.content,
-                  chunkIndex: item.chunkIndex,
-                  similarity: item.similarity,
-                  ...createKnowledgeDocumentCitation({
-                    scope,
-                    knowledgeBaseId: item.knowledgeBaseId,
+                query: safeQuery,
+                retrieval: result.retrieval,
+                results: result.results.map((item) => {
+                  const content = projectResolvedSecretModelContent(item.content, registry)
+                  if (!content.safe || typeof content.value !== 'string')
+                    throw new Error('Knowledge result provenance is unavailable')
+                  return {
                     documentId: item.documentId,
+                    knowledgeBaseId: item.knowledgeBaseId,
+                    knowledgeBaseName: names.get(item.knowledgeBaseId) ?? '',
+                    siteName: item.connectorType
+                      ? connectorDisplayName(item.connectorType)
+                      : names.get(item.knowledgeBaseId),
+                    documentName: item.documentName,
                     sourceUrl: item.sourceUrl,
-                    baseUrl: getBaseUrl(),
-                  }),
-                })),
+                    connectorType: item.connectorType,
+                    sourceModifiedAt: item.sourceModifiedAt?.toISOString() ?? null,
+                    author: sourceAuthor(item.metadata),
+                    ...matchPassage(content.value, safeQuery, 1200),
+                    chunkIndex: item.chunkIndex,
+                    similarity: item.similarity,
+                    ...createKnowledgeDocumentCitation({
+                      scope,
+                      knowledgeBaseId: item.knowledgeBaseId,
+                      documentId: item.documentId,
+                      sourceUrl: item.sourceUrl,
+                      baseUrl: getBaseUrl(),
+                    }),
+                  }
+                }),
               },
             }
             const passageBytes = output.data.results.map((item) => Buffer.byteLength(item.content))
             annotateSearchDiagnostics({
               toolResultBytes: Buffer.byteLength(JSON.stringify(output)),
               passageBytes: passageBytes.reduce((total, bytes) => total + bytes, 0),
+              originalPassageBytes: result.results.reduce(
+                (total, item) => total + Buffer.byteLength(item.content),
+                0
+              ),
               maxPassageBytes: Math.max(0, ...passageBytes),
               uniqueDocumentCount: new Set(output.data.results.map((item) => item.documentId)).size,
             })
@@ -128,10 +144,13 @@ export const searchWorkspaceServerTool: BaseServerTool = {
           logger.error('Workspace search failed', { error })
           return {
             success: false,
+            retryable: error instanceof SearchDeadlineError,
             message:
-              error instanceof z.ZodError
-                ? 'Invalid search arguments'
-                : messageForCopilotKnowledgeError(error),
+              error instanceof SearchDeadlineError
+                ? error.message
+                : error instanceof z.ZodError
+                  ? 'Invalid search arguments'
+                  : messageForCopilotKnowledgeError(error),
           }
         }
       }
@@ -142,50 +161,69 @@ export const searchWorkspaceServerTool: BaseServerTool = {
 export const readDocumentServerTool: BaseServerTool = {
   name: 'read_document',
   async execute(raw, context?: ServerToolContext) {
-    try {
-      const scope = requireCopilotKnowledgeScope(context)
-      const input = readInputSchema.parse(raw)
-      const registry = context?.resolvedSecretTraceRegistry
-      if (!registry) throw new Error('Knowledge result provenance is unavailable')
-      const readInput = {
-        ...input,
-        ...(scope.kind === 'organization'
-          ? { assertedOrganizationId: scope.organizationId }
-          : { assertedWorkspaceId: scope.workspaceId }),
-        filters: intersectWorkspaceSearchFilters(
-          { documentIds: [input.documentId] },
-          context?.assistantSearch
-        ),
-        resultSecretRegistry: registry,
-        signal: context?.abortSignal,
-      }
-      const result =
-        scope.kind === 'organization'
-          ? await executeCopilotOrganizationKnowledgeUseCase(context, readSearchDocument, readInput)
-          : await executeCopilotKnowledgeUseCase(context, readSearchDocument, readInput)
-      return {
-        success: true,
-        message: CITATION_INSTRUCTION,
-        data: {
-          ...result,
-          ...createKnowledgeDocumentCitation({
-            scope,
-            knowledgeBaseId: result.knowledgeBaseId,
-            documentId: result.documentId,
-            sourceUrl: result.sourceUrl,
-            baseUrl: getBaseUrl(),
-          }),
-        },
-      }
-    } catch (error) {
-      logger.error('Document read failed', { error })
-      return {
-        success: false,
-        message:
-          error instanceof z.ZodError
-            ? 'Invalid document arguments'
-            : messageForCopilotKnowledgeError(error),
+    return withSearchDiagnostics(
+      {
+        surface: context?.searchSurface ?? 'copilot',
+        toolCallId: context?.toolCallId,
+        executionId: context?.executionId,
+        operation: 'read_document',
+      },
+      async () => {
+        try {
+          const scope = requireCopilotKnowledgeScope(context)
+          const input = readInputSchema.parse(raw)
+          const registry = context?.resolvedSecretTraceRegistry
+          if (!registry) throw new Error('Knowledge result provenance is unavailable')
+          const readInput = {
+            ...input,
+            ...(scope.kind === 'organization'
+              ? { assertedOrganizationId: scope.organizationId }
+              : { assertedWorkspaceId: scope.workspaceId }),
+            filters: intersectWorkspaceSearchFilters(
+              { documentIds: [input.documentId] },
+              context?.assistantSearch
+            ),
+            resultSecretRegistry: registry,
+            signal: context?.abortSignal,
+          }
+          const result = await measureSearchStage('document_read', () =>
+            scope.kind === 'organization'
+              ? executeCopilotOrganizationKnowledgeUseCase(context, readSearchDocument, readInput)
+              : executeCopilotKnowledgeUseCase(context, readSearchDocument, readInput)
+          )
+          const output = {
+            success: true,
+            message: CITATION_INSTRUCTION,
+            data: {
+              ...result,
+              ...createKnowledgeDocumentCitation({
+                scope,
+                knowledgeBaseId: result.knowledgeBaseId,
+                documentId: result.documentId,
+                sourceUrl: result.sourceUrl,
+                baseUrl: getBaseUrl(),
+              }),
+            },
+          }
+          annotateSearchDiagnostics({
+            toolResultBytes: Buffer.byteLength(JSON.stringify(output)),
+            passageBytes: result.chunks.reduce(
+              (total, chunk) => total + Buffer.byteLength(chunk.content),
+              0
+            ),
+          })
+          return output
+        } catch (error) {
+          logger.error('Document read failed', { error })
+          return {
+            success: false,
+            message:
+              error instanceof z.ZodError
+                ? 'Invalid document arguments'
+                : messageForCopilotKnowledgeError(error),
+          }
+        }
       }
-    }
+    )
   },
 }
diff --git a/apps/sim/lib/copilot/tools/tool-activity.test.ts b/apps/sim/lib/copilot/tools/tool-activity.test.ts
index 8c2d90c8725..e0ad93fb872 100644
--- a/apps/sim/lib/copilot/tools/tool-activity.test.ts
+++ b/apps/sim/lib/copilot/tools/tool-activity.test.ts
@@ -34,6 +34,8 @@ describe('tool activity catalog coverage', () => {
       if (!isRecordLike(schema) || !Array.isArray(schema.enum)) continue
       expect(typeof activity, `${tool.id}.${parameter}`).toBe('object')
       if (typeof activity === 'string') continue
+      expect('parameter' in activity, `${tool.id}.${parameter}`).toBe(true)
+      if (!('parameter' in activity)) continue
       expect(activity.parameter).toBe(parameter)
       expect(Object.keys(activity.operations).sort()).toEqual([...schema.enum].sort())
       if (typeof schema.default === 'string') {
@@ -136,7 +138,7 @@ describe('getToolActivityLabel', () => {
   ])('keeps legacy combined table operations consistent with %s', (toolName) => {
     const activity = TOOL_ACTIVITIES[toolName]
     expect(typeof activity).toBe('object')
-    if (typeof activity === 'string') return
+    if (typeof activity === 'string' || !('parameter' in activity)) return
     for (const operation of Object.keys(activity.operations)) {
       expect(getToolActivityLabel('user_table', { operation })).toBe(
         getToolActivityLabel(toolName, { operation })
diff --git a/apps/sim/lib/copilot/tools/tool-activity.ts b/apps/sim/lib/copilot/tools/tool-activity.ts
index 7f4b367b5ab..10765bac5b1 100644
--- a/apps/sim/lib/copilot/tools/tool-activity.ts
+++ b/apps/sim/lib/copilot/tools/tool-activity.ts
@@ -1,3 +1,18 @@
+interface SharedObjectActivity {
+  verb: string
+  object: string
+}
+
+type ActivityPhrase = string | SharedObjectActivity
+
+const PAGE_NAVIGATION = {
+  verb: 'navigated',
+  object: 'pages',
+} as const satisfies SharedObjectActivity
+const PAGE_READING = { verb: 'read', object: 'pages' } as const satisfies SharedObjectActivity
+const PAGE_SEARCHING = { verb: 'searched', object: 'pages' } as const satisfies SharedObjectActivity
+const PAGE_SCROLLING = { verb: 'scrolled', object: 'pages' } as const satisfies SharedObjectActivity
+
 interface OperationActivity {
   label: string
   parameter: 'operation' | 'action'
@@ -61,34 +76,34 @@ const TABLE_ENRICHMENTS_OPERATIONS = {
 } as const
 
 /** Client-owned summaries; the executable tool registry stays outside the UI bundle. */
-export const TOOL_ACTIVITIES: Readonly<Record<string, string | OperationActivity>> = {
+export const TOOL_ACTIVITIES: Readonly<Record<string, ActivityPhrase | OperationActivity>> = {
   apply_file_edit: 'edited files',
   browser_click: 'clicked elements',
   browser_click_at: 'clicked elements',
   browser_close_tab: 'closed tabs',
   browser_drag: 'dragged elements',
-  browser_extract: 'read pages',
+  browser_extract: PAGE_READING,
   browser_fill_form: 'filled forms',
-  browser_find: 'searched pages',
-  browser_go_back: 'navigated pages',
-  browser_go_forward: 'navigated pages',
+  browser_find: PAGE_SEARCHING,
+  browser_go_back: PAGE_NAVIGATION,
+  browser_go_forward: PAGE_NAVIGATION,
   browser_hover: 'hovered over elements',
   browser_insert_text: 'entered text',
   browser_list_downloads: 'listed downloads',
   browser_list_sessions: 'checked signed-in sites',
   browser_list_tabs: 'listed tabs',
-  browser_navigate: 'navigated pages',
+  browser_navigate: PAGE_NAVIGATION,
   browser_open_tab: 'opened tabs',
-  browser_open_url: 'navigated pages',
+  browser_open_url: PAGE_NAVIGATION,
   browser_press_key: 'pressed keys',
-  browser_read_text: 'read pages',
-  browser_reload: 'navigated pages',
+  browser_read_text: PAGE_READING,
+  browser_reload: PAGE_NAVIGATION,
   browser_request_takeover: 'resumed browser control',
   browser_screenshot: 'captured screenshots',
-  browser_scroll: 'scrolled pages',
+  browser_scroll: PAGE_SCROLLING,
   browser_select_option: 'selected options',
   browser_set_checked: 'updated selections',
-  browser_snapshot: 'read pages',
+  browser_snapshot: PAGE_READING,
   browser_switch_tab: 'switched tabs',
   browser_type: 'entered text',
   browser_wait_for: 'waited',
@@ -382,13 +397,43 @@ export const TOOL_ACTIVITIES: Readonly<Record<string, string | OperationActivity
 }
 
 /** Unknown tools and operations retain a neutral summary for historical/custom calls. */
-export function getToolActivityLabel(toolName: string, params?: Record<string, unknown>): string {
+function resolveToolActivity(toolName: string, params?: Record<string, unknown>): ActivityPhrase {
   const activity = Object.hasOwn(TOOL_ACTIVITIES, toolName) ? TOOL_ACTIVITIES[toolName] : undefined
   if (!activity) return toolName.startsWith('browser_') ? 'used the browser' : 'used tools'
-  if (typeof activity === 'string') return activity
+  if (typeof activity === 'string' || 'verb' in activity) return activity
   const suppliedOperation = params?.[activity.parameter]
   const operation = suppliedOperation === undefined ? activity.defaultOperation : suppliedOperation
   return typeof operation === 'string' && Object.hasOwn(activity.operations, operation)
     ? activity.operations[operation]
     : activity.label
 }
+
+function activityLabel(activity: ActivityPhrase): string {
+  return typeof activity === 'string' ? activity : `${activity.verb} ${activity.object}`
+}
+
+export function getToolActivityLabel(toolName: string, params?: Record<string, unknown>): string {
+  return activityLabel(resolveToolActivity(toolName, params))
+}
+
+/** Compact only explicitly related phrases, after capping, so the shared object remains visible. */
+export function getToolActivitySummaryActions(
+  tools: ReadonlyArray<{ toolName: string; params?: Record<string, unknown> }>,
+  limit: number
+): { labels: string[]; additionalActions: number } {
+  const unique = new Map<string, ActivityPhrase>()
+  for (const tool of tools) {
+    const activity = resolveToolActivity(tool.toolName, tool.params)
+    unique.set(activityLabel(activity), activity)
+  }
+  const visible = Array.from(unique.values()).slice(0, limit)
+  const labels = visible.map((activity, index) => {
+    const next = visible[index + 1]
+    return typeof activity !== 'string' &&
+      typeof next !== 'string' &&
+      next?.object === activity.object
+      ? activity.verb
+      : activityLabel(activity)
+  })
+  return { labels, additionalActions: Math.max(0, unique.size - limit) }
+}
diff --git a/apps/sim/lib/copilot/tools/tool-display.test.ts b/apps/sim/lib/copilot/tools/tool-display.test.ts
index 9eae8f49e93..39739a99d3e 100644
--- a/apps/sim/lib/copilot/tools/tool-display.test.ts
+++ b/apps/sim/lib/copilot/tools/tool-display.test.ts
@@ -2,6 +2,7 @@
  * @vitest-environment node
  */
 import { describe, expect, it } from 'vitest'
+import { MOTHERSHIP_STREAM_V1_SCHEMA } from '@/lib/copilot/generated/mothership-stream-v1-schema'
 import {
   FfmpegOperationValues,
   ManageKnowledgeBaseOperationValues,
@@ -20,6 +21,7 @@ import {
   getWaitCountdownTitle,
   humanizeToolName,
   mvDisplayVerb,
+  normalizeToolActivityDescription,
 } from '@/lib/copilot/tools/tool-display'
 
 function representativeToolArgs(entry: ToolCatalogEntry): Record<string, unknown> {
@@ -816,3 +818,52 @@ describe('getToolStatusDisplayTitle for skipped and interrupted calls', () => {
     expect(getToolStatusDisplayTitle('Checks', 'skipped')).toBe('Skipped: Checks')
   })
 })
+
+describe('normalizeToolActivityDescription', () => {
+  it('matches the bound published by the producer contract', () => {
+    expect(MOTHERSHIP_STREAM_V1_SCHEMA).toHaveProperty(
+      '$defs.MothershipStreamV1ToolCallDescriptor.properties.activityDescription.maxLength',
+      160
+    )
+  })
+
+  it('normalizes a phrase without rewriting its meaning', () => {
+    expect(
+      normalizeToolActivityDescription('\uFEFF Checking\n\tthe\u00a0latest\u0085invoices  ')
+    ).toBe('Checking the latest invoices')
+  })
+
+  it.each([undefined, null, false, 42, {}, [], '', ' \n\t ', 'a'.repeat(161)])(
+    'ignores an invalid description: %j',
+    (value) => expect(normalizeToolActivityDescription(value)).toBeUndefined()
+  )
+
+  it('counts Unicode codepoints after whitespace normalization', () => {
+    expect(normalizeToolActivityDescription(`  ${'🧪'.repeat(160)}  `)).toBe('🧪'.repeat(160))
+    expect(normalizeToolActivityDescription('🧪'.repeat(161))).toBeUndefined()
+  })
+})
+
+describe('model-authored activity outcomes', () => {
+  it.each([
+    ['success', 'Checking invoices', 'Checked invoices'],
+    ['success', 'Read the latest inbox emails', 'Read the latest inbox emails'],
+    ['success', 'Checked invoices', 'Checked invoices'],
+    ['success', 'Check invoices', 'Check invoices'],
+    ['success', 'Reconciling invoices', 'Reconciling invoices'],
+    ['success', 'Revisando facturas', 'Revisando facturas'],
+    ['success', 'Stopped checking invoices', 'Stopped checking invoices'],
+    ['success', 'Completed: Check invoices', 'Completed: Check invoices'],
+    ['error', 'Failed: Fetching invoices', 'Failed: Fetching invoices'],
+    ['error', 'Stopped checking invoices', 'Failed checking invoices'],
+    ['error', 'Completed checking invoices', 'Failed checking invoices'],
+    ['rejected', 'Failed checking invoices', 'Failed checking invoices'],
+    ['cancelled', 'Stopped reading notes', 'Stopped reading notes'],
+    ['interrupted', 'Completed: Check invoices', 'Stopped: Check invoices'],
+    ['skipped', 'Failed: Checking invoices', 'Skipped: Checking invoices'],
+  ])('projects %s once onto "%s"', (status, description, expected) => {
+    const title = getToolStatusDisplayTitle('Fallback', status, 'read', description)
+    expect(title).toBe(expected)
+    expect(getToolStatusDisplayTitle(title, status, 'read', description)).toBe(expected)
+  })
+})
diff --git a/apps/sim/lib/copilot/tools/tool-display.ts b/apps/sim/lib/copilot/tools/tool-display.ts
index da4f01ddc7a..6e3dbd905d1 100644
--- a/apps/sim/lib/copilot/tools/tool-display.ts
+++ b/apps/sim/lib/copilot/tools/tool-display.ts
@@ -4,17 +4,23 @@ import { stripVersionSuffix, truncate } from '@sim/utils/string'
 /**
  * Single source of truth for copilot tool-call display titles.
  *
- * The mothership (Go) no longer emits any presentation metadata on the stream —
- * tool-call titles are derived entirely here, keyed by tool name (plus arguments
- * for the dynamic cases). The live client render layer (see
+ * Model-authored invocation descriptions take precedence when available. Fallback
+ * titles are derived here from the tool name and arguments. The live client render layer (see
  * `home/hooks/stream/stream-helpers.ts`) wraps this with workspace/block-name
  * enrichment for the run_* tools; every other surface (server persistence,
  * transcript replay, fallback rendering) calls `getToolDisplayTitle` directly.
  *
  * Icons are likewise client-owned — see `getAgentIcon` in the message-content
- * utils. Nothing about tool presentation lives on the Go side anymore.
+ * utils. Tool status, icons, and fallback wording remain deterministic.
  */
 
+/** Normalizes optional model-authored activity text using the producer's Unicode bound. */
+export function normalizeToolActivityDescription(value: unknown): string | undefined {
+  if (typeof value !== 'string') return undefined
+  const description = value.replace(/[\p{White_Space}\uFEFF]+/gu, ' ').trim()
+  return description && Array.from(description).length <= 160 ? description : undefined
+}
+
 type ToolArgs = Record<string, unknown> | undefined
 
 export const CONTEXT_COMPACTION_DISPLAY_TITLE = 'Summarizing context'
@@ -1402,11 +1408,8 @@ const COMPLETED_VERB_REWRITES: Record<string, string> = {
 /**
  * Rewrite a resolved display title to its past-tense form for a successfully
  * completed tool call (e.g. "Querying logs for X" -> "Queried logs for X").
- * Operates on the already-resolved title so enriched and persisted titles both
- * work. Returns undefined when the title has no leading gerund rewrite — the
- * caller keeps the original. Integration gateway descriptions are base-form
- * verb phrases ("Read recent emails") whose first word never matches a gerund
- * key, so they intentionally pass through unchanged.
+ * Returns undefined when no leading gerund rewrite is known; status formatting
+ * handles the fallback for model-authored and legacy titles.
  */
 export function getToolCompletedTitle(title: string): string | undefined {
   const spaceIndex = title.indexOf(' ')
@@ -1439,9 +1442,20 @@ function statesTerminalOutcome(title: string): boolean {
 }
 
 /** Apply one terminal outcome prefix while preserving already-resolved titles. */
-function getToolOutcomeTitle(title: string, outcome: 'Failed' | 'Stopped' | 'Skipped'): string {
-  if (statesTerminalOutcome(title)) return title
+function getToolOutcomeTitle(
+  title: string,
+  outcome: 'Failed' | 'Stopped' | 'Skipped',
+  preserveExistingOutcome: boolean
+): string {
+  if (preserveExistingOutcome && statesTerminalOutcome(title)) return title
   const firstWord = firstWordOf(title)
+  const statedOutcome = firstWord.replace(/:$/, '')
+  if (
+    !preserveExistingOutcome &&
+    (TERMINAL_TITLE_PREFIXES.has(statedOutcome) || statedOutcome === 'Completed')
+  ) {
+    return outcome + title.slice(statedOutcome.length)
+  }
   if (COMPLETED_VERB_REWRITES[firstWord]) {
     return `${outcome} ${firstWord.charAt(0).toLowerCase()}${firstWord.slice(1)}${title.slice(firstWord.length)}`
   }
@@ -1449,39 +1463,30 @@ function getToolOutcomeTitle(title: string, outcome: 'Failed' | 'Stopped' | 'Ski
 }
 
 /**
- * Rewrite a resolved display title for a FAILED tool call. A gerund title
- * becomes "Failed <gerund>…" ("Searching for X" → "Failed searching for X");
- * anything else gets a "Failed: " prefix. Without this, an errored row kept
- * its present-tense activity title verbatim and read as still running.
- */
-export function getToolFailedTitle(title: string): string {
-  return getToolOutcomeTitle(title, 'Failed')
-}
-
-/** Rewrite a resolved display title for a CANCELLED tool call ("Stopped <gerund>…"). */
-export function getToolStoppedTitle(title: string): string {
-  return getToolOutcomeTitle(title, 'Stopped')
-}
-
-/**
- * Resolve the final title for a tool status at a rendering boundary. Persisted
- * and live snapshots intentionally keep the present-tense activity title so a
- * RUNNING row remains truthful; terminal states project a tense that says the
- * work is over — completed (past tense), failed, stopped, or skipped.
+ * Resolve a tool title at the rendering boundary. Successful calls use a known
+ * past-tense rewrite when available and otherwise preserve the wording.
+ * Failed, stopped, and skipped calls retain explicit outcome labels.
  */
 export function getToolStatusDisplayTitle(
   title: string,
   status: string,
-  toolName?: string
+  toolName?: string,
+  activityDescription?: string
 ): string {
+  const description = normalizeToolActivityDescription(activityDescription)
+  title = description ?? title
   if (status === 'success' && toolName === 'browser_request_takeover') {
     return 'Resumed browser control'
   }
-  if (status === 'success') return getToolCompletedTitle(title) ?? title
-  if (status === 'error' || status === 'rejected') return getToolFailedTitle(title)
+  if (status === 'success') {
+    return getToolCompletedTitle(title) ?? title
+  }
+  if (status === 'error' || status === 'rejected') {
+    return getToolOutcomeTitle(title, 'Failed', !description)
+  }
   if (status === 'cancelled' || status === 'aborted' || status === 'interrupted') {
-    return getToolStoppedTitle(title)
+    return getToolOutcomeTitle(title, 'Stopped', !description)
   }
-  if (status === 'skipped') return getToolOutcomeTitle(title, 'Skipped')
+  if (status === 'skipped') return getToolOutcomeTitle(title, 'Skipped', !description)
   return title
 }
diff --git a/apps/sim/lib/core/application/authorized-workspace-use-case.test.ts b/apps/sim/lib/core/application/authorized-workspace-use-case.test.ts
index 5ead0766352..f9d1b64e6a5 100644
--- a/apps/sim/lib/core/application/authorized-workspace-use-case.test.ts
+++ b/apps/sim/lib/core/application/authorized-workspace-use-case.test.ts
@@ -10,11 +10,18 @@ import type {
 import { beforeEach, describe, expect, expectTypeOf, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
+  routingEnabled: vi.fn(() => false),
+  resolveRoute: vi.fn(async () => ({ kind: 'direct' as const })),
   events: [] as string[],
   recordAudit: vi.fn(() => mocks.events.push('audit')),
   resolvePermission: vi.fn(),
 }))
 
+vi.mock('@/lib/core/network/config.server', () => ({
+  isOutboundRoutingEnabled: mocks.routingEnabled,
+  resolveOutboundRoute: mocks.resolveRoute,
+}))
+
 vi.mock('@sim/audit', () => ({
   AuditAction: { FILE_UPDATED: 'file.updated' },
   AuditResourceType: { FILE: 'file' },
@@ -33,6 +40,7 @@ vi.mock('@sim/platform-authz/workspace', () => ({
 
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import { defineAuthorizedWorkspaceUseCase, defineWorkspaceOperation } from '@/lib/core/application'
+import { resolveCurrentOutboundRoute } from '@/lib/core/network/context.server'
 import type { OrchestrationError } from '@/lib/core/orchestration/types'
 import { CREDENTIAL_GROUP_CREDENTIAL_USE_ACTION } from '@/lib/resource-policies/registry'
 
@@ -100,10 +108,37 @@ const sessionPrincipal: SessionPrincipal = {
 describe('defineAuthorizedWorkspaceUseCase', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mocks.routingEnabled.mockReturnValue(false)
     mocks.events.length = 0
     mocks.resolvePermission.mockResolvedValue('write')
   })
 
+  it('establishes outbound ownership after authorization and retains it through effects', async () => {
+    mocks.routingEnabled.mockReturnValue(true)
+    const useCase = defineAuthorizedWorkspaceUseCase({
+      operation,
+      resolveContext: async () => canonicalContext,
+      authorizationOptions: {},
+      async execute() {
+        expect(mocks.resolvePermission).toHaveBeenCalledOnce()
+        await resolveCurrentOutboundRoute()
+        return 'done'
+      },
+      async afterSuccess() {
+        await resolveCurrentOutboundRoute()
+      },
+    })
+    await expect(useCase.execute({ principal: sessionPrincipal, input: {} })).resolves.toBe('done')
+    expect(mocks.resolveRoute.mock.calls).toEqual([['organization-1'], ['organization-1']])
+    await resolveCurrentOutboundRoute()
+    expect(mocks.resolveRoute).toHaveBeenLastCalledWith(undefined)
+
+    mocks.resolveRoute.mockClear()
+    mocks.resolvePermission.mockResolvedValue(null)
+    await expect(useCase.execute({ principal: sessionPrincipal, input: {} })).rejects.toThrow()
+    expect(mocks.resolveRoute).not.toHaveBeenCalled()
+  })
+
   it('narrows definition callbacks while keeping public execution principal-safe', async () => {
     const resolveContext = vi.fn(
       async ({ principal }: { principal: SessionPrincipal; input: TestInput }) => {
diff --git a/apps/sim/lib/core/application/authorized-workspace-use-case.ts b/apps/sim/lib/core/application/authorized-workspace-use-case.ts
index c3a8b2e1d3d..19ed9ff3965 100644
--- a/apps/sim/lib/core/application/authorized-workspace-use-case.ts
+++ b/apps/sim/lib/core/application/authorized-workspace-use-case.ts
@@ -12,6 +12,7 @@ import type {
   PrincipalForOperation,
   WorkspaceOperation,
 } from '@/lib/core/application/workspace-operation'
+import { runWithOutboundOrganization } from '@/lib/core/network/context.server'
 import type { OrchestrationRequestContext } from '@/lib/core/orchestration/types'
 import type { ResourcePolicyBinding } from '@/lib/resource-policies/registry'
 
@@ -205,23 +206,25 @@ export function defineAuthorizedWorkspaceUseCase<
     async execute(args) {
       const executionContext = await authorizePhase(args)
       const { principal, context, request } = executionContext
-      const result = await definition.execute(executionContext)
-      const resultContext = { ...executionContext, result }
-      const projectedAudit = definition.projectAudit?.(resultContext)
-      if (projectedAudit !== undefined) {
-        const auditEntries = Array.isArray(projectedAudit) ? projectedAudit : [projectedAudit]
-        if (auditEntries.length > 0) {
-          recordProjectedUseCaseAuditEntries(
-            definition.operation,
-            context.workspaceId,
-            principal,
-            request,
-            auditEntries
-          )
+      return runWithOutboundOrganization(context.workspaceOrganizationId, async () => {
+        const result = await definition.execute(executionContext)
+        const resultContext = { ...executionContext, result }
+        const projectedAudit = definition.projectAudit?.(resultContext)
+        if (projectedAudit !== undefined) {
+          const auditEntries = Array.isArray(projectedAudit) ? projectedAudit : [projectedAudit]
+          if (auditEntries.length > 0) {
+            recordProjectedUseCaseAuditEntries(
+              definition.operation,
+              context.workspaceId,
+              principal,
+              request,
+              auditEntries
+            )
+          }
         }
-      }
-      await definition.afterSuccess?.(resultContext)
-      return result
+        await definition.afterSuccess?.(resultContext)
+        return result
+      })
     },
   }
 }
diff --git a/apps/sim/lib/core/config/appconfig.test.ts b/apps/sim/lib/core/config/appconfig.test.ts
index fb497fe1788..e5f797d665f 100644
--- a/apps/sim/lib/core/config/appconfig.test.ts
+++ b/apps/sim/lib/core/config/appconfig.test.ts
@@ -1,7 +1,7 @@
 /**
  * @vitest-environment node
  */
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { mockSend } = vi.hoisted(() => ({
   mockSend: vi.fn(),
@@ -21,7 +21,7 @@ vi.mock('@aws-sdk/client-appconfigdata', () => ({
   },
 }))
 
-import { fetchAppConfigProfile } from '@/lib/core/config/appconfig'
+import { fetchAppConfigProfile, fetchAppConfigSnapshot } from '@/lib/core/config/appconfig'
 
 const encode = (value: unknown) => new TextEncoder().encode(JSON.stringify(value))
 
@@ -133,4 +133,154 @@ describe('fetchAppConfigProfile', () => {
     expect(b).toEqual({ x: 1 })
     expect(mockSend.mock.calls.map(([c]) => c.__type)).toEqual(['start', 'get'])
   })
+
+  it('honors the server poll interval and serves warm values during one shared refresh', async () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(100_000)
+    try {
+      mockSend.mockImplementation((command: { __type: string }) =>
+        Promise.resolve(
+          command.__type === 'start'
+            ? { InitialConfigurationToken: 'token' }
+            : {
+                Configuration: encode({ revision: 'first' }),
+                NextPollConfigurationToken: 'next',
+                NextPollIntervalInSeconds: 60,
+              }
+        )
+      )
+      const ids = uniqueIds()
+      const parse = (value: unknown) => value
+      expect(await fetchAppConfigProfile(ids, parse)).toEqual({ revision: 'first' })
+      vi.setSystemTime(130_001)
+      await fetchAppConfigProfile(ids, parse)
+      expect(mockSend).toHaveBeenCalledTimes(2)
+
+      let finish: (value: unknown) => void = () => {}
+      mockSend.mockReturnValueOnce(
+        new Promise((resolve) => {
+          finish = resolve
+        })
+      )
+      vi.setSystemTime(161_000)
+      expect(
+        await Promise.all([fetchAppConfigProfile(ids, parse), fetchAppConfigProfile(ids, parse)])
+      ).toEqual([{ revision: 'first' }, { revision: 'first' }])
+      expect(mockSend).toHaveBeenCalledTimes(3)
+      finish({ Configuration: encode({ revision: 'second' }), NextPollConfigurationToken: 'next' })
+      await vi.waitFor(async () => {
+        expect(await fetchAppConfigProfile(ids, parse)).toEqual({ revision: 'second' })
+      })
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+})
+
+describe('fetchAppConfigSnapshot freshness', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.useFakeTimers()
+    vi.setSystemTime(100_000)
+  })
+  afterEach(() => vi.useRealTimers())
+
+  it('evicts old profiles and requires fresh evidence when they are requested again', async () => {
+    mockSend.mockImplementation((command: { __type: string }) =>
+      Promise.resolve(
+        command.__type === 'start'
+          ? { InitialConfigurationToken: 'token' }
+          : { Configuration: encode({ revision: 'valid' }), NextPollConfigurationToken: 'next' }
+      )
+    )
+    const oldest = uniqueIds()
+    await fetchAppConfigSnapshot(oldest, (value) => value)
+    const results = await Promise.all(
+      Array.from({ length: 65 }, () => fetchAppConfigSnapshot(uniqueIds(), (value) => value))
+    )
+    expect(results.every((result) => result.value !== null)).toBe(true)
+    mockSend.mockRejectedValueOnce(new Error('unavailable'))
+    expect(await fetchAppConfigSnapshot(oldest, (value) => value)).toEqual({
+      value: null,
+      validatedAt: null,
+    })
+    expect(mockSend.mock.calls.at(-1)?.[0].__type).toBe('start')
+  })
+
+  it('does not turn an empty first response or a cold failure into a valid snapshot', async () => {
+    mockSend.mockRejectedValueOnce(new Error('unavailable'))
+    expect(await fetchAppConfigSnapshot(uniqueIds(), (value) => value)).toEqual({
+      value: null,
+      validatedAt: null,
+    })
+    mockSend.mockImplementation((command: { __type: string }) =>
+      Promise.resolve(
+        command.__type === 'start'
+          ? { InitialConfigurationToken: 'token' }
+          : { Configuration: new Uint8Array(), NextPollConfigurationToken: 'next' }
+      )
+    )
+    expect(await fetchAppConfigSnapshot(uniqueIds(), (value) => value)).toEqual({
+      value: null,
+      validatedAt: null,
+    })
+  })
+
+  it('does not renew an old snapshot after a rejected revision followed by unchanged polls', async () => {
+    let payload = encode({ revision: 'valid' })
+    mockSend.mockImplementation((command: { __type: string }) =>
+      Promise.resolve(
+        command.__type === 'start'
+          ? { InitialConfigurationToken: 'token' }
+          : {
+              Configuration: payload,
+              NextPollConfigurationToken: 'next',
+              NextPollIntervalInSeconds: 30,
+            }
+      )
+    )
+    const ids = uniqueIds()
+    const parse = (value: unknown) => value
+    const first = await fetchAppConfigSnapshot(ids, parse)
+    expect(first.validatedAt).toBe(100_000)
+    payload = new TextEncoder().encode('invalid json')
+    vi.setSystemTime(130_001)
+    expect(await fetchAppConfigSnapshot(ids, parse)).toEqual(first)
+    payload = new Uint8Array()
+    vi.setSystemTime(160_002)
+    expect(await fetchAppConfigSnapshot(ids, parse)).toEqual(first)
+    payload = encode({ revision: 'replacement' })
+    vi.setSystemTime(190_003)
+    expect(await fetchAppConfigSnapshot(ids, parse)).toEqual({
+      value: { revision: 'replacement' },
+      validatedAt: 190_003,
+    })
+  })
+
+  it('renews a validated unchanged revision and deduplicates due polls', async () => {
+    let payload = encode({ revision: 'valid' })
+    mockSend.mockImplementation((command: { __type: string }) =>
+      Promise.resolve(
+        command.__type === 'start'
+          ? { InitialConfigurationToken: 'token' }
+          : {
+              Configuration: payload,
+              NextPollConfigurationToken: 'next',
+              NextPollIntervalInSeconds: 30,
+            }
+      )
+    )
+    const ids = uniqueIds()
+    const parse = (value: unknown) => value
+    await fetchAppConfigSnapshot(ids, parse)
+    payload = new Uint8Array()
+    vi.setSystemTime(130_001)
+    const results = await Promise.all([
+      fetchAppConfigSnapshot(ids, parse),
+      fetchAppConfigSnapshot(ids, parse),
+    ])
+    expect(results[0].validatedAt).toBe(130_001)
+    expect(results[1]).toEqual(results[0])
+    expect(mockSend.mock.calls).toHaveLength(3)
+  })
 })
diff --git a/apps/sim/lib/core/config/appconfig.ts b/apps/sim/lib/core/config/appconfig.ts
index 61aa093c375..8ebfc5eb954 100644
--- a/apps/sim/lib/core/config/appconfig.ts
+++ b/apps/sim/lib/core/config/appconfig.ts
@@ -6,6 +6,7 @@ import {
 } from '@aws-sdk/client-appconfigdata'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
+import { LRUCache } from 'lru-cache'
 import { getAwsCredentialsFromEnv } from '@/lib/core/config/aws'
 import { env } from '@/lib/core/config/env'
 
@@ -22,16 +23,43 @@ export interface AppConfigProfileIdentifiers {
 interface CacheEntry<T> {
   /** Last successfully parsed value, or `null` if the config is empty/unseeded. */
   value: T | null
-  /** True once any poll has completed (success, empty payload, or error). */
-  loaded: boolean
   /** Token for the next `GetLatestConfiguration` poll, rotated on each call. */
   nextToken: string | undefined
-  expiresAt: number
-  /** In-flight poll, shared so concurrent callers don't each hit AppConfig. */
-  inflight: Promise<T | null> | null
+  validatedAt: number | null
+  remoteMatchesValue: boolean
+  strict: boolean
 }
 
-const cache = new Map<string, CacheEntry<unknown>>()
+export interface AppConfigSnapshot<T> {
+  readonly value: T | null
+  readonly validatedAt: number | null
+}
+
+interface PollContext {
+  ids: AppConfigProfileIdentifiers
+  parse: (json: unknown) => unknown
+  strict: boolean
+}
+
+const cache = new LRUCache<string, CacheEntry<unknown>, PollContext>({
+  max: 64,
+  ttl: DEFAULT_TTL_MS,
+  ttlResolution: 0,
+  ignoreFetchAbort: true,
+  /** Poll intervals and snapshot freshness share the same clock. */
+  perf: { now: () => Date.now() },
+  fetchMethod: async (_key, stale, { context, options }) => {
+    const entry = stale ?? {
+      value: null,
+      nextToken: undefined,
+      validatedAt: null,
+      remoteMatchesValue: false,
+      strict: context.strict,
+    }
+    options.ttl = await poll(context.ids, context.parse, entry)
+    return entry
+  },
+})
 
 let client: AppConfigDataClient | null = null
 
@@ -58,68 +86,69 @@ function cacheKey(ids: AppConfigProfileIdentifiers): string {
  * Run one AppConfig poll for `entry`: starts a session if no token is held, then
  * calls `GetLatestConfiguration`. An empty payload means "unchanged" (or an
  * unseeded profile) and the previous value is kept. Any error is logged and the
- * last good value is retained. Marks the entry `loaded` on any outcome so callers
- * never re-block on the cold path, and honors AppConfig's `NextPollInterval` so we
+ * last good value is retained. Returns AppConfig's `NextPollInterval` so we
  * don't poll faster than the server allows (which would throttle).
  */
 async function poll<T>(
   ids: AppConfigProfileIdentifiers,
   parse: (json: unknown) => T,
   entry: CacheEntry<T>
-): Promise<T | null> {
+): Promise<number> {
   let response: GetLatestConfigurationCommandOutput
   try {
     const dataClient = getClient()
 
     if (!entry.nextToken) {
+      entry.remoteMatchesValue = false
       const session = await dataClient.send(
         new StartConfigurationSessionCommand({
           ApplicationIdentifier: ids.application,
           EnvironmentIdentifier: ids.environment,
           ConfigurationProfileIdentifier: ids.profile,
-        })
+        }),
+        { abortSignal: AbortSignal.timeout(5000) }
       )
       entry.nextToken = session.InitialConfigurationToken
     }
 
     response = await dataClient.send(
-      new GetLatestConfigurationCommand({ ConfigurationToken: entry.nextToken })
+      new GetLatestConfigurationCommand({ ConfigurationToken: entry.nextToken }),
+      { abortSignal: AbortSignal.timeout(5000) }
     )
     entry.nextToken = response.NextPollConfigurationToken ?? entry.nextToken
   } catch (error) {
-    // Network/session failure: drop the token so the next attempt starts a fresh
-    // session (handles expired or invalid tokens). Mark loaded + back off so we
-    // serve the fallback and retry in the background rather than blocking every
-    // request during an outage.
+    /** A failed or expired session retries after backoff without renewing snapshot freshness. */
     entry.nextToken = undefined
-    entry.expiresAt = Date.now() + DEFAULT_TTL_MS
-    entry.loaded = true
     logger.error('AppConfig fetch failed; serving last known value', {
       profile: cacheKey(ids),
       error: getErrorMessage(error),
     })
-    return entry.value
+    return DEFAULT_TTL_MS
   }
 
-  // Parse outside the network try: a decode/parse error must NOT discard the
-  // already-rotated session token — the round trip succeeded, so the next poll
-  // can reuse it instead of opening a new session. Keep the last good value.
+  /** Decode failures retain the rotated session token and last validated value. */
   try {
     if (response.Configuration && response.Configuration.length > 0) {
+      entry.remoteMatchesValue = false
+      if (entry.strict && response.Configuration.length > 1_048_576) {
+        throw new Error('Configuration exceeds the maximum size')
+      }
       const text = new TextDecoder().decode(response.Configuration)
       entry.value = parse(JSON.parse(text))
+      entry.remoteMatchesValue = true
+    }
+    if (entry.remoteMatchesValue && entry.value !== null) {
+      entry.validatedAt = Date.now()
     }
   } catch (error) {
     logger.error('AppConfig response parse failed; serving last known value', {
       profile: cacheKey(ids),
-      error: getErrorMessage(error),
+      error: entry.strict ? 'Configuration rejected' : getErrorMessage(error),
     })
   }
 
   const intervalMs = (response.NextPollIntervalInSeconds ?? 60) * 1000
-  entry.expiresAt = Date.now() + Math.max(DEFAULT_TTL_MS, intervalMs)
-  entry.loaded = true
-  return entry.value
+  return Math.max(DEFAULT_TTL_MS, intervalMs)
 }
 
 /**
@@ -137,31 +166,28 @@ export async function fetchAppConfigProfile<T>(
   ids: AppConfigProfileIdentifiers,
   parse: (json: unknown) => T
 ): Promise<T | null> {
-  const key = cacheKey(ids)
-  const entry = (cache.get(key) as CacheEntry<T> | undefined) ?? {
-    value: null,
-    loaded: false,
-    nextToken: undefined,
-    expiresAt: 0,
-    inflight: null,
-  }
-  cache.set(key, entry)
-
-  // Cold: never polled — await a single shared poll so concurrent callers don't
-  // each hit AppConfig (and don't race the rotating session token).
-  if (!entry.loaded) {
-    entry.inflight ??= poll(ids, parse, entry).finally(() => {
-      entry.inflight = null
-    })
-    return entry.inflight
-  }
-
-  // Warm but stale: serve cached value, refresh once in the background.
-  if (Date.now() >= entry.expiresAt && !entry.inflight) {
-    entry.inflight = poll(ids, parse, entry).finally(() => {
-      entry.inflight = null
-    })
-  }
+  const entry = await cache.fetch(cacheKey(ids), {
+    context: { ids, parse, strict: false },
+    allowStale: true,
+  })
+  return (entry?.value ?? null) as T | null
+}
 
-  return entry.value
+/**
+ * Security-sensitive callers receive freshness evidence instead of an implicit fallback.
+ * Due polls are awaited and deduplicated. Rejected remote revisions cannot renew an old
+ * snapshot through subsequent unchanged responses. The caller owns its maximum stale age.
+ */
+export async function fetchAppConfigSnapshot<T>(
+  ids: AppConfigProfileIdentifiers,
+  parse: (json: unknown) => T
+): Promise<AppConfigSnapshot<T>> {
+  const entry = await cache.fetch(`strict:${cacheKey(ids)}`, {
+    context: { ids, parse, strict: true },
+    allowStale: false,
+  })
+  return Object.freeze({
+    value: (entry?.value ?? null) as T | null,
+    validatedAt: entry?.validatedAt ?? null,
+  })
 }
diff --git a/apps/sim/lib/core/config/env.ts b/apps/sim/lib/core/config/env.ts
index efece380bdb..72c47f9a279 100644
--- a/apps/sim/lib/core/config/env.ts
+++ b/apps/sim/lib/core/config/env.ts
@@ -107,6 +107,10 @@ export const env = createEnv({
   skipValidation: true,
 
   server: {
+    OUTBOUND_ROUTING_SOURCE: z.enum(['env', 'appconfig']).optional(),
+    OUTBOUND_ROUTING_CONFIG: z.string().optional(),
+    OUTBOUND_GATEWAYS: z.string().optional(),
+    OUTBOUND_GATEWAY_CREDENTIALS: z.string().optional(),
     // Core Database & Authentication
     DATABASE_URL:                          z.string().url(),                       // Primary database connection string
     DATABASE_REPLICA_URL:                  z.string().url().optional(),            // Read-replica connection string; opt-in reads fall back to the primary when unset
diff --git a/apps/sim/lib/core/network/application/read-organization-network.test.ts b/apps/sim/lib/core/network/application/read-organization-network.test.ts
new file mode 100644
index 00000000000..ed0a230acdb
--- /dev/null
+++ b/apps/sim/lib/core/network/application/read-organization-network.test.ts
@@ -0,0 +1,105 @@
+/** @vitest-environment node */
+import type { Principal } from '@sim/auth/principal'
+import { db } from '@sim/db'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  membership: vi.fn(),
+  section: vi.fn(),
+  route: vi.fn(),
+}))
+vi.mock('@/lib/permission-groups/resolve.server', () => ({
+  getUserPermissionConfigForOrganization: vi.fn(async () => null),
+}))
+vi.mock('@/lib/settings/application/organization-section-access', () => ({
+  authorizeOrganizationSettingsSection: mocks.section,
+}))
+vi.mock('@/lib/core/network/config.server', () => ({ resolveOutboundRoute: mocks.route }))
+
+import { readOrganizationNetwork } from '@/lib/core/network/application/read-organization-network'
+import { OutboundRoutingError } from '@/lib/core/network/routing'
+
+const principal: Principal = {
+  kind: 'session',
+  userId: 'user_example',
+  sessionId: 'session_example',
+}
+const input = { organizationId: 'org_example' }
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.membership.mockResolvedValue([{ role: 'admin' }])
+  mocks.section.mockResolvedValue(true)
+  mocks.route.mockResolvedValue({ kind: 'direct' })
+  const query = { from: vi.fn(), where: vi.fn(), limit: mocks.membership }
+  query.from.mockReturnValue(query)
+  query.where.mockReturnValue(query)
+  vi.mocked(db.select).mockReturnValue(query as ReturnType<typeof db.select>)
+})
+
+describe('organization network settings', () => {
+  it.each([[], [{ role: 'member' }]])('withholds routing from non-admins', async (rows) => {
+    mocks.membership.mockResolvedValue(rows)
+    await expect(readOrganizationNetwork.execute({ principal, input })).rejects.toThrow()
+    expect(mocks.route).not.toHaveBeenCalled()
+    expect(mocks.section).not.toHaveBeenCalled()
+  })
+
+  it('rejects workspace credentials before looking up the organization', async () => {
+    const workspacePrincipal: Principal = {
+      kind: 'workspace_api_key',
+      workspaceId: 'workspace_example',
+      apiKeyId: 'key_example',
+    }
+    await expect(
+      readOrganizationNetwork.execute({ principal: workspacePrincipal, input })
+    ).rejects.toThrow()
+    expect(mocks.membership).not.toHaveBeenCalled()
+    expect(mocks.route).not.toHaveBeenCalled()
+  })
+
+  it('checks the target organization entitlement before reading its network', async () => {
+    mocks.section.mockResolvedValue(false)
+    await expect(readOrganizationNetwork.execute({ principal, input })).rejects.toThrow(
+      'Network settings are not available'
+    )
+    expect(mocks.route).not.toHaveBeenCalled()
+    expect(mocks.section).toHaveBeenCalledWith(
+      expect.objectContaining({ organizationId: 'org_example', section: 'security' })
+    )
+  })
+
+  it('projects only published addresses, never credentials or dial addresses', async () => {
+    mocks.route.mockResolvedValue({
+      kind: 'gateway',
+      gateway: {
+        id: 'gateway_example',
+        url: 'https://private.example.invalid',
+        token: 'synthetic-secret',
+        ca: 'synthetic-ca',
+        publicIps: ['192.0.2.10', '192.0.2.20'],
+      },
+    })
+    await expect(readOrganizationNetwork.execute({ principal, input })).resolves.toEqual({
+      mode: 'gateway',
+      publicIps: ['192.0.2.10', '192.0.2.20'],
+    })
+    expect(mocks.route).toHaveBeenCalledWith('org_example')
+  })
+
+  it.each([
+    ['ROUTE_BLOCKED', 'blocked'],
+    ['CONFIGURATION_UNAVAILABLE', 'unavailable'],
+    ['INVALID_CONFIGURATION', 'unavailable'],
+  ] as const)('reports %s without claiming direct fallback', async (code, mode) => {
+    mocks.route.mockRejectedValue(new OutboundRoutingError(code))
+    await expect(readOrganizationNetwork.execute({ principal, input })).resolves.toEqual({ mode })
+  })
+
+  it('propagates unexpected failures instead of treating them as default routing', async () => {
+    mocks.route.mockRejectedValue(new Error('unexpected failure'))
+    await expect(readOrganizationNetwork.execute({ principal, input })).rejects.toThrow(
+      'unexpected failure'
+    )
+  })
+})
diff --git a/apps/sim/lib/core/network/application/read-organization-network.ts b/apps/sim/lib/core/network/application/read-organization-network.ts
new file mode 100644
index 00000000000..0ebca832dce
--- /dev/null
+++ b/apps/sim/lib/core/network/application/read-organization-network.ts
@@ -0,0 +1,55 @@
+import type { OperationUseCase } from '@/lib/core/application/operation'
+import { authorizeOrganizationOperation } from '@/lib/core/application/organization-authorization'
+import { defineOrganizationOperation } from '@/lib/core/application/organization-operation'
+import { resolveOutboundRoute } from '@/lib/core/network/config.server'
+import { OutboundRoutingError } from '@/lib/core/network/routing'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { authorizeOrganizationSettingsSection } from '@/lib/settings/application/organization-section-access'
+
+type OrganizationNetwork =
+  | { mode: 'direct' | 'blocked' | 'unavailable' }
+  | { mode: 'gateway'; publicIps: string[] }
+
+/**
+ * permission-group-exempt: Network settings are governed by organization administrator membership.
+ */
+export const readOrganizationNetworkOperation = defineOrganizationOperation({
+  id: 'organization.network.read',
+  minimumRole: 'admin',
+  principalKinds: ['session'],
+  capability: 'none',
+})
+
+export const readOrganizationNetwork: OperationUseCase<
+  typeof readOrganizationNetworkOperation,
+  { organizationId: string },
+  OrganizationNetwork
+> = {
+  operation: readOrganizationNetworkOperation,
+  async execute({ principal, input }) {
+    const context = await authorizeOrganizationOperation(
+      principal,
+      readOrganizationNetworkOperation,
+      input
+    )
+    if (
+      !(await authorizeOrganizationSettingsSection({
+        ...context,
+        section: 'security',
+      }))
+    ) {
+      throw new OrchestrationError('forbidden', 'Network settings are not available')
+    }
+    try {
+      const route = await resolveOutboundRoute(context.organizationId)
+      if (route.kind === 'direct') return { mode: 'direct' }
+      return {
+        mode: 'gateway',
+        publicIps: [...(route.gateway.publicIps ?? [])],
+      }
+    } catch (error) {
+      if (!(error instanceof OutboundRoutingError)) throw error
+      return { mode: error.code === 'ROUTE_BLOCKED' ? 'blocked' : 'unavailable' }
+    }
+  },
+}
diff --git a/apps/sim/lib/core/network/config.server.test.ts b/apps/sim/lib/core/network/config.server.test.ts
new file mode 100644
index 00000000000..945aff74e29
--- /dev/null
+++ b/apps/sim/lib/core/network/config.server.test.ts
@@ -0,0 +1,215 @@
+/** @vitest-environment node */
+import { describe, expect, it, vi } from 'vitest'
+import { createOutboundRoutingReader } from '@/lib/core/network/config.server'
+
+const document = {
+  schemaVersion: 1,
+  revision: 'revision-1',
+  organizations: { org_a: { kind: 'gateway', gatewayId: 'gateway_a' } },
+}
+const catalog = {
+  gateway_a: {
+    organizationId: 'org_a',
+    url: 'https://proxy.example.invalid/',
+    credentialId: 'credential_a',
+  },
+}
+const credentials = { credential_a: { token: 'synthetic-test-token-0000000000000000' } }
+const options = {
+  source: 'env',
+  configuration: JSON.stringify(document),
+  gateways: JSON.stringify(catalog),
+  credentials: JSON.stringify(credentials),
+}
+const dependencies = { now: () => 400_000, readSnapshot: vi.fn() }
+
+describe('outbound configuration', () => {
+  it('keeps unconfigured OSS deployments independent of AWS and organization context', async () => {
+    const readSnapshot = vi.fn()
+    const reader = createOutboundRoutingReader({}, { ...dependencies, readSnapshot })
+    expect(reader.enabled).toBe(false)
+    expect(await reader.resolve(undefined)).toEqual({ kind: 'direct' })
+    expect(readSnapshot).not.toHaveBeenCalled()
+  })
+
+  it.each([undefined, '{}'])(
+    'rejects missing AppConfig gateway catalog %s before routing',
+    (gateways) => {
+      expect(() =>
+        createOutboundRoutingReader(
+          {
+            ...options,
+            source: 'appconfig',
+            configuration: undefined,
+            gateways,
+          },
+          dependencies
+        )
+      ).toThrow('INVALID_CONFIGURATION')
+    }
+  )
+
+  it('does not treat missing context as a personal workspace', async () => {
+    const reader = createOutboundRoutingReader(options, dependencies)
+    await expect(reader.resolve(undefined)).rejects.toThrow('MISSING_SCOPE')
+    expect(await reader.resolve(null)).toEqual({ kind: 'direct' })
+    expect(await reader.resolve('org_a')).toMatchObject({
+      kind: 'gateway',
+      gateway: { id: 'gateway_a' },
+    })
+  })
+
+  it('rejects assignments to another organization and gateway defaults', () => {
+    for (const overrides of [
+      { defaultRoute: { kind: 'gateway', gatewayId: 'gateway_a' } },
+      { organizations: { org_b: { kind: 'gateway', gatewayId: 'gateway_a' } } },
+    ]) {
+      expect(() =>
+        createOutboundRoutingReader(
+          {
+            ...options,
+            configuration: JSON.stringify({ ...document, ...overrides }),
+          },
+          dependencies
+        )
+      ).toThrow('INVALID_CONFIGURATION')
+    }
+  })
+
+  it('refuses to share an endpoint or credential between organizations', () => {
+    for (const gateway of [
+      { ...catalog.gateway_a, organizationId: 'org_b' },
+      { ...catalog.gateway_a, organizationId: 'org_b', url: 'https://second.invalid/' },
+    ]) {
+      expect(() =>
+        createOutboundRoutingReader(
+          {
+            ...options,
+            gateways: JSON.stringify({ ...catalog, gateway_b: gateway }),
+          },
+          dependencies
+        )
+      ).toThrow('INVALID_CONFIGURATION')
+    }
+  })
+
+  it('does not release a reserved organization when its assignment is removed', async () => {
+    const reader = createOutboundRoutingReader(
+      {
+        ...options,
+        configuration: JSON.stringify({ ...document, organizations: {} }),
+      },
+      dependencies
+    )
+    await expect(reader.resolve('org_a')).rejects.toThrow('ROUTE_BLOCKED')
+    expect(await reader.resolve('org_other')).toEqual({ kind: 'direct' })
+  })
+
+  it('uses explicit direct and blocked assignments only for reserved organizations', async () => {
+    for (const kind of ['direct', 'blocked']) {
+      const reader = createOutboundRoutingReader(
+        {
+          ...options,
+          configuration: JSON.stringify({
+            ...document,
+            organizations: { org_a: { kind } },
+          }),
+        },
+        dependencies
+      )
+      if (kind === 'direct') {
+        expect(await reader.resolve('org_a')).toEqual({ kind: 'direct' })
+      } else {
+        await expect(reader.resolve('org_a')).rejects.toThrow('ROUTE_BLOCKED')
+      }
+      expect(await reader.resolve('constructor')).toEqual({ kind: 'direct' })
+    }
+  })
+
+  it('rejects an outbound IP published for two different owners', () => {
+    expect(() =>
+      createOutboundRoutingReader(
+        {
+          ...options,
+          credentials: JSON.stringify({ ...credentials, credential_b: { token: 'b'.repeat(48) } }),
+          gateways: JSON.stringify({
+            gateway_a: { ...catalog.gateway_a, publicIps: ['192.0.2.10'] },
+            gateway_b: {
+              ...catalog.gateway_a,
+              organizationId: 'org_b',
+              url: 'https://second.invalid/',
+              credentialId: 'credential_b',
+              publicIps: ['192.0.2.10'],
+            },
+          }),
+        },
+        dependencies
+      )
+    ).toThrow('INVALID_CONFIGURATION')
+  })
+
+  it.each([
+    { ...options, source: undefined },
+    { ...options, configuration: undefined },
+    { ...options, gateways: '{}' },
+    { ...options, credentials: '{}' },
+    {
+      ...options,
+      gateways: JSON.stringify({
+        gateway_a: { ...catalog.gateway_a, url: 'http://proxy.example.invalid/' },
+      }),
+    },
+    {
+      ...options,
+      gateways: JSON.stringify({
+        gateway_a: { ...catalog.gateway_a, url: 'https://user:password@proxy.example.invalid/' },
+      }),
+    },
+  ])('rejects incomplete or unsafe operator configuration', (input) => {
+    expect(() => createOutboundRoutingReader(input, dependencies)).toThrow('INVALID_CONFIGURATION')
+  })
+
+  it('never falls back to direct routing on cold, stale or future snapshots', async () => {
+    for (const validatedAt of [null, 100_000, 500_000]) {
+      const reader = createOutboundRoutingReader(
+        { ...options, source: 'appconfig', configuration: undefined },
+        {
+          ...dependencies,
+          readSnapshot: async (parse) => ({ value: parse(document), validatedAt }),
+        }
+      )
+      await expect(reader.resolve('org_a')).rejects.toThrow('CONFIGURATION_UNAVAILABLE')
+      expect(await reader.resolve('org_other')).toEqual({ kind: 'direct' })
+      expect(await reader.resolve(null)).toEqual({ kind: 'direct' })
+    }
+  })
+
+  it('never reads AppConfig for organizations without a reservation', async () => {
+    const readSnapshot = vi.fn().mockRejectedValue(new Error('AppConfig unavailable'))
+    const reader = createOutboundRoutingReader(
+      { ...options, source: 'appconfig', configuration: undefined },
+      { ...dependencies, readSnapshot }
+    )
+    expect(await reader.resolve('org_other')).toEqual({ kind: 'direct' })
+    expect(await reader.resolve(null)).toEqual({ kind: 'direct' })
+    expect(readSnapshot).not.toHaveBeenCalled()
+  })
+
+  it('keeps a still-valid snapshot and re-resolves current routing for each operation', async () => {
+    let current: unknown = document
+    const reader = createOutboundRoutingReader(
+      { ...options, source: 'appconfig', configuration: undefined },
+      {
+        ...dependencies,
+        readSnapshot: async (parse) => ({ value: parse(current), validatedAt: 350_000 }),
+      }
+    )
+    expect(await reader.resolve('org_a')).toMatchObject({ kind: 'gateway' })
+    current = {
+      ...document,
+      revision: 'revision-2',
+      organizations: { org_a: { kind: 'blocked' } },
+    }
+    await expect(reader.resolve('org_a')).rejects.toThrow('ROUTE_BLOCKED')
+  })
+})
diff --git a/apps/sim/lib/core/network/config.server.ts b/apps/sim/lib/core/network/config.server.ts
new file mode 100644
index 00000000000..c04c56ddf9d
--- /dev/null
+++ b/apps/sim/lib/core/network/config.server.ts
@@ -0,0 +1,247 @@
+import { isIP } from 'node:net'
+import { z } from 'zod'
+import type { AppConfigSnapshot } from '@/lib/core/config/appconfig'
+import { env } from '@/lib/core/config/env'
+import { gatewayPublicMetadataSchema } from '@/lib/core/network/gateway-metadata'
+import {
+  type OutboundRoutingConfig,
+  OutboundRoutingError,
+  parseOutboundJson,
+  parseOutboundRoutingConfig,
+} from '@/lib/core/network/routing'
+
+const MAX_STALE_MS = 300_000
+const keySchema = z
+  .string()
+  .min(1)
+  .max(128)
+  .regex(/^[a-zA-Z0-9_-]+$/)
+const gatewaySchema = z.strictObject({
+  organizationId: keySchema,
+  url: z.string().url().max(2048),
+  servername: z
+    .string()
+    .min(1)
+    .max(253)
+    .regex(/^[a-zA-Z0-9.-]+$/)
+    .optional(),
+  credentialId: keySchema,
+  ...gatewayPublicMetadataSchema.partial().shape,
+})
+const gatewaysSchema = z
+  .record(keySchema, gatewaySchema)
+  .refine((value) => Object.keys(value).length > 0 && Object.keys(value).length <= 100)
+const credentialSchema = z.strictObject({
+  token: z
+    .string()
+    .min(32)
+    .max(4096)
+    .regex(/^[a-zA-Z0-9_=-]+$/),
+  ca: z.string().min(1).max(65_536).optional(),
+})
+const credentialsSchema = z
+  .record(keySchema, credentialSchema)
+  .refine((value) => Object.keys(value).length <= 100)
+
+export interface OutboundGateway {
+  readonly id: string
+  readonly organizationId: string
+  readonly url: string
+  readonly servername: string
+  readonly token: string
+  readonly ca?: string
+  readonly publicIps?: readonly string[]
+}
+
+export type ResolvedOutboundRoute =
+  | { readonly kind: 'direct' }
+  | {
+      readonly kind: 'gateway'
+      readonly gateway: OutboundGateway
+    }
+
+interface OutboundConfigurationOptions {
+  source?: string
+  configuration?: string
+  gateways?: string
+  credentials?: string
+}
+
+interface OutboundConfigurationDependencies {
+  readSnapshot(
+    parse: (value: unknown) => OutboundRoutingConfig
+  ): Promise<AppConfigSnapshot<OutboundRoutingConfig>>
+  now(): number
+}
+
+/** A configured reader is immutable; failures cannot switch it to deployment defaults. */
+export function createOutboundRoutingReader(
+  options: OutboundConfigurationOptions,
+  dependencies: OutboundConfigurationDependencies
+): {
+  enabled: boolean
+  resolve(organizationId: string | null | undefined): Promise<ResolvedOutboundRoute>
+} {
+  if (options.source === undefined) {
+    if (
+      options.configuration !== undefined ||
+      options.gateways !== undefined ||
+      options.credentials !== undefined
+    ) {
+      throw new OutboundRoutingError('INVALID_CONFIGURATION')
+    }
+    return { enabled: false, resolve: async () => ({ kind: 'direct' }) }
+  }
+  if (options.source !== 'env' && options.source !== 'appconfig') {
+    throw new OutboundRoutingError('INVALID_CONFIGURATION')
+  }
+  const parsedGateways = gatewaysSchema.safeParse(parseOutboundJson(options.gateways ?? '{}'))
+  const parsedCredentials = credentialsSchema.safeParse(
+    parseOutboundJson(options.credentials ?? '{}')
+  )
+  if (!parsedGateways.success || !parsedCredentials.success) {
+    throw new OutboundRoutingError('INVALID_CONFIGURATION')
+  }
+  const gateways = new Map<string, OutboundGateway>()
+  const managedOrganizations = new Set<string>()
+  const endpointOwners = new Map<string, string>()
+  const credentialOwners = new Map<string, string>()
+  const addressOwners = new Map<string, string>()
+  for (const [id, entry] of Object.entries(parsedGateways.data)) {
+    const url = new URL(entry.url)
+    const hostname = url.hostname.replace(/^\[|\]$/g, '')
+    if (
+      url.protocol !== 'https:' ||
+      url.username ||
+      url.password ||
+      url.pathname !== '/' ||
+      url.search ||
+      url.hash
+    ) {
+      throw new OutboundRoutingError('INVALID_CONFIGURATION')
+    }
+    const servername = entry.servername ?? hostname
+    if (
+      isIP(servername) ||
+      !servername ||
+      !Object.hasOwn(parsedCredentials.data, entry.credentialId)
+    ) {
+      throw new OutboundRoutingError('INVALID_CONFIGURATION')
+    }
+    const credential = parsedCredentials.data[entry.credentialId]
+    for (const [owners, key] of [
+      [endpointOwners, url.href],
+      [credentialOwners, credential.token],
+      ...(entry.publicIps ?? []).map((address) => [addressOwners, address] as const),
+    ] as const) {
+      const owner = owners.get(key)
+      if (owner !== undefined && owner !== entry.organizationId) {
+        throw new OutboundRoutingError('INVALID_CONFIGURATION')
+      }
+      owners.set(key, entry.organizationId)
+    }
+    managedOrganizations.add(entry.organizationId)
+    gateways.set(
+      id,
+      Object.freeze({
+        id,
+        organizationId: entry.organizationId,
+        url: url.href,
+        servername,
+        ...credential,
+        ...(entry.publicIps ? { publicIps: Object.freeze([...new Set(entry.publicIps)]) } : {}),
+      })
+    )
+  }
+  const parse = (value: unknown): OutboundRoutingConfig => {
+    const config = parseOutboundRoutingConfig(value)
+    for (const [organizationId, route] of Object.entries(config.organizations)) {
+      if (
+        route.kind === 'gateway' &&
+        gateways.get(route.gatewayId)?.organizationId !== organizationId
+      ) {
+        throw new OutboundRoutingError('INVALID_CONFIGURATION')
+      }
+    }
+    return config
+  }
+  const staticConfig =
+    options.source === 'env' ? parse(parseOutboundJson(options.configuration ?? '')) : null
+  if (options.source === 'appconfig' && options.configuration !== undefined) {
+    throw new OutboundRoutingError('INVALID_CONFIGURATION')
+  }
+  return {
+    enabled: true,
+    async resolve(organizationId) {
+      if (organizationId === undefined) throw new OutboundRoutingError('MISSING_SCOPE')
+      if (organizationId === null || !managedOrganizations.has(organizationId)) {
+        return { kind: 'direct' }
+      }
+      let config = staticConfig
+      if (!config) {
+        const snapshot = await dependencies.readSnapshot(parse)
+        const age =
+          snapshot.validatedAt === null
+            ? Number.POSITIVE_INFINITY
+            : dependencies.now() - snapshot.validatedAt
+        if (!snapshot.value || age < 0 || age >= MAX_STALE_MS) {
+          throw new OutboundRoutingError('CONFIGURATION_UNAVAILABLE')
+        }
+        config = snapshot.value
+      }
+      /** Removing an assignment must not release a reserved organization onto shared egress. */
+      if (!Object.hasOwn(config.organizations, organizationId)) {
+        throw new OutboundRoutingError('ROUTE_BLOCKED')
+      }
+      const route = config.organizations[organizationId]
+      if (route.kind === 'direct') return { kind: 'direct' }
+      if (route.kind === 'blocked') throw new OutboundRoutingError('ROUTE_BLOCKED')
+      const gateway = gateways.get(route.gatewayId)
+      if (!gateway) throw new OutboundRoutingError('INVALID_CONFIGURATION')
+      return {
+        kind: 'gateway',
+        gateway,
+      }
+    },
+  }
+}
+
+let reader: ReturnType<typeof createOutboundRoutingReader> | undefined
+
+function getReader() {
+  reader ??= createOutboundRoutingReader(
+    {
+      source: env.OUTBOUND_ROUTING_SOURCE,
+      configuration: env.OUTBOUND_ROUTING_CONFIG,
+      gateways: env.OUTBOUND_GATEWAYS,
+      credentials: env.OUTBOUND_GATEWAY_CREDENTIALS,
+    },
+    {
+      now: Date.now,
+      async readSnapshot(parse) {
+        if (!env.APPCONFIG_APPLICATION || !env.APPCONFIG_ENVIRONMENT) {
+          throw new OutboundRoutingError('CONFIGURATION_UNAVAILABLE')
+        }
+        const { fetchAppConfigSnapshot } = await import('@/lib/core/config/appconfig')
+        return fetchAppConfigSnapshot(
+          {
+            application: env.APPCONFIG_APPLICATION,
+            environment: env.APPCONFIG_ENVIRONMENT,
+            profile: 'outbound-routing',
+          },
+          parse
+        )
+      },
+    }
+  )
+  return reader
+}
+
+export function isOutboundRoutingEnabled(): boolean {
+  return getReader().enabled
+}
+
+/** Resolved gateways contain credentials; never serialize them. */
+export function resolveOutboundRoute(organizationId: string | null | undefined) {
+  return getReader().resolve(organizationId)
+}
diff --git a/apps/sim/lib/core/network/context.server.test.ts b/apps/sim/lib/core/network/context.server.test.ts
new file mode 100644
index 00000000000..6c6b15c9c86
--- /dev/null
+++ b/apps/sim/lib/core/network/context.server.test.ts
@@ -0,0 +1,71 @@
+/** @vitest-environment node */
+import { describe, expect, it, vi } from 'vitest'
+
+const { resolve } = vi.hoisted(() => ({
+  resolve: vi.fn(async (organizationId: string | null | undefined) => ({
+    kind: 'direct',
+    organizationId,
+  })),
+}))
+vi.mock('@/lib/core/network/config.server', () => ({
+  resolveOutboundRoute: resolve,
+  isOutboundRoutingEnabled: () => true,
+}))
+
+import {
+  captureOutboundScope,
+  resolveCurrentOutboundRoute,
+  runWithOutboundOrganization,
+} from '@/lib/core/network/context.server'
+
+describe('outbound execution context', () => {
+  it('restores captured ownership inside a callback invoked by another organization', async () => {
+    const captured = runWithOutboundOrganization('org_a', captureOutboundScope)
+    await runWithOutboundOrganization('org_b', async () => {
+      expect(await captured(resolveCurrentOutboundRoute)).toEqual({
+        kind: 'direct',
+        organizationId: 'org_a',
+      })
+      expect(await resolveCurrentOutboundRoute()).toEqual({
+        kind: 'direct',
+        organizationId: 'org_b',
+      })
+    })
+  })
+
+  it('does not borrow ambient ownership when a callback captured no scope', async () => {
+    const captured = captureOutboundScope()
+    await runWithOutboundOrganization('org_a', async () => {
+      expect(await captured(resolveCurrentOutboundRoute)).toEqual({
+        kind: 'direct',
+        organizationId: undefined,
+      })
+    })
+  })
+
+  it('isolates interleaved organizations and restores the parent after nested calls', async () => {
+    let release: () => void = () => {}
+    const gate = new Promise<void>((done) => {
+      release = done
+    })
+    const first = runWithOutboundOrganization('org_a', async () => {
+      await gate
+      await resolveCurrentOutboundRoute()
+      await runWithOutboundOrganization('org_child', resolveCurrentOutboundRoute)
+      return resolveCurrentOutboundRoute()
+    })
+    const second = runWithOutboundOrganization('org_b', async () => {
+      await resolveCurrentOutboundRoute()
+      release()
+      return resolveCurrentOutboundRoute()
+    })
+    expect(await Promise.all([first, second])).toEqual([
+      { kind: 'direct', organizationId: 'org_a' },
+      { kind: 'direct', organizationId: 'org_b' },
+    ])
+    expect(await resolveCurrentOutboundRoute()).toEqual({
+      kind: 'direct',
+      organizationId: undefined,
+    })
+  })
+})
diff --git a/apps/sim/lib/core/network/context.server.ts b/apps/sim/lib/core/network/context.server.ts
new file mode 100644
index 00000000000..c91ad01e1a3
--- /dev/null
+++ b/apps/sim/lib/core/network/context.server.ts
@@ -0,0 +1,32 @@
+import { AsyncLocalStorage } from 'node:async_hooks'
+import { isOutboundRoutingEnabled, resolveOutboundRoute } from '@/lib/core/network/config.server'
+import { OutboundRoutingError } from '@/lib/core/network/routing'
+
+interface OutboundScope {
+  readonly organizationId: string | null
+}
+
+const storage = new AsyncLocalStorage<OutboundScope>()
+
+/**
+ * Established by authorized operations or jobs after loading canonical ownership.
+ * Null means a verified personal workspace or platform operation. Never pass a requested organization.
+ */
+export function runWithOutboundOrganization<T>(organizationId: string | null, run: () => T): T {
+  if (!isOutboundRoutingEnabled()) return run()
+  if (organizationId !== null && (typeof organizationId !== 'string' || !organizationId)) {
+    throw new OutboundRoutingError('MISSING_SCOPE')
+  }
+  return storage.run(Object.freeze({ organizationId }), run)
+}
+
+/** Resolves current policy per operation, rather than freezing policy for a long-running job. */
+export function resolveCurrentOutboundRoute() {
+  return resolveOutboundRoute(storage.getStore()?.organizationId)
+}
+
+/** Captures only the outbound scope for deferred callbacks; route policy is still read per call. */
+export function captureOutboundScope(): <T>(run: () => T) => T {
+  const scope = storage.getStore()
+  return <T>(run: () => T): T => (scope ? storage.run(scope, run) : storage.exit(run))
+}
diff --git a/apps/sim/lib/core/network/fixtures/gateway-runtime.fixture.ts b/apps/sim/lib/core/network/fixtures/gateway-runtime.fixture.ts
new file mode 100644
index 00000000000..7551e2e72ed
--- /dev/null
+++ b/apps/sim/lib/core/network/fixtures/gateway-runtime.fixture.ts
@@ -0,0 +1,53 @@
+/** Real runtime probe invoked by gateway.server.test.ts against its local TLS servers. */
+import { readFileSync } from 'node:fs'
+import { request as undiciRequest } from 'undici/index.js'
+import { runWithOutboundOrganization } from '@/lib/core/network/context.server'
+import { createGatewayDispatcher } from '@/lib/core/network/gateway.server'
+import { secureFetchWithPinnedIP } from '@/lib/core/security/input-validation.server'
+
+const [proxyPort, certificatePath] = process.argv.slice(2)
+if (!proxyPort || !certificatePath)
+  throw new Error('Local fixture proxy port and certificate are required')
+const gateway = {
+  id: 'synthetic',
+  organizationId: 'org_test',
+  url: `https://127.0.0.1:${proxyPort}`,
+  servername: 'gateway.invalid',
+  token: 'a'.repeat(48),
+  ca: readFileSync(certificatePath, 'utf8'),
+}
+const dispatcher = createGatewayDispatcher(gateway, {
+  profile: 'selfHostedService',
+  resolvedIP: '1.1.1.1',
+})
+try {
+  const response = await undiciRequest('https://origin.invalid', {
+    dispatcher,
+    signal: AbortSignal.timeout(10_000),
+  })
+  if (response.headers['x-via-proxy'] !== 'yes') throw new Error('Undici bypassed proxy')
+  if ((await response.body.text()) !== 'tls reached') throw new Error('Undici response mismatch')
+
+  await runWithOutboundOrganization('org_test', async () => {
+    const pinned = await secureFetchWithPinnedIP('https://origin.invalid', '1.1.1.1', {
+      profile: 'selfHostedService',
+      timeout: 10_000,
+    })
+    if (pinned.headers.get('x-via-proxy') !== 'yes') throw new Error('Pinned fetch bypassed proxy')
+    if ((await pinned.text()) !== 'tls reached') throw new Error('Pinned fetch response mismatch')
+  })
+
+  let rejected = false
+  try {
+    await undiciRequest('https://wrong.invalid', {
+      dispatcher,
+      headers: { host: 'origin.invalid' },
+      signal: AbortSignal.timeout(10_000),
+    })
+  } catch {
+    rejected = true
+  }
+  if (!rejected) throw new Error('Mismatched upstream certificate was accepted')
+} finally {
+  await dispatcher.destroy()
+}
diff --git a/apps/sim/lib/core/network/gateway-metadata.ts b/apps/sim/lib/core/network/gateway-metadata.ts
new file mode 100644
index 00000000000..d7b82b7f820
--- /dev/null
+++ b/apps/sim/lib/core/network/gateway-metadata.ts
@@ -0,0 +1,6 @@
+import { z } from 'zod'
+
+/** Public operator-published metadata; never includes transport or credential configuration. */
+export const gatewayPublicMetadataSchema = z.object({
+  publicIps: z.array(z.ipv4()).max(16),
+})
diff --git a/apps/sim/lib/core/network/gateway.server.test.ts b/apps/sim/lib/core/network/gateway.server.test.ts
new file mode 100644
index 00000000000..3ec317df477
--- /dev/null
+++ b/apps/sim/lib/core/network/gateway.server.test.ts
@@ -0,0 +1,335 @@
+/** @vitest-environment node */
+import { execFile } from 'node:child_process'
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { createServer as httpsServer } from 'node:https'
+import { type AddressInfo, connect, type Socket } from 'node:net'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { getCACertificates, setDefaultCACertificates } from 'node:tls'
+import { fileURLToPath } from 'node:url'
+import { promisify } from 'node:util'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+import type { OutboundGateway, ResolvedOutboundRoute } from '@/lib/core/network/config.server'
+
+const { state } = vi.hoisted(() => ({
+  state: { gateways: new Map<string, OutboundGateway>() },
+}))
+vi.mock('@/lib/core/network/config.server', () => ({
+  isOutboundRoutingEnabled: () => true,
+  async resolveOutboundRoute(
+    organizationId: string | null | undefined
+  ): Promise<ResolvedOutboundRoute> {
+    const gateway = organizationId ? state.gateways.get(organizationId) : undefined
+    if (!gateway || !organizationId) throw new Error('No configured route')
+    return { kind: 'gateway', gateway }
+  },
+}))
+
+import { runWithOutboundOrganization } from '@/lib/core/network/context.server'
+import { openGatewayTunnel, secureOutboundTunnel } from '@/lib/core/network/gateway.server'
+import {
+  createPinnedFetchWithDispatcher,
+  secureFetchWithPinnedIP,
+} from '@/lib/core/security/input-validation.server'
+
+const certificateDirectory = mkdtempSync(join(tmpdir(), 'gateway-tls-'))
+const certificatePath = join(certificateDirectory, 'cert.pem')
+const keyPath = join(certificateDirectory, 'key.pem')
+let cert = ''
+const sockets = new Set<Socket>()
+const admissions: Array<{
+  token: string | undefined
+  destination: string | undefined
+  sni: string | undefined
+}> = []
+let originRequests = 0
+let receivedHeaders: Record<string, unknown> = {}
+const proxiedPorts = new Set<number>()
+const secureOrigin = httpsServer(async (req, res) => {
+  res.setHeader('x-via-proxy', proxiedPorts.has(req.socket.remotePort ?? 0) ? 'yes' : 'no')
+  originRequests++
+  receivedHeaders = req.headers
+  if (req.url === '/redirect') {
+    res.writeHead(302, { location: '/done' })
+    res.end()
+    return
+  }
+  if (req.url === '/wait') return
+  const chunks: Buffer[] = []
+  for await (const chunk of req) chunks.push(Buffer.from(chunk))
+  res.end(req.method === 'POST' ? Buffer.concat(chunks) : 'tls reached')
+})
+const proxy = httpsServer()
+proxy.on('connect', (req, socket, head) => {
+  socket.on('error', () => {})
+  const tlsSocket = req.socket as Socket & { servername?: string }
+  admissions.push({
+    token: req.headers['proxy-authorization'],
+    destination: req.url,
+    sni: tlsSocket.servername,
+  })
+  if (!req.headers['proxy-authorization']?.match(/^Bearer (alpha|bravo|a{48})$/)) {
+    socket.end('HTTP/1.1 407 Proxy Authentication Required\r\nContent-Length: 0\r\n\r\n')
+    return
+  }
+  if (req.url !== '1.1.1.1:443') {
+    socket.end('HTTP/1.1 403 Forbidden\r\nContent-Length: 0\r\n\r\n')
+    return
+  }
+  const upstream = connect(securePort, '127.0.0.1', () => {
+    if (upstream.localPort) proxiedPorts.add(upstream.localPort)
+    socket.write('HTTP/1.1 200 Connection Established\r\n\r\n')
+    if (head.length) upstream.write(head)
+    socket.pipe(upstream).pipe(socket)
+  })
+  upstream.on('error', () => socket.destroy())
+  socket.on('error', () => upstream.destroy())
+  socket.on('close', () => upstream.destroy())
+  sockets.add(upstream)
+  upstream.on('close', () => sockets.delete(upstream))
+})
+let securePort = 0
+const trust = getCACertificates('default')
+beforeAll(async () => {
+  await promisify(execFile)('openssl', [
+    'req',
+    '-x509',
+    '-newkey',
+    'rsa:2048',
+    '-sha256',
+    '-nodes',
+    '-keyout',
+    keyPath,
+    '-out',
+    certificatePath,
+    '-days',
+    '2',
+    '-subj',
+    '/CN=gateway.invalid',
+    '-addext',
+    'subjectAltName=DNS:gateway.invalid,DNS:origin.invalid,IP:1.1.1.1',
+    '-addext',
+    'extendedKeyUsage=serverAuth',
+  ])
+  cert = readFileSync(certificatePath, 'utf8')
+  const key = readFileSync(keyPath, 'utf8')
+  for (const server of [secureOrigin, proxy]) server.setSecureContext({ cert, key })
+  setDefaultCACertificates([...trust, cert])
+  for (const server of [secureOrigin, proxy]) {
+    server.on('connection', (socket) => {
+      sockets.add(socket)
+      socket.on('close', () => sockets.delete(socket))
+    })
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
+  }
+  securePort = (secureOrigin.address() as AddressInfo).port
+  const proxyPort = (proxy.address() as AddressInfo).port
+  for (const [id, token] of [
+    ['org_a', 'alpha'],
+    ['org_b', 'bravo'],
+  ])
+    state.gateways.set(id, {
+      id,
+      organizationId: id,
+      token,
+      url: `https://127.0.0.1:${proxyPort}`,
+      servername: 'gateway.invalid',
+      ca: cert,
+    })
+})
+afterAll(async () => {
+  for (const socket of sockets) socket.destroy()
+  await Promise.all(
+    [secureOrigin, proxy].map(
+      (server) => new Promise<void>((resolve) => server.close(() => resolve()))
+    )
+  )
+  setDefaultCACertificates(trust)
+  rmSync(certificateDirectory, { recursive: true, force: true })
+})
+const url = () => 'https://origin.invalid'
+const options = { profile: 'selfHostedService' as const }
+
+describe('organization gateways over real TLS CONNECT sockets', () => {
+  it('keeps an upgraded tunnel usable after five minutes', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    let tunnel: Socket | undefined
+    try {
+      tunnel = await secureOutboundTunnel(
+        await openGatewayTunnel(state.gateways.get('org_a')!, '1.1.1.1', 443),
+        'origin.invalid',
+        443
+      )
+      await vi.advanceTimersByTimeAsync(6 * 60_000)
+      expect(tunnel.destroyed).toBe(false)
+      tunnel.write('GET /done HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n')
+      const chunks: Buffer[] = []
+      for await (const chunk of tunnel) chunks.push(Buffer.from(chunk))
+      expect(Buffer.concat(chunks).toString()).toContain('reached')
+    } finally {
+      tunnel?.destroy()
+      vi.useRealTimers()
+    }
+  })
+
+  it('pins guarded requests and keeps proxy credentials out of origin headers', async () => {
+    const response = await runWithOutboundOrganization('org_a', () =>
+      secureFetchWithPinnedIP(url(), '1.1.1.1', {
+        ...options,
+        headers: { 'Proxy-Authorization': 'must-not-reach-origin' },
+      })
+    )
+    expect(await response.text()).toBe('tls reached')
+    expect(admissions.at(-1)).toEqual({
+      token: 'Bearer alpha',
+      destination: '1.1.1.1:443',
+      sni: 'gateway.invalid',
+    })
+    expect(receivedHeaders['proxy-authorization']).toBeUndefined()
+    expect(receivedHeaders.host).toBe('origin.invalid')
+  })
+  it('isolates concurrent requests to the same origin and rotates pools when its gateway assignment changes', async () => {
+    const transport = createPinnedFetchWithDispatcher('1.1.1.1', options)
+    const start = admissions.length
+    try {
+      expect(
+        await Promise.all(
+          ['org_a', 'org_b'].map((id) =>
+            runWithOutboundOrganization(id, async () => (await transport.fetch(url())).text())
+          )
+        )
+      ).toEqual(['tls reached', 'tls reached'])
+      expect(
+        admissions
+          .slice(start)
+          .map((item) => item.token)
+          .sort()
+      ).toEqual(['Bearer alpha', 'Bearer bravo'])
+      state.gateways.set('org_a', { ...state.gateways.get('org_a')!, id: 'gateway-next' })
+      await runWithOutboundOrganization('org_a', async () => (await transport.fetch(url())).text())
+      expect(admissions.length).toBe(start + 3)
+    } finally {
+      await transport.dispatcher.destroy()
+    }
+  })
+  it('preserves upstream TLS identity on both transports and rejects the wrong hostname', async () => {
+    const transport = createPinnedFetchWithDispatcher('1.1.1.1', options)
+    try {
+      await runWithOutboundOrganization('org_a', async () => {
+        expect(await (await transport.fetch(url())).text()).toBe('tls reached')
+        expect(await (await secureFetchWithPinnedIP(url(), '1.1.1.1', options)).text()).toBe(
+          'tls reached'
+        )
+        await expect(transport.fetch('https://wrong.invalid')).rejects.toThrow()
+        await expect(
+          transport.fetch('https://wrong.invalid', {
+            headers: { host: 'origin.invalid' },
+          })
+        ).rejects.toThrow()
+        await expect(
+          secureFetchWithPinnedIP('https://wrong.invalid', '1.1.1.1', options)
+        ).rejects.toThrow()
+      })
+    } finally {
+      await transport.dispatcher.destroy()
+    }
+  })
+  it('preserves Request bodies, encodes multipart data, and honors manual redirects', async () => {
+    const transport = createPinnedFetchWithDispatcher('1.1.1.1', options)
+    try {
+      await runWithOutboundOrganization('org_a', async () => {
+        expect(
+          await (
+            await transport.fetch(new Request(url(), { method: 'POST', body: 'request body' }))
+          ).text()
+        ).toBe('request body')
+        const form = new FormData()
+        form.set('field', 'multipart body')
+        expect(
+          await (await transport.fetch(url(), { method: 'POST', body: form })).text()
+        ).toContain('multipart body')
+        const redirect = await transport.fetch(`${url()}/redirect`, { redirect: 'manual' })
+        expect(redirect.status).toBe(302)
+        await redirect.body?.cancel()
+      })
+    } finally {
+      await transport.dispatcher.destroy()
+    }
+  })
+  it('fails closed on denied proxy credentials without contacting the origin', async () => {
+    state.gateways.set('denied', {
+      ...state.gateways.get('org_a')!,
+      organizationId: 'denied',
+      token: 'denied',
+    })
+    const transport = createPinnedFetchWithDispatcher('1.1.1.1', options)
+    const start = originRequests
+    try {
+      await runWithOutboundOrganization('denied', async () => {
+        await expect(transport.fetch(url())).rejects.toThrow()
+        await expect(secureFetchWithPinnedIP(url(), '1.1.1.1', options)).rejects.toThrow()
+      })
+      expect(originRequests).toBe(start)
+    } finally {
+      await transport.dispatcher.destroy()
+    }
+  })
+  it('routes and verifies TLS under the actual Bun runtime', async () => {
+    const start = admissions.length
+    await promisify(execFile)(
+      'bun',
+      [
+        '--no-env-file',
+        'run',
+        fileURLToPath(new URL('./fixtures/gateway-runtime.fixture.ts', import.meta.url)),
+        String((proxy.address() as AddressInfo).port),
+        certificatePath,
+      ],
+      {
+        timeout: 15_000,
+        env: {
+          ...process.env,
+          /** This local tunnel fixture must not inherit hosted-mode loopback restrictions. */
+          NEXT_PUBLIC_APP_URL: 'http://localhost:3000',
+          NEXT_PUBLIC_FORCE_HOSTED: 'false',
+          NODE_EXTRA_CA_CERTS: certificatePath,
+          OUTBOUND_ROUTING_SOURCE: 'env',
+          OUTBOUND_ROUTING_CONFIG: JSON.stringify({
+            schemaVersion: 1,
+            revision: 'test',
+            organizations: { org_test: { kind: 'gateway', gatewayId: 'synthetic' } },
+          }),
+          OUTBOUND_GATEWAYS: JSON.stringify({
+            synthetic: {
+              organizationId: 'org_test',
+              url: `https://127.0.0.1:${(proxy.address() as AddressInfo).port}`,
+              servername: 'gateway.invalid',
+              credentialId: 'synthetic',
+            },
+          }),
+          OUTBOUND_GATEWAY_CREDENTIALS: JSON.stringify({
+            synthetic: { token: 'a'.repeat(48), ca: cert },
+          }),
+        },
+      }
+    )
+    expect(admissions.length).toBe(start + 3)
+    expect(
+      admissions.slice(start).every((entry) => entry.token === `Bearer ${'a'.repeat(48)}`)
+    ).toBe(true)
+  })
+
+  it('supports cancellation without a direct retry', async () => {
+    const transport = createPinnedFetchWithDispatcher('1.1.1.1', options)
+    const controller = new AbortController()
+    try {
+      const promise = runWithOutboundOrganization('org_a', () =>
+        transport.fetch(`${url()}/wait`, { signal: controller.signal })
+      )
+      controller.abort()
+      await expect(promise).rejects.toThrow()
+    } finally {
+      await transport.dispatcher.destroy()
+    }
+  })
+})
diff --git a/apps/sim/lib/core/network/gateway.server.ts b/apps/sim/lib/core/network/gateway.server.ts
new file mode 100644
index 00000000000..190f4ce8730
--- /dev/null
+++ b/apps/sim/lib/core/network/gateway.server.ts
@@ -0,0 +1,136 @@
+import { isIP, Socket } from 'node:net'
+import { checkServerIdentity, connect as connectTls } from 'node:tls'
+import { evaluateAddress, STRICT_EGRESS_POLICY } from '@sim/security/egress'
+import { Agent, Client } from 'undici/index.js'
+import type { OutboundGateway } from '@/lib/core/network/config.server'
+import { OutboundRoutingError } from '@/lib/core/network/routing'
+import type { EgressProfile } from '@/lib/core/security/egress/profiles'
+import { checkResolvedEgress, validateEgressUrl } from '@/lib/core/security/egress/validate'
+
+const CONNECT_TIMEOUT_MS = 10_000
+
+/** The proxy CA never changes trust for the upstream service. */
+export async function secureOutboundTunnel(
+  socket: Socket,
+  hostname: string,
+  port: number
+): Promise<Socket> {
+  return new Promise((resolve, reject) => {
+    const tls = connectTls({
+      socket,
+      host: hostname,
+      port,
+      servername: isIP(hostname) ? undefined : hostname,
+      checkServerIdentity: (_name, certificate) => checkServerIdentity(hostname, certificate),
+      rejectUnauthorized: true,
+      ALPNProtocols: ['http/1.1'],
+    })
+    /** The inner TLS stream has no TCP descriptor; QoS must be applied to the outer socket. */
+    if ('setTypeOfService' in socket && typeof socket.setTypeOfService === 'function') {
+      const setTypeOfService = socket.setTypeOfService.bind(socket)
+      Object.defineProperty(tls, 'setTypeOfService', {
+        value(tos: number) {
+          setTypeOfService(tos)
+          return tls
+        },
+      })
+    }
+    const timer = setTimeout(
+      () => tls.destroy(new OutboundRoutingError('GATEWAY_UNAVAILABLE')),
+      CONNECT_TIMEOUT_MS
+    )
+    timer.unref()
+    tls.once('secureConnect', () => {
+      clearTimeout(timer)
+      resolve(tls)
+    })
+    tls.once('error', () => {
+      clearTimeout(timer)
+      reject(new OutboundRoutingError('GATEWAY_UNAVAILABLE'))
+    })
+  })
+}
+
+/** Uses the npm HTTP parser on both runtimes; Bun's Node HTTP shim cannot send CONNECT. */
+export async function openGatewayTunnel(
+  gateway: OutboundGateway,
+  address: string,
+  port: number
+): Promise<Socket> {
+  if (
+    isIP(address) !== 4 ||
+    port !== 443 ||
+    !evaluateAddress(new URL(`https://${address}`), address, STRICT_EGRESS_POLICY).allowed
+  ) {
+    throw new OutboundRoutingError('UNSUPPORTED_TRANSPORT')
+  }
+  const authority = `${address}:443`
+  const client = new Client(gateway.url, {
+    allowH2: false,
+    maxHeaderSize: 16_384,
+    connectTimeout: CONNECT_TIMEOUT_MS,
+    connect: { servername: gateway.servername, ca: gateway.ca, rejectUnauthorized: true },
+  })
+  try {
+    const { statusCode, socket } = await client.connect({
+      path: authority,
+      signal: AbortSignal.timeout(CONNECT_TIMEOUT_MS),
+      headers: { host: authority, 'proxy-authorization': `Bearer ${gateway.token}` },
+    })
+    if (statusCode !== 200 || !(socket instanceof Socket)) {
+      socket.destroy()
+      throw new OutboundRoutingError('GATEWAY_UNAVAILABLE')
+    }
+    return socket
+  } catch {
+    throw new OutboundRoutingError('GATEWAY_UNAVAILABLE')
+  } finally {
+    /** An upgraded socket is detached from the dispatcher and now belongs to its caller. */
+    await client.destroy()
+  }
+}
+
+/** A dispatcher belongs to one organization and gateway, never a process-wide default. */
+export function createGatewayDispatcher(
+  gateway: OutboundGateway,
+  options: { profile: EgressProfile; resolvedIP?: string; maxResponseSize?: number }
+): Agent {
+  return new Agent({
+    allowH2: false,
+    ...(options.maxResponseSize !== undefined ? { maxResponseSize: options.maxResponseSize } : {}),
+    connect(connection, callback) {
+      const port = Number(connection.port || (connection.protocol === 'https:' ? 443 : 80))
+      const hostname = connection.hostname.replace(/^\[|\]$/g, '')
+      const authority = isIP(hostname) === 6 ? `[${hostname}]` : hostname
+      const url = new URL(`${connection.protocol}//${authority}:${port}`)
+      void (async () => {
+        if (connection.protocol !== 'https:' || port !== 443) {
+          throw new OutboundRoutingError('UNSUPPORTED_TRANSPORT')
+        }
+        let address = options.resolvedIP
+        if (address) {
+          if (!checkResolvedEgress(url, address, options.profile).allowed) {
+            throw new OutboundRoutingError('ROUTE_BLOCKED')
+          }
+        } else {
+          const result = await validateEgressUrl(url.href, 'url', options.profile, {
+            logDetails: false,
+          })
+          if (!result.isValid) throw new OutboundRoutingError('ROUTE_BLOCKED')
+          address = result.resolvedIP
+        }
+        const socket = await openGatewayTunnel(gateway, address, port)
+        return secureOutboundTunnel(socket, hostname, port)
+      })().then(
+        (socket) => callback(null, socket),
+        (error) =>
+          callback(
+            error instanceof OutboundRoutingError
+              ? error
+              : new OutboundRoutingError('GATEWAY_UNAVAILABLE'),
+            null
+          )
+      )
+    },
+  })
+}
diff --git a/apps/sim/lib/core/network/resource-scope.server.test.ts b/apps/sim/lib/core/network/resource-scope.server.test.ts
new file mode 100644
index 00000000000..20126ad7ef1
--- /dev/null
+++ b/apps/sim/lib/core/network/resource-scope.server.test.ts
@@ -0,0 +1,100 @@
+/** @vitest-environment node */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  enabled: vi.fn(() => true),
+  workspace: vi.fn(),
+  route: vi.fn(async (organizationId: string | null | undefined) => ({ organizationId })),
+}))
+vi.mock('@/lib/core/network/config.server', () => ({
+  isOutboundRoutingEnabled: mocks.enabled,
+  resolveOutboundRoute: mocks.route,
+}))
+vi.mock('@/lib/workspaces/application/workspace-context', () => ({
+  loadWorkspaceApplicationContext: mocks.workspace,
+}))
+
+import {
+  resolveCurrentOutboundRoute,
+  runWithOutboundOrganization,
+} from '@/lib/core/network/context.server'
+import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
+
+describe('canonical resource outbound scope', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.enabled.mockReturnValue(true)
+  })
+
+  it.each(['publisher-org', null])(
+    'uses current workspace ownership %s and restores its caller',
+    async (organizationId) => {
+      mocks.workspace.mockResolvedValue({ workspaceOrganizationId: organizationId })
+      await runWithOutboundOrganization('caller-org', async () => {
+        expect(
+          await withResourceOutboundScope(
+            { workspaceId: 'source-workspace' },
+            resolveCurrentOutboundRoute
+          )
+        ).toEqual({ organizationId })
+        expect(await resolveCurrentOutboundRoute()).toEqual({ organizationId: 'caller-org' })
+      })
+      expect(mocks.workspace).toHaveBeenCalledExactlyOnceWith('source-workspace', {})
+    }
+  )
+
+  it('rejects a missing or archived workspace before executing provider work', async () => {
+    mocks.workspace.mockResolvedValue(null)
+    await expect(
+      withResourceOutboundScope({ workspaceId: 'removed' }, resolveCurrentOutboundRoute)
+    ).rejects.toMatchObject({ code: 'MISSING_SCOPE' })
+    expect(mocks.route).not.toHaveBeenCalled()
+  })
+
+  it('uses canonical archived workspace ownership only when cleanup explicitly requests it', async () => {
+    mocks.workspace.mockImplementation(async (_id, options) =>
+      options.includeArchived ? { workspaceOrganizationId: 'owner-org' } : null
+    )
+    await expect(
+      withResourceOutboundScope({ workspaceId: 'archived' }, resolveCurrentOutboundRoute)
+    ).rejects.toMatchObject({ code: 'MISSING_SCOPE' })
+    await expect(
+      withResourceOutboundScope({ workspaceId: 'archived' }, resolveCurrentOutboundRoute, {
+        includeArchived: true,
+      })
+    ).resolves.toEqual({ organizationId: 'owner-org' })
+  })
+
+  it('uses organization ownership without loading a workspace or retaining caller scope', async () => {
+    await runWithOutboundOrganization('caller-org', async () => {
+      expect(
+        await withResourceOutboundScope(
+          { workspaceId: null, organizationId: 'owner-org' },
+          resolveCurrentOutboundRoute
+        )
+      ).toEqual({ organizationId: 'owner-org' })
+      expect(await resolveCurrentOutboundRoute()).toEqual({ organizationId: 'caller-org' })
+    })
+    expect(mocks.workspace).not.toHaveBeenCalled()
+  })
+
+  it('adds no workspace query when routing is unconfigured', async () => {
+    mocks.enabled.mockReturnValue(false)
+    const run = vi.fn(async () => 'done')
+    expect(await withResourceOutboundScope({ workspaceId: null }, run)).toBe('done')
+    expect(mocks.workspace).not.toHaveBeenCalled()
+    expect(run).toHaveBeenCalledOnce()
+  })
+
+  it('rejects ambiguous or missing ownership when routing is configured', async () => {
+    const run = vi.fn(async () => 'done')
+    await expect(withResourceOutboundScope({}, run)).rejects.toThrow(
+      'Resource requires exactly one workspace or organization owner'
+    )
+    await expect(
+      withResourceOutboundScope({ workspaceId: 'workspace', organizationId: 'org' }, run)
+    ).rejects.toThrow('Resource requires exactly one workspace or organization owner')
+    expect(run).not.toHaveBeenCalled()
+    expect(mocks.workspace).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/sim/lib/core/network/resource-scope.server.ts b/apps/sim/lib/core/network/resource-scope.server.ts
new file mode 100644
index 00000000000..6694a353a2d
--- /dev/null
+++ b/apps/sim/lib/core/network/resource-scope.server.ts
@@ -0,0 +1,19 @@
+import { isOutboundRoutingEnabled } from '@/lib/core/network/config.server'
+import { runWithOutboundOrganization } from '@/lib/core/network/context.server'
+import { OutboundRoutingError } from '@/lib/core/network/routing'
+import { type ResourceOwner, resourceScopeFromOwner } from '@/lib/core/resource-scope'
+import { loadWorkspaceApplicationContext } from '@/lib/workspaces/application/workspace-context'
+
+/** Establishes routing after resource authorization, reloading current workspace ownership when needed. */
+export async function withResourceOutboundScope<T>(
+  owner: ResourceOwner,
+  run: () => Promise<T>,
+  options: { includeArchived?: boolean } = {}
+): Promise<T> {
+  if (!isOutboundRoutingEnabled()) return run()
+  const scope = resourceScopeFromOwner(owner)
+  if (scope.kind === 'organization') return runWithOutboundOrganization(scope.organizationId, run)
+  const workspace = await loadWorkspaceApplicationContext(scope.workspaceId, options)
+  if (!workspace) throw new OutboundRoutingError('MISSING_SCOPE')
+  return runWithOutboundOrganization(workspace.workspaceOrganizationId, run)
+}
diff --git a/apps/sim/lib/core/network/routing.test.ts b/apps/sim/lib/core/network/routing.test.ts
new file mode 100644
index 00000000000..29e578989b8
--- /dev/null
+++ b/apps/sim/lib/core/network/routing.test.ts
@@ -0,0 +1,31 @@
+/** @vitest-environment node */
+import { describe, expect, it } from 'vitest'
+import { parseOutboundJson, parseOutboundRoutingConfig } from '@/lib/core/network/routing'
+
+const document = {
+  schemaVersion: 1,
+  revision: 'revision-1',
+  organizations: { org_a: { kind: 'gateway', gatewayId: 'gateway_a' }, org_b: { kind: 'blocked' } },
+}
+
+describe('outbound routing policy', () => {
+  it('cannot be mutated', () => {
+    const policy = parseOutboundRoutingConfig(document)
+    expect(Object.isFrozen(policy.organizations.org_a)).toBe(true)
+    expect(Object.isFrozen(policy.organizations)).toBe(true)
+  })
+
+  it.each([
+    { ...document, schemaVersion: 2 },
+    { ...document, organizations: { org_a: { kind: 'gateway' } } },
+    { ...document, defaultRoute: { kind: 'blocked' } },
+    { ...document, extra: true },
+  ])('rejects malformed policy without exposing its content', (input) => {
+    expect(() => parseOutboundRoutingConfig(input)).toThrow('INVALID_CONFIGURATION')
+  })
+
+  it('bounds serialized configuration and does not expose JSON syntax errors', () => {
+    expect(() => parseOutboundJson('sensitive-value')).toThrow('INVALID_CONFIGURATION')
+    expect(() => parseOutboundJson(' '.repeat(1_048_577))).toThrow('INVALID_CONFIGURATION')
+  })
+})
diff --git a/apps/sim/lib/core/network/routing.ts b/apps/sim/lib/core/network/routing.ts
new file mode 100644
index 00000000000..121c9d94f82
--- /dev/null
+++ b/apps/sim/lib/core/network/routing.ts
@@ -0,0 +1,64 @@
+import { z } from 'zod'
+
+const MAX_CONFIG_BYTES = 1_048_576
+const identifier = z
+  .string()
+  .min(1)
+  .max(128)
+  .regex(/^[a-zA-Z0-9_-]+$/)
+const routeSchema = z.discriminatedUnion('kind', [
+  z.strictObject({ kind: z.literal('direct') }),
+  z.strictObject({ kind: z.literal('gateway'), gatewayId: identifier }),
+  z.strictObject({ kind: z.literal('blocked') }),
+])
+const configSchema = z.strictObject({
+  schemaVersion: z.literal(1),
+  revision: identifier,
+  organizations: z
+    .record(identifier, routeSchema)
+    .refine((value) => Object.keys(value).length <= 10_000),
+})
+
+type OutboundRoute = Readonly<z.infer<typeof routeSchema>>
+export interface OutboundRoutingConfig {
+  readonly schemaVersion: 1
+  readonly revision: string
+  readonly organizations: Readonly<Record<string, OutboundRoute>>
+}
+
+type OutboundRoutingErrorCode =
+  | 'CONFIGURATION_UNAVAILABLE'
+  | 'INVALID_CONFIGURATION'
+  | 'MISSING_SCOPE'
+  | 'ROUTE_BLOCKED'
+  | 'UNSUPPORTED_TRANSPORT'
+  | 'GATEWAY_UNAVAILABLE'
+
+/** Public error text never includes routing configuration, credentials or destination details. */
+export class OutboundRoutingError extends Error {
+  constructor(readonly code: OutboundRoutingErrorCode) {
+    super(`Outbound routing failed: ${code}`)
+    this.name = 'OutboundRoutingError'
+  }
+}
+
+/** Bounds operator configuration before parsing and hides secret-bearing parser errors. */
+export function parseOutboundJson(value: string): unknown {
+  if (Buffer.byteLength(value, 'utf8') > MAX_CONFIG_BYTES) {
+    throw new OutboundRoutingError('INVALID_CONFIGURATION')
+  }
+  try {
+    return JSON.parse(value)
+  } catch {
+    throw new OutboundRoutingError('INVALID_CONFIGURATION')
+  }
+}
+
+/** Produces an immutable routing snapshot without reading deployment state. */
+export function parseOutboundRoutingConfig(value: unknown): OutboundRoutingConfig {
+  const parsed = configSchema.safeParse(value)
+  if (!parsed.success) throw new OutboundRoutingError('INVALID_CONFIGURATION')
+  for (const route of Object.values(parsed.data.organizations)) Object.freeze(route)
+  Object.freeze(parsed.data.organizations)
+  return Object.freeze(parsed.data)
+}
diff --git a/apps/sim/lib/core/network/transport.server.test.ts b/apps/sim/lib/core/network/transport.server.test.ts
new file mode 100644
index 00000000000..ecd58fec4de
--- /dev/null
+++ b/apps/sim/lib/core/network/transport.server.test.ts
@@ -0,0 +1,111 @@
+/** @vitest-environment node */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ResolvedOutboundRoute } from '@/lib/core/network/config.server'
+
+const { resolveRoute, createGateway } = vi.hoisted(() => ({
+  resolveRoute: vi.fn<() => Promise<ResolvedOutboundRoute>>(),
+  createGateway: vi.fn(),
+}))
+vi.mock('@/lib/core/network/context.server', () => ({ resolveCurrentOutboundRoute: resolveRoute }))
+vi.mock('@/lib/core/network/gateway.server', () => ({ createGatewayDispatcher: createGateway }))
+
+import { createOutboundTransport } from '@/lib/core/network/transport.server'
+
+const route = (
+  organizationId = 'org_a',
+  gatewayId = `gateway-${organizationId}`
+): ResolvedOutboundRoute => ({
+  kind: 'gateway',
+  gateway: {
+    id: gatewayId,
+    organizationId,
+    url: 'https://gateway.invalid',
+    servername: 'gateway.invalid',
+    token: 'synthetic',
+  },
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  resolveRoute.mockResolvedValue(route())
+  createGateway.mockImplementation(() => ({
+    close: vi.fn(async () => {}),
+    destroy: vi.fn(async () => {}),
+  }))
+})
+
+describe('shared outbound transport ownership', () => {
+  it('rejects an explicit proxy when organization policy requires its gateway', async () => {
+    const owner = createOutboundTransport({
+      profile: 'configuredEndpoint',
+      proxyUrl: 'http://proxy.invalid',
+    })
+    try {
+      await expect(owner.selectDispatcher()).rejects.toThrow('UNSUPPORTED_TRANSPORT')
+      expect(createGateway).not.toHaveBeenCalled()
+    } finally {
+      await owner.destroy()
+    }
+  })
+
+  it('isolates organizations, reuses gateway pools, and disposes pools', async () => {
+    const owner = createOutboundTransport({ profile: 'configuredEndpoint' })
+    const first = await owner.selectDispatcher()
+    expect(await owner.selectDispatcher()).toBe(first)
+    resolveRoute.mockResolvedValue(route('org_b'))
+    expect(await owner.selectDispatcher()).not.toBe(first)
+    resolveRoute.mockResolvedValue(route('org_a'))
+    expect(await owner.selectDispatcher()).toBe(first)
+    await owner.destroy()
+    for (const result of createGateway.mock.results)
+      expect(result.value.destroy).toHaveBeenCalledOnce()
+    await expect(owner.selectDispatcher()).rejects.toThrow('GATEWAY_UNAVAILABLE')
+  })
+
+  it('delegates explicit direct routes but propagates policy failure without a fallback', async () => {
+    const owner = createOutboundTransport({ profile: 'configuredEndpoint' })
+    resolveRoute.mockResolvedValue({ kind: 'direct' })
+    expect(await owner.selectDispatcher()).toBeNull()
+    resolveRoute.mockRejectedValue(new Error('policy unavailable'))
+    await expect(owner.selectDispatcher()).rejects.toThrow('policy unavailable')
+    expect(createGateway).not.toHaveBeenCalled()
+  })
+
+  it('refuses to create a pool when its owner is destroyed during policy resolution', async () => {
+    let resolve: (route: ResolvedOutboundRoute) => void = () => {}
+    resolveRoute.mockReturnValue(
+      new Promise((done) => {
+        resolve = done
+      })
+    )
+    const owner = createOutboundTransport({ profile: 'configuredEndpoint' })
+    const pending = owner.selectDispatcher()
+    await owner.destroy()
+    resolve(route())
+    await expect(pending).rejects.toThrow('GATEWAY_UNAVAILABLE')
+    expect(createGateway).not.toHaveBeenCalled()
+  })
+
+  it('bounds gateway changes per organization without blocking other organizations', async () => {
+    const drain: Array<() => void> = []
+    createGateway.mockImplementation(() => ({
+      close: vi.fn(() => new Promise<void>((done) => drain.push(done))),
+      destroy: vi.fn(async () => {}),
+    }))
+    const owner = createOutboundTransport({ profile: 'configuredEndpoint' })
+    try {
+      for (let index = 0; index < 3; index++) {
+        resolveRoute.mockResolvedValue(route('org_a', `v${index}`))
+        expect(await owner.selectDispatcher()).not.toBeNull()
+      }
+      resolveRoute.mockResolvedValue(route('org_a', 'overflow'))
+      await expect(owner.selectDispatcher()).rejects.toThrow('GATEWAY_UNAVAILABLE')
+      expect(createGateway).toHaveBeenCalledTimes(3)
+      resolveRoute.mockResolvedValue(route('org_b'))
+      expect(await owner.selectDispatcher()).not.toBeNull()
+    } finally {
+      await owner.destroy()
+      for (const finish of drain) finish()
+    }
+  })
+})
diff --git a/apps/sim/lib/core/network/transport.server.ts b/apps/sim/lib/core/network/transport.server.ts
new file mode 100644
index 00000000000..b4a6c630e7b
--- /dev/null
+++ b/apps/sim/lib/core/network/transport.server.ts
@@ -0,0 +1,94 @@
+import { type Agent, type Dispatcher, request } from 'undici/index.js'
+import { resolveCurrentOutboundRoute } from '@/lib/core/network/context.server'
+import { createGatewayDispatcher } from '@/lib/core/network/gateway.server'
+import { OutboundRoutingError } from '@/lib/core/network/routing'
+import type { EgressProfile } from '@/lib/core/security/egress/profiles'
+
+interface OutboundTransportOptions {
+  profile: EgressProfile
+  resolvedIP?: string
+  maxResponseSize?: number
+  direct?: Agent
+  proxyUrl?: string
+}
+
+interface OutboundTransportOwner {
+  /** Null delegates to the adapter's existing direct transport. */
+  selectDispatcher(): Promise<Dispatcher | null>
+  close(): Promise<void>
+  destroy(): Promise<void>
+}
+
+/**
+ * Owns routing and connection lifetimes for the shared HTTP helpers. Destination provenance
+ * and optional pinning are immutable for this owner; policy is resolved per operation.
+ */
+export function createOutboundTransport(options: OutboundTransportOptions): OutboundTransportOwner {
+  const pools = new Map<string, { gatewayId: string; agent: Agent }>()
+  const retired = new Map<string, Set<Agent>>()
+  let closed = false
+  const allPools = () => [
+    ...(options.direct ? [options.direct] : []),
+    ...[...pools.values()].map((pool) => pool.agent),
+    ...[...retired.values()].flatMap((agents) => [...agents]),
+  ]
+  return {
+    async selectDispatcher() {
+      const route = await resolveCurrentOutboundRoute()
+      if (closed) throw new OutboundRoutingError('GATEWAY_UNAVAILABLE')
+      if (route.kind === 'direct') return options.direct ?? null
+      if (options.proxyUrl) throw new OutboundRoutingError('UNSUPPORTED_TRANSPORT')
+      const owner = route.gateway.organizationId
+      const current = pools.get(owner)
+      if (current?.gatewayId === route.gateway.id) return current.agent
+      const draining = retired.get(owner) ?? new Set<Agent>()
+      if (draining.size >= 2) throw new OutboundRoutingError('GATEWAY_UNAVAILABLE')
+      const agent = createGatewayDispatcher(route.gateway, options)
+      if (current) {
+        retired.set(owner, draining)
+        draining.add(current.agent)
+        void current.agent
+          .close()
+          .catch(() => {})
+          .finally(() => {
+            draining.delete(current.agent)
+            if (draining.size === 0) retired.delete(owner)
+          })
+      }
+      pools.set(owner, { gatewayId: route.gateway.id, agent })
+      return agent
+    },
+    async close() {
+      closed = true
+      await Promise.all(allPools().map((pool) => pool.close()))
+      pools.clear()
+      retired.clear()
+    },
+    async destroy() {
+      closed = true
+      await Promise.all(allPools().map((pool) => pool.destroy()))
+      pools.clear()
+      retired.clear()
+    },
+  }
+}
+
+type OutboundRequestOptions = Omit<
+  NonNullable<Parameters<typeof request>[1]>,
+  'headers' | 'dispatcher'
+> & {
+  headers?: Record<string, string>
+  dispatcher: Dispatcher
+}
+
+/**
+ * The shared HTTP wire transport. Import the installed package explicitly: Bun's bare
+ * undici shim ignores dispatchers. Proxy credentials never become destination headers.
+ */
+export function requestWithOutboundDispatcher(url: string, options: OutboundRequestOptions) {
+  const headers = { ...options.headers }
+  for (const name of Object.keys(headers)) {
+    if (name.toLowerCase() === 'proxy-authorization') delete headers[name]
+  }
+  return request(url, { ...options, headers })
+}
diff --git a/apps/sim/lib/core/security/guarded-request-fetch.server.test.ts b/apps/sim/lib/core/security/guarded-request-fetch.server.test.ts
index 45cc68ff51f..e4ceb5fd380 100644
--- a/apps/sim/lib/core/security/guarded-request-fetch.server.test.ts
+++ b/apps/sim/lib/core/security/guarded-request-fetch.server.test.ts
@@ -54,6 +54,21 @@ describe('createSsrfGuardedFetchWithDispatcher (undici.request backed)', () => {
     vi.clearAllMocks()
   })
 
+  it.each(['manual', 'error'] as const)(
+    'checks the initial literal address with redirect mode %s',
+    async (redirect) => {
+      const transport = createSsrfGuardedFetchWithDispatcher({ profile: 'contentFetch' })
+      try {
+        await expect(transport.fetch('https://127.0.0.1/', { redirect })).rejects.toThrow(
+          'SSRF policy'
+        )
+        expect(mockUndiciRequest).not.toHaveBeenCalled()
+      } finally {
+        await transport.dispatcher.destroy()
+      }
+    }
+  )
+
   it('constructs a Response with the reply status, headers, url, and a streaming body', async () => {
     mockUndiciRequest.mockResolvedValueOnce(
       undiciReply(
@@ -81,11 +96,28 @@ describe('createSsrfGuardedFetchWithDispatcher (undici.request backed)', () => {
     expect(mockUndiciRequest).toHaveBeenCalledTimes(1)
     const [, options] = mockUndiciRequest.mock.calls[0]
     expect(options.method).toBe('POST')
-    expect(options.headers).toEqual({ 'content-type': 'application/json' })
+    expect(options.headers).toEqual({ 'content-type': 'application/json', 'user-agent': 'undici' })
     expect(options.body).toBe('{"jsonrpc":"2.0"}')
     expect(options.maxRedirections).toBeUndefined()
   })
 
+  it('preserves an explicitly supplied User-Agent regardless of casing', async () => {
+    mockUndiciRequest.mockResolvedValueOnce(undiciReply(200, {}, byteStream('ok')))
+    const transport = createSsrfGuardedFetchWithDispatcher({ profile: 'configuredEndpoint' })
+    try {
+      const response = await transport.fetch('https://api.example.com/data', {
+        headers: { 'uSeR-aGeNt': 'custom-client/1.0' },
+      })
+      await response.text()
+
+      expect(mockUndiciRequest.mock.calls[0][1].headers).toEqual({
+        'uSeR-aGeNt': 'custom-client/1.0',
+      })
+    } finally {
+      await transport.dispatcher.destroy()
+    }
+  })
+
   it('follows a redirect through followRedirectsGuarded and reports the final url', async () => {
     mockUndiciRequest
       .mockResolvedValueOnce(
@@ -102,6 +134,93 @@ describe('createSsrfGuardedFetchWithDispatcher (undici.request backed)', () => {
     expect(await response.text()).toBe('final-body')
   })
 
+  it.each([
+    [307, 'POST'],
+    [308, 'POST'],
+    [301, 'PUT'],
+    [302, 'PUT'],
+  ] as const)('replays a Request body through same-origin %s redirects', async (status, method) => {
+    const payloads: string[] = []
+    mockUndiciRequest.mockImplementation(async (_url, options: { body: Buffer | Readable }) => {
+      const chunks: Buffer[] = []
+      for await (const chunk of options.body instanceof Readable ? options.body : [options.body]) {
+        chunks.push(Buffer.from(chunk))
+      }
+      payloads.push(Buffer.concat(chunks).toString())
+      return payloads.length < 3
+        ? undiciReply(status, { location: `/hop-${payloads.length}` }, byteStream(''))
+        : undiciReply(200, {}, byteStream('done'))
+    })
+    const transport = createSsrfGuardedFetchWithDispatcher({ profile: 'configuredEndpoint' })
+    try {
+      const response = await transport.fetch(
+        new Request('https://api.example.com/start', {
+          method,
+          headers: { 'content-type': 'application/json' },
+          body: '{"payload":"replay"}',
+        })
+      )
+      expect(await response.text()).toBe('done')
+      expect(payloads).toEqual(Array(3).fill('{"payload":"replay"}'))
+      expect(response.redirected).toBe(true)
+      expect(mockUndiciRequest.mock.calls.map(([, options]) => options.method)).toEqual(
+        Array(3).fill(method)
+      )
+    } finally {
+      await transport.dispatcher.destroy()
+    }
+  })
+
+  it.each(['manual', 'error'] as const)(
+    'keeps Request bodies streaming in %s mode',
+    async (redirect) => {
+      const request = new Request('https://api.example.com/upload', {
+        method: 'POST',
+        redirect,
+        body: 'payload',
+      })
+      const transport = createSsrfGuardedFetchWithDispatcher({ profile: 'configuredEndpoint' })
+      mockUndiciRequest.mockImplementationOnce(async (_url, options: { body: Readable }) => {
+        expect(options.body).toBeInstanceOf(Readable)
+        const chunks: Buffer[] = []
+        for await (const chunk of options.body) chunks.push(Buffer.from(chunk))
+        expect(Buffer.concat(chunks).toString()).toBe('payload')
+        return undiciReply(200, {}, byteStream('done'))
+      })
+      try {
+        expect(await (await transport.fetch(request)).text()).toBe('done')
+      } finally {
+        await transport.dispatcher.destroy()
+      }
+    }
+  )
+
+  it('does not read the Request body when init supplies a replacement', async () => {
+    const request = new Request('https://api.example.com/upload', {
+      method: 'POST',
+      body: 'original',
+    })
+    const clone = vi.spyOn(request, 'clone')
+    const bodyOverride = vi.fn().mockReturnValueOnce('replacement').mockReturnValue(undefined)
+    mockUndiciRequest.mockResolvedValueOnce(undiciReply(200, {}, byteStream('done')))
+    const transport = createSsrfGuardedFetchWithDispatcher({ profile: 'configuredEndpoint' })
+    try {
+      const response = await transport.fetch(request, {
+        get body() {
+          return bodyOverride()
+        },
+      })
+      expect(await response.text()).toBe('done')
+      expect(mockUndiciRequest.mock.calls[0][1].body).toBe('replacement')
+      expect(request.bodyUsed).toBe(false)
+      expect(clone).not.toHaveBeenCalled()
+      expect(bodyOverride).toHaveBeenCalledTimes(1)
+    } finally {
+      await request.body?.cancel()
+      await transport.dispatcher.destroy()
+    }
+  })
+
   it('supports buffered reads (.json()) through the constructed body', async () => {
     mockUndiciRequest.mockResolvedValueOnce(
       undiciReply(
@@ -128,7 +247,7 @@ describe('createSsrfGuardedFetchWithDispatcher (undici.request backed)', () => {
     })
 
     const [, options] = mockUndiciRequest.mock.calls[0]
-    expect(options.headers).toEqual({ authorization: 'Bearer t' })
+    expect(options.headers).toEqual({ authorization: 'Bearer t', 'user-agent': 'undici' })
     expect(Buffer.isBuffer(options.body)).toBe(true)
     expect(Buffer.from(options.body).toString()).toBe('payload')
   })
@@ -217,16 +336,21 @@ describe('createSsrfGuardedFetchWithDispatcher (undici.request backed)', () => {
     await expect(response.text()).rejects.toThrow()
   })
 
-  it('rejects the reader when the source is destroyed without an error (abort/reset)', async () => {
-    const source = new Readable({ read() {} }) // stays open, never pushes
-    mockUndiciRequest.mockResolvedValueOnce(undiciReply(200, {}, source))
-    const { fetch } = createSsrfGuardedFetchWithDispatcher({ profile: 'configuredEndpoint' })
+  it.each([undefined, 'gzip'])(
+    'rejects the reader when the source is destroyed without an error (encoding: %s)',
+    async (encoding) => {
+      const source = new Readable({ read() {} }) // stays open, never pushes
+      mockUndiciRequest.mockResolvedValueOnce(
+        undiciReply(200, encoding ? { 'content-encoding': encoding } : {}, source)
+      )
+      const { fetch } = createSsrfGuardedFetchWithDispatcher({ profile: 'configuredEndpoint' })
 
-    const response = await fetch('https://mcp.example.com/hang', { method: 'GET' })
-    const reader = response.body!.getReader()
-    const read = reader.read()
-    source.destroy() // no error argument — mirrors an aborted/reset socket
+      const response = await fetch('https://mcp.example.com/hang', { method: 'GET' })
+      const reader = response.body!.getReader()
+      const read = reader.read()
+      source.destroy() // no error argument — mirrors an aborted/reset socket
 
-    await expect(read).rejects.toThrow(/closed before completing/)
-  })
+      await expect(read).rejects.toThrow(/closed before completing/)
+    }
+  )
 })
diff --git a/apps/sim/lib/core/security/input-validation.server.ts b/apps/sim/lib/core/security/input-validation.server.ts
index 86891fa1e6e..9c638d35fc1 100644
--- a/apps/sim/lib/core/security/input-validation.server.ts
+++ b/apps/sim/lib/core/security/input-validation.server.ts
@@ -14,9 +14,14 @@ import { HttpsProxyAgent } from 'https-proxy-agent'
 import {
   Agent,
   type Dispatcher,
+  errors,
   type RequestInit as UndiciRequestInit,
-  request as undiciRequest,
-} from 'undici'
+} from 'undici/index.js'
+import { OutboundRoutingError } from '@/lib/core/network/routing'
+import {
+  createOutboundTransport,
+  requestWithOutboundDispatcher,
+} from '@/lib/core/network/transport.server'
 import { describeEgressDenial, type EgressProfile } from '@/lib/core/security/egress/profiles'
 import {
   checkEgressUrl,
@@ -403,6 +408,7 @@ export interface SecureFetchResponse {
 }
 
 const DEFAULT_MAX_REDIRECTS = 5
+const DEFAULT_USER_AGENT = 'undici'
 
 /**
  * Fail-safe ceiling applied by {@link secureFetchWithPinnedIP} when the caller does not
@@ -760,33 +766,29 @@ function contentEncodingDecoder(
  * `redirect: 'manual'`.
  */
 async function undiciRequestAsResponse(
-  input: RequestInfo | URL,
-  init: RequestInit,
-  dispatcher: Dispatcher
+  url: string,
+  effectiveInit: UndiciRequestInit,
+  dispatcher: Dispatcher,
+  maxResponseSize?: number
 ): Promise<Response> {
-  let url: string
-  let effectiveInit = init as UndiciRequestInit
-  if (typeof Request !== 'undefined' && input instanceof Request) {
-    // A Request input carries its own method/headers/body/signal; lift them (explicit
-    // init fields win, per fetch semantics) so a guarded POST isn't downgraded to GET.
-    const bodyAllowed = input.method !== 'GET' && input.method !== 'HEAD'
-    effectiveInit = {
-      method: input.method,
-      headers: input.headers,
-      body: bodyAllowed ? await input.clone().arrayBuffer() : undefined,
-      signal: input.signal,
-      ...(init as UndiciRequestInit),
-      // double-cast-allowed: DOM RequestInit and undici RequestInit differ in TS but match at runtime
-    } as unknown as UndiciRequestInit
-    url = input.url
-  } else {
-    url = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url
-  }
-
   const method = (effectiveInit.method ?? 'GET').toUpperCase()
   const canHaveBody = method !== 'GET' && method !== 'HEAD'
   const requestHeaders = toUndiciRequestHeaders(effectiveInit.headers) ?? {}
-  const requestBody = canHaveBody ? toUndiciRequestBody(effectiveInit.body) : undefined
+  if (!Object.keys(requestHeaders).some((name) => name.toLowerCase() === 'user-agent')) {
+    requestHeaders['user-agent'] = DEFAULT_USER_AGENT
+  }
+  let requestBody = canHaveBody ? toUndiciRequestBody(effectiveInit.body) : undefined
+  if (
+    canHaveBody &&
+    (effectiveInit.body instanceof FormData || effectiveInit.body instanceof Blob)
+  ) {
+    const encoded = new Request(url, { method, body: effectiveInit.body })
+    if (!Object.keys(requestHeaders).some((key) => key.toLowerCase() === 'content-type')) {
+      const contentType = encoded.headers.get('content-type')
+      if (contentType) requestHeaders['content-type'] = contentType
+    }
+    requestBody = encoded.body ? toUndiciRequestBody(encoded.body) : undefined
+  }
   // fetch auto-adds a form content-type for a URLSearchParams body; preserve that parity
   // when the caller didn't set one (the MCP SDK does set it explicitly, but not every caller).
   if (
@@ -796,7 +798,7 @@ async function undiciRequestAsResponse(
   ) {
     requestHeaders['content-type'] = 'application/x-www-form-urlencoded;charset=UTF-8'
   }
-  const { statusCode, headers, body } = await undiciRequest(url, {
+  const { statusCode, headers, body } = await requestWithOutboundDispatcher(url, {
     method: method as Dispatcher.HttpMethod,
     headers: requestHeaders,
     body: requestBody,
@@ -815,7 +817,8 @@ async function undiciRequestAsResponse(
   // Null-body statuses (204/205/304) can't carry a body; drain undici's (empty) stream so its
   // socket returns to the pool. Attach an error listener first so a socket reset mid-drain
   // surfaces as a handled event, not an unhandled 'error' that crashes the process.
-  const isNullBody = statusCode === 204 || statusCode === 205 || statusCode === 304
+  const isNullBody =
+    method === 'HEAD' || statusCode === 204 || statusCode === 205 || statusCode === 304
   if (isNullBody) {
     body.on('error', () => {})
     body.resume()
@@ -839,11 +842,33 @@ async function undiciRequestAsResponse(
   // `nodeReadableToWebStream` attaches its `error` listener synchronously, so wiring the pipe
   // AFTER it means a synchronous zlib error (e.g. a server mislabeling a non-gzip body as gzip)
   // is caught and rejects the reader instead of taking down the process.
-  const webBody = nodeReadableToWebStream(decoder ?? body)
+  let webBody = nodeReadableToWebStream(decoder ?? body)
+  if (decoder && maxResponseSize !== undefined && maxResponseSize >= 0) {
+    let decodedBytes = 0
+    webBody = webBody.pipeThrough(
+      new TransformStream<Uint8Array, Uint8Array>({
+        transform(chunk, controller) {
+          decodedBytes += chunk.byteLength
+          if (decodedBytes > maxResponseSize) throw new errors.ResponseExceededMaxSizeError()
+          controller.enqueue(chunk)
+        },
+      })
+    )
+  }
   if (decoder) {
-    body.once('error', (err) => decoder.destroy(err)) // forward maxResponseSize / socket reset
-    decoder.once('close', () => body.destroy()) // tear the source down so the socket can't leak
+    const signal = effectiveInit.signal
+    const onAbort = () => decoder.destroy(toError(signal?.reason ?? new Error('Aborted')))
+    signal?.addEventListener('abort', onAbort, { once: true })
+    body.once('error', (error) => decoder.destroy(error))
+    body.once('close', () => {
+      if (!body.readableEnded) decoder.destroy(new Error('Response body closed before completing'))
+    })
+    decoder.once('close', () => {
+      signal?.removeEventListener('abort', onAbort)
+      body.destroy()
+    })
     body.pipe(decoder)
+    if (signal?.aborted) onAbort()
   }
 
   try {
@@ -856,6 +881,7 @@ async function undiciRequestAsResponse(
   } catch (err) {
     // `new Response` rejects an out-of-range status (a 1xx undici shouldn't surface, but
     // defensively): destroy the source so its socket can't leak, then rethrow.
+    decoder?.destroy()
     body.destroy()
     throw err
   }
@@ -874,25 +900,82 @@ async function liftFetchArgs(
   const target = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url
   if (typeof Request !== 'undefined' && input instanceof Request) {
     const bodyAllowed = input.method !== 'GET' && input.method !== 'HEAD'
-    return {
-      target,
-      effectiveInit: {
-        method: input.method,
-        headers: input.headers,
-        body: bodyAllowed ? await input.clone().arrayBuffer() : undefined,
-        signal: input.signal,
-        // Carry the Request's redirect mode so the pinned fetch honors `manual`/`error`
-        // instead of defaulting a `Request({ redirect: 'manual' })` to `follow`.
-        redirect: input.redirect,
-        ...init,
-      },
+    const effectiveInit: RequestInit = {
+      method: input.method,
+      headers: input.headers,
+      body: bodyAllowed ? input.body : undefined,
+      signal: input.signal,
+      // Carry the Request's redirect mode so the pinned fetch honors `manual`/`error`
+      // instead of defaulting a `Request({ redirect: 'manual' })` to `follow`.
+      redirect: input.redirect,
+      ...init,
     }
+    /** Request hides its original body source, so following redirects requires replayable bytes. */
+    if (
+      !Object.hasOwn(init ?? {}, 'body') &&
+      effectiveInit.body &&
+      (effectiveInit.redirect ?? 'follow') === 'follow'
+    ) {
+      effectiveInit.body = await input.clone().arrayBuffer()
+    }
+    return { target, effectiveInit }
   }
   return { target, effectiveInit: init ?? {} }
 }
 
+export interface OutboundFetchDispatcher {
+  close(): Promise<void>
+  destroy(): Promise<void>
+}
+
+/** Owns routing, redirect validation and connection pools for pinned and DNS-guarded fetches. */
+function createValidatedFetch(
+  direct: Agent,
+  options: {
+    profile: EgressProfile
+    resolvedIP?: string
+    maxResponseSize?: number
+  }
+): { fetch: typeof fetch; dispatcher: OutboundFetchDispatcher } {
+  const dispatcher = createOutboundTransport({ ...options, direct })
+  const rawFetch = async (url: string, init: UndiciRequestInit): Promise<Response> => {
+    const selected = await dispatcher.selectDispatcher()
+    if (!selected) throw new OutboundRoutingError('GATEWAY_UNAVAILABLE')
+    return undiciRequestAsResponse(url, init, selected, options.maxResponseSize)
+  }
+  return {
+    dispatcher,
+    fetch: async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+      const { target, effectiveInit } = await liftFetchArgs(input, init)
+      const mode = effectiveInit.redirect ?? 'follow'
+      // double-cast-allowed: DOM and Undici RequestInit represent the same wire request in this bridge
+      const undiciInit = effectiveInit as unknown as UndiciRequestInit
+      if (mode === 'follow') {
+        return followRedirectsGuarded(
+          rawFetch,
+          target,
+          undiciInit,
+          options.profile,
+          options.resolvedIP
+        )
+      }
+      assertGuardedRedirectTarget(new URL(target), options.profile, options.resolvedIP)
+      const response = await rawFetch(target, undiciInit)
+      if (
+        mode === 'error' &&
+        isRedirectStatus(response.status) &&
+        response.headers.has('location')
+      ) {
+        await response.body?.cancel().catch(() => {})
+        throw new TypeError('Outbound fetch received an unexpected redirect')
+      }
+      return response
+    },
+  }
+}
+
 /**
- * SSRF-guarded `fetch` + its `Agent` for outbound requests to user-controlled
+ * SSRF-guarded `fetch` + its dispatcher for outbound requests to user-controlled
  * hosts: DNS resolves normally, and every socket connect validates the chosen
  * addresses via {@link createSsrfGuardedLookup}; redirects are followed manually
  * with per-hop validation (see {@link followRedirectsGuarded}) so IP-literal
@@ -904,7 +987,7 @@ export function createSsrfGuardedFetchWithDispatcher(options: {
   maxResponseSize?: number
 }): {
   fetch: typeof fetch
-  dispatcher: Agent
+  dispatcher: OutboundFetchDispatcher
 } {
   const dispatcher = new Agent({
     allowH2: false,
@@ -912,22 +995,7 @@ export function createSsrfGuardedFetchWithDispatcher(options: {
     ...(options.maxResponseSize !== undefined ? { maxResponseSize: options.maxResponseSize } : {}),
   })
 
-  const rawFetch = (url: string, init: UndiciRequestInit): Promise<Response> =>
-    // double-cast-allowed: DOM RequestInit and undici RequestInit differ in TS but match at runtime
-    undiciRequestAsResponse(url, init as unknown as RequestInit, dispatcher)
-
-  const guarded = async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
-    const { target, effectiveInit } = await liftFetchArgs(input, init)
-    return followRedirectsGuarded(
-      rawFetch,
-      target,
-      // double-cast-allowed: DOM RequestInit and undici RequestInit are structurally compatible at runtime but the TS types differ
-      effectiveInit as unknown as UndiciRequestInit,
-      options.profile
-    )
-  }
-
-  return { fetch: guarded, dispatcher }
+  return createValidatedFetch(dispatcher, options)
 }
 
 /**
@@ -962,10 +1030,9 @@ export function createPinnedFetch(
 }
 
 /**
- * Same as {@link createPinnedFetch} but also returns the underlying `Agent` so a
- * caller with a defined connection lifetime (e.g. a long-lived MCP transport) can
- * tear the Agent down on close instead of waiting for its idle timeout. Closing
- * the Agent is what releases any pooled keep-alive / HTTP/2 sockets it holds.
+ * Like {@link createPinnedFetch}, with lifecycle controls for its direct and gateway
+ * connection pools. Callers with a defined connection lifetime close these pools
+ * when that lifetime ends.
  *
  * `maxResponseSize` caps the (decoded) response body in bytes and makes undici reject
  * with `UND_ERR_RES_EXCEEDED_MAX_SIZE` once exceeded — a DoS backstop for one-shot
@@ -975,48 +1042,14 @@ export function createPinnedFetch(
 export function createPinnedFetchWithDispatcher(
   resolvedIP: string,
   options: { profile: EgressProfile; allowH2?: boolean; maxResponseSize?: number }
-): { fetch: typeof fetch; dispatcher: Agent } {
+): { fetch: typeof fetch; dispatcher: OutboundFetchDispatcher } {
   const dispatcher = new Agent({
     allowH2: options.allowH2 ?? false,
     connect: { lookup: createPinnedLookup(resolvedIP) },
     ...(options.maxResponseSize !== undefined ? { maxResponseSize: options.maxResponseSize } : {}),
   })
 
-  const rawFetch = (url: string, init: UndiciRequestInit): Promise<Response> =>
-    // double-cast-allowed: DOM RequestInit and undici RequestInit differ in TS but match at runtime
-    undiciRequestAsResponse(url, init as unknown as RequestInit, dispatcher)
-
-  // Requests go through `undici.request` (not `undici.fetch`) because fetch's streaming
-  // `response.body` never delivers under the Bun runtime the server runs on — the same bug
-  // {@link createSsrfGuardedFetchWithDispatcher} works around. Redirects are handled here (not
-  // by a caller's wrapper — the pinned fetch is passed straight to provider/A2A SDKs), honoring
-  // the request's `redirect` mode: `manual`/`error` must NOT transparently follow (e.g.
-  // `detectMcpAuthType` inspects the 3xx to classify auth). The default `follow` uses
-  // {@link followRedirectsGuarded}, which drops headers on cross-origin hops (so a redirect
-  // can't disclose a provider `api-key` to another origin) and stamps the final `response.url`.
-  // Every hop still dispatches through the pinned `Agent` (its `connect.lookup` forces
-  // `resolvedIP`), so a redirect can't escape to another address.
-  const pinned = async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
-    const { target, effectiveInit } = await liftFetchArgs(input, init)
-    const mode = effectiveInit.redirect ?? 'follow'
-    // double-cast-allowed: DOM RequestInit and undici RequestInit are structurally compatible at runtime but the TS types differ
-    const undiciInit = effectiveInit as unknown as UndiciRequestInit
-    if (mode === 'manual') {
-      return rawFetch(target, undiciInit)
-    }
-    if (mode === 'error') {
-      const response = await rawFetch(target, undiciInit)
-      const location = response.headers.get('location')
-      if (response.status >= 300 && response.status < 400 && location) {
-        await response.body?.cancel().catch(() => {})
-        throw new TypeError('Pinned fetch received an unexpected redirect (redirect: "error")')
-      }
-      return response
-    }
-    return followRedirectsGuarded(rawFetch, target, undiciInit, options.profile, resolvedIP)
-  }
-
-  return { fetch: pinned, dispatcher }
+  return createValidatedFetch(dispatcher, { ...options, resolvedIP })
 }
 
 /**
@@ -1041,14 +1074,23 @@ export async function secureFetchWithPinnedIP(
       ? requestedMaxResponseBytes
       : DEFAULT_MAX_RESPONSE_BYTES
 
+  const transport = createOutboundTransport({
+    profile: options.profile,
+    resolvedIP,
+    proxyUrl: options.proxyUrl,
+  })
+  const outboundDispatcher = await transport.selectDispatcher()
+
   return new Promise((resolve, reject) => {
     const parsed = new URL(url)
     const isHttps = parsed.protocol === 'https:'
     const defaultPort = isHttps ? 443 : 80
     const port = parsed.port ? Number.parseInt(parsed.port, 10) : defaultPort
 
-    let agent: http.Agent
-    if (options.proxyUrl) {
+    let agent: http.Agent | undefined
+    if (outboundDispatcher) {
+      agent = undefined
+    } else if (options.proxyUrl) {
       // Proxy connection is already IP-pinned by validateAndPinProxyUrl; target-IP
       // pinning is intentionally bypassed (the proxy resolves the target). https
       // targets tunnel via CONNECT, http targets use absolute-URI forwarding.
@@ -1060,6 +1102,9 @@ export async function secureFetchWithPinnedIP(
     }
 
     const { 'accept-encoding': _, ...sanitizedHeaders } = options.headers ?? {}
+    if (!Object.keys(sanitizedHeaders).some((name) => name.toLowerCase() === 'user-agent')) {
+      sanitizedHeaders['user-agent'] = DEFAULT_USER_AGENT
+    }
     const hasExplicitFraming = Object.keys(sanitizedHeaders).some((name) => {
       const header = name.toLowerCase()
       return header === 'content-length' || header === 'transfer-encoding'
@@ -1081,8 +1126,14 @@ export async function secureFetchWithPinnedIP(
       timeout: options.timeout || 300000,
     }
 
-    const protocol = isHttps ? https : http
-    const req = protocol.request(requestOptions, (res) => {
+    let destroyRequest: () => void = () => {}
+    const onResponse = (
+      res: Readable & {
+        statusCode?: number
+        headers: http.IncomingHttpHeaders
+        statusMessage?: string
+      }
+    ) => {
       const statusCode = res.statusCode || 0
       const location = res.headers.location
 
@@ -1212,6 +1263,7 @@ export async function secureFetchWithPinnedIP(
       const isBodylessResponse =
         (requestOptions.method || 'GET').toUpperCase() === 'HEAD' ||
         statusCode === 204 ||
+        statusCode === 205 ||
         statusCode === 304
       const contentLength = headersRecord['content-length']
       if (contentLength && !isBodylessResponse) {
@@ -1219,7 +1271,7 @@ export async function secureFetchWithPinnedIP(
         if (Number.isFinite(parsedLength) && parsedLength > maxResponseBytes) {
           cleanupAbort()
           res.destroy()
-          req.destroy()
+          destroyRequest()
           if (isRetryableHttpStatus(statusCode)) {
             settledResolve({
               ok: false,
@@ -1244,38 +1296,69 @@ export async function secureFetchWithPinnedIP(
         }
       }
 
+      const decoder = isBodylessResponse
+        ? null
+        : contentEncodingDecoder((headersRecord['content-encoding'] ?? '').toLowerCase().trim())
+      const responseHeaders = decoder
+        ? stripHeaders(headersRecord, ['content-encoding', 'content-length'])
+        : headersRecord
+
       let totalBytes = 0
-      const nodeRes = res
+      let bodySettled = false
+      const nodeRes = decoder ?? res
+      const destroyTransport = destroyRequest
+      destroyRequest = () => {
+        nodeRes.destroy()
+        if (decoder) res.destroy()
+        destroyTransport()
+      }
       const body = new ReadableStream<Uint8Array>({
         start(controller) {
+          const fail = (error: Error) => {
+            if (bodySettled) return
+            bodySettled = true
+            cleanupAbort()
+            controller.error(error)
+            destroyRequest()
+          }
           nodeRes.on('data', (chunk: Buffer) => {
+            if (bodySettled) return
             totalBytes += chunk.length
             if (totalBytes > maxResponseBytes) {
-              cleanupAbort()
-              controller.error(
+              fail(
                 new PayloadSizeLimitError({
                   label: 'response body',
                   maxBytes: maxResponseBytes,
                   observedBytes: totalBytes,
                 })
               )
-              nodeRes.destroy()
               return
             }
             controller.enqueue(new Uint8Array(chunk))
           })
-          nodeRes.on('end', () => {
+          nodeRes.once('end', () => {
+            if (bodySettled) return
+            bodySettled = true
             cleanupAbort()
             controller.close()
           })
-          nodeRes.on('error', (err) => {
-            cleanupAbort()
-            controller.error(err)
+          nodeRes.once('error', fail)
+          nodeRes.once('close', () => {
+            if (!bodySettled) fail(new Error('Response body closed before completing'))
           })
+          if (decoder) {
+            res.once('error', (error) => decoder.destroy(error))
+            res.once('close', () => {
+              if (!res.readableEnded)
+                decoder.destroy(new Error('Response body closed before completing'))
+            })
+            res.pipe(decoder)
+          }
         },
         cancel() {
+          bodySettled = true
           cleanupAbort()
-          nodeRes.destroy()
+          destroyRequest()
         },
       })
 
@@ -1300,7 +1383,7 @@ export async function secureFetchWithPinnedIP(
         ok: statusCode >= 200 && statusCode < 300,
         status: statusCode,
         statusText: res.statusMessage || '',
-        headers: new SecureFetchHeaders(headersRecord, setCookieArray),
+        headers: new SecureFetchHeaders(responseHeaders, setCookieArray),
         body,
         text: async () => (await readBodyAsBuffer()).toString('utf-8'),
         json: async () => JSON.parse((await readBodyAsBuffer()).toString('utf-8')),
@@ -1309,7 +1392,7 @@ export async function secureFetchWithPinnedIP(
           return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength) as ArrayBuffer
         },
       })
-    })
+    }
 
     let onAbort: (() => void) | null = null
     const cleanupAbort = () => {
@@ -1326,29 +1409,65 @@ export async function secureFetchWithPinnedIP(
       reject(reason)
     }
 
-    req.on('error', (error) => {
-      settledReject(error)
-    })
-
-    req.on('timeout', () => {
-      req.destroy()
-      settledReject(new Error(`Request timed out after ${requestOptions.timeout}ms`))
-    })
+    let send: () => void
+    if (outboundDispatcher) {
+      const dispatcher = outboundDispatcher
+      const controller = new AbortController()
+      destroyRequest = () => {
+        controller.abort()
+        void transport.destroy()
+      }
+      send = () => {
+        void requestWithOutboundDispatcher(url, {
+          dispatcher,
+          method: (options.method || 'GET') as Dispatcher.HttpMethod,
+          headers: sanitizedHeaders,
+          body: options.body,
+          headersTimeout: requestOptions.timeout,
+          bodyTimeout: requestOptions.timeout,
+          signal: controller.signal,
+        })
+          .then(({ statusCode, statusText, headers, body }) => {
+            body.once('close', () => {
+              void transport.destroy()
+            })
+            onResponse(Object.assign(body, { statusCode, statusMessage: statusText, headers }))
+          })
+          .catch((error) => {
+            void transport.destroy()
+            settledReject(error)
+          })
+      }
+    } else {
+      const protocol = isHttps ? https : http
+      const req = protocol.request(requestOptions, onResponse)
+      destroyRequest = () => {
+        req.destroy()
+      }
+      req.on('error', settledReject)
+      req.on('timeout', () => {
+        destroyRequest()
+        settledReject(new Error(`Request timed out after ${requestOptions.timeout}ms`))
+      })
+      send = () => {
+        req.end(options.body)
+      }
+    }
 
     if (options.signal) {
       if (options.signal.aborted) {
-        req.destroy()
+        destroyRequest()
         settledReject(options.signal.reason ?? new Error('Aborted'))
         return
       }
       onAbort = () => {
-        req.destroy()
+        destroyRequest()
         settledReject(options.signal?.reason ?? new Error('Aborted'))
       }
       options.signal.addEventListener('abort', onAbort, { once: true })
     }
 
-    req.end(options.body)
+    send()
   })
 }
 
diff --git a/apps/sim/lib/core/security/pinned-fetch.server.test.ts b/apps/sim/lib/core/security/pinned-fetch.server.test.ts
index ded5a698a08..a129ad9f999 100644
--- a/apps/sim/lib/core/security/pinned-fetch.server.test.ts
+++ b/apps/sim/lib/core/security/pinned-fetch.server.test.ts
@@ -109,7 +109,7 @@ describe('createPinnedFetch', () => {
     expect(url).toBe('https://myresource.openai.azure.com/openai/v1/responses')
     expect(options.dispatcher).toBeInstanceOf(mockAgent)
     expect(options.method).toBe('POST')
-    expect(options.headers).toEqual({ 'api-key': 'secret' })
+    expect(options.headers).toEqual({ 'api-key': 'secret', 'user-agent': 'undici' })
     expect(options.body).toBe('{}')
     expect(options.signal).toBe(controller.signal)
   })
@@ -159,7 +159,7 @@ describe('createPinnedFetch', () => {
       string
     >
     expect(secondHopHeaders['api-key']).toBeUndefined()
-    expect(Object.keys(secondHopHeaders)).toHaveLength(0)
+    expect(secondHopHeaders).toEqual({ 'user-agent': 'undici' })
     expect(response.status).toBe(200)
     expect(response.url).toBe('https://other-origin.example/final')
     expect(response.redirected).toBe(true)
diff --git a/apps/sim/lib/core/security/secure-fetch-request-framing.server.test.ts b/apps/sim/lib/core/security/secure-fetch-request-framing.server.test.ts
index 3076de3590c..7d977c64e29 100644
--- a/apps/sim/lib/core/security/secure-fetch-request-framing.server.test.ts
+++ b/apps/sim/lib/core/security/secure-fetch-request-framing.server.test.ts
@@ -83,6 +83,18 @@ async function sendToLengthRequiredEndpoint(
 }
 
 describe('secureFetchWithPinnedIP request framing', () => {
+  it.each([
+    { headers: undefined, expected: 'undici' },
+    { headers: { 'uSeR-aGeNt': 'custom-client/1.0' }, expected: 'custom-client/1.0' },
+  ])(
+    'sends a default User-Agent and preserves an explicit one ($expected)',
+    async ({ headers, expected }) => {
+      const received = await sendToLengthRequiredEndpoint({ method: 'POST', headers })
+
+      expect(received.headers['user-agent']).toBe(expected)
+    }
+  )
+
   it.each(['POST', 'PUT', 'PATCH', 'DELETE'])(
     'sends a UTF-8 %s body with its byte length',
     async (method) => {
diff --git a/apps/sim/lib/core/security/secure-fetch-response-cap.server.test.ts b/apps/sim/lib/core/security/secure-fetch-response-cap.server.test.ts
index ce7e2b7d6d6..c86966085f3 100644
--- a/apps/sim/lib/core/security/secure-fetch-response-cap.server.test.ts
+++ b/apps/sim/lib/core/security/secure-fetch-response-cap.server.test.ts
@@ -3,6 +3,9 @@
  */
 import http from 'node:http'
 import type { AddressInfo } from 'node:net'
+import { Transform } from 'node:stream'
+import zlib, { brotliCompressSync, deflateSync, gzipSync } from 'node:zlib'
+import { Agent } from 'undici/index.js'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('@sim/security/dns', () => ({
@@ -18,7 +21,9 @@ vi.mock('@/lib/core/config/env-flags', () => ({
   getProxyUrl: () => undefined,
 }))
 
+import * as networkTransport from '@/lib/core/network/transport.server'
 import {
+  createPinnedFetchWithDispatcher,
   DEFAULT_MAX_RESPONSE_BYTES,
   secureFetchWithPinnedIP,
 } from '@/lib/core/security/input-validation.server'
@@ -26,7 +31,11 @@ import {
 const servers: http.Server[] = []
 
 afterEach(() => {
-  for (const server of servers.splice(0)) server.close()
+  vi.restoreAllMocks()
+  for (const server of servers.splice(0)) {
+    server.closeAllConnections()
+    server.close()
+  }
 })
 
 /** Starts a throwaway loopback server and returns its origin. */
@@ -38,6 +47,182 @@ async function startServer(handler: http.RequestListener): Promise<string> {
 }
 
 describe('secureFetchWithPinnedIP response cap', () => {
+  it.each(['direct', 'gateway'])(
+    'preserves the status phrase and active streaming past the %s inactivity timeout',
+    async (mode) => {
+      const dispatcher = new Agent()
+      if (mode === 'gateway') {
+        vi.spyOn(networkTransport, 'createOutboundTransport').mockReturnValue({
+          selectDispatcher: async () => dispatcher,
+          close: () => dispatcher.close(),
+          destroy: () => dispatcher.destroy(),
+        })
+      }
+      const origin = await startServer((_req, res) => {
+        res.writeHead(200, 'Synthetic status phrase')
+        res.write('start')
+        let chunks = 0
+        const timer = setInterval(() => {
+          res.write('.')
+          if (++chunks === 25) {
+            clearInterval(timer)
+            res.end()
+          }
+        }, 50)
+        res.once('close', () => clearInterval(timer))
+      })
+
+      try {
+        const response = await secureFetchWithPinnedIP(origin, '127.0.0.1', {
+          profile: 'configuredEndpoint',
+          timeout: 1000,
+        })
+        expect(response.statusText).toBe('Synthetic status phrase')
+        await expect(response.text()).resolves.toBe(`start${'.'.repeat(25)}`)
+      } finally {
+        await dispatcher.destroy()
+      }
+    }
+  )
+
+  it.each([
+    { encoding: 'gzip', compress: gzipSync },
+    { encoding: 'deflate', compress: deflateSync },
+    { encoding: 'br', compress: brotliCompressSync },
+  ])(
+    'decodes $encoding JSON and removes encoded framing headers',
+    async ({ encoding, compress }) => {
+      const payload = { ok: true, message: 'compressed provider response' }
+      const encoded = compress(Buffer.from(JSON.stringify(payload)))
+      const origin = await startServer((_req, res) => {
+        res.writeHead(200, {
+          'Content-Type': 'application/json',
+          'Content-Encoding': encoding,
+          'Content-Length': String(encoded.length),
+        })
+        res.end(encoded)
+      })
+
+      const response = await secureFetchWithPinnedIP(origin, '127.0.0.1', {
+        profile: 'configuredEndpoint',
+        maxResponseBytes: 1024,
+      })
+
+      await expect(response.json()).resolves.toEqual(payload)
+      expect(response.headers.get('content-type')).toBe('application/json')
+      expect(response.headers.get('content-encoding')).toBeNull()
+      expect(response.headers.get('content-length')).toBeNull()
+    }
+  )
+
+  it('limits decoded bytes and closes an upstream still sending compressed content', async () => {
+    const closed = vi.fn()
+    const encoded = gzipSync(Buffer.alloc(64 * 1024, 0x41))
+    expect(encoded.length).toBeLessThan(1024)
+    const origin = await startServer((_req, res) => {
+      res.once('close', closed)
+      res.writeHead(200, { 'Content-Encoding': 'gzip' })
+      res.write(encoded)
+    })
+
+    const response = await secureFetchWithPinnedIP(origin, '127.0.0.1', {
+      profile: 'configuredEndpoint',
+      maxResponseBytes: 1024,
+    })
+
+    await expect(response.text()).rejects.toThrow(/response body/i)
+    await vi.waitFor(() => expect(closed).toHaveBeenCalledOnce())
+  })
+
+  it('rejects malformed compression and closes the upstream connection', async () => {
+    const closed = vi.fn()
+    const origin = await startServer((_req, res) => {
+      res.once('close', closed)
+      res.writeHead(200, { 'Content-Encoding': 'gzip' })
+      res.write('this is not gzip')
+    })
+
+    const response = await secureFetchWithPinnedIP(origin, '127.0.0.1', {
+      profile: 'configuredEndpoint',
+    })
+
+    await expect(response.text()).rejects.toThrow()
+    await vi.waitFor(() => expect(closed).toHaveBeenCalledOnce())
+  })
+
+  it('rejects the decoded reader when the upstream resets before completing', async () => {
+    let upstream: http.ServerResponse | undefined
+    const origin = await startServer((_req, res) => {
+      upstream = res
+      res.writeHead(200, { 'Content-Encoding': 'gzip' })
+      res.write(gzipSync(Buffer.from('payload')).subarray(0, 10))
+    })
+
+    const response = await secureFetchWithPinnedIP(origin, '127.0.0.1', {
+      profile: 'configuredEndpoint',
+    })
+    const body = response.text()
+    upstream!.destroy()
+
+    await expect(body).rejects.toThrow(/aborted|closed before completing/)
+  })
+
+  it('rejects a compressed body read when its request is aborted', async () => {
+    const controller = new AbortController()
+    const closed = vi.fn()
+    const origin = await startServer((_req, res) => {
+      res.once('close', closed)
+      res.writeHead(200, { 'Content-Encoding': 'gzip' })
+      res.write(gzipSync(Buffer.from('payload')).subarray(0, 10))
+    })
+
+    const response = await secureFetchWithPinnedIP(origin, '127.0.0.1', {
+      profile: 'configuredEndpoint',
+      signal: controller.signal,
+    })
+    const body = response.text()
+    controller.abort()
+
+    await expect(body).rejects.toThrow()
+    await vi.waitFor(() => expect(closed).toHaveBeenCalledOnce())
+  })
+
+  it('destroys the compressed source when the reader cancels', async () => {
+    const closed = vi.fn()
+    const origin = await startServer((_req, res) => {
+      res.once('close', closed)
+      res.writeHead(200, { 'Content-Encoding': 'gzip' })
+      res.write(gzipSync(Buffer.from('payload')))
+    })
+
+    const response = await secureFetchWithPinnedIP(origin, '127.0.0.1', {
+      profile: 'configuredEndpoint',
+    })
+    await response.body!.cancel()
+
+    await vi.waitFor(() => expect(closed).toHaveBeenCalledOnce())
+  })
+
+  it.each([
+    { method: 'HEAD', status: 200 },
+    { method: 'GET', status: 204 },
+    { method: 'GET', status: 205 },
+    { method: 'GET', status: 304 },
+  ])('does not decode a bodyless $method $status response', async ({ method, status }) => {
+    const origin = await startServer((_req, res) => {
+      res.writeHead(status, { 'Content-Encoding': 'gzip' })
+      res.end()
+    })
+
+    const response = await secureFetchWithPinnedIP(origin, '127.0.0.1', {
+      profile: 'configuredEndpoint',
+      method,
+    })
+
+    await expect(response.text()).resolves.toBe('')
+    expect(response.headers.get('content-encoding')).toBe('gzip')
+  })
+
   it('rejects a body that exceeds an explicit cap instead of buffering it', async () => {
     const origin = await startServer((_req, res) => {
       res.writeHead(200, { 'Content-Type': 'application/octet-stream' })
@@ -112,3 +297,130 @@ describe('secureFetchWithPinnedIP response cap', () => {
     expect(response.status).toBe(304)
   })
 })
+
+describe('pinned fetch response decoding', () => {
+  it('returns a null body for HEAD even when metadata advertises gzip', async () => {
+    const origin = await startServer((_req, res) => {
+      res.writeHead(200, { 'Content-Encoding': 'gzip', 'Content-Length': '10000' })
+      res.end()
+    })
+    const transport = createPinnedFetchWithDispatcher('127.0.0.1', {
+      profile: 'configuredEndpoint',
+      maxResponseSize: 1024,
+    })
+    try {
+      const response = await transport.fetch(origin, { method: 'HEAD' })
+
+      expect(response.body).toBeNull()
+      await expect(response.text()).resolves.toBe('')
+      expect(response.headers.get('content-encoding')).toBe('gzip')
+      expect(response.headers.get('content-length')).toBe('10000')
+    } finally {
+      await transport.dispatcher.destroy()
+    }
+  })
+
+  it('enforces maxResponseSize on decoded content and cancels its upstream', async () => {
+    const encoded = gzipSync(Buffer.alloc(64 * 1024, 0x41))
+    const closed = vi.fn()
+    expect(encoded.length).toBeLessThan(1024)
+    const origin = await startServer((_req, res) => {
+      res.once('close', closed)
+      res.writeHead(200, { 'Content-Encoding': 'gzip' })
+      res.write(encoded)
+    })
+    const transport = createPinnedFetchWithDispatcher('127.0.0.1', {
+      profile: 'configuredEndpoint',
+      maxResponseSize: 1024,
+    })
+    try {
+      const response = await transport.fetch(origin)
+
+      await expect(response.text()).rejects.toMatchObject({ code: 'UND_ERR_RES_EXCEEDED_MAX_SIZE' })
+      await vi.waitFor(() => expect(closed).toHaveBeenCalledOnce())
+    } finally {
+      await transport.dispatcher.destroy()
+    }
+  })
+
+  it('still permits decoded responses when maxResponseSize is explicitly unbounded', async () => {
+    const payload = 'a'.repeat(64 * 1024)
+    const origin = await startServer((_req, res) => {
+      res.writeHead(200, { 'Content-Encoding': 'gzip' })
+      res.end(gzipSync(payload))
+    })
+    const transport = createPinnedFetchWithDispatcher('127.0.0.1', {
+      profile: 'configuredEndpoint',
+      maxResponseSize: -1,
+    })
+    try {
+      const response = await transport.fetch(origin)
+      await expect(response.text()).resolves.toBe(payload)
+    } finally {
+      await transport.dispatcher.destroy()
+    }
+  })
+
+  it.each(['bounded', 'guarded'] as const)(
+    'keeps %s cancellation attached until decoding finishes',
+    async (mode) => {
+      const decoder = new Transform({
+        transform(_chunk, _encoding, done) {
+          done()
+        },
+        flush() {},
+      })
+      vi.spyOn(zlib, 'createGunzip').mockReturnValue(decoder as zlib.Gunzip)
+      const dispatcher = new Agent()
+      if (mode === 'bounded') {
+        vi.spyOn(networkTransport, 'createOutboundTransport').mockReturnValueOnce({
+          selectDispatcher: async () => dispatcher,
+          close: () => dispatcher.close(),
+          destroy: () => dispatcher.destroy(),
+        })
+      }
+      const pinned =
+        mode === 'guarded'
+          ? createPinnedFetchWithDispatcher('127.0.0.1', { profile: 'configuredEndpoint' })
+          : undefined
+      const wireClosed = vi.fn()
+      const send = networkTransport.requestWithOutboundDispatcher
+      vi.spyOn(networkTransport, 'requestWithOutboundDispatcher').mockImplementationOnce(
+        async (...args) => {
+          const reply = await send(...args)
+          reply.body.once('close', wireClosed)
+          return reply
+        }
+      )
+      const origin = await startServer((_req, res) => {
+        res.writeHead(200, { 'Content-Encoding': 'gzip' })
+        res.end(gzipSync('payload'))
+      })
+      const controller = new AbortController()
+      const removeListener = vi.spyOn(controller.signal, 'removeEventListener')
+      try {
+        const response = pinned
+          ? await pinned.fetch(origin, { signal: controller.signal })
+          : await secureFetchWithPinnedIP(origin, '127.0.0.1', {
+              profile: 'configuredEndpoint',
+              signal: controller.signal,
+            })
+        await vi.waitFor(() => expect(wireClosed).toHaveBeenCalledOnce())
+        if (mode === 'bounded') {
+          expect(removeListener).not.toHaveBeenCalledWith('abort', expect.any(Function))
+        }
+        const reading = response.text()
+        const reason = new Error('decoding cancelled')
+        controller.abort(reason)
+
+        if (mode === 'guarded') await expect(reading).rejects.toBe(reason)
+        else await expect(reading).rejects.toThrow(/closed before completing/)
+        expect(decoder.destroyed).toBe(true)
+      } finally {
+        decoder.destroy()
+        await pinned?.dispatcher.destroy()
+        await dispatcher.destroy()
+      }
+    }
+  )
+})
diff --git a/apps/sim/lib/core/utils/fetch-deadline.ts b/apps/sim/lib/core/utils/fetch-deadline.ts
index 006795a427a..f6643784a09 100644
--- a/apps/sim/lib/core/utils/fetch-deadline.ts
+++ b/apps/sim/lib/core/utils/fetch-deadline.ts
@@ -1,4 +1,4 @@
-import { Agent, type Dispatcher } from 'undici'
+import { Agent, type Dispatcher } from 'undici/index.js'
 
 /**
  * Keeps the transport deadline from undercutting the application deadline.
diff --git a/apps/sim/lib/credential-groups/application/public-enrollment.ts b/apps/sim/lib/credential-groups/application/public-enrollment.ts
index 0c0f388e82b..a45f06f9135 100644
--- a/apps/sim/lib/credential-groups/application/public-enrollment.ts
+++ b/apps/sim/lib/credential-groups/application/public-enrollment.ts
@@ -2,6 +2,7 @@ import type { CredentialGroupEnrollmentPrincipal, Principal } from '@sim/auth/pr
 import { safeCompare } from '@sim/security/compare'
 import { sha256Hex } from '@sim/security/hash'
 import type { OperationUseCase } from '@/lib/core/application'
+import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
   resourceScopeFields,
@@ -91,7 +92,7 @@ function defineAuthorizedCredentialGroupEnrollmentUseCase<
     },
     async execute({ principal, input }) {
       const authorized = await authorize(principal, input)
-      return definition.execute(authorized)
+      return withResourceOutboundScope(authorized.context, () => definition.execute(authorized))
     },
   }
 }
diff --git a/apps/sim/lib/credentials/application/organization-credentials.ts b/apps/sim/lib/credentials/application/organization-credentials.ts
index 6117032c586..97ea3207545 100644
--- a/apps/sim/lib/credentials/application/organization-credentials.ts
+++ b/apps/sim/lib/credentials/application/organization-credentials.ts
@@ -17,6 +17,7 @@ import {
 } from '@/lib/core/application/organization-authorization'
 import { defineOrganizationOperation } from '@/lib/core/application/organization-operation'
 import { PrincipalKindAuthorizationError } from '@/lib/core/application/workspace-authorization'
+import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { resourceScopeCondition } from '@/lib/core/resource-scope.server'
 import { throwCredentialMutationFailure } from '@/lib/credentials/application/credential-crud'
@@ -216,9 +217,8 @@ export const createOrganizationCredential: OperationUseCase<
       )
       requireAvailableOAuthCredentialProvider(catalog, input.providerId ?? '')
     }
-    const result = await createCredentialRecord(
-      { ...input, userId: context.userId },
-      { authorizeWorkspace: false }
+    const result = await withResourceOutboundScope(context, () =>
+      createCredentialRecord({ ...input, userId: context.userId }, { authorizeWorkspace: false })
     )
     if (!result.success) throwCredentialMutationFailure(result)
     if (!result.credential) throw new Error('Credential creation returned no credential')
@@ -409,7 +409,9 @@ export const updateOrganizationCredential: OperationUseCase<
       (row.type === 'oauth' && row.createdBy !== context.userId)
     )
       throw new OrchestrationError('not_found', 'Credential not found')
-    const result = await updateCredentialRecord({ ...input, credential: row })
+    const result = await withResourceOutboundScope(row, () =>
+      updateCredentialRecord({ ...input, credential: row })
+    )
     if (!result.success) throwCredentialMutationFailure(result)
     const updated = await getOrganizationCredential(input.organizationId, input.credentialId)
     if (!updated) throw new OrchestrationError('not_found', 'Credential not found')
diff --git a/apps/sim/lib/data-drains/service.ts b/apps/sim/lib/data-drains/service.ts
index 418d475137b..df5709af819 100644
--- a/apps/sim/lib/data-drains/service.ts
+++ b/apps/sim/lib/data-drains/service.ts
@@ -4,6 +4,7 @@ import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
 import { eq } from 'drizzle-orm'
+import { runWithOutboundOrganization } from '@/lib/core/network/context.server'
 import { getDestination } from '@/lib/data-drains/destinations/registry'
 import { decryptCredentials } from '@/lib/data-drains/encryption'
 import { getSource } from '@/lib/data-drains/sources/registry'
@@ -88,7 +89,8 @@ export async function runDrain(
     const credentials = destination.credentialsSchema.parse(
       await decryptCredentials(drain.destinationCredentials)
     )
-    session = destination.openSession({ config, credentials })
+    const activeSession = destination.openSession({ config, credentials })
+    session = activeSession
 
     for await (const chunk of source.pages({
       organizationId: drain.organizationId,
@@ -99,19 +101,21 @@ export async function runDrain(
       const ndjson = `${chunk.map((row) => JSON.stringify(source.serialize(row))).join('\n')}\n`
       const body = Buffer.from(ndjson, 'utf8')
 
-      const result = await session.deliver({
-        body,
-        contentType: 'application/x-ndjson',
-        metadata: {
-          drainId,
-          runId,
-          source: drain.source,
-          sequence,
-          rowCount: chunk.length,
-          runStartedAt: startedAt,
-        },
-        signal,
-      })
+      const result = await runWithOutboundOrganization(drain.organizationId, () =>
+        activeSession.deliver({
+          body,
+          contentType: 'application/x-ndjson',
+          metadata: {
+            drainId,
+            runId,
+            source: drain.source,
+            sequence,
+            rowCount: chunk.length,
+            runStartedAt: startedAt,
+          },
+          signal,
+        })
+      )
 
       locators.push(result.locator)
       rowsExported += chunk.length
diff --git a/apps/sim/lib/execution/files.ts b/apps/sim/lib/execution/files.ts
index e23582aba18..d2d195681bd 100644
--- a/apps/sim/lib/execution/files.ts
+++ b/apps/sim/lib/execution/files.ts
@@ -1,4 +1,5 @@
 import { createLogger } from '@sim/logger'
+import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import { uploadExecutionFile } from '@/lib/uploads/contexts/execution'
 import { TRIGGER_TYPES } from '@/lib/workflows/triggers/triggers'
 import type { InputFormatField } from '@/lib/workflows/types'
@@ -57,7 +58,9 @@ export async function processExecutionFile(
 
   if (file.type === 'url' && file.data) {
     const { downloadFileFromUrl } = await import('@/lib/uploads/utils/file-utils.server')
-    const buffer = await downloadFileFromUrl(file.data, { userId })
+    const buffer = await withResourceOutboundScope(executionContext, () =>
+      downloadFileFromUrl(file.data, { userId })
+    )
 
     if (buffer.length > MAX_FILE_SIZE) {
       const fileSizeMB = (buffer.length / (1024 * 1024)).toFixed(2)
diff --git a/apps/sim/lib/execution/isolated-vm-worker.cjs b/apps/sim/lib/execution/isolated-vm-worker.cjs
index ac19d487b21..a5eeb2e6dd0 100644
--- a/apps/sim/lib/execution/isolated-vm-worker.cjs
+++ b/apps/sim/lib/execution/isolated-vm-worker.cjs
@@ -263,13 +263,16 @@ async function executeCode(request, executionId) {
           resolve(JSON.stringify({ error: 'Parent process disconnected' }))
           return
         }
-        sendIpcRequest({ type: 'fetch', fetchId, requestId, url, optionsJson }, (err) => {
-          const pending = pendingFetches.get(fetchId)
-          if (!pending) return
-          clearTimeout(pending.timeout)
-          pendingFetches.delete(fetchId)
-          pending.resolve(JSON.stringify({ error: `Fetch IPC send failed: ${err.message}` }))
-        })
+        sendIpcRequest(
+          { type: 'fetch', fetchId, executionId, requestId, url, optionsJson },
+          (err) => {
+            const pending = pendingFetches.get(fetchId)
+            if (!pending) return
+            clearTimeout(pending.timeout)
+            pendingFetches.delete(fetchId)
+            pending.resolve(JSON.stringify({ error: `Fetch IPC send failed: ${err.message}` }))
+          }
+        )
       })
     })
     await jail.set('__fetchRef', fetchCallback)
diff --git a/apps/sim/lib/execution/isolated-vm.test.ts b/apps/sim/lib/execution/isolated-vm.test.ts
index 717f9ebaa2e..0511fd9fda5 100644
--- a/apps/sim/lib/execution/isolated-vm.test.ts
+++ b/apps/sim/lib/execution/isolated-vm.test.ts
@@ -143,6 +143,7 @@ function createReadyFetchProxyProc(fetchMessage: { url: string; optionsJson?: st
       setImmediate(() => {
         proc.emit('message', {
           type: 'fetch',
+          executionId: currentExecutionId,
           fetchId: 1,
           requestId: msg.request?.requestId ?? 'fetch-test',
           url: fetchMessage.url,
@@ -171,7 +172,10 @@ function createReadyFetchProxyProc(fetchMessage: { url: string; optionsJson?: st
   return proc
 }
 
-const { mockSpawn, mockExecSync, mockEnv } = vi.hoisted(() => ({
+const { mockSpawn, mockExecSync, mockEnv, mockResolveOutboundRoute } = vi.hoisted(() => ({
+  mockResolveOutboundRoute: vi.fn(async (_organizationId: string | null | undefined) => ({
+    kind: 'direct',
+  })),
   mockSpawn: vi.fn(),
   mockExecSync: vi.fn(() => Buffer.from('v23.11.0')),
   mockEnv: {
@@ -199,6 +203,10 @@ const mockSecureFetch = inputValidationMockFns.mockSecureFetchWithValidation
 const mockGetRedisClient = redisConfigMockFns.mockGetRedisClient
 
 vi.mock('@/lib/core/security/input-validation.server', () => inputValidationMock)
+vi.mock('@/lib/core/network/config.server', () => ({
+  isOutboundRoutingEnabled: () => true,
+  resolveOutboundRoute: mockResolveOutboundRoute,
+}))
 vi.mock('@/lib/core/config/env', () => ({
   env: mockEnv,
 }))
@@ -830,6 +838,77 @@ describe('isolated-vm scheduler', () => {
     expect(completionOrder).toEqual(['a-1', 'a-2', 'a-3', 'b-1', 'b-2'])
   })
 
+  it('restores each execution owner when a reused worker emits outside its scope', async () => {
+    const { executeInIsolatedVM, spawnMock } = await loadExecutionModule({
+      spawns: [
+        () => {
+          const proc = createReadyFetchProxyProc({ url: 'https://example.com' })
+          const emit = proc.emit.bind(proc)
+          proc.emit = (event, ...args: unknown[]) => {
+            const message = args[0] as { type?: string } | undefined
+            return event === 'message' && message?.type === 'fetch'
+              ? context.runWithOutboundOrganization('wrong-ambient', () => emit(event, ...args))
+              : emit(event, ...args)
+          }
+          return proc
+        },
+      ],
+      secureFetchImpl: async () => {
+        await context.resolveCurrentOutboundRoute()
+        return new Response('ok')
+      },
+    })
+    const context = await import('@/lib/core/network/context.server')
+
+    for (const organizationId of ['org_a', 'org_b']) {
+      const result = await context.runWithOutboundOrganization(organizationId, () =>
+        executeInIsolatedVM({
+          code: 'return "fetch"',
+          params: {},
+          envVars: {},
+          contextVariables: {},
+          timeoutMs: 1000,
+          requestId: organizationId,
+        })
+      )
+      expect(result.error).toBeUndefined()
+    }
+    expect(spawnMock).toHaveBeenCalledOnce()
+    expect(mockResolveOutboundRoute.mock.calls).toEqual([['org_a'], ['org_b']])
+  })
+
+  it.each([undefined, -1])(
+    'rejects fetch IPC with missing or inactive execution ID %s',
+    async (executionId) => {
+      const { executeInIsolatedVM, secureFetchMock } = await loadExecutionModule({
+        spawns: [
+          () => {
+            const proc = createReadyFetchProxyProc({ url: 'https://example.com' })
+            const emit = proc.emit.bind(proc)
+            proc.emit = (event, ...args: unknown[]) => {
+              const message = args[0] as { type?: string } | undefined
+              if (event === 'message' && message?.type === 'fetch') {
+                return emit(event, { ...message, executionId })
+              }
+              return emit(event, ...args)
+            }
+            return proc
+          },
+        ],
+      })
+      const result = await executeInIsolatedVM({
+        code: 'return "fetch"',
+        params: {},
+        envVars: {},
+        contextVariables: {},
+        timeoutMs: 1000,
+        requestId: 'inactive-fetch',
+      })
+      expect(JSON.parse(String(result.result))).toEqual({ error: 'Execution no longer active' })
+      expect(secureFetchMock).not.toHaveBeenCalled()
+    }
+  )
+
   it('rejects oversized fetch options payloads before outbound call', async () => {
     const { executeInIsolatedVM, secureFetchMock } = await loadExecutionModule({
       envOverrides: {
diff --git a/apps/sim/lib/execution/isolated-vm.ts b/apps/sim/lib/execution/isolated-vm.ts
index 93bbf55fedb..d257c08c8fa 100644
--- a/apps/sim/lib/execution/isolated-vm.ts
+++ b/apps/sim/lib/execution/isolated-vm.ts
@@ -9,6 +9,7 @@ import { randomFloat } from '@sim/utils/random'
 import { env } from '@/lib/core/config/env'
 import { getConfiguredCacheProvider } from '@/lib/core/config/env-capabilities.server'
 import { getRedisClient } from '@/lib/core/config/redis'
+import { captureOutboundScope } from '@/lib/core/network/context.server'
 import {
   type SecureFetchOptions,
   secureFetchWithValidation,
@@ -160,6 +161,7 @@ const QUEUE_RETRY_DELAY_MS = 1000
 const DISTRIBUTED_LEASE_GRACE_MS = 30000
 
 interface PendingExecution {
+  runInOutboundScope: ReturnType<typeof captureOutboundScope>
   resolve: (result: IsolatedVMExecutionResult) => void
   timeout: ReturnType<typeof setTimeout>
   ownerKey: string
@@ -199,6 +201,7 @@ interface QueuedExecution {
  * against the queue-to-worker handoff.
  */
 interface ExecutionState {
+  runInOutboundScope: ReturnType<typeof captureOutboundScope>
   cancelled: boolean
   queueId?: number
   workerId?: number
@@ -730,7 +733,7 @@ function handleBrokerMessage(
   }
 
   Promise.resolve()
-    .then(() => handler(args))
+    .then(() => pending.runInOutboundScope(() => handler(args)))
     .then((resultValue) => {
       if (pending.cancelled) {
         sendResponse({ error: 'Execution cancelled' })
@@ -809,6 +812,18 @@ function handleWorkerMessage(workerId: number, message: unknown) {
   }
 
   if (msg.type === 'fetch') {
+    const pending =
+      typeof msg.executionId === 'number'
+        ? workerInfo?.pendingExecutions.get(msg.executionId)
+        : undefined
+    if (!pending || pending.cancelled) {
+      workerInfo?.process.send({
+        type: 'fetchResponse',
+        fetchId: msg.fetchId,
+        response: JSON.stringify({ error: 'Execution no longer active' }),
+      })
+      return
+    }
     const { fetchId, requestId, url, optionsJson } = msg as {
       fetchId: number
       requestId: string
@@ -847,7 +862,8 @@ function handleWorkerMessage(workerId: number, message: unknown) {
         return
       }
     }
-    secureFetch(requestId, url, options)
+    pending
+      .runInOutboundScope(() => secureFetch(requestId, url, options))
       .then((response) => {
         try {
           workerInfo?.process.send({ type: 'fetchResponse', fetchId, response })
@@ -1200,6 +1216,7 @@ function dispatchToWorker(
   }, req.timeoutMs + 1000)
 
   workerInfo.pendingExecutions.set(execId, {
+    runInOutboundScope: state.runInOutboundScope,
     resolve,
     timeout,
     ownerKey: ownerState.ownerKey,
@@ -1472,7 +1489,7 @@ export async function executeInIsolatedVM(
   // An undetermined lease cannot reject the execution: the per-process pool and
   // the per-owner active/queued limits above still bound this work.
 
-  const state: ExecutionState = { cancelled: false }
+  const state: ExecutionState = { cancelled: false, runInOutboundScope: captureOutboundScope() }
 
   return new Promise<IsolatedVMExecutionResult>((resolve) => {
     let abortListener: (() => void) | null = null
diff --git a/apps/sim/lib/knowledge/__integration__/gitlab-live.integration.ts b/apps/sim/lib/knowledge/__integration__/gitlab-live.integration.ts
index 0ffcd293d9f..e515978e548 100644
--- a/apps/sim/lib/knowledge/__integration__/gitlab-live.integration.ts
+++ b/apps/sim/lib/knowledge/__integration__/gitlab-live.integration.ts
@@ -829,8 +829,7 @@ describe.skipIf(!fixtureFile)('live self-hosted GitLab ingestion and permission
               input: {
                 documentId: ordinary.id,
                 assertedOrganizationId: ids.organizationId,
-                offset: 0,
-                limit: 10,
+                limit: 3,
                 resultSecretRegistry: new ResolvedSecretTraceRegistry(),
               },
             })
diff --git a/apps/sim/lib/knowledge/__integration__/search-latency.integration.ts b/apps/sim/lib/knowledge/__integration__/search-latency.integration.ts
index 5646bd707d1..df209d20d1b 100644
--- a/apps/sim/lib/knowledge/__integration__/search-latency.integration.ts
+++ b/apps/sim/lib/knowledge/__integration__/search-latency.integration.ts
@@ -6,6 +6,7 @@ import {
   credential,
   credentialGroup,
   document,
+  embedding,
   knowledgeBase,
   knowledgeConnector,
   member,
@@ -16,16 +17,34 @@ import {
 import { createLogger, Logger } from '@sim/logger'
 import { generateId } from '@sim/utils/id'
 import { and, eq, inArray, sql } from 'drizzle-orm'
+import { NextRequest } from 'next/server'
 import { afterAll, beforeAll, describe, expect, it, type MockInstance, vi } from 'vitest'
 import { z } from 'zod'
-import { searchWorkspaceServerTool } from '@/lib/copilot/tools/server/knowledge/workspace-search'
+import { workspaceKnowledgeSearchDataSchema } from '@/lib/api/contracts/knowledge/search'
+import { internalSessionAuth } from '@/lib/api/server/routes'
+import type {
+  MothershipStreamV1CheckpointPausePayload,
+  MothershipStreamV1ToolCallDescriptor,
+} from '@/lib/copilot/generated/mothership-stream-v1'
+import { isContractStreamEventEnvelope } from '@/lib/copilot/request/session/contract'
+import {
+  readDocumentServerTool,
+  searchWorkspaceServerTool,
+} from '@/lib/copilot/tools/server/knowledge/workspace-search'
 import { seedSearchReaderFixture } from '@/lib/knowledge/__integration__/seed-search-reader-fixture'
 import {
   createKnowledgeAclFixtureIds,
   seedKnowledgeAclFixture,
 } from '@/lib/knowledge/__integration__/seed-source-access-fixture'
 import { searchScopedKnowledge } from '@/lib/knowledge/application/workspace-search'
+import {
+  SearchBudget,
+  SearchDeadlineError,
+  type SearchExecutor,
+} from '@/lib/knowledge/search/budget'
+import type { SearchStage } from '@/lib/knowledge/search/diagnostics'
 import type { WorkspaceSearchFilters } from '@/lib/knowledge/search/filters'
+import { POST as searchRoute } from '@/app/api/knowledge/search/route'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
 /** Initialize controlled provider configuration before the real application modules load. */
@@ -39,6 +58,7 @@ vi.hoisted(() => {
   }
 })
 
+const externalFetch = globalThis.fetch
 const enabled = process.env.KNOWLEDGE_SEARCH_PERFORMANCE_TEST === 'true'
 const chunkCount = Number(process.env.KNOWLEDGE_SEARCH_PERFORMANCE_CHUNKS ?? 20_000)
 const dimensions = 1536
@@ -67,7 +87,11 @@ const reused = reuseFile ? readFixtureReport(reuseFile) : undefined
 const ids = reused?.fixture ?? createKnowledgeAclFixtureIds()
 const unrelated = reused?.unrelatedFixture ?? createKnowledgeAclFixtureIds()
 const organizationChatId = generateId()
-const queryVector = Array.from({ length: dimensions }, (_, index) => (index === 0 ? 1 : 0))
+const queryVector = Array.from({ length: dimensions }, (_, index) =>
+  Math.sin((index + 1) * 12.9898)
+)
+const queryMagnitude = Math.hypot(...queryVector)
+for (let index = 0; index < queryVector.length; index++) queryVector[index] /= queryMagnitude
 const captured: CapturedQuery[] = []
 const report: Record<string, unknown> = {
   fixture: ids,
@@ -117,6 +141,7 @@ const explainSchema = z.array(z.object({ Plan: explainNodeSchema }).passthrough(
 
 function usesVectorIndex(node: ExplainNode): boolean {
   return (
+    node['Index Name'] === 'embedding_binary_hnsw_idx' ||
     node['Index Name'] === 'embedding_vector_hnsw_idx' ||
     (node.Plans?.some(usesVectorIndex) ?? false)
   )
@@ -221,14 +246,21 @@ async function sample(label: string, run: () => ReturnType<typeof search>) {
     const plan = await db.$client.begin(async (tx) => {
       await tx.unsafe("SET LOCAL hnsw.iterative_scan = 'relaxed_order'")
       await tx.unsafe('SET LOCAL hnsw.max_scan_tuples = 20000')
+      if (query.query.includes('binary_quantize')) {
+        await tx.unsafe('SET LOCAL hnsw.max_scan_tuples = 100000')
+        await tx.unsafe('SET LOCAL hnsw.ef_search = 200')
+        await tx.unsafe('SET LOCAL hnsw.scan_mem_multiplier = 4')
+      }
       return tx.unsafe(`EXPLAIN (ANALYZE, BUFFERS, FORMAT JSON) ${query.query}`, query.parameters)
     })
     plans.push({
       kind: query.query.includes('keyword_rank')
         ? 'keyword'
-        : query.query.includes('order by')
+        : query.query.includes('binary_quantize')
           ? 'vector'
-          : 'probe',
+          : query.query.includes('order by')
+            ? 'rerank'
+            : 'probe',
       query: query.query,
       parameters: query.parameters,
       plan: explainSchema.parse(plan[0]['QUERY PLAN']),
@@ -362,8 +394,8 @@ describe.skipIf(!enabled)('Assistant search latency on a realistic indexed corpu
             CASE WHEN n % 8 = 0 THEN 'Orion deployment reference. ' ELSE 'Engineering operations reference. ' END ||
               (SELECT string_agg(md5(n::text || ':' || paragraph::text), ' ') FROM generate_series(1, 90) paragraph),
             3000, 750, 0, 3000,
-            l2_normalize(ARRAY(SELECT (CASE WHEN coordinate = n % 32 + 1 THEN 1 ELSE 0 END +
-              0.025 * sin(n::double precision * coordinate * 12.9898 + coordinate * 78.233))::real
+            l2_normalize(ARRAY(SELECT (sin(coordinate * (n % 32 + 1) * 12.9898) +
+              0.25 * sin(n::double precision * coordinate * 12.9898 + coordinate * 78.233))::real
               FROM generate_series(1, ${dimensions}) coordinate)::vector(1536))
           FROM generate_series(${first}::int, ${last}::int) n`)
           })
@@ -400,7 +432,191 @@ describe.skipIf(!enabled)('Assistant search latency on a realistic indexed corpu
     await db.$client.end()
   }, 120_000)
 
+  it('cancels slow SQL on the server and restores pooled connection settings', async () => {
+    const budget = new SearchBudget('keyword', performance.now() + 200)
+    const started = performance.now()
+    await expect(
+      budget.query('keyword.sql', (tx) => tx.execute(sql`SELECT pg_sleep(5)`))
+    ).rejects.toBeInstanceOf(SearchDeadlineError)
+    expect(performance.now() - started).toBeLessThan(2000)
+    const [active] = await db.execute<{ count: number }>(
+      sql`SELECT count(*)::int AS count FROM pg_stat_activity WHERE pid <> pg_backend_pid() AND state = 'active' AND query = 'SELECT pg_sleep(5)'`
+    )
+    expect(active.count).toBe(0)
+    const [settings] = await db.execute<{ timeout: string }>(
+      sql`SELECT current_setting('statement_timeout') AS timeout`
+    )
+    expect(settings.timeout).toBe('0')
+  })
+
+  it('expires waiting for a saturated pool without executing abandoned work', async () => {
+    let release!: () => void
+    const released = new Promise<void>((resolve) => {
+      release = resolve
+    })
+    let markSaturated!: () => void
+    const saturated = new Promise<void>((resolve) => {
+      markSaturated = resolve
+    })
+    let acquired = 0
+    const holders = Array.from({ length: db.$client.options.max }, () =>
+      db.transaction(async () => {
+        if (++acquired === db.$client.options.max) markSaturated()
+        await released
+      })
+    )
+    const run = vi.fn((tx: SearchExecutor) => tx.execute(sql`SELECT 1`))
+    const started = performance.now()
+    try {
+      await saturated
+      const budget = new SearchBudget('keyword', performance.now() + 200)
+      await expect(budget.query('keyword.sql', run)).rejects.toBeInstanceOf(SearchDeadlineError)
+      expect(performance.now() - started).toBeLessThan(2000)
+    } finally {
+      release()
+      await Promise.all(holders)
+    }
+    await db.execute(sql`SELECT 1`)
+    expect(run).not.toHaveBeenCalled()
+  })
+
+  it.each(['vector', 'keyword', 'both'] as const)(
+    'keeps the Assistant budget when %s SQL branches are delayed',
+    async (delayedLegs) => {
+      diagnosticLog?.mockClear()
+      let vectorDelayed = false
+      const query = SearchBudget.prototype.query
+      const delayed = vi.spyOn(SearchBudget.prototype, 'query').mockImplementation(function <T>(
+        this: SearchBudget,
+        stage: SearchStage,
+        run: (executor: SearchExecutor) => PromiseLike<T>
+      ): Promise<T> {
+        return query.call(this, stage, async (tx) => {
+          if (delayedLegs === 'vector' && this.leg === 'vector' && !vectorDelayed) {
+            vectorDelayed = true
+            await tx.execute(sql`SELECT pg_sleep(4)`)
+          } else if (
+            delayedLegs === 'both' ||
+            (delayedLegs === 'keyword' && this.leg === 'keyword')
+          )
+            await tx.execute(sql`SELECT pg_sleep(9)`)
+          return run(tx)
+        }) as Promise<T>
+      })
+      try {
+        const result = await searchWorkspaceServerTool.execute(
+          { query: 'Orion deployment', topK: 15 },
+          {
+            userId: ids.aliceId,
+            workspaceId: ids.workspaceId,
+            toolCallId: generateId(),
+            copilotToolExecution: true,
+            resolvedSecretTraceRegistry: new ResolvedSecretTraceRegistry([], {
+              userId: ids.aliceId,
+              workspaceId: ids.workspaceId,
+            }),
+          }
+        )
+        const completed = diagnosticLog?.mock.calls.find(
+          ([message]) => message === 'Knowledge search completed'
+        )
+        expect(diagnosticSchema.parse(completed?.[1]).vectorBudgetMs).toBe(8000)
+        if (delayedLegs === 'both') {
+          expect(result).toMatchObject({
+            success: true,
+            data: {
+              retrieval: { status: 'partial', timedOutLegs: ['vector', 'keyword'] },
+              results: [],
+            },
+          })
+          return
+        }
+        expect(result).toMatchObject({
+          success: true,
+          data: {
+            retrieval:
+              delayedLegs === 'vector'
+                ? { status: 'complete', timedOutLegs: [] }
+                : { status: 'partial', timedOutLegs: ['keyword'] },
+          },
+        })
+        const parsed = resultSchema.parse(result)
+        expect(parsed.data.results.length).toBeGreaterThan(0)
+        expect(
+          parsed.data.results.every((row) => row.knowledgeBaseId === ids.knowledgeBaseId)
+        ).toBe(true)
+        report[`assistant.deadline.${delayedLegs}`] = { resultCount: parsed.data.results.length }
+      } finally {
+        delayed.mockRestore()
+      }
+    },
+    30_000
+  )
+
+  it.each(['vector', 'both'] as const)(
+    'returns incomplete dashboard coverage when %s SQL branches exceed their deadline',
+    async (delayedLegs) => {
+      diagnosticLog?.mockClear()
+      const authenticate = vi.spyOn(internalSessionAuth, 'authenticate').mockResolvedValue({
+        kind: 'session',
+        userId: ids.aliceId,
+        sessionId: 'fixture-dashboard',
+      })
+      const query = SearchBudget.prototype.query
+      const delayed = vi.spyOn(SearchBudget.prototype, 'query').mockImplementation(function <T>(
+        this: SearchBudget,
+        stage: SearchStage,
+        run: (executor: SearchExecutor) => PromiseLike<T>
+      ): Promise<T> {
+        return query.call(this, stage, async (tx) => {
+          if (delayedLegs === 'both' || this.leg === 'vector')
+            await tx.execute(sql`SELECT pg_sleep(${delayedLegs === 'both' ? 9 : 4})`)
+          return run(tx)
+        }) as Promise<T>
+      })
+      try {
+        const response = await searchRoute(
+          new NextRequest('http://localhost/api/knowledge/search', {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({
+              workspaceId: ids.workspaceId,
+              query: 'Orion deployment',
+              topK: 15,
+            }),
+          })
+        )
+        expect(response.status).toBe(200)
+        const completed = diagnosticLog?.mock.calls.find(
+          ([message]) => message === 'Knowledge search completed'
+        )
+        const diagnostics = diagnosticSchema.parse(completed?.[1])
+        expect(diagnostics.vectorBudgetMs).toBe(3000)
+        expect(diagnostics.stages.vector.totalMs).toBeGreaterThan(2500)
+        expect(diagnostics.stages.vector.totalMs).toBeLessThan(4000)
+        const data = workspaceKnowledgeSearchDataSchema.parse((await response.json()).data)
+        expect(data.retrieval).toEqual({
+          status: 'partial',
+          timedOutLegs: delayedLegs === 'both' ? ['vector', 'keyword'] : ['vector'],
+        })
+        if (delayedLegs === 'both') expect(data.results).toEqual([])
+        else {
+          expect(data.results.length).toBeGreaterThan(0)
+          expect(
+            data.results.every((result) => result.knowledgeBaseId === ids.knowledgeBaseId)
+          ).toBe(true)
+        }
+        report[`dashboard.deadline.${delayedLegs}`] = { resultCount: data.results.length }
+      } finally {
+        delayed.mockRestore()
+        authenticate.mockRestore()
+      }
+    },
+    30_000
+  )
+
   it('records first and repeated application searches with the actual SQL plans', async () => {
+    const before = embeddingCalls
     for (let iteration = 0; iteration < 2; iteration++) {
       const { result, plans } = await sample(`broad.${iteration}`, () => search())
       expect(result.data.results).toHaveLength(15)
@@ -411,8 +627,20 @@ describe.skipIf(!enabled)('Assistant search latency on a realistic indexed corpu
       const vectorPlans = plans.filter((plan) => plan.kind === 'vector')
       expect(vectorPlans).toHaveLength(1)
       expect(usesVectorIndex(vectorPlans[0].plan[0].Plan)).toBe(true)
+      expect(plans.some((plan) => plan.kind === 'rerank')).toBe(true)
+      const rerank = plans.find((plan) => plan.kind === 'rerank')!
+      const actual = await db.$client.unsafe(rerank.query, rerank.parameters).values()
+      const expected = await db.execute<{ id: string }>(sql`SELECT id FROM embedding
+        WHERE knowledge_base_id = ${ids.knowledgeBaseId} AND enabled
+        ORDER BY (embedding <=> ${JSON.stringify(queryVector)}::vector) + 0, id
+        LIMIT ${actual.length}`)
+      const expectedIds = new Set(expected.map(({ id }) => id))
+      const recall = actual.filter(([id]) => expectedIds.has(id)).length / expected.length
+      expect(recall).toBeGreaterThanOrEqual(0.95)
+      report[`recall.${iteration}`] = { neighbors: expected.length, recall }
+      saveReport()
     }
-    expect(embeddingCalls).toBe(2)
+    expect(embeddingCalls - before).toBe(2)
   }, 180_000)
 
   it('compares the Search tab and Assistant with the same person, query and index', async () => {
@@ -463,7 +691,7 @@ describe.skipIf(!enabled)('Assistant search latency on a realistic indexed corpu
       expect(probe).toHaveLength(1)
       expect(probe[0].query).not.toContain('<=>')
       expect(probe[0].plan[0].Plan['Actual Rows']).toBe(12)
-      const vector = plans.filter((plan) => plan.kind === 'vector')
+      const vector = plans.filter((plan) => plan.kind === 'rerank')
       expect(vector).toHaveLength(1)
       expect(vector[0].query).toContain('"embedding"."id" in')
     } finally {
@@ -555,4 +783,196 @@ describe.skipIf(!enabled)('Assistant search latency on a realistic indexed corpu
       true
     )
   }, 180_000)
+  /** Opt in with local Sim and Go URLs; uses the real configured provider, billing adapter, and async resume protocol. */
+  it.skipIf(!process.env.KNOWLEDGE_SEARCH_ASSISTANT_URL)(
+    'recovers quietly from incomplete search through local Go Assistant, then reads and cites evidence',
+    async () => {
+      const assistantUrl = new URL(process.env.KNOWLEDGE_SEARCH_ASSISTANT_URL!)
+      const simUrl = new URL(process.env.KNOWLEDGE_SEARCH_SIM_URL!)
+      for (const url of [assistantUrl, simUrl]) {
+        if (!['127.0.0.1', 'localhost'].includes(url.hostname))
+          throw new Error(
+            'Assistant integration requires local servers using the disposable test databases'
+          )
+      }
+      const apiKey = process.env.KNOWLEDGE_SEARCH_ASSISTANT_API_KEY!
+      const internalKey = process.env.KNOWLEDGE_SEARCH_SIM_INTERNAL_KEY!
+      expect(apiKey).toBeTruthy()
+      expect(internalKey).toBeTruthy()
+      const chunkId = `${ids.workspaceId}-chunk-0`
+      const [original] = await db
+        .select({
+          content: embedding.content,
+          contentLength: embedding.contentLength,
+          tokenCount: embedding.tokenCount,
+        })
+        .from(embedding)
+        .where(eq(embedding.id, chunkId))
+        .limit(1)
+      const longContent =
+        'Orion deployment guide. The activation phrase and final checksum appear at the end.\n' +
+        'Review the deployment stages in order. Preserve the rollback procedure.\n'.repeat(320) +
+        '\nActivation phrase: SILVER COMET\nFinal checksum: K7M2-84\n'
+      const registry = new ResolvedSecretTraceRegistry([], { userId: ids.aliceId })
+      const calls: Array<{
+        name: string
+        arguments: unknown
+        milliseconds: number
+        bytes: number
+      }> = []
+      let answer = ''
+      let incompleteSearch = true
+      const query = SearchBudget.prototype.query
+      const delayed = vi.spyOn(SearchBudget.prototype, 'query').mockImplementation(function <T>(
+        this: SearchBudget,
+        stage: SearchStage,
+        run: (executor: SearchExecutor) => PromiseLike<T>
+      ): Promise<T> {
+        return query.call(this, stage, async (tx) => {
+          if (incompleteSearch) await tx.execute(sql`SELECT pg_sleep(9)`)
+          return run(tx)
+        }) as Promise<T>
+      })
+      const started = performance.now()
+      try {
+        await db
+          .update(embedding)
+          .set({
+            content: longContent,
+            contentLength: longContent.length,
+            tokenCount: Math.ceil(longContent.length / 4),
+          })
+          .where(eq(embedding.id, chunkId))
+        const admission = await externalFetch(new URL('/api/copilot/api-keys/validate', simUrl), {
+          method: 'POST',
+          headers: {
+            'content-type': 'application/json',
+            'x-api-key': internalKey,
+            'x-sim-billing-protocol': 'legacy-v0',
+          },
+          body: JSON.stringify({
+            userId: ids.aliceId,
+            organizationId: ids.organizationId,
+            chatId: organizationChatId,
+          }),
+        })
+        expect(admission.status, await admission.text()).toBe(200)
+        let path = '/api/mothership'
+        let body: Record<string, unknown> = {
+          message:
+            'Search for the Orion deployment guide that mentions an activation phrase and final checksum. Read enough of that document to report both values and cite it.',
+          version: '3.0.0',
+          mode: 'assistant',
+          userId: ids.aliceId,
+          organizationId: ids.organizationId,
+          chatId: organizationChatId,
+        }
+        for (let round = 0; round < 8; round++) {
+          const response = await externalFetch(new URL(path, assistantUrl), {
+            method: 'POST',
+            headers: {
+              'content-type': 'application/json',
+              'x-api-key': apiKey,
+              'x-sim-billing-protocol': 'legacy-v0',
+            },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(120000),
+          })
+          const wire = await response.text()
+          expect(response.status, wire.slice(0, 2000)).toBe(200)
+          expect(Buffer.byteLength(wire)).toBeLessThan(2 * 1024 * 1024)
+          const pending = new Map<string, MothershipStreamV1ToolCallDescriptor>()
+          let checkpoint: MothershipStreamV1CheckpointPausePayload | undefined
+          let streamId = ''
+          for (const line of wire.split('\n')) {
+            if (!line.startsWith('data:')) continue
+            const raw = line.slice(5).trim()
+            if (!raw || raw === '[DONE]') continue
+            const event: unknown = JSON.parse(raw)
+            if (!isContractStreamEventEnvelope(event))
+              throw new Error('Assistant returned an invalid generated stream envelope')
+            streamId = event.stream.streamId
+            if (event.type === 'error') throw new Error(JSON.stringify(event.payload))
+            if (event.type === 'text') answer += event.payload.text
+            if (
+              event.type === 'tool' &&
+              event.payload.phase === 'call' &&
+              !event.payload.partial &&
+              event.payload.arguments
+            )
+              pending.set(event.payload.toolCallId, event.payload)
+            if (event.type === 'run' && event.payload.kind === 'checkpoint_pause')
+              checkpoint = event.payload
+          }
+          if (!checkpoint) break
+          const results = await Promise.all(
+            checkpoint.pendingToolCallIds.map(async (callId) => {
+              const call = pending.get(callId)
+              if (!call) throw new Error('Checkpoint referenced an absent tool call')
+              const tool =
+                call.toolName === 'search_workspace'
+                  ? searchWorkspaceServerTool
+                  : call.toolName === 'read_document'
+                    ? readDocumentServerTool
+                    : undefined
+              if (!tool) throw new Error(`Unexpected Assistant tool: ${call.toolName}`)
+              const toolStarted = performance.now()
+              const result = await tool.execute(call.arguments, {
+                userId: ids.aliceId,
+                organizationId: ids.organizationId,
+                chatId: organizationChatId,
+                toolCallId: callId,
+                copilotToolExecution: true,
+                requestMode: 'assistant',
+                resolvedSecretTraceRegistry: registry,
+              })
+              calls.push({
+                name: call.toolName,
+                arguments: call.arguments,
+                milliseconds: performance.now() - toolStarted,
+                bytes: Buffer.byteLength(JSON.stringify(result)),
+              })
+              const { success } = z.object({ success: z.boolean() }).parse(result)
+              expect(success).toBe(true)
+              if (incompleteSearch) {
+                expect(call.toolName).toBe('search_workspace')
+                expect(result).toMatchObject({
+                  data: {
+                    retrieval: { status: 'partial', timedOutLegs: ['vector', 'keyword'] },
+                    results: [],
+                  },
+                })
+              }
+              return { callId, name: call.toolName, success, data: result }
+            })
+          )
+          incompleteSearch = false
+          path = '/api/tools/resume'
+          body = {
+            checkpointId: checkpoint.checkpointId,
+            streamId,
+            userId: ids.aliceId,
+            organizationId: ids.organizationId,
+            chatId: organizationChatId,
+            results,
+          }
+          report['assistant.live.progress'] = { rounds: round + 1, calls }
+          saveReport()
+        }
+        report['assistant.live'] = { milliseconds: performance.now() - started, calls, answer }
+        saveReport()
+        expect(answer).toContain('SILVER COMET')
+        expect(answer).toContain('K7M2-84')
+        expect(answer).toContain('<source>')
+        expect(answer).not.toMatch(/timed?\s*out|timeout|internal retr(?:y|ies)/i)
+        expect(calls.some((call) => call.name === 'read_document')).toBe(true)
+        expect(calls.filter((call) => call.name === 'search_workspace').length).toBeGreaterThan(1)
+        expect(calls.every((call) => call.bytes < 40000)).toBe(true)
+      } finally {
+        delayed.mockRestore()
+        await db.update(embedding).set(original).where(eq(embedding.id, chunkId))
+      }
+    },
+    10 * 60_000
+  )
 })
diff --git a/apps/sim/lib/knowledge/application/authorized-knowledge-use-case.ts b/apps/sim/lib/knowledge/application/authorized-knowledge-use-case.ts
index e2b2cba69f3..125907a75e5 100644
--- a/apps/sim/lib/knowledge/application/authorized-knowledge-use-case.ts
+++ b/apps/sim/lib/knowledge/application/authorized-knowledge-use-case.ts
@@ -8,6 +8,7 @@ import {
   type WorkspaceUseCaseAuditEntry,
 } from '@/lib/core/application'
 import { authorizeOrganizationOperation } from '@/lib/core/application/organization-authorization'
+import { runWithOutboundOrganization } from '@/lib/core/network/context.server'
 import {
   OrchestrationError,
   type OrchestrationRequestContext,
@@ -230,11 +231,13 @@ export function defineAuthorizedKnowledgeUseCase<
         context: resolved.context,
         request,
       }
-      const result = await definition.execute(executionContext)
-      const resultContext = { ...executionContext, result }
-      recordOrganizationAudit(resultContext, resolved.context.organizationId)
-      await definition.afterSuccess?.(resultContext)
-      return result
+      return runWithOutboundOrganization(resolved.context.organizationId, async () => {
+        const result = await definition.execute(executionContext)
+        const resultContext = { ...executionContext, result }
+        recordOrganizationAudit(resultContext, resolved.context.organizationId)
+        await definition.afterSuccess?.(resultContext)
+        return result
+      })
     },
   }
 }
diff --git a/apps/sim/lib/knowledge/application/read-search-document.test.ts b/apps/sim/lib/knowledge/application/read-search-document.test.ts
index ddd93ad5b0a..ad3b3831013 100644
--- a/apps/sim/lib/knowledge/application/read-search-document.test.ts
+++ b/apps/sim/lib/knowledge/application/read-search-document.test.ts
@@ -56,8 +56,7 @@ const context = {
 const input = {
   documentId: 'doc',
   assertedWorkspaceId: 'workspace',
-  offset: 0,
-  limit: 20,
+  limit: 3,
   filters: { source: 'slack', documentIds: ['doc'] },
   resultSecretRegistry: new ResolvedSecretTraceRegistry([], {
     userId: 'reader',
@@ -89,7 +88,7 @@ describe('Assistant document read', () => {
     await expect(readSearchDocument.execute({ principal, input })).resolves.toMatchObject({
       documentId: 'doc',
       chunks: [{ content: 'body', chunkIndex: 0 }],
-      nextOffset: null,
+      next: null,
     })
     expect(mocks.context).toHaveBeenCalledWith({ ...input, knowledgeBaseId: 'index' }, principal)
     expect(mocks.chunks).toHaveBeenCalledWith(
@@ -97,8 +96,7 @@ describe('Assistant document read', () => {
       expect.objectContaining({
         documentFilters: input.filters,
         enabled: 'true',
-        offset: 0,
-        limit: 20,
+        limit: 3,
       }),
       expect.any(String),
       access
@@ -194,3 +192,92 @@ describe('organization Search document reads', () => {
     expect(mocks.chunks).not.toHaveBeenCalled()
   })
 })
+
+describe('precise bounded passage expansion', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.permission.mockResolvedValue('read')
+    mocks.context.mockResolvedValue(context)
+    mocks.provenance.mockResolvedValue({ imported: true, documentMetadata: {} })
+  })
+
+  it('projects a secret spanning the page boundary before slicing it', async () => {
+    const secret = 'private-token-that-crosses-the-boundary'
+    const registry = new ResolvedSecretTraceRegistry([
+      { name: 'TOKEN', plaintext: secret, encryptedValue: 'ciphertext' },
+    ])
+    mocks.provenance.mockImplementationOnce(async () => {
+      registry.recordResolved('TOKEN', secret)
+      return { imported: true, documentMetadata: {} }
+    })
+    mocks.chunks.mockResolvedValue({
+      chunks: [{ id: 'secret-chunk', chunkIndex: 0, content: `${'x'.repeat(7990) + secret}tail` }],
+      pagination: { total: 1, hasMore: false },
+    })
+    const result = await readSearchDocument.execute({
+      principal,
+      input: { ...input, resultSecretRegistry: registry },
+    })
+    expect(result.chunks[0].content).toContain('{{TOKEN}}')
+    expect(JSON.stringify(result)).not.toContain('private-token')
+  })
+
+  it('continues a long chunk before advancing across disabled chunk gaps', async () => {
+    const content = 'Evidence 🔎\n'.repeat(1100)
+    mocks.chunks.mockResolvedValue({
+      chunks: [
+        { id: 'c7', chunkIndex: 7, content },
+        { id: 'c11', chunkIndex: 11, content: 'next enabled passage' },
+      ],
+      pagination: { total: 2, hasMore: false },
+    })
+    const first = await readSearchDocument.execute({
+      principal,
+      input: { ...input, startChunkIndex: 7 },
+    })
+    expect(first.chunks).toHaveLength(1)
+    expect(first.chunks[0].content.length).toBeLessThanOrEqual(8000)
+    expect(first.next).toEqual({ startChunkIndex: 7, startOffset: first.chunks[0].endOffset })
+    const second = await readSearchDocument.execute({
+      principal,
+      input: { ...input, ...first.next! },
+    })
+    expect(first.chunks[0].content + second.chunks[0].content).toBe(content)
+    expect(second.chunks[1].chunkIndex).toBe(11)
+    expect(second.next).toBeNull()
+    expect(mocks.chunks).toHaveBeenCalledWith(
+      'doc',
+      expect.objectContaining({ startChunkIndex: 7, requireEnabledDocument: true }),
+      expect.any(String),
+      access
+    )
+  })
+
+  it('rejects a continuation when all remaining chunks have disappeared', async () => {
+    mocks.chunks.mockResolvedValue({
+      chunks: [],
+      pagination: { total: 2, hasMore: false },
+    })
+    await expect(
+      readSearchDocument.execute({ principal, input: { ...input, startChunkIndex: 7 } })
+    ).rejects.toThrow('no longer available')
+    expect(mocks.provenance).not.toHaveBeenCalled()
+  })
+
+  it('rejects positions without an anchor and stale within-chunk continuation', async () => {
+    await expect(
+      readSearchDocument.execute({ principal, input: { ...input, startOffset: 2 } })
+    ).rejects.toThrow('startOffset requires startChunkIndex')
+    expect(mocks.chunks).not.toHaveBeenCalled()
+    mocks.chunks.mockResolvedValue({
+      chunks: [{ id: 'c8', chunkIndex: 8, content: 'replacement' }],
+      pagination: { total: 1, hasMore: false },
+    })
+    await expect(
+      readSearchDocument.execute({
+        principal,
+        input: { ...input, startChunkIndex: 7, startOffset: 100 },
+      })
+    ).rejects.toThrow('no longer available')
+  })
+})
diff --git a/apps/sim/lib/knowledge/application/read-search-document.ts b/apps/sim/lib/knowledge/application/read-search-document.ts
index ac48bcdbbe3..dbc52ccc0b5 100644
--- a/apps/sim/lib/knowledge/application/read-search-document.ts
+++ b/apps/sim/lib/knowledge/application/read-search-document.ts
@@ -8,9 +8,12 @@ import { KnowledgeDocumentNotReadyError } from '@/lib/knowledge/application/chun
 import { resolveCanonicalActiveKnowledgeDocumentContext } from '@/lib/knowledge/application/contexts'
 import { knowledgeOperations } from '@/lib/knowledge/application/operations'
 import { queryChunks } from '@/lib/knowledge/chunks/service'
+import { measureSearchStage } from '@/lib/knowledge/search/diagnostics'
 import type { WorkspaceSearchFilters } from '@/lib/knowledge/search/filters'
 import { findSearchIndex } from '@/lib/knowledge/search/search-index'
+import { passageWindow } from '@/lib/knowledge/search/snippet'
 import { importKnowledgeSearchResultSecretProvenance } from '@/lib/knowledge/secret-provenance'
+import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
 import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
 export interface ReadSearchDocumentInput {
@@ -18,12 +21,19 @@ export interface ReadSearchDocumentInput {
   assertedWorkspaceId?: string
   assertedOrganizationId?: string
   filters?: WorkspaceSearchFilters
-  offset: number
   limit: number
+  startChunkIndex?: number
+  startOffset?: number
   resultSecretRegistry: ResolvedSecretTraceRegistry
   signal?: AbortSignal
 }
 
+/** Bounds model text to at most 24KB of UTF-8, with continuation even inside a large chunk. */
+const READ_PAGE_CHARACTERS = 8000
+const READ_PAGE_CHUNKS = 8
+const STALE_POSITION_MESSAGE =
+  'The passage position is no longer available; search again or read from the chunk start'
+
 /** Reads enabled indexed passages with the same document scope and ACLs as search. */
 export const readSearchDocument = defineAuthorizedKnowledgeUseCase({
   operation: knowledgeOperations.readDocument,
@@ -50,16 +60,22 @@ export const readSearchDocument = defineAuthorizedKnowledgeUseCase({
   async execute({ input, context }): Promise<ReadSearchDocumentResult> {
     input.signal?.throwIfAborted()
     if (
-      !Number.isInteger(input.offset) ||
-      input.offset < 0 ||
-      input.offset > 5000 ||
       !Number.isInteger(input.limit) ||
       input.limit < 1 ||
-      input.limit > 50
+      input.limit > READ_PAGE_CHUNKS ||
+      (input.startChunkIndex !== undefined &&
+        (!Number.isSafeInteger(input.startChunkIndex) ||
+          input.startChunkIndex < 0 ||
+          input.startChunkIndex > 2147483647)) ||
+      (input.startOffset !== undefined &&
+        (!Number.isSafeInteger(input.startOffset) ||
+          input.startOffset < 0 ||
+          input.startOffset > 2147483647 ||
+          input.startChunkIndex === undefined))
     ) {
       throw new OrchestrationError(
         'validation',
-        'Document reads require offset 0–5000 and limit 1–50'
+        'Document reads require limit 1–8 and nonnegative chunk positions; startOffset requires startChunkIndex'
       )
     }
     if (context.document.processingStatus !== 'completed') {
@@ -68,24 +84,33 @@ export const readSearchDocument = defineAuthorizedKnowledgeUseCase({
     if (!context.knowledgeBase.isSearchIndex)
       throw new OrchestrationError('not_found', 'Document not found')
     if (!context.document.enabled) throw new OrchestrationError('not_found', 'Document not found')
-    const page = await queryChunks(
-      context.documentId,
-      {
-        offset: input.offset,
-        limit: input.limit,
-        enabled: 'true',
-        sortBy: 'chunkIndex',
-        sortOrder: 'asc',
-        documentFilters: input.filters,
-      },
-      generateRequestId(),
-      await context.access.get()
+    const access = await measureSearchStage('access_scope', () => context.access.get())
+    const page = await measureSearchStage('document_read.sql', () =>
+      queryChunks(
+        context.documentId,
+        {
+          limit: input.limit,
+          startChunkIndex: input.startChunkIndex,
+          requireEnabledDocument: true,
+          enabled: 'true',
+          sortBy: 'chunkIndex',
+          sortOrder: 'asc',
+          documentFilters: input.filters,
+        },
+        generateRequestId(),
+        access
+      )
     )
     if (page.pagination.total === 0) throw new OrchestrationError('not_found', 'Document not found')
-    const provenance = await importKnowledgeSearchResultSecretProvenance({
-      registry: input.resultSecretRegistry,
-      results: page.chunks.map((chunk) => ({ ...chunk, documentId: context.documentId })),
-    })
+    if (input.startChunkIndex !== undefined && page.chunks.length === 0) {
+      throw new OrchestrationError('validation', STALE_POSITION_MESSAGE)
+    }
+    const provenance = await measureSearchStage('result_provenance', () =>
+      importKnowledgeSearchResultSecretProvenance({
+        registry: input.resultSecretRegistry,
+        results: page.chunks.map((chunk) => ({ ...chunk, documentId: context.documentId })),
+      })
+    )
     if (!provenance.imported) throw new Error('Knowledge result provenance is unavailable')
     const metadata = provenance.documentMetadata[context.documentId]
     if (
@@ -99,15 +124,50 @@ export const readSearchDocument = defineAuthorizedKnowledgeUseCase({
     ) {
       throw new Error('Knowledge document provenance is unavailable')
     }
+    /** Project complete strings before slicing, so a window cannot expose part of a secret. */
+    const projectedChunks = page.chunks.map((chunk) => {
+      const projected = projectResolvedSecretModelContent(chunk.content, input.resultSecretRegistry)
+      if (!projected.safe || typeof projected.value !== 'string')
+        throw new Error('Knowledge result provenance is unavailable')
+      return { ...chunk, content: projected.value }
+    })
+    if (
+      input.startOffset &&
+      (projectedChunks[0]?.chunkIndex !== input.startChunkIndex ||
+        input.startOffset >= projectedChunks[0].content.length)
+    ) {
+      throw new OrchestrationError('validation', STALE_POSITION_MESSAGE)
+    }
+    let remaining = READ_PAGE_CHARACTERS
+    const chunks: ReadSearchDocumentResult['chunks'] = []
+    let next: ReadSearchDocumentResult['next'] = null
+    for (const chunk of projectedChunks) {
+      if (remaining < 2) {
+        next = { startChunkIndex: chunk.chunkIndex, startOffset: 0 }
+        break
+      }
+      const start = chunk.chunkIndex === input.startChunkIndex ? (input.startOffset ?? 0) : 0
+      const excerpt = passageWindow(chunk.content, start, remaining)
+      chunks.push({ chunkIndex: chunk.chunkIndex, ...excerpt })
+      remaining -= excerpt.content.length
+      if (excerpt.endOffset < chunk.content.length) {
+        next = { startChunkIndex: chunk.chunkIndex, startOffset: excerpt.endOffset }
+        break
+      }
+    }
+    const last = chunks.at(-1)
+    if (!next && page.pagination.hasMore && last) {
+      next = { startChunkIndex: last.chunkIndex + 1, startOffset: 0 }
+    }
     input.signal?.throwIfAborted()
     return {
       documentId: context.documentId,
       knowledgeBaseId: context.knowledgeBaseId,
       documentName: metadata?.filename ?? null,
       sourceUrl: metadata?.sourceUrl ?? null,
-      chunks: page.chunks.map(({ content, chunkIndex }) => ({ content, chunkIndex })),
-      hasMore: page.pagination.hasMore,
-      nextOffset: page.pagination.hasMore ? input.offset + page.chunks.length : null,
+      chunks,
+      hasMore: next !== null,
+      next,
     }
   },
 })
diff --git a/apps/sim/lib/knowledge/application/search.test.ts b/apps/sim/lib/knowledge/application/search.test.ts
index 49aa6d88584..e42e26018c4 100644
--- a/apps/sim/lib/knowledge/application/search.test.ts
+++ b/apps/sim/lib/knowledge/application/search.test.ts
@@ -19,6 +19,7 @@ const mocks = vi.hoisted(() => ({
   checkActorUsage: vi.fn(),
   generateEmbedding: vi.fn(),
   executeSearch: vi.fn(),
+  retrieval: vi.fn(),
   getDocumentMetadata: vi.fn(),
   getTagDefinitions: vi.fn(),
   getTagDefinitionsBatch: vi.fn(),
@@ -89,7 +90,10 @@ vi.mock('@/lib/knowledge/embeddings', () => ({
 
 vi.mock('@/lib/knowledge/search/queries', () => ({
   generateSearchEmbedding: mocks.generateEmbedding,
-  executeKnowledgeSearch: mocks.executeSearch,
+  retrieveKnowledgeSearch: async (...args: unknown[]) => ({
+    rows: await mocks.executeSearch(...args),
+    retrieval: mocks.retrieval(),
+  }),
   getDocumentMetadataByIds: mocks.getDocumentMetadata,
 }))
 
@@ -126,6 +130,7 @@ const knowledgeBase = {
 
 describe('knowledge search application use case', () => {
   beforeEach(() => {
+    mocks.retrieval.mockReturnValue({ status: 'complete', timedOutLegs: [] })
     vi.clearAllMocks()
     mocks.rerank.mockReset()
     resetDbChainMock()
@@ -201,6 +206,53 @@ describe('knowledge search application use case', () => {
     expect(result.totalResults).toBe(0)
   })
 
+  it.each([false, true])(
+    'requires explicit partial-result support for empty incomplete searches (allowPartialResults=%s)',
+    async (allowPartialResults) => {
+      mocks.retrieval.mockReturnValue({ status: 'partial', timedOutLegs: ['vector', 'keyword'] })
+      mocks.executeSearch.mockResolvedValue([])
+      const result = searchKnowledge.execute({
+        principal: { kind: 'session', userId: 'user-1', sessionId: 'session-1' },
+        input: {
+          workspaceId: 'workspace-1',
+          knowledgeBaseIds: ['knowledge-1'],
+          query: 'canaries',
+          topK: 20,
+          allowPartialResults,
+        },
+      })
+
+      if (!allowPartialResults) {
+        await expect(result).rejects.toThrow('retrieval deadline')
+        return
+      }
+      await expect(result).resolves.toMatchObject({
+        results: [],
+        totalResults: 0,
+        retrieval: { status: 'partial', timedOutLegs: ['vector', 'keyword'] },
+      })
+    }
+  )
+
+  it.each([
+    { surface: 'dashboard' as const, vectorBudgetMs: 3000 },
+    { surface: 'copilot' as const, vectorBudgetMs: undefined },
+    { surface: 'workflow' as const, vectorBudgetMs: undefined },
+  ])('forwards only the configured vector budget for $surface', async (options) => {
+    await searchKnowledge.execute({
+      principal: { kind: 'session', userId: 'user-1', sessionId: 'session-1' },
+      input: {
+        knowledgeBaseIds: ['knowledge-1'],
+        query: 'release',
+        topK: 10,
+        ...options,
+      },
+    })
+    expect(mocks.executeSearch).toHaveBeenCalledWith(
+      expect.objectContaining({ vectorBudgetMs: options.vectorBudgetMs })
+    )
+  })
+
   describe.each(['workspace', 'organization'] as const)('%s ranking policy', (scope) => {
     beforeEach(() => {
       if (scope === 'organization') {
diff --git a/apps/sim/lib/knowledge/application/search.ts b/apps/sim/lib/knowledge/application/search.ts
index 1bcd42670b8..1f8871529cb 100644
--- a/apps/sim/lib/knowledge/application/search.ts
+++ b/apps/sim/lib/knowledge/application/search.ts
@@ -41,12 +41,14 @@ import { runWithKnowledgeModelInputProvenance } from '@/lib/knowledge/model-inpu
 import { rerank } from '@/lib/knowledge/reranker'
 import type { RerankerStatus } from '@/lib/knowledge/reranker-models'
 import { recordOrganizationSearchActivity } from '@/lib/knowledge/search/activity'
+import { SearchDeadlineError } from '@/lib/knowledge/search/budget'
 import { resolveKnowledgeSearchDefaults } from '@/lib/knowledge/search/defaults'
 import { annotateSearchDiagnostics, measureSearchStage } from '@/lib/knowledge/search/diagnostics'
 import type { WorkspaceSearchFilters } from '@/lib/knowledge/search/filters'
 import {
-  executeKnowledgeSearch,
   getDocumentMetadataByIds,
+  type RetrievalStatus,
+  retrieveKnowledgeSearch,
   type SearchResult,
 } from '@/lib/knowledge/search/queries'
 import { importKnowledgeSearchResultSecretProvenance } from '@/lib/knowledge/secret-provenance'
@@ -88,6 +90,10 @@ export class KnowledgeSearchProvenanceUnavailableError extends Error {
 export type KnowledgeSearchTagFilter = KnowledgeTagNameFilter
 
 export interface SearchKnowledgeInput {
+  /** Allows returning available results when a retrieval leg times out. */
+  allowPartialResults?: boolean
+  /** Trusted adapter's vector retrieval budget; omitted callers use the shared default. */
+  vectorBudgetMs?: number
   /** Optional assertion from a trusted adapter or public contract. */
   workspaceId?: string
   organizationId?: string
@@ -154,6 +160,7 @@ interface KnowledgeSearchCost {
 }
 
 export interface SearchKnowledgeResult {
+  retrieval: RetrievalStatus
   results: KnowledgeSearchItem[]
   query: string
   knowledgeBaseIds: string[]
@@ -397,8 +404,9 @@ const searchKnowledgeUseCase = defineAuthorizedKnowledgeUseCase({
           )
         : Math.min(KNOWLEDGE_SEARCH_COST_POLICY.maxTopK, input.topK * 4)
       : input.topK
-    let rows = await measureSearchStage('retrieval', () =>
-      executeKnowledgeSearch({
+    const retrieved = await measureSearchStage('retrieval', () =>
+      retrieveKnowledgeSearch({
+        vectorBudgetMs: input.vectorBudgetMs,
         knowledgeBaseIds,
         topK: candidateTopK,
         filters: input.filters,
@@ -418,6 +426,13 @@ const searchKnowledgeUseCase = defineAuthorizedKnowledgeUseCase({
       })
     )
 
+    annotateSearchDiagnostics({
+      retrievalStatus: retrieved.retrieval.status,
+      timedOutLegs: retrieved.retrieval.timedOutLegs,
+    })
+    if (retrieved.retrieval.status === 'partial' && !input.allowPartialResults)
+      throw new SearchDeadlineError()
+    let rows = retrieved.rows
     input.signal?.throwIfAborted()
     /** Public callers have no input envelope, but persisted reranker inputs still need provenance. */
     const registrySubjectUserId = resolvePrincipalSubjectUserId(principal)
@@ -715,6 +730,7 @@ const searchKnowledgeUseCase = defineAuthorizedKnowledgeUseCase({
         }
       : undefined
     return {
+      retrieval: retrieved.retrieval,
       results,
       query: input.query ?? '',
       knowledgeBaseIds,
diff --git a/apps/sim/lib/knowledge/application/workspace-search.activity.test.ts b/apps/sim/lib/knowledge/application/workspace-search.activity.test.ts
index 32ecacf0059..301766ff25f 100644
--- a/apps/sim/lib/knowledge/application/workspace-search.activity.test.ts
+++ b/apps/sim/lib/knowledge/application/workspace-search.activity.test.ts
@@ -63,6 +63,7 @@ describe.each([
     queueTableRows(member, [{ role: 'member' }])
     expect(await operation.execute({ principal, input })).toEqual({
       results: [],
+      retrieval: { status: 'complete', timedOutLegs: [] },
       query: 'policy',
       knowledgeBases: [],
     })
diff --git a/apps/sim/lib/knowledge/application/workspace-search.ts b/apps/sim/lib/knowledge/application/workspace-search.ts
index 983c7819011..81924891d5a 100644
--- a/apps/sim/lib/knowledge/application/workspace-search.ts
+++ b/apps/sim/lib/knowledge/application/workspace-search.ts
@@ -31,7 +31,13 @@ const searchWorkspaceKnowledgeUseCase = defineAuthorizedKnowledgeUseCase({
     const index = await measureSearchStage('index_resolution', () =>
       findWorkspaceSearchIndex(context.workspaceId)
     )
-    if (!index) return { results: [], query: input.query ?? '', knowledgeBases: [] }
+    if (!index)
+      return {
+        results: [],
+        query: input.query ?? '',
+        knowledgeBases: [],
+        retrieval: { status: 'complete' as const, timedOutLegs: [] },
+      }
     return searchKnowledge.execute({
       principal,
       input: { ...input, workspaceId: context.workspaceId, knowledgeBaseIds: [index.id] },
@@ -75,7 +81,12 @@ const searchOrganizationKnowledgeUseCase = defineAuthorizedKnowledgeUseCase({
             results: [],
           })
       }
-      return { results: [], query: input.query ?? '', knowledgeBases: [] }
+      return {
+        results: [],
+        query: input.query ?? '',
+        knowledgeBases: [],
+        retrieval: { status: 'complete' as const, timedOutLegs: [] },
+      }
     }
     return searchKnowledge.execute({
       principal,
@@ -118,7 +129,12 @@ const searchScopedKnowledgeUseCase = defineAuthorizedKnowledgeUseCase({
             results: [],
           })
       }
-      return { results: [], query: input.query ?? '', knowledgeBases: [] }
+      return {
+        results: [],
+        query: input.query ?? '',
+        knowledgeBases: [],
+        retrieval: { status: 'complete' as const, timedOutLegs: [] },
+      }
     }
     return searchKnowledge.execute({
       principal,
diff --git a/apps/sim/lib/knowledge/chunks/service.ts b/apps/sim/lib/knowledge/chunks/service.ts
index 02a018367c9..f471c084f81 100644
--- a/apps/sim/lib/knowledge/chunks/service.ts
+++ b/apps/sim/lib/knowledge/chunks/service.ts
@@ -3,7 +3,7 @@ import { document, embedding, knowledgeBase } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { sha256Hex } from '@sim/security/hash'
 import { generateId } from '@sim/utils/id'
-import { and, eq, inArray, isNull, sql } from 'drizzle-orm'
+import { and, eq, gte, inArray, isNull, sql } from 'drizzle-orm'
 import {
   type KeysetKey,
   keysetColumns,
@@ -123,7 +123,13 @@ export async function queryChunks(
    * keyset resume narrows the *page*, and folding it into the count would turn
    * a total into a remainder that shrinks with every page.
    */
-  const pageConditions = [...conditions, resumeKeyset(keys, cursorKeys, sortOrder)]
+  const pageConditions = [
+    ...conditions,
+    resumeKeyset(keys, cursorKeys, sortOrder),
+    filters.startChunkIndex === undefined
+      ? undefined
+      : gte(embedding.chunkIndex, filters.startChunkIndex),
+  ]
 
   const rows = await db
     .select({
diff --git a/apps/sim/lib/knowledge/chunks/types.ts b/apps/sim/lib/knowledge/chunks/types.ts
index 66c20011a18..4225a2e28e6 100644
--- a/apps/sim/lib/knowledge/chunks/types.ts
+++ b/apps/sim/lib/knowledge/chunks/types.ts
@@ -13,6 +13,8 @@ export interface ChunkFilters {
   enabled?: 'true' | 'false' | 'all'
   limit?: number
   offset?: number
+  /** Inclusive indexed position; unlike an ordinal offset it survives disabled chunk gaps. */
+  startChunkIndex?: number
   sortBy?: ChunkSortBy
   sortOrder?: 'asc' | 'desc'
   /** Keyset position from a previous page. Never combined with `offset`. */
diff --git a/apps/sim/lib/knowledge/connectors/external-group-sync.ts b/apps/sim/lib/knowledge/connectors/external-group-sync.ts
index 230a5f92280..221c6802483 100644
--- a/apps/sim/lib/knowledge/connectors/external-group-sync.ts
+++ b/apps/sim/lib/knowledge/connectors/external-group-sync.ts
@@ -11,6 +11,7 @@ import { getErrorMessage, toError } from '@sim/utils/errors'
 import { chunkArray } from '@sim/utils/helpers'
 import { generateId } from '@sim/utils/id'
 import { and, eq, gt, inArray, isNull, lt, notInArray, or, sql } from 'drizzle-orm'
+import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import {
   resourceScopeColumns,
   resourceScopeFields,
@@ -434,69 +435,77 @@ export async function refreshConnectorDirectory(
     return 'skipped'
   }
 
-  if (
-    !(
-      await resolveKnowledgeAccessAvailability(
-        resourceScopeFields(resourceScopeFromOwner(connector))
-      )
-    ).sourceMirrored
-  ) {
-    return 'skipped'
-  }
+  return withResourceOutboundScope(
+    connector,
+    async (): Promise<ConnectorDirectoryRefreshOutcome> => {
+      if (
+        !(
+          await resolveKnowledgeAccessAvailability(
+            resourceScopeFields(resourceScopeFromOwner(connector))
+          )
+        ).sourceMirrored
+      ) {
+        return 'skipped'
+      }
 
-  const connectorConfig = CONNECTOR_REGISTRY[connector.connectorType]
-  if (!connectorConfig?.openDirectory) return 'skipped'
+      const connectorConfig = CONNECTOR_REGISTRY[connector.connectorType]
+      if (!connectorConfig?.openDirectory) return 'skipped'
 
-  const credentialUserId = await resolveConnectorTokenUserId({
-    credentialId: connector.credentialId,
-    ...resourceScopeFields(resourceScopeFromOwner(connector)),
-    fallbackUserId: connector.knowledgeBaseOwnerId,
-  })
-  if (!credentialUserId) return 'unusable'
+      const credentialUserId = await resolveConnectorTokenUserId({
+        credentialId: connector.credentialId,
+        ...resourceScopeFields(resourceScopeFromOwner(connector)),
+        fallbackUserId: connector.knowledgeBaseOwnerId,
+      })
+      if (!credentialUserId) return 'unusable'
 
-  const sourceConfig = connector.sourceConfig as Record<string, unknown>
-  const token = await resolveConnectorAccessToken({
-    auth: connectorConfig.auth,
-    accessMode: 'admin',
-    connector,
-    userId: credentialUserId,
-    requestId,
-    sourceConfig,
-  })
-  if (!token) return 'unusable'
+      const sourceConfig = connector.sourceConfig as Record<string, unknown>
+      const token = await resolveConnectorAccessToken({
+        auth: connectorConfig.auth,
+        accessMode: 'admin',
+        connector,
+        userId: credentialUserId,
+        requestId,
+        sourceConfig,
+      })
+      if (!token) return 'unusable'
 
-  const recordError = async (lastSyncError: string | null) => {
-    await db
-      .update(knowledgeConnector)
-      .set({ lastSyncError, updatedAt: new Date() })
-      .where(
-        and(
-          eq(knowledgeConnector.id, connector.id),
-          eq(knowledgeConnector.updatedAt, connector.updatedAt),
-          isNull(knowledgeConnector.syncLockToken),
-          isNull(knowledgeConnector.memberSyncLockToken),
-          isNull(knowledgeConnector.archivedAt),
-          isNull(knowledgeConnector.deletedAt)
-        )
-      )
-  }
-  try {
-    const syncContext = syncContextForToken(token)
-    await connectorConfig.permissionConfig?.populateSyncContext(connector.id, syncContext)
-    const outcome = await refreshMirroredDirectory({
-      ...resourceScopeFields(resourceScopeFromOwner(connector)),
-      connectorConfig,
-      sourceConfig,
-      syncContext,
-      accessToken: token.accessToken,
-      force: connector.lastSyncError?.startsWith(DIRECTORY_ERROR_PREFIX),
-    })
-    if (outcome === 'refreshed' && connector.lastSyncError?.startsWith(DIRECTORY_ERROR_PREFIX)) {
-      await recordError(null)
+      const recordError = async (lastSyncError: string | null) => {
+        await db
+          .update(knowledgeConnector)
+          .set({ lastSyncError, updatedAt: new Date() })
+          .where(
+            and(
+              eq(knowledgeConnector.id, connector.id),
+              eq(knowledgeConnector.updatedAt, connector.updatedAt),
+              isNull(knowledgeConnector.syncLockToken),
+              isNull(knowledgeConnector.memberSyncLockToken),
+              isNull(knowledgeConnector.archivedAt),
+              isNull(knowledgeConnector.deletedAt)
+            )
+          )
+      }
+      try {
+        const syncContext = syncContextForToken(token)
+        await connectorConfig.permissionConfig?.populateSyncContext(connector.id, syncContext)
+        const outcome = await refreshMirroredDirectory({
+          ...resourceScopeFields(resourceScopeFromOwner(connector)),
+          connectorConfig,
+          sourceConfig,
+          syncContext,
+          accessToken: token.accessToken,
+          force: connector.lastSyncError?.startsWith(DIRECTORY_ERROR_PREFIX),
+        })
+        if (
+          outcome === 'refreshed' &&
+          connector.lastSyncError?.startsWith(DIRECTORY_ERROR_PREFIX)
+        ) {
+          await recordError(null)
+        }
+        return outcome
+      } catch (error) {
+        await recordError(getErrorMessage(error))
+        throw error
+      }
     }
-    return outcome
-  } catch (error) {
-    await recordError(getErrorMessage(error))
-    throw error
-  }
+  )
 }
diff --git a/apps/sim/lib/knowledge/connectors/member-sync-engine.ts b/apps/sim/lib/knowledge/connectors/member-sync-engine.ts
index 186e56e8d72..3357161f6d8 100644
--- a/apps/sim/lib/knowledge/connectors/member-sync-engine.ts
+++ b/apps/sim/lib/knowledge/connectors/member-sync-engine.ts
@@ -21,6 +21,7 @@ import {
   assertBillingAttributionSnapshot,
   type BillingAttributionSnapshot,
 } from '@/lib/billing/core/billing-attribution'
+import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import { resourceScopeFields, resourceScopeFromOwner } from '@/lib/core/resource-scope'
 import { resourceScopeCondition } from '@/lib/core/resource-scope.server'
 import {
@@ -1713,544 +1714,547 @@ export async function executeMemberSync(
     userId: kbRow.userId,
   }
 
-  const runId = generateId()
-  const connector = await acquireMemberSyncLock(connectorId, runId, options.dispatchToken)
-  if (!connector) {
-    const [current] = await db
-      .select({
-        status: knowledgeConnector.status,
-        memberSyncStatus: knowledgeConnector.memberSyncStatus,
-        memberSyncLockToken: knowledgeConnector.memberSyncLockToken,
-        syncLockToken: knowledgeConnector.syncLockToken,
-      })
-      .from(knowledgeConnector)
-      .where(eq(knowledgeConnector.id, connectorId))
-      .limit(1)
-    if (
-      current?.memberSyncStatus === 'disabled' ||
-      current?.syncLockToken ||
-      (current && !MEMBER_LOCKABLE_CONNECTOR_STATUSES.some((status) => status === current.status))
-    ) {
-      logger.info('Connector is not accepting member syncs, skipping', {
-        connectorId,
-        status: current.status,
-      })
-      return skipped(result, 'connector_not_syncable')
-    }
-    if (options.dispatchToken && current?.memberSyncLockToken !== options.dispatchToken) {
-      logger.info('Member sync superseded by a newer dispatch, skipping', { connectorId })
-      return skipped(result, 'dispatch_superseded')
-    }
-    logger.info('Member sync already in progress, skipping', { connectorId })
-    return skipped(result, 'sync_in_progress')
-  }
-
-  const runStartedAt = new Date()
-  const run: MemberSyncRun = {
-    connectorId,
-    knowledgeBaseId: connector.knowledgeBaseId,
-    ...resourceScopeFields(resourceScopeFromOwner(kbRow)),
-    runId,
-    runStartedAt,
-    deadlineAt: runStartedAt.getTime() + MEMBER_SYNC_SOFT_BUDGET_SECONDS * 1000,
-    result,
-    lease: createMemberSyncLease(connectorId, runId),
-  }
-  await insertMemberSyncLog(runId, connectorId, runStartedAt)
-
-  try {
-    /**
-     * Where the feature is off — flag, plan, or a flag read that could not
-     * reach its source — nothing changes: readers already see no member-scoped
-     * document, and the run waits for the next schedule to look again.
-     */
-    if (!(await isKnowledgeMemberAccessAvailable(run))) {
-      await deferMemberSync(run, connector.syncIntervalMinutes)
-      return {
-        ...skipped(result, 'connector_not_syncable'),
-        error: 'Per-member access is not available for this workspace',
+  return withResourceOutboundScope(kbOwner, async (): Promise<MemberSyncResult> => {
+    const runId = generateId()
+    const connector = await acquireMemberSyncLock(connectorId, runId, options.dispatchToken)
+    if (!connector) {
+      const [current] = await db
+        .select({
+          status: knowledgeConnector.status,
+          memberSyncStatus: knowledgeConnector.memberSyncStatus,
+          memberSyncLockToken: knowledgeConnector.memberSyncLockToken,
+          syncLockToken: knowledgeConnector.syncLockToken,
+        })
+        .from(knowledgeConnector)
+        .where(eq(knowledgeConnector.id, connectorId))
+        .limit(1)
+      if (
+        current?.memberSyncStatus === 'disabled' ||
+        current?.syncLockToken ||
+        (current && !MEMBER_LOCKABLE_CONNECTOR_STATUSES.some((status) => status === current.status))
+      ) {
+        logger.info('Connector is not accepting member syncs, skipping', {
+          connectorId,
+          status: current.status,
+        })
+        return skipped(result, 'connector_not_syncable')
       }
-    }
-    if (!connector.credentialGroupId || !connector.credentialGroupOptionId) {
-      await disableMemberSync(run, 'Connector is no longer attached to a Credential Group option')
-      return {
-        ...skipped(result, 'connector_not_syncable'),
-        error: 'Connector is no longer attached to a Credential Group option',
+      if (options.dispatchToken && current?.memberSyncLockToken !== options.dispatchToken) {
+        logger.info('Member sync superseded by a newer dispatch, skipping', { connectorId })
+        return skipped(result, 'dispatch_superseded')
       }
+      logger.info('Member sync already in progress, skipping', { connectorId })
+      return skipped(result, 'sync_in_progress')
     }
-    if (!connectorConfig.permissionScopedListing || connectorConfig.auth.mode !== 'oauth') {
-      throw new Error(`Connector ${connectorConfig.id} cannot sync per member`)
-    }
-    if (connector.credentialId && !connectorConfig.supportsSeparateContentCredential) {
-      throw new Error(`${connectorConfig.name} does not support a separate content credential`)
-    }
-    const binding = {
-      credentialGroupId: connector.credentialGroupId,
-      credentialGroupOptionId: connector.credentialGroupOptionId,
-    }
-    const sourceConfig = connector.sourceConfig as Record<string, unknown>
 
-    if (connector.accessRewritePending && !(await finishPendingAccessRewrite(run))) {
-      /** The rewrite is not done, so nothing is listed yet; the next run picks it up at once. */
-      result.membersRemaining = true
-      const landed = await completeMemberSync(run, connector.syncIntervalMinutes)
-      if (!landed) return skipped(result, 'sync_superseded')
-      logger.info('Member sync spent its budget hiding documents after a mode switch', {
-        connectorId,
-        runId,
-      })
-      return result
+    const runStartedAt = new Date()
+    const run: MemberSyncRun = {
+      connectorId,
+      knowledgeBaseId: connector.knowledgeBaseId,
+      ...resourceScopeFields(resourceScopeFromOwner(kbRow)),
+      runId,
+      runStartedAt,
+      deadlineAt: runStartedAt.getTime() + MEMBER_SYNC_SOFT_BUDGET_SECONDS * 1000,
+      result,
+      lease: createMemberSyncLease(connectorId, runId),
     }
+    await insertMemberSyncLog(runId, connectorId, runStartedAt)
 
-    const contentDue =
-      Boolean(connector.listingCheckpoint) ||
-      options.forceContentRefresh ||
-      connector.accessRewritePending ||
-      !connector.lastSyncAt ||
-      connector.syncIntervalMinutes <= 0 ||
-      runStartedAt.getTime() - connector.lastSyncAt.getTime() >=
-        connector.syncIntervalMinutes * 60_000
-    if (connector.credentialId && options.forceContentRefresh) {
-      /** An interrupted explicit crawl stays due when its continuation no longer carries the force flag. */
-      await withMemberLease(run, (tx) =>
-        tx
-          .update(knowledgeConnector)
-          .set({ lastSyncAt: null, updatedAt: new Date() })
-          .where(stillHoldsMemberSyncLock(connectorId, runId))
-      )
-    }
-    const serviceContent = connector.credentialId
-      ? contentDue
-        ? await syncDedicatedMemberContent({
-            run,
-            connector,
-            connectorConfig,
-            sourceConfig,
-            kbOwner,
-            billingAttribution,
-          })
-        : { complete: true }
-      : undefined
-    /**
-     * Anyone who joined the workspace since the last run is invited now, so
-     * membership grows on its own; the invitation is the only thing they need.
-     */
-    const invited = run.workspaceId
-      ? await inviteWorkspaceMembersToCredentialGroup({
-          workspaceId: run.workspaceId,
-          credentialGroupId: connector.credentialGroupId,
-          beforeBatch: run.lease.beatIfDue,
-          deadlineAt: run.deadlineAt,
-        }).catch((error) => {
-          logger.warn('Failed to invite new workspace members during a member run', {
-            connectorId,
-            error: getErrorMessage(error),
+    try {
+      /**
+       * Where the feature is off — flag, plan, or a flag read that could not
+       * reach its source — nothing changes: readers already see no member-scoped
+       * document, and the run waits for the next schedule to look again.
+       */
+      if (!(await isKnowledgeMemberAccessAvailable(run))) {
+        await deferMemberSync(run, connector.syncIntervalMinutes)
+        return {
+          ...skipped(result, 'connector_not_syncable'),
+          error: 'Per-member access is not available for this workspace',
+        }
+      }
+      if (!connector.credentialGroupId || !connector.credentialGroupOptionId) {
+        await disableMemberSync(run, 'Connector is no longer attached to a Credential Group option')
+        return {
+          ...skipped(result, 'connector_not_syncable'),
+          error: 'Connector is no longer attached to a Credential Group option',
+        }
+      }
+      if (!connectorConfig.permissionScopedListing || connectorConfig.auth.mode !== 'oauth') {
+        throw new Error(`Connector ${connectorConfig.id} cannot sync per member`)
+      }
+      if (connector.credentialId && !connectorConfig.supportsSeparateContentCredential) {
+        throw new Error(`${connectorConfig.name} does not support a separate content credential`)
+      }
+      const binding = {
+        credentialGroupId: connector.credentialGroupId,
+        credentialGroupOptionId: connector.credentialGroupOptionId,
+      }
+      const sourceConfig = connector.sourceConfig as Record<string, unknown>
+
+      if (connector.accessRewritePending && !(await finishPendingAccessRewrite(run))) {
+        /** The rewrite is not done, so nothing is listed yet; the next run picks it up at once. */
+        result.membersRemaining = true
+        const landed = await completeMemberSync(run, connector.syncIntervalMinutes)
+        if (!landed) return skipped(result, 'sync_superseded')
+        logger.info('Member sync spent its budget hiding documents after a mode switch', {
+          connectorId,
+          runId,
+        })
+        return result
+      }
+
+      const contentDue =
+        Boolean(connector.listingCheckpoint) ||
+        options.forceContentRefresh ||
+        connector.accessRewritePending ||
+        !connector.lastSyncAt ||
+        connector.syncIntervalMinutes <= 0 ||
+        runStartedAt.getTime() - connector.lastSyncAt.getTime() >=
+          connector.syncIntervalMinutes * 60_000
+      if (connector.credentialId && options.forceContentRefresh) {
+        /** An interrupted explicit crawl stays due when its continuation no longer carries the force flag. */
+        await withMemberLease(run, (tx) =>
+          tx
+            .update(knowledgeConnector)
+            .set({ lastSyncAt: null, updatedAt: new Date() })
+            .where(stillHoldsMemberSyncLock(connectorId, runId))
+        )
+      }
+      const serviceContent = connector.credentialId
+        ? contentDue
+          ? await syncDedicatedMemberContent({
+              run,
+              connector,
+              connectorConfig,
+              sourceConfig,
+              kbOwner,
+              billingAttribution,
+            })
+          : { complete: true }
+        : undefined
+      /**
+       * Anyone who joined the workspace since the last run is invited now, so
+       * membership grows on its own; the invitation is the only thing they need.
+       */
+      const invited = run.workspaceId
+        ? await inviteWorkspaceMembersToCredentialGroup({
+            workspaceId: run.workspaceId,
+            credentialGroupId: connector.credentialGroupId,
+            beforeBatch: run.lease.beatIfDue,
+            deadlineAt: run.deadlineAt,
+          }).catch((error) => {
+            logger.warn('Failed to invite new workspace members during a member run', {
+              connectorId,
+              error: getErrorMessage(error),
+            })
+            return null
           })
-          return null
+        : null
+      if (invited && invited.invited > 0) {
+        logger.info('Invited new workspace members to the connector credential group', {
+          connectorId,
+          ...invited,
         })
-      : null
-    if (invited && invited.invited > 0) {
-      logger.info('Invited new workspace members to the connector credential group', {
-        connectorId,
-        ...invited,
-      })
-    }
-    if (
-      !(await reconcileMembership(
-        run,
-        binding,
-        connector.directoryCheckpoint,
-        Boolean(options.forceContentRefresh)
-      ))
-    ) {
-      result.membersRemaining = true
-      if (!(await completeMemberSync(run, connector.syncIntervalMinutes)))
-        return skipped(result, 'sync_superseded')
-      return result
-    }
+      }
+      if (
+        !(await reconcileMembership(
+          run,
+          binding,
+          connector.directoryCheckpoint,
+          Boolean(options.forceContentRefresh)
+        ))
+      ) {
+        result.membersRemaining = true
+        if (!(await completeMemberSync(run, connector.syncIntervalMinutes)))
+          return skipped(result, 'sync_superseded')
+        return result
+      }
 
-    const credentialIdByMemberId = new Map<string, string>()
-    const tokens = createMemberTokenCache({
-      run,
-      connectorConfig,
-      credentialIdByMemberId,
-      sourceConfig,
-    })
+      const credentialIdByMemberId = new Map<string, string>()
+      const tokens = createMemberTokenCache({
+        run,
+        connectorConfig,
+        credentialIdByMemberId,
+        sourceConfig,
+      })
 
-    while (Date.now() < run.deadlineAt) {
-      const member = await claimNextMember(run)
-      if (!member) break
-      result.membersClaimed += 1
-      credentialIdByMemberId.clear()
-      credentialIdByMemberId.set(member.id, member.credentialId)
-      const syncContext: Record<string, unknown> = {
-        syncRunId: runId,
-        memberId: member.id,
-        ...PER_MEMBER_LISTING_CONTEXT,
-      }
-      let contentFailures = false
-      const processPage = async (
-        documents: ExternalDocument[],
-        checkpoint: ListingCheckpoint,
-        durableCheckpoint = true
-      ) => {
-        const externalIds = documents.map((item) => item.externalId)
-        const observeAttempted = async (attempted: ExternalDocument[]) => {
-          if (attempted.length === 0) return
-          const documentIds = [
-            ...(
-              await loadDocumentIdsByExternalId(
-                connectorId,
-                attempted.map((item) => item.externalId)
+      while (Date.now() < run.deadlineAt) {
+        const member = await claimNextMember(run)
+        if (!member) break
+        result.membersClaimed += 1
+        credentialIdByMemberId.clear()
+        credentialIdByMemberId.set(member.id, member.credentialId)
+        const syncContext: Record<string, unknown> = {
+          syncRunId: runId,
+          memberId: member.id,
+          ...PER_MEMBER_LISTING_CONTEXT,
+        }
+        let contentFailures = false
+        const processPage = async (
+          documents: ExternalDocument[],
+          checkpoint: ListingCheckpoint,
+          durableCheckpoint = true
+        ) => {
+          const externalIds = documents.map((item) => item.externalId)
+          const observeAttempted = async (attempted: ExternalDocument[]) => {
+            if (attempted.length === 0) return
+            const documentIds = [
+              ...(
+                await loadDocumentIdsByExternalId(
+                  connectorId,
+                  attempted.map((item) => item.externalId)
+                )
+              ).values(),
+            ]
+            await withMemberLease(run, async (tx) => {
+              result.observationsAdded += await recordMemberObservations(
+                tx,
+                member.id,
+                documentIds,
+                checkpoint.generationId
               )
-            ).values(),
-          ]
-          await withMemberLease(run, async (tx) => {
-            result.observationsAdded += await recordMemberObservations(
-              tx,
-              member.id,
-              documentIds,
-              checkpoint.generationId
-            )
-            await materializeDocumentAcls(connectorId, documentIds, tx)
-            if (durableCheckpoint && checkpoint.contentFailures) {
-              await tx
-                .update(knowledgeConnectorMember)
-                .set({ listingCheckpoint: checkpoint })
-                .where(eq(knowledgeConnectorMember.id, member.id))
-            }
-            if (!serviceContent) {
-              for (let offset = 0; offset < documentIds.length; offset += 500) {
+              await materializeDocumentAcls(connectorId, documentIds, tx)
+              if (durableCheckpoint && checkpoint.contentFailures) {
                 await tx
-                  .update(document)
-                  .set({ sourceSeenAt: run.runStartedAt })
-                  .where(
-                    and(
-                      eq(document.connectorId, connectorId),
-                      inArray(document.id, documentIds.slice(offset, offset + 500))
+                  .update(knowledgeConnectorMember)
+                  .set({ listingCheckpoint: checkpoint })
+                  .where(eq(knowledgeConnectorMember.id, member.id))
+              }
+              if (!serviceContent) {
+                for (let offset = 0; offset < documentIds.length; offset += 500) {
+                  await tx
+                    .update(document)
+                    .set({ sourceSeenAt: run.runStartedAt })
+                    .where(
+                      and(
+                        eq(document.connectorId, connectorId),
+                        inArray(document.id, documentIds.slice(offset, offset + 500))
+                      )
                     )
-                  )
+                }
               }
-            }
-          })
-          result.docsListed += attempted.length
-        }
-        if (!serviceContent) {
-          const corpus = await loadPageCorpus(connectorId, externalIds)
-          const pageState = createSyncRunState(result)
-          let rejectedCredentialError: Error | undefined
-          /** Commit sibling observations and failures before capacity pressure can end this page. */
-          const persistAttempted = async (attempted: ExternalDocument[]) => {
-            if (rejectedCredentialError) throw rejectedCredentialError
-            if (attempted.some((item) => pageState.failedExternalIds.has(item.externalId))) {
-              await persistSourceDocumentFailures({
-                knowledgeBaseId: connector.knowledgeBaseId,
-                connectorId,
-                connectorType: connector.connectorType,
-                documents: attempted,
-                failedExternalIds: pageState.failedExternalIds,
-                sourceFailures: pageState.sourceFailures,
-                priorByExternalId: corpus.priorByExternalId,
-                sourceConfig,
-                access: 'members',
-                lease: run.lease,
-              })
-              checkpoint.contentFailures = true
-              contentFailures = true
-              result.listingIncomplete = true
-            }
-            await observeAttempted(attempted)
+            })
+            result.docsListed += attempted.length
           }
-          const pendingOps = classifyListing({
-            externalDocs: documents.filter((item) => {
-              const alreadyRead = corpus.priorByExternalId.get(item.externalId)?.sourceSeenAt
-              if (
-                alreadyRead &&
-                alreadyRead >= run.runStartedAt &&
-                corpus.priorByExternalId.get(item.externalId)?.contentHash !== null
-              ) {
-                result.docsUnchanged += 1
-                return false
+          if (!serviceContent) {
+            const corpus = await loadPageCorpus(connectorId, externalIds)
+            const pageState = createSyncRunState(result)
+            let rejectedCredentialError: Error | undefined
+            /** Commit sibling observations and failures before capacity pressure can end this page. */
+            const persistAttempted = async (attempted: ExternalDocument[]) => {
+              if (rejectedCredentialError) throw rejectedCredentialError
+              if (attempted.some((item) => pageState.failedExternalIds.has(item.externalId))) {
+                await persistSourceDocumentFailures({
+                  knowledgeBaseId: connector.knowledgeBaseId,
+                  connectorId,
+                  connectorType: connector.connectorType,
+                  documents: attempted,
+                  failedExternalIds: pageState.failedExternalIds,
+                  sourceFailures: pageState.sourceFailures,
+                  priorByExternalId: corpus.priorByExternalId,
+                  sourceConfig,
+                  access: 'members',
+                  lease: run.lease,
+                })
+                checkpoint.contentFailures = true
+                contentFailures = true
+                result.listingIncomplete = true
               }
-              return true
-            }),
-            corpus,
-            forceRehydrate: false,
-            state: pageState,
-          })
-          const pendingIds = new Set(pendingOps.map((op) => op.extDoc.externalId))
-          await persistAttempted(documents.filter((item) => !pendingIds.has(item.externalId)))
-          const finished = await processDocOps({
-            connectorId,
-            connector,
-            sourceConfig,
-            kbOwner,
-            billingAttribution,
-            pendingOps,
-            corpus,
-            forceRehydrate: false,
-            state: pageState,
-            hydration: {
-              concurrency: connectorConfig.contentConcurrency,
-              getDocument: async (externalId) => {
-                if (rejectedCredentialError) throw rejectedCredentialError
-                try {
-                  return await connectorConfig.getDocument(
-                    await tokens.get(member.id),
-                    sourceConfig,
-                    externalId,
-                    syncContext
-                  )
-                } catch (error) {
-                  if (connectorConfig.isCredentialInvalidError?.(error) === true) {
-                    rejectedCredentialError = toError(error)
-                    if (await tokens.reject(member.id))
-                      await recordMemberFailure(
-                        run,
-                        member,
-                        error,
-                        connector.syncIntervalMinutes,
-                        true
-                      )
-                  }
-                  throw error
+              await observeAttempted(attempted)
+            }
+            const pendingOps = classifyListing({
+              externalDocs: documents.filter((item) => {
+                const alreadyRead = corpus.priorByExternalId.get(item.externalId)?.sourceSeenAt
+                if (
+                  alreadyRead &&
+                  alreadyRead >= run.runStartedAt &&
+                  corpus.priorByExternalId.get(item.externalId)?.contentHash !== null
+                ) {
+                  result.docsUnchanged += 1
+                  return false
                 }
+                return true
+              }),
+              corpus,
+              forceRehydrate: false,
+              state: pageState,
+            })
+            const pendingIds = new Set(pendingOps.map((op) => op.extDoc.externalId))
+            await persistAttempted(documents.filter((item) => !pendingIds.has(item.externalId)))
+            const finished = await processDocOps({
+              connectorId,
+              connector,
+              sourceConfig,
+              kbOwner,
+              billingAttribution,
+              pendingOps,
+              corpus,
+              forceRehydrate: false,
+              state: pageState,
+              hydration: {
+                concurrency: connectorConfig.contentConcurrency,
+                getDocument: async (externalId) => {
+                  if (rejectedCredentialError) throw rejectedCredentialError
+                  try {
+                    return await connectorConfig.getDocument(
+                      await tokens.get(member.id),
+                      sourceConfig,
+                      externalId,
+                      syncContext
+                    )
+                  } catch (error) {
+                    if (connectorConfig.isCredentialInvalidError?.(error) === true) {
+                      rejectedCredentialError = toError(error)
+                      if (await tokens.reject(member.id))
+                        await recordMemberFailure(
+                          run,
+                          member,
+                          error,
+                          connector.syncIntervalMinutes,
+                          true
+                        )
+                    }
+                    throw error
+                  }
+                },
               },
-            },
-            lease: run.lease,
-            documentAccess: 'members',
-            deadlineAt: durableCheckpoint ? run.deadlineAt : undefined,
-            onBatchComplete: async (attempted) => {
-              result.docsHydratedOnce += attempted.filter((item) => item.contentDeferred).length
-              await persistAttempted(attempted)
-            },
-          })
-          if (rejectedCredentialError) throw rejectedCredentialError
-          if (!finished) return false
-        } else {
-          await observeAttempted(documents)
+              lease: run.lease,
+              documentAccess: 'members',
+              deadlineAt: durableCheckpoint ? run.deadlineAt : undefined,
+              onBatchComplete: async (attempted) => {
+                result.docsHydratedOnce += attempted.filter((item) => item.contentDeferred).length
+                await persistAttempted(attempted)
+              },
+            })
+            if (rejectedCredentialError) throw rejectedCredentialError
+            if (!finished) return false
+          } else {
+            await observeAttempted(documents)
+          }
         }
-      }
-      const listed = await listForMember({
-        run,
-        member,
-        connectorConfig,
-        sourceConfig,
-        tokens,
-        syncContext,
-        syncIntervalMinutes: connector.syncIntervalMinutes,
-        forceFull: Boolean(
-          serviceContent &&
-            (result.docsAdded > 0 ||
-              (connector.lastSyncAt &&
-                (!member.memberSyncedThrough || member.memberSyncedThrough < connector.lastSyncAt)))
-        ),
-        processPage,
-      })
-      if (listed.kind === 'failed') continue
-      if (listed.checkpoint?.contentFailures) result.listingIncomplete = true
-      if (listed.documents.length > 0) {
-        await processPage(
-          listed.documents,
-          beginListingCheckpoint({
-            fingerprint: listingFingerprint({ connectorId, memberId: member.id }),
-            generationId: runId,
-            startedAt: listed.startedAt,
-          }),
-          false
+        const listed = await listForMember({
+          run,
+          member,
+          connectorConfig,
+          sourceConfig,
+          tokens,
+          syncContext,
+          syncIntervalMinutes: connector.syncIntervalMinutes,
+          forceFull: Boolean(
+            serviceContent &&
+              (result.docsAdded > 0 ||
+                (connector.lastSyncAt &&
+                  (!member.memberSyncedThrough ||
+                    member.memberSyncedThrough < connector.lastSyncAt)))
+          ),
+          processPage,
+        })
+        if (listed.kind === 'failed') continue
+        if (listed.checkpoint?.contentFailures) result.listingIncomplete = true
+        if (listed.documents.length > 0) {
+          await processPage(
+            listed.documents,
+            beginListingCheckpoint({
+              fingerprint: listingFingerprint({ connectorId, memberId: member.id }),
+              generationId: runId,
+              startedAt: listed.startedAt,
+            }),
+            false
+          )
+        }
+        const listedCount = listed.checkpoint?.listedCount ?? listed.documents.length
+        const suspect =
+          listed.mode === 'full' &&
+          !listed.authoritative &&
+          listed.complete &&
+          classifySuspectListing(listedCount, member.lastListedCount ?? 0) !== null
+        const outcome: MemberListingOutcome = {
+          member,
+          mode: listed.mode,
+          listingStartedAt: listed.startedAt,
+          seenExternalIds: new Set(listed.documents.map((doc) => doc.externalId)),
+          removedExternalIds: listed.removedExternalIds,
+          listedCount,
+          complete: listed.complete,
+          resumable: listed.resumable,
+          suspect,
+          contentFailures: contentFailures || Boolean(listed.checkpoint?.contentFailures),
+          changeCursor: suspect ? undefined : listed.changeCursor,
+          checkpoint: listed.checkpoint,
+          observationRunId: listed.observationRunId,
+        }
+        const relevantIds = [...outcome.seenExternalIds, ...outcome.removedExternalIds]
+        const affected = await applyMemberListing(
+          run,
+          outcome,
+          await loadDocumentIdsByExternalId(connectorId, relevantIds),
+          connector.syncIntervalMinutes
         )
+        await withMemberLease(run, (tx) => materializeDocumentAcls(connectorId, affected, tx))
       }
-      const listedCount = listed.checkpoint?.listedCount ?? listed.documents.length
-      const suspect =
-        listed.mode === 'full' &&
-        !listed.authoritative &&
-        listed.complete &&
-        classifySuspectListing(listedCount, member.lastListedCount ?? 0) !== null
-      const outcome: MemberListingOutcome = {
-        member,
-        mode: listed.mode,
-        listingStartedAt: listed.startedAt,
-        seenExternalIds: new Set(listed.documents.map((doc) => doc.externalId)),
-        removedExternalIds: listed.removedExternalIds,
-        listedCount,
-        complete: listed.complete,
-        resumable: listed.resumable,
-        suspect,
-        contentFailures: contentFailures || Boolean(listed.checkpoint?.contentFailures),
-        changeCursor: suspect ? undefined : listed.changeCursor,
-        checkpoint: listed.checkpoint,
-        observationRunId: listed.observationRunId,
-      }
-      const relevantIds = [...outcome.seenExternalIds, ...outcome.removedExternalIds]
-      const affected = await applyMemberListing(
-        run,
-        outcome,
-        await loadDocumentIdsByExternalId(connectorId, relevantIds),
-        connector.syncIntervalMinutes
-      )
-      await withMemberLease(run, (tx) => materializeDocumentAcls(connectorId, affected, tx))
-    }
 
-    /** A service-owned corpus outlives its last observer; only the content pass removes it. */
-    if (!serviceContent) {
-      /**
-       * Nobody has completed a listing yet — a connector that just entered
-       * members mode, waiting for its first member to connect — so an
-       * unobserved document says nothing about access and must not be
-       * tombstoned, let alone purged a week later.
-       */
-      const [listed] = await db
-        .select({ count: sql<number>`count(*)::int` })
-        .from(knowledgeConnectorMember)
-        .where(
-          and(
-            eq(knowledgeConnectorMember.connectorId, connectorId),
-            sql`${knowledgeConnectorMember.lastCompleteListingAt} IS NOT NULL`
+      /** A service-owned corpus outlives its last observer; only the content pass removes it. */
+      if (!serviceContent) {
+        /**
+         * Nobody has completed a listing yet — a connector that just entered
+         * members mode, waiting for its first member to connect — so an
+         * unobserved document says nothing about access and must not be
+         * tombstoned, let alone purged a week later.
+         */
+        const [listed] = await db
+          .select({ count: sql<number>`count(*)::int` })
+          .from(knowledgeConnectorMember)
+          .where(
+            and(
+              eq(knowledgeConnectorMember.connectorId, connectorId),
+              sql`${knowledgeConnectorMember.lastCompleteListingAt} IS NOT NULL`
+            )
           )
-        )
-      const lifecycle = await applyMemberDocumentLifecycle({
+        const lifecycle = await applyMemberDocumentLifecycle({
+          connectorId,
+          knowledgeBaseId: connector.knowledgeBaseId,
+          runId,
+          lease: run.lease,
+          withLease: (fn) => withMemberLease(run, fn),
+          deadlineAt: run.deadlineAt,
+          allowRemoval: (listed?.count ?? 0) > 0,
+        })
+        result.docsTombstoned = lifecycle.tombstoned
+        result.docsResurrected = lifecycle.resurrected
+        result.docsPurged = lifecycle.purged
+        result.docsDeleted = lifecycle.purged
+        result.membersRemaining = !lifecycle.finished
+      }
+
+      await sweepStuckDocuments({
         connectorId,
         knowledgeBaseId: connector.knowledgeBaseId,
-        runId,
+        syncStartedAt: runStartedAt,
+        retryCutoff: new Date(Date.now() - RETRY_WINDOW_DAYS * 24 * 60 * 60 * 1000),
+        billingAttribution,
+        result,
         lease: run.lease,
-        withLease: (fn) => withMemberLease(run, fn),
-        deadlineAt: run.deadlineAt,
-        allowRemoval: (listed?.count ?? 0) > 0,
       })
-      result.docsTombstoned = lifecycle.tombstoned
-      result.docsResurrected = lifecycle.resurrected
-      result.docsPurged = lifecycle.purged
-      result.docsDeleted = lifecycle.purged
-      result.membersRemaining = !lifecycle.finished
-    }
 
-    await sweepStuckDocuments({
-      connectorId,
-      knowledgeBaseId: connector.knowledgeBaseId,
-      syncStartedAt: runStartedAt,
-      retryCutoff: new Date(Date.now() - RETRY_WINDOW_DAYS * 24 * 60 * 60 * 1000),
-      billingAttribution,
-      result,
-      lease: run.lease,
-    })
-
-    result.membersRemaining =
-      result.membersRemaining ||
-      serviceContent?.complete === false ||
-      (await countDueMembers(run, binding)) > 0
-    const landed = await completeMemberSync(run, connector.syncIntervalMinutes)
-    if (!landed) {
-      logger.warn(
-        'Member sync result discarded — connector was reclaimed while this run was executing',
-        {
-          connectorId,
-          runId,
-        }
-      )
-      return skipped(result, 'sync_superseded')
-    }
-    logger.info('Member sync completed', { connectorId, runId, ...result })
-    return result
-  } catch (error) {
-    if (error instanceof SyncLockLostException) {
-      logger.warn('Member sync abandoned — lock was reclaimed while this run was executing', {
-        connectorId,
-        runId,
-      })
-      return skipped(result, 'sync_superseded')
-    }
-    if (error instanceof ConnectorDeletedException) {
-      logger.info('Connector deleted during member sync', { connectorId })
-      await failMemberSyncLog(runId, result, 'Connector deleted during sync').catch((logError) =>
-        logger.error('Failed to record member sync failure', {
-          connectorId,
-          error: getErrorMessage(logError),
-        })
-      )
-      return skipped(result, 'connector_deleted_during_sync')
-    }
-    if (error instanceof MemberBindingGoneError) {
-      try {
-        await disableMemberSync(run, error.message)
-      } catch (disableError) {
-        if (!(disableError instanceof SyncLockLostException)) throw disableError
-        logger.warn('Member sync abandoned — lock was reclaimed before it could be disabled', {
+      result.membersRemaining =
+        result.membersRemaining ||
+        serviceContent?.complete === false ||
+        (await countDueMembers(run, binding)) > 0
+      const landed = await completeMemberSync(run, connector.syncIntervalMinutes)
+      if (!landed) {
+        logger.warn(
+          'Member sync result discarded — connector was reclaimed while this run was executing',
+          {
+            connectorId,
+            runId,
+          }
+        )
+        return skipped(result, 'sync_superseded')
+      }
+      logger.info('Member sync completed', { connectorId, runId, ...result })
+      return result
+    } catch (error) {
+      if (error instanceof SyncLockLostException) {
+        logger.warn('Member sync abandoned — lock was reclaimed while this run was executing', {
           connectorId,
           runId,
         })
         return skipped(result, 'sync_superseded')
       }
-      return { ...skipped(result, 'connector_not_syncable'), error: error.message }
-    }
+      if (error instanceof ConnectorDeletedException) {
+        logger.info('Connector deleted during member sync', { connectorId })
+        await failMemberSyncLog(runId, result, 'Connector deleted during sync').catch((logError) =>
+          logger.error('Failed to record member sync failure', {
+            connectorId,
+            error: getErrorMessage(logError),
+          })
+        )
+        return skipped(result, 'connector_deleted_during_sync')
+      }
+      if (error instanceof MemberBindingGoneError) {
+        try {
+          await disableMemberSync(run, error.message)
+        } catch (disableError) {
+          if (!(disableError instanceof SyncLockLostException)) throw disableError
+          logger.warn('Member sync abandoned — lock was reclaimed before it could be disabled', {
+            connectorId,
+            runId,
+          })
+          return skipped(result, 'sync_superseded')
+        }
+        return { ...skipped(result, 'connector_not_syncable'), error: error.message }
+      }
 
-    if (getConnectorSyncDeferral(error)) {
-      try {
-        result.deferred = await deferConnectorSync({
-          connectorId,
-          knowledgeBaseId: connector.knowledgeBaseId,
-          runId,
-          lease: run.lease,
-          kind: 'member',
-          result,
-          error,
-        })
-        result.listingIncomplete = true
-        logger.info('Member source sync deferred', { connectorId, ...result.deferred })
-        return result
-      } catch (persistenceError) {
-        logger.error('Failed to persist member source deferral', {
-          connectorId,
-          error:
-            getConnectorFailureDiagnostic(persistenceError)?.message ??
-            toError(persistenceError).message,
-        })
-        result.error = 'Could not persist the member sync retry after provider deferral'
-        return result
+      if (getConnectorSyncDeferral(error)) {
+        try {
+          result.deferred = await deferConnectorSync({
+            connectorId,
+            knowledgeBaseId: connector.knowledgeBaseId,
+            runId,
+            lease: run.lease,
+            kind: 'member',
+            result,
+            error,
+          })
+          result.listingIncomplete = true
+          logger.info('Member source sync deferred', { connectorId, ...result.deferred })
+          return result
+        } catch (persistenceError) {
+          logger.error('Failed to persist member source deferral', {
+            connectorId,
+            error:
+              getConnectorFailureDiagnostic(persistenceError)?.message ??
+              toError(persistenceError).message,
+          })
+          result.error = 'Could not persist the member sync retry after provider deferral'
+          return result
+        }
       }
-    }
 
-    const diagnostic = getConnectorFailureDiagnostic(error)
-    const errorMessage = diagnostic?.message ?? toError(error).message
-    const retryAfterMs = getRetryAfterMs(error)
-    logger.error('Member sync failed', { connectorId, runId, error: errorMessage, diagnostic })
-    try {
-      await failMemberSyncLog(runId, result, errorMessage)
-      const failureUpdate =
-        error instanceof ConnectorSyncCapacityError
-          ? {
-              memberSyncStatus: 'error' as const,
-              lastMemberSyncError: errorMessage,
-              nextMemberSyncAt: null,
-              memberSyncConsecutiveFailures: connector.memberSyncConsecutiveFailures,
-              memberSyncLockToken: null,
-              memberSyncLockLeaseAt: null,
-              updatedAt: new Date(),
-            }
-          : buildMemberSyncFailureUpdate(
-              new Date(),
-              connector.memberSyncConsecutiveFailures,
-              errorMessage,
-              retryAfterMs
-            )
-      const written = await db
-        .update(knowledgeConnector)
-        .set(failureUpdate)
-        .where(stillHoldsMemberSyncLock(connectorId, runId))
-        .returning({ id: knowledgeConnector.id })
-      if (written.length === 0) {
-        logger.warn('Member sync failure discarded — connector was reclaimed', {
+      const diagnostic = getConnectorFailureDiagnostic(error)
+      const errorMessage = diagnostic?.message ?? toError(error).message
+      const retryAfterMs = getRetryAfterMs(error)
+      logger.error('Member sync failed', { connectorId, runId, error: errorMessage, diagnostic })
+      try {
+        await failMemberSyncLog(runId, result, errorMessage)
+        const failureUpdate =
+          error instanceof ConnectorSyncCapacityError
+            ? {
+                memberSyncStatus: 'error' as const,
+                lastMemberSyncError: errorMessage,
+                nextMemberSyncAt: null,
+                memberSyncConsecutiveFailures: connector.memberSyncConsecutiveFailures,
+                memberSyncLockToken: null,
+                memberSyncLockLeaseAt: null,
+                updatedAt: new Date(),
+              }
+            : buildMemberSyncFailureUpdate(
+                new Date(),
+                connector.memberSyncConsecutiveFailures,
+                errorMessage,
+                retryAfterMs
+              )
+        const written = await db
+          .update(knowledgeConnector)
+          .set(failureUpdate)
+          .where(stillHoldsMemberSyncLock(connectorId, runId))
+          .returning({ id: knowledgeConnector.id })
+        if (written.length === 0) {
+          logger.warn('Member sync failure discarded — connector was reclaimed', {
+            connectorId,
+            runId,
+          })
+        }
+      } catch (recoveryError) {
+        logger.error('Failed to record member sync failure', {
           connectorId,
-          runId,
+          error:
+            getConnectorFailureDiagnostic(recoveryError)?.message ?? toError(recoveryError).message,
         })
       }
-    } catch (recoveryError) {
-      logger.error('Failed to record member sync failure', {
-        connectorId,
-        error:
-          getConnectorFailureDiagnostic(recoveryError)?.message ?? toError(recoveryError).message,
-      })
+      result.error = errorMessage
+      return result
     }
-    result.error = errorMessage
-    return result
-  }
+  })
 }
diff --git a/apps/sim/lib/knowledge/connectors/sync-engine.ts b/apps/sim/lib/knowledge/connectors/sync-engine.ts
index d1e9ef65b85..78bec1bf562 100644
--- a/apps/sim/lib/knowledge/connectors/sync-engine.ts
+++ b/apps/sim/lib/knowledge/connectors/sync-engine.ts
@@ -15,6 +15,7 @@ import {
   assertBillingAttributionSnapshot,
   type BillingAttributionSnapshot,
 } from '@/lib/billing/core/billing-attribution'
+import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import { resourceScopeFields, resourceScopeFromOwner } from '@/lib/core/resource-scope'
 import { EMPTY_ACL } from '@/lib/knowledge/access/tokens'
 import {
@@ -805,543 +806,551 @@ export async function executeSync(
     )
   }
   assertBillingAttributionOwner(billingAttribution, kbOwner)
-  /**
-   * Identifies this run for the terminal writes. Generated before the CAS and
-   * written by it, so ownership is established atomically with the lock — and
-   * reused as the sync-log row id, which makes the connector row point at the
-   * run that holds it.
-   */
-  const syncLogId = generateId()
-
-  const lockResult = await db
-    .update(knowledgeConnector)
-    .set(buildSyncLockAcquisition(syncLogId, new Date()))
-    .where(
-      and(
-        inArray(knowledgeConnector.accessMode, CONTENT_ENGINE_ACCESS_MODES),
-        eq(knowledgeConnector.id, connectorId),
-        inArray(knowledgeConnector.status, LOCKABLE_CONNECTOR_STATUSES),
-        /**
-         * Proves this run is consuming the queue entry that was made for it.
-         *
-         * A task delayed past the lease is reclaimed and replaced, and the
-         * status check alone would let that stale task take the replacement's
-         * entry — running superseded options (a plain sync where the user had
-         * just asked for a full resync) while the replacement is turned away as
-         * `sync_in_progress`. Matching the token is the same discipline
-         * {@link holdsSyncLockToken} already applies to the `syncing` phase,
-         * extended to the phase before it.
-         */
-        ...(options.dispatchToken
-          ? [eq(knowledgeConnector.syncLockToken, options.dispatchToken)]
-          : []),
-        isNull(knowledgeConnector.archivedAt),
-        isNull(knowledgeConnector.deletedAt)
-      )
-    )
-    .returning()
-
-  if (lockResult.length === 0) {
+  return withResourceOutboundScope(kbOwner, async (): Promise<SyncResult> => {
     /**
-     * Distinguishes the two ways the CAS can find no row. Costs one read on a
-     * path that already decided not to work, and the alternative is reporting a
-     * connector someone paused as a concurrency conflict.
+     * Identifies this run for the terminal writes. Generated before the CAS and
+     * written by it, so ownership is established atomically with the lock — and
+     * reused as the sync-log row id, which makes the connector row point at the
+     * run that holds it.
      */
-    const [current] = await db
-      .select({
-        status: knowledgeConnector.status,
-        syncLockToken: knowledgeConnector.syncLockToken,
-      })
-      .from(knowledgeConnector)
-      .where(eq(knowledgeConnector.id, connectorId))
-      .limit(1)
+    const syncLogId = generateId()
 
-    /**
-     * Status is checked before ownership because pausing a queued connector
-     * releases its token, so a mismatch is the *symptom* there and the status is
-     * the actual reason. Testing ownership first would report every
-     * pause-while-queued — the common case — as a superseded dispatch, losing
-     * the distinction this branch exists to draw.
-     */
-    if (current?.status === 'paused' || current?.status === 'disabled') {
-      logger.info('Connector is not accepting syncs, skipping', {
-        connectorId,
-        status: current.status,
-      })
-      return { ...result, skipReason: 'connector_not_syncable' }
-    }
+    const lockResult = await db
+      .update(knowledgeConnector)
+      .set(buildSyncLockAcquisition(syncLogId, new Date()))
+      .where(
+        and(
+          inArray(knowledgeConnector.accessMode, CONTENT_ENGINE_ACCESS_MODES),
+          eq(knowledgeConnector.id, connectorId),
+          inArray(knowledgeConnector.status, LOCKABLE_CONNECTOR_STATUSES),
+          /**
+           * Proves this run is consuming the queue entry that was made for it.
+           *
+           * A task delayed past the lease is reclaimed and replaced, and the
+           * status check alone would let that stale task take the replacement's
+           * entry — running superseded options (a plain sync where the user had
+           * just asked for a full resync) while the replacement is turned away as
+           * `sync_in_progress`. Matching the token is the same discipline
+           * {@link holdsSyncLockToken} already applies to the `syncing` phase,
+           * extended to the phase before it.
+           */
+          ...(options.dispatchToken
+            ? [eq(knowledgeConnector.syncLockToken, options.dispatchToken)]
+            : []),
+          isNull(knowledgeConnector.archivedAt),
+          isNull(knowledgeConnector.deletedAt)
+        )
+      )
+      .returning()
 
-    if (options.dispatchToken && current?.syncLockToken !== options.dispatchToken) {
-      logger.info('Sync superseded by a newer dispatch, skipping', { connectorId })
-      return { ...result, skipReason: 'dispatch_superseded' }
-    }
+    if (lockResult.length === 0) {
+      /**
+       * Distinguishes the two ways the CAS can find no row. Costs one read on a
+       * path that already decided not to work, and the alternative is reporting a
+       * connector someone paused as a concurrency conflict.
+       */
+      const [current] = await db
+        .select({
+          status: knowledgeConnector.status,
+          syncLockToken: knowledgeConnector.syncLockToken,
+        })
+        .from(knowledgeConnector)
+        .where(eq(knowledgeConnector.id, connectorId))
+        .limit(1)
 
-    logger.info('Sync already in progress, skipping', { connectorId })
-    return { ...result, skipReason: 'sync_in_progress' }
-  }
+      /**
+       * Status is checked before ownership because pausing a queued connector
+       * releases its token, so a mismatch is the *symptom* there and the status is
+       * the actual reason. Testing ownership first would report every
+       * pause-while-queued — the common case — as a superseded dispatch, losing
+       * the distinction this branch exists to draw.
+       */
+      if (current?.status === 'paused' || current?.status === 'disabled') {
+        logger.info('Connector is not accepting syncs, skipping', {
+          connectorId,
+          status: current.status,
+        })
+        return { ...result, skipReason: 'connector_not_syncable' }
+      }
 
-  /**
-   * The row returned by the lock is the authoritative sync snapshot. A source update
-   * committed before the lock is included here; one attempted after it sees `syncing`
-   * and conflicts instead of letting this worker process stale configuration.
-   */
-  const connector = lockResult[0]
-  /** The lock CAS only takes a content-engine row; this is the type's word for the same fact. */
-  if (!isContentEngineAccessMode(connector.accessMode)) {
-    throw new Error(`Connector ${connectorId} left the content engine's modes while locked`)
-  }
-  const accessMode = connector.accessMode
-  const mirrored = mirrorsSourceAcls(connector.accessMode)
-  const sourceConfig = connector.sourceConfig as Record<string, unknown>
-  const syncStartedAt = new Date()
-  const lease = createContentSyncLease(connectorId, syncLogId)
-  await db.insert(knowledgeConnectorSyncLog).values({
-    id: syncLogId,
-    connectorId,
-    status: 'started',
-    startedAt: syncStartedAt,
-  })
+      if (options.dispatchToken && current?.syncLockToken !== options.dispatchToken) {
+        logger.info('Sync superseded by a newer dispatch, skipping', { connectorId })
+        return { ...result, skipReason: 'dispatch_superseded' }
+      }
+
+      logger.info('Sync already in progress, skipping', { connectorId })
+      return { ...result, skipReason: 'sync_in_progress' }
+    }
 
-  try {
     /**
-     * OAuth credentials are workspace-scoped and shared, so the member who authorized
-     * one is often not the knowledge base owner. Resolve the credential's own account
-     * owner — token reads are scoped to `account.userId`, so passing the KB owner
-     * resolves no token at all. Resolved once here rather than inside
-     * `resolveAccessToken` so per-page refreshes don't repeat the lookup.
+     * The row returned by the lock is the authoritative sync snapshot. A source update
+     * committed before the lock is included here; one attempted after it sees `syncing`
+     * and conflicts instead of letting this worker process stale configuration.
      */
-    const credentialUserId = await resolveConnectorTokenUserId({
-      credentialId: connector.credentialId,
-      ...resourceScopeFields(resourceScopeFromOwner(kbOwner)),
-      fallbackUserId: userId,
-    })
-    if (!credentialUserId) {
-      throw new Error(
-        `Credential ${connector.credentialId} is not usable from workspace ${kbOwner.workspaceId} — reconnect the credential`
-      )
+    const connector = lockResult[0]
+    /** The lock CAS only takes a content-engine row; this is the type's word for the same fact. */
+    if (!isContentEngineAccessMode(connector.accessMode)) {
+      throw new Error(`Connector ${connectorId} left the content engine's modes while locked`)
     }
+    const accessMode = connector.accessMode
+    const mirrored = mirrorsSourceAcls(connector.accessMode)
+    const sourceConfig = connector.sourceConfig as Record<string, unknown>
+    const syncStartedAt = new Date()
+    const lease = createContentSyncLease(connectorId, syncLogId)
+    await db.insert(knowledgeConnectorSyncLog).values({
+      id: syncLogId,
+      connectorId,
+      status: 'started',
+      startedAt: syncStartedAt,
+    })
 
-    let credentialToken = await resolveAccessToken(
-      connector,
-      connectorConfig,
-      credentialUserId,
-      sourceConfig,
-      accessMode
-    )
-    /** Re-resolves the token for every OAuth call after the first, so a long run outlives a short-lived token. */
-    const refreshOAuthToken = async (): Promise<void> => {
-      if (connectorConfig.auth.mode === 'oauth') {
-        credentialToken = await resolveAccessToken(
-          connector,
-          connectorConfig,
-          credentialUserId,
-          sourceConfig,
-          accessMode
+    try {
+      /**
+       * OAuth credentials are workspace-scoped and shared, so the member who authorized
+       * one is often not the knowledge base owner. Resolve the credential's own account
+       * owner — token reads are scoped to `account.userId`, so passing the KB owner
+       * resolves no token at all. Resolved once here rather than inside
+       * `resolveAccessToken` so per-page refreshes don't repeat the lookup.
+       */
+      const credentialUserId = await resolveConnectorTokenUserId({
+        credentialId: connector.credentialId,
+        ...resourceScopeFields(resourceScopeFromOwner(kbOwner)),
+        fallbackUserId: userId,
+      })
+      if (!credentialUserId) {
+        throw new Error(
+          `Credential ${connector.credentialId} is not usable from workspace ${kbOwner.workspaceId} — reconnect the credential`
         )
       }
-    }
 
-    /**
-     * A credential that already knows its cloud id seeds the same `syncContext`
-     * slot the connector would otherwise memoise it into. Confluence discovers
-     * it by calling `accessible-resources` with a bearer token; an Atlassian
-     * service account holds an API token that cannot make that call, so for it
-     * the seed is the only source. Connectors need no service-account branch.
-     */
-    const syncContext: Record<string, unknown> = {
-      syncRunId: generateId(),
-      ...syncContextForToken(credentialToken),
-      /** Tells a connector to carry permissions with its listing; without it, none are read. */
-      ...(mirrored ? { mirrorsSourceAcls: true } : {}),
-    }
-    if (mirrored)
-      await connectorConfig.permissionConfig?.populateSyncContext(connectorId, syncContext)
+      let credentialToken = await resolveAccessToken(
+        connector,
+        connectorConfig,
+        credentialUserId,
+        sourceConfig,
+        accessMode
+      )
+      /** Re-resolves the token for every OAuth call after the first, so a long run outlives a short-lived token. */
+      const refreshOAuthToken = async (): Promise<void> => {
+        if (connectorConfig.auth.mode === 'oauth') {
+          credentialToken = await resolveAccessToken(
+            connector,
+            connectorConfig,
+            credentialUserId,
+            sourceConfig,
+            accessMode
+          )
+        }
+      }
+
+      /**
+       * A credential that already knows its cloud id seeds the same `syncContext`
+       * slot the connector would otherwise memoise it into. Confluence discovers
+       * it by calling `accessible-resources` with a bearer token; an Atlassian
+       * service account holds an API token that cannot make that call, so for it
+       * the seed is the only source. Connectors need no service-account branch.
+       */
+      const syncContext: Record<string, unknown> = {
+        syncRunId: generateId(),
+        ...syncContextForToken(credentialToken),
+        /** Tells a connector to carry permissions with its listing; without it, none are read. */
+        ...(mirrored ? { mirrorsSourceAcls: true } : {}),
+      }
+      if (mirrored)
+        await connectorConfig.permissionConfig?.populateSyncContext(connectorId, syncContext)
 
-    // Shared cutoff for both the tombstone-retry bound below and the stuck-document
-    // retry near the end of this sync — same RETRY_WINDOW_DAYS window, one computation.
-    const retryCutoff = new Date(Date.now() - RETRY_WINDOW_DAYS * 24 * 60 * 60 * 1000)
+      // Shared cutoff for both the tombstone-retry bound below and the stuck-document
+      // retry near the end of this sync — same RETRY_WINDOW_DAYS window, one computation.
+      const retryCutoff = new Date(Date.now() - RETRY_WINDOW_DAYS * 24 * 60 * 60 * 1000)
 
-    /**
-     * Bounded to the same retry window as the stuck-document retry below: a
-     * document whose refresh keeps failing every sync (e.g. permanently
-     * oversized) would otherwise be a tombstone that never resolves, forcing a
-     * full listing — and its listing-time overhead — for this connector
-     * forever. Past the window, this connector stops forcing full syncs on its
-     * account; the document itself is unaffected and stays tombstoned either way.
-     *
-     * Known accepted trade-off: once past the window, a still-tombstoned
-     * document that's unchanged-but-genuinely-present at the source can only
-     * be resurrected by a full listing — and nothing here forces one anymore.
-     * On a connector that never runs a full sync again (persistent incremental
-     * syncMode, no manual full resync), that document stays correctly
-     * invisible (excluded everywhere by `isNull(deletedAt)`, so no
-     * search/billing/listing leakage) but unresolved indefinitely. This is
-     * deliberately not "fixed" by hard-deleting it after the window expires —
-     * that would delete a document we have no positive evidence is actually
-     * gone, reintroducing the exact risk this whole design exists to avoid.
-     */
-    const hasTombstonedDocs = await db
-      .select({ id: document.id })
-      .from(document)
-      .where(
-        and(
-          eq(document.connectorId, connectorId),
-          isNull(document.archivedAt),
-          or(
-            and(isNotNull(document.deletedAt), gt(document.deletedAt, retryCutoff)),
-            isNull(document.contentHash)
+      /**
+       * Bounded to the same retry window as the stuck-document retry below: a
+       * document whose refresh keeps failing every sync (e.g. permanently
+       * oversized) would otherwise be a tombstone that never resolves, forcing a
+       * full listing — and its listing-time overhead — for this connector
+       * forever. Past the window, this connector stops forcing full syncs on its
+       * account; the document itself is unaffected and stays tombstoned either way.
+       *
+       * Known accepted trade-off: once past the window, a still-tombstoned
+       * document that's unchanged-but-genuinely-present at the source can only
+       * be resurrected by a full listing — and nothing here forces one anymore.
+       * On a connector that never runs a full sync again (persistent incremental
+       * syncMode, no manual full resync), that document stays correctly
+       * invisible (excluded everywhere by `isNull(deletedAt)`, so no
+       * search/billing/listing leakage) but unresolved indefinitely. This is
+       * deliberately not "fixed" by hard-deleting it after the window expires —
+       * that would delete a document we have no positive evidence is actually
+       * gone, reintroducing the exact risk this whole design exists to avoid.
+       */
+      const hasTombstonedDocs = await db
+        .select({ id: document.id })
+        .from(document)
+        .where(
+          and(
+            eq(document.connectorId, connectorId),
+            isNull(document.archivedAt),
+            or(
+              and(isNotNull(document.deletedAt), gt(document.deletedAt, retryCutoff)),
+              isNull(document.contentHash)
+            )
           )
         )
-      )
-      .limit(1)
-      .then((rows) => rows.length > 0)
-
-    /**
-     * Determine if this sync should be incremental. A `rehydrate` request forces a
-     * full listing too: re-hydration must see *every* document (a container page can
-     * be unchanged itself yet transclude a page that changed), and an incremental
-     * listing would omit those unchanged containers, so they'd never be re-fetched.
-     */
-    const isIncremental =
-      !mirrored &&
-      shouldRunIncrementalSync(
-        connectorConfig.supportsIncrementalSync,
-        connector.syncMode,
-        options?.fullSync,
-        options?.rehydrate,
-        hasTombstonedDocs,
-        connector.lastSyncAt
-      )
-    const lastSyncAt =
-      isIncremental && connector.lastSyncAt ? new Date(connector.lastSyncAt) : undefined
-
-    /**
-     * Re-hydrate and re-index connectors whose rendered content can drift without a
-     * hash change (transclusions) — see `ConnectorMeta.rehydrateOnFullSync`. Driven
-     * by the dedicated `rehydrate` request (the "Full resync" action) or implied by a
-     * true `fullSync`. It forces a full listing (above) and re-indexes unchanged
-     * deferred docs, but — unlike `fullSync` — it does NOT bypass any
-     * deletion-reconciliation safety guard. Incremental syncs of other connectors
-     * stay hash-gated.
-     */
-    const forceRehydrate = Boolean(
-      (options?.rehydrate || options?.fullSync) && connectorConfig.rehydrateOnFullSync
-    )
+        .limit(1)
+        .then((rows) => rows.length > 0)
 
-    let directoryRefreshed: Promise<Error | undefined> = Promise.resolve(undefined)
-    if (mirrored) {
       /**
-       * A switch into this mode hides every document before it flips, and one
-       * whose rewrite outgrew its request budget leaves the rest for the next
-       * run. It has to be finished *before this run lists anything*: the
-       * documents it did not reach are still readable by the whole workspace,
-       * and the completion write below clears the flag on the strength of this
-       * pass having left none under the mode the connector came from. The
-       * workspace-mode equivalent runs at completion instead, because restoring
-       * is safe to do last; hiding is not.
+       * Determine if this sync should be incremental. A `rehydrate` request forces a
+       * full listing too: re-hydration must see *every* document (a container page can
+       * be unchanged itself yet transclude a page that changed), and an incremental
+       * listing would omit those unchanged containers, so they'd never be re-fetched.
        */
-      if (connector.accessRewritePending) {
-        await rewriteConnectorAcls(connectorId, EMPTY_ACL, {
-          beforeBatch: lease.beatIfDue,
-          lease,
-        })
-      }
+      const isIncremental =
+        !mirrored &&
+        shouldRunIncrementalSync(
+          connectorConfig.supportsIncrementalSync,
+          connector.syncMode,
+          options?.fullSync,
+          options?.rehydrate,
+          hasTombstonedDocs,
+          connector.lastSyncAt
+        )
+      const lastSyncAt =
+        isIncremental && connector.lastSyncAt ? new Date(connector.lastSyncAt) : undefined
+
       /**
-       * Started before the listing and awaited before the ACLs are written: a
-       * group grant this crawl writes must never point at membership nobody
-       * has read, and the scheduler's refresh is a cadence, not a guarantee.
-       * Observe failures immediately while allowing content ingestion to finish.
-       * The terminal sync write below still reports directory failures.
+       * Re-hydrate and re-index connectors whose rendered content can drift without a
+       * hash change (transclusions) — see `ConnectorMeta.rehydrateOnFullSync`. Driven
+       * by the dedicated `rehydrate` request (the "Full resync" action) or implied by a
+       * true `fullSync`. It forces a full listing (above) and re-indexes unchanged
+       * deferred docs, but — unlike `fullSync` — it does NOT bypass any
+       * deletion-reconciliation safety guard. Incremental syncs of other connectors
+       * stay hash-gated.
        */
-      directoryRefreshed = refreshMirroredDirectory({
-        ...resourceScopeFields(resourceScopeFromOwner(kbOwner)),
+      const forceRehydrate = Boolean(
+        (options?.rehydrate || options?.fullSync) && connectorConfig.rehydrateOnFullSync
+      )
+
+      let directoryRefreshed: Promise<Error | undefined> = Promise.resolve(undefined)
+      if (mirrored) {
+        /**
+         * A switch into this mode hides every document before it flips, and one
+         * whose rewrite outgrew its request budget leaves the rest for the next
+         * run. It has to be finished *before this run lists anything*: the
+         * documents it did not reach are still readable by the whole workspace,
+         * and the completion write below clears the flag on the strength of this
+         * pass having left none under the mode the connector came from. The
+         * workspace-mode equivalent runs at completion instead, because restoring
+         * is safe to do last; hiding is not.
+         */
+        if (connector.accessRewritePending) {
+          await rewriteConnectorAcls(connectorId, EMPTY_ACL, {
+            beforeBatch: lease.beatIfDue,
+            lease,
+          })
+        }
+        /**
+         * Started before the listing and awaited before the ACLs are written: a
+         * group grant this crawl writes must never point at membership nobody
+         * has read, and the scheduler's refresh is a cadence, not a guarantee.
+         * Observe failures immediately while allowing content ingestion to finish.
+         * The terminal sync write below still reports directory failures.
+         */
+        directoryRefreshed = refreshMirroredDirectory({
+          ...resourceScopeFields(resourceScopeFromOwner(kbOwner)),
+          connectorConfig,
+          sourceConfig,
+          syncContext,
+          accessToken: credentialToken.accessToken,
+          force:
+            Boolean(options.fullSync) ||
+            connector.consecutiveFailures > 0 ||
+            connector.lastSyncError?.startsWith(DIRECTORY_ERROR_PREFIX),
+        }).then(() => undefined, toError)
+      }
+
+      const contentPass = await runConnectorContentPass({
+        connectorId,
+        connector,
         connectorConfig,
         sourceConfig,
         syncContext,
-        accessToken: credentialToken.accessToken,
-        force:
-          Boolean(options.fullSync) ||
-          connector.consecutiveFailures > 0 ||
-          connector.lastSyncError?.startsWith(DIRECTORY_ERROR_PREFIX),
-      }).then(() => undefined, toError)
-    }
-
-    const contentPass = await runConnectorContentPass({
-      connectorId,
-      connector,
-      connectorConfig,
-      sourceConfig,
-      syncContext,
-      lastSyncAt,
-      kbOwner,
-      billingAttribution,
-      result,
-      forceRehydrate,
-      getAccessToken: async (pageNum) => {
-        if (pageNum > 0) await refreshOAuthToken()
-        return credentialToken.accessToken
-      },
-      hydration: {
-        concurrency: connectorConfig.contentConcurrency,
-        beforeHydration: refreshOAuthToken,
-        getDocument: (externalId) =>
-          connectorConfig.getDocument(
-            credentialToken.accessToken,
-            sourceConfig,
-            externalId,
-            syncContext
-          ),
-      },
-      lease,
-      documentAccess: connector.accessMode,
-      runId: syncLogId,
-      leaseKind: 'content',
-      fingerprint: listingFingerprint({
-        connectorType: connector.connectorType,
-        credentialId: connector.credentialId,
-        encryptedApiKey: connector.encryptedApiKey,
-        sourceConfig,
-        accessMode: connector.accessMode,
-      }),
-      fullSync: options.fullSync,
-      deadlineAt: syncStartedAt.getTime() + (CONNECTOR_SYNC_MAX_DURATION_SECONDS - 300) * 1000,
-      onPage: mirrored
-        ? async (externalDocs, generationStartedAt) => {
-            await directoryRefreshed
-            await applySourceMirroredAcls({
-              connectorId,
-              connectorConfig,
+        lastSyncAt,
+        kbOwner,
+        billingAttribution,
+        result,
+        forceRehydrate,
+        getAccessToken: async (pageNum) => {
+          if (pageNum > 0) await refreshOAuthToken()
+          return credentialToken.accessToken
+        },
+        hydration: {
+          concurrency: connectorConfig.contentConcurrency,
+          beforeHydration: refreshOAuthToken,
+          getDocument: (externalId) =>
+            connectorConfig.getDocument(
+              credentialToken.accessToken,
               sourceConfig,
-              syncContext,
-              accessToken: credentialToken.accessToken,
-              externalDocs,
-              generationStartedAt,
-              ownedExternalIds: [],
-              lease,
-            })
-          }
-        : undefined,
-    })
+              externalId,
+              syncContext
+            ),
+        },
+        lease,
+        documentAccess: connector.accessMode,
+        runId: syncLogId,
+        leaseKind: 'content',
+        fingerprint: listingFingerprint({
+          connectorType: connector.connectorType,
+          credentialId: connector.credentialId,
+          encryptedApiKey: connector.encryptedApiKey,
+          sourceConfig,
+          accessMode: connector.accessMode,
+        }),
+        fullSync: options.fullSync,
+        deadlineAt: syncStartedAt.getTime() + (CONNECTOR_SYNC_MAX_DURATION_SECONDS - 300) * 1000,
+        onPage: mirrored
+          ? async (externalDocs, generationStartedAt) => {
+              await directoryRefreshed
+              await applySourceMirroredAcls({
+                connectorId,
+                connectorConfig,
+                sourceConfig,
+                syncContext,
+                accessToken: credentialToken.accessToken,
+                externalDocs,
+                generationStartedAt,
+                ownedExternalIds: [],
+                lease,
+              })
+            }
+          : undefined,
+      })
 
-    result.listingIncomplete = isContentPassIncomplete(contentPass)
-    const reconciliationHoldNotice = contentPass.holdNotice
-    const directoryError = await directoryRefreshed
-    if (directoryError) throw directoryError
+      result.listingIncomplete = isContentPassIncomplete(contentPass)
+      const reconciliationHoldNotice = contentPass.holdNotice
+      const directoryError = await directoryRefreshed
+      if (directoryError) throw directoryError
 
-    const postBatchPresence = await checkSyncTargetPresence(connectorId, connector.knowledgeBaseId)
-    if (postBatchPresence.connectorDeleted) {
-      throw new ConnectorDeletedException(connectorId)
-    }
-    if (postBatchPresence.knowledgeBaseDeleted) {
-      throw new Error(`Knowledge base ${connector.knowledgeBaseId} was deleted during sync`)
-    }
-
-    await sweepStuckDocuments({
-      connectorId,
-      knowledgeBaseId: connector.knowledgeBaseId,
-      syncStartedAt,
-      retryCutoff,
-      billingAttribution,
-      result,
-      lease,
-    })
+      const postBatchPresence = await checkSyncTargetPresence(
+        connectorId,
+        connector.knowledgeBaseId
+      )
+      if (postBatchPresence.connectorDeleted) {
+        throw new ConnectorDeletedException(connectorId)
+      }
+      if (postBatchPresence.knowledgeBaseDeleted) {
+        throw new Error(`Knowledge base ${connector.knowledgeBaseId} was deleted during sync`)
+      }
 
-    const completionLanded = await completeSuccessfulSync(
-      connectorId,
-      connector.knowledgeBaseId,
-      syncLogId,
-      effectiveConnectorSyncIntervalMinutes(connector.accessMode, connector.syncIntervalMinutes),
-      result,
-      reconciliationHoldNotice,
-      contentPass
-    )
+      await sweepStuckDocuments({
+        connectorId,
+        knowledgeBaseId: connector.knowledgeBaseId,
+        syncStartedAt,
+        retryCutoff,
+        billingAttribution,
+        result,
+        lease,
+      })
 
-    if (!completionLanded) {
-      logger.warn('Sync result discarded — connector was reclaimed while this run was executing', {
+      const completionLanded = await completeSuccessfulSync(
         connectorId,
+        connector.knowledgeBaseId,
         syncLogId,
-        ...result,
-      })
-      return markSyncSuperseded(result)
-    }
+        effectiveConnectorSyncIntervalMinutes(connector.accessMode, connector.syncIntervalMinutes),
+        result,
+        reconciliationHoldNotice,
+        contentPass
+      )
 
-    logger.info('Sync completed', { connectorId, ...result })
-    return result
-  } catch (error) {
-    let connectorDeleted = error instanceof ConnectorDeletedException
-    if (error instanceof SyncLockLostException) {
-      /** A checkpoint can discover an archive before the next batch's presence check. */
-      const [ownedArchive] = await db
-        .select({
-          archivedAt: knowledgeConnector.archivedAt,
-          deletedAt: knowledgeConnector.deletedAt,
-        })
-        .from(knowledgeConnector)
-        .where(
-          and(
-            holdsSyncLockToken(connectorId, syncLogId),
-            or(isNotNull(knowledgeConnector.archivedAt), isNotNull(knowledgeConnector.deletedAt))
-          )
+      if (!completionLanded) {
+        logger.warn(
+          'Sync result discarded — connector was reclaimed while this run was executing',
+          {
+            connectorId,
+            syncLogId,
+            ...result,
+          }
         )
-        .limit(1)
-      connectorDeleted = Boolean(ownedArchive?.archivedAt || ownedArchive?.deletedAt)
-      if (!connectorDeleted) {
-        /** A replacement-owned connector must receive no writes from this run. */
-        logger.warn('Sync abandoned — lock was reclaimed while this run was executing', {
-          connectorId,
-          syncLogId,
-          ...result,
-        })
         return markSyncSuperseded(result)
       }
-    }
-
-    if (connectorDeleted) {
-      logger.info('Connector deleted during sync, cleaning up', { connectorId })
 
-      try {
-        await releaseSyncLockOnDeletedConnector(connectorId, syncLogId)
+      logger.info('Sync completed', { connectorId, ...result })
+      return result
+    } catch (error) {
+      let connectorDeleted = error instanceof ConnectorDeletedException
+      if (error instanceof SyncLockLostException) {
+        /** A checkpoint can discover an archive before the next batch's presence check. */
+        const [ownedArchive] = await db
+          .select({
+            archivedAt: knowledgeConnector.archivedAt,
+            deletedAt: knowledgeConnector.deletedAt,
+          })
+          .from(knowledgeConnector)
+          .where(
+            and(
+              holdsSyncLockToken(connectorId, syncLogId),
+              or(isNotNull(knowledgeConnector.archivedAt), isNotNull(knowledgeConnector.deletedAt))
+            )
+          )
+          .limit(1)
+        connectorDeleted = Boolean(ownedArchive?.archivedAt || ownedArchive?.deletedAt)
+        if (!connectorDeleted) {
+          /** A replacement-owned connector must receive no writes from this run. */
+          logger.warn('Sync abandoned — lock was reclaimed while this run was executing', {
+            connectorId,
+            syncLogId,
+            ...result,
+          })
+          return markSyncSuperseded(result)
+        }
+      }
 
-        /**
-         * Includes pending-removal tombstones. Page IDs so deleting a connector
-         * with a legacy corpus above the sync admission cap cannot materialize
-         * the entire corpus in the cleanup worker.
-         */
-        let afterDocumentId: string | undefined
-        while (true) {
-          const connectorDocs = await db
-            .select({ id: document.id })
-            .from(document)
-            .where(
-              and(
-                eq(document.connectorId, connectorId),
-                isNull(document.archivedAt),
-                afterDocumentId ? gt(document.id, afterDocumentId) : undefined
+      if (connectorDeleted) {
+        logger.info('Connector deleted during sync, cleaning up', { connectorId })
+
+        try {
+          await releaseSyncLockOnDeletedConnector(connectorId, syncLogId)
+
+          /**
+           * Includes pending-removal tombstones. Page IDs so deleting a connector
+           * with a legacy corpus above the sync admission cap cannot materialize
+           * the entire corpus in the cleanup worker.
+           */
+          let afterDocumentId: string | undefined
+          while (true) {
+            const connectorDocs = await db
+              .select({ id: document.id })
+              .from(document)
+              .where(
+                and(
+                  eq(document.connectorId, connectorId),
+                  isNull(document.archivedAt),
+                  afterDocumentId ? gt(document.id, afterDocumentId) : undefined
+                )
               )
+              .orderBy(asc(document.id))
+              .limit(CONNECTOR_DELETION_CLEANUP_BATCH_SIZE)
+            if (connectorDocs.length === 0) break
+
+            await hardDeleteDocuments(
+              connectorDocs.map((doc) => doc.id),
+              syncLogId,
+              connectorId
             )
-            .orderBy(asc(document.id))
-            .limit(CONNECTOR_DELETION_CLEANUP_BATCH_SIZE)
-          if (connectorDocs.length === 0) break
+            afterDocumentId = connectorDocs.at(-1)?.id
+            if (connectorDocs.length < CONNECTOR_DELETION_CLEANUP_BATCH_SIZE) break
+          }
 
-          await hardDeleteDocuments(
-            connectorDocs.map((doc) => doc.id),
-            syncLogId,
-            connectorId
-          )
-          afterDocumentId = connectorDocs.at(-1)?.id
-          if (connectorDocs.length < CONNECTOR_DELETION_CLEANUP_BATCH_SIZE) break
+          await completeSyncLog(syncLogId, 'failed', result, {
+            errorMessage: 'Connector deleted during sync',
+          })
+        } catch (cleanupError) {
+          logger.error('Failed to clean up after connector deletion', {
+            connectorId,
+            error: toError(cleanupError).message,
+          })
         }
 
-        await completeSyncLog(syncLogId, 'failed', result, {
-          errorMessage: 'Connector deleted during sync',
-        })
-      } catch (cleanupError) {
-        logger.error('Failed to clean up after connector deletion', {
-          connectorId,
-          error: toError(cleanupError).message,
-        })
+        result.skipReason = 'connector_deleted_during_sync'
+        return result
       }
 
-      result.skipReason = 'connector_deleted_during_sync'
-      return result
-    }
-
-    if (getConnectorSyncDeferral(error)) {
-      try {
-        result.deferred = await deferConnectorSync({
-          connectorId,
-          knowledgeBaseId: connector.knowledgeBaseId,
-          runId: syncLogId,
-          lease,
-          kind: 'content',
-          result,
-          error,
-        })
-        result.listingIncomplete = true
-        logger.info('Connector source sync deferred', {
-          connectorId,
-          ...result.deferred,
-          docsAdvanced:
-            result.docsAdded + result.docsUpdated + result.docsUnchanged + result.docsSkipped,
-        })
-        return result
-      } catch (persistenceError) {
-        logger.error('Failed to persist connector source deferral', {
-          connectorId,
-          error:
-            getConnectorFailureDiagnostic(persistenceError)?.message ??
-            toError(persistenceError).message,
-        })
-        result.error = 'Could not persist the connector retry after provider deferral'
-        return result
+      if (getConnectorSyncDeferral(error)) {
+        try {
+          result.deferred = await deferConnectorSync({
+            connectorId,
+            knowledgeBaseId: connector.knowledgeBaseId,
+            runId: syncLogId,
+            lease,
+            kind: 'content',
+            result,
+            error,
+          })
+          result.listingIncomplete = true
+          logger.info('Connector source sync deferred', {
+            connectorId,
+            ...result.deferred,
+            docsAdvanced:
+              result.docsAdded + result.docsUpdated + result.docsUnchanged + result.docsSkipped,
+          })
+          return result
+        } catch (persistenceError) {
+          logger.error('Failed to persist connector source deferral', {
+            connectorId,
+            error:
+              getConnectorFailureDiagnostic(persistenceError)?.message ??
+              toError(persistenceError).message,
+          })
+          result.error = 'Could not persist the connector retry after provider deferral'
+          return result
+        }
       }
-    }
 
-    const diagnostic = getConnectorFailureDiagnostic(error)
-    const errorMessage = diagnostic?.message ?? toError(error).message
-    const retryAfterMs = getRetryAfterMs(error)
-    const rateLimited = isRateLimitError(error)
-    logger.error('Sync failed', {
-      connectorId,
-      diagnostic,
-      error: errorMessage,
-      ...(retryAfterMs === undefined ? {} : { retryAfterMs }),
-    })
+      const diagnostic = getConnectorFailureDiagnostic(error)
+      const errorMessage = diagnostic?.message ?? toError(error).message
+      const retryAfterMs = getRetryAfterMs(error)
+      const rateLimited = isRateLimitError(error)
+      logger.error('Sync failed', {
+        connectorId,
+        diagnostic,
+        error: errorMessage,
+        ...(retryAfterMs === undefined ? {} : { retryAfterMs }),
+      })
 
-    try {
-      await completeSyncLog(syncLogId, 'failed', result, { errorMessage })
-
-      const failureUpdate =
-        error instanceof ConnectorSyncCapacityError
-          ? buildSyncCapacityUpdate(new Date(), connector.consecutiveFailures, errorMessage)
-          : rateLimited
-            ? buildSyncRateLimitUpdate(
-                new Date(),
-                connector.consecutiveFailures,
-                errorMessage,
-                retryAfterMs
-              )
-            : buildSyncFailureUpdate(
-                new Date(),
-                connector.consecutiveFailures,
-                errorMessage,
-                retryAfterMs
-              )
+      try {
+        await completeSyncLog(syncLogId, 'failed', result, { errorMessage })
+
+        const failureUpdate =
+          error instanceof ConnectorSyncCapacityError
+            ? buildSyncCapacityUpdate(new Date(), connector.consecutiveFailures, errorMessage)
+            : rateLimited
+              ? buildSyncRateLimitUpdate(
+                  new Date(),
+                  connector.consecutiveFailures,
+                  errorMessage,
+                  retryAfterMs
+                )
+              : buildSyncFailureUpdate(
+                  new Date(),
+                  connector.consecutiveFailures,
+                  errorMessage,
+                  retryAfterMs
+                )
+
+        if (failureUpdate.status === 'disabled') {
+          logger.warn('Connector disabled after repeated failures', {
+            connectorId,
+            consecutiveFailures: failureUpdate.consecutiveFailures,
+          })
+        }
+
+        const failureWriteLanded = await writeTerminalConnectorState(
+          connectorId,
+          syncLogId,
+          failureUpdate
+        )
 
-      if (failureUpdate.status === 'disabled') {
-        logger.warn('Connector disabled after repeated failures', {
+        /**
+         * Deliberately does NOT get {@link markSyncSuperseded}. `result.error`
+         * is set to the real failure cause below, so replacing it with lifecycle
+         * control flow would destroy the diagnostic. The supersession is carried
+         * by this log line instead.
+         */
+        if (!failureWriteLanded) {
+          logger.warn(
+            'Sync failure discarded — connector was reclaimed while this run was executing',
+            { connectorId, syncLogId, error: errorMessage }
+          )
+        }
+      } catch (recoveryError) {
+        logger.error('Failed to record sync failure', {
           connectorId,
-          consecutiveFailures: failureUpdate.consecutiveFailures,
+          error:
+            getConnectorFailureDiagnostic(recoveryError)?.message ?? toError(recoveryError).message,
         })
       }
 
-      const failureWriteLanded = await writeTerminalConnectorState(
-        connectorId,
-        syncLogId,
-        failureUpdate
-      )
-
-      /**
-       * Deliberately does NOT get {@link markSyncSuperseded}. `result.error`
-       * is set to the real failure cause below, so replacing it with lifecycle
-       * control flow would destroy the diagnostic. The supersession is carried
-       * by this log line instead.
-       */
-      if (!failureWriteLanded) {
-        logger.warn(
-          'Sync failure discarded — connector was reclaimed while this run was executing',
-          { connectorId, syncLogId, error: errorMessage }
-        )
-      }
-    } catch (recoveryError) {
-      logger.error('Failed to record sync failure', {
-        connectorId,
-        error:
-          getConnectorFailureDiagnostic(recoveryError)?.message ?? toError(recoveryError).message,
-      })
+      result.error = errorMessage
+      return result
     }
-
-    result.error = errorMessage
-    return result
-  }
+  })
 }
diff --git a/apps/sim/lib/knowledge/documents/secure-fetch.server.test.ts b/apps/sim/lib/knowledge/documents/secure-fetch.server.test.ts
new file mode 100644
index 00000000000..f9a1d28421d
--- /dev/null
+++ b/apps/sim/lib/knowledge/documents/secure-fetch.server.test.ts
@@ -0,0 +1,79 @@
+/** @vitest-environment node */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  route: vi.fn(),
+  gatewayFetch: vi.fn(),
+  directFetch: vi.fn(),
+}))
+vi.mock('@/lib/core/network/context.server', () => ({
+  resolveCurrentOutboundRoute: mocks.route,
+}))
+vi.mock('@/lib/core/security/input-validation.server', () => ({
+  createSsrfGuardedFetchWithDispatcher: () => ({ fetch: mocks.gatewayFetch }),
+  secureFetchWithValidation: vi.fn(),
+}))
+
+import { OutboundRoutingError } from '@/lib/core/network/routing'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+
+const url = 'https://api.example.invalid/items'
+const noRetries = { maxRetries: 0, retryBudgetMs: 1_000 }
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  vi.stubGlobal('fetch', mocks.directFetch)
+  mocks.route.mockResolvedValue({ kind: 'direct' })
+  mocks.directFetch.mockImplementation(async () => new Response('direct'))
+  mocks.gatewayFetch.mockImplementation(async () => new Response('gateway'))
+})
+afterEach(() => vi.unstubAllGlobals())
+
+describe('connector request routing', () => {
+  it('preserves native fetch and request options for direct organizations', async () => {
+    const response = await fetchWithRetry(
+      url,
+      { method: 'POST', body: 'payload', headers: { authorization: 'Bearer test' } },
+      noRetries
+    )
+    expect(await response.text()).toBe('direct')
+    expect(mocks.directFetch).toHaveBeenCalledWith(url, {
+      method: 'POST',
+      body: 'payload',
+      headers: { authorization: 'Bearer test' },
+      signal: expect.any(AbortSignal),
+    })
+    expect(mocks.gatewayFetch).not.toHaveBeenCalled()
+  })
+
+  it('uses the validated gateway transport for a managed organization', async () => {
+    mocks.route.mockResolvedValue({ kind: 'gateway' })
+    const response = await fetchWithRetry(url, {}, noRetries)
+    expect(await response.text()).toBe('gateway')
+    expect(mocks.directFetch).not.toHaveBeenCalled()
+  })
+
+  it('reads policy after provider admission and never bypasses a revoked route', async () => {
+    const fetcher = vi.fn(
+      async (input: RequestInfo | URL, init: RequestInit, transport: typeof fetch) => {
+        mocks.route.mockRejectedValue(new OutboundRoutingError('ROUTE_BLOCKED'))
+        return transport(input, init)
+      }
+    )
+    await expect(fetchWithRetry(url, {}, { ...noRetries, fetcher })).rejects.toMatchObject({
+      code: 'ROUTE_BLOCKED',
+    })
+    expect(fetcher).toHaveBeenCalledOnce()
+    expect(mocks.directFetch).not.toHaveBeenCalled()
+    expect(mocks.gatewayFetch).not.toHaveBeenCalled()
+  })
+
+  it('does not fall back to native fetch after gateway failure', async () => {
+    mocks.route.mockResolvedValue({ kind: 'gateway' })
+    mocks.gatewayFetch.mockRejectedValue(new OutboundRoutingError('GATEWAY_UNAVAILABLE'))
+    await expect(fetchWithRetry(url, {}, noRetries)).rejects.toMatchObject({
+      code: 'GATEWAY_UNAVAILABLE',
+    })
+    expect(mocks.directFetch).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/sim/lib/knowledge/documents/secure-fetch.server.ts b/apps/sim/lib/knowledge/documents/secure-fetch.server.ts
index 24cd4814dc8..27302ee9442 100644
--- a/apps/sim/lib/knowledge/documents/secure-fetch.server.ts
+++ b/apps/sim/lib/knowledge/documents/secure-fetch.server.ts
@@ -1,4 +1,6 @@
+import { resolveCurrentOutboundRoute } from '@/lib/core/network/context.server'
 import {
+  createSsrfGuardedFetchWithDispatcher,
   type SecureFetchOptions,
   type SecureFetchResponse,
   secureFetchWithValidation,
@@ -57,3 +59,62 @@ export async function secureFetchWithRetry(
     return response
   }, retry)
 }
+
+const DEFAULT_FETCH_RETRY_BUDGET_MS = 150_000
+let connectorTransport: ReturnType<typeof createSsrfGuardedFetchWithDispatcher> | undefined
+
+/**
+ * Bounds requests and response bodies within one retry budget.
+ */
+export async function fetchWithRetry(
+  url: string,
+  options: RequestInit = {},
+  retryOptions: RetryOptions = {}
+): Promise<Response> {
+  const callerSignal = options.signal
+    ? retryOptions.signal
+      ? AbortSignal.any([options.signal, retryOptions.signal])
+      : options.signal
+    : retryOptions.signal
+
+  return retryWithExponentialBackoff(
+    async (signal, deadlineAt) => {
+      /** The fetch deadline stays active while callers consume the returned response body. */
+      const requestSignal = AbortSignal.any([
+        signal,
+        AbortSignal.timeout(Math.max(0, Math.ceil(deadlineAt - Date.now()))),
+      ])
+      const transport: typeof fetch = async (input, init) => {
+        const route = await resolveCurrentOutboundRoute()
+        if (route.kind === 'direct') return fetch(input, init)
+        connectorTransport ??= createSsrfGuardedFetchWithDispatcher({
+          profile: 'configuredEndpoint',
+        })
+        return connectorTransport.fetch(input, init)
+      }
+      const init = { ...options, signal: requestSignal }
+      const response = retryOptions.fetcher
+        ? await retryOptions.fetcher(url, init, transport)
+        : await transport(url, init)
+
+      if (
+        !response.ok &&
+        isRetryableError({ status: response.status, headers: response.headers })
+      ) {
+        throw await createRetryableHttpError(response)
+      }
+
+      return response
+    },
+    {
+      ...retryOptions,
+      retryBudgetMs: retryOptions.retryBudgetMs ?? DEFAULT_FETCH_RETRY_BUDGET_MS,
+      maxRetryAfterMs:
+        retryOptions.maxRetryAfterMs ??
+        retryOptions.retryBudgetMs ??
+        retryOptions.maxDelayMs ??
+        30_000,
+      signal: callerSignal,
+    }
+  )
+}
diff --git a/apps/sim/lib/knowledge/documents/service.ts b/apps/sim/lib/knowledge/documents/service.ts
index 65eb4b14f95..188a5c0308d 100644
--- a/apps/sim/lib/knowledge/documents/service.ts
+++ b/apps/sim/lib/knowledge/documents/service.ts
@@ -53,6 +53,7 @@ import { resolveTriggerRegion } from '@/lib/core/async-jobs/region'
 import { env, envNumber } from '@/lib/core/config/env'
 import { getCostMultiplier, isTriggerDevEnabled } from '@/lib/core/config/env-flags'
 import { isInsideTriggerRun } from '@/lib/core/config/trigger-runtime'
+import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import type { ProviderCapacityDeferredError } from '@/lib/core/rate-limiter/provider-capacity-error'
 import { mapWithConcurrency } from '@/lib/core/utils/concurrency'
@@ -1540,482 +1541,487 @@ export async function processDocumentAsync(
 
     const ctx = contextRows[0]
     processingFilename = ctx.filename
-    const persistedDocData = {
-      filename: ctx.filename,
-      fileUrl: ctx.fileUrl,
-      fileSize: ctx.fileSize,
-      mimeType: ctx.mimeType,
-    }
+    await withResourceOutboundScope(ctx, async () => {
+      const persistedDocData = {
+        filename: ctx.filename,
+        fileUrl: ctx.fileUrl,
+        fileSize: ctx.fileSize,
+        mimeType: ctx.mimeType,
+      }
 
-    /**
-     * Claiming is guarded by both completion status and queue generation.
-     *
-     * Without a status predicate this write was reachable for a finished
-     * document — a late or duplicate dispatch would flip `completed` back to
-     * `processing`, discard the pass that had already indexed and billed, and
-     * index it a second time. `pending`, `failed`, and `processing` remain
-     * claimable so a Trigger retry can recover if an earlier attempt threw
-     * before persisting its failure. Queued workers also match the exact stamp
-     * carried in their payload. A retry or recovery sweep re-stamps the row, so
-     * an older delayed quota continuation becomes a harmless no-op instead of
-     * stealing the newer pass.
-     */
-    /**
-     * Queue acceptance can precede the parent's pending-state write. The published
-     * successor may adopt that exact processing generation; stamping its token
-     * fences the parent's delayed write and refunds admission at most once.
-     */
-    const predecessor =
-      attemptContext?.processingQueueToken && attemptContext.processingPredecessorToken
-        ? and(
-            eq(document.processingStatus, 'processing'),
-            eq(document.processingQueueToken, attemptContext.processingPredecessorToken)
+      /**
+       * Claiming is guarded by both completion status and queue generation.
+       *
+       * Without a status predicate this write was reachable for a finished
+       * document — a late or duplicate dispatch would flip `completed` back to
+       * `processing`, discard the pass that had already indexed and billed, and
+       * index it a second time. `pending`, `failed`, and `processing` remain
+       * claimable so a Trigger retry can recover if an earlier attempt threw
+       * before persisting its failure. Queued workers also match the exact stamp
+       * carried in their payload. A retry or recovery sweep re-stamps the row, so
+       * an older delayed quota continuation becomes a harmless no-op instead of
+       * stealing the newer pass.
+       */
+      /**
+       * Queue acceptance can precede the parent's pending-state write. The published
+       * successor may adopt that exact processing generation; stamping its token
+       * fences the parent's delayed write and refunds admission at most once.
+       */
+      const predecessor =
+        attemptContext?.processingQueueToken && attemptContext.processingPredecessorToken
+          ? and(
+              eq(document.processingStatus, 'processing'),
+              eq(document.processingQueueToken, attemptContext.processingPredecessorToken)
+            )
+          : undefined
+      const claimed = await db
+        .update(document)
+        .set({
+          processingStatus: 'processing',
+          processingStartedAt,
+          processingDeferredUntil: null,
+          processingCompletedAt: null,
+          processingError: null,
+          ...(attemptContext?.processingQueueToken
+            ? { processingQueueToken: attemptContext.processingQueueToken }
+            : {}),
+          ...(predecessor && attemptContext?.refundPredecessorAdmission
+            ? {
+                processingAttempts: sql`CASE WHEN ${document.processingQueueToken} = ${attemptContext.processingPredecessorToken} THEN GREATEST(${document.processingAttempts} - 1, 0) ELSE ${document.processingAttempts} END`,
+              }
+            : {}),
+        })
+        .where(
+          and(
+            eq(document.id, documentId),
+            inArray(document.processingStatus, ['pending', 'processing', 'failed']),
+            not(skippedDocumentCondition()),
+            ...(predecessor
+              ? [or(and(...queueGenerationConditions(attemptContext)), predecessor)]
+              : queueGenerationConditions(attemptContext)),
+            eq(document.userExcluded, false),
+            isNull(document.archivedAt),
+            isNull(document.deletedAt)
           )
-        : undefined
-    const claimed = await db
-      .update(document)
-      .set({
-        processingStatus: 'processing',
-        processingStartedAt,
-        processingDeferredUntil: null,
-        processingCompletedAt: null,
-        processingError: null,
-        ...(attemptContext?.processingQueueToken
-          ? { processingQueueToken: attemptContext.processingQueueToken }
-          : {}),
-        ...(predecessor && attemptContext?.refundPredecessorAdmission
-          ? {
-              processingAttempts: sql`CASE WHEN ${document.processingQueueToken} = ${attemptContext.processingPredecessorToken} THEN GREATEST(${document.processingAttempts} - 1, 0) ELSE ${document.processingAttempts} END`,
-            }
-          : {}),
-      })
-      .where(
-        and(
-          eq(document.id, documentId),
-          inArray(document.processingStatus, ['pending', 'processing', 'failed']),
-          not(skippedDocumentCondition()),
-          ...(predecessor
-            ? [or(and(...queueGenerationConditions(attemptContext)), predecessor)]
-            : queueGenerationConditions(attemptContext)),
-          eq(document.userExcluded, false),
-          isNull(document.archivedAt),
-          isNull(document.deletedAt)
         )
-      )
-      .returning({ id: document.id })
+        .returning({ id: document.id })
 
-    if (claimed.length === 0) {
-      logger.info(
-        `[${documentId}] Skipping document processing: superseded, already active, completed, archived, or deleted`
-      )
-      return
-    }
+      if (claimed.length === 0) {
+        logger.info(
+          `[${documentId}] Skipping document processing: superseded, already active, completed, archived, or deleted`
+        )
+        return
+      }
 
-    attemptContext?.onClaimed?.()
-
-    logger.info(`[${documentId}] Status updated to 'processing', starting document processor`)
-
-    const rawConfig = ctx.chunkingConfig as {
-      maxSize?: number
-      minSize?: number
-      overlap?: number
-      strategy?: ChunkingStrategy
-      strategyOptions?: StrategyOptions
-    } | null
-    const kbConfig = {
-      maxSize: rawConfig?.maxSize ?? 1024,
-      minSize: rawConfig?.minSize ?? 100,
-      overlap: rawConfig?.overlap ?? 200,
-    }
+      attemptContext?.onClaimed?.()
+
+      logger.info(`[${documentId}] Status updated to 'processing', starting document processor`)
+
+      const rawConfig = ctx.chunkingConfig as {
+        maxSize?: number
+        minSize?: number
+        overlap?: number
+        strategy?: ChunkingStrategy
+        strategyOptions?: StrategyOptions
+      } | null
+      const kbConfig = {
+        maxSize: rawConfig?.maxSize ?? 1024,
+        minSize: rawConfig?.minSize ?? 100,
+        overlap: rawConfig?.overlap ?? 200,
+      }
 
-    const kbEmbedding: KbEmbeddingTarget = {
-      model: ctx.embeddingModel,
-      dimensions: toKbEmbeddingDimensions(ctx.embeddingDimension),
-    }
-    const kbEmbeddingModel = kbEmbedding.model
-    const queuedBillingContext = hasDocumentProcessingBillingScope(providedBillingContext)
-      ? assertDocumentProcessingBillingContext(providedBillingContext)
-      : undefined
-    const restoredBillingAttribution =
-      queuedBillingContext && queuedBillingContext.billingScope !== 'non-workspace'
-        ? queuedBillingContext.billingAttribution
-        : providedBillingContext && !queuedBillingContext
-          ? assertBillingAttributionSnapshot(providedBillingContext)
-          : undefined
-    if (queuedBillingContext?.billingScope === 'non-workspace') {
-      throw new Error('Document processing billing scope does not match knowledge base ownership')
-    }
-    if (!restoredBillingAttribution) {
-      throw new Error('Billing attribution is required for queued document processing')
-    }
-    const billingAttribution = restoredBillingAttribution
-    assertBillingAttributionOwner(billingAttribution, ctx)
-    const documentActorUserId = billingAttribution.actorUserId
-
-    const usageGate = await checkIngestionUsageLimits(billingAttribution)
-    if (usageGate.isExceeded) {
-      logger.warn(`[${documentId}] Usage limit reached — skipping document indexing`)
-      throw new UsageLimitDocumentProcessingError(
-        usageGate.message ?? 'Usage limit exceeded. Please upgrade your plan to continue.'
-      )
-    }
-    let billableEmbeddingTokens = 0
-    let embeddingModelName = kbEmbeddingModel
-    let embeddingPricingId = kbEmbeddingModel
+      const kbEmbedding: KbEmbeddingTarget = {
+        model: ctx.embeddingModel,
+        dimensions: toKbEmbeddingDimensions(ctx.embeddingDimension),
+      }
+      const kbEmbeddingModel = kbEmbedding.model
+      const queuedBillingContext = hasDocumentProcessingBillingScope(providedBillingContext)
+        ? assertDocumentProcessingBillingContext(providedBillingContext)
+        : undefined
+      const restoredBillingAttribution =
+        queuedBillingContext && queuedBillingContext.billingScope !== 'non-workspace'
+          ? queuedBillingContext.billingAttribution
+          : providedBillingContext && !queuedBillingContext
+            ? assertBillingAttributionSnapshot(providedBillingContext)
+            : undefined
+      if (queuedBillingContext?.billingScope === 'non-workspace') {
+        throw new Error('Document processing billing scope does not match knowledge base ownership')
+      }
+      if (!restoredBillingAttribution) {
+        throw new Error('Billing attribution is required for queued document processing')
+      }
+      const billingAttribution = restoredBillingAttribution
+      assertBillingAttributionOwner(billingAttribution, ctx)
+      const documentActorUserId = billingAttribution.actorUserId
+
+      const usageGate = await checkIngestionUsageLimits(billingAttribution)
+      if (usageGate.isExceeded) {
+        logger.warn(`[${documentId}] Usage limit reached — skipping document indexing`)
+        throw new UsageLimitDocumentProcessingError(
+          usageGate.message ?? 'Usage limit exceeded. Please upgrade your plan to continue.'
+        )
+      }
+      let billableEmbeddingTokens = 0
+      let embeddingModelName = kbEmbeddingModel
+      let embeddingPricingId = kbEmbeddingModel
 
-    const currentSourceFileProvenance = await loadCurrentSourceFileSecretProvenance({
-      fileUrl: persistedDocData.fileUrl,
-      workspaceId: ctx.workspaceId,
-    })
-    const documentSecretContext = await loadKnowledgeDocumentSecretRegistry(
-      documentId,
-      {
-        userId: documentActorUserId,
-        ...(ctx.workspaceId ? { workspaceId: ctx.workspaceId } : {}),
-      },
-      currentSourceFileProvenance
-    )
+      const currentSourceFileProvenance = await loadCurrentSourceFileSecretProvenance({
+        fileUrl: persistedDocData.fileUrl,
+        workspaceId: ctx.workspaceId,
+      })
+      const documentSecretContext = await loadKnowledgeDocumentSecretRegistry(
+        documentId,
+        {
+          userId: documentActorUserId,
+          ...(ctx.workspaceId ? { workspaceId: ctx.workspaceId } : {}),
+        },
+        currentSourceFileProvenance
+      )
 
-    let processingCommitted = false
-    const processingDeadlineAt = Math.min(
-      startTime + TIMEOUTS.OVERALL_PROCESSING - 15_000,
-      (attemptContext?.deadlineAt ?? Number.POSITIVE_INFINITY) - 15_000
-    )
-    await withTimeout(
-      (signal) =>
-        runWithKnowledgeModelInputProvenance(
-          documentSecretContext.registry,
-          async () => {
-            await assertKnowledgeEmbeddingCapacity({
-              ...kbEmbedding,
-              workspaceId: ctx.workspaceId,
-              signal,
-            })
-            const processed = await processDocument(
-              persistedDocData.fileUrl,
-              persistedDocData.filename,
-              persistedDocData.mimeType,
-              kbConfig.maxSize,
-              kbConfig.overlap,
-              kbConfig.minSize,
-              {
-                ...sourceFileAccessFor(ctx.connectorId, documentActorUserId),
+      let processingCommitted = false
+      const processingDeadlineAt = Math.min(
+        startTime + TIMEOUTS.OVERALL_PROCESSING - 15_000,
+        (attemptContext?.deadlineAt ?? Number.POSITIVE_INFINITY) - 15_000
+      )
+      await withTimeout(
+        (signal) =>
+          runWithKnowledgeModelInputProvenance(
+            documentSecretContext.registry,
+            async () => {
+              await assertKnowledgeEmbeddingCapacity({
+                ...kbEmbedding,
+                workspaceId: ctx.workspaceId,
                 signal,
-                processingDeadlineAt,
-                ...(indexingPassId
-                  ? { ocrCheckpoint: { knowledgeBaseId, documentId, indexingPassId } }
-                  : {}),
-              },
-              ctx.workspaceId,
-              rawConfig?.strategy,
-              rawConfig?.strategyOptions
-            )
+              })
+              const processed = await processDocument(
+                persistedDocData.fileUrl,
+                persistedDocData.filename,
+                persistedDocData.mimeType,
+                kbConfig.maxSize,
+                kbConfig.overlap,
+                kbConfig.minSize,
+                {
+                  ...sourceFileAccessFor(ctx.connectorId, documentActorUserId),
+                  signal,
+                  processingDeadlineAt,
+                  ...(indexingPassId
+                    ? { ocrCheckpoint: { knowledgeBaseId, documentId, indexingPassId } }
+                    : {}),
+                },
+                ctx.workspaceId,
+                rawConfig?.strategy,
+                rawConfig?.strategyOptions
+              )
 
-            signal.throwIfAborted()
-            assertDocumentChunkCountWithinLimit(processed.chunks.length)
+              signal.throwIfAborted()
+              assertDocumentChunkCountWithinLimit(processed.chunks.length)
 
-            const now = new Date()
+              const now = new Date()
 
-            logger.info(
-              `[${documentId}] Document parsed successfully, generating embeddings for ${processed.chunks.length} chunks`
-            )
+              logger.info(
+                `[${documentId}] Document parsed successfully, generating embeddings for ${processed.chunks.length} chunks`
+              )
 
-            const chunkTexts = processed.chunks.map((chunk) => chunk.text)
-            const embeddingModelInfo = getEmbeddingModelInfo(kbEmbeddingModel)
-            const chunkTokenCounts: number[] = []
-            for (let chunkIndex = 0; chunkIndex < chunkTexts.length; chunkIndex++) {
-              const tokenCount = estimateTokenCount(
-                chunkTexts[chunkIndex],
-                embeddingModelInfo.tokenizerProvider
-              ).count
-              chunkTokenCounts.push(tokenCount)
-              if (tokenCount > embeddingModelInfo.maxInputTokens) {
-                throw new PermanentDocumentProcessingError(
-                  'document_complexity_limit',
-                  `Chunk ${chunkIndex + 1} contains ${tokenCount.toLocaleString()} estimated tokens, exceeding the ${embeddingModelInfo.maxInputTokens.toLocaleString()}-token limit for ${kbEmbeddingModel}. Reduce the knowledge-base chunk size and retry.`
-                )
+              const chunkTexts = processed.chunks.map((chunk) => chunk.text)
+              const embeddingModelInfo = getEmbeddingModelInfo(kbEmbeddingModel)
+              const chunkTokenCounts: number[] = []
+              for (let chunkIndex = 0; chunkIndex < chunkTexts.length; chunkIndex++) {
+                const tokenCount = estimateTokenCount(
+                  chunkTexts[chunkIndex],
+                  embeddingModelInfo.tokenizerProvider
+                ).count
+                chunkTokenCounts.push(tokenCount)
+                if (tokenCount > embeddingModelInfo.maxInputTokens) {
+                  throw new PermanentDocumentProcessingError(
+                    'document_complexity_limit',
+                    `Chunk ${chunkIndex + 1} contains ${tokenCount.toLocaleString()} estimated tokens, exceeding the ${embeddingModelInfo.maxInputTokens.toLocaleString()}-token limit for ${kbEmbeddingModel}. Reduce the knowledge-base chunk size and retry.`
+                  )
+                }
               }
-            }
-            const embeddings: number[][] = []
-            const embeddingSourceHash = indexingPassId
-              ? sha256Hex(JSON.stringify(chunkTexts.map((text) => sha256Hex(text))))
-              : undefined
+              const embeddings: number[][] = []
+              const embeddingSourceHash = indexingPassId
+                ? sha256Hex(JSON.stringify(chunkTexts.map((text) => sha256Hex(text))))
+                : undefined
 
-            if (chunkTexts.length > 0) {
-              const batchSize = LARGE_DOC_CONFIG.MAX_EMBEDDING_BATCH
-              const totalBatches = Math.ceil(chunkTexts.length / batchSize)
+              if (chunkTexts.length > 0) {
+                const batchSize = LARGE_DOC_CONFIG.MAX_EMBEDDING_BATCH
+                const totalBatches = Math.ceil(chunkTexts.length / batchSize)
 
-              logger.info(`[${documentId}] Generating embeddings in ${totalBatches} batches`)
+                logger.info(`[${documentId}] Generating embeddings in ${totalBatches} batches`)
 
-              for (let i = 0; i < chunkTexts.length; i += batchSize) {
-                signal.throwIfAborted()
-                const batch = chunkTexts.slice(i, i + batchSize)
-                const batchNum = Math.floor(i / batchSize) + 1
+                for (let i = 0; i < chunkTexts.length; i += batchSize) {
+                  signal.throwIfAborted()
+                  const batch = chunkTexts.slice(i, i + batchSize)
+                  const batchNum = Math.floor(i / batchSize) + 1
 
-                logger.info(
-                  `[${documentId}] Processing embedding batch ${batchNum}/${totalBatches}`
-                )
-                const {
-                  embeddings: batchEmbeddings,
-                  billableTokens: batchBillableTokens,
-                  modelName,
-                  pricingId,
-                } = await generateEmbeddings(
-                  batch,
-                  kbEmbedding,
-                  ctx.workspaceId,
-                  signal,
-                  indexingPassId && embeddingSourceHash
-                    ? createEmbeddingCheckpoints({
-                        knowledgeBaseId,
-                        documentId,
-                        indexingPassId,
-                        sourceHash: embeddingSourceHash,
-                        batchOffset: i,
-                        deadlineAt: processingDeadlineAt,
-                      })
-                    : undefined
-                )
-                for (const emb of batchEmbeddings) {
-                  embeddings.push(emb)
-                }
-                billableEmbeddingTokens += batchBillableTokens
-                if (i === 0) {
-                  embeddingModelName = modelName
-                  embeddingPricingId = pricingId
+                  logger.info(
+                    `[${documentId}] Processing embedding batch ${batchNum}/${totalBatches}`
+                  )
+                  const {
+                    embeddings: batchEmbeddings,
+                    billableTokens: batchBillableTokens,
+                    modelName,
+                    pricingId,
+                  } = await generateEmbeddings(
+                    batch,
+                    kbEmbedding,
+                    ctx.workspaceId,
+                    signal,
+                    indexingPassId && embeddingSourceHash
+                      ? createEmbeddingCheckpoints({
+                          knowledgeBaseId,
+                          documentId,
+                          indexingPassId,
+                          sourceHash: embeddingSourceHash,
+                          batchOffset: i,
+                          deadlineAt: processingDeadlineAt,
+                        })
+                      : undefined
+                  )
+                  for (const emb of batchEmbeddings) {
+                    embeddings.push(emb)
+                  }
+                  billableEmbeddingTokens += batchBillableTokens
+                  if (i === 0) {
+                    embeddingModelName = modelName
+                    embeddingPricingId = pricingId
+                  }
                 }
               }
-            }
 
-            if (embeddings.length !== processed.chunks.length) {
-              throw new Error(
-                `Embedding generation returned ${embeddings.length} vectors for ${processed.chunks.length} chunks`
+              if (embeddings.length !== processed.chunks.length) {
+                throw new Error(
+                  `Embedding generation returned ${embeddings.length} vectors for ${processed.chunks.length} chunks`
+                )
+              }
+              const documentTags = ctx
+
+              logger.info(
+                `[${documentId}] Embeddings generated, creating embedding records with tags`
               )
-            }
-            const documentTags = ctx
 
-            logger.info(
-              `[${documentId}] Embeddings generated, creating embedding records with tags`
-            )
+              const chunkProvenances = processed.chunks.map((chunk) =>
+                documentSecretContext.tracked
+                  ? documentSecretContext.registry
+                    ? durableSecretProvenanceFromRegistry(
+                        documentSecretContext.registry,
+                        chunk.text
+                      )
+                    : EXACT_EMPTY_DURABLE_SECRET_PROVENANCE
+                  : undefined
+              )
+              const embeddingRecords = processed.chunks.map((chunk, chunkIndex) => ({
+                id: generateId(),
+                knowledgeBaseId,
+                documentId,
+                chunkIndex,
+                chunkHash: sha256Hex(chunk.text),
+                content: chunk.text,
+                secretProvenanceVersion: chunkProvenances[chunkIndex] ? 1 : null,
+                contentLength: chunk.text.length,
+                tokenCount: chunkTokenCounts[chunkIndex],
+                ...embeddingVectorValues(kbEmbedding.dimensions, embeddings[chunkIndex]),
+                embeddingModel: kbEmbeddingModel,
+                startOffset: chunk.metadata.startIndex,
+                endOffset: chunk.metadata.endIndex,
+                tag1: documentTags.tag1,
+                tag2: documentTags.tag2,
+                tag3: documentTags.tag3,
+                tag4: documentTags.tag4,
+                tag5: documentTags.tag5,
+                tag6: documentTags.tag6,
+                tag7: documentTags.tag7,
+                number1: documentTags.number1,
+                number2: documentTags.number2,
+                number3: documentTags.number3,
+                number4: documentTags.number4,
+                number5: documentTags.number5,
+                date1: documentTags.date1,
+                date2: documentTags.date2,
+                boolean1: documentTags.boolean1,
+                boolean2: documentTags.boolean2,
+                boolean3: documentTags.boolean3,
+                createdAt: now,
+                updatedAt: now,
+              }))
 
-            const chunkProvenances = processed.chunks.map((chunk) =>
-              documentSecretContext.tracked
-                ? documentSecretContext.registry
-                  ? durableSecretProvenanceFromRegistry(documentSecretContext.registry, chunk.text)
-                  : EXACT_EMPTY_DURABLE_SECRET_PROVENANCE
-                : undefined
-            )
-            const embeddingRecords = processed.chunks.map((chunk, chunkIndex) => ({
-              id: generateId(),
-              knowledgeBaseId,
-              documentId,
-              chunkIndex,
-              chunkHash: sha256Hex(chunk.text),
-              content: chunk.text,
-              secretProvenanceVersion: chunkProvenances[chunkIndex] ? 1 : null,
-              contentLength: chunk.text.length,
-              tokenCount: chunkTokenCounts[chunkIndex],
-              ...embeddingVectorValues(kbEmbedding.dimensions, embeddings[chunkIndex]),
-              embeddingModel: kbEmbeddingModel,
-              startOffset: chunk.metadata.startIndex,
-              endOffset: chunk.metadata.endIndex,
-              tag1: documentTags.tag1,
-              tag2: documentTags.tag2,
-              tag3: documentTags.tag3,
-              tag4: documentTags.tag4,
-              tag5: documentTags.tag5,
-              tag6: documentTags.tag6,
-              tag7: documentTags.tag7,
-              number1: documentTags.number1,
-              number2: documentTags.number2,
-              number3: documentTags.number3,
-              number4: documentTags.number4,
-              number5: documentTags.number5,
-              date1: documentTags.date1,
-              date2: documentTags.date2,
-              boolean1: documentTags.boolean1,
-              boolean2: documentTags.boolean2,
-              boolean3: documentTags.boolean3,
-              createdAt: now,
-              updatedAt: now,
-            }))
-
-            signal.throwIfAborted()
-            processingCommitted = await db.transaction(async (tx) => {
               signal.throwIfAborted()
-              const activeDocument = await tx
-                .select({ id: document.id })
-                .from(document)
-                .innerJoin(knowledgeBase, eq(document.knowledgeBaseId, knowledgeBase.id))
-                .where(
-                  and(
-                    eq(document.id, documentId),
-                    eq(document.processingStatus, 'processing'),
-                    eq(document.processingStartedAt, processingStartedAt),
-                    ...queueGenerationConditions(attemptContext),
-                    eq(document.userExcluded, false),
-                    isNull(document.archivedAt),
-                    isNull(document.deletedAt),
-                    isNull(knowledgeBase.deletedAt)
+              processingCommitted = await db.transaction(async (tx) => {
+                signal.throwIfAborted()
+                const activeDocument = await tx
+                  .select({ id: document.id })
+                  .from(document)
+                  .innerJoin(knowledgeBase, eq(document.knowledgeBaseId, knowledgeBase.id))
+                  .where(
+                    and(
+                      eq(document.id, documentId),
+                      eq(document.processingStatus, 'processing'),
+                      eq(document.processingStartedAt, processingStartedAt),
+                      ...queueGenerationConditions(attemptContext),
+                      eq(document.userExcluded, false),
+                      isNull(document.archivedAt),
+                      isNull(document.deletedAt),
+                      isNull(knowledgeBase.deletedAt)
+                    )
                   )
-                )
-                .for('update', { of: document })
-                .limit(1)
-
-              if (activeDocument.length === 0) {
-                return false
-              }
-
-              if (embeddingRecords.length > 0) {
-                await tx.delete(embedding).where(eq(embedding.documentId, documentId))
+                  .for('update', { of: document })
+                  .limit(1)
 
-                const insertBatchSize = LARGE_DOC_CONFIG.MAX_CHUNKS_PER_BATCH
-                const batches: (typeof embeddingRecords)[] = []
-                for (let i = 0; i < embeddingRecords.length; i += insertBatchSize) {
-                  batches.push(embeddingRecords.slice(i, i + insertBatchSize))
+                if (activeDocument.length === 0) {
+                  return false
                 }
 
-                logger.info(`[${documentId}] Inserting ${embeddingRecords.length} embeddings`)
-                for (const batch of batches) {
-                  signal.throwIfAborted()
-                  await tx.insert(embedding).values(batch)
-                }
-                const provenanceRecords = embeddingRecords.flatMap((record, index) => {
-                  const provenance = chunkProvenances[index]
-                  if (!provenance) return []
-                  return [
-                    {
-                      embeddingId: record.id,
-                      contentHash: record.chunkHash,
-                      status: provenance.status,
-                      entries: provenance.status === 'exact' ? [...provenance.entries] : [],
-                      updatedAt: now,
-                    },
-                  ]
-                })
-                for (let i = 0; i < provenanceRecords.length; i += insertBatchSize) {
-                  signal.throwIfAborted()
-                  await tx
-                    .insert(embeddingSecretProvenance)
-                    .values(provenanceRecords.slice(i, i + insertBatchSize))
+                if (embeddingRecords.length > 0) {
+                  await tx.delete(embedding).where(eq(embedding.documentId, documentId))
+
+                  const insertBatchSize = LARGE_DOC_CONFIG.MAX_CHUNKS_PER_BATCH
+                  const batches: (typeof embeddingRecords)[] = []
+                  for (let i = 0; i < embeddingRecords.length; i += insertBatchSize) {
+                    batches.push(embeddingRecords.slice(i, i + insertBatchSize))
+                  }
+
+                  logger.info(`[${documentId}] Inserting ${embeddingRecords.length} embeddings`)
+                  for (const batch of batches) {
+                    signal.throwIfAborted()
+                    await tx.insert(embedding).values(batch)
+                  }
+                  const provenanceRecords = embeddingRecords.flatMap((record, index) => {
+                    const provenance = chunkProvenances[index]
+                    if (!provenance) return []
+                    return [
+                      {
+                        embeddingId: record.id,
+                        contentHash: record.chunkHash,
+                        status: provenance.status,
+                        entries: provenance.status === 'exact' ? [...provenance.entries] : [],
+                        updatedAt: now,
+                      },
+                    ]
+                  })
+                  for (let i = 0; i < provenanceRecords.length; i += insertBatchSize) {
+                    signal.throwIfAborted()
+                    await tx
+                      .insert(embeddingSecretProvenance)
+                      .values(provenanceRecords.slice(i, i + insertBatchSize))
+                  }
                 }
-              }
 
-              signal.throwIfAborted()
-              await tx
-                .update(document)
-                .set({
-                  chunkCount: processed.metadata.chunkCount,
-                  tokenCount: processed.metadata.tokenCount,
-                  characterCount: processed.metadata.characterCount,
-                  processingStatus: 'completed',
-                  processingCompletedAt: now,
-                  processingError: null,
-                  /** A completed pass restores the retry allowance for a future failure. */
-                  processingAttempts: 0,
-                  processingQueueToken: null,
-                  processingQueuedAt: null,
-                  processingDeferredUntil: null,
-                })
-                .where(
-                  and(
-                    eq(document.id, documentId),
-                    eq(document.processingStatus, 'processing'),
-                    eq(document.processingStartedAt, processingStartedAt),
-                    ...queueGenerationConditions(attemptContext),
-                    eq(document.userExcluded, false),
-                    isNull(document.archivedAt),
-                    isNull(document.deletedAt)
+                signal.throwIfAborted()
+                await tx
+                  .update(document)
+                  .set({
+                    chunkCount: processed.metadata.chunkCount,
+                    tokenCount: processed.metadata.tokenCount,
+                    characterCount: processed.metadata.characterCount,
+                    processingStatus: 'completed',
+                    processingCompletedAt: now,
+                    processingError: null,
+                    /** A completed pass restores the retry allowance for a future failure. */
+                    processingAttempts: 0,
+                    processingQueueToken: null,
+                    processingQueuedAt: null,
+                    processingDeferredUntil: null,
+                  })
+                  .where(
+                    and(
+                      eq(document.id, documentId),
+                      eq(document.processingStatus, 'processing'),
+                      eq(document.processingStartedAt, processingStartedAt),
+                      ...queueGenerationConditions(attemptContext),
+                      eq(document.userExcluded, false),
+                      isNull(document.archivedAt),
+                      isNull(document.deletedAt)
+                    )
                   )
-                )
-              signal.throwIfAborted()
-              return true
-            })
-          },
-          {
-            opaqueInputSafe:
-              documentSecretContext.provenance.status === 'exact' &&
-              documentSecretContext.provenance.entries.length === 0,
-          }
-        ),
-      Math.max(1, processingDeadlineAt - Date.now()),
-      'Document processing',
-      attemptContext?.signal
-    )
+                signal.throwIfAborted()
+                return true
+              })
+            },
+            {
+              opaqueInputSafe:
+                documentSecretContext.provenance.status === 'exact' &&
+                documentSecretContext.provenance.entries.length === 0,
+            }
+          ),
+        Math.max(1, processingDeadlineAt - Date.now()),
+        'Document processing',
+        attemptContext?.signal
+      )
 
-    if (!processingCommitted) {
-      logger.info(`[${documentId}] Discarded output from an obsolete processing attempt`)
-      return
-    }
+      if (!processingCommitted) {
+        logger.info(`[${documentId}] Discarded output from an obsolete processing attempt`)
+        return
+      }
 
-    const processingTime = Date.now() - startTime
-    logger.info(`[${documentId}] Successfully processed document in ${processingTime}ms`)
+      const processingTime = Date.now() - startTime
+      logger.info(`[${documentId}] Successfully processed document in ${processingTime}ms`)
 
-    if (billableEmbeddingTokens > 0) {
-      try {
-        const costMultiplier = getCostMultiplier()
-        const { total: cost } = calculateCost(
-          embeddingPricingId,
-          billableEmbeddingTokens,
-          0,
-          false,
-          costMultiplier
-        )
-        if (cost > 0) {
-          /**
-           * Dedup identity for this embedding charge. `usage_log.event_key` is
-           * derived from `sourceReference` and guarded by a permanent unique
-           * index — usage_log rows are never pruned, there is no retention job
-           * — so the granularity has to separate two cases for all time:
-           *
-           * - A retry of the same pass must collapse. `knowledge-process-document`
-           *   runs up to `KB_CONFIG_MAX_ATTEMPTS` attempts and the stale-document
-           *   sweep can re-dispatch on top of that, so any per-attempt component
-           *   (a `Date.now()` stamp, `processingStartedAt`) bills one indexing
-           *   pass several times over.
-           * - A genuinely new pass must not collapse. A content change, a
-           *   rehydrate, or a user-triggered reprocess pays a real embedding
-           *   bill, and keying on `documentId` alone would suppress that charge
-           *   permanently.
-           *
-           * `indexingPassId` is exactly that discriminator. Without one, the
-           * resolved pricing id is the safest fallback: it still collapses
-           * attempts and still re-bills a knowledge base whose embedding model
-           * changed. Token counts are deliberately left out — OCR-backed parsing
-           * is not bit-stable across attempts, so they would break the dedup
-           * they appear to sharpen.
-           */
-          const usageSourceReference = [
-            'knowledge-document',
-            documentId,
-            indexingPassId ?? `model:${embeddingPricingId}`,
-          ].join(':')
-          await recordUsage({
-            userId: documentActorUserId,
-            workspaceId: ctx.workspaceId ?? undefined,
-            ...toBillingContext(billingAttribution),
-            entries: [
-              {
-                category: 'model',
-                source: 'knowledge-base',
-                description: embeddingModelName,
-                cost,
-                sourceReference: usageSourceReference,
-                metadata: { inputTokens: billableEmbeddingTokens, outputTokens: 0 },
-              },
-            ],
-          })
-          await checkAndBillPayerOverageThreshold(billingAttribution.billingEntity)
-        } else {
-          logger.warn(
-            `[${documentId}] Embedding model "${embeddingModelName}" has no pricing entry — billing skipped`,
-            { billableEmbeddingTokens, embeddingModelName }
+      if (billableEmbeddingTokens > 0) {
+        try {
+          const costMultiplier = getCostMultiplier()
+          const { total: cost } = calculateCost(
+            embeddingPricingId,
+            billableEmbeddingTokens,
+            0,
+            false,
+            costMultiplier
           )
+          if (cost > 0) {
+            /**
+             * Dedup identity for this embedding charge. `usage_log.event_key` is
+             * derived from `sourceReference` and guarded by a permanent unique
+             * index — usage_log rows are never pruned, there is no retention job
+             * — so the granularity has to separate two cases for all time:
+             *
+             * - A retry of the same pass must collapse. `knowledge-process-document`
+             *   runs up to `KB_CONFIG_MAX_ATTEMPTS` attempts and the stale-document
+             *   sweep can re-dispatch on top of that, so any per-attempt component
+             *   (a `Date.now()` stamp, `processingStartedAt`) bills one indexing
+             *   pass several times over.
+             * - A genuinely new pass must not collapse. A content change, a
+             *   rehydrate, or a user-triggered reprocess pays a real embedding
+             *   bill, and keying on `documentId` alone would suppress that charge
+             *   permanently.
+             *
+             * `indexingPassId` is exactly that discriminator. Without one, the
+             * resolved pricing id is the safest fallback: it still collapses
+             * attempts and still re-bills a knowledge base whose embedding model
+             * changed. Token counts are deliberately left out — OCR-backed parsing
+             * is not bit-stable across attempts, so they would break the dedup
+             * they appear to sharpen.
+             */
+            const usageSourceReference = [
+              'knowledge-document',
+              documentId,
+              indexingPassId ?? `model:${embeddingPricingId}`,
+            ].join(':')
+            await recordUsage({
+              userId: documentActorUserId,
+              workspaceId: ctx.workspaceId ?? undefined,
+              ...toBillingContext(billingAttribution),
+              entries: [
+                {
+                  category: 'model',
+                  source: 'knowledge-base',
+                  description: embeddingModelName,
+                  cost,
+                  sourceReference: usageSourceReference,
+                  metadata: { inputTokens: billableEmbeddingTokens, outputTokens: 0 },
+                },
+              ],
+            })
+            await checkAndBillPayerOverageThreshold(billingAttribution.billingEntity)
+          } else {
+            logger.warn(
+              `[${documentId}] Embedding model "${embeddingModelName}" has no pricing entry — billing skipped`,
+              { billableEmbeddingTokens, embeddingModelName }
+            )
+          }
+        } catch (billingError) {
+          logger.error(`[${documentId}] Failed to record embedding usage`, { error: billingError })
         }
-      } catch (billingError) {
-        logger.error(`[${documentId}] Failed to record embedding usage`, { error: billingError })
       }
-    }
+    })
   } catch (error) {
     const processingTime = Date.now() - startTime
     const embeddingQuotaExhausted = isEmbeddingQuotaExhaustion(error)
diff --git a/apps/sim/lib/knowledge/documents/utils.test.ts b/apps/sim/lib/knowledge/documents/utils.test.ts
index 36e742545a1..c840cecb406 100644
--- a/apps/sim/lib/knowledge/documents/utils.test.ts
+++ b/apps/sim/lib/knowledge/documents/utils.test.ts
@@ -14,9 +14,8 @@ vi.mock('@/lib/core/security/input-validation.server', () => ({
   secureFetchWithValidation: mockSecureFetchWithValidation,
 }))
 
-import { secureFetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { fetchWithRetry, secureFetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
 import {
-  fetchWithRetry,
   getRetryAfterMs,
   type HTTPError,
   hasRateLimitEvidence,
diff --git a/apps/sim/lib/knowledge/documents/utils.ts b/apps/sim/lib/knowledge/documents/utils.ts
index ce8a6fbb321..879525bf723 100644
--- a/apps/sim/lib/knowledge/documents/utils.ts
+++ b/apps/sim/lib/knowledge/documents/utils.ts
@@ -41,8 +41,12 @@ type RetryableError =
   | { status?: number; message?: string; headers?: HeaderReader }
 
 export interface RetryOptions {
-  /** Provider transport hooks run for every attempt, including retries and streamed responses. */
-  fetcher?: typeof fetch
+  /** Admission hooks must call the supplied transport, which resolves routing after any wait. */
+  fetcher?: (
+    input: RequestInfo | URL,
+    init: RequestInit,
+    transport: typeof fetch
+  ) => Promise<Response>
   /** Cancels the current retry cycle, including waits between attempts. */
   signal?: AbortSignal
   maxRetries?: number
@@ -58,7 +62,6 @@ export interface RetryOptions {
 
 const MAX_HTTP_ERROR_DIAGNOSTIC_CHARS = 2000
 const HTTP_ERROR_BODY_OMITTED = '[response body omitted]'
-const DEFAULT_FETCH_RETRY_BUDGET_MS = 150_000
 
 /**
  * Reads an upstream error body without allowing a provider or proxy error page
@@ -603,51 +606,3 @@ export const VALIDATE_RETRY_OPTIONS: RetryOptions = {
   initialDelayMs: 1000,
   maxDelayMs: 10000,
 }
-
-/**
- * Bounds requests and response bodies within one retry budget.
- */
-export async function fetchWithRetry(
-  url: string,
-  options: RequestInit = {},
-  retryOptions: RetryOptions = {}
-): Promise<Response> {
-  const callerSignal = options.signal
-    ? retryOptions.signal
-      ? AbortSignal.any([options.signal, retryOptions.signal])
-      : options.signal
-    : retryOptions.signal
-
-  return retryWithExponentialBackoff(
-    async (signal, deadlineAt) => {
-      /** The fetch deadline stays active while callers consume the returned response body. */
-      const requestSignal = AbortSignal.any([
-        signal,
-        AbortSignal.timeout(Math.max(0, Math.ceil(deadlineAt - Date.now()))),
-      ])
-      const response = await (retryOptions.fetcher ?? fetch)(url, {
-        ...options,
-        signal: requestSignal,
-      })
-
-      if (
-        !response.ok &&
-        isRetryableError({ status: response.status, headers: response.headers })
-      ) {
-        throw await createRetryableHttpError(response)
-      }
-
-      return response
-    },
-    {
-      ...retryOptions,
-      retryBudgetMs: retryOptions.retryBudgetMs ?? DEFAULT_FETCH_RETRY_BUDGET_MS,
-      maxRetryAfterMs:
-        retryOptions.maxRetryAfterMs ??
-        retryOptions.retryBudgetMs ??
-        retryOptions.maxDelayMs ??
-        30_000,
-      signal: callerSignal,
-    }
-  )
-}
diff --git a/apps/sim/lib/knowledge/search/budget.test.ts b/apps/sim/lib/knowledge/search/budget.test.ts
new file mode 100644
index 00000000000..d5e04601737
--- /dev/null
+++ b/apps/sim/lib/knowledge/search/budget.test.ts
@@ -0,0 +1,55 @@
+/** @vitest-environment node */
+import { db } from '@sim/db'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { SearchBudget, SearchDeadlineError } from '@/lib/knowledge/search/budget'
+
+afterEach(() => vi.restoreAllMocks())
+
+describe('search SQL deadline', () => {
+  it('does not start a fallback with a fresh budget', async () => {
+    let now = 0
+    vi.spyOn(performance, 'now').mockImplementation(() => now)
+    const budget = new SearchBudget('vector', 100)
+    const run = vi.fn(async () => {
+      now = 101
+      return ['candidate']
+    })
+    await budget.query('vector.ann', run)
+    await expect(budget.query('vector.exact', run)).rejects.toBeInstanceOf(SearchDeadlineError)
+    expect(run).toHaveBeenCalledTimes(1)
+  })
+
+  it('returns at the acquisition deadline and skips work when the queued transaction later starts', async () => {
+    vi.useFakeTimers()
+    try {
+      let begin: (() => void) | undefined
+      let finished: Promise<unknown> | undefined
+      vi.spyOn(db, 'transaction').mockImplementation((callback) => {
+        finished = new Promise<void>((resolve) => {
+          begin = resolve
+        }).then(() => callback(db as never))
+        return finished as ReturnType<typeof db.transaction>
+      })
+      const run = vi.fn(async () => ['private result'])
+      const budget = new SearchBudget('keyword', performance.now() + 50)
+      const pending = budget.query('keyword.sql', run)
+      const assertion = expect(pending).rejects.toBeInstanceOf(SearchDeadlineError)
+      await vi.advanceTimersByTimeAsync(60)
+      await assertion
+      begin!()
+      await expect(finished).rejects.toBeInstanceOf(SearchDeadlineError)
+      expect(run).not.toHaveBeenCalled()
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('preserves cancellation and unexpected errors instead of labeling them incomplete evidence', async () => {
+    const controller = new AbortController()
+    const budget = new SearchBudget('keyword', performance.now() - 1, controller.signal)
+    const denied = new Error('access revoked')
+    expect(budget.isTimeout(denied)).toBe(false)
+    controller.abort(denied)
+    expect(() => budget.isTimeout(new SearchDeadlineError())).toThrow(denied)
+  })
+})
diff --git a/apps/sim/lib/knowledge/search/budget.ts b/apps/sim/lib/knowledge/search/budget.ts
new file mode 100644
index 00000000000..8011733d926
--- /dev/null
+++ b/apps/sim/lib/knowledge/search/budget.ts
@@ -0,0 +1,115 @@
+import { db } from '@sim/db'
+import { getPostgresErrorCode } from '@sim/utils/errors'
+import { sql } from 'drizzle-orm'
+import type { DbTransaction } from '@/lib/db/types'
+import {
+  measureSearchStage,
+  recordSearchStageDuration,
+  type SearchStage,
+} from '@/lib/knowledge/search/diagnostics'
+
+export const SEARCH_RETRIEVAL_BUDGET_MS = 8000
+export type RetrievalLeg = 'vector' | 'keyword' | 'tags'
+export type SearchExecutor = Pick<DbTransaction, 'select' | 'execute'>
+
+export class SearchDeadlineError extends Error {
+  constructor() {
+    super('Search reached its retrieval deadline. Retry with a narrower query or source filter.')
+    this.name = 'SearchDeadlineError'
+  }
+}
+
+/** One leg's absolute deadline, reused across every refill and fallback. */
+export class SearchBudget {
+  timedOut = false
+
+  constructor(
+    readonly leg: RetrievalLeg,
+    readonly deadline: number,
+    readonly signal?: AbortSignal
+  ) {}
+
+  remaining(): number {
+    this.signal?.throwIfAborted()
+    const remaining = Math.ceil(this.deadline - performance.now())
+    if (remaining <= 0) {
+      this.timedOut = true
+      throw new SearchDeadlineError()
+    }
+    return remaining
+  }
+
+  isTimeout(error: unknown): boolean {
+    this.signal?.throwIfAborted()
+    if (error instanceof SearchDeadlineError || getPostgresErrorCode(error) === '57014') {
+      this.timedOut = true
+      return true
+    }
+    return false
+  }
+
+  /**
+   * Only acquisition is raced. An expired queued transaction rolls back before executing work.
+   * Once acquired, PostgreSQL cancels the statement and we await rollback/release before returning.
+   * This avoids postgres.js cancellation packets racing a subsequent query on a pooled connection.
+   */
+  async query<T>(
+    stage: SearchStage,
+    run: (executor: SearchExecutor) => PromiseLike<T>
+  ): Promise<T> {
+    const started = performance.now()
+    const remaining = this.remaining()
+    let acquired = false
+    let expired = false
+    let timer: ReturnType<typeof setTimeout> | undefined
+    let rejectAcquisition: (error: unknown) => void = () => {}
+    const onAbort = () => {
+      if (!acquired) {
+        expired = true
+        rejectAcquisition(this.signal?.reason)
+      }
+    }
+    const acquisition = new Promise<never>((_, reject) => {
+      rejectAcquisition = reject
+      timer = setTimeout(() => {
+        expired = true
+        this.timedOut = true
+        reject(new SearchDeadlineError())
+      }, remaining)
+      this.signal?.addEventListener('abort', onAbort, { once: true })
+    })
+    const work = db.transaction(async (tx) => {
+      acquired = true
+      clearTimeout(timer)
+      this.signal?.removeEventListener('abort', onAbort)
+      if (expired) throw new SearchDeadlineError()
+      recordSearchStageDuration(`${this.leg}.connection_acquire`, performance.now() - started)
+      const timeout = String(this.remaining())
+      await tx.execute(sql`SELECT set_config('statement_timeout', ${timeout}, true)`)
+      this.remaining()
+      return measureSearchStage(stage, () => run(tx))
+    })
+    try {
+      const result = await Promise.race([work, acquisition])
+      this.signal?.throwIfAborted()
+      return result
+    } catch (error) {
+      if (this.isTimeout(error)) throw new SearchDeadlineError()
+      throw error
+    } finally {
+      clearTimeout(timer)
+      this.signal?.removeEventListener('abort', onAbort)
+      if (!acquired)
+        recordSearchStageDuration(`${this.leg}.connection_acquire`, performance.now() - started)
+    }
+  }
+}
+
+/** Execute SQL with stage diagnostics and, for live search, the shared retrieval deadline. */
+export function runSearchQuery<T>(
+  budget: SearchBudget | undefined,
+  stage: SearchStage,
+  run: (executor: SearchExecutor) => PromiseLike<T>
+): Promise<T> {
+  return budget ? budget.query(stage, run) : measureSearchStage(stage, () => run(db))
+}
diff --git a/apps/sim/lib/knowledge/search/diagnostics.ts b/apps/sim/lib/knowledge/search/diagnostics.ts
index 09672e26a76..04c618d9721 100644
--- a/apps/sim/lib/knowledge/search/diagnostics.ts
+++ b/apps/sim/lib/knowledge/search/diagnostics.ts
@@ -7,6 +7,8 @@ const PROGRESS_INTERVAL_MS = 5000
 
 type RetrievalLeg = 'vector' | 'keyword' | 'tags'
 export type SearchStage =
+  | 'document_read'
+  | 'document_read.sql'
   | 'tool_input'
   | 'tool_application'
   | 'tool_presentation'
@@ -40,14 +42,17 @@ export type SearchStage =
   | `${RetrievalLeg}.candidates`
   | `${RetrievalLeg}.authorization`
   | `${RetrievalLeg}.hydration`
-  | 'vector.connection_acquire'
+  | `${RetrievalLeg}.connection_acquire`
+  | `${RetrievalLeg}.sql`
   | 'vector.settings'
   | 'vector.probe'
   | 'vector.ann'
+  | 'vector.rerank'
   | 'vector.exact'
 
 /** Fixed, content-free fields. Never pass queries, filters, document identities, SQL, or errors. */
 export interface SearchDiagnosticMetadata {
+  operation?: 'search_workspace' | 'read_document'
   surface?: 'dashboard' | 'mcp' | 'copilot' | 'workflow' | 'api' | 'slack' | 'other'
   toolCallId?: string
   executionId?: string
@@ -64,10 +69,17 @@ export interface SearchDiagnosticMetadata {
   searchMode?: 'hybrid' | 'vector'
   boostRecency?: boolean
   embeddingDimensions?: number
+  vectorRanking?: 'exact' | 'binary-rerank'
+  vectorBudgetMs?: number
+  vectorCandidateLimit?: number
+  vectorCandidateCount?: number
   resultCount?: number
   /** Tool output before the executor's final egress projection; counts only, never content. */
   toolResultBytes?: number
   passageBytes?: number
+  originalPassageBytes?: number
+  retrievalStatus?: 'complete' | 'partial'
+  timedOutLegs?: RetrievalLeg[]
   maxPassageBytes?: number
   uniqueDocumentCount?: number
 }
diff --git a/apps/sim/lib/knowledge/search/queries.test.ts b/apps/sim/lib/knowledge/search/queries.test.ts
index e9beb8eccc7..86c5bdf8458 100644
--- a/apps/sim/lib/knowledge/search/queries.test.ts
+++ b/apps/sim/lib/knowledge/search/queries.test.ts
@@ -15,12 +15,14 @@ import {
   WORKSPACE_ACCESS_TOKENS,
 } from '@/lib/knowledge/access/types'
 import { buildTagFilterCondition } from '@/lib/knowledge/documents/tag-filter'
+import { SearchBudget } from '@/lib/knowledge/search/budget'
 import {
   executeKeywordSearch,
   getStructuredTagFilters,
   handleTagAndVectorSearch,
   handleTagOnlySearch,
   handleVectorOnlySearch,
+  retrieveKnowledgeSearch,
   type SearchParams,
 } from '@/lib/knowledge/search/queries'
 import type { StructuredFilter } from '@/lib/knowledge/types'
@@ -36,6 +38,59 @@ const embeddingTable = {
   boolean1: 'boolean1',
 }
 
+describe('retrieval leg budgets', () => {
+  afterEach(() => vi.restoreAllMocks())
+
+  it.each([undefined, 3000])(
+    'applies vector budget %s without shortening keyword or tag retrieval',
+    async (vectorBudgetMs) => {
+      resetDbChainMock()
+      vi.spyOn(performance, 'now').mockReturnValue(1000)
+      const remaining = SearchBudget.prototype.remaining
+      const deadlines = new Map<string, number>()
+      vi.spyOn(SearchBudget.prototype, 'remaining').mockImplementation(function (
+        this: SearchBudget
+      ) {
+        deadlines.set(this.leg, this.deadline)
+        return remaining.call(this)
+      })
+      const access: UserAccessScope = {
+        kind: 'user',
+        userId: 'user-1',
+        tokens: WORKSPACE_ACCESS_TOKENS,
+      }
+      const params = {
+        knowledgeBaseIds: ['knowledge-1'],
+        topK: 10,
+        access,
+        accessProvider: {
+          get: async () => access,
+          getForConnectors: async () => access,
+          getForDocuments: async () => access,
+        },
+        searchMode: 'hybrid' as const,
+        vectorBudgetMs,
+      }
+      await retrieveKnowledgeSearch({
+        ...params,
+        query: 'release',
+        queryVector: { vector: '[1,0]', dimensions: 1536 },
+      })
+      await retrieveKnowledgeSearch({
+        ...params,
+        structuredFilters: [
+          { tagSlot: 'tag1', fieldType: 'text', operator: 'eq', value: 'release' },
+        ],
+      })
+      expect(Object.fromEntries(deadlines)).toEqual({
+        vector: 1000 + (vectorBudgetMs ?? 8000),
+        keyword: 9000,
+        tags: 9000,
+      })
+    }
+  )
+})
+
 /**
  * The global `drizzle-orm` mock renders `sql` fragments to a `?`-placeholder
  * string via `toSQL()`, so we can assert the exact predicate each filter builds.
@@ -528,6 +583,7 @@ describe('live repository authorization follows ranked candidates', () => {
       schemaMock.embedding,
       Array.from({ length: 200 }, (_, index) => candidate(`probe-${index}`, 'allowed-source'))
     )
+    queueTableRows(schemaMock.embedding, [{ id: 'far' }, { id: 'near' }])
     queueTableRows(schemaMock.embedding, [
       { ...candidate('far', 'allowed-source'), distance: 0.3 },
       { ...candidate('near', 'allowed-source'), distance: 0.1 },
@@ -544,13 +600,20 @@ describe('live repository authorization follows ranked candidates', () => {
     })
     expect(rows.map((row) => row.id)).toEqual(['near'])
     expect(dbChainMockFns.orderBy.mock.calls[0]).toHaveLength(1)
-    expect(Object.keys(dbChainMockFns.select.mock.calls[1][0])).toEqual(['id', 'distance'])
+    expect(Object.keys(dbChainMockFns.select.mock.calls[1][0])).toEqual(['id'])
+    expect(render(dbChainMockFns.orderBy.mock.calls[0][0]).sql).toContain('binary_quantize')
+    expect(JSON.stringify(dbChainMockFns.orderBy.mock.calls[1][0])).toContain('<=>')
+    expect(dbChainMockFns.limit.mock.calls[1]).toEqual([4000])
+    expect(JSON.stringify(dbChainMockFns.where.mock.calls[1][0])).not.toContain('<=>')
     expect(dbChainMockFns.limit.mock.invocationCallOrder[1]).toBeLessThan(
       dbChainMockFns.select.mock.invocationCallOrder[2]
     )
-    expect(JSON.stringify(dbChainMockFns.where.mock.calls[1][0])).toContain('OFFSET 0')
+    const visibilityJoin = render(dbChainMockFns.innerJoin.mock.calls[1][0])
+    expect(visibilityJoin.sql).toContain('LATERAL')
+    expect(visibilityJoin.sql).toContain('OFFSET 0')
+    expect(JSON.stringify(dbChainMockFns.innerJoin.mock.calls[1][0])).toContain('required_clause')
     expect(getForConnectors).toHaveBeenCalledExactlyOnceWith(['allowed-source'], undefined)
-    expect(JSON.stringify(dbChainMockFns.where.mock.calls[2][0])).toContain('github_read_grant')
+    expect(JSON.stringify(dbChainMockFns.where.mock.calls[3][0])).toContain('github_read_grant')
   })
 
   it('finishes empty scopes after the bounded probe without scanning HNSW or calling providers', async () => {
@@ -592,6 +655,7 @@ describe('live repository authorization follows ranked candidates', () => {
       schemaMock.embedding,
       Array.from({ length: 200 }, (_, index) => candidate(`probe-${index}`, 'allowed-source'))
     )
+    queueTableRows(schemaMock.embedding, [{ id: 'partial' }])
     queueTableRows(schemaMock.embedding, [candidate('partial', 'allowed-source')])
     queueTableRows(schemaMock.embedding, [candidate('selected', 'allowed-source')])
     queueTableRows(schemaMock.embedding, [
@@ -614,6 +678,10 @@ describe('live repository authorization follows ranked candidates', () => {
       candidate(`approximate-${index}`, 'allowed-source')
     )
     queueTableRows(schemaMock.embedding, probe)
+    queueTableRows(
+      schemaMock.embedding,
+      approximate.map(({ id }) => ({ id }))
+    )
     queueTableRows(schemaMock.embedding, approximate)
     queueTableRows(schemaMock.embedding, [])
     queueTableRows(schemaMock.embedding, probe)
@@ -628,9 +696,9 @@ describe('live repository authorization follows ranked candidates', () => {
     const rows = await handleVectorOnlySearch({ ...params, structuredFilters: undefined })
 
     expect(rows.map((row) => row.id)).toEqual(['selected'])
-    expect(dbChainMockFns.offset.mock.calls).toEqual([[0], [20], [0], [20]])
+    expect(dbChainMockFns.offset.mock.calls).toEqual([[0], [0], [20]])
     expect(getForConnectors).toHaveBeenCalledTimes(2)
-    expect(dbChainMockFns.transaction).toHaveBeenCalledTimes(3)
+    expect(dbChainMockFns.transaction).toHaveBeenCalledTimes(2)
   })
 
   it('keeps the nearest exact results when an earlier ANN page hydrated only a farther result', async () => {
@@ -638,6 +706,7 @@ describe('live repository authorization follows ranked candidates', () => {
       candidate(`probe-${index}`, 'allowed-source')
     )
     queueTableRows(schemaMock.embedding, probe)
+    queueTableRows(schemaMock.embedding, [{ id: 'far' }])
     queueTableRows(schemaMock.embedding, [
       { ...candidate('far', 'allowed-source'), distance: 0.7 },
       ...Array.from({ length: 19 }, (_, index) => candidate(`hidden-${index}`, 'allowed-source')),
@@ -662,7 +731,7 @@ describe('live repository authorization follows ranked candidates', () => {
     })
 
     expect(rows.map((row) => row.id)).toEqual(['nearer', 'near'])
-    expect(dbChainMockFns.offset.mock.calls).toEqual([[0], [20], [0]])
+    expect(dbChainMockFns.offset.mock.calls).toEqual([[0], [0]])
     expect(
       hasMockCondition(
         dbChainMockFns.where.mock.calls.at(-1)![0],
diff --git a/apps/sim/lib/knowledge/search/queries.ts b/apps/sim/lib/knowledge/search/queries.ts
index 17becb53e74..cb0f82b20cf 100644
--- a/apps/sim/lib/knowledge/search/queries.ts
+++ b/apps/sim/lib/knowledge/search/queries.ts
@@ -9,7 +9,19 @@ import {
 } from '@/lib/knowledge/access/predicate'
 import type { KnowledgeAccessProvider, KnowledgeAccessScope } from '@/lib/knowledge/access/types'
 import type { KbEmbeddingDimensions } from '@/lib/knowledge/embedding-models'
-import { measureSearchStage, recordSearchStageDuration } from '@/lib/knowledge/search/diagnostics'
+import {
+  type RetrievalLeg,
+  runSearchQuery,
+  SEARCH_RETRIEVAL_BUDGET_MS,
+  SearchBudget,
+  SearchDeadlineError,
+  type SearchExecutor,
+} from '@/lib/knowledge/search/budget'
+import {
+  annotateSearchDiagnostics,
+  measureSearchStage,
+  recordSearchStageDuration,
+} from '@/lib/knowledge/search/diagnostics'
 import { workspaceSearchFilterConditions } from '@/lib/knowledge/search/filter-conditions'
 import type { WorkspaceSearchFilters } from '@/lib/knowledge/search/filters'
 import { applyRecencyBoost, RRF_K } from '@/lib/knowledge/search/recency'
@@ -19,7 +31,7 @@ import {
   uncompilableTagFilterError,
 } from '@/lib/knowledge/tags/utils'
 import type { StructuredFilter } from '@/lib/knowledge/types'
-import { embeddingDistance } from '@/lib/knowledge/vector-columns'
+import { embeddingCandidateDistance, embeddingDistance } from '@/lib/knowledge/vector-columns'
 
 const logger = createLogger('KnowledgeSearchQueries')
 
@@ -27,14 +39,20 @@ const logger = createLogger('KnowledgeSearchQueries')
 const UNDEFINED_OBJECT_SQLSTATE = '42704'
 /** Tuples a relaxed-order scan may visit before giving up on filling the limit. */
 const HNSW_MAX_SCAN_TUPLES = '20000'
+/** Compact graphs can visit a wider frontier without retaining full vectors for each neighbor. */
+const BINARY_HNSW_MAX_SCAN_TUPLES = '100000'
+const BINARY_HNSW_EF_SEARCH = '200'
+const BINARY_HNSW_SCAN_MEM_MULTIPLIER = '4'
+/** Bounded cosine reranking pool, sized for recall under permission filtering and sign quantization. */
+const MIN_VECTOR_RERANK_CANDIDATES = 4000
+const MAX_VECTOR_RERANK_CANDIDATES = 8000
+const VECTOR_RERANK_OVERSAMPLING = 40
 
 /** How long to stop trying the iterative-scan settings after the server rejected them. */
 const HNSW_SETTINGS_UNSUPPORTED_RETRY_MS = 10 * 60 * 1000
 
 let hnswSettingsUnsupportedUntil = 0
 
-type SearchExecutor = Pick<typeof db, 'select'>
-
 /**
  * Shared HNSW indexes can be selective on KB scope, access, or tags, even for
  * small workspace searches. Iterative scans keep looking within a bounded
@@ -42,30 +60,41 @@ type SearchExecutor = Pick<typeof db, 'select'>
  * older extensions retry without tuning until the compatibility cooldown expires.
  */
 async function withVectorScanSettings<T>(
-  run: (executor: SearchExecutor) => Promise<T>
+  run: (executor: SearchExecutor) => Promise<T>,
+  budget?: SearchBudget,
+  ranking: 'cosine' | 'binary' = 'cosine'
 ): Promise<T> {
-  if (Date.now() < hnswSettingsUnsupportedUntil) return run(db)
+  const untuned = () => runSearchQuery(budget, 'vector.ann', run)
+  if (Date.now() < hnswSettingsUnsupportedUntil) return untuned()
   const acquireStarted = performance.now()
   let applyingSettings = false
   try {
-    return await db.transaction(async (tx) => {
-      recordSearchStageDuration('vector.connection_acquire', performance.now() - acquireStarted)
+    const tuned = async (tx: SearchExecutor) => {
+      if (!budget)
+        recordSearchStageDuration('vector.connection_acquire', performance.now() - acquireStarted)
       applyingSettings = true
       await measureSearchStage('vector.settings', () =>
         tx.execute(
-          sql`SELECT set_config('hnsw.iterative_scan', 'relaxed_order', true), set_config('hnsw.max_scan_tuples', ${HNSW_MAX_SCAN_TUPLES}, true)`
+          ranking === 'binary'
+            ? sql`SELECT set_config('hnsw.iterative_scan', 'relaxed_order', true), set_config('hnsw.max_scan_tuples', ${BINARY_HNSW_MAX_SCAN_TUPLES}, true), set_config('hnsw.ef_search', ${BINARY_HNSW_EF_SEARCH}, true), set_config('hnsw.scan_mem_multiplier', ${BINARY_HNSW_SCAN_MEM_MULTIPLIER}, true)`
+            : sql`SELECT set_config('hnsw.iterative_scan', 'relaxed_order', true), set_config('hnsw.max_scan_tuples', ${HNSW_MAX_SCAN_TUPLES}, true)`
         )
       )
       applyingSettings = false
+      if (budget)
+        await tx.execute(
+          sql`SELECT set_config('statement_timeout', ${String(budget.remaining())}, true)`
+        )
       return run(tx)
-    })
+    }
+    return await (budget ? budget.query('vector.ann', tuned) : db.transaction(tuned))
   } catch (error) {
     if (!applyingSettings || getPostgresErrorCode(error) !== UNDEFINED_OBJECT_SQLSTATE) throw error
     hnswSettingsUnsupportedUntil = Date.now() + HNSW_SETTINGS_UNSUPPORTED_RETRY_MS
     logger.warn('pgvector iterative scan is unavailable; vector legs run without it', {
       error: getErrorMessage(error),
     })
-    return run(db)
+    return untuned()
   }
 }
 
@@ -186,6 +215,7 @@ export interface SearchParams {
   access: KnowledgeAccessScope
   accessProvider?: KnowledgeAccessProvider
   signal?: AbortSignal
+  budget?: SearchBudget
   structuredFilters?: StructuredFilter[]
   filters?: WorkspaceSearchFilters
   queryVector?: KnowledgeQueryVector
@@ -475,6 +505,7 @@ async function selectAuthorizedSearchResults(input: {
   accessProvider: KnowledgeAccessProvider
   filters?: WorkspaceSearchFilters
   signal?: AbortSignal
+  budget?: SearchBudget
   topK: number
   selectPage: (
     limit: number,
@@ -491,77 +522,82 @@ async function selectAuthorizedSearchResults(input: {
   const considered = new Set<string>()
   let scanned = 0
   let offset = 0
-  while (
-    results.size < input.topK &&
-    scanned < Number(HNSW_MAX_SCAN_TUPLES) &&
-    Date.now() < deadline
-  ) {
-    input.signal?.throwIfAborted()
-    const page = await measureSearchStage(`${input.leg}.candidates`, () =>
-      input.selectPage(pageSize, offset, [...excludedSources])
-    )
-    if (!page.candidates.length) break
-    scanned += page.candidates.length
-    offset = page.nextOffset
-    const candidates = page.candidates.filter((candidate) => !considered.has(candidate.id))
-    for (const candidate of candidates) considered.add(candidate.id)
-    if (!candidates.length) {
-      if (page.candidates.length < pageSize) break
-      continue
-    }
-    /** Candidate and hydration queries enforce this source filter; connector types are immutable. */
-    const connectorIds =
-      input.filters?.source &&
-      input.filters.source !== 'github' &&
-      input.filters.source !== 'confluence'
-        ? []
-        : [
-            ...new Set(
-              candidates.flatMap((candidate) =>
-                candidate.connectorId ? [candidate.connectorId] : []
-              )
-            ),
-          ]
-    const access = await measureSearchStage(`${input.leg}.authorization`, () =>
-      input.accessProvider.getForConnectors(connectorIds, input.signal)
-    )
-    input.signal?.throwIfAborted()
-    const grantedSources = new Set(
-      access.kind === 'user'
-        ? [
-            ...(access.githubInstallationGrants?.map((grant) => grant.connectorId) ?? []),
-            ...(access.confluenceSiteGrants?.map((grant) => grant.connectorId) ?? []),
-          ]
-        : []
-    )
-    const excludedBefore = excludedSources.size
-    for (const candidate of candidates) {
-      if (
-        candidate.liveAuthorizationSource &&
-        candidate.connectorId &&
-        !grantedSources.has(candidate.connectorId)
+  try {
+    while (
+      results.size < input.topK &&
+      scanned < Number(HNSW_MAX_SCAN_TUPLES) &&
+      (input.budget !== undefined || Date.now() < deadline)
+    ) {
+      input.signal?.throwIfAborted()
+      input.budget?.remaining()
+      const page = await measureSearchStage(`${input.leg}.candidates`, () =>
+        input.selectPage(pageSize, offset, [...excludedSources])
       )
-        excludedSources.add(candidate.connectorId)
-    }
-    const hydrated = await measureSearchStage(`${input.leg}.hydration`, () =>
-      input.hydrate(
-        candidates.map((candidate) => candidate.id),
-        access
+      if (!page.candidates.length) break
+      scanned += page.candidates.length
+      offset = page.nextOffset
+      const candidates = page.candidates.filter((candidate) => !considered.has(candidate.id))
+      for (const candidate of candidates) considered.add(candidate.id)
+      if (!candidates.length) {
+        if (page.candidates.length < pageSize) break
+        continue
+      }
+      /** Candidate and hydration queries enforce this source filter; connector types are immutable. */
+      const connectorIds =
+        input.filters?.source &&
+        input.filters.source !== 'github' &&
+        input.filters.source !== 'confluence'
+          ? []
+          : [
+              ...new Set(
+                candidates.flatMap((candidate) =>
+                  candidate.connectorId ? [candidate.connectorId] : []
+                )
+              ),
+            ]
+      const access = await measureSearchStage(`${input.leg}.authorization`, () =>
+        input.accessProvider.getForConnectors(connectorIds, input.signal)
       )
-    )
-    const byId = new Map(hydrated.map((row) => [row.id, row]))
-    for (const candidate of candidates) {
-      const row = byId.get(candidate.id)
-      if (row) results.set(row.id, row)
-      if (!input.compareResults && results.size === input.topK) break
-    }
-    if (input.compareResults) {
-      const ranked = [...results.values()].sort(input.compareResults).slice(0, input.topK)
-      results.clear()
-      for (const row of ranked) results.set(row.id, row)
+      input.signal?.throwIfAborted()
+      const grantedSources = new Set(
+        access.kind === 'user'
+          ? [
+              ...(access.githubInstallationGrants?.map((grant) => grant.connectorId) ?? []),
+              ...(access.confluenceSiteGrants?.map((grant) => grant.connectorId) ?? []),
+            ]
+          : []
+      )
+      const excludedBefore = excludedSources.size
+      for (const candidate of candidates) {
+        if (
+          candidate.liveAuthorizationSource &&
+          candidate.connectorId &&
+          !grantedSources.has(candidate.connectorId)
+        )
+          excludedSources.add(candidate.connectorId)
+      }
+      const hydrated = await measureSearchStage(`${input.leg}.hydration`, () =>
+        input.hydrate(
+          candidates.map((candidate) => candidate.id),
+          access
+        )
+      )
+      const byId = new Map(hydrated.map((row) => [row.id, row]))
+      for (const candidate of candidates) {
+        const row = byId.get(candidate.id)
+        if (row) results.set(row.id, row)
+        if (!input.compareResults && results.size === input.topK) break
+      }
+      if (input.compareResults) {
+        const ranked = [...results.values()].sort(input.compareResults).slice(0, input.topK)
+        results.clear()
+        for (const row of ranked) results.set(row.id, row)
+      }
+      if (excludedSources.size > excludedBefore) offset = 0
+      else if (page.candidates.length < pageSize) break
     }
-    if (excludedSources.size > excludedBefore) offset = 0
-    else if (page.candidates.length < pageSize) break
+  } catch (error) {
+    if (!input.budget?.isTimeout(error)) throw error
   }
   input.signal?.throwIfAborted()
   return [...results.values()]
@@ -578,15 +614,19 @@ function hydrateSearchCandidates(
   access: KnowledgeAccessScope,
   distance: SQL<number> | SQL.Aliased<number>,
   filters: WorkspaceSearchFilters | undefined,
-  conditions: (SQL | undefined)[]
+  conditions: (SQL | undefined)[],
+  leg: RetrievalLeg,
+  budget?: SearchBudget
 ) {
-  return db
-    .select(getSearchResultFields(distance))
-    .from(embedding)
-    .innerJoin(document, eq(embedding.documentId, document.id))
-    .where(
-      and(inArray(embedding.id, ids), ...getVisibilityConditions(access, filters), ...conditions)
-    )
+  return runSearchQuery(budget, `${leg}.sql`, (executor) =>
+    executor
+      .select(getSearchResultFields(distance))
+      .from(embedding)
+      .innerJoin(document, eq(embedding.documentId, document.id))
+      .where(
+        and(inArray(embedding.id, ids), ...getVisibilityConditions(access, filters), ...conditions)
+      )
+  )
 }
 
 /** Candidates each hybrid leg retrieves before the fused list is trimmed to `topK`. */
@@ -629,26 +669,29 @@ export async function handleTagOnlySearch(params: SearchParams): Promise<SearchR
       accessProvider: params.accessProvider,
       filters: params.filters,
       signal: params.signal,
+      budget: params.budget,
       topK,
       selectPage: async (limit, offset, excludedSources) => {
-        const candidates = await db
-          .select(SEARCH_READ_CANDIDATE_FIELDS)
-          .from(embedding)
-          .innerJoin(document, eq(embedding.documentId, document.id))
-          .where(
-            and(
-              ...conditions,
-              ...getVisibilityConditions(
-                access,
-                params.filters,
-                knowledgeMetadataCandidateAccessCondition(access)
-              ),
-              excludeSearchSources(excludedSources)
+        const candidates = await runSearchQuery(params.budget, 'tags.sql', (executor) =>
+          executor
+            .select(SEARCH_READ_CANDIDATE_FIELDS)
+            .from(embedding)
+            .innerJoin(document, eq(embedding.documentId, document.id))
+            .where(
+              and(
+                ...conditions,
+                ...getVisibilityConditions(
+                  access,
+                  params.filters,
+                  knowledgeMetadataCandidateAccessCondition(access)
+                ),
+                excludeSearchSources(excludedSources)
+              )
             )
-          )
-          .orderBy(embedding.id)
-          .limit(limit)
-          .offset(offset)
+            .orderBy(embedding.id)
+            .limit(limit)
+            .offset(offset)
+        )
         return { candidates, nextOffset: offset + candidates.length }
       },
       hydrate: (ids, authorized) =>
@@ -657,7 +700,9 @@ export async function handleTagOnlySearch(params: SearchParams): Promise<SearchR
           authorized,
           sql<number>`0`.as('distance'),
           params.filters,
-          conditions
+          conditions,
+          'tags',
+          params.budget
         ),
     })
   }
@@ -748,11 +793,12 @@ export async function handleVectorOnlySearch(params: SearchParams): Promise<Sear
 }
 
 /**
- * Keep broad candidate visibility correlated with the vector scan. Flattening
- * the document join can make PostgreSQL prefer sorting every vector (whose
- * TOAST reads it undercosts) before checking access. OFFSET 0 keeps that
- * visibility check inside the scan, before LIMIT. Only bounded identities join
- * back for source metadata; content still requires live authorization below.
+ * A lateral document lookup lets PostgreSQL memoize visibility per document while
+ * walking the compact index, instead of repeating source ACL checks for every chunk.
+ * OFFSET 0 preserves the parameterized lookup before LIMIT; flattening the join can
+ * make the planner sort the whole corpus instead. Binary candidates are reranked
+ * by cosine distance before relevance filtering or live source authorization;
+ * full vectors and content are never loaded while traversing inaccessible neighbors.
  * Small scopes and underfilled approximate pages use exact ranking, so selective
  * permissions do not force a fruitless index walk or lose reachable matches.
  */
@@ -763,99 +809,134 @@ async function selectLiveVectorResults(
   filters: (SQL | undefined)[]
 ): Promise<SearchResult[]> {
   const conditions = [inArray(embedding.knowledgeBaseId, params.knowledgeBaseIds), ...filters]
+  const queryVector = params.queryVector!
+  const candidateDistance = embeddingCandidateDistance(queryVector.dimensions, queryVector.vector)
+  const candidateLimit = Math.min(
+    MAX_VECTOR_RERANK_CANDIDATES,
+    Math.max(MIN_VECTOR_RERANK_CANDIDATES, params.topK * VECTOR_RERANK_OVERSAMPLING)
+  )
   let useExactRanking = false
   const rows = await selectAuthorizedSearchResults({
     leg: 'vector',
     accessProvider,
     filters: params.filters,
     signal: params.signal,
+    budget: params.budget,
     topK: params.topK,
     compareResults: (a, b) => a.distance - b.distance,
-    selectPage: (limit, offset, excludedSources) =>
-      withVectorScanSettings(async (executor) => {
-        const visibility = [
-          ...getVisibilityConditions(
-            params.access,
-            params.filters,
-            knowledgeMetadataCandidateAccessCondition(params.access)
-          ),
-          excludeSearchSources(excludedSources),
-        ]
-        /** Adding zero prevents an underfilled HNSW scan from being chosen again for fallback. */
-        const exactPage = async (candidateIds?: string[]) => {
-          const exactOffset = useExactRanking ? offset : 0
-          useExactRanking = true
-          const candidates = await measureSearchStage('vector.exact', () =>
-            executor
-              .select({ ...SEARCH_READ_CANDIDATE_FIELDS, distance: distance.as('distance') })
-              .from(embedding)
-              .innerJoin(document, eq(embedding.documentId, document.id))
-              .where(
-                and(
-                  ...conditions,
-                  ...visibility,
-                  candidateIds ? inArray(embedding.id, candidateIds) : undefined
-                )
-              )
-              .orderBy(sql`(${distance}) + 0`, embedding.id)
-              .limit(limit)
-              .offset(exactOffset)
-          )
-          return { candidates, nextOffset: exactOffset + candidates.length }
-        }
-        if (params.filters?.documentIds?.length || params.structuredFilters?.length) {
-          return exactPage()
-        }
-        /** Probe visibility without vector reads; revoked scopes must not detoast the corpus. */
-        const probe = await measureSearchStage('vector.probe', () =>
+    selectPage: async (limit, offset, excludedSources) => {
+      const visibility = [
+        ...getVisibilityConditions(
+          params.access,
+          params.filters,
+          knowledgeMetadataCandidateAccessCondition(params.access)
+        ),
+        excludeSearchSources(excludedSources),
+      ]
+      /** Adding zero prevents an underfilled HNSW scan from being chosen again for fallback. */
+      const exactPage = async (candidateIds?: string[]) => {
+        const exactOffset = useExactRanking ? offset : 0
+        useExactRanking = true
+        annotateSearchDiagnostics({ vectorRanking: 'exact' })
+        const candidates = await runSearchQuery(params.budget, 'vector.exact', (executor) =>
           executor
-            .select({ id: embedding.id })
+            .select({ ...SEARCH_READ_CANDIDATE_FIELDS, distance: distance.as('distance') })
             .from(embedding)
             .innerJoin(document, eq(embedding.documentId, document.id))
-            .where(and(inArray(embedding.knowledgeBaseId, params.knowledgeBaseIds), ...visibility))
-            .limit(LIVE_SEARCH_PAGE_SIZE)
+            .where(
+              and(
+                ...conditions,
+                ...visibility,
+                candidateIds ? inArray(embedding.id, candidateIds) : undefined
+              )
+            )
+            .orderBy(sql`(${distance}) + 0`, embedding.id)
+            .limit(limit)
+            .offset(exactOffset)
         )
-        if (probe.length === 0) return { candidates: [], nextOffset: offset }
-        if (probe.length < LIVE_SEARCH_PAGE_SIZE) {
-          return exactPage(probe.map((candidate) => candidate.id))
-        }
-        if (useExactRanking) return exactPage()
-        const ranked = executor
-          .select({ id: embedding.id, distance: distance.as('distance') })
+        return { candidates, nextOffset: exactOffset + candidates.length }
+      }
+      if (params.filters?.documentIds?.length || params.structuredFilters?.length) {
+        return exactPage()
+      }
+      /** Probe visibility without vector reads; revoked scopes must not detoast the corpus. */
+      const probe = await runSearchQuery(params.budget, 'vector.probe', (executor) =>
+        executor
+          .select({ id: embedding.id })
+          .from(embedding)
+          .innerJoin(document, eq(embedding.documentId, document.id))
+          .where(and(inArray(embedding.knowledgeBaseId, params.knowledgeBaseIds), ...visibility))
+          .limit(LIVE_SEARCH_PAGE_SIZE)
+      )
+      if (probe.length === 0) return { candidates: [], nextOffset: offset }
+      if (probe.length < LIVE_SEARCH_PAGE_SIZE) {
+        return exactPage(probe.map((candidate) => candidate.id))
+      }
+      if (useExactRanking) return exactPage()
+      annotateSearchDiagnostics({
+        vectorRanking: 'binary-rerank',
+        vectorCandidateLimit: candidateLimit,
+      })
+      const identities = await withVectorScanSettings(
+        (executor) =>
+          executor
+            .select({ id: embedding.id })
+            .from(embedding)
+            .innerJoin(
+              sql`LATERAL (
+                SELECT 1 FROM ${document}
+                WHERE ${and(eq(document.id, embedding.documentId), ...visibility)}
+                OFFSET 0
+              ) AS visible_document`,
+              sql`true`
+            )
+            .where(inArray(embedding.knowledgeBaseId, params.knowledgeBaseIds))
+            .orderBy(candidateDistance)
+            .limit(candidateLimit),
+        params.budget,
+        'binary'
+      )
+      annotateSearchDiagnostics({
+        vectorCandidateCount: identities.length,
+      })
+      if (!identities.length) return exactPage()
+      const page = await runSearchQuery(params.budget, 'vector.rerank', (executor) =>
+        executor
+          .select({ ...SEARCH_READ_CANDIDATE_FIELDS, distance: distance.as('distance') })
           .from(embedding)
+          .innerJoin(document, eq(document.id, embedding.documentId))
           .where(
             and(
+              inArray(
+                embedding.id,
+                identities.map(({ id }) => id)
+              ),
               ...conditions,
-              sql`EXISTS (
-            SELECT 1 FROM ${document}
-            WHERE ${and(eq(document.id, embedding.documentId), ...visibility)}
-            OFFSET 0
-          )`
+              ...visibility
             )
           )
-          .orderBy(distance)
+          .orderBy(sql`(${distance}) + 0`, embedding.id)
           .limit(limit)
           .offset(offset)
-          .as('ranked_search_candidates')
-        const page = await measureSearchStage('vector.ann', () =>
-          executor
-            .select({ ...SEARCH_READ_CANDIDATE_FIELDS, distance: ranked.distance })
-            .from(ranked)
-            .innerJoin(embedding, eq(embedding.id, ranked.id))
-            .innerJoin(document, eq(document.id, embedding.documentId))
-            .orderBy(ranked.distance, ranked.id)
-        )
-        if (page.length < limit) return exactPage()
-        return {
-          candidates: page.sort((a, b) => a.distance - b.distance),
-          nextOffset: offset + page.length,
-        }
-      }),
+      )
+      if (page.length < limit) return exactPage()
+      return {
+        candidates: page,
+        nextOffset: offset + page.length,
+      }
+    },
     hydrate: (ids, authorized) =>
-      hydrateSearchCandidates(ids, authorized, distance.as('distance'), params.filters, conditions),
+      hydrateSearchCandidates(
+        ids,
+        authorized,
+        distance.as('distance'),
+        params.filters,
+        conditions,
+        'vector',
+        params.budget
+      ),
   })
-  /** Relaxed HNSW scans can return adjacent pages out of distance order. */
-  return rows.sort((a, b) => a.distance - b.distance)
+  return rows
 }
 
 /**
@@ -893,6 +974,7 @@ export interface KeywordSearchParams {
   access: KnowledgeAccessScope
   accessProvider?: KnowledgeAccessProvider
   signal?: AbortSignal
+  budget?: SearchBudget
   query: string
   /** Query embedding, so keyword-only hits still carry a real cosine distance. */
   queryVector: KnowledgeQueryVector
@@ -946,26 +1028,29 @@ export async function executeKeywordSearch(params: KeywordSearchParams): Promise
       accessProvider: params.accessProvider,
       filters: params.filters,
       signal: params.signal,
+      budget: params.budget,
       topK,
       selectPage: async (limit, offset, excludedSources) => {
-        const candidates = await db
-          .select({ ...SEARCH_READ_CANDIDATE_FIELDS, keywordRank: rankExpr.as('keyword_rank') })
-          .from(embedding)
-          .innerJoin(document, eq(embedding.documentId, document.id))
-          .where(
-            and(
-              ...conditions,
-              ...getVisibilityConditions(
-                access,
-                params.filters,
-                knowledgeMetadataCandidateAccessCondition(access)
-              ),
-              excludeSearchSources(excludedSources)
+        const candidates = await runSearchQuery(params.budget, 'keyword.sql', (executor) =>
+          executor
+            .select({ ...SEARCH_READ_CANDIDATE_FIELDS, keywordRank: rankExpr.as('keyword_rank') })
+            .from(embedding)
+            .innerJoin(document, eq(embedding.documentId, document.id))
+            .where(
+              and(
+                ...conditions,
+                ...getVisibilityConditions(
+                  access,
+                  params.filters,
+                  knowledgeMetadataCandidateAccessCondition(access)
+                ),
+                excludeSearchSources(excludedSources)
+              )
             )
-          )
-          .orderBy(sql`${rankExpr} DESC`, embedding.id)
-          .limit(limit)
-          .offset(offset)
+            .orderBy(sql`${rankExpr} DESC`, embedding.id)
+            .limit(limit)
+            .offset(offset)
+        )
         return { candidates, nextOffset: offset + candidates.length }
       },
       hydrate: (ids, authorized) =>
@@ -974,7 +1059,9 @@ export async function executeKeywordSearch(params: KeywordSearchParams): Promise
           authorized,
           embeddingDistance(queryVector.dimensions, queryVector.vector).as('distance'),
           params.filters,
-          conditions
+          conditions,
+          'keyword',
+          params.budget
         ),
     })
   }
@@ -1154,6 +1241,8 @@ export async function handleTagAndVectorSearch(params: SearchParams): Promise<Se
 export type KnowledgeSearchMode = 'hybrid' | 'vector'
 
 export interface ExecuteKnowledgeSearchParams {
+  /** Optional vector-leg budget; keyword and tag retrieval keep their default budgets. */
+  vectorBudgetMs?: number
   knowledgeBaseIds: string[]
   /** Candidate count each leg retrieves and the fused list is trimmed to. */
   topK: number
@@ -1171,14 +1260,29 @@ export interface ExecuteKnowledgeSearchParams {
   filters?: WorkspaceSearchFilters
 }
 
-/**
- * Single retrieval entry point shared by the internal and v1 search routes.
- * Callers remain responsible for auth, embedding generation, billing, and for
- * rejecting requests that carry neither a query nor tag filters.
- */
+export interface RetrievalStatus {
+  status: 'complete' | 'partial'
+  timedOutLegs: Array<'vector' | 'keyword' | 'tags'>
+}
+
+export interface KnowledgeRetrievalResult {
+  rows: SearchResult[]
+  retrieval: RetrievalStatus
+}
+
+/** Legacy surfaces cannot silently present partial retrieval as complete. */
 export async function executeKnowledgeSearch(
   params: ExecuteKnowledgeSearchParams
 ): Promise<SearchResult[]> {
+  const result = await retrieveKnowledgeSearch(params)
+  if (result.retrieval.status === 'partial') throw new SearchDeadlineError()
+  return result.rows
+}
+
+/** Shared hybrid retrieval, with explicit completeness for surfaces that can represent it. */
+export async function retrieveKnowledgeSearch(
+  params: ExecuteKnowledgeSearchParams
+): Promise<KnowledgeRetrievalResult> {
   const {
     knowledgeBaseIds,
     topK,
@@ -1189,99 +1293,71 @@ export async function executeKnowledgeSearch(
     access,
     boostRecency = false,
   } = params
-
+  params.signal?.throwIfAborted()
+  const started = performance.now()
+  const deadline = started + SEARCH_RETRIEVAL_BUDGET_MS
+  const vectorBudgetMs = params.vectorBudgetMs ?? SEARCH_RETRIEVAL_BUDGET_MS
+  annotateSearchDiagnostics({ vectorBudgetMs })
+  const budgets = {
+    vector: new SearchBudget('vector', started + vectorBudgetMs, params.signal),
+    keyword: new SearchBudget('keyword', deadline, params.signal),
+    tags: new SearchBudget('tags', deadline, params.signal),
+  }
+  const finish = (rows: SearchResult[]): KnowledgeRetrievalResult => {
+    params.signal?.throwIfAborted()
+    const timedOutLegs = Object.values(budgets)
+      .filter((budget) => budget.timedOut)
+      .map((budget) => budget.leg)
+    return {
+      rows: boostRecency ? applyRecencyBoost(rows) : rows,
+      retrieval: { status: timedOutLegs.length ? 'partial' : 'complete', timedOutLegs },
+    }
+  }
+  const common = {
+    knowledgeBaseIds,
+    access,
+    accessProvider: params.accessProvider,
+    signal: params.signal,
+    filters: params.filters,
+    structuredFilters,
+  }
   const hasQuery = Boolean(query?.trim())
-  const hasFilters = Boolean(structuredFilters && structuredFilters.length > 0)
-
+  const hasFilters = Boolean(structuredFilters?.length)
   if (!hasQuery) {
-    if (!hasFilters) {
-      throw new Error('A search query or tag filters are required')
-    }
-    return await measureSearchStage('tags', () =>
-      handleTagOnlySearch({
-        knowledgeBaseIds,
-        topK,
-        structuredFilters,
-        access,
-        accessProvider: params.accessProvider,
-        signal: params.signal,
-        filters: params.filters,
-      })
+    if (!hasFilters) throw new Error('A search query or tag filters are required')
+    return finish(
+      await measureSearchStage('tags', () =>
+        handleTagOnlySearch({ ...common, topK, budget: budgets.tags })
+      )
     )
   }
-
-  if (!queryVector) {
-    throw new Error('Query vector is required when searching with a query')
-  }
-
+  if (!queryVector) throw new Error('Query vector is required when searching with a query')
   const { distanceThreshold } = getQueryStrategy(knowledgeBaseIds.length, topK)
-  /**
-   * Hybrid fuses two rankings, so each leg retrieves more than the caller
-   * asked for: a chunk that both legs rank just below `topK` is a strong
-   * signal the fused list must be able to surface.
-   */
   const legTopK = searchMode === 'hybrid' ? hybridCandidateCount(topK) : topK
-
+  const vectorParams = {
+    ...common,
+    topK: legTopK,
+    queryVector,
+    distanceThreshold,
+    budget: budgets.vector,
+  }
   const vectorSearch = measureSearchStage('vector', () =>
-    hasFilters
-      ? handleTagAndVectorSearch({
-          knowledgeBaseIds,
-          topK: legTopK,
-          structuredFilters,
-          queryVector,
-          distanceThreshold,
-          access,
-          accessProvider: params.accessProvider,
-          signal: params.signal,
-          filters: params.filters,
-        })
-      : handleVectorOnlySearch({
-          knowledgeBaseIds,
-          topK: legTopK,
-          queryVector,
-          distanceThreshold,
-          access,
-          accessProvider: params.accessProvider,
-          signal: params.signal,
-          filters: params.filters,
-        })
+    hasFilters ? handleTagAndVectorSearch(vectorParams) : handleVectorOnlySearch(vectorParams)
   )
-  if (searchMode === 'vector') {
-    const results = await vectorSearch
-    return boostRecency ? applyRecencyBoost(results) : results
-  }
-
-  /**
-   * The lexical leg is best-effort: a failure there falls back to vector-only
-   * results rather than failing the whole search.
-   */
+  if (searchMode === 'vector') return finish(await vectorSearch)
   const keywordSearch = measureSearchStage('keyword', () =>
     executeKeywordSearch({
-      knowledgeBaseIds,
+      ...common,
       topK: legTopK,
       query: query!,
       queryVector,
-      structuredFilters,
-      access,
-      accessProvider: params.accessProvider,
-      signal: params.signal,
-      filters: params.filters,
-    })
-  ).catch((error) => {
-    logger.warn('Keyword search leg failed; falling back to vector-only results', {
-      error: getErrorMessage(error, 'Unknown error'),
+      budget: budgets.keyword,
     })
-    return [] as SearchResult[]
-  })
-
-  const [vectorResults, keywordResults] = await Promise.all([vectorSearch, keywordSearch])
-
-  /**
-   * Lexical leg first: on a total tie it wins, which is the behavior this mode
-   * exists for — an exact-token chunk the vector leg ranked below its distance
-   * threshold is precisely what a caller opted into hybrid to recover, and at
-   * `topK: 1` something has to win.
-   */
-  const fused = fuseByReciprocalRank([keywordResults, vectorResults], topK)
-  return boostRecency ? applyRecencyBoost(fused) : fused
+  )
+  const legs = await Promise.allSettled([vectorSearch, keywordSearch])
+  /** Wait for both legs to release SQL resources; only deadline failures permit partial success. */
+  for (const leg of legs) if (leg.status === 'rejected') throw leg.reason
+  const vectorResults = legs[0].status === 'fulfilled' ? legs[0].value : []
+  const keywordResults = legs[1].status === 'fulfilled' ? legs[1].value : []
+  return finish(fuseByReciprocalRank([keywordResults, vectorResults], topK))
 }
diff --git a/apps/sim/lib/knowledge/search/snippet.test.ts b/apps/sim/lib/knowledge/search/snippet.test.ts
index 7dbec47ab5a..684e444d4d4 100644
--- a/apps/sim/lib/knowledge/search/snippet.test.ts
+++ b/apps/sim/lib/knowledge/search/snippet.test.ts
@@ -4,7 +4,9 @@
 import { describe, expect, it } from 'vitest'
 import {
   findTermMatches,
+  matchPassage,
   matchSnippet,
+  passageWindow,
   queryTerms,
   SNIPPET_LENGTH,
   stripLeadingHeaders,
@@ -138,3 +140,30 @@ describe('matchSnippet', () => {
     expect(snippet.endsWith('…')).toBe(true)
   })
 })
+
+describe('verbatim model passages', () => {
+  it('preserves formatting and exposes the location of evidence past the opening', () => {
+    const content = `Subject: Release\n\n${'Unrelated text. '.repeat(150)}\n\tdeploy_token = "orion"\n${'Trailing text. '.repeat(100)}`
+    const preview = matchPassage(content, 'orion', 1200)
+    expect(preview.content).toContain('\n\tdeploy_token = "orion"\n')
+    expect(preview.content).toBe(content.slice(preview.startOffset, preview.endOffset))
+    expect(preview.content.length).toBeLessThanOrEqual(1200)
+    expect(preview.startOffset).toBeGreaterThan(0)
+    expect(preview.totalCharacters).toBe(content.length)
+  })
+
+  it('reassembles long Unicode chunks without splitting characters or losing text', () => {
+    const content = '中é🔎\n  code();\n'.repeat(1900)
+    let position = 0
+    let rebuilt = ''
+    while (position < content.length) {
+      const page = passageWindow(content, position, 8000)
+      expect(page.content.isWellFormed()).toBe(true)
+      expect(Buffer.byteLength(page.content)).toBeLessThanOrEqual(24000)
+      expect(page.endOffset).toBeGreaterThan(position)
+      rebuilt += page.content
+      position = page.endOffset
+    }
+    expect(rebuilt).toBe(content)
+  })
+})
diff --git a/apps/sim/lib/knowledge/search/snippet.ts b/apps/sim/lib/knowledge/search/snippet.ts
index 648e7c4060a..dbc866c77fb 100644
--- a/apps/sim/lib/knowledge/search/snippet.ts
+++ b/apps/sim/lib/knowledge/search/snippet.ts
@@ -97,6 +97,45 @@ function alignToCodePoint(text: string, index: number): number {
   return unit >= 0xdc00 && unit <= 0xdfff ? index - 1 : index
 }
 
+export interface PassageExcerpt {
+  content: string
+  /** Positions are UTF-16 code units in the input chunk. */
+  startOffset: number
+  endOffset: number
+  totalCharacters: number
+}
+
+/** A bounded, verbatim window; offsets make omitted text explicitly recoverable. */
+export function passageWindow(
+  content: string,
+  startOffset: number,
+  maxCharacters: number
+): PassageExcerpt {
+  const start = alignToCodePoint(content, Math.min(startOffset, content.length))
+  const end = alignToCodePoint(content, Math.min(start + maxCharacters, content.length))
+  return {
+    content: content.slice(start, end),
+    startOffset: start,
+    endOffset: end,
+    totalCharacters: content.length,
+  }
+}
+
+/** Search evidence preserves source formatting and anchors on the same matches as Search's UI. */
+export function matchPassage(
+  content: string,
+  query: string,
+  maxCharacters: number
+): PassageExcerpt {
+  if (content.length <= maxCharacters) return passageWindow(content, 0, maxCharacters)
+  const anchor = findTermMatches(content, queryTerms(query)).reduce<TermMatch | undefined>(
+    (best, match) => (!best || match.length > best.length ? match : best),
+    undefined
+  )
+  const start = anchor ? Math.max(0, anchor.index - Math.floor(maxCharacters / 3)) : 0
+  return passageWindow(content, start, maxCharacters)
+}
+
 /**
  * The passage of a document a search result shows: a window around the longest
  * matching query term, keeping the earliest occurrence on ties. This favors a
diff --git a/apps/sim/lib/knowledge/vector-columns.test.ts b/apps/sim/lib/knowledge/vector-columns.test.ts
index 68898ad4c0a..3d5f244a045 100644
--- a/apps/sim/lib/knowledge/vector-columns.test.ts
+++ b/apps/sim/lib/knowledge/vector-columns.test.ts
@@ -4,6 +4,7 @@
 import { describe, expect, it } from 'vitest'
 import { KB_EMBEDDING_STORAGE_DIMENSIONS } from '@/lib/embeddings/catalog'
 import {
+  embeddingCandidateDistance,
   embeddingDistance,
   embeddingVectorColumn,
   embeddingVectorValues,
@@ -20,6 +21,20 @@ describe('embeddingVectorColumn', () => {
   })
 })
 
+describe('embeddingCandidateDistance', () => {
+  it('matches the compact expression index for every stored width', () => {
+    for (const width of KB_EMBEDDING_STORAGE_DIMENSIONS) {
+      const rendered = embeddingCandidateDistance(width, '[1,2]').toSQL()
+      expect(rendered.sql).toContain('binary_quantize(?)::bit(?) <~>')
+      expect(rendered.params[0]).toBe(embeddingVectorColumn(width))
+      expect(rendered.params[1]).toEqual(rendered.params[3])
+      expect(JSON.stringify(rendered.params[1])).toContain(String(width))
+      expect(rendered.params[2]).toBe('[1,2]')
+      expect(rendered.sql).not.toContain('<=>')
+    }
+  })
+})
+
 describe('embeddingVectorValues', () => {
   const vector = [0.1, 0.2]
 
diff --git a/apps/sim/lib/knowledge/vector-columns.ts b/apps/sim/lib/knowledge/vector-columns.ts
index 3f6e084462c..057d168206e 100644
--- a/apps/sim/lib/knowledge/vector-columns.ts
+++ b/apps/sim/lib/knowledge/vector-columns.ts
@@ -69,3 +69,12 @@ export function embeddingDistance(
   }
   return sql<number>`${embeddingVectorColumn(dimensions)} <=> ${queryVector}::vector`
 }
+
+/** Compact HNSW candidate ordering; final scores always use the stored vector's cosine distance. */
+export function embeddingCandidateDistance(
+  dimensions: KbEmbeddingDimensions,
+  queryVector: string
+): SQL<number> {
+  const width = sql.raw(String(dimensions))
+  return sql<number>`binary_quantize(${embeddingVectorColumn(dimensions)})::bit(${width}) <~> binary_quantize(${queryVector}::vector)::bit(${width})`
+}
diff --git a/apps/sim/lib/mcp/client.test.ts b/apps/sim/lib/mcp/client.test.ts
index 1d5ff39964d..bb7784bdbed 100644
--- a/apps/sim/lib/mcp/client.test.ts
+++ b/apps/sim/lib/mcp/client.test.ts
@@ -22,6 +22,7 @@ vi.mock('@sim/logger', () => ({
 
 vi.mock('@/lib/mcp/pinned-fetch', () => ({
   createGuardedMcpFetch: vi.fn(() => ({ fetch: vi.fn(), close: mockPinnedClose })),
+  createPinnedPrivateMcpFetch: vi.fn(() => ({ fetch: vi.fn(), close: mockPinnedClose })),
 }))
 
 /**
@@ -72,6 +73,7 @@ vi.mock('@/lib/core/execution-limits', () => ({
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
 import { getMaxExecutionTimeout } from '@/lib/core/execution-limits'
 import { McpClient } from '@/lib/mcp/client'
+import { createGuardedMcpFetch, createPinnedPrivateMcpFetch } from '@/lib/mcp/pinned-fetch'
 import {
   type McpClientOptions,
   McpOauthAuthorizationRequiredError,
@@ -372,6 +374,38 @@ describe('McpClient notification handler', () => {
     expect(JSON.stringify(mockLogger.error.mock.calls)).not.toContain(secret)
   })
 
+  it('keeps the transport on the SSRF guard when no validated address is supplied', () => {
+    new McpClient({
+      config: createConfig(),
+      securityPolicy: { requireConsent: false, auditLevel: 'basic' },
+    })
+
+    const guarded = vi.mocked(createGuardedMcpFetch).mock.results.at(-1)?.value
+    expect(createGuardedMcpFetch).toHaveBeenCalledWith('https://test.example.com/mcp')
+    expect(createPinnedPrivateMcpFetch).not.toHaveBeenCalled()
+    expect(vi.mocked(StreamableHTTPClientTransport).mock.calls.at(-1)?.[1]?.fetch).toBe(
+      guarded.fetch
+    )
+  })
+
+  it('pins the transport to a validated private address', () => {
+    new McpClient({
+      config: createConfig(),
+      securityPolicy: { requireConsent: false, auditLevel: 'basic' },
+      resolvedIP: '10.0.0.5',
+    })
+
+    const pinned = vi.mocked(createPinnedPrivateMcpFetch).mock.results.at(-1)?.value
+    expect(createPinnedPrivateMcpFetch).toHaveBeenCalledWith(
+      '10.0.0.5',
+      'https://test.example.com/mcp'
+    )
+    expect(createGuardedMcpFetch).not.toHaveBeenCalled()
+    expect(vi.mocked(StreamableHTTPClientTransport).mock.calls.at(-1)?.[1]?.fetch).toBe(
+      pinned.fetch
+    )
+  })
+
   it('closes the pinned transport Agent when connect fails', async () => {
     mockSdkConnect.mockRejectedValueOnce(new Error('connect boom'))
     const client = new McpClient({
diff --git a/apps/sim/lib/mcp/client.ts b/apps/sim/lib/mcp/client.ts
index 296478e16cb..bcfe4a5072d 100644
--- a/apps/sim/lib/mcp/client.ts
+++ b/apps/sim/lib/mcp/client.ts
@@ -119,19 +119,18 @@ export class McpClient {
       throw new McpError('OAuth MCP server must use one authentication strategy')
     }
     const useOauth = this.config.authType === 'oauth'
-    // `resolvedIP` is null only when the hostname still carries an unresolved env-var
-    // reference, which is checked again once it resolves. Otherwise the guard validates
-    // addresses per-connect. A private/loopback resolvedIP only reaches here on a
-    // self-hosted deployment whose policy permits it, and that case pins to the address
-    // that was validated rather than to whatever the name resolves to next.
-    const guarded = resolvedIP
-      ? isPrivateIp(resolvedIP)
+    // The transport never runs on the global fetch: the guard validates addresses
+    // per-connect and redirects per-hop whether or not a caller validated the URL
+    // first. A private/loopback resolvedIP only reaches here on a self-hosted
+    // deployment whose policy permits it, and that case pins to the address that
+    // was validated rather than to whatever the name resolves to next.
+    const guarded =
+      resolvedIP && isPrivateIp(resolvedIP)
         ? createPinnedPrivateMcpFetch(resolvedIP, this.config.url)
         : createGuardedMcpFetch(this.config.url)
-      : undefined
-    this.closeGuardedTransport = guarded?.close
+    this.closeGuardedTransport = guarded.close
     const oauthFetch = useOauth
-      ? createMcpEndpointFetch(guarded?.fetch ?? fetch, {
+      ? createMcpEndpointFetch(guarded.fetch, {
           serverUrl: this.config.url,
           headers: this.config.headers,
         })
@@ -142,11 +141,11 @@ export class McpClient {
             serverUrl: this.config.url,
             fetch: oauthFetch,
           })
-        : (oauthFetch ?? guarded?.fetch)
+        : (oauthFetch ?? guarded.fetch)
     this.transport = new StreamableHTTPClientTransport(new URL(this.config.url), {
       authProvider: useOauth ? this.authProvider : undefined,
       ...(useOauth ? {} : { requestInit: { headers: this.config.headers } }),
-      ...(transportFetch ? { fetch: transportFetch } : {}),
+      fetch: transportFetch,
     })
 
     this.client = new Client(
diff --git a/apps/sim/lib/mcp/connection-manager.test.ts b/apps/sim/lib/mcp/connection-manager.test.ts
index 6d66ca07340..0954cec05e3 100644
--- a/apps/sim/lib/mcp/connection-manager.test.ts
+++ b/apps/sim/lib/mcp/connection-manager.test.ts
@@ -34,13 +34,23 @@ const {
   mockOnToolsChanged,
   mockPublishToolsChanged,
   mockGetOrCreateOauthRow,
+  mockValidateMcpDomain,
+  mockValidateMcpServerSsrf,
+  mockWithResourceOutboundScope,
 } = vi.hoisted(() => ({
+  mockWithResourceOutboundScope: vi.fn(),
   MockMcpClientConstructor: vi.fn(),
+  mockValidateMcpDomain: vi.fn(),
+  mockValidateMcpServerSsrf: vi.fn(),
   mockOnToolsChanged: vi.fn(() => vi.fn()),
   mockPublishToolsChanged: vi.fn(),
   mockGetOrCreateOauthRow: vi.fn(),
 }))
 
+vi.mock('@/lib/core/network/resource-scope.server', () => ({
+  withResourceOutboundScope: mockWithResourceOutboundScope,
+}))
+
 vi.mock('@/lib/mcp/pubsub', () => ({
   mcpPubSub: {
     onToolsChanged: mockOnToolsChanged,
@@ -50,6 +60,10 @@ vi.mock('@/lib/mcp/pubsub', () => ({
 vi.mock('@/lib/mcp/client', () => ({
   McpClient: MockMcpClientConstructor,
 }))
+vi.mock('@/lib/mcp/domain-check', () => ({
+  validateMcpDomain: mockValidateMcpDomain,
+  validateMcpServerSsrf: mockValidateMcpServerSsrf,
+}))
 vi.mock('@/lib/mcp/oauth', () => ({
   getOrCreateOauthRow: mockGetOrCreateOauthRow,
   loadPreregisteredClient: vi.fn(),
@@ -76,6 +90,8 @@ describe('McpConnectionManager', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
+    mockWithResourceOutboundScope.mockImplementation((_owner, run) => run())
+    mockValidateMcpServerSsrf.mockResolvedValue('93.184.216.34')
     mockGetOrCreateOauthRow.mockResolvedValue({
       id: 'oauth-row-1',
       mcpServerId: 'server-oauth',
@@ -102,6 +118,28 @@ describe('McpConnectionManager', () => {
   }
 
   describe('concurrent connect() guard', () => {
+    it('allows retrying a connection after workspace ownership resolution fails', async () => {
+      const connect = vi.fn().mockResolvedValue(undefined)
+      MockMcpClientConstructor.mockImplementation(
+        class {
+          connect = connect
+          disconnect = vi.fn().mockResolvedValue(undefined)
+          hasListChangedCapability = () => true
+          onClose = vi.fn()
+        }
+      )
+      const mgr = createFreshManager()
+      const config = serverConfig('server-retry')
+      mockWithResourceOutboundScope.mockRejectedValueOnce(new Error('Workspace unavailable'))
+
+      await expect(mgr.connect(config, 'user-1', 'ws-1')).rejects.toThrow('Workspace unavailable')
+      expect(MockMcpClientConstructor).not.toHaveBeenCalled()
+      await expect(mgr.connect(config, 'user-1', 'ws-1')).resolves.toEqual({
+        supportsListChanged: true,
+      })
+      expect(connect).toHaveBeenCalledOnce()
+    })
+
     it('creates only one client when two connect() calls race for the same serverId', async () => {
       const deferred = createDeferred()
       const instances: MockMcpClient[] = []
@@ -277,6 +315,82 @@ describe('McpConnectionManager', () => {
     })
   })
 
+  describe('destination validation', () => {
+    function mockClients(closeHandlers: Array<() => void> = []): MockMcpClient[] {
+      const instances: MockMcpClient[] = []
+      MockMcpClientConstructor.mockImplementation(
+        class {
+          constructor() {
+            const instance: MockMcpClient = {
+              connect: vi.fn().mockResolvedValue(undefined),
+              disconnect: vi.fn().mockResolvedValue(undefined),
+              hasListChangedCapability: vi.fn().mockReturnValue(true),
+              onClose: vi.fn().mockImplementation((handler: () => void) => {
+                closeHandlers.push(handler)
+              }),
+            }
+            instances.push(instance)
+            Object.assign(this, instance)
+          }
+        }
+      )
+      return instances
+    }
+
+    it('validates the destination and hands the resolved address to the client', async () => {
+      mockClients()
+      const mgr = createFreshManager()
+      const config = serverConfig('server-validate')
+
+      await mgr.connect(config, 'user-1', 'ws-1')
+
+      expect(mockValidateMcpDomain).toHaveBeenCalledWith(config.url)
+      expect(mockValidateMcpServerSsrf).toHaveBeenCalledWith(config.url)
+      const options: McpClientOptions = MockMcpClientConstructor.mock.calls[0][0]
+      expect(options.resolvedIP).toBe('93.184.216.34')
+    })
+
+    it('never constructs a client for a refused destination and releases the connecting slot', async () => {
+      const instances = mockClients()
+      mockValidateMcpServerSsrf.mockRejectedValueOnce(new Error('refused by egress policy'))
+      const mgr = createFreshManager()
+      const config = serverConfig('server-refused')
+
+      await expect(mgr.connect(config, 'user-1', 'ws-1')).rejects.toThrow(
+        'refused by egress policy'
+      )
+      expect(instances).toHaveLength(0)
+
+      const retry = await mgr.connect(config, 'user-1', 'ws-1')
+      expect(retry.supportsListChanged).toBe(true)
+      expect(instances).toHaveLength(1)
+    })
+
+    it('re-validates the destination before every reconnect', async () => {
+      vi.useFakeTimers()
+      const closeHandlers: Array<() => void> = []
+      const instances = mockClients(closeHandlers)
+      const mgr = createFreshManager()
+      const config = serverConfig('server-reconnect')
+
+      await mgr.connect(config, 'user-1', 'ws-1')
+      mockValidateMcpServerSsrf.mockRejectedValueOnce(new Error('refused by egress policy'))
+      mockValidateMcpServerSsrf.mockResolvedValueOnce('93.184.216.35')
+
+      closeHandlers[0]()
+      await vi.advanceTimersByTimeAsync(2_000)
+      expect(mockValidateMcpServerSsrf).toHaveBeenCalledTimes(2)
+      expect(instances).toHaveLength(1)
+
+      await vi.advanceTimersByTimeAsync(5_000)
+      expect(mockValidateMcpServerSsrf).toHaveBeenCalledTimes(3)
+      expect(instances).toHaveLength(2)
+      const options: McpClientOptions = MockMcpClientConstructor.mock.calls[1][0]
+      expect(options.resolvedIP).toBe('93.184.216.35')
+      expect(mgr.hasConnection('server-reconnect')).toBe(true)
+    })
+  })
+
   describe('dispose', () => {
     it('rejects new connections after dispose', async () => {
       MockMcpClientConstructor.mockImplementation(
diff --git a/apps/sim/lib/mcp/connection-manager.ts b/apps/sim/lib/mcp/connection-manager.ts
index a0e6d448bd2..5c64310dcba 100644
--- a/apps/sim/lib/mcp/connection-manager.ts
+++ b/apps/sim/lib/mcp/connection-manager.ts
@@ -1,3 +1,4 @@
+import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 /**
  * MCP Connection Manager
  *
@@ -14,6 +15,7 @@ import { createLogger } from '@sim/logger'
 import { backoffWithJitter } from '@sim/utils/retry'
 import { isTest } from '@/lib/core/config/env-flags'
 import { McpClient } from '@/lib/mcp/client'
+import { validateMcpDomain, validateMcpServerSsrf } from '@/lib/mcp/domain-check'
 import { getOrCreateOauthRow, loadPreregisteredClient, SimMcpOauthProvider } from '@/lib/mcp/oauth'
 import { mcpPubSub } from '@/lib/mcp/pubsub'
 import {
@@ -106,12 +108,19 @@ export class McpConnectionManager {
    *
    * If the server does NOT support `listChanged`, the client is disconnected
    * immediately — there's nothing to listen for.
+   *
+   * `config` must already have its env-var references resolved. The destination
+   * is validated here on every dial, including reconnects, so the address is
+   * never carried over from an earlier resolution.
+   *
+   * @throws McpDomainNotAllowedError when the domain is not allowlisted
+   * @throws McpSsrfError when the egress policy refuses the destination
+   * @throws McpDnsResolutionError when the hostname cannot be resolved
    */
   async connect(
     config: McpServerConfig,
     userId: string,
-    workspaceId: string,
-    resolvedIP?: string | null
+    workspaceId: string
   ): Promise<{ supportsListChanged: boolean }> {
     if (this.disposed) {
       logger.warn('Connection manager is disposed, ignoring connect request')
@@ -134,95 +143,100 @@ export class McpConnectionManager {
     this.connectingServers.add(key)
 
     try {
-      const onToolsChanged: McpToolsChangedCallback = () => {
-        this.handleToolsChanged(key)
-      }
+      return await withResourceOutboundScope({ workspaceId }, async () => {
+        const onToolsChanged: McpToolsChangedCallback = () => {
+          this.handleToolsChanged(key)
+        }
 
-      let oauthCredentials: McpClientOptions['oauthCredentials']
-      if (config.authType === 'oauth') {
-        const row = await getOrCreateOauthRow({
-          mcpServerId: config.id,
-          userId,
-          workspaceId,
-        })
-        if (!row.tokens) {
-          logger.info(
-            `[${config.name}] OAuth server has no workspace tokens — skipping persistent connection until authorized`
-          )
-          return { supportsListChanged: false }
+        let oauthCredentials: McpClientOptions['oauthCredentials']
+        if (config.authType === 'oauth') {
+          const row = await getOrCreateOauthRow({
+            mcpServerId: config.id,
+            userId,
+            workspaceId,
+          })
+          if (!row.tokens) {
+            logger.info(
+              `[${config.name}] OAuth server has no workspace tokens — skipping persistent connection until authorized`
+            )
+            return { supportsListChanged: false }
+          }
+          oauthCredentials = {
+            credentialId: config.id,
+            initialProvider: new SimMcpOauthProvider({
+              row,
+              preregistered: await loadPreregisteredClient(config.id),
+            }),
+            loadProvider: async () => {
+              const current = await getOrCreateOauthRow({
+                mcpServerId: config.id,
+                userId,
+                workspaceId,
+              })
+              if (!current.tokens) {
+                throw new McpOauthAuthorizationRequiredError(config.id, config.name)
+              }
+              const preregistered = await loadPreregisteredClient(config.id)
+              return new SimMcpOauthProvider({ row: current, preregistered })
+            },
+          }
         }
-        oauthCredentials = {
-          credentialId: config.id,
-          initialProvider: new SimMcpOauthProvider({
-            row,
-            preregistered: await loadPreregisteredClient(config.id),
-          }),
-          loadProvider: async () => {
-            const current = await getOrCreateOauthRow({
-              mcpServerId: config.id,
-              userId,
-              workspaceId,
-            })
-            if (!current.tokens) {
-              throw new McpOauthAuthorizationRequiredError(config.id, config.name)
-            }
-            const preregistered = await loadPreregisteredClient(config.id)
-            return new SimMcpOauthProvider({ row: current, preregistered })
+
+        validateMcpDomain(config.url)
+        const resolvedIP = await validateMcpServerSsrf(config.url)
+
+        const client = new McpClient({
+          config,
+          securityPolicy: {
+            requireConsent: false,
+            auditLevel: 'basic',
+            maxToolExecutionsPerHour: 1000,
           },
+          onToolsChanged,
+          resolvedIP: resolvedIP ?? undefined,
+          oauthCredentials,
+        })
+
+        try {
+          await withConnectTimeout(client, config.name)
+        } catch (error) {
+          logger.error(`[${config.name}] Failed to connect for persistent monitoring:`, error)
+          return { supportsListChanged: false }
         }
-      }
 
-      const client = new McpClient({
-        config,
-        securityPolicy: {
-          requireConsent: false,
-          auditLevel: 'basic',
-          maxToolExecutionsPerHour: 1000,
-        },
-        onToolsChanged,
-        resolvedIP: resolvedIP ?? undefined,
-        oauthCredentials,
-      })
+        const supportsListChanged = client.hasListChangedCapability()
 
-      try {
-        await withConnectTimeout(client, config.name)
-      } catch (error) {
-        logger.error(`[${config.name}] Failed to connect for persistent monitoring:`, error)
-        return { supportsListChanged: false }
-      }
+        if (!supportsListChanged) {
+          logger.info(
+            `[${config.name}] Server does not support listChanged — disconnecting (fallback to cache)`
+          )
+          await client.disconnect()
+          return { supportsListChanged: false }
+        }
 
-      const supportsListChanged = client.hasListChangedCapability()
+        this.clearReconnectTimer(key)
 
-      if (!supportsListChanged) {
-        logger.info(
-          `[${config.name}] Server does not support listChanged — disconnecting (fallback to cache)`
-        )
-        await client.disconnect()
-        return { supportsListChanged: false }
-      }
+        this.connections.set(key, client)
+        this.states.set(key, {
+          serverId: config.id,
+          serverName: config.name,
+          workspaceId,
+          userId,
+          connected: true,
+          supportsListChanged: true,
+          reconnectAttempts: 0,
+          lastActivity: Date.now(),
+        })
 
-      this.clearReconnectTimer(key)
+        client.onClose(() => {
+          this.handleDisconnect(config, userId, workspaceId)
+        })
 
-      this.connections.set(key, client)
-      this.states.set(key, {
-        serverId: config.id,
-        serverName: config.name,
-        workspaceId,
-        userId,
-        connected: true,
-        supportsListChanged: true,
-        reconnectAttempts: 0,
-        lastActivity: Date.now(),
-      })
+        this.ensureIdleCheck()
 
-      client.onClose(() => {
-        this.handleDisconnect(config, userId, workspaceId)
+        logger.info(`[${config.name}] Persistent connection established (listChanged supported)`)
+        return { supportsListChanged: true }
       })
-
-      this.ensureIdleCheck()
-
-      logger.info(`[${config.name}] Persistent connection established (listChanged supported)`)
-      return { supportsListChanged: true }
     } finally {
       this.connectingServers.delete(key)
     }
diff --git a/apps/sim/lib/mcp/middleware.ts b/apps/sim/lib/mcp/middleware.ts
index 88be4b04c39..a3bec4ce0dd 100644
--- a/apps/sim/lib/mcp/middleware.ts
+++ b/apps/sim/lib/mcp/middleware.ts
@@ -8,6 +8,7 @@ import {
   checkSessionOrInternalAuth,
   type AuthResult as HybridAuthResult,
 } from '@/lib/auth/hybrid'
+import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import { generateRequestId } from '@/lib/core/utils/request'
 import {
   assertContentLengthWithinLimit,
@@ -328,7 +329,10 @@ export function withMcpAuth<TParams = Record<string, string>>(
       }
 
       try {
-        return await handler(request, (authResult as AuthResult).context, routeContext)
+        const context = (authResult as AuthResult).context
+        return await withResourceOutboundScope({ workspaceId: context.workspaceId }, () =>
+          handler(request, context, routeContext)
+        )
       } catch (error) {
         const bodyErrorResponse = mcpBodyReadErrorResponse(error, request)
         if (bodyErrorResponse) return bodyErrorResponse
diff --git a/apps/sim/lib/mcp/pinned-fetch.ts b/apps/sim/lib/mcp/pinned-fetch.ts
index a8360236156..a09d263299f 100644
--- a/apps/sim/lib/mcp/pinned-fetch.ts
+++ b/apps/sim/lib/mcp/pinned-fetch.ts
@@ -1,10 +1,10 @@
 import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js'
 import { createLogger } from '@sim/logger'
 import { isPrivateIp } from '@sim/security/ssrf'
-import type { Agent } from 'undici'
 import {
   createPinnedFetchWithDispatcher,
   createSsrfGuardedFetchWithDispatcher,
+  type OutboundFetchDispatcher,
 } from '@/lib/core/security/input-validation.server'
 import {
   MCP_EGRESS_PROFILE,
@@ -277,7 +277,7 @@ async function bufferUnderDeadline(response: Response, signal: AbortSignal): Pro
  */
 function releaseStreamOnSettle(
   response: Response,
-  dispatcher: Agent | undefined,
+  dispatcher: OutboundFetchDispatcher | undefined,
   signal: AbortSignal
 ): Response {
   if (!dispatcher || !response.body) {
@@ -349,7 +349,7 @@ export function createSsrfGuardedMcpFetch(
     // Bound every phase — validation, request, body read — by the deadline + caller signal.
     const signal = init?.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal
     // Per-request Agent must be torn down (finally): a one-shot leg never reuses its socket.
-    let dispatcher: Agent | undefined
+    let dispatcher: OutboundFetchDispatcher | undefined
     try {
       logger.info('OAuth guarded fetch: validating', { host })
       const resolvedIP = await withDeadline(validateMcpServerSsrf(target, profile), signal)
diff --git a/apps/sim/lib/mcp/service.ts b/apps/sim/lib/mcp/service.ts
index 74ce71f6d66..7d93b58112b 100644
--- a/apps/sim/lib/mcp/service.ts
+++ b/apps/sim/lib/mcp/service.ts
@@ -1095,12 +1095,12 @@ class McpService {
           // survives a transport loss and would block that fresh reconnect.
           void (async () => {
             try {
-              const { config: resolvedConfig, resolvedIP } = await this.resolveConfigEnvVars(
+              const { config: resolvedConfig } = await resolveMcpConfigEnvVars(
                 config,
                 userId,
                 workspaceId
               )
-              await manager.connect(resolvedConfig, userId, workspaceId, resolvedIP)
+              await manager.connect(resolvedConfig, userId, workspaceId)
             } catch (err) {
               logger.warn(`[${requestId}] Persistent connection failed for ${config.name}:`, err)
             }
diff --git a/apps/sim/lib/mcp/types.ts b/apps/sim/lib/mcp/types.ts
index 91dbfadde3c..a4007638a03 100644
--- a/apps/sim/lib/mcp/types.ts
+++ b/apps/sim/lib/mcp/types.ts
@@ -197,11 +197,11 @@ export interface McpClientOptions {
   securityPolicy?: McpSecurityPolicy
   onToolsChanged?: McpToolsChangedCallback
   /**
-   * Pre-resolved IP address to pin all transport HTTP connections to. When
-   * set, the SDK transport uses a custom fetch backed by an undici Agent with
-   * a fixed DNS lookup, preventing DNS-rebinding (TOCTOU) attacks between
-   * URL validation and connection. Should be supplied by callers that have
-   * just validated the URL via `validateMcpServerSsrf`.
+   * Address returned by `validateMcpServerSsrf` for this URL. A private/loopback
+   * address (only permitted on a self-hosted deployment whose policy allows it)
+   * pins every transport connection to it, so the name cannot rebind elsewhere
+   * after validation. A public address or none leaves the transport on the SSRF
+   * guard, which validates every connect and redirect hop itself.
    */
   resolvedIP?: string
   /**
diff --git a/apps/sim/lib/selectors/application/execute-selector.ts b/apps/sim/lib/selectors/application/execute-selector.ts
index 32ca55fb3b5..ca802667784 100644
--- a/apps/sim/lib/selectors/application/execute-selector.ts
+++ b/apps/sim/lib/selectors/application/execute-selector.ts
@@ -7,6 +7,7 @@ import {
 import { defineAuthorizedWorkspaceUseCase } from '@/lib/core/application'
 import type { OperationUseCase } from '@/lib/core/application/operation'
 import { requireOrganizationMembership } from '@/lib/core/application/organization-authorization'
+import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { authorizePersonalSearchSetup } from '@/lib/knowledge/application/personal-search-account'
 import { type CredentialAuditRequest, recordCredentialAccess } from '@/lib/oauth/token-resolution'
@@ -371,6 +372,7 @@ export const executeSelector: OperationUseCase<
       scope: args.input.scope,
     })
     validateAuthorizedInput(args.input, context)
-    return executeAuthorizedSelector({ principal: args.principal, input: args.input, context })
+    const executionArgs = { principal: args.principal, input: args.input, context }
+    return withResourceOutboundScope(context, () => executeAuthorizedSelector(executionArgs))
   },
 }
diff --git a/apps/sim/lib/sim-search/connections.ts b/apps/sim/lib/sim-search/connections.ts
deleted file mode 100644
index bb3a172ef3c..00000000000
--- a/apps/sim/lib/sim-search/connections.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-import type { WorkspaceMemberConnector } from '@/lib/api/contracts/knowledge/connectors'
-
-/** The canonical index keeps every configured source, including multiple sites of one provider. */
-export function groupSearchConnections(connectors: readonly WorkspaceMemberConnector[]) {
-  const connectionByType = new Map<string, WorkspaceMemberConnector[]>()
-  const sharedConnectors: WorkspaceMemberConnector[] = []
-  for (const connector of connectors) {
-    if (connector.knowledgeBaseIsSearchIndex === true) {
-      const existing = connectionByType.get(connector.connectorType)
-      if (existing) existing.push(connector)
-      else connectionByType.set(connector.connectorType, [connector])
-    } else {
-      sharedConnectors.push(connector)
-    }
-  }
-  return { connectionByType, sharedConnectors }
-}
diff --git a/apps/sim/app/workspace/[workspaceId]/search/search-params.ts b/apps/sim/lib/sim-search/search-params.ts
similarity index 63%
rename from apps/sim/app/workspace/[workspaceId]/search/search-params.ts
rename to apps/sim/lib/sim-search/search-params.ts
index a20092ce98a..3d0116eb784 100644
--- a/apps/sim/app/workspace/[workspaceId]/search/search-params.ts
+++ b/apps/sim/lib/sim-search/search-params.ts
@@ -36,23 +36,3 @@ export const searchSetupReturnParam = {
 } as const
 
 export type SearchSetupSource = NonNullable<ReturnType<typeof searchSetupParam.parser.parse>>
-
-/**
- * `search` filters the Sim Search connector list by name and description. The
- * input is controlled directly by the instant nuqs value; only its URL write is
- * debounced via `useDebouncedSearchSetter` — never written on every keystroke.
- */
-export const connectorSearchParam = {
-  key: 'search',
-  parser: parseAsString.withDefault(''),
-} as const
-
-/** Search is filter view-state: clean URLs, no back-stack churn. */
-export const connectorSearchUrlKeys = {
-  history: 'replace',
-  clearOnDefault: true,
-} as const
-
-export type SearchSetupReturnSource = NonNullable<
-  ReturnType<typeof searchSetupReturnParam.parser.parse>
->
diff --git a/apps/sim/lib/sim-search/setup-navigation.test.ts b/apps/sim/lib/sim-search/setup-navigation.test.ts
index 25d0be5f7d5..1c41cd7a0c8 100644
--- a/apps/sim/lib/sim-search/setup-navigation.test.ts
+++ b/apps/sim/lib/sim-search/setup-navigation.test.ts
@@ -1,26 +1,20 @@
-/**
- * @vitest-environment node
- */
+/** @vitest-environment node */
 import { describe, expect, it } from 'vitest'
-import { searchSetupReturnHref, slackSearchSetupHref } from '@/lib/sim-search/setup-navigation'
+import {
+  organizationSearchSetupPath,
+  slackSearchSetupHref,
+} from '@/lib/sim-search/setup-navigation'
 
-describe('source setup detours', () => {
-  it('keeps organization Slack setup and its continuation in the same organization', () => {
-    const scope = { kind: 'organization' as const, organizationId: 'org-1' }
-    expect(slackSearchSetupHref(scope, 'slack')).toBe(
-      '/o/org-1/settings/integrations?search-setup=slack&connectedAccounts=slack'
-    )
-    expect(searchSetupReturnHref(scope, 'slack')).toBe(
-      '/o/org-1/settings/integrations?addConnector=slack'
-    )
-    expect(searchSetupReturnHref(scope, 'search')).toBe('/o/org-1/settings/integrations')
-  })
-  it('preserves workspace continuation links', () => {
-    expect(searchSetupReturnHref('workspace-1', 'google_drive')).toBe(
-      '/workspace/workspace-1/search?addConnector=google_drive'
-    )
-    expect(slackSearchSetupHref('workspace-1', 'slack')).toContain(
-      '/workspace/workspace-1/settings/credential-groups?search-setup=slack&'
-    )
+describe('organization source setup', () => {
+  it('opens organization integrations settings', () => {
+    expect(organizationSearchSetupPath('org-1')).toBe('/o/org-1/settings/integrations')
   })
+  it.each(['slack', 'search'] as const)(
+    'preserves the %s continuation through Slack account setup',
+    (source) => {
+      expect(slackSearchSetupHref('org-1', source)).toBe(
+        `/o/org-1/settings/integrations?search-setup=${source}&connectedAccounts=slack`
+      )
+    }
+  )
 })
diff --git a/apps/sim/lib/sim-search/setup-navigation.ts b/apps/sim/lib/sim-search/setup-navigation.ts
index 332e8caf824..4c101dc473a 100644
--- a/apps/sim/lib/sim-search/setup-navigation.ts
+++ b/apps/sim/lib/sim-search/setup-navigation.ts
@@ -1,50 +1,16 @@
-import type { ResourceScope } from '@/lib/core/resource-scope'
 import { organizationRoutes } from '@/lib/navigation/paths'
-import {
-  type SearchSetupReturnSource,
-  searchSetupParam,
-  searchSetupReturnParam,
-} from '@/app/workspace/[workspaceId]/search/search-params'
-import { credentialGroupProviderSearchParam } from '@/app/workspace/[workspaceId]/settings/[section]/search-params'
+import { searchSetupReturnParam } from '@/lib/sim-search/search-params'
 
-/** Where an organization admin sets up Sim Search sources: the Integrations section of its settings. */
+/** Where an organization admin sets up Sim Search sources. */
 export function organizationSearchSetupPath(organizationId: string): string {
   return organizationRoutes(organizationId).settingsSection('integrations')
 }
 
-/** Carries Search setup through an existing integration or settings screen. */
-export function searchSetupDestination(path: string, source: SearchSetupReturnSource): string {
-  const params = new URLSearchParams({ [searchSetupReturnParam.key]: source })
-  return `${path}?${params}`
-}
-
-export function searchSetupReturnHref(
-  owner: string | ResourceScope,
-  source: SearchSetupReturnSource
-): string {
-  const scope =
-    typeof owner === 'string' ? { kind: 'workspace' as const, workspaceId: owner } : owner
-  const path =
-    scope.kind === 'organization'
-      ? organizationSearchSetupPath(scope.organizationId)
-      : `/workspace/${scope.workspaceId}/search`
-  return source === 'search'
-    ? path
-    : `${path}?${new URLSearchParams({ [searchSetupParam.key]: source })}`
-}
-
-/** Opens the Slack account configuration within the existing settings surface. */
-export function slackSearchSetupHref(
-  owner: string | ResourceScope,
-  source: 'slack' | 'search'
-): string {
-  const scope =
-    typeof owner === 'string' ? { kind: 'workspace' as const, workspaceId: owner } : owner
-  const path =
-    scope.kind === 'organization'
-      ? organizationSearchSetupPath(scope.organizationId)
-      : `/workspace/${scope.workspaceId}/settings/credential-groups`
-  const providerKey =
-    scope.kind === 'organization' ? 'connectedAccounts' : credentialGroupProviderSearchParam.key
-  return `${searchSetupDestination(path, source)}&${new URLSearchParams({ [providerKey]: 'slack' })}`
+/** Opens Slack account configuration and preserves the organization setup form. */
+export function slackSearchSetupHref(organizationId: string, source: 'slack' | 'search'): string {
+  const params = new URLSearchParams({
+    [searchSetupReturnParam.key]: source,
+    connectedAccounts: 'slack',
+  })
+  return `${organizationSearchSetupPath(organizationId)}?${params}`
 }
diff --git a/apps/sim/app/workspace/[workspaceId]/search/components/search-source-row-status.ts b/apps/sim/lib/sim-search/source-status.ts
similarity index 100%
rename from apps/sim/app/workspace/[workspaceId]/search/components/search-source-row-status.ts
rename to apps/sim/lib/sim-search/source-status.ts
diff --git a/apps/sim/lib/webhooks/polling/orchestrator.ts b/apps/sim/lib/webhooks/polling/orchestrator.ts
index 6a7f553eb7d..d6cf75822b5 100644
--- a/apps/sim/lib/webhooks/polling/orchestrator.ts
+++ b/apps/sim/lib/webhooks/polling/orchestrator.ts
@@ -1,5 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { generateShortId } from '@sim/utils/id'
+import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import { getPollingHandler } from '@/lib/webhooks/polling/registry'
 import type { PollSummary } from '@/lib/webhooks/polling/types'
 import { fetchActiveWebhooks, runWithConcurrency } from '@/lib/webhooks/polling/utils'
@@ -26,12 +27,14 @@ export async function pollProvider(providerName: string): Promise<PollSummary> {
     activeWebhooks,
     async (entry) => {
       const requestId = generateShortId()
-      return handler.pollWebhook({
-        webhookData: entry.webhook,
-        workflowData: entry.workflow,
-        requestId,
-        logger,
-      })
+      return withResourceOutboundScope({ workspaceId: entry.workflow.workspaceId }, () =>
+        handler.pollWebhook({
+          webhookData: entry.webhook,
+          workflowData: entry.workflow,
+          requestId,
+          logger,
+        })
+      )
     },
     logger
   )
diff --git a/apps/sim/lib/webhooks/polling/outlook.ts b/apps/sim/lib/webhooks/polling/outlook.ts
index 4cedf69a4dd..7ee7e269233 100644
--- a/apps/sim/lib/webhooks/polling/outlook.ts
+++ b/apps/sim/lib/webhooks/polling/outlook.ts
@@ -2,7 +2,7 @@ import type { Logger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { htmlToText } from 'html-to-text'
 import { pollingIdempotency } from '@/lib/core/idempotency/service'
-import { fetchWithRetry } from '@/lib/knowledge/documents/utils'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
 import {
   getProviderConfig,
   type PollingProviderHandler,
diff --git a/apps/sim/lib/webhooks/polling/rss.test.ts b/apps/sim/lib/webhooks/polling/rss.test.ts
new file mode 100644
index 00000000000..490e4a06bab
--- /dev/null
+++ b/apps/sim/lib/webhooks/polling/rss.test.ts
@@ -0,0 +1,128 @@
+/**
+ * @vitest-environment node
+ */
+import { createLogger } from '@sim/logger'
+import { createWorkflowRecord } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockFetch, mockValidateUrl, mockProcessEvent, mockUpdateConfig } = vi.hoisted(() => ({
+  mockFetch: vi.fn(),
+  mockValidateUrl: vi.fn(),
+  mockProcessEvent: vi.fn(),
+  mockUpdateConfig: vi.fn(),
+}))
+
+vi.mock('@/lib/core/security/input-validation.server', () => ({
+  secureFetchWithPinnedIP: mockFetch,
+  validateUrlWithDNS: mockValidateUrl,
+}))
+
+vi.mock('@/lib/core/idempotency/service', () => ({
+  pollingIdempotency: {
+    executeWithIdempotency: vi.fn(
+      async (_provider: string, _key: string, execute: () => Promise<unknown>) => execute()
+    ),
+  },
+}))
+
+vi.mock('@/lib/webhooks/processor', () => ({
+  processPolledWebhookEvent: mockProcessEvent,
+}))
+
+vi.mock('@/lib/webhooks/polling/utils', () => ({
+  markWebhookSuccess: vi.fn(),
+  markWebhookFailed: vi.fn(),
+  updateWebhookProviderConfig: mockUpdateConfig,
+}))
+
+import { rssPollingHandler } from '@/lib/webhooks/polling/rss'
+import type { PollWebhookContext, WebhookRecord } from '@/lib/webhooks/polling/types'
+
+const SUBSCRIBED_AT = new Date('2026-08-27T18:36:16.000Z')
+const LAST_CHECKED_AT = '2026-09-11T23:26:27.000Z'
+const GUID = 'https://example.com/news/late-item'
+
+function context(lastSeenGuids: string[] = []): PollWebhookContext {
+  const webhookData: WebhookRecord = {
+    id: 'rss-webhook',
+    workflowId: 'rss-listener',
+    deploymentVersionId: null,
+    registrationStatus: null,
+    registrationGeneration: null,
+    configFingerprint: null,
+    preparedAt: null,
+    blockId: null,
+    path: 'rss-listener',
+    routingKey: null,
+    provider: 'rss',
+    providerConfig: {
+      feedUrl: 'https://example.com/feed.xml',
+      lastCheckedTimestamp: LAST_CHECKED_AT,
+      lastSeenGuids,
+    },
+    isActive: true,
+    failedCount: 0,
+    lastFailedAt: null,
+    archivedAt: null,
+    createdAt: SUBSCRIBED_AT,
+    updatedAt: new Date(LAST_CHECKED_AT),
+  }
+  return {
+    webhookData,
+    workflowData: createWorkflowRecord({
+      id: 'rss-listener',
+    }) as PollWebhookContext['workflowData'],
+    requestId: 'rss-request',
+    logger: createLogger('RssTest'),
+  }
+}
+
+function feed(pubDate: string) {
+  return new Response(
+    `<?xml version="1.0"?><rss version="2.0"><channel>
+      <title>Canary fixture</title><link>https://example.com</link><description>RSS fixture</description>
+      <item><title>Late item</title><guid>${GUID}</guid><pubDate>${pubDate}</pubDate></item>
+    </channel></rss>`,
+    { headers: { 'Content-Type': 'application/rss+xml' } }
+  )
+}
+
+describe('RSS delivery across delayed feed updates', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockValidateUrl.mockResolvedValue({ isValid: true, resolvedIP: '203.0.113.1' })
+    mockProcessEvent.mockResolvedValue({ success: true })
+    mockUpdateConfig.mockResolvedValue(undefined)
+  })
+
+  it('delivers an unseen item published before the last poll but after subscription', async () => {
+    mockFetch.mockResolvedValue(feed('Fri, 11 Sep 2026 21:25:32 GMT'))
+
+    expect(await rssPollingHandler.pollWebhook(context())).toBe('success')
+    expect(mockProcessEvent).toHaveBeenCalledExactlyOnceWith(
+      expect.anything(),
+      expect.anything(),
+      expect.objectContaining({ item: expect.objectContaining({ guid: GUID }) }),
+      'rss-request'
+    )
+    expect(mockUpdateConfig).toHaveBeenCalledWith(
+      'rss-webhook',
+      expect.objectContaining({ lastSeenGuids: [GUID] }),
+      expect.anything()
+    )
+  })
+
+  it('does not redeliver a known GUID when its publication date changes', async () => {
+    mockFetch.mockResolvedValue(feed('Fri, 11 Sep 2026 23:28:00 GMT'))
+
+    expect(await rssPollingHandler.pollWebhook(context([GUID]))).toBe('success')
+    expect(mockProcessEvent).not.toHaveBeenCalled()
+  })
+
+  it('does not backfill items published before the subscription existed', async () => {
+    mockFetch.mockResolvedValue(feed('Thu, 27 Aug 2026 18:30:00 GMT'))
+
+    expect(await rssPollingHandler.pollWebhook(context())).toBe('success')
+    expect(mockProcessEvent).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/sim/lib/webhooks/polling/rss.ts b/apps/sim/lib/webhooks/polling/rss.ts
index 1fd4bb0affb..491d7756cd6 100644
--- a/apps/sim/lib/webhooks/polling/rss.ts
+++ b/apps/sim/lib/webhooks/polling/rss.ts
@@ -109,7 +109,7 @@ export const rssPollingHandler: PollingProviderHandler = {
         items: newItems,
         etag,
         lastModified,
-      } = await fetchNewRssItems(config, requestId, logger)
+      } = await fetchNewRssItems(config, webhookData.createdAt, requestId, logger)
 
       if (!newItems.length) {
         await updateRssState(webhookId, now.toISOString(), [], config, logger, etag, lastModified)
@@ -195,6 +195,7 @@ async function updateRssState(
 
 async function fetchNewRssItems(
   config: RssWebhookConfig,
+  subscriptionStartedAt: Date,
   requestId: string,
   logger: Logger
 ): Promise<{ feed: RssFeed; items: RssItem[]; etag?: string; lastModified?: string }> {
@@ -248,9 +249,6 @@ async function fetchNewRssItems(
       return { feed: feed as RssFeed, items: [], etag: newEtag, lastModified: newLastModified }
     }
 
-    const lastCheckedTime = config.lastCheckedTimestamp
-      ? new Date(config.lastCheckedTimestamp)
-      : null
     const lastSeenGuids = new Set(config.lastSeenGuids || [])
 
     const newItems = feed.items.filter((item) => {
@@ -263,9 +261,13 @@ async function fetchNewRssItems(
         return false
       }
 
-      if (lastCheckedTime && item.isoDate) {
+      /**
+       * A cached feed can reveal an item after its publication time. Only the fixed
+       * subscription boundary excludes history; the last poll time is not a delivery cursor.
+       */
+      if (item.isoDate) {
         const itemDate = new Date(item.isoDate)
-        if (itemDate <= lastCheckedTime) {
+        if (itemDate <= subscriptionStartedAt) {
           return false
         }
       }
diff --git a/apps/sim/lib/webhooks/provider-subscriptions.ts b/apps/sim/lib/webhooks/provider-subscriptions.ts
index 8cd221622b9..ddd7b11a0ee 100644
--- a/apps/sim/lib/webhooks/provider-subscriptions.ts
+++ b/apps/sim/lib/webhooks/provider-subscriptions.ts
@@ -2,6 +2,7 @@ import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
 import { omit } from '@sim/utils/object'
 import type { NextRequest } from 'next/server'
+import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import {
   resolveBackgroundWebhookEnv,
   resolveWebhookProviderConfig,
@@ -151,14 +152,15 @@ export async function createExternalWebhookSubscription(
    * outbox handler must not mint a provider resource it can no longer
    * durably record.
    */
-  options.signal?.throwIfAborted()
-
-  const result = await handler.createSubscription({
-    webhook: { ...webhookData, providerConfig: resolvedProviderConfig },
-    workflow,
-    userId,
-    requestId,
-    request,
+  const result = await withResourceOutboundScope({ workspaceId }, () => {
+    options.signal?.throwIfAborted()
+    return handler.createSubscription!({
+      webhook: { ...webhookData, providerConfig: resolvedProviderConfig },
+      workflow,
+      userId,
+      requestId,
+      request,
+    })
   })
 
   if (!result) {
@@ -213,12 +215,18 @@ export async function cleanupExternalWebhook(
       { envVars }
     )
 
-    await handler.deleteSubscription({
-      webhook: resolvedWebhook,
-      workflow,
-      requestId,
-      strict: options.throwOnError,
-    })
+    /** Workspace archival precedes provider cleanup; routing still uses its canonical owner. */
+    await withResourceOutboundScope(
+      { workspaceId },
+      () =>
+        handler.deleteSubscription!({
+          webhook: resolvedWebhook,
+          workflow,
+          requestId,
+          strict: options.throwOnError,
+        }),
+      { includeArchived: true }
+    )
   } catch (error) {
     logger.warn(`[${requestId}] Error cleaning up external webhook (non-fatal)`, {
       provider,
diff --git a/apps/sim/lib/workflows/editing/engine.ts b/apps/sim/lib/workflows/editing/engine.ts
index ba98f968ac4..5624d684883 100644
--- a/apps/sim/lib/workflows/editing/engine.ts
+++ b/apps/sim/lib/workflows/editing/engine.ts
@@ -1,6 +1,11 @@
 import { createLogger } from '@sim/logger'
+import type { BlockState } from '@sim/workflow-types/workflow'
+import { isEqual } from 'es-toolkit'
 import type { PermissionGroupConfig } from '@/lib/permission-groups/fields'
+import { coerceObjectArray } from '@/lib/workflows/persistence/remap-internal-ids'
 import { isValidKey } from '@/lib/workflows/sanitization/key-validation'
+import { reindexRewrittenToolCanonicalModes } from '@/lib/workflows/subblocks/visibility'
+import { getBlock } from '@/blocks/registry'
 import { validateEdges } from '@/stores/workflows/workflow/edge-validation'
 import { generateLoopBlocks, generateParallelBlocks } from '@/stores/workflows/workflow/utils'
 import {
@@ -256,6 +261,11 @@ export function applyOperationsToWorkflowState(
   // blocks that are both being moved into the same subflow in one batch.
   removeInvalidScopeEdges(modifiedState, skippedItems)
 
+  reindexToolCanonicalModesAfterEdits(
+    workflowState.blocks as Record<string, BlockState> | undefined,
+    modifiedState.blocks as Record<string, BlockState> | undefined
+  )
+
   // Regenerate loops and parallels after modifications
   ;(modifiedState as any).loops = generateLoopBlocks((modifiedState as any).blocks)
   ;(modifiedState as any).parallels = generateParallelBlocks((modifiedState as any).blocks)
@@ -295,6 +305,37 @@ export function applyOperationsToWorkflowState(
   }
 }
 
+/**
+ * Nested tool canonical-mode overrides are keyed by the tool's position in its `tool-input`
+ * array, so when this batch rewrote a surviving block's tool list, carry each tool's overrides to
+ * wherever that tool now sits and drop those of removed tools, as the editor does on reorder and
+ * removal. Compares the original and final lists so any number of edits in the batch compose.
+ */
+function reindexToolCanonicalModesAfterEdits(
+  originalBlocks: Record<string, BlockState> | undefined,
+  blocks: Record<string, BlockState> | undefined
+): void {
+  for (const [blockId, block] of Object.entries(blocks ?? {})) {
+    const originalBlock = originalBlocks?.[blockId]
+    if (!originalBlock || originalBlock.type !== block.type || !block.data?.canonicalModes) continue
+
+    for (const subBlock of getBlock(block.type)?.subBlocks ?? []) {
+      if (subBlock.type !== 'tool-input') continue
+      const originalTools = coerceObjectArray(originalBlock.subBlocks?.[subBlock.id]?.value).array
+      if (!originalTools) continue
+      const tools = coerceObjectArray(block.subBlocks?.[subBlock.id]?.value).array ?? []
+      if (isEqual(originalTools, tools)) continue
+
+      const canonicalModes = reindexRewrittenToolCanonicalModes(
+        originalTools,
+        tools,
+        block.data.canonicalModes
+      )
+      if (canonicalModes) block.data = { ...block.data, canonicalModes }
+    }
+  }
+}
+
 /**
  * Resolves pending forward-reference connections recorded on block.data.
  *
diff --git a/apps/sim/lib/workflows/editing/operations.test.ts b/apps/sim/lib/workflows/editing/operations.test.ts
index c9f8511bc60..8e6286cc79e 100644
--- a/apps/sim/lib/workflows/editing/operations.test.ts
+++ b/apps/sim/lib/workflows/editing/operations.test.ts
@@ -1169,3 +1169,85 @@ describe('permission-group tool access', () => {
     )
   })
 })
+
+describe('tool canonical-mode reindexing', () => {
+  const selectorTool = {
+    type: 'jira',
+    operation: 'jira_get_issue',
+    title: 'Selector',
+    params: { projectId: 'PROJ' },
+    usageControl: 'auto',
+    isExpanded: false,
+  }
+  const variableTool = {
+    type: 'jira',
+    operation: 'jira_get_issue',
+    title: 'Variable',
+    params: { manualProjectId: '{{PROJECT}}' },
+    usageControl: 'auto',
+    isExpanded: false,
+  }
+
+  function agentWithTools(tools: unknown[], canonicalModes: Record<string, 'basic' | 'advanced'>) {
+    return {
+      blocks: {
+        agent: {
+          id: 'agent',
+          type: 'agent',
+          name: 'Agent',
+          position: { x: 0, y: 0 },
+          enabled: true,
+          outputs: {},
+          subBlocks: { tools: { id: 'tools', type: 'tool-input', value: tools } },
+          data: { canonicalModes },
+        },
+      },
+      edges: [],
+      loops: {},
+      parallels: {},
+    }
+  }
+
+  function editTools(workflow: Record<string, unknown>, tools: unknown[]) {
+    const { state } = applyOperationsToWorkflowState(workflow, [
+      { operation_type: 'edit', block_id: 'agent', params: { inputs: { tools } } },
+    ])
+    return state.blocks.agent.data.canonicalModes
+  }
+
+  it('moves each tool mode with it when the edit reorders the tools', () => {
+    const workflow = agentWithTools([selectorTool, variableTool], {
+      '0:projectId': 'basic',
+      '1:projectId': 'advanced',
+    })
+
+    expect(editTools(workflow, [variableTool, selectorTool])).toEqual({
+      '0:projectId': 'advanced',
+      '1:projectId': 'basic',
+    })
+  })
+
+  it('keeps modes in place when an edit changes tool params without moving them', () => {
+    const workflow = agentWithTools([selectorTool, variableTool], {
+      '0:projectId': 'basic',
+      '1:projectId': 'advanced',
+    })
+
+    expect(
+      editTools(workflow, [
+        { ...selectorTool, params: { projectId: 'OTHER' } },
+        { ...variableTool, params: { manualProjectId: '{{OTHER}}' } },
+      ])
+    ).toEqual({ '0:projectId': 'basic', '1:projectId': 'advanced' })
+  })
+
+  it('drops a removed tool mode so a later tool cannot inherit its position', () => {
+    const workflow = agentWithTools([selectorTool, variableTool], {
+      '0:projectId': 'basic',
+      '1:projectId': 'advanced',
+    })
+
+    expect(editTools(workflow, [selectorTool])).toEqual({ '0:projectId': 'basic' })
+    expect(editTools(workflow, [])).toEqual({})
+  })
+})
diff --git a/apps/sim/lib/workflows/executor/execution-core.ts b/apps/sim/lib/workflows/executor/execution-core.ts
index a465c6b48e4..09fbb27c2d7 100644
--- a/apps/sim/lib/workflows/executor/execution-core.ts
+++ b/apps/sim/lib/workflows/executor/execution-core.ts
@@ -19,6 +19,8 @@ import {
   getTimeoutErrorMessage,
   isTimeoutAbortReason,
 } from '@/lib/core/execution-limits'
+import { isOutboundRoutingEnabled } from '@/lib/core/network/config.server'
+import { runWithOutboundOrganization } from '@/lib/core/network/context.server'
 import { withDatabaseReadRetry } from '@/lib/db/read-retry'
 import { getExecutionEnvironment } from '@/lib/environment/utils'
 import { clearExecutionCancellation } from '@/lib/execution/cancellation'
@@ -29,6 +31,7 @@ import type { LoggingSession } from '@/lib/logs/execution/logging-session'
 import { redactLargeValueRefsInValue } from '@/lib/logs/execution/pii-large-values'
 import { redactObjectStrings } from '@/lib/logs/execution/pii-redaction'
 import { buildTraceSpans } from '@/lib/logs/execution/trace-spans/trace-spans'
+import { resolveActiveWorkflowApplicationContext } from '@/lib/workflows/application/context'
 import { waitForChildRuns } from '@/lib/workflows/custom-blocks/child-execution'
 import { getCustomBlockRowsForWorkspace } from '@/lib/workflows/custom-blocks/operations'
 import { resolveStartBlockRunIdentity } from '@/lib/workflows/executor/start-run-identity'
@@ -397,7 +400,13 @@ export async function executeWorkflowCore(
         label: 'getCustomBlockRowsForWorkspace',
       })
     : []
-  return withCustomBlockOverlay(rows, () => executeWorkflowCoreImpl(options))
+  const execute = () => withCustomBlockOverlay(rows, () => executeWorkflowCoreImpl(options))
+  if (!isOutboundRoutingEnabled()) return execute()
+  const context = await resolveActiveWorkflowApplicationContext({
+    workflowId: options.snapshot.metadata.workflowId,
+    assertedWorkspaceId: workspaceId,
+  })
+  return runWithOutboundOrganization(context.workspaceOrganizationId, execute)
 }
 
 async function executeWorkflowCoreImpl(
diff --git a/apps/sim/lib/workflows/executor/human-in-the-loop-manager.test.ts b/apps/sim/lib/workflows/executor/human-in-the-loop-manager.test.ts
index 33dd706d8a5..da7e4a71e52 100644
--- a/apps/sim/lib/workflows/executor/human-in-the-loop-manager.test.ts
+++ b/apps/sim/lib/workflows/executor/human-in-the-loop-manager.test.ts
@@ -14,12 +14,43 @@ import { createTimeoutAbortController, getExecutionDeadlineAt } from '@/lib/core
 import { abortManualExecution } from '@/lib/execution/manual-cancellation'
 import { terminalExecutionLogFields } from '@/lib/logs/execution/cancellation'
 
-const { mockReleaseExecutionSlot, mockReplaceLargeValueReferenceKeysWithClient } = vi.hoisted(
-  () => ({
-    mockReleaseExecutionSlot: vi.fn(),
-    mockReplaceLargeValueReferenceKeysWithClient: vi.fn(),
-  })
-)
+const {
+  mockReleaseExecutionSlot,
+  mockReplaceLargeValueReferenceKeysWithClient,
+  mockPreprocessExecution,
+  mockExecuteWorkflowCore,
+  mockCleanupExecutionBase64Cache,
+  mockResetExecutionStreamBuffer,
+  mockInitializeExecutionStreamMeta,
+  mockEventWriter,
+} = vi.hoisted(() => ({
+  mockReleaseExecutionSlot: vi.fn(),
+  mockPreprocessExecution: vi.fn(),
+  mockReplaceLargeValueReferenceKeysWithClient: vi.fn(),
+  mockExecuteWorkflowCore: vi.fn(),
+  mockCleanupExecutionBase64Cache: vi.fn(),
+  mockResetExecutionStreamBuffer: vi.fn(),
+  mockInitializeExecutionStreamMeta: vi.fn(),
+  mockEventWriter: { write: vi.fn(), writeTerminal: vi.fn(), close: vi.fn() },
+}))
+
+vi.mock('@/lib/execution/preprocessing', () => ({ preprocessExecution: mockPreprocessExecution }))
+
+vi.mock('@/lib/workflows/executor/execution-core', () => ({
+  executeWorkflowCore: mockExecuteWorkflowCore,
+}))
+
+vi.mock('@/lib/uploads/utils/user-file-base64.server', () => ({
+  cleanupExecutionBase64Cache: mockCleanupExecutionBase64Cache,
+}))
+
+vi.mock('@/lib/execution/event-buffer', () => ({
+  createExecutionEventWriter: vi.fn(() => mockEventWriter),
+  flushExecutionStreamReplayBuffer: vi.fn(),
+  initializeExecutionStreamMeta: mockInitializeExecutionStreamMeta,
+  markExecutionStreamTerminal: vi.fn(),
+  resetExecutionStreamBuffer: mockResetExecutionStreamBuffer,
+}))
 
 vi.mock('@/lib/billing/calculations/usage-reservation', () => ({
   releaseExecutionSlot: mockReleaseExecutionSlot,
@@ -1996,3 +2027,174 @@ describe('PauseResumeManager.enqueueOrStartResume admission refusals', () => {
     await expect(enqueue()).rejects.toMatchObject({ retryable: false })
   })
 })
+
+describe('repeated human review pauses', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetDbChainMock()
+  })
+
+  const runResumeExecution = Reflect.get(PauseResumeManager, 'runResumeExecution') as (
+    args: Record<string, unknown>
+  ) => Promise<unknown>
+
+  function createRepeatedReviewResumeArgs(): Record<string, unknown> {
+    const seed = createSnapshotSeed()
+    const snapshot = JSON.parse(seed.snapshot)
+    snapshot.metadata = {
+      ...snapshot.metadata,
+      workflowId: 'workflow-1',
+      executionId: 'durable-run',
+      useDraftState: true,
+      triggerType: 'manual',
+    }
+    snapshot.workflow = { blocks: [], connections: [] }
+    snapshot.state = { ...createExecutionState(), dagIncomingEdges: {} }
+    return {
+      reservationId: 'reservation-1',
+      resumeExecutionId: 'attempt-1',
+      pausedExecution: {
+        id: 'pause-1',
+        workflowId: 'workflow-1',
+        executionId: 'durable-run',
+        executionSnapshot: { ...seed, snapshot: JSON.stringify(snapshot) },
+        pausePoints: { hitl_loop0: { blockId: 'hitl', pauseKind: 'human' } },
+      },
+      contextId: 'hitl_loop0',
+      resumeInput: { reply: 'partial answer' },
+      userId: 'user-1',
+    }
+  }
+
+  it('keeps the next pause snapshot attached to the log that admission claimed', async () => {
+    dbChainMockFns.returning.mockResolvedValueOnce([{ id: 'log-1', deploymentVersionId: null }])
+    const stopAfterSnapshot = new Error('stop after snapshot construction')
+    mockPreprocessExecution.mockRejectedValueOnce(stopAfterSnapshot)
+
+    await expect(runResumeExecution(createRepeatedReviewResumeArgs())).rejects.toBe(
+      stopAfterSnapshot
+    )
+
+    expect(humanInTheLoopLogger.info).toHaveBeenCalledWith(
+      'Created resume snapshot',
+      expect.objectContaining({ metadata: expect.objectContaining({ executionId: 'durable-run' }) })
+    )
+    expect(
+      dbChainMockFns.where.mock.calls.some(([condition]) =>
+        flattenMockConditions(condition).some(
+          (part) =>
+            part.type === 'eq' &&
+            part.left === 'workflowExecutionLogs.executionId' &&
+            part.right === 'durable-run'
+        )
+      )
+    ).toBe(true)
+  })
+
+  it('cleans the base64 cache under the durable run that the resumed blocks wrote to', async () => {
+    dbChainMockFns.returning.mockResolvedValueOnce([{ id: 'log-1', deploymentVersionId: null }])
+    mockPreprocessExecution.mockResolvedValueOnce({
+      success: true,
+      actorUserId: 'user-1',
+      executionTimeout: { async: 60_000 },
+    })
+    mockResetExecutionStreamBuffer.mockResolvedValueOnce(true)
+    mockInitializeExecutionStreamMeta.mockResolvedValueOnce(true)
+    mockEventWriter.write.mockResolvedValue({ eventId: 1 })
+    mockEventWriter.writeTerminal.mockResolvedValue({ eventId: 2 })
+    mockEventWriter.close.mockResolvedValue(undefined)
+    mockExecuteWorkflowCore.mockResolvedValueOnce({
+      success: true,
+      status: 'completed',
+      output: {},
+      logs: [],
+      metadata: { executionId: 'durable-run' },
+    })
+
+    await expect(runResumeExecution(createRepeatedReviewResumeArgs())).resolves.toMatchObject({
+      status: 'completed',
+    })
+
+    expect(mockExecuteWorkflowCore).toHaveBeenCalledWith(
+      expect.objectContaining({ includeFileBase64: true })
+    )
+    expect(mockCleanupExecutionBase64Cache).toHaveBeenCalledTimes(1)
+    expect(mockCleanupExecutionBase64Cache).toHaveBeenCalledWith('durable-run')
+  })
+
+  it('settles the answered context exactly once when the same run pauses again', async () => {
+    const runSpy = vi
+      .spyOn(PauseResumeManager as unknown as PauseResumeManagerInternals, 'runResumeExecution')
+      .mockResolvedValueOnce({
+        status: 'paused',
+        success: true,
+        metadata: { executionId: 'durable-run' },
+        snapshotSeed: createSnapshotSeed(),
+        pausePoints: [{ contextId: 'hitl_loop1', blockId: 'hitl', resumeStatus: 'paused' }],
+      })
+    const persistSpy = vi.spyOn(PauseResumeManager, 'persistPauseResult')
+    dbChainMockFns.limit.mockResolvedValueOnce([{ status: 'running' }]).mockResolvedValueOnce([
+      {
+        id: 'pause-1',
+        executionId: 'durable-run',
+        status: 'paused',
+        metadata: {},
+        pausePoints: {
+          hitl_loop0: { contextId: 'hitl_loop0', blockId: 'hitl', resumeStatus: 'resuming' },
+        },
+      },
+    ])
+    const completeSpy = vi
+      .spyOn(
+        PauseResumeManager as unknown as {
+          markResumeCompleted: (...args: unknown[]) => Promise<void>
+        },
+        'markResumeCompleted'
+      )
+      .mockResolvedValueOnce()
+    const processSpy = vi.spyOn(PauseResumeManager, 'processQueuedResumes').mockResolvedValueOnce()
+    type Args = Parameters<typeof PauseResumeManager.startResumeExecution>[0]
+    try {
+      await PauseResumeManager.startResumeExecution({
+        resumeEntryId: 'entry-1',
+        resumeExecutionId: 'attempt-1',
+        contextId: 'hitl_loop0',
+        resumeInput: { reply: 'partial answer' },
+        userId: 'user-1',
+        pausedExecution: {
+          id: 'pause-1',
+          executionId: 'durable-run',
+          workflowId: 'workflow-1',
+          pausePoints: { hitl_loop0: { contextId: 'hitl_loop0', blockId: 'hitl' } },
+          executionSnapshot: createSnapshotSeed(),
+          metadata: {},
+        } as Args['pausedExecution'],
+      })
+      expect(persistSpy).toHaveBeenCalledWith(
+        expect.objectContaining({ executionId: 'durable-run' })
+      )
+      expect(completeSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          parentExecutionId: 'durable-run',
+        })
+      )
+      expect(completeSpy.mock.calls[0][0]).not.toHaveProperty('contextId')
+      expect(dbChainMockFns.set).toHaveBeenCalledWith(
+        expect.objectContaining({
+          resumedCount: 1,
+          totalPauseCount: 2,
+          status: 'partially_resumed',
+          pausePoints: expect.objectContaining({
+            hitl_loop0: expect.objectContaining({ resumeStatus: 'resumed' }),
+            hitl_loop1: expect.objectContaining({ resumeStatus: 'paused' }),
+          }),
+        })
+      )
+    } finally {
+      runSpy.mockRestore()
+      persistSpy.mockRestore()
+      completeSpy.mockRestore()
+      processSpy.mockRestore()
+    }
+  })
+})
diff --git a/apps/sim/lib/workflows/executor/human-in-the-loop-manager.ts b/apps/sim/lib/workflows/executor/human-in-the-loop-manager.ts
index bca73899221..818644c1f0c 100644
--- a/apps/sim/lib/workflows/executor/human-in-the-loop-manager.ts
+++ b/apps/sim/lib/workflows/executor/human-in-the-loop-manager.ts
@@ -969,6 +969,7 @@ export class PauseResumeManager {
       }
 
       if (result.status === 'paused') {
+        /** persistPauseResult already settles the answered context and recounts the merged pauses. */
         await PauseResumeManager.markResumeCompleted({
           resumeEntryId,
           pausedExecutionId: pausedExecution.id,
@@ -1424,9 +1425,10 @@ export class PauseResumeManager {
       })
     }
 
+    /** Resume attempts have separate stream IDs; new pauses must retain the durable run ID. */
     const metadata = {
       ...baseSnapshot.metadata,
-      executionId: resumeExecutionId,
+      executionId: parentExecutionId,
       requestId: baseSnapshot.metadata.requestId,
       startTime: new Date().toISOString(),
       userId: effectiveUserId,
@@ -2024,7 +2026,7 @@ export class PauseResumeManager {
           )
         })
       }
-      void cleanupExecutionBase64Cache(resumeExecutionId)
+      void cleanupExecutionBase64Cache(parentExecutionId)
     }
 
     /**
diff --git a/apps/sim/lib/workflows/subblocks/visibility.test.ts b/apps/sim/lib/workflows/subblocks/visibility.test.ts
index fa9d2d7eaba..daa2860f3cb 100644
--- a/apps/sim/lib/workflows/subblocks/visibility.test.ts
+++ b/apps/sim/lib/workflows/subblocks/visibility.test.ts
@@ -7,6 +7,7 @@ import {
   buildCanonicalIndexForSurface,
   evaluateSubBlockCondition,
   getCanonicalSubBlocksForSurface,
+  reindexRewrittenToolCanonicalModes,
   reindexToolCanonicalModes,
   resolveActiveDependencyValue,
   resolveDependencyValue,
@@ -347,6 +348,100 @@ describe('reindexToolCanonicalModes', () => {
   })
 })
 
+describe('reindexRewrittenToolCanonicalModes', () => {
+  /** Serialized tools: each call builds fresh objects, so object identity never matches. */
+  const jira = (projectId: string, extra: Record<string, unknown> = {}) => ({
+    type: 'jira',
+    operation: 'jira_get_issue',
+    params: { projectId },
+    ...extra,
+  })
+  const gmail = () => ({ type: 'gmail', operation: 'gmail_send', params: {} })
+
+  it.concurrent('returns undefined when there are no overrides', () => {
+    expect(reindexRewrittenToolCanonicalModes([jira('A')], [jira('B')], undefined)).toBeUndefined()
+  })
+
+  it.concurrent('moves each tool overrides with it when serialized tools are reordered', () => {
+    const result = reindexRewrittenToolCanonicalModes(
+      [jira('A'), jira('B')],
+      [jira('B'), jira('A')],
+      { '0:projectId': 'basic', '1:projectId': 'advanced' }
+    )
+    expect(result).toEqual({ '0:projectId': 'advanced', '1:projectId': 'basic' })
+  })
+
+  it.concurrent('ignores isExpanded, which serialized input may omit or default', () => {
+    const result = reindexRewrittenToolCanonicalModes(
+      [jira('A', { isExpanded: false }), jira('B', { isExpanded: true })],
+      [jira('B'), jira('A', { isExpanded: true })],
+      { '1:projectId': 'advanced' }
+    )
+    expect(result).toEqual({ '0:projectId': 'advanced' })
+  })
+
+  it.concurrent('keeps overrides in place when a tool params are edited without moving', () => {
+    const result = reindexRewrittenToolCanonicalModes(
+      [jira('A'), jira('B')],
+      [jira('A-edited'), jira('B-edited')],
+      { '0:projectId': 'basic', '1:projectId': 'advanced' }
+    )
+    expect(result).toBeUndefined()
+  })
+
+  it.concurrent(
+    'lets an edited tool claim its old slot after an unchanged tool moves past it',
+    () => {
+      const result = reindexRewrittenToolCanonicalModes(
+        [jira('A'), gmail(), jira('B')],
+        [gmail(), jira('B'), jira('A-edited')],
+        { '0:projectId': 'advanced', '2:projectId': 'basic' }
+      )
+      expect(result).toEqual({ '1:projectId': 'basic', '2:projectId': 'advanced' })
+    }
+  )
+
+  it.concurrent('drops a removed tool overrides and shifts the survivors', () => {
+    const result = reindexRewrittenToolCanonicalModes(
+      [jira('A'), jira('B'), jira('C')],
+      [jira('B'), jira('C')],
+      { '0:projectId': 'advanced', '1:projectId': 'basic', '2:projectId': 'advanced' }
+    )
+    expect(result).toEqual({ '0:projectId': 'basic', '1:projectId': 'advanced' })
+  })
+
+  it.concurrent('gives a new tool no overrides even when it lands on a used position', () => {
+    const result = reindexRewrittenToolCanonicalModes([jira('A')], [gmail(), jira('A')], {
+      '0:projectId': 'advanced',
+    })
+    expect(result).toEqual({ '1:projectId': 'advanced' })
+  })
+
+  it.concurrent('does not hand a replaced tool overrides to a tool of another type', () => {
+    const result = reindexRewrittenToolCanonicalModes([jira('A')], [gmail()], {
+      '0:projectId': 'advanced',
+    })
+    expect(result).toEqual({})
+  })
+
+  it.concurrent('keeps identical duplicates on their own positions', () => {
+    const result = reindexRewrittenToolCanonicalModes(
+      [jira('A'), jira('A')],
+      [jira('A'), jira('A'), gmail()],
+      { '0:projectId': 'basic', '1:projectId': 'advanced' }
+    )
+    expect(result).toBeUndefined()
+  })
+
+  it.concurrent('carries a legacy (non-index-scoped) key through unchanged', () => {
+    const result = reindexRewrittenToolCanonicalModes([jira('A'), jira('B')], [jira('B')], {
+      '0:projectId': 'advanced',
+      'jira:projectId': 'basic',
+    })
+    expect(result).toEqual({ 'jira:projectId': 'basic' })
+  })
+})
+
 describe('canonical index scoping by surface', () => {
   /** Webflow's shape: an action pair and a trigger alias sharing one `canonicalParamId`. */
   const MIXED: SubBlockConfig[] = [
diff --git a/apps/sim/lib/workflows/subblocks/visibility.ts b/apps/sim/lib/workflows/subblocks/visibility.ts
index 2e9ed82e8ff..15b797fe72f 100644
--- a/apps/sim/lib/workflows/subblocks/visibility.ts
+++ b/apps/sim/lib/workflows/subblocks/visibility.ts
@@ -1,3 +1,5 @@
+import { isRecordLike, omit } from '@sim/utils/object'
+import { isEqual } from 'es-toolkit'
 import { getDeploymentShape } from '@/lib/core/config/deployment-shape'
 import { getEnv, isTruthy } from '@/lib/core/config/env'
 import type { SubBlockConfig } from '@/blocks/types'
@@ -373,11 +375,11 @@ const INDEX_SCOPED_KEY = /^(\d+):(.+)$/
 /**
  * Canonical-mode overrides are keyed by a tool's position in its `tool-input` array
  * (`${toolIndex}:${canonicalId}`), so anything that reorders or removes tools - the editor
- * (drag-reorder, remove, delete), fork/promote copy (dropping an unresolved custom-tool/MCP
- * entry) - must carry each surviving tool's overrides to its new position and DROP the
- * vacated index. Otherwise a saved basic/advanced choice can attach to whichever DIFFERENT
- * tool later lands on that old index (e.g. a newly-added tool, always appended at the end,
- * can refill a slot a removal just freed).
+ * (drag-reorder, remove, delete), the workflow edit engine (a rewritten tool list), fork/promote
+ * copy (dropping an unresolved custom-tool/MCP entry) - must carry each surviving tool's
+ * overrides to its new position and DROP the vacated index. Otherwise a saved basic/advanced
+ * choice can attach to whichever DIFFERENT tool later lands on that old index (e.g. a newly-added
+ * tool, always appended at the end, can refill a slot a removal just freed).
  *
  * Returns the full replacement `canonicalModes` object (for an atomic whole-map write - a
  * per-key merge can't drop a key, and sequential per-key writes can clobber each other when
@@ -435,6 +437,62 @@ export function reindexToolCanonicalModes<T>(
   return reindexCanonicalModesByPosition(newIndexByOldIndex, overrides)
 }
 
+type ToolMatcher = (oldTool: unknown, newTool: unknown) => boolean
+
+const isSameToolType: ToolMatcher = (oldTool, newTool) =>
+  isRecordLike(oldTool) &&
+  isRecordLike(newTool) &&
+  typeof oldTool.type === 'string' &&
+  oldTool.type === newTool.type
+
+/** Drops `isExpanded`, editor UI state that serialized input may omit or default. */
+function withoutExpandedState(tool: unknown): unknown {
+  return isRecordLike(tool) ? omit(tool, ['isExpanded']) : tool
+}
+
+/**
+ * {@link reindexCanonicalModesByPosition} for a tool array rewritten from serialized input (the
+ * workflow edit API and Chat), where object identity is gone. Each rewritten tool claims an
+ * unclaimed old tool with the same content, then any tool still unmatched claims an unclaimed
+ * old tool of the same `type`, so a tool whose params were edited in place keeps its modes. Each
+ * pass tries the same position before any other, so unmoved tools and identical duplicates keep
+ * their own overrides. A tool left unmatched is new, and an old tool left unmatched was removed.
+ */
+export function reindexRewrittenToolCanonicalModes(
+  oldTools: readonly unknown[],
+  newTools: readonly unknown[],
+  overrides: CanonicalModeOverrides | undefined
+): Record<string, 'basic' | 'advanced'> | undefined {
+  if (!overrides) return undefined
+
+  const oldContents = oldTools.map(withoutExpandedState)
+  const newContents = newTools.map(withoutExpandedState)
+  const newIndexByOldIndex = new Map<number, number>()
+  const matchedNewIndices = new Set<number>()
+
+  for (const matches of [isEqual, isSameToolType] as ToolMatcher[]) {
+    const isUnclaimedMatch = (oldIndex: number, newIndex: number) =>
+      oldIndex < oldContents.length &&
+      !newIndexByOldIndex.has(oldIndex) &&
+      matches(oldContents[oldIndex], newContents[newIndex])
+    const findSamePosition = (newIndex: number) =>
+      isUnclaimedMatch(newIndex, newIndex) ? newIndex : -1
+    const findAnyPosition = (newIndex: number) =>
+      oldContents.findIndex((_, oldIndex) => isUnclaimedMatch(oldIndex, newIndex))
+
+    for (const findOldIndex of [findSamePosition, findAnyPosition]) {
+      newContents.forEach((_, newIndex) => {
+        if (matchedNewIndices.has(newIndex)) return
+        const oldIndex = findOldIndex(newIndex)
+        if (oldIndex === -1) return
+        newIndexByOldIndex.set(oldIndex, newIndex)
+        matchedNewIndices.add(newIndex)
+      })
+    }
+  }
+  return reindexCanonicalModesByPosition(newIndexByOldIndex, overrides)
+}
+
 /**
  * True for the modes that make a field advanced-only when it is not part of a
  * canonical basic/advanced pair: a standalone `advanced` field, or a standalone
diff --git a/apps/sim/lib/workspaces/admin-move-source-impact.ts b/apps/sim/lib/workspaces/admin-move-source-impact.ts
index 687f89ec9ac..8a770c24d6e 100644
--- a/apps/sim/lib/workspaces/admin-move-source-impact.ts
+++ b/apps/sim/lib/workspaces/admin-move-source-impact.ts
@@ -65,7 +65,7 @@ const ENTERPRISE_GATED_SECTION_LABELS: Record<OrganizationSettingsSection, strin
   'access-control': 'permission groups',
   'audit-logs': 'audit logs',
   sso: 'SSO settings and domains',
-  sessions: 'session policies and organization session revocation',
+  security: 'session policies, organization session revocation, and outbound IP settings',
   'data-retention': 'data retention policies',
   'data-drains': 'data drains',
   whitelabeling: 'whitelabel branding',
diff --git a/apps/sim/lib/workspaces/organization-navigation.ts b/apps/sim/lib/workspaces/organization-navigation.ts
new file mode 100644
index 00000000000..758bf66f2d1
--- /dev/null
+++ b/apps/sim/lib/workspaces/organization-navigation.ts
@@ -0,0 +1,11 @@
+import type { WorkspaceHostContext } from '@/lib/api/contracts/workspaces'
+import { organizationRoutes } from '@/lib/navigation/paths'
+
+/** Returns the workspace's organization destination only when the viewer can enter it. */
+export function getWorkspaceOrganizationHref(hostContext: WorkspaceHostContext): string | null {
+  return hostContext.hostOrganizationId &&
+    hostContext.viewer.isHostOrganizationMember &&
+    hostContext.features?.organizationSearch
+    ? organizationRoutes(hostContext.hostOrganizationId).root
+    : null
+}
diff --git a/apps/sim/stores/operation-queue/store.test.ts b/apps/sim/stores/operation-queue/store.test.ts
index 33cb8e0eb11..5c12081780e 100644
--- a/apps/sim/stores/operation-queue/store.test.ts
+++ b/apps/sim/stores/operation-queue/store.test.ts
@@ -266,6 +266,51 @@ describe('operation queue room gating', () => {
     ])
   })
 
+  it('supersedes pending tool updates with the latest value and canonical modes together', () => {
+    const queue = useOperationQueueStore.getState()
+    const toolsUpdate = (id: string, operation: string, value: string[]) =>
+      queue.addToQueue({
+        id,
+        workflowId: 'workflow-a',
+        userId: 'user-1',
+        operation: {
+          operation,
+          target: 'subblock',
+          payload: {
+            blockId: 'agent-1',
+            subblockId: 'tools',
+            value,
+            ...(operation === 'subblock-update-with-canonical-modes' && {
+              canonicalModes: { [`${value.indexOf('a')}:projectId`]: 'advanced' },
+            }),
+          },
+        },
+      })
+
+    toolsUpdate('op-1', 'subblock-update', ['a', 'b'])
+    toolsUpdate('op-2', 'subblock-update-with-canonical-modes', ['b', 'a'])
+    toolsUpdate('op-3', 'subblock-update-with-canonical-modes', ['a', 'b'])
+
+    expect(useOperationQueueStore.getState().operations).toEqual([
+      expect.objectContaining({
+        id: 'op-3',
+        operation: expect.objectContaining({
+          payload: expect.objectContaining({
+            value: ['a', 'b'],
+            canonicalModes: { '0:projectId': 'advanced' },
+          }),
+        }),
+      }),
+    ])
+
+    toolsUpdate('op-4', 'subblock-update', ['a', 'b', 'c'])
+
+    expect(useOperationQueueStore.getState().operations.map((op) => op.id)).toEqual([
+      'op-3',
+      'op-4',
+    ])
+  })
+
   it('does not coalesce matching subblock updates across workflows', () => {
     useOperationQueueStore.getState().addToQueue({
       id: 'op-1',
diff --git a/apps/sim/stores/operation-queue/store.ts b/apps/sim/stores/operation-queue/store.ts
index e1655007aba..502435e1581 100644
--- a/apps/sim/stores/operation-queue/store.ts
+++ b/apps/sim/stores/operation-queue/store.ts
@@ -77,6 +77,18 @@ export function registerEmitFunctions(
 
 let currentRegisteredWorkflowId: string | null = null
 
+/**
+ * Pending subblock operations a newer one for the same field makes redundant. A value-only update
+ * never supersedes one that also carries canonical modes, or those modes would be lost.
+ */
+const SUPERSEDED_SUBBLOCK_OPERATIONS: Partial<Record<string, readonly string[]>> = {
+  'subblock-update': ['subblock-update'],
+  'subblock-update-with-canonical-modes': [
+    'subblock-update',
+    'subblock-update-with-canonical-modes',
+  ],
+}
+
 /** Targets whose payload id refers to a canvas block (subflow ids are loop/parallel blocks). */
 const BLOCK_SCOPED_TARGETS = ['block', 'subblock', 'subflow']
 
@@ -150,15 +162,13 @@ export const useOperationQueueStore = create<OperationQueueState>((set, get) =>
 
     let shouldDropPendingOperation = (_op: QueuedOperation) => false
 
-    if (
-      operation.operation.operation === 'subblock-update' &&
-      operation.operation.target === 'subblock'
-    ) {
+    const supersededOperations = SUPERSEDED_SUBBLOCK_OPERATIONS[operation.operation.operation]
+    if (supersededOperations && operation.operation.target === 'subblock') {
       const { blockId, subblockId } = operation.operation.payload
       shouldDropPendingOperation = (op) =>
         op.status === 'pending' &&
         op.workflowId === operation.workflowId &&
-        op.operation.operation === 'subblock-update' &&
+        supersededOperations.includes(op.operation.operation) &&
         op.operation.target === 'subblock' &&
         op.operation.payload?.blockId === blockId &&
         op.operation.payload?.subblockId === subblockId
diff --git a/apps/sim/tools/jira/attachment-downloads.test.ts b/apps/sim/tools/jira/attachment-downloads.test.ts
index cafb6b5b07c..53a4834eba7 100644
--- a/apps/sim/tools/jira/attachment-downloads.test.ts
+++ b/apps/sim/tools/jira/attachment-downloads.test.ts
@@ -5,7 +5,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { PayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import { AttachmentDownloadBudget } from '@/lib/uploads/utils/attachment-download-budget'
 
-vi.mock('@/lib/knowledge/documents/utils', () => ({
+vi.mock('@/lib/knowledge/documents/secure-fetch.server', () => ({
   fetchWithRetry: (url: string, init: RequestInit) => fetch(url, init),
 }))
 
diff --git a/apps/sim/tools/jira/utils.ts b/apps/sim/tools/jira/utils.ts
index 545c9b32357..dd5820e93ea 100644
--- a/apps/sim/tools/jira/utils.ts
+++ b/apps/sim/tools/jira/utils.ts
@@ -1,7 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { resolveAtlassianCloudId } from '@/lib/atlassian/discovery'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
 import type { RetryOptions } from '@/lib/knowledge/documents/utils'
-import { fetchWithRetry } from '@/lib/knowledge/documents/utils'
 import {
   AttachmentDownloadBudget,
   rethrowAttachmentDownloadError,
diff --git a/packages/db/embedding-width-migration.postgres.test.ts b/packages/db/embedding-width-migration.postgres.test.ts
index 738b00656d0..b4a3d9624f4 100644
--- a/packages/db/embedding-width-migration.postgres.test.ts
+++ b/packages/db/embedding-width-migration.postgres.test.ts
@@ -122,4 +122,40 @@ describe.runIf(Boolean(databaseUrl))('embedding width migration in PostgreSQL',
       sql`UPDATE embedding SET embedding_768 = ${vector(768)}::vector WHERE id = 'legacy'`
     ).rejects.toMatchObject({ code: '23514', constraint_name: 'embedding_width_check' })
   })
+
+  it('rebuilds compact candidate indexes on replay and uses them at every stored width', async () => {
+    await applyMigration(correctiveMigration)
+    const migration = await readFile(
+      new URL('./migrations/0342_clean_weapon_omega.sql', import.meta.url),
+      'utf8'
+    )
+    for (const width of SUPPORTED_WIDTHS) {
+      await insertEmbedding(width, `width-${width}`)
+      const name =
+        width === 1536 ? 'embedding_binary_hnsw_idx' : `embedding_${width}_binary_hnsw_idx`
+      /** Seed interrupted builds in the isolated schema, never an index in the shared public schema. */
+      await sql.unsafe(`CREATE INDEX "${name}" ON embedding (id)`)
+    }
+    await applyMigration(migration)
+    await applyMigration(migration)
+    await sql`SET enable_seqscan = off`
+    try {
+      for (const width of SUPPORTED_WIDTHS) {
+        const column = width === 1536 ? 'embedding' : `embedding_${width}`
+        const name =
+          width === 1536 ? 'embedding_binary_hnsw_idx' : `embedding_${width}_binary_hnsw_idx`
+        const plan = await sql.unsafe(
+          `EXPLAIN (FORMAT JSON) SELECT id FROM embedding
+          ORDER BY binary_quantize("${column}")::bit(${width}) <~> binary_quantize($1::vector)::bit(${width}) LIMIT 1`,
+          [vector(width)]
+        )
+        expect(JSON.stringify(plan)).toContain(name)
+      }
+      const indexes = await sql`SELECT count(*)::int AS count FROM pg_index
+        WHERE indrelid = 'embedding'::regclass AND indisvalid`
+      expect(indexes[0].count).toBeGreaterThanOrEqual(10)
+    } finally {
+      await sql`RESET enable_seqscan`
+    }
+  })
 })
diff --git a/packages/db/migrations/0342_clean_weapon_omega.sql b/packages/db/migrations/0342_clean_weapon_omega.sql
new file mode 100644
index 00000000000..14de6fc5a21
--- /dev/null
+++ b/packages/db/migrations/0342_clean_weapon_omega.sql
@@ -0,0 +1,19 @@
+-- Additive indexes; existing cosine indexes remain available to deployed and unfiltered search.
+COMMIT;--> statement-breakpoint
+SET lock_timeout = 0;--> statement-breakpoint
+-- migration-safe: replay removes only this new candidate index so an interrupted concurrent build cannot remain invalid.
+DROP INDEX CONCURRENTLY IF EXISTS "embedding_binary_hnsw_idx";--> statement-breakpoint
+CREATE INDEX CONCURRENTLY IF NOT EXISTS "embedding_binary_hnsw_idx" ON "embedding" USING hnsw ((binary_quantize("embedding")::bit(1536)) bit_hamming_ops) WITH (m=16,ef_construction=64);--> statement-breakpoint
+-- migration-safe: replay removes only this new candidate index so an interrupted concurrent build cannot remain invalid.
+DROP INDEX CONCURRENTLY IF EXISTS "embedding_384_binary_hnsw_idx";--> statement-breakpoint
+CREATE INDEX CONCURRENTLY IF NOT EXISTS "embedding_384_binary_hnsw_idx" ON "embedding" USING hnsw ((binary_quantize("embedding_384")::bit(384)) bit_hamming_ops) WITH (m=16,ef_construction=64);--> statement-breakpoint
+-- migration-safe: replay removes only this new candidate index so an interrupted concurrent build cannot remain invalid.
+DROP INDEX CONCURRENTLY IF EXISTS "embedding_768_binary_hnsw_idx";--> statement-breakpoint
+CREATE INDEX CONCURRENTLY IF NOT EXISTS "embedding_768_binary_hnsw_idx" ON "embedding" USING hnsw ((binary_quantize("embedding_768")::bit(768)) bit_hamming_ops) WITH (m=16,ef_construction=64);--> statement-breakpoint
+-- migration-safe: replay removes only this new candidate index so an interrupted concurrent build cannot remain invalid.
+DROP INDEX CONCURRENTLY IF EXISTS "embedding_1024_binary_hnsw_idx";--> statement-breakpoint
+CREATE INDEX CONCURRENTLY IF NOT EXISTS "embedding_1024_binary_hnsw_idx" ON "embedding" USING hnsw ((binary_quantize("embedding_1024")::bit(1024)) bit_hamming_ops) WITH (m=16,ef_construction=64);--> statement-breakpoint
+-- migration-safe: replay removes only this new candidate index so an interrupted concurrent build cannot remain invalid.
+DROP INDEX CONCURRENTLY IF EXISTS "embedding_3072_binary_hnsw_idx";--> statement-breakpoint
+CREATE INDEX CONCURRENTLY IF NOT EXISTS "embedding_3072_binary_hnsw_idx" ON "embedding" USING hnsw ((binary_quantize("embedding_3072")::bit(3072)) bit_hamming_ops) WITH (m=16,ef_construction=64);--> statement-breakpoint
+SET lock_timeout = '5s';
diff --git a/packages/db/migrations/meta/0342_snapshot.json b/packages/db/migrations/meta/0342_snapshot.json
new file mode 100644
index 00000000000..d0382298f77
--- /dev/null
+++ b/packages/db/migrations/meta/0342_snapshot.json
@@ -0,0 +1,26392 @@
+{
+  "id": "a93f8916-30f0-4b9e-ae2f-fe3c3861d848",
+  "prevId": "38b15e57-1b67-4a30-86e7-12d829535277",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.academy_certificate": {
+      "name": "academy_certificate",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "course_id": {
+          "name": "course_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "academy_cert_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "issued_at": {
+          "name": "issued_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "certificate_number": {
+          "name": "certificate_number",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "academy_certificate_user_id_idx": {
+          "name": "academy_certificate_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "academy_certificate_course_id_idx": {
+          "name": "academy_certificate_course_id_idx",
+          "columns": [
+            {
+              "expression": "course_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "academy_certificate_user_course_unique": {
+          "name": "academy_certificate_user_course_unique",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "course_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "academy_certificate_status_idx": {
+          "name": "academy_certificate_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "academy_certificate_user_id_user_id_fk": {
+          "name": "academy_certificate_user_id_user_id_fk",
+          "tableFrom": "academy_certificate",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "academy_certificate_certificate_number_unique": {
+          "name": "academy_certificate_certificate_number_unique",
+          "nullsNotDistinct": false,
+          "columns": ["certificate_number"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.account": {
+      "name": "account",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "access_token": {
+          "name": "access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "id_token": {
+          "name": "id_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "access_token_expires_at": {
+          "name": "access_token_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token_expires_at": {
+          "name": "refresh_token_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "oauth_config": {
+          "name": "oauth_config",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "account_user_id_idx": {
+          "name": "account_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "idx_account_on_account_id_provider_id": {
+          "name": "idx_account_on_account_id_provider_id",
+          "columns": [
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "account_user_id_user_id_fk": {
+          "name": "account_user_id_user_id_fk",
+          "tableFrom": "account",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.api_key": {
+      "name": "api_key",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key_hash": {
+          "name": "key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'personal'"
+        },
+        "last_used": {
+          "name": "last_used",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "api_key_workspace_type_idx": {
+          "name": "api_key_workspace_type_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "api_key_user_type_idx": {
+          "name": "api_key_user_type_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "api_key_key_hash_idx": {
+          "name": "api_key_key_hash_idx",
+          "columns": [
+            {
+              "expression": "key_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "api_key_user_id_user_id_fk": {
+          "name": "api_key_user_id_user_id_fk",
+          "tableFrom": "api_key",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "api_key_workspace_id_workspace_id_fk": {
+          "name": "api_key_workspace_id_workspace_id_fk",
+          "tableFrom": "api_key",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "api_key_created_by_user_id_fk": {
+          "name": "api_key_created_by_user_id_fk",
+          "tableFrom": "api_key",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "api_key_key_unique": {
+          "name": "api_key_key_unique",
+          "nullsNotDistinct": false,
+          "columns": ["key"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "workspace_type_check": {
+          "name": "workspace_type_check",
+          "value": "(type = 'workspace' AND workspace_id IS NOT NULL) OR (type = 'personal' AND workspace_id IS NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.async_jobs": {
+      "name": "async_jobs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_at": {
+          "name": "run_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "attempts": {
+          "name": "attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "max_attempts": {
+          "name": "max_attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 3
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "output": {
+          "name": "output",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "async_jobs_status_started_at_idx": {
+          "name": "async_jobs_status_started_at_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "async_jobs_status_completed_at_idx": {
+          "name": "async_jobs_status_completed_at_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "completed_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "async_jobs_schedule_pending_run_at_idx": {
+          "name": "async_jobs_schedule_pending_run_at_idx",
+          "columns": [
+            {
+              "expression": "run_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"async_jobs\".\"type\" = 'schedule-execution' AND \"async_jobs\".\"status\" = 'pending'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "async_jobs_schedule_processing_started_at_idx": {
+          "name": "async_jobs_schedule_processing_started_at_idx",
+          "columns": [
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"async_jobs\".\"type\" = 'schedule-execution' AND \"async_jobs\".\"status\" = 'processing'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "async_jobs_schedule_unreconciled_terminal_idx": {
+          "name": "async_jobs_schedule_unreconciled_terminal_idx",
+          "columns": [
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"async_jobs\".\"type\" = 'schedule-execution' AND \"async_jobs\".\"status\" IN ('completed', 'failed', 'cancelled') AND COALESCE(\"async_jobs\".\"metadata\" ->> 'scheduleReconciled', 'false') <> 'true'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.audit_log": {
+      "name": "audit_log",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_type": {
+          "name": "resource_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_id": {
+          "name": "resource_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_name": {
+          "name": "actor_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_email": {
+          "name": "actor_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resource_name": {
+          "name": "resource_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'{}'"
+        },
+        "ip_address": {
+          "name": "ip_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "audit_log_workspace_created_idx": {
+          "name": "audit_log_workspace_created_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "audit_log_workspace_created_at_id_idx": {
+          "name": "audit_log_workspace_created_at_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "date_trunc('milliseconds', \"created_at\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "audit_log_actor_created_idx": {
+          "name": "audit_log_actor_created_idx",
+          "columns": [
+            {
+              "expression": "actor_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "audit_log_resource_idx": {
+          "name": "audit_log_resource_idx",
+          "columns": [
+            {
+              "expression": "resource_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "audit_log_action_idx": {
+          "name": "audit_log_action_idx",
+          "columns": [
+            {
+              "expression": "action",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "audit_log_workspace_id_workspace_id_fk": {
+          "name": "audit_log_workspace_id_workspace_id_fk",
+          "tableFrom": "audit_log",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "audit_log_actor_id_user_id_fk": {
+          "name": "audit_log_actor_id_user_id_fk",
+          "tableFrom": "audit_log",
+          "tableTo": "user",
+          "columnsFrom": ["actor_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.background_work_status": {
+      "name": "background_work_status",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "kind": {
+          "name": "kind",
+          "type": "background_work_kind",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "background_work_status_value",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "background_work_status_workspace_status_idx": {
+          "name": "background_work_status_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "background_work_status_workflow_status_idx": {
+          "name": "background_work_status_workflow_status_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "background_work_status_meta_child_ws_idx": {
+          "name": "background_work_status_meta_child_ws_idx",
+          "columns": [
+            {
+              "expression": "(\"metadata\" ->> 'childWorkspaceId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "background_work_status_meta_other_ws_idx": {
+          "name": "background_work_status_meta_other_ws_idx",
+          "columns": [
+            {
+              "expression": "(\"metadata\" ->> 'otherWorkspaceId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "background_work_status_workspace_id_workspace_id_fk": {
+          "name": "background_work_status_workspace_id_workspace_id_fk",
+          "tableFrom": "background_work_status",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "background_work_status_workflow_id_workflow_id_fk": {
+          "name": "background_work_status_workflow_id_workflow_id_fk",
+          "tableFrom": "background_work_status",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.chat": {
+      "name": "chat",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "customizations": {
+          "name": "customizations",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'{}'"
+        },
+        "auth_type": {
+          "name": "auth_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'public'"
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "allowed_emails": {
+          "name": "allowed_emails",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'[]'"
+        },
+        "output_configs": {
+          "name": "output_configs",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'[]'"
+        },
+        "include_thinking": {
+          "name": "include_thinking",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "include_tool_calls": {
+          "name": "include_tool_calls",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "identifier_idx": {
+          "name": "identifier_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"chat\".\"archived_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "chat_archived_at_partial_idx": {
+          "name": "chat_archived_at_partial_idx",
+          "columns": [
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"chat\".\"archived_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "idx_chat_on_workflow_id_archived_at": {
+          "name": "idx_chat_on_workflow_id_archived_at",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "chat_workflow_id_workflow_id_fk": {
+          "name": "chat_workflow_id_workflow_id_fk",
+          "tableFrom": "chat",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "chat_user_id_user_id_fk": {
+          "name": "chat_user_id_user_id_fk",
+          "tableFrom": "chat",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.copilot_async_tool_calls": {
+      "name": "copilot_async_tool_calls",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "checkpoint_id": {
+          "name": "checkpoint_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tool_call_id": {
+          "name": "tool_call_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "args": {
+          "name": "args",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "status": {
+          "name": "status",
+          "type": "copilot_async_tool_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "result": {
+          "name": "result",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "permission_decision": {
+          "name": "permission_decision",
+          "type": "copilot_tool_permission_decision",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "permission_decided_at": {
+          "name": "permission_decided_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claimed_by": {
+          "name": "claimed_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "copilot_async_tool_calls_run_id_idx": {
+          "name": "copilot_async_tool_calls_run_id_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_async_tool_calls_checkpoint_id_idx": {
+          "name": "copilot_async_tool_calls_checkpoint_id_idx",
+          "columns": [
+            {
+              "expression": "checkpoint_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_async_tool_calls_status_idx": {
+          "name": "copilot_async_tool_calls_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_async_tool_calls_run_status_idx": {
+          "name": "copilot_async_tool_calls_run_status_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_async_tool_calls_tool_call_id_unique": {
+          "name": "copilot_async_tool_calls_tool_call_id_unique",
+          "columns": [
+            {
+              "expression": "tool_call_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "copilot_async_tool_calls_run_id_copilot_runs_id_fk": {
+          "name": "copilot_async_tool_calls_run_id_copilot_runs_id_fk",
+          "tableFrom": "copilot_async_tool_calls",
+          "tableTo": "copilot_runs",
+          "columnsFrom": ["run_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "copilot_async_tool_calls_checkpoint_id_copilot_run_checkpoints_id_fk": {
+          "name": "copilot_async_tool_calls_checkpoint_id_copilot_run_checkpoints_id_fk",
+          "tableFrom": "copilot_async_tool_calls",
+          "tableTo": "copilot_run_checkpoints",
+          "columnsFrom": ["checkpoint_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.copilot_chats": {
+      "name": "copilot_chats",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "type": {
+          "name": "type",
+          "type": "chat_type",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'copilot'"
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'claude-3-7-sonnet-latest'"
+        },
+        "conversation_id": {
+          "name": "conversation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "external_conversation_key": {
+          "name": "external_conversation_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "external_conversation_metadata": {
+          "name": "external_conversation_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "preview_yaml": {
+          "name": "preview_yaml",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "plan_artifact": {
+          "name": "plan_artifact",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resources": {
+          "name": "resources",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'"
+        },
+        "auto_allowed_tools": {
+          "name": "auto_allowed_tools",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'"
+        },
+        "last_seen_at": {
+          "name": "last_seen_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pinned": {
+          "name": "pinned",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "copilot_chats_organization_id_idx": {
+          "name": "copilot_chats_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_chats_external_conversation_unique": {
+          "name": "copilot_chats_external_conversation_unique",
+          "columns": [
+            {
+              "expression": "external_conversation_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"copilot_chats\".\"external_conversation_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_chats_user_org_created_idx": {
+          "name": "copilot_chats_user_org_created_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_chats_user_id_idx": {
+          "name": "copilot_chats_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_chats_workflow_id_idx": {
+          "name": "copilot_chats_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_chats_user_workflow_idx": {
+          "name": "copilot_chats_user_workflow_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_chats_user_workspace_idx": {
+          "name": "copilot_chats_user_workspace_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_chats_created_at_idx": {
+          "name": "copilot_chats_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_chats_updated_at_idx": {
+          "name": "copilot_chats_updated_at_idx",
+          "columns": [
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_chats_workspace_created_at_id_idx": {
+          "name": "copilot_chats_workspace_created_at_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "date_trunc('milliseconds', \"created_at\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_chats_user_workspace_deleted_partial_idx": {
+          "name": "copilot_chats_user_workspace_deleted_partial_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"copilot_chats\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "copilot_chats_user_id_user_id_fk": {
+          "name": "copilot_chats_user_id_user_id_fk",
+          "tableFrom": "copilot_chats",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "copilot_chats_workflow_id_workflow_id_fk": {
+          "name": "copilot_chats_workflow_id_workflow_id_fk",
+          "tableFrom": "copilot_chats",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "copilot_chats_workspace_id_workspace_id_fk": {
+          "name": "copilot_chats_workspace_id_workspace_id_fk",
+          "tableFrom": "copilot_chats",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "copilot_chats_organization_id_organization_id_fk": {
+          "name": "copilot_chats_organization_id_organization_id_fk",
+          "tableFrom": "copilot_chats",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "copilot_chats_owner_check": {
+          "name": "copilot_chats_owner_check",
+          "value": "num_nonnulls(\"copilot_chats\".\"workspace_id\", \"copilot_chats\".\"organization_id\") <= 1"
+        },
+        "copilot_chats_organization_workflow_check": {
+          "name": "copilot_chats_organization_workflow_check",
+          "value": "\"copilot_chats\".\"organization_id\" IS NULL OR \"copilot_chats\".\"workflow_id\" IS NULL"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.copilot_feedback": {
+      "name": "copilot_feedback",
+      "schema": "",
+      "columns": {
+        "feedback_id": {
+          "name": "feedback_id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "chat_id": {
+          "name": "chat_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_query": {
+          "name": "user_query",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_response": {
+          "name": "agent_response",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "is_positive": {
+          "name": "is_positive",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "feedback": {
+          "name": "feedback",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workflow_yaml": {
+          "name": "workflow_yaml",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "copilot_feedback_user_id_idx": {
+          "name": "copilot_feedback_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_feedback_chat_id_idx": {
+          "name": "copilot_feedback_chat_id_idx",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_feedback_user_chat_idx": {
+          "name": "copilot_feedback_user_chat_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_feedback_is_positive_idx": {
+          "name": "copilot_feedback_is_positive_idx",
+          "columns": [
+            {
+              "expression": "is_positive",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_feedback_created_at_idx": {
+          "name": "copilot_feedback_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "copilot_feedback_user_id_user_id_fk": {
+          "name": "copilot_feedback_user_id_user_id_fk",
+          "tableFrom": "copilot_feedback",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "copilot_feedback_chat_id_copilot_chats_id_fk": {
+          "name": "copilot_feedback_chat_id_copilot_chats_id_fk",
+          "tableFrom": "copilot_feedback",
+          "tableTo": "copilot_chats",
+          "columnsFrom": ["chat_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.copilot_messages": {
+      "name": "copilot_messages",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "chat_id": {
+          "name": "chat_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message_id": {
+          "name": "message_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stream_id": {
+          "name": "stream_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_message_id": {
+          "name": "parent_message_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tokens_in": {
+          "name": "tokens_in",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tokens_out": {
+          "name": "tokens_out",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "seq": {
+          "name": "seq",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "copilot_messages_chat_message_unique": {
+          "name": "copilot_messages_chat_message_unique",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "message_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_messages_chat_created_at_idx": {
+          "name": "copilot_messages_chat_created_at_idx",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"copilot_messages\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_messages_chat_seq_idx": {
+          "name": "copilot_messages_chat_seq_idx",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "seq",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"copilot_messages\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_messages_chat_stream_idx": {
+          "name": "copilot_messages_chat_stream_idx",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "stream_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"copilot_messages\".\"stream_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_messages_user_created_at_idx": {
+          "name": "copilot_messages_user_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "message_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"copilot_messages\".\"role\" = 'user' AND \"copilot_messages\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "copilot_messages_chat_id_copilot_chats_id_fk": {
+          "name": "copilot_messages_chat_id_copilot_chats_id_fk",
+          "tableFrom": "copilot_messages",
+          "tableTo": "copilot_chats",
+          "columnsFrom": ["chat_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.copilot_run_checkpoints": {
+      "name": "copilot_run_checkpoints",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pending_tool_call_id": {
+          "name": "pending_tool_call_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "conversation_snapshot": {
+          "name": "conversation_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "agent_state": {
+          "name": "agent_state",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "provider_request": {
+          "name": "provider_request",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "copilot_run_checkpoints_run_id_idx": {
+          "name": "copilot_run_checkpoints_run_id_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_run_checkpoints_pending_tool_call_id_idx": {
+          "name": "copilot_run_checkpoints_pending_tool_call_id_idx",
+          "columns": [
+            {
+              "expression": "pending_tool_call_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_run_checkpoints_run_pending_tool_unique": {
+          "name": "copilot_run_checkpoints_run_pending_tool_unique",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "pending_tool_call_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "copilot_run_checkpoints_run_id_copilot_runs_id_fk": {
+          "name": "copilot_run_checkpoints_run_id_copilot_runs_id_fk",
+          "tableFrom": "copilot_run_checkpoints",
+          "tableTo": "copilot_runs",
+          "columnsFrom": ["run_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.copilot_runs": {
+      "name": "copilot_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "execution_id": {
+          "name": "execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_run_id": {
+          "name": "parent_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "chat_id": {
+          "name": "chat_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stream_id": {
+          "name": "stream_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent": {
+          "name": "agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "copilot_run_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "request_context": {
+          "name": "request_context",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "copilot_runs_execution_id_idx": {
+          "name": "copilot_runs_execution_id_idx",
+          "columns": [
+            {
+              "expression": "execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_runs_parent_run_id_idx": {
+          "name": "copilot_runs_parent_run_id_idx",
+          "columns": [
+            {
+              "expression": "parent_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_runs_chat_id_idx": {
+          "name": "copilot_runs_chat_id_idx",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_runs_user_id_idx": {
+          "name": "copilot_runs_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_runs_workflow_id_idx": {
+          "name": "copilot_runs_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_runs_workspace_id_idx": {
+          "name": "copilot_runs_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_runs_status_idx": {
+          "name": "copilot_runs_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_runs_chat_execution_idx": {
+          "name": "copilot_runs_chat_execution_idx",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_runs_execution_started_at_idx": {
+          "name": "copilot_runs_execution_started_at_idx",
+          "columns": [
+            {
+              "expression": "execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_runs_workspace_completed_at_id_idx": {
+          "name": "copilot_runs_workspace_completed_at_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "date_trunc('milliseconds', \"completed_at\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_runs_stream_id_unique": {
+          "name": "copilot_runs_stream_id_unique",
+          "columns": [
+            {
+              "expression": "stream_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "copilot_runs_chat_id_copilot_chats_id_fk": {
+          "name": "copilot_runs_chat_id_copilot_chats_id_fk",
+          "tableFrom": "copilot_runs",
+          "tableTo": "copilot_chats",
+          "columnsFrom": ["chat_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "copilot_runs_user_id_user_id_fk": {
+          "name": "copilot_runs_user_id_user_id_fk",
+          "tableFrom": "copilot_runs",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "copilot_runs_workflow_id_workflow_id_fk": {
+          "name": "copilot_runs_workflow_id_workflow_id_fk",
+          "tableFrom": "copilot_runs",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "copilot_runs_workspace_id_workspace_id_fk": {
+          "name": "copilot_runs_workspace_id_workspace_id_fk",
+          "tableFrom": "copilot_runs",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.copilot_workflow_read_hashes": {
+      "name": "copilot_workflow_read_hashes",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "chat_id": {
+          "name": "chat_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "hash": {
+          "name": "hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "copilot_workflow_read_hashes_chat_id_idx": {
+          "name": "copilot_workflow_read_hashes_chat_id_idx",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_workflow_read_hashes_workflow_id_idx": {
+          "name": "copilot_workflow_read_hashes_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_workflow_read_hashes_chat_workflow_unique": {
+          "name": "copilot_workflow_read_hashes_chat_workflow_unique",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "copilot_workflow_read_hashes_chat_id_copilot_chats_id_fk": {
+          "name": "copilot_workflow_read_hashes_chat_id_copilot_chats_id_fk",
+          "tableFrom": "copilot_workflow_read_hashes",
+          "tableTo": "copilot_chats",
+          "columnsFrom": ["chat_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "copilot_workflow_read_hashes_workflow_id_workflow_id_fk": {
+          "name": "copilot_workflow_read_hashes_workflow_id_workflow_id_fk",
+          "tableFrom": "copilot_workflow_read_hashes",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.credential": {
+      "name": "credential",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "slack_app_id": {
+          "name": "slack_app_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "type": {
+          "name": "type",
+          "type": "credential_type",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "unredacted": {
+          "name": "unredacted",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "env_key": {
+          "name": "env_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "env_owner_user_id": {
+          "name": "env_owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "encrypted_service_account_key": {
+          "name": "encrypted_service_account_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "encrypted_personal_token": {
+          "name": "encrypted_personal_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "authorization_app_id": {
+          "name": "authorization_app_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_group_enrollment_id": {
+          "name": "credential_group_enrollment_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_group_option_id": {
+          "name": "credential_group_option_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_server_id": {
+          "name": "mcp_server_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_oauth_config_version": {
+          "name": "mcp_oauth_config_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "managed_oauth_scope_version": {
+          "name": "managed_oauth_scope_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_subject_id": {
+          "name": "provider_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_tenant_id": {
+          "name": "provider_tenant_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "managed_oauth_status": {
+          "name": "managed_oauth_status",
+          "type": "managed_oauth_credential_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "granted_scopes": {
+          "name": "granted_scopes",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_metadata": {
+          "name": "provider_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "encrypted_oauth_token_set": {
+          "name": "encrypted_oauth_token_set",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_tools": {
+          "name": "mcp_tools",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_tools_refreshed_at": {
+          "name": "mcp_tools_refreshed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "granted_at": {
+          "name": "granted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "access_token_expires_at": {
+          "name": "access_token_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token_expires_at": {
+          "name": "refresh_token_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_refreshed_at": {
+          "name": "last_refreshed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_organization_id_idx": {
+          "name": "credential_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_organization_account_unique": {
+          "name": "credential_organization_account_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"credential\".\"account_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_org_personal_token_unique": {
+          "name": "credential_org_personal_token_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_by",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_tenant_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_subject_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"credential\".\"type\" = 'personal_token'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_workspace_id_idx": {
+          "name": "credential_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_type_idx": {
+          "name": "credential_type_idx",
+          "columns": [
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_provider_id_idx": {
+          "name": "credential_provider_id_idx",
+          "columns": [
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_account_id_idx": {
+          "name": "credential_account_id_idx",
+          "columns": [
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_env_owner_user_id_idx": {
+          "name": "credential_env_owner_user_id_idx",
+          "columns": [
+            {
+              "expression": "env_owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_group_enrollment_idx": {
+          "name": "credential_group_enrollment_idx",
+          "columns": [
+            {
+              "expression": "credential_group_enrollment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_mcp_server_idx": {
+          "name": "credential_mcp_server_idx",
+          "columns": [
+            {
+              "expression": "mcp_server_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_group_option_unique": {
+          "name": "credential_group_option_unique",
+          "columns": [
+            {
+              "expression": "credential_group_enrollment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "credential_group_option_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"credential\".\"type\" = 'managed_oauth'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_managed_mcp_enrollment_server_unique": {
+          "name": "credential_managed_mcp_enrollment_server_unique",
+          "columns": [
+            {
+              "expression": "credential_group_enrollment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "mcp_server_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"credential\".\"type\" = 'managed_mcp'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_workspace_account_unique": {
+          "name": "credential_workspace_account_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "account_id IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_workspace_env_unique": {
+          "name": "credential_workspace_env_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "env_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "type = 'env_workspace'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_workspace_personal_env_unique": {
+          "name": "credential_workspace_personal_env_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "env_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "env_owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "type = 'env_personal'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_personal_token_identity_unique": {
+          "name": "credential_personal_token_identity_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_by",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_tenant_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_subject_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "type = 'personal_token'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_workspace_id_workspace_id_fk": {
+          "name": "credential_workspace_id_workspace_id_fk",
+          "tableFrom": "credential",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "credential_organization_id_organization_id_fk": {
+          "name": "credential_organization_id_organization_id_fk",
+          "tableFrom": "credential",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "credential_slack_app_id_slack_app_id_fk": {
+          "name": "credential_slack_app_id_slack_app_id_fk",
+          "tableFrom": "credential",
+          "tableTo": "slack_app",
+          "columnsFrom": ["slack_app_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "credential_account_id_account_id_fk": {
+          "name": "credential_account_id_account_id_fk",
+          "tableFrom": "credential",
+          "tableTo": "account",
+          "columnsFrom": ["account_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "credential_env_owner_user_id_user_id_fk": {
+          "name": "credential_env_owner_user_id_user_id_fk",
+          "tableFrom": "credential",
+          "tableTo": "user",
+          "columnsFrom": ["env_owner_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "credential_credential_group_enrollment_id_credential_group_enrollment_id_fk": {
+          "name": "credential_credential_group_enrollment_id_credential_group_enrollment_id_fk",
+          "tableFrom": "credential",
+          "tableTo": "credential_group_enrollment",
+          "columnsFrom": ["credential_group_enrollment_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "credential_mcp_server_id_mcp_servers_id_fk": {
+          "name": "credential_mcp_server_id_mcp_servers_id_fk",
+          "tableFrom": "credential",
+          "tableTo": "mcp_servers",
+          "columnsFrom": ["mcp_server_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "credential_created_by_user_id_fk": {
+          "name": "credential_created_by_user_id_fk",
+          "tableFrom": "credential",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "credential_owner_check": {
+          "name": "credential_owner_check",
+          "value": "num_nonnulls(\"credential\".\"workspace_id\", \"credential\".\"organization_id\") = 1"
+        },
+        "credential_organization_type_check": {
+          "name": "credential_organization_type_check",
+          "value": "\"credential\".\"organization_id\" IS NULL OR \"credential\".\"type\" IN ('oauth', 'managed_oauth', 'managed_mcp', 'service_account', 'personal_token')"
+        },
+        "credential_personal_token_source_check": {
+          "name": "credential_personal_token_source_check",
+          "value": "(type::text <> 'personal_token') OR (\n        created_by IS NOT NULL\n        AND provider_id IS NOT NULL\n        AND provider_id = 'gitlab'\n        AND provider_subject_id IS NOT NULL\n        AND provider_tenant_id IS NOT NULL\n        AND encrypted_personal_token IS NOT NULL\n        AND granted_scopes IS NOT NULL\n        AND cardinality(granted_scopes) > 0\n        AND account_id IS NULL\n        AND env_key IS NULL\n        AND env_owner_user_id IS NULL\n        AND authorization_app_id IS NULL\n        AND encrypted_oauth_token_set IS NULL\n        AND encrypted_service_account_key IS NULL\n        AND unredacted = false\n      )"
+        },
+        "credential_oauth_source_check": {
+          "name": "credential_oauth_source_check",
+          "value": "(type <> 'oauth') OR (account_id IS NOT NULL AND provider_id IS NOT NULL)"
+        },
+        "credential_managed_oauth_source_check": {
+          "name": "credential_managed_oauth_source_check",
+          "value": "(type::text <> 'managed_oauth') OR (\n        account_id IS NULL\n        AND provider_id IS NOT NULL\n        AND authorization_app_id IS NOT NULL\n        AND provider_subject_id IS NOT NULL\n        AND managed_oauth_status IS NOT NULL\n        AND granted_scopes IS NOT NULL\n        AND encrypted_oauth_token_set IS NOT NULL\n        AND granted_at IS NOT NULL\n      )"
+        },
+        "credential_managed_oauth_group_binding_check": {
+          "name": "credential_managed_oauth_group_binding_check",
+          "value": "(type::text <> 'managed_oauth') OR (\n        credential_group_enrollment_id IS NOT NULL\n        AND credential_group_option_id IS NOT NULL\n        AND managed_oauth_scope_version IS NOT NULL\n        AND managed_oauth_scope_version > 0\n      )"
+        },
+        "credential_managed_mcp_source_check": {
+          "name": "credential_managed_mcp_source_check",
+          "value": "(type::text <> 'managed_mcp') OR (\n        id LIKE 'mcp-cg-%'\n        AND account_id IS NULL\n        AND provider_id IS NULL\n        AND authorization_app_id IS NULL\n        AND credential_group_enrollment_id IS NOT NULL\n        AND credential_group_option_id IS NULL\n        AND mcp_server_id IS NOT NULL\n        AND managed_oauth_status IS NOT NULL\n        AND (managed_oauth_status <> 'active' OR (\n          encrypted_oauth_token_set IS NOT NULL\n          AND mcp_tools IS NOT NULL\n        ))\n        AND granted_at IS NOT NULL\n        AND managed_oauth_scope_version IS NULL\n        AND provider_subject_id IS NULL\n        AND provider_tenant_id IS NULL\n        AND granted_scopes IS NULL\n        AND provider_metadata IS NULL\n        AND created_by IS NULL\n        AND env_key IS NULL\n        AND env_owner_user_id IS NULL\n        AND encrypted_service_account_key IS NULL\n        AND unredacted = false\n      )"
+        },
+        "credential_creator_source_check": {
+          "name": "credential_creator_source_check",
+          "value": "(type::text = 'managed_mcp') OR created_by IS NOT NULL"
+        },
+        "credential_workspace_env_source_check": {
+          "name": "credential_workspace_env_source_check",
+          "value": "(type <> 'env_workspace') OR (env_key IS NOT NULL AND env_owner_user_id IS NULL)"
+        },
+        "credential_personal_env_source_check": {
+          "name": "credential_personal_env_source_check",
+          "value": "(type <> 'env_personal') OR (env_key IS NOT NULL AND env_owner_user_id IS NOT NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.credential_group": {
+      "name": "credential_group",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "public_id": {
+          "name": "public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "options": {
+          "name": "options",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "encrypted_provider_configuration": {
+          "name": "encrypted_provider_configuration",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "credential_group_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_group_organization_id_idx": {
+          "name": "credential_group_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_group_organization_unique": {
+          "name": "credential_group_organization_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_group_public_id_unique": {
+          "name": "credential_group_public_id_unique",
+          "columns": [
+            {
+              "expression": "public_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_group_workspace_unique": {
+          "name": "credential_group_workspace_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_group_workspace_id_workspace_id_fk": {
+          "name": "credential_group_workspace_id_workspace_id_fk",
+          "tableFrom": "credential_group",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "credential_group_organization_id_organization_id_fk": {
+          "name": "credential_group_organization_id_organization_id_fk",
+          "tableFrom": "credential_group",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "credential_group_created_by_user_id_fk": {
+          "name": "credential_group_created_by_user_id_fk",
+          "tableFrom": "credential_group",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "credential_group_owner_check": {
+          "name": "credential_group_owner_check",
+          "value": "num_nonnulls(\"credential_group\".\"workspace_id\", \"credential_group\".\"organization_id\") = 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.credential_group_enrollment": {
+      "name": "credential_group_enrollment",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "credential_group_id": {
+          "name": "credential_group_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "credential_group_enrollment_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'invited'"
+        },
+        "invitation_token_hash": {
+          "name": "invitation_token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invitation_expires_at": {
+          "name": "invitation_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invited_at": {
+          "name": "invited_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sent_at": {
+          "name": "sent_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_delivery_error": {
+          "name": "last_delivery_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_group_enrollment_group_user_unique": {
+          "name": "credential_group_enrollment_group_user_unique",
+          "columns": [
+            {
+              "expression": "credential_group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"credential_group_enrollment\".\"user_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_group_enrollment_user_id_idx": {
+          "name": "credential_group_enrollment_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_group_enrollment_group_email_unique": {
+          "name": "credential_group_enrollment_group_email_unique",
+          "columns": [
+            {
+              "expression": "credential_group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "email",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_group_enrollment_invitation_token_hash_unique": {
+          "name": "credential_group_enrollment_invitation_token_hash_unique",
+          "columns": [
+            {
+              "expression": "invitation_token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_group_enrollment_group_status_idx": {
+          "name": "credential_group_enrollment_group_status_idx",
+          "columns": [
+            {
+              "expression": "credential_group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_group_enrollment_group_invited_at_id_idx": {
+          "name": "credential_group_enrollment_group_invited_at_id_idx",
+          "columns": [
+            {
+              "expression": "credential_group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "invited_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_group_enrollment_credential_group_id_credential_group_id_fk": {
+          "name": "credential_group_enrollment_credential_group_id_credential_group_id_fk",
+          "tableFrom": "credential_group_enrollment",
+          "tableTo": "credential_group",
+          "columnsFrom": ["credential_group_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "credential_group_enrollment_user_id_user_id_fk": {
+          "name": "credential_group_enrollment_user_id_user_id_fk",
+          "tableFrom": "credential_group_enrollment",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "credential_group_enrollment_created_by_user_id_fk": {
+          "name": "credential_group_enrollment_created_by_user_id_fk",
+          "tableFrom": "credential_group_enrollment",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "credential_group_enrollment_normalized_email_check": {
+          "name": "credential_group_enrollment_normalized_email_check",
+          "value": "\"credential_group_enrollment\".\"email\" = lower(btrim(\"credential_group_enrollment\".\"email\")) AND length(\"credential_group_enrollment\".\"email\") BETWEEN 3 AND 320"
+        },
+        "credential_group_enrollment_invitation_token_hash_length_check": {
+          "name": "credential_group_enrollment_invitation_token_hash_length_check",
+          "value": "length(\"credential_group_enrollment\".\"invitation_token_hash\") = 64"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.credential_member": {
+      "name": "credential_member",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "credential_id": {
+          "name": "credential_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "credential_member_role",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'member'"
+        },
+        "status": {
+          "name": "status",
+          "type": "credential_member_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "joined_at": {
+          "name": "joined_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "invited_by": {
+          "name": "invited_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_member_user_id_idx": {
+          "name": "credential_member_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_member_role_idx": {
+          "name": "credential_member_role_idx",
+          "columns": [
+            {
+              "expression": "role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_member_status_idx": {
+          "name": "credential_member_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_member_unique": {
+          "name": "credential_member_unique",
+          "columns": [
+            {
+              "expression": "credential_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_member_credential_id_credential_id_fk": {
+          "name": "credential_member_credential_id_credential_id_fk",
+          "tableFrom": "credential_member",
+          "tableTo": "credential",
+          "columnsFrom": ["credential_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "credential_member_user_id_user_id_fk": {
+          "name": "credential_member_user_id_user_id_fk",
+          "tableFrom": "credential_member",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "credential_member_invited_by_user_id_fk": {
+          "name": "credential_member_invited_by_user_id_fk",
+          "tableFrom": "credential_member",
+          "tableTo": "user",
+          "columnsFrom": ["invited_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.custom_block": {
+      "name": "custom_block",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "icon_url": {
+          "name": "icon_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "inputs": {
+          "name": "inputs",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outputs": {
+          "name": "outputs",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "trace_child_runs": {
+          "name": "trace_child_runs",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "custom_block_organization_id_idx": {
+          "name": "custom_block_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "custom_block_workflow_id_idx": {
+          "name": "custom_block_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "custom_block_organization_type_unique": {
+          "name": "custom_block_organization_type_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "custom_block_organization_id_organization_id_fk": {
+          "name": "custom_block_organization_id_organization_id_fk",
+          "tableFrom": "custom_block",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "custom_block_workflow_id_workflow_id_fk": {
+          "name": "custom_block_workflow_id_workflow_id_fk",
+          "tableFrom": "custom_block",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "custom_block_created_by_user_id_fk": {
+          "name": "custom_block_created_by_user_id_fk",
+          "tableFrom": "custom_block",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.custom_tools": {
+      "name": "custom_tools",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema": {
+          "name": "schema",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "code": {
+          "name": "code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "custom_tools_workspace_id_idx": {
+          "name": "custom_tools_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "custom_tools_workspace_title_unique": {
+          "name": "custom_tools_workspace_title_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "custom_tools_workspace_id_workspace_id_fk": {
+          "name": "custom_tools_workspace_id_workspace_id_fk",
+          "tableFrom": "custom_tools",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "custom_tools_user_id_user_id_fk": {
+          "name": "custom_tools_user_id_user_id_fk",
+          "tableFrom": "custom_tools",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.data_drain_runs": {
+      "name": "data_drain_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "drain_id": {
+          "name": "drain_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "data_drain_run_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "data_drain_run_trigger",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rows_exported": {
+          "name": "rows_exported",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "bytes_written": {
+          "name": "bytes_written",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cursor_before": {
+          "name": "cursor_before",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cursor_after": {
+          "name": "cursor_after",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locators": {
+          "name": "locators",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        }
+      },
+      "indexes": {
+        "data_drain_runs_drain_started_idx": {
+          "name": "data_drain_runs_drain_started_idx",
+          "columns": [
+            {
+              "expression": "drain_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "data_drain_runs_drain_id_data_drains_id_fk": {
+          "name": "data_drain_runs_drain_id_data_drains_id_fk",
+          "tableFrom": "data_drain_runs",
+          "tableTo": "data_drains",
+          "columnsFrom": ["drain_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.data_drains": {
+      "name": "data_drains",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "data_drain_source",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "destination_type": {
+          "name": "destination_type",
+          "type": "data_drain_destination",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "destination_config": {
+          "name": "destination_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "destination_credentials": {
+          "name": "destination_credentials",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schedule_cadence": {
+          "name": "schedule_cadence",
+          "type": "data_drain_cadence",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "cursor": {
+          "name": "cursor",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_run_at": {
+          "name": "last_run_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_success_at": {
+          "name": "last_success_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "data_drains_org_idx": {
+          "name": "data_drains_org_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "data_drains_due_idx": {
+          "name": "data_drains_due_idx",
+          "columns": [
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_run_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "data_drains_org_name_unique": {
+          "name": "data_drains_org_name_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "data_drains_organization_id_organization_id_fk": {
+          "name": "data_drains_organization_id_organization_id_fk",
+          "tableFrom": "data_drains",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "data_drains_created_by_user_id_fk": {
+          "name": "data_drains_created_by_user_id_fk",
+          "tableFrom": "data_drains",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.docs_embeddings": {
+      "name": "docs_embeddings",
+      "schema": "",
+      "columns": {
+        "chunk_id": {
+          "name": "chunk_id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "chunk_text": {
+          "name": "chunk_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_document": {
+          "name": "source_document",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_link": {
+          "name": "source_link",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "header_text": {
+          "name": "header_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "header_level": {
+          "name": "header_level",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_count": {
+          "name": "token_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "embedding": {
+          "name": "embedding",
+          "type": "vector(1536)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "embedding_model": {
+          "name": "embedding_model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'text-embedding-3-small'"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "chunk_text_tsv": {
+          "name": "chunk_text_tsv",
+          "type": "tsvector",
+          "primaryKey": false,
+          "notNull": false,
+          "generated": {
+            "as": "to_tsvector('english', \"docs_embeddings\".\"chunk_text\")",
+            "type": "stored"
+          }
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "docs_emb_source_document_idx": {
+          "name": "docs_emb_source_document_idx",
+          "columns": [
+            {
+              "expression": "source_document",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "docs_emb_header_level_idx": {
+          "name": "docs_emb_header_level_idx",
+          "columns": [
+            {
+              "expression": "header_level",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "docs_emb_source_header_idx": {
+          "name": "docs_emb_source_header_idx",
+          "columns": [
+            {
+              "expression": "source_document",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "header_level",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "docs_emb_model_idx": {
+          "name": "docs_emb_model_idx",
+          "columns": [
+            {
+              "expression": "embedding_model",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "docs_emb_created_at_idx": {
+          "name": "docs_emb_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "docs_embedding_vector_hnsw_idx": {
+          "name": "docs_embedding_vector_hnsw_idx",
+          "columns": [
+            {
+              "expression": "embedding",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "vector_cosine_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "hnsw",
+          "with": {
+            "m": 16,
+            "ef_construction": 64
+          }
+        },
+        "docs_emb_metadata_gin_idx": {
+          "name": "docs_emb_metadata_gin_idx",
+          "columns": [
+            {
+              "expression": "metadata",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "docs_emb_chunk_text_fts_idx": {
+          "name": "docs_emb_chunk_text_fts_idx",
+          "columns": [
+            {
+              "expression": "chunk_text_tsv",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "docs_embedding_not_null_check": {
+          "name": "docs_embedding_not_null_check",
+          "value": "\"embedding\" IS NOT NULL"
+        },
+        "docs_header_level_check": {
+          "name": "docs_header_level_check",
+          "value": "\"header_level\" >= 1 AND \"header_level\" <= 6"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.document": {
+      "name": "document",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "knowledge_base_id": {
+          "name": "knowledge_base_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "filename": {
+          "name": "filename",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "file_url": {
+          "name": "file_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "storage_key": {
+          "name": "storage_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "file_size": {
+          "name": "file_size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mime_type": {
+          "name": "mime_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "chunk_count": {
+          "name": "chunk_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "token_count": {
+          "name": "token_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "character_count": {
+          "name": "character_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "processing_status": {
+          "name": "processing_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "processing_attempts": {
+          "name": "processing_attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "processing_queued_at": {
+          "name": "processing_queued_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "processing_queue_token": {
+          "name": "processing_queue_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "processing_started_at": {
+          "name": "processing_started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "processing_deferred_until": {
+          "name": "processing_deferred_until",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "processing_completed_at": {
+          "name": "processing_completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "processing_error": {
+          "name": "processing_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "processing_recovery_after": {
+          "name": "processing_recovery_after",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_excluded": {
+          "name": "user_excluded",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "tag1": {
+          "name": "tag1",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag2": {
+          "name": "tag2",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag3": {
+          "name": "tag3",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag4": {
+          "name": "tag4",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag5": {
+          "name": "tag5",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag6": {
+          "name": "tag6",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag7": {
+          "name": "tag7",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "number1": {
+          "name": "number1",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "number2": {
+          "name": "number2",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "number3": {
+          "name": "number3",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "number4": {
+          "name": "number4",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "number5": {
+          "name": "number5",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "date1": {
+          "name": "date1",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "date2": {
+          "name": "date2",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "boolean1": {
+          "name": "boolean1",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "boolean2": {
+          "name": "boolean2",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "boolean3": {
+          "name": "boolean3",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connector_id": {
+          "name": "connector_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "content_hash": {
+          "name": "content_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_url": {
+          "name": "source_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_provenance_version": {
+          "name": "secret_provenance_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "uploaded_by": {
+          "name": "uploaded_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "acl": {
+          "name": "acl",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{ws}'::text[]"
+        },
+        "acl_requirements": {
+          "name": "acl_requirements",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "acl_verified_at": {
+          "name": "acl_verified_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_modified_at": {
+          "name": "source_modified_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_seen_at": {
+          "name": "source_seen_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "uploaded_at": {
+          "name": "uploaded_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "doc_kb_id_idx": {
+          "name": "doc_kb_id_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_acl_gin_idx": {
+          "name": "doc_acl_gin_idx",
+          "columns": [
+            {
+              "expression": "acl",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "array_ops"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"document\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "doc_filename_idx": {
+          "name": "doc_filename_idx",
+          "columns": [
+            {
+              "expression": "filename",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_processing_status_idx": {
+          "name": "doc_processing_status_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "processing_status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_processing_recovery_idx": {
+          "name": "doc_processing_recovery_idx",
+          "columns": [
+            {
+              "expression": "uploaded_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"document\".\"processing_status\" IN ('pending', 'processing', 'failed') AND \"document\".\"connector_id\" IS NOT NULL AND \"document\".\"content_hash\" IS NOT NULL AND \"document\".\"storage_key\" IS NOT NULL AND \"document\".\"user_excluded\" = false AND \"document\".\"archived_at\" IS NULL AND \"document\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_connector_external_id_idx": {
+          "name": "doc_connector_external_id_idx",
+          "columns": [
+            {
+              "expression": "connector_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"document\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_connector_source_lookup_idx": {
+          "name": "doc_connector_source_lookup_idx",
+          "columns": [
+            {
+              "expression": "connector_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_connector_reconciliation_idx": {
+          "name": "doc_connector_reconciliation_idx",
+          "columns": [
+            {
+              "expression": "connector_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "COALESCE(\"source_seen_at\", '-infinity'::timestamp)",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"document\".\"user_excluded\" = false AND \"document\".\"archived_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_active_kb_token_count_idx": {
+          "name": "doc_active_kb_token_count_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "token_count",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"document\".\"user_excluded\" = false AND \"document\".\"archived_at\" IS NULL AND \"document\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_storage_key_idx": {
+          "name": "doc_storage_key_idx",
+          "columns": [
+            {
+              "expression": "storage_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"document\".\"storage_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_archived_at_partial_idx": {
+          "name": "doc_archived_at_partial_idx",
+          "columns": [
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"document\".\"archived_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_deleted_at_partial_idx": {
+          "name": "doc_deleted_at_partial_idx",
+          "columns": [
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"document\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_kb_tag1_lower_idx": {
+          "name": "doc_kb_tag1_lower_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"tag1\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_kb_tag2_lower_idx": {
+          "name": "doc_kb_tag2_lower_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"tag2\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_kb_tag3_lower_idx": {
+          "name": "doc_kb_tag3_lower_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"tag3\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_kb_tag4_lower_idx": {
+          "name": "doc_kb_tag4_lower_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"tag4\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_kb_tag5_lower_idx": {
+          "name": "doc_kb_tag5_lower_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"tag5\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_kb_tag6_lower_idx": {
+          "name": "doc_kb_tag6_lower_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"tag6\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_kb_tag7_lower_idx": {
+          "name": "doc_kb_tag7_lower_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"tag7\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_number1_idx": {
+          "name": "doc_number1_idx",
+          "columns": [
+            {
+              "expression": "number1",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_number2_idx": {
+          "name": "doc_number2_idx",
+          "columns": [
+            {
+              "expression": "number2",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_number3_idx": {
+          "name": "doc_number3_idx",
+          "columns": [
+            {
+              "expression": "number3",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_number4_idx": {
+          "name": "doc_number4_idx",
+          "columns": [
+            {
+              "expression": "number4",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_number5_idx": {
+          "name": "doc_number5_idx",
+          "columns": [
+            {
+              "expression": "number5",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_date1_idx": {
+          "name": "doc_date1_idx",
+          "columns": [
+            {
+              "expression": "date1",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_date2_idx": {
+          "name": "doc_date2_idx",
+          "columns": [
+            {
+              "expression": "date2",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_boolean1_idx": {
+          "name": "doc_boolean1_idx",
+          "columns": [
+            {
+              "expression": "boolean1",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_boolean2_idx": {
+          "name": "doc_boolean2_idx",
+          "columns": [
+            {
+              "expression": "boolean2",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_boolean3_idx": {
+          "name": "doc_boolean3_idx",
+          "columns": [
+            {
+              "expression": "boolean3",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_knowledge_base_id_knowledge_base_id_fk": {
+          "name": "document_knowledge_base_id_knowledge_base_id_fk",
+          "tableFrom": "document",
+          "tableTo": "knowledge_base",
+          "columnsFrom": ["knowledge_base_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_connector_id_knowledge_connector_id_fk": {
+          "name": "document_connector_id_knowledge_connector_id_fk",
+          "tableFrom": "document",
+          "tableTo": "knowledge_connector",
+          "columnsFrom": ["connector_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_uploaded_by_user_id_fk": {
+          "name": "document_uploaded_by_user_id_fk",
+          "tableFrom": "document",
+          "tableTo": "user",
+          "columnsFrom": ["uploaded_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "doc_acl_token_shape_check": {
+          "name": "doc_acl_token_shape_check",
+          "value": "array_position(\"document\".\"acl\", NULL) IS NULL AND (cardinality(\"document\".\"acl\") = 0 OR (cardinality(\"document\".\"acl\") = array_length(string_to_array(array_to_string(\"document\".\"acl\", E'\\n'), E'\\n'), 1) AND array_to_string(\"document\".\"acl\", E'\\n') ~ '^((ws|pub|link|u:[^\\nA-Z]+@[^\\nA-Z]+|[gs]:[^\\n:]+:[^\\n:]+:[^\\n]+)(\\n(ws|pub|link|u:[^\\nA-Z]+@[^\\nA-Z]+|[gs]:[^\\n:]+:[^\\n:]+:[^\\n]+))*)$'))"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.document_secret_provenance": {
+      "name": "document_secret_provenance",
+      "schema": "",
+      "columns": {
+        "document_id": {
+          "name": "document_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "source_hash": {
+          "name": "source_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entries": {
+          "name": "entries",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "document_secret_provenance_document_id_document_id_fk": {
+          "name": "document_secret_provenance_document_id_document_id_fk",
+          "tableFrom": "document_secret_provenance",
+          "tableTo": "document",
+          "columnsFrom": ["document_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "document_secret_provenance_status_check": {
+          "name": "document_secret_provenance_status_check",
+          "value": "\"document_secret_provenance\".\"status\" IN ('exact', 'unknown')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.embedding": {
+      "name": "embedding",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "knowledge_base_id": {
+          "name": "knowledge_base_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "chunk_index": {
+          "name": "chunk_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "chunk_hash": {
+          "name": "chunk_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_provenance_version": {
+          "name": "secret_provenance_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "content_length": {
+          "name": "content_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_count": {
+          "name": "token_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "embedding": {
+          "name": "embedding",
+          "type": "vector(1536)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "embedding_384": {
+          "name": "embedding_384",
+          "type": "vector(384)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "embedding_768": {
+          "name": "embedding_768",
+          "type": "vector(768)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "embedding_1024": {
+          "name": "embedding_1024",
+          "type": "vector(1024)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "embedding_3072": {
+          "name": "embedding_3072",
+          "type": "vector(3072)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "embedding_model": {
+          "name": "embedding_model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'text-embedding-3-small'"
+        },
+        "start_offset": {
+          "name": "start_offset",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "end_offset": {
+          "name": "end_offset",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tag1": {
+          "name": "tag1",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag2": {
+          "name": "tag2",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag3": {
+          "name": "tag3",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag4": {
+          "name": "tag4",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag5": {
+          "name": "tag5",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag6": {
+          "name": "tag6",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag7": {
+          "name": "tag7",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "number1": {
+          "name": "number1",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "number2": {
+          "name": "number2",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "number3": {
+          "name": "number3",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "number4": {
+          "name": "number4",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "number5": {
+          "name": "number5",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "date1": {
+          "name": "date1",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "date2": {
+          "name": "date2",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "boolean1": {
+          "name": "boolean1",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "boolean2": {
+          "name": "boolean2",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "boolean3": {
+          "name": "boolean3",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "content_tsv": {
+          "name": "content_tsv",
+          "type": "tsvector",
+          "primaryKey": false,
+          "notNull": false,
+          "generated": {
+            "as": "to_tsvector('english', \"embedding\".\"content\")",
+            "type": "stored"
+          }
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "emb_kb_id_idx": {
+          "name": "emb_kb_id_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_doc_id_idx": {
+          "name": "emb_doc_id_idx",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_doc_chunk_idx": {
+          "name": "emb_doc_chunk_idx",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "chunk_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_kb_model_idx": {
+          "name": "emb_kb_model_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "embedding_model",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_kb_enabled_idx": {
+          "name": "emb_kb_enabled_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_doc_enabled_idx": {
+          "name": "emb_doc_enabled_idx",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "embedding_vector_hnsw_idx": {
+          "name": "embedding_vector_hnsw_idx",
+          "columns": [
+            {
+              "expression": "embedding",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "vector_cosine_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "hnsw",
+          "with": {
+            "m": 16,
+            "ef_construction": 64
+          }
+        },
+        "embedding_384_vector_hnsw_idx": {
+          "name": "embedding_384_vector_hnsw_idx",
+          "columns": [
+            {
+              "expression": "embedding_384",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "vector_cosine_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "hnsw",
+          "with": {
+            "m": 16,
+            "ef_construction": 64
+          }
+        },
+        "embedding_768_vector_hnsw_idx": {
+          "name": "embedding_768_vector_hnsw_idx",
+          "columns": [
+            {
+              "expression": "embedding_768",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "vector_cosine_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "hnsw",
+          "with": {
+            "m": 16,
+            "ef_construction": 64
+          }
+        },
+        "embedding_1024_vector_hnsw_idx": {
+          "name": "embedding_1024_vector_hnsw_idx",
+          "columns": [
+            {
+              "expression": "embedding_1024",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "vector_cosine_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "hnsw",
+          "with": {
+            "m": 16,
+            "ef_construction": 64
+          }
+        },
+        "embedding_3072_vector_hnsw_idx": {
+          "name": "embedding_3072_vector_hnsw_idx",
+          "columns": [
+            {
+              "expression": "(\"embedding_3072\"::halfvec(3072)) halfvec_cosine_ops",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "hnsw",
+          "with": {
+            "m": 16,
+            "ef_construction": 64
+          }
+        },
+        "embedding_binary_hnsw_idx": {
+          "name": "embedding_binary_hnsw_idx",
+          "columns": [
+            {
+              "expression": "(binary_quantize(\"embedding\")::bit(1536)) bit_hamming_ops",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "hnsw",
+          "with": {
+            "m": 16,
+            "ef_construction": 64
+          }
+        },
+        "embedding_384_binary_hnsw_idx": {
+          "name": "embedding_384_binary_hnsw_idx",
+          "columns": [
+            {
+              "expression": "(binary_quantize(\"embedding_384\")::bit(384)) bit_hamming_ops",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "hnsw",
+          "with": {
+            "m": 16,
+            "ef_construction": 64
+          }
+        },
+        "embedding_768_binary_hnsw_idx": {
+          "name": "embedding_768_binary_hnsw_idx",
+          "columns": [
+            {
+              "expression": "(binary_quantize(\"embedding_768\")::bit(768)) bit_hamming_ops",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "hnsw",
+          "with": {
+            "m": 16,
+            "ef_construction": 64
+          }
+        },
+        "embedding_1024_binary_hnsw_idx": {
+          "name": "embedding_1024_binary_hnsw_idx",
+          "columns": [
+            {
+              "expression": "(binary_quantize(\"embedding_1024\")::bit(1024)) bit_hamming_ops",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "hnsw",
+          "with": {
+            "m": 16,
+            "ef_construction": 64
+          }
+        },
+        "embedding_3072_binary_hnsw_idx": {
+          "name": "embedding_3072_binary_hnsw_idx",
+          "columns": [
+            {
+              "expression": "(binary_quantize(\"embedding_3072\")::bit(3072)) bit_hamming_ops",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "hnsw",
+          "with": {
+            "m": 16,
+            "ef_construction": 64
+          }
+        },
+        "emb_kb_tag1_lower_idx": {
+          "name": "emb_kb_tag1_lower_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"tag1\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_kb_tag2_lower_idx": {
+          "name": "emb_kb_tag2_lower_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"tag2\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_kb_tag3_lower_idx": {
+          "name": "emb_kb_tag3_lower_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"tag3\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_kb_tag4_lower_idx": {
+          "name": "emb_kb_tag4_lower_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"tag4\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_kb_tag5_lower_idx": {
+          "name": "emb_kb_tag5_lower_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"tag5\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_kb_tag6_lower_idx": {
+          "name": "emb_kb_tag6_lower_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"tag6\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_kb_tag7_lower_idx": {
+          "name": "emb_kb_tag7_lower_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"tag7\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_number1_idx": {
+          "name": "emb_number1_idx",
+          "columns": [
+            {
+              "expression": "number1",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_number2_idx": {
+          "name": "emb_number2_idx",
+          "columns": [
+            {
+              "expression": "number2",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_number3_idx": {
+          "name": "emb_number3_idx",
+          "columns": [
+            {
+              "expression": "number3",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_number4_idx": {
+          "name": "emb_number4_idx",
+          "columns": [
+            {
+              "expression": "number4",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_number5_idx": {
+          "name": "emb_number5_idx",
+          "columns": [
+            {
+              "expression": "number5",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_date1_idx": {
+          "name": "emb_date1_idx",
+          "columns": [
+            {
+              "expression": "date1",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_date2_idx": {
+          "name": "emb_date2_idx",
+          "columns": [
+            {
+              "expression": "date2",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_boolean1_idx": {
+          "name": "emb_boolean1_idx",
+          "columns": [
+            {
+              "expression": "boolean1",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_boolean2_idx": {
+          "name": "emb_boolean2_idx",
+          "columns": [
+            {
+              "expression": "boolean2",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_boolean3_idx": {
+          "name": "emb_boolean3_idx",
+          "columns": [
+            {
+              "expression": "boolean3",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_content_fts_idx": {
+          "name": "emb_content_fts_idx",
+          "columns": [
+            {
+              "expression": "content_tsv",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "embedding_knowledge_base_id_knowledge_base_id_fk": {
+          "name": "embedding_knowledge_base_id_knowledge_base_id_fk",
+          "tableFrom": "embedding",
+          "tableTo": "knowledge_base",
+          "columnsFrom": ["knowledge_base_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "embedding_document_id_document_id_fk": {
+          "name": "embedding_document_id_document_id_fk",
+          "tableFrom": "embedding",
+          "tableTo": "document",
+          "columnsFrom": ["document_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "embedding_width_check": {
+          "name": "embedding_width_check",
+          "value": "num_nonnulls(\"embedding\", \"embedding_384\", \"embedding_768\", \"embedding_1024\", \"embedding_3072\") = 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.embedding_secret_provenance": {
+      "name": "embedding_secret_provenance",
+      "schema": "",
+      "columns": {
+        "embedding_id": {
+          "name": "embedding_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "content_hash": {
+          "name": "content_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entries": {
+          "name": "entries",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "embedding_secret_provenance_embedding_id_embedding_id_fk": {
+          "name": "embedding_secret_provenance_embedding_id_embedding_id_fk",
+          "tableFrom": "embedding_secret_provenance",
+          "tableTo": "embedding",
+          "columnsFrom": ["embedding_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "embedding_secret_provenance_status_check": {
+          "name": "embedding_secret_provenance_status_check",
+          "value": "\"embedding_secret_provenance\".\"status\" IN ('exact', 'unknown')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.environment": {
+      "name": "environment",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "variables": {
+          "name": "variables",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "environment_user_id_user_id_fk": {
+          "name": "environment_user_id_user_id_fk",
+          "tableFrom": "environment",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "environment_user_id_unique": {
+          "name": "environment_user_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.execution_large_value_dependencies": {
+      "name": "execution_large_value_dependencies",
+      "schema": "",
+      "columns": {
+        "parent_key": {
+          "name": "parent_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "child_key": {
+          "name": "child_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "execution_large_value_dependencies_workspace_parent_key_idx": {
+          "name": "execution_large_value_dependencies_workspace_parent_key_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_large_value_dependencies_workspace_child_key_idx": {
+          "name": "execution_large_value_dependencies_workspace_child_key_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "child_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "execution_large_value_dependencies_workspace_id_workspace_id_fk": {
+          "name": "execution_large_value_dependencies_workspace_id_workspace_id_fk",
+          "tableFrom": "execution_large_value_dependencies",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "execution_large_value_dependencies_parent_key_child_key_pk": {
+          "name": "execution_large_value_dependencies_parent_key_child_key_pk",
+          "columns": ["parent_key", "child_key"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.execution_large_value_references": {
+      "name": "execution_large_value_references",
+      "schema": "",
+      "columns": {
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_id": {
+          "name": "execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "execution_large_value_reference_source",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "execution_large_value_references_workspace_execution_source_idx": {
+          "name": "execution_large_value_references_workspace_execution_source_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_large_value_references_workflow_id_idx": {
+          "name": "execution_large_value_references_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "execution_large_value_references_workspace_id_workspace_id_fk": {
+          "name": "execution_large_value_references_workspace_id_workspace_id_fk",
+          "tableFrom": "execution_large_value_references",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_large_value_references_workflow_id_workflow_id_fk": {
+          "name": "execution_large_value_references_workflow_id_workflow_id_fk",
+          "tableFrom": "execution_large_value_references",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "execution_large_value_references_key_execution_id_source_pk": {
+          "name": "execution_large_value_references_key_execution_id_source_pk",
+          "columns": ["key", "execution_id", "source"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.execution_large_values": {
+      "name": "execution_large_values",
+      "schema": "",
+      "columns": {
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_execution_id": {
+          "name": "owner_execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "size": {
+          "name": "size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "execution_large_values_owner_execution_id_idx": {
+          "name": "execution_large_values_owner_execution_id_idx",
+          "columns": [
+            {
+              "expression": "owner_execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_large_values_cleanup_idx": {
+          "name": "execution_large_values_cleanup_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"execution_large_values\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_large_values_tombstone_cleanup_idx": {
+          "name": "execution_large_values_tombstone_cleanup_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"execution_large_values\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_large_values_workflow_id_idx": {
+          "name": "execution_large_values_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "execution_large_values_workspace_id_workspace_id_fk": {
+          "name": "execution_large_values_workspace_id_workspace_id_fk",
+          "tableFrom": "execution_large_values",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_large_values_workflow_id_workflow_id_fk": {
+          "name": "execution_large_values_workflow_id_workflow_id_fk",
+          "tableFrom": "execution_large_values",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.folder": {
+      "name": "folder",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "resource_type": {
+          "name": "resource_type",
+          "type": "folder_resource_type",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked": {
+          "name": "locked",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "sort_order": {
+          "name": "sort_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "folder_user_idx": {
+          "name": "folder_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folder_workspace_resource_parent_idx": {
+          "name": "folder_workspace_resource_parent_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folder_parent_sort_idx": {
+          "name": "folder_parent_sort_idx",
+          "columns": [
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sort_order",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folder_deleted_at_idx": {
+          "name": "folder_deleted_at_idx",
+          "columns": [
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folder_workspace_deleted_partial_idx": {
+          "name": "folder_workspace_deleted_partial_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"folder\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folder_workspace_resource_parent_name_active_unique": {
+          "name": "folder_workspace_resource_parent_name_active_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "coalesce(\"parent_id\", '')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"folder\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "folder_user_id_user_id_fk": {
+          "name": "folder_user_id_user_id_fk",
+          "tableFrom": "folder",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "folder_workspace_id_workspace_id_fk": {
+          "name": "folder_workspace_id_workspace_id_fk",
+          "tableFrom": "folder",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "folder_parent_id_folder_id_fk": {
+          "name": "folder_parent_id_folder_id_fk",
+          "tableFrom": "folder",
+          "tableTo": "folder",
+          "columnsFrom": ["parent_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.idempotency_key": {
+      "name": "idempotency_key",
+      "schema": "",
+      "columns": {
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "result": {
+          "name": "result",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "idempotency_key_created_at_idx": {
+          "name": "idempotency_key_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.invitation": {
+      "name": "invitation",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "invitation_kind",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'organization'"
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "inviter_id": {
+          "name": "inviter_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "membership_intent": {
+          "name": "membership_intent",
+          "type": "invitation_membership_intent",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'internal'"
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "invitation_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "invitation_email_idx": {
+          "name": "invitation_email_idx",
+          "columns": [
+            {
+              "expression": "email",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invitation_organization_id_idx": {
+          "name": "invitation_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invitation_status_idx": {
+          "name": "invitation_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invitation_pending_email_org_unique": {
+          "name": "invitation_pending_email_org_unique",
+          "columns": [
+            {
+              "expression": "email",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"invitation\".\"status\" = 'pending' AND \"invitation\".\"organization_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "invitation_inviter_id_user_id_fk": {
+          "name": "invitation_inviter_id_user_id_fk",
+          "tableFrom": "invitation",
+          "tableTo": "user",
+          "columnsFrom": ["inviter_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "invitation_organization_id_organization_id_fk": {
+          "name": "invitation_organization_id_organization_id_fk",
+          "tableFrom": "invitation",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "invitation_token_unique": {
+          "name": "invitation_token_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.invitation_workspace_grant": {
+      "name": "invitation_workspace_grant",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "invitation_id": {
+          "name": "invitation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "permission": {
+          "name": "permission",
+          "type": "permission_type",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "invitation_workspace_grant_unique": {
+          "name": "invitation_workspace_grant_unique",
+          "columns": [
+            {
+              "expression": "invitation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invitation_workspace_grant_workspace_id_idx": {
+          "name": "invitation_workspace_grant_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "invitation_workspace_grant_invitation_id_invitation_id_fk": {
+          "name": "invitation_workspace_grant_invitation_id_invitation_id_fk",
+          "tableFrom": "invitation_workspace_grant",
+          "tableTo": "invitation",
+          "columnsFrom": ["invitation_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "invitation_workspace_grant_workspace_id_workspace_id_fk": {
+          "name": "invitation_workspace_grant_workspace_id_workspace_id_fk",
+          "tableFrom": "invitation_workspace_grant",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.job_execution_logs": {
+      "name": "job_execution_logs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "schedule_id": {
+          "name": "schedule_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_id": {
+          "name": "execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'running'"
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ended_at": {
+          "name": "ended_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "total_duration_ms": {
+          "name": "total_duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_data": {
+          "name": "execution_data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "cost": {
+          "name": "cost",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "job_execution_logs_schedule_id_idx": {
+          "name": "job_execution_logs_schedule_id_idx",
+          "columns": [
+            {
+              "expression": "schedule_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "job_execution_logs_workspace_started_at_idx": {
+          "name": "job_execution_logs_workspace_started_at_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "job_execution_logs_workspace_ended_at_id_idx": {
+          "name": "job_execution_logs_workspace_ended_at_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "date_trunc('milliseconds', \"ended_at\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "job_execution_logs_execution_id_unique": {
+          "name": "job_execution_logs_execution_id_unique",
+          "columns": [
+            {
+              "expression": "execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "job_execution_logs_trigger_idx": {
+          "name": "job_execution_logs_trigger_idx",
+          "columns": [
+            {
+              "expression": "trigger",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "job_execution_logs_schedule_id_workflow_schedule_id_fk": {
+          "name": "job_execution_logs_schedule_id_workflow_schedule_id_fk",
+          "tableFrom": "job_execution_logs",
+          "tableTo": "workflow_schedule",
+          "columnsFrom": ["schedule_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "job_execution_logs_workspace_id_workspace_id_fk": {
+          "name": "job_execution_logs_workspace_id_workspace_id_fk",
+          "tableFrom": "job_execution_logs",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.knowledge_base": {
+      "name": "knowledge_base",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "folder_id": {
+          "name": "folder_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_search_index": {
+          "name": "is_search_index",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "token_count": {
+          "name": "token_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "embedding_model": {
+          "name": "embedding_model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'text-embedding-3-small'"
+        },
+        "embedding_dimension": {
+          "name": "embedding_dimension",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1536
+        },
+        "chunking_config": {
+          "name": "chunking_config",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"maxSize\": 1024, \"minSize\": 1, \"overlap\": 200}'"
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "kb_organization_id_idx": {
+          "name": "kb_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kb_organization_search_index_unique": {
+          "name": "kb_organization_search_index_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"knowledge_base\".\"is_search_index\" = true AND \"knowledge_base\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kb_organization_name_active_unique": {
+          "name": "kb_organization_name_active_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"knowledge_base\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kb_user_id_idx": {
+          "name": "kb_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kb_workspace_id_idx": {
+          "name": "kb_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kb_user_workspace_idx": {
+          "name": "kb_user_workspace_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kb_folder_id_idx": {
+          "name": "kb_folder_id_idx",
+          "columns": [
+            {
+              "expression": "folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kb_deleted_at_idx": {
+          "name": "kb_deleted_at_idx",
+          "columns": [
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kb_workspace_deleted_partial_idx": {
+          "name": "kb_workspace_deleted_partial_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"knowledge_base\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kb_workspace_name_active_unique": {
+          "name": "kb_workspace_name_active_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"knowledge_base\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kb_workspace_search_index_unique": {
+          "name": "kb_workspace_search_index_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"knowledge_base\".\"is_search_index\" = true AND \"knowledge_base\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "knowledge_base_user_id_user_id_fk": {
+          "name": "knowledge_base_user_id_user_id_fk",
+          "tableFrom": "knowledge_base",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "knowledge_base_workspace_id_workspace_id_fk": {
+          "name": "knowledge_base_workspace_id_workspace_id_fk",
+          "tableFrom": "knowledge_base",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "knowledge_base_organization_id_organization_id_fk": {
+          "name": "knowledge_base_organization_id_organization_id_fk",
+          "tableFrom": "knowledge_base",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "knowledge_base_folder_id_folder_id_fk": {
+          "name": "knowledge_base_folder_id_folder_id_fk",
+          "tableFrom": "knowledge_base",
+          "tableTo": "folder",
+          "columnsFrom": ["folder_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "kb_owner_check": {
+          "name": "kb_owner_check",
+          "value": "num_nonnulls(\"knowledge_base\".\"workspace_id\", \"knowledge_base\".\"organization_id\") = 1"
+        },
+        "kb_organization_search_index_check": {
+          "name": "kb_organization_search_index_check",
+          "value": "\"knowledge_base\".\"organization_id\" IS NULL OR \"knowledge_base\".\"is_search_index\""
+        },
+        "kb_organization_folder_check": {
+          "name": "kb_organization_folder_check",
+          "value": "\"knowledge_base\".\"organization_id\" IS NULL OR \"knowledge_base\".\"folder_id\" IS NULL"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.knowledge_base_tag_definitions": {
+      "name": "knowledge_base_tag_definitions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "knowledge_base_id": {
+          "name": "knowledge_base_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tag_slot": {
+          "name": "tag_slot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "field_type": {
+          "name": "field_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'text'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "kb_tag_definitions_kb_slot_idx": {
+          "name": "kb_tag_definitions_kb_slot_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "tag_slot",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kb_tag_definitions_kb_display_name_idx": {
+          "name": "kb_tag_definitions_kb_display_name_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "display_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kb_tag_definitions_kb_id_idx": {
+          "name": "kb_tag_definitions_kb_id_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "knowledge_base_tag_definitions_knowledge_base_id_knowledge_base_id_fk": {
+          "name": "knowledge_base_tag_definitions_knowledge_base_id_knowledge_base_id_fk",
+          "tableFrom": "knowledge_base_tag_definitions",
+          "tableTo": "knowledge_base",
+          "columnsFrom": ["knowledge_base_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.knowledge_connector": {
+      "name": "knowledge_connector",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "knowledge_base_id": {
+          "name": "knowledge_base_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connector_type": {
+          "name": "connector_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "credential_id": {
+          "name": "credential_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "encrypted_api_key": {
+          "name": "encrypted_api_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_config": {
+          "name": "source_config",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sync_mode": {
+          "name": "sync_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'full'"
+        },
+        "sync_interval_minutes": {
+          "name": "sync_interval_minutes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1440
+        },
+        "access_mode": {
+          "name": "access_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'workspace'"
+        },
+        "credential_group_id": {
+          "name": "credential_group_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_group_option_id": {
+          "name": "credential_group_option_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "member_sync_status": {
+          "name": "member_sync_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'idle'"
+        },
+        "member_sync_lock_token": {
+          "name": "member_sync_lock_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "member_sync_lock_lease_at": {
+          "name": "member_sync_lock_lease_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_member_sync_at": {
+          "name": "next_member_sync_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_member_sync_at": {
+          "name": "last_member_sync_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_member_sync_error": {
+          "name": "last_member_sync_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "member_sync_consecutive_failures": {
+          "name": "member_sync_consecutive_failures",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "access_rewrite_pending": {
+          "name": "access_rewrite_pending",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "last_sync_at": {
+          "name": "last_sync_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_sync_error": {
+          "name": "last_sync_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_sync_doc_count": {
+          "name": "last_sync_doc_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "listing_checkpoint": {
+          "name": "listing_checkpoint",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "directory_checkpoint": {
+          "name": "directory_checkpoint",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_sync_at": {
+          "name": "next_sync_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_directory_sync_at": {
+          "name": "next_directory_sync_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "consecutive_failures": {
+          "name": "consecutive_failures",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "sync_lock_token": {
+          "name": "sync_lock_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sync_lock_lease_at": {
+          "name": "sync_lock_lease_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "kc_knowledge_base_id_idx": {
+          "name": "kc_knowledge_base_id_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kc_status_next_sync_idx": {
+          "name": "kc_status_next_sync_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "next_sync_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kc_archived_at_partial_idx": {
+          "name": "kc_archived_at_partial_idx",
+          "columns": [
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"knowledge_connector\".\"archived_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kc_deleted_at_partial_idx": {
+          "name": "kc_deleted_at_partial_idx",
+          "columns": [
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"knowledge_connector\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kc_member_sync_due_idx": {
+          "name": "kc_member_sync_due_idx",
+          "columns": [
+            {
+              "expression": "member_sync_status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "next_member_sync_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"knowledge_connector\".\"access_mode\" = 'members' AND \"knowledge_connector\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kc_directory_sync_due_idx": {
+          "name": "kc_directory_sync_due_idx",
+          "columns": [
+            {
+              "expression": "next_directory_sync_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"knowledge_connector\".\"access_mode\" = 'admin' AND \"knowledge_connector\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "knowledge_connector_knowledge_base_id_knowledge_base_id_fk": {
+          "name": "knowledge_connector_knowledge_base_id_knowledge_base_id_fk",
+          "tableFrom": "knowledge_connector",
+          "tableTo": "knowledge_base",
+          "columnsFrom": ["knowledge_base_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "knowledge_connector_credential_group_id_credential_group_id_fk": {
+          "name": "knowledge_connector_credential_group_id_credential_group_id_fk",
+          "tableFrom": "knowledge_connector",
+          "tableTo": "credential_group",
+          "columnsFrom": ["credential_group_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "kc_access_mode_check": {
+          "name": "kc_access_mode_check",
+          "value": "\"knowledge_connector\".\"access_mode\" IN ('workspace', 'members', 'admin')"
+        },
+        "kc_member_sync_status_check": {
+          "name": "kc_member_sync_status_check",
+          "value": "\"knowledge_connector\".\"member_sync_status\" IN ('idle', 'pending', 'running', 'error', 'disabled')"
+        },
+        "kc_sync_lock_exclusive_check": {
+          "name": "kc_sync_lock_exclusive_check",
+          "value": "NOT (\"knowledge_connector\".\"sync_lock_token\" IS NOT NULL AND \"knowledge_connector\".\"member_sync_lock_token\" IS NOT NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.knowledge_connector_member": {
+      "name": "knowledge_connector_member",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connector_id": {
+          "name": "connector_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "credential_id": {
+          "name": "credential_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject_token": {
+          "name": "subject_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "consecutive_failures": {
+          "name": "consecutive_failures",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "next_attempt_at": {
+          "name": "next_attempt_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_started_at": {
+          "name": "last_started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_complete_listing_at": {
+          "name": "last_complete_listing_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_listed_count": {
+          "name": "last_listed_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "member_synced_through": {
+          "name": "member_synced_through",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "change_cursor": {
+          "name": "change_cursor",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "listing_checkpoint": {
+          "name": "listing_checkpoint",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "suspended_at": {
+          "name": "suspended_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "kcm_organization_id_idx": {
+          "name": "kcm_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kcm_connector_credential_unique": {
+          "name": "kcm_connector_credential_unique",
+          "columns": [
+            {
+              "expression": "connector_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "credential_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kcm_connector_queue_idx": {
+          "name": "kcm_connector_queue_idx",
+          "columns": [
+            {
+              "expression": "connector_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "next_attempt_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "first"
+            },
+            {
+              "expression": "last_started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "first"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kcm_credential_idx": {
+          "name": "kcm_credential_idx",
+          "columns": [
+            {
+              "expression": "credential_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "knowledge_connector_member_workspace_id_workspace_id_fk": {
+          "name": "knowledge_connector_member_workspace_id_workspace_id_fk",
+          "tableFrom": "knowledge_connector_member",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "knowledge_connector_member_organization_id_organization_id_fk": {
+          "name": "knowledge_connector_member_organization_id_organization_id_fk",
+          "tableFrom": "knowledge_connector_member",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "knowledge_connector_member_connector_id_knowledge_connector_id_fk": {
+          "name": "knowledge_connector_member_connector_id_knowledge_connector_id_fk",
+          "tableFrom": "knowledge_connector_member",
+          "tableTo": "knowledge_connector",
+          "columnsFrom": ["connector_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "knowledge_connector_member_credential_id_credential_id_fk": {
+          "name": "knowledge_connector_member_credential_id_credential_id_fk",
+          "tableFrom": "knowledge_connector_member",
+          "tableTo": "credential",
+          "columnsFrom": ["credential_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "kcm_owner_check": {
+          "name": "kcm_owner_check",
+          "value": "num_nonnulls(\"knowledge_connector_member\".\"workspace_id\", \"knowledge_connector_member\".\"organization_id\") = 1"
+        },
+        "kcm_status_check": {
+          "name": "kcm_status_check",
+          "value": "\"knowledge_connector_member\".\"status\" IN ('active', 'suspended', 'disabled')"
+        },
+        "kcm_subject_token_shape_check": {
+          "name": "kcm_subject_token_shape_check",
+          "value": "\"knowledge_connector_member\".\"subject_token\" ~ '^s:[^:]+:[^:]+:.+$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.knowledge_connector_member_sync_log": {
+      "name": "knowledge_connector_member_sync_log",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "connector_id": {
+          "name": "connector_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "members_claimed": {
+          "name": "members_claimed",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "members_completed": {
+          "name": "members_completed",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "members_incomplete": {
+          "name": "members_incomplete",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "members_failed": {
+          "name": "members_failed",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "docs_listed": {
+          "name": "docs_listed",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "docs_added": {
+          "name": "docs_added",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "docs_updated": {
+          "name": "docs_updated",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "docs_unchanged": {
+          "name": "docs_unchanged",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "docs_hydrated_once": {
+          "name": "docs_hydrated_once",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "observations_added": {
+          "name": "observations_added",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "observations_removed": {
+          "name": "observations_removed",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "docs_tombstoned": {
+          "name": "docs_tombstoned",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "docs_resurrected": {
+          "name": "docs_resurrected",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "docs_purged": {
+          "name": "docs_purged",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "credentials_audited": {
+          "name": "credentials_audited",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "kcmsl_connector_started_at_idx": {
+          "name": "kcmsl_connector_started_at_idx",
+          "columns": [
+            {
+              "expression": "connector_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "\"started_at\" DESC",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kcmsl_started_at_partial_idx": {
+          "name": "kcmsl_started_at_partial_idx",
+          "columns": [
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"knowledge_connector_member_sync_log\".\"status\" = 'started'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "knowledge_connector_member_sync_log_connector_id_knowledge_connector_id_fk": {
+          "name": "knowledge_connector_member_sync_log_connector_id_knowledge_connector_id_fk",
+          "tableFrom": "knowledge_connector_member_sync_log",
+          "tableTo": "knowledge_connector",
+          "columnsFrom": ["connector_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "kcmsl_status_check": {
+          "name": "kcmsl_status_check",
+          "value": "\"knowledge_connector_member_sync_log\".\"status\" IN ('started', 'partial', 'completed', 'failed')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.knowledge_connector_permission_grant": {
+      "name": "knowledge_connector_permission_grant",
+      "schema": "",
+      "columns": {
+        "connector_id": {
+          "name": "connector_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "group_key": {
+          "name": "group_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject_token": {
+          "name": "subject_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "kcpg_subject_idx": {
+          "name": "kcpg_subject_idx",
+          "columns": [
+            {
+              "expression": "subject_token",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connector_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "group_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "kcpg_snapshot_fk": {
+          "name": "kcpg_snapshot_fk",
+          "tableFrom": "knowledge_connector_permission_grant",
+          "tableTo": "knowledge_connector_permission_snapshot",
+          "columnsFrom": ["connector_id"],
+          "columnsTo": ["connector_id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "kcpg_pk": {
+          "name": "kcpg_pk",
+          "columns": ["connector_id", "group_key", "subject_token"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "kcpg_group_check": {
+          "name": "kcpg_group_check",
+          "value": "length(\"knowledge_connector_permission_grant\".\"group_key\") BETWEEN 1 AND 255"
+        },
+        "kcpg_subject_check": {
+          "name": "kcpg_subject_check",
+          "value": "\"knowledge_connector_permission_grant\".\"subject_token\" ~ '^u:[^[:space:]A-Z]+@[^[:space:]A-Z]+$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.knowledge_connector_permission_snapshot": {
+      "name": "knowledge_connector_permission_snapshot",
+      "schema": "",
+      "columns": {
+        "connector_id": {
+          "name": "connector_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "revision": {
+          "name": "revision",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "kcps_connector_fk": {
+          "name": "kcps_connector_fk",
+          "tableFrom": "knowledge_connector_permission_snapshot",
+          "tableTo": "knowledge_connector",
+          "columnsFrom": ["connector_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "kcps_revision_check": {
+          "name": "kcps_revision_check",
+          "value": "\"knowledge_connector_permission_snapshot\".\"revision\" > 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.knowledge_connector_sync_log": {
+      "name": "knowledge_connector_sync_log",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "connector_id": {
+          "name": "connector_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "docs_added": {
+          "name": "docs_added",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "docs_updated": {
+          "name": "docs_updated",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "docs_deleted": {
+          "name": "docs_deleted",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "docs_unchanged": {
+          "name": "docs_unchanged",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "docs_skipped": {
+          "name": "docs_skipped",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "docs_failed": {
+          "name": "docs_failed",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "listed_count": {
+          "name": "listed_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "kcsl_connector_started_at_idx": {
+          "name": "kcsl_connector_started_at_idx",
+          "columns": [
+            {
+              "expression": "connector_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "\"started_at\" DESC",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kcsl_started_at_partial_idx": {
+          "name": "kcsl_started_at_partial_idx",
+          "columns": [
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"knowledge_connector_sync_log\".\"status\" = 'started'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "knowledge_connector_sync_log_connector_id_knowledge_connector_id_fk": {
+          "name": "knowledge_connector_sync_log_connector_id_knowledge_connector_id_fk",
+          "tableFrom": "knowledge_connector_sync_log",
+          "tableTo": "knowledge_connector",
+          "columnsFrom": ["connector_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.knowledge_document_observation": {
+      "name": "knowledge_document_observation",
+      "schema": "",
+      "columns": {
+        "document_id": {
+          "name": "document_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "member_id": {
+          "name": "member_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_seen_at": {
+          "name": "last_seen_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "kdo_member_idx": {
+          "name": "kdo_member_idx",
+          "columns": [
+            {
+              "expression": "member_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "knowledge_document_observation_document_id_document_id_fk": {
+          "name": "knowledge_document_observation_document_id_document_id_fk",
+          "tableFrom": "knowledge_document_observation",
+          "tableTo": "document",
+          "columnsFrom": ["document_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "knowledge_document_observation_member_id_knowledge_connector_member_id_fk": {
+          "name": "knowledge_document_observation_member_id_knowledge_connector_member_id_fk",
+          "tableFrom": "knowledge_document_observation",
+          "tableTo": "knowledge_connector_member",
+          "columnsFrom": ["member_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "knowledge_document_observation_document_id_member_id_pk": {
+          "name": "knowledge_document_observation_document_id_member_id_pk",
+          "columns": ["document_id", "member_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.knowledge_external_directory": {
+      "name": "knowledge_external_directory",
+      "schema": "",
+      "columns": {
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tenant_id": {
+          "name": "tenant_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sync_lock_token": {
+          "name": "sync_lock_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sync_lock_lease_at": {
+          "name": "sync_lock_lease_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_started_at": {
+          "name": "last_started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_complete_sync_at": {
+          "name": "last_complete_sync_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "ked_organization_id_idx": {
+          "name": "ked_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "ked_workspace_identity_unique": {
+          "name": "ked_workspace_identity_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "tenant_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "ked_organization_identity_unique": {
+          "name": "ked_organization_identity_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "tenant_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "knowledge_external_directory_workspace_id_workspace_id_fk": {
+          "name": "knowledge_external_directory_workspace_id_workspace_id_fk",
+          "tableFrom": "knowledge_external_directory",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "knowledge_external_directory_organization_id_organization_id_fk": {
+          "name": "knowledge_external_directory_organization_id_organization_id_fk",
+          "tableFrom": "knowledge_external_directory",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "ked_owner_check": {
+          "name": "ked_owner_check",
+          "value": "num_nonnulls(\"knowledge_external_directory\".\"workspace_id\", \"knowledge_external_directory\".\"organization_id\") = 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.knowledge_external_group": {
+      "name": "knowledge_external_group",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tenant_id": {
+          "name": "tenant_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_group_id": {
+          "name": "external_group_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_synced_at": {
+          "name": "last_synced_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "keg_organization_id_idx": {
+          "name": "keg_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "keg_organization_identity_unique": {
+          "name": "keg_organization_identity_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "tenant_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "keg_organization_synced_idx": {
+          "name": "keg_organization_synced_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_synced_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "first"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "keg_identity_unique": {
+          "name": "keg_identity_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "tenant_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "keg_workspace_synced_idx": {
+          "name": "keg_workspace_synced_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_synced_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "first"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "knowledge_external_group_organization_id_organization_id_fk": {
+          "name": "knowledge_external_group_organization_id_organization_id_fk",
+          "tableFrom": "knowledge_external_group",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "keg_workspace_fk": {
+          "name": "keg_workspace_fk",
+          "tableFrom": "knowledge_external_group",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "keg_owner_check": {
+          "name": "keg_owner_check",
+          "value": "num_nonnulls(\"knowledge_external_group\".\"workspace_id\", \"knowledge_external_group\".\"organization_id\") = 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.knowledge_external_group_member": {
+      "name": "knowledge_external_group_member",
+      "schema": "",
+      "columns": {
+        "group_id": {
+          "name": "group_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject_token": {
+          "name": "subject_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "kegm_subject_token_idx": {
+          "name": "kegm_subject_token_idx",
+          "columns": [
+            {
+              "expression": "subject_token",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "kegm_group_fk": {
+          "name": "kegm_group_fk",
+          "tableFrom": "knowledge_external_group_member",
+          "tableTo": "knowledge_external_group",
+          "columnsFrom": ["group_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "knowledge_external_group_member_group_id_subject_token_pk": {
+          "name": "knowledge_external_group_member_group_id_subject_token_pk",
+          "columns": ["group_id", "subject_token"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.mcp_server_oauth": {
+      "name": "mcp_server_oauth",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "mcp_server_id": {
+          "name": "mcp_server_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_information": {
+          "name": "client_information",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tokens": {
+          "name": "tokens",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "code_verifier": {
+          "name": "code_verifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "state_created_at": {
+          "name": "state_created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_refreshed_at": {
+          "name": "last_refreshed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "mcp_server_oauth_server_unique": {
+          "name": "mcp_server_oauth_server_unique",
+          "columns": [
+            {
+              "expression": "mcp_server_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "mcp_server_oauth_state_idx": {
+          "name": "mcp_server_oauth_state_idx",
+          "columns": [
+            {
+              "expression": "state",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "mcp_server_oauth_mcp_server_id_mcp_servers_id_fk": {
+          "name": "mcp_server_oauth_mcp_server_id_mcp_servers_id_fk",
+          "tableFrom": "mcp_server_oauth",
+          "tableTo": "mcp_servers",
+          "columnsFrom": ["mcp_server_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "mcp_server_oauth_user_id_user_id_fk": {
+          "name": "mcp_server_oauth_user_id_user_id_fk",
+          "tableFrom": "mcp_server_oauth",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "mcp_server_oauth_workspace_id_workspace_id_fk": {
+          "name": "mcp_server_oauth_workspace_id_workspace_id_fk",
+          "tableFrom": "mcp_server_oauth",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "mcp_server_oauth_organization_id_organization_id_fk": {
+          "name": "mcp_server_oauth_organization_id_organization_id_fk",
+          "tableFrom": "mcp_server_oauth",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "mcp_server_oauth_owner_check": {
+          "name": "mcp_server_oauth_owner_check",
+          "value": "num_nonnulls(\"mcp_server_oauth\".\"workspace_id\", \"mcp_server_oauth\".\"organization_id\") = 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.mcp_servers": {
+      "name": "mcp_servers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_group_id": {
+          "name": "credential_group_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "managed_connector_id": {
+          "name": "managed_connector_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "oauth_config_version": {
+          "name": "oauth_config_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "transport": {
+          "name": "transport",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "url": {
+          "name": "url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "auth_type": {
+          "name": "auth_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'headers'"
+        },
+        "oauth_client_id": {
+          "name": "oauth_client_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "oauth_client_secret": {
+          "name": "oauth_client_secret",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "headers": {
+          "name": "headers",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'{}'"
+        },
+        "timeout": {
+          "name": "timeout",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "default": 30000
+        },
+        "retries": {
+          "name": "retries",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "default": 3
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "last_connected": {
+          "name": "last_connected",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_status": {
+          "name": "connection_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'disconnected'"
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_config": {
+          "name": "status_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'{}'"
+        },
+        "tool_count": {
+          "name": "tool_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "default": 0
+        },
+        "last_tools_refresh": {
+          "name": "last_tools_refresh",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "total_requests": {
+          "name": "total_requests",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "default": 0
+        },
+        "last_used": {
+          "name": "last_used",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "mcp_servers_organization_id_idx": {
+          "name": "mcp_servers_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "mcp_servers_workspace_enabled_idx": {
+          "name": "mcp_servers_workspace_enabled_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "mcp_servers_credential_group_idx": {
+          "name": "mcp_servers_credential_group_idx",
+          "columns": [
+            {
+              "expression": "credential_group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "mcp_servers_credential_group_managed_connector_unique": {
+          "name": "mcp_servers_credential_group_managed_connector_unique",
+          "columns": [
+            {
+              "expression": "credential_group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "managed_connector_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"mcp_servers\".\"credential_group_id\" IS NOT NULL AND \"mcp_servers\".\"managed_connector_id\" IS NOT NULL AND \"mcp_servers\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "mcp_servers_workspace_deleted_partial_idx": {
+          "name": "mcp_servers_workspace_deleted_partial_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"mcp_servers\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "mcp_servers_workspace_id_workspace_id_fk": {
+          "name": "mcp_servers_workspace_id_workspace_id_fk",
+          "tableFrom": "mcp_servers",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "mcp_servers_organization_id_organization_id_fk": {
+          "name": "mcp_servers_organization_id_organization_id_fk",
+          "tableFrom": "mcp_servers",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "mcp_servers_credential_group_id_credential_group_id_fk": {
+          "name": "mcp_servers_credential_group_id_credential_group_id_fk",
+          "tableFrom": "mcp_servers",
+          "tableTo": "credential_group",
+          "columnsFrom": ["credential_group_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "mcp_servers_created_by_user_id_fk": {
+          "name": "mcp_servers_created_by_user_id_fk",
+          "tableFrom": "mcp_servers",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "mcp_servers_owner_check": {
+          "name": "mcp_servers_owner_check",
+          "value": "num_nonnulls(\"mcp_servers\".\"workspace_id\", \"mcp_servers\".\"organization_id\") = 1"
+        },
+        "mcp_servers_organization_managed_check": {
+          "name": "mcp_servers_organization_managed_check",
+          "value": "\"mcp_servers\".\"organization_id\" IS NULL OR \"mcp_servers\".\"credential_group_id\" IS NOT NULL"
+        },
+        "mcp_servers_credential_group_managed_connector_check": {
+          "name": "mcp_servers_credential_group_managed_connector_check",
+          "value": "\"mcp_servers\".\"credential_group_id\" IS NULL OR \"mcp_servers\".\"managed_connector_id\" IS NOT NULL"
+        },
+        "mcp_servers_managed_connector_oauth_check": {
+          "name": "mcp_servers_managed_connector_oauth_check",
+          "value": "\"mcp_servers\".\"managed_connector_id\" IS NULL OR \"mcp_servers\".\"auth_type\" = 'oauth'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.member": {
+      "name": "member",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "member_user_id_unique": {
+          "name": "member_user_id_unique",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "member_organization_id_idx": {
+          "name": "member_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "member_user_id_user_id_fk": {
+          "name": "member_user_id_user_id_fk",
+          "tableFrom": "member",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "member_organization_id_organization_id_fk": {
+          "name": "member_organization_id_organization_id_fk",
+          "tableFrom": "member",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.memory": {
+      "name": "memory",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "data": {
+          "name": "data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_provenance_version": {
+          "name": "secret_provenance_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "memory_key_idx": {
+          "name": "memory_key_idx",
+          "columns": [
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "memory_workspace_idx": {
+          "name": "memory_workspace_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "memory_workspace_key_idx": {
+          "name": "memory_workspace_key_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "memory_workspace_deleted_partial_idx": {
+          "name": "memory_workspace_deleted_partial_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"memory\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "memory_workspace_id_workspace_id_fk": {
+          "name": "memory_workspace_id_workspace_id_fk",
+          "tableFrom": "memory",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.memory_secret_provenance": {
+      "name": "memory_secret_provenance",
+      "schema": "",
+      "columns": {
+        "memory_id": {
+          "name": "memory_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "content_hash": {
+          "name": "content_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entries": {
+          "name": "entries",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "memory_secret_provenance_memory_id_memory_id_fk": {
+          "name": "memory_secret_provenance_memory_id_memory_id_fk",
+          "tableFrom": "memory_secret_provenance",
+          "tableTo": "memory",
+          "columnsFrom": ["memory_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "memory_secret_provenance_status_check": {
+          "name": "memory_secret_provenance_status_check",
+          "value": "\"memory_secret_provenance\".\"status\" IN ('exact', 'unknown')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.mothership_inbox_allowed_sender": {
+      "name": "mothership_inbox_allowed_sender",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by": {
+          "name": "added_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "inbox_sender_ws_email_idx": {
+          "name": "inbox_sender_ws_email_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "email",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "mothership_inbox_allowed_sender_workspace_id_workspace_id_fk": {
+          "name": "mothership_inbox_allowed_sender_workspace_id_workspace_id_fk",
+          "tableFrom": "mothership_inbox_allowed_sender",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "mothership_inbox_allowed_sender_added_by_user_id_fk": {
+          "name": "mothership_inbox_allowed_sender_added_by_user_id_fk",
+          "tableFrom": "mothership_inbox_allowed_sender",
+          "tableTo": "user",
+          "columnsFrom": ["added_by"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.mothership_inbox_task": {
+      "name": "mothership_inbox_task",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_email": {
+          "name": "from_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_name": {
+          "name": "from_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body_preview": {
+          "name": "body_preview",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body_text": {
+          "name": "body_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body_html": {
+          "name": "body_html",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "email_message_id": {
+          "name": "email_message_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "in_reply_to": {
+          "name": "in_reply_to",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "response_message_id": {
+          "name": "response_message_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agentmail_message_id": {
+          "name": "agentmail_message_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'received'"
+        },
+        "chat_id": {
+          "name": "chat_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger_job_id": {
+          "name": "trigger_job_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_summary": {
+          "name": "result_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rejection_reason": {
+          "name": "rejection_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "has_attachments": {
+          "name": "has_attachments",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "cc_recipients": {
+          "name": "cc_recipients",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "processing_started_at": {
+          "name": "processing_started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "inbox_task_ws_created_at_idx": {
+          "name": "inbox_task_ws_created_at_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "inbox_task_ws_status_idx": {
+          "name": "inbox_task_ws_status_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "inbox_task_response_msg_id_idx": {
+          "name": "inbox_task_response_msg_id_idx",
+          "columns": [
+            {
+              "expression": "response_message_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "inbox_task_email_msg_id_idx": {
+          "name": "inbox_task_email_msg_id_idx",
+          "columns": [
+            {
+              "expression": "email_message_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "mothership_inbox_task_workspace_id_workspace_id_fk": {
+          "name": "mothership_inbox_task_workspace_id_workspace_id_fk",
+          "tableFrom": "mothership_inbox_task",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "mothership_inbox_task_chat_id_copilot_chats_id_fk": {
+          "name": "mothership_inbox_task_chat_id_copilot_chats_id_fk",
+          "tableFrom": "mothership_inbox_task",
+          "tableTo": "copilot_chats",
+          "columnsFrom": ["chat_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.mothership_inbox_webhook": {
+      "name": "mothership_inbox_webhook",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "webhook_id": {
+          "name": "webhook_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret": {
+          "name": "secret",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "mothership_inbox_webhook_workspace_id_workspace_id_fk": {
+          "name": "mothership_inbox_webhook_workspace_id_workspace_id_fk",
+          "tableFrom": "mothership_inbox_webhook",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "mothership_inbox_webhook_workspace_id_unique": {
+          "name": "mothership_inbox_webhook_workspace_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["workspace_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.mothership_settings": {
+      "name": "mothership_settings",
+      "schema": "",
+      "columns": {
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "mcp_tool_refs": {
+          "name": "mcp_tool_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "custom_tool_refs": {
+          "name": "custom_tool_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "skill_refs": {
+          "name": "skill_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "mothership_settings_workspace_id_workspace_id_fk": {
+          "name": "mothership_settings_workspace_id_workspace_id_fk",
+          "tableFrom": "mothership_settings",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.oauth_access_token": {
+      "name": "oauth_access_token",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "client_id": {
+          "name": "client_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reference_id": {
+          "name": "reference_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_id": {
+          "name": "refresh_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scopes": {
+          "name": "scopes",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource": {
+          "name": "resource",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "oauth_access_token_client_id_idx": {
+          "name": "oauth_access_token_client_id_idx",
+          "columns": [
+            {
+              "expression": "client_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oauth_access_token_session_id_idx": {
+          "name": "oauth_access_token_session_id_idx",
+          "columns": [
+            {
+              "expression": "session_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oauth_access_token_refresh_id_idx": {
+          "name": "oauth_access_token_refresh_id_idx",
+          "columns": [
+            {
+              "expression": "refresh_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oauth_access_token_user_client_idx": {
+          "name": "oauth_access_token_user_client_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "client_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oauth_access_token_expires_at_idx": {
+          "name": "oauth_access_token_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "oauth_access_token_client_id_oauth_client_client_id_fk": {
+          "name": "oauth_access_token_client_id_oauth_client_client_id_fk",
+          "tableFrom": "oauth_access_token",
+          "tableTo": "oauth_client",
+          "columnsFrom": ["client_id"],
+          "columnsTo": ["client_id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "oauth_access_token_session_id_session_id_fk": {
+          "name": "oauth_access_token_session_id_session_id_fk",
+          "tableFrom": "oauth_access_token",
+          "tableTo": "session",
+          "columnsFrom": ["session_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "oauth_access_token_user_id_user_id_fk": {
+          "name": "oauth_access_token_user_id_user_id_fk",
+          "tableFrom": "oauth_access_token",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "oauth_access_token_refresh_id_oauth_refresh_token_id_fk": {
+          "name": "oauth_access_token_refresh_id_oauth_refresh_token_id_fk",
+          "tableFrom": "oauth_access_token",
+          "tableTo": "oauth_refresh_token",
+          "columnsFrom": ["refresh_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "oauth_access_token_token_unique": {
+          "name": "oauth_access_token_token_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "oauth_access_token_search_resource_check": {
+          "name": "oauth_access_token_search_resource_check",
+          "value": "NOT ('search:read' = ANY(\"oauth_access_token\".\"scopes\")) OR \"oauth_access_token\".\"resource\" IS NOT NULL"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.oauth_client": {
+      "name": "oauth_client",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "client_id": {
+          "name": "client_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "client_secret": {
+          "name": "client_secret",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "disabled": {
+          "name": "disabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "skip_consent": {
+          "name": "skip_consent",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enable_end_session": {
+          "name": "enable_end_session",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "subject_type": {
+          "name": "subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scopes": {
+          "name": "scopes",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "uri": {
+          "name": "uri",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "icon": {
+          "name": "icon",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "contacts": {
+          "name": "contacts",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tos": {
+          "name": "tos",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "policy": {
+          "name": "policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "software_id": {
+          "name": "software_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "software_version": {
+          "name": "software_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "software_statement": {
+          "name": "software_statement",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "redirect_uris": {
+          "name": "redirect_uris",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "post_logout_redirect_uris": {
+          "name": "post_logout_redirect_uris",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_endpoint_auth_method": {
+          "name": "token_endpoint_auth_method",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "grant_types": {
+          "name": "grant_types",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "response_types": {
+          "name": "response_types",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "public": {
+          "name": "public",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "require_pkce": {
+          "name": "require_pkce",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reference_id": {
+          "name": "reference_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "oauth_client_user_id_idx": {
+          "name": "oauth_client_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "oauth_client_user_id_user_id_fk": {
+          "name": "oauth_client_user_id_user_id_fk",
+          "tableFrom": "oauth_client",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "oauth_client_client_id_unique": {
+          "name": "oauth_client_client_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["client_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.oauth_consent": {
+      "name": "oauth_consent",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "client_id": {
+          "name": "client_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reference_id": {
+          "name": "reference_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scopes": {
+          "name": "scopes",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "oauth_consent_client_id_idx": {
+          "name": "oauth_consent_client_id_idx",
+          "columns": [
+            {
+              "expression": "client_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "oauth_consent_client_id_oauth_client_client_id_fk": {
+          "name": "oauth_consent_client_id_oauth_client_client_id_fk",
+          "tableFrom": "oauth_consent",
+          "tableTo": "oauth_client",
+          "columnsFrom": ["client_id"],
+          "columnsTo": ["client_id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "oauth_consent_user_id_user_id_fk": {
+          "name": "oauth_consent_user_id_user_id_fk",
+          "tableFrom": "oauth_consent",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "oauth_consent_user_client_reference_unique": {
+          "name": "oauth_consent_user_client_reference_unique",
+          "nullsNotDistinct": true,
+          "columns": ["user_id", "client_id", "reference_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.oauth_refresh_token": {
+      "name": "oauth_refresh_token",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "client_id": {
+          "name": "client_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reference_id": {
+          "name": "reference_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revoked": {
+          "name": "revoked",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "auth_time": {
+          "name": "auth_time",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scopes": {
+          "name": "scopes",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource": {
+          "name": "resource",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "family_id": {
+          "name": "family_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation": {
+          "name": "generation",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "oauth_refresh_token_client_id_idx": {
+          "name": "oauth_refresh_token_client_id_idx",
+          "columns": [
+            {
+              "expression": "client_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oauth_refresh_token_session_id_idx": {
+          "name": "oauth_refresh_token_session_id_idx",
+          "columns": [
+            {
+              "expression": "session_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oauth_refresh_token_user_client_idx": {
+          "name": "oauth_refresh_token_user_client_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "client_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oauth_refresh_token_expires_at_idx": {
+          "name": "oauth_refresh_token_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "oauth_refresh_token_client_id_oauth_client_client_id_fk": {
+          "name": "oauth_refresh_token_client_id_oauth_client_client_id_fk",
+          "tableFrom": "oauth_refresh_token",
+          "tableTo": "oauth_client",
+          "columnsFrom": ["client_id"],
+          "columnsTo": ["client_id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "oauth_refresh_token_session_id_session_id_fk": {
+          "name": "oauth_refresh_token_session_id_session_id_fk",
+          "tableFrom": "oauth_refresh_token",
+          "tableTo": "session",
+          "columnsFrom": ["session_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "oauth_refresh_token_user_id_user_id_fk": {
+          "name": "oauth_refresh_token_user_id_user_id_fk",
+          "tableFrom": "oauth_refresh_token",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "oauth_refresh_token_family_id_oauth_token_family_id_fk": {
+          "name": "oauth_refresh_token_family_id_oauth_token_family_id_fk",
+          "tableFrom": "oauth_refresh_token",
+          "tableTo": "oauth_token_family",
+          "columnsFrom": ["family_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "oauth_refresh_token_token_unique": {
+          "name": "oauth_refresh_token_token_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token"]
+        },
+        "oauth_refresh_token_family_generation_unique": {
+          "name": "oauth_refresh_token_family_generation_unique",
+          "nullsNotDistinct": false,
+          "columns": ["family_id", "generation"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "oauth_refresh_token_generation_check": {
+          "name": "oauth_refresh_token_generation_check",
+          "value": "\"oauth_refresh_token\".\"generation\" BETWEEN 0 AND 1000"
+        },
+        "oauth_refresh_token_search_resource_check": {
+          "name": "oauth_refresh_token_search_resource_check",
+          "value": "NOT ('search:read' = ANY(\"oauth_refresh_token\".\"scopes\")) OR \"oauth_refresh_token\".\"resource\" IS NOT NULL"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.oauth_token_family": {
+      "name": "oauth_token_family",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "client_id": {
+          "name": "client_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reference_id": {
+          "name": "reference_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consent_id": {
+          "name": "consent_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "current_generation": {
+          "name": "current_generation",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "oauth_token_family_client_id_idx": {
+          "name": "oauth_token_family_client_id_idx",
+          "columns": [
+            {
+              "expression": "client_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oauth_token_family_session_id_idx": {
+          "name": "oauth_token_family_session_id_idx",
+          "columns": [
+            {
+              "expression": "session_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oauth_token_family_user_client_idx": {
+          "name": "oauth_token_family_user_client_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "client_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oauth_token_family_consent_id_idx": {
+          "name": "oauth_token_family_consent_id_idx",
+          "columns": [
+            {
+              "expression": "consent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oauth_token_family_expires_at_idx": {
+          "name": "oauth_token_family_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "oauth_token_family_client_id_oauth_client_client_id_fk": {
+          "name": "oauth_token_family_client_id_oauth_client_client_id_fk",
+          "tableFrom": "oauth_token_family",
+          "tableTo": "oauth_client",
+          "columnsFrom": ["client_id"],
+          "columnsTo": ["client_id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "oauth_token_family_session_id_session_id_fk": {
+          "name": "oauth_token_family_session_id_session_id_fk",
+          "tableFrom": "oauth_token_family",
+          "tableTo": "session",
+          "columnsFrom": ["session_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "oauth_token_family_user_id_user_id_fk": {
+          "name": "oauth_token_family_user_id_user_id_fk",
+          "tableFrom": "oauth_token_family",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "oauth_token_family_consent_id_oauth_consent_id_fk": {
+          "name": "oauth_token_family_consent_id_oauth_consent_id_fk",
+          "tableFrom": "oauth_token_family",
+          "tableTo": "oauth_consent",
+          "columnsFrom": ["consent_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "oauth_token_family_generation_check": {
+          "name": "oauth_token_family_generation_check",
+          "value": "\"oauth_token_family\".\"current_generation\" BETWEEN 0 AND 1000"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.organization": {
+      "name": "organization",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "logo": {
+          "name": "logo",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_policy_settings": {
+          "name": "session_policy_settings",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "security_policy_version": {
+          "name": "security_policy_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "whitelabel_settings": {
+          "name": "whitelabel_settings",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "data_retention_settings": {
+          "name": "data_retention_settings",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "org_usage_limit": {
+          "name": "org_usage_limit",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "storage_used_bytes": {
+          "name": "storage_used_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "limit_notifications": {
+          "name": "limit_notifications",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "departed_member_usage": {
+          "name": "departed_member_usage",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "credit_balance": {
+          "name": "credit_balance",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.organization_byok_keys": {
+      "name": "organization_byok_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "encrypted_api_key": {
+          "name": "encrypted_api_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "organization_byok_organization_provider_idx": {
+          "name": "organization_byok_organization_provider_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "organization_byok_keys_organization_id_organization_id_fk": {
+          "name": "organization_byok_keys_organization_id_organization_id_fk",
+          "tableFrom": "organization_byok_keys",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "organization_byok_keys_created_by_user_id_fk": {
+          "name": "organization_byok_keys_created_by_user_id_fk",
+          "tableFrom": "organization_byok_keys",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.organization_member_usage_limit": {
+      "name": "organization_member_usage_limit",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "usage_limit": {
+          "name": "usage_limit",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "set_by": {
+          "name": "set_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "org_member_usage_limit_org_user_unique": {
+          "name": "org_member_usage_limit_org_user_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "org_member_usage_limit_organization_id_idx": {
+          "name": "org_member_usage_limit_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "organization_member_usage_limit_organization_id_organization_id_fk": {
+          "name": "organization_member_usage_limit_organization_id_organization_id_fk",
+          "tableFrom": "organization_member_usage_limit",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "organization_member_usage_limit_user_id_user_id_fk": {
+          "name": "organization_member_usage_limit_user_id_user_id_fk",
+          "tableFrom": "organization_member_usage_limit",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "organization_member_usage_limit_set_by_user_id_fk": {
+          "name": "organization_member_usage_limit_set_by_user_id_fk",
+          "tableFrom": "organization_member_usage_limit",
+          "tableTo": "user",
+          "columnsFrom": ["set_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.organization_search_integration": {
+      "name": "organization_search_integration",
+      "schema": "",
+      "columns": {
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connector_type": {
+          "name": "connector_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "approved": {
+          "name": "approved",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "organization_search_integration_organization_id_organization_id_fk": {
+          "name": "organization_search_integration_organization_id_organization_id_fk",
+          "tableFrom": "organization_search_integration",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "organization_search_integration_organization_id_connector_type_pk": {
+          "name": "organization_search_integration_organization_id_connector_type_pk",
+          "columns": ["organization_id", "connector_type"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.organization_search_invocation": {
+      "name": "organization_search_invocation",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "surface": {
+          "name": "surface",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_types": {
+          "name": "source_types",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "result_count": {
+          "name": "result_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "organization_search_invocation_org_created_idx": {
+          "name": "organization_search_invocation_org_created_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "organization_search_invocation_user_idx": {
+          "name": "organization_search_invocation_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "organization_search_invocation_organization_id_organization_id_fk": {
+          "name": "organization_search_invocation_organization_id_organization_id_fk",
+          "tableFrom": "organization_search_invocation",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "organization_search_invocation_user_id_user_id_fk": {
+          "name": "organization_search_invocation_user_id_user_id_fk",
+          "tableFrom": "organization_search_invocation",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "organization_search_invocation_result_count_bounds": {
+          "name": "organization_search_invocation_result_count_bounds",
+          "value": "\"organization_search_invocation\".\"result_count\" BETWEEN 0 AND 100"
+        },
+        "organization_search_invocation_source_types_bounds": {
+          "name": "organization_search_invocation_source_types_bounds",
+          "value": "cardinality(\"organization_search_invocation\".\"source_types\") <= 100"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.outbox_event": {
+      "name": "outbox_event",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "payload": {
+          "name": "payload",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "attempts": {
+          "name": "attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "max_attempts": {
+          "name": "max_attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 10
+        },
+        "available_at": {
+          "name": "available_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "locked_at": {
+          "name": "locked_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "processed_at": {
+          "name": "processed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "outbox_event_status_available_idx": {
+          "name": "outbox_event_status_available_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "available_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "outbox_event_pending_type_available_idx": {
+          "name": "outbox_event_pending_type_available_idx",
+          "columns": [
+            {
+              "expression": "event_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "available_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"outbox_event\".\"status\" = 'pending'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "outbox_event_locked_at_idx": {
+          "name": "outbox_event_locked_at_idx",
+          "columns": [
+            {
+              "expression": "locked_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "outbox_event_type_created_idx": {
+          "name": "outbox_event_type_created_idx",
+          "columns": [
+            {
+              "expression": "event_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.paused_executions": {
+      "name": "paused_executions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_id": {
+          "name": "execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_snapshot": {
+          "name": "execution_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pause_points": {
+          "name": "pause_points",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "total_pause_count": {
+          "name": "total_pause_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resumed_count": {
+          "name": "resumed_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "automatic_resume_retry_count": {
+          "name": "automatic_resume_retry_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paused'"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "paused_at": {
+          "name": "paused_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_resume_at": {
+          "name": "next_resume_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "paused_executions_workflow_id_idx": {
+          "name": "paused_executions_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "paused_executions_status_idx": {
+          "name": "paused_executions_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "paused_executions_execution_id_unique": {
+          "name": "paused_executions_execution_id_unique",
+          "columns": [
+            {
+              "expression": "execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "paused_executions_next_resume_at_idx": {
+          "name": "paused_executions_next_resume_at_idx",
+          "columns": [
+            {
+              "expression": "next_resume_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "status = 'paused' AND next_resume_at IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "paused_executions_workflow_id_workflow_id_fk": {
+          "name": "paused_executions_workflow_id_workflow_id_fk",
+          "tableFrom": "paused_executions",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pending_credential_draft": {
+      "name": "pending_credential_draft",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_id": {
+          "name": "credential_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "oauth_config": {
+          "name": "oauth_config",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pending_draft_organization_id_idx": {
+          "name": "pending_draft_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pending_draft_user_provider_org": {
+          "name": "pending_draft_user_provider_org",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pending_draft_user_provider_ws": {
+          "name": "pending_draft_user_provider_ws",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pending_credential_draft_user_id_user_id_fk": {
+          "name": "pending_credential_draft_user_id_user_id_fk",
+          "tableFrom": "pending_credential_draft",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pending_credential_draft_workspace_id_workspace_id_fk": {
+          "name": "pending_credential_draft_workspace_id_workspace_id_fk",
+          "tableFrom": "pending_credential_draft",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pending_credential_draft_organization_id_organization_id_fk": {
+          "name": "pending_credential_draft_organization_id_organization_id_fk",
+          "tableFrom": "pending_credential_draft",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pending_credential_draft_credential_id_credential_id_fk": {
+          "name": "pending_credential_draft_credential_id_credential_id_fk",
+          "tableFrom": "pending_credential_draft",
+          "tableTo": "credential",
+          "columnsFrom": ["credential_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pending_draft_owner_check": {
+          "name": "pending_draft_owner_check",
+          "value": "num_nonnulls(\"pending_credential_draft\".\"workspace_id\", \"pending_credential_draft\".\"organization_id\") = 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.permission_group": {
+      "name": "permission_group",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "membership_mode": {
+          "name": "membership_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'inherit'"
+        }
+      },
+      "indexes": {
+        "permission_group_created_by_idx": {
+          "name": "permission_group_created_by_idx",
+          "columns": [
+            {
+              "expression": "created_by",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "permission_group_organization_name_unique": {
+          "name": "permission_group_organization_name_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "permission_group_organization_default_unique": {
+          "name": "permission_group_organization_default_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "is_default = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "permission_group_organization_id_organization_id_fk": {
+          "name": "permission_group_organization_id_organization_id_fk",
+          "tableFrom": "permission_group",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "permission_group_created_by_user_id_fk": {
+          "name": "permission_group_created_by_user_id_fk",
+          "tableFrom": "permission_group",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.permission_group_member": {
+      "name": "permission_group_member",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "permission_group_id": {
+          "name": "permission_group_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "assigned_by": {
+          "name": "assigned_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assigned_at": {
+          "name": "assigned_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "permission_group_member_group_id_idx": {
+          "name": "permission_group_member_group_id_idx",
+          "columns": [
+            {
+              "expression": "permission_group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "permission_group_member_group_user_unique": {
+          "name": "permission_group_member_group_user_unique",
+          "columns": [
+            {
+              "expression": "permission_group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "permission_group_member_organization_user_idx": {
+          "name": "permission_group_member_organization_user_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "permission_group_member_permission_group_id_permission_group_id_fk": {
+          "name": "permission_group_member_permission_group_id_permission_group_id_fk",
+          "tableFrom": "permission_group_member",
+          "tableTo": "permission_group",
+          "columnsFrom": ["permission_group_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "permission_group_member_organization_id_organization_id_fk": {
+          "name": "permission_group_member_organization_id_organization_id_fk",
+          "tableFrom": "permission_group_member",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "permission_group_member_user_id_user_id_fk": {
+          "name": "permission_group_member_user_id_user_id_fk",
+          "tableFrom": "permission_group_member",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "permission_group_member_assigned_by_user_id_fk": {
+          "name": "permission_group_member_assigned_by_user_id_fk",
+          "tableFrom": "permission_group_member",
+          "tableTo": "user",
+          "columnsFrom": ["assigned_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.permission_group_workspace": {
+      "name": "permission_group_workspace",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "permission_group_id": {
+          "name": "permission_group_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "permission_group_workspace_workspace_id_idx": {
+          "name": "permission_group_workspace_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "permission_group_workspace_group_workspace_unique": {
+          "name": "permission_group_workspace_group_workspace_unique",
+          "columns": [
+            {
+              "expression": "permission_group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "permission_group_workspace_permission_group_id_permission_group_id_fk": {
+          "name": "permission_group_workspace_permission_group_id_permission_group_id_fk",
+          "tableFrom": "permission_group_workspace",
+          "tableTo": "permission_group",
+          "columnsFrom": ["permission_group_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "permission_group_workspace_workspace_id_workspace_id_fk": {
+          "name": "permission_group_workspace_workspace_id_workspace_id_fk",
+          "tableFrom": "permission_group_workspace",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "permission_group_workspace_organization_id_organization_id_fk": {
+          "name": "permission_group_workspace_organization_id_organization_id_fk",
+          "tableFrom": "permission_group_workspace",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.permissions": {
+      "name": "permissions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_type": {
+          "name": "entity_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_id": {
+          "name": "entity_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "permission_type": {
+          "name": "permission_type",
+          "type": "permission_type",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "permissions_user_id_idx": {
+          "name": "permissions_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "permissions_entity_idx": {
+          "name": "permissions_entity_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "permissions_user_entity_type_idx": {
+          "name": "permissions_user_entity_type_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "permissions_user_entity_permission_idx": {
+          "name": "permissions_user_entity_permission_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "permission_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "permissions_unique_constraint": {
+          "name": "permissions_unique_constraint",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "permissions_user_id_user_id_fk": {
+          "name": "permissions_user_id_user_id_fk",
+          "tableFrom": "permissions",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pinned_item": {
+      "name": "pinned_item",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_type": {
+          "name": "resource_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_id": {
+          "name": "resource_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pinned_at": {
+          "name": "pinned_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pinned_item_user_workspace_idx": {
+          "name": "pinned_item_user_workspace_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pinned_item_resource_idx": {
+          "name": "pinned_item_resource_idx",
+          "columns": [
+            {
+              "expression": "resource_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pinned_item_user_resource_unique": {
+          "name": "pinned_item_user_resource_unique",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pinned_item_user_id_user_id_fk": {
+          "name": "pinned_item_user_id_user_id_fk",
+          "tableFrom": "pinned_item",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pinned_item_workspace_id_workspace_id_fk": {
+          "name": "pinned_item_workspace_id_workspace_id_fk",
+          "tableFrom": "pinned_item",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.public_share": {
+      "name": "public_share",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "resource_type": {
+          "name": "resource_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_id": {
+          "name": "resource_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "auth_type": {
+          "name": "auth_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'public'"
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "allowed_emails": {
+          "name": "allowed_emails",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'[]'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "public_share_token_unique": {
+          "name": "public_share_token_unique",
+          "columns": [
+            {
+              "expression": "token",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "public_share_resource_unique": {
+          "name": "public_share_resource_unique",
+          "columns": [
+            {
+              "expression": "resource_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "public_share_resource_id_idx": {
+          "name": "public_share_resource_id_idx",
+          "columns": [
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "public_share_workspace_id_idx": {
+          "name": "public_share_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "public_share_workspace_id_workspace_id_fk": {
+          "name": "public_share_workspace_id_workspace_id_fk",
+          "tableFrom": "public_share",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "public_share_created_by_user_id_fk": {
+          "name": "public_share_created_by_user_id_fk",
+          "tableFrom": "public_share",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.rate_limit_bucket": {
+      "name": "rate_limit_bucket",
+      "schema": "",
+      "columns": {
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "tokens": {
+          "name": "tokens",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_refill_at": {
+          "name": "last_refill_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "blocked_until": {
+          "name": "blocked_until",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "capacity_state": {
+          "name": "capacity_state",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.resource_policy": {
+      "name": "resource_policy",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resource_type": {
+          "name": "resource_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_id": {
+          "name": "resource_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision": {
+          "name": "revision",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "document": {
+          "name": "document",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by": {
+          "name": "updated_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "resource_policy_organization_id_idx": {
+          "name": "resource_policy_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "resource_policy_resource_unique": {
+          "name": "resource_policy_resource_unique",
+          "columns": [
+            {
+              "expression": "resource_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "resource_policy_workspace_id_idx": {
+          "name": "resource_policy_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "resource_policy_workspace_id_workspace_id_fk": {
+          "name": "resource_policy_workspace_id_workspace_id_fk",
+          "tableFrom": "resource_policy",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "resource_policy_organization_id_organization_id_fk": {
+          "name": "resource_policy_organization_id_organization_id_fk",
+          "tableFrom": "resource_policy",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "resource_policy_created_by_user_id_fk": {
+          "name": "resource_policy_created_by_user_id_fk",
+          "tableFrom": "resource_policy",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "resource_policy_updated_by_user_id_fk": {
+          "name": "resource_policy_updated_by_user_id_fk",
+          "tableFrom": "resource_policy",
+          "tableTo": "user",
+          "columnsFrom": ["updated_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "resource_policy_owner_check": {
+          "name": "resource_policy_owner_check",
+          "value": "num_nonnulls(\"resource_policy\".\"workspace_id\", \"resource_policy\".\"organization_id\") = 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.resume_queue": {
+      "name": "resume_queue",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "paused_execution_id": {
+          "name": "paused_execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_execution_id": {
+          "name": "parent_execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "new_execution_id": {
+          "name": "new_execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "context_id": {
+          "name": "context_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resume_input": {
+          "name": "resume_input",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "queued_at": {
+          "name": "queued_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "resume_queue_parent_status_idx": {
+          "name": "resume_queue_parent_status_idx",
+          "columns": [
+            {
+              "expression": "parent_execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "queued_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "resume_queue_new_execution_idx": {
+          "name": "resume_queue_new_execution_idx",
+          "columns": [
+            {
+              "expression": "new_execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "resume_queue_paused_execution_id_paused_executions_id_fk": {
+          "name": "resume_queue_paused_execution_id_paused_executions_id_fk",
+          "tableFrom": "resume_queue",
+          "tableTo": "paused_executions",
+          "columnsFrom": ["paused_execution_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.sandbox_image": {
+      "name": "sandbox_image",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "spec_hash": {
+          "name": "spec_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "spec": {
+          "name": "spec",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "sandbox_image_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "image_ref": {
+          "name": "image_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_image_id": {
+          "name": "provider_image_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "build_id": {
+          "name": "build_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "materialization_generation": {
+          "name": "materialization_generation",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_detail": {
+          "name": "error_detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "sandbox_image_provider_spec_unique": {
+          "name": "sandbox_image_provider_spec_unique",
+          "columns": [
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "spec_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "sandbox_image_status_idx": {
+          "name": "sandbox_image_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "sandbox_image_last_used_idx": {
+          "name": "sandbox_image_last_used_idx",
+          "columns": [
+            {
+              "expression": "last_used_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.scim_connection": {
+      "name": "scim_connection",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "settings": {
+          "name": "settings",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_request_at": {
+          "name": "last_request_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reconcile_lock_token": {
+          "name": "reconcile_lock_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reconcile_lease_at": {
+          "name": "reconcile_lease_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reconciled_at": {
+          "name": "reconciled_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "scim_connection_organization_unique": {
+          "name": "scim_connection_organization_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "scim_connection_reconcile_due_idx": {
+          "name": "scim_connection_reconcile_due_idx",
+          "columns": [
+            {
+              "expression": "reconciled_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "scim_connection_organization_id_organization_id_fk": {
+          "name": "scim_connection_organization_id_organization_id_fk",
+          "tableFrom": "scim_connection",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "scim_connection_created_by_user_id_fk": {
+          "name": "scim_connection_created_by_user_id_fk",
+          "tableFrom": "scim_connection",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.scim_credential": {
+      "name": "scim_credential",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_prefix": {
+          "name": "token_prefix",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scopes": {
+          "name": "scopes",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_by": {
+          "name": "revoked_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "scim_credential_token_hash_unique": {
+          "name": "scim_credential_token_hash_unique",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "scim_credential_connection_idx": {
+          "name": "scim_credential_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "scim_credential_connection_id_scim_connection_id_fk": {
+          "name": "scim_credential_connection_id_scim_connection_id_fk",
+          "tableFrom": "scim_credential",
+          "tableTo": "scim_connection",
+          "columnsFrom": ["connection_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "scim_credential_revoked_by_user_id_fk": {
+          "name": "scim_credential_revoked_by_user_id_fk",
+          "tableFrom": "scim_credential",
+          "tableTo": "user",
+          "columnsFrom": ["revoked_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "scim_credential_created_by_user_id_fk": {
+          "name": "scim_credential_created_by_user_id_fk",
+          "tableFrom": "scim_credential",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.scim_group": {
+      "name": "scim_group",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name_key": {
+          "name": "display_name_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "order_key": {
+          "name": "order_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "scim_group_connection_display_name_unique": {
+          "name": "scim_group_connection_display_name_unique",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "display_name_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "scim_group_connection_external_id_unique": {
+          "name": "scim_group_connection_external_id_unique",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "external_id is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "scim_group_connection_order_idx": {
+          "name": "scim_group_connection_order_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "order_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "scim_group_connection_id_scim_connection_id_fk": {
+          "name": "scim_group_connection_id_scim_connection_id_fk",
+          "tableFrom": "scim_group",
+          "tableTo": "scim_connection",
+          "columnsFrom": ["connection_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.scim_group_mapping": {
+      "name": "scim_group_mapping",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "group_id": {
+          "name": "group_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_kind": {
+          "name": "target_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "permission_group_id": {
+          "name": "permission_group_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "permission_type": {
+          "name": "permission_type",
+          "type": "permission_type",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'manual'"
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "scim_group_mapping_group_idx": {
+          "name": "scim_group_mapping_group_idx",
+          "columns": [
+            {
+              "expression": "group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "scim_group_mapping_permission_group_idx": {
+          "name": "scim_group_mapping_permission_group_idx",
+          "columns": [
+            {
+              "expression": "permission_group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "scim_group_mapping_workspace_idx": {
+          "name": "scim_group_mapping_workspace_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "scim_group_mapping_group_target_unique": {
+          "name": "scim_group_mapping_group_target_unique",
+          "columns": [
+            {
+              "expression": "group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "coalesce(\"permission_group_id\", \"workspace_id\", \"role\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "scim_group_mapping_group_id_scim_group_id_fk": {
+          "name": "scim_group_mapping_group_id_scim_group_id_fk",
+          "tableFrom": "scim_group_mapping",
+          "tableTo": "scim_group",
+          "columnsFrom": ["group_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "scim_group_mapping_permission_group_id_permission_group_id_fk": {
+          "name": "scim_group_mapping_permission_group_id_permission_group_id_fk",
+          "tableFrom": "scim_group_mapping",
+          "tableTo": "permission_group",
+          "columnsFrom": ["permission_group_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "scim_group_mapping_workspace_id_workspace_id_fk": {
+          "name": "scim_group_mapping_workspace_id_workspace_id_fk",
+          "tableFrom": "scim_group_mapping",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "scim_group_mapping_created_by_user_id_fk": {
+          "name": "scim_group_mapping_created_by_user_id_fk",
+          "tableFrom": "scim_group_mapping",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "scim_group_mapping_target_shape": {
+          "name": "scim_group_mapping_target_shape",
+          "value": "(\n        (\"scim_group_mapping\".\"target_kind\" = 'permission_group' AND \"scim_group_mapping\".\"permission_group_id\" IS NOT NULL AND \"scim_group_mapping\".\"workspace_id\" IS NULL AND \"scim_group_mapping\".\"permission_type\" IS NULL AND \"scim_group_mapping\".\"role\" IS NULL)\n        OR (\"scim_group_mapping\".\"target_kind\" = 'workspace' AND \"scim_group_mapping\".\"workspace_id\" IS NOT NULL AND \"scim_group_mapping\".\"permission_type\" IS NOT NULL AND \"scim_group_mapping\".\"permission_group_id\" IS NULL AND \"scim_group_mapping\".\"role\" IS NULL)\n        OR (\"scim_group_mapping\".\"target_kind\" = 'org_role' AND \"scim_group_mapping\".\"role\" IS NOT NULL AND \"scim_group_mapping\".\"permission_group_id\" IS NULL AND \"scim_group_mapping\".\"workspace_id\" IS NULL AND \"scim_group_mapping\".\"permission_type\" IS NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.scim_group_member": {
+      "name": "scim_group_member",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "group_id": {
+          "name": "group_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scim_user_id": {
+          "name": "scim_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "scim_group_member_group_user_unique": {
+          "name": "scim_group_member_group_user_unique",
+          "columns": [
+            {
+              "expression": "group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scim_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "scim_group_member_scim_user_idx": {
+          "name": "scim_group_member_scim_user_idx",
+          "columns": [
+            {
+              "expression": "scim_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "scim_group_member_group_id_scim_group_id_fk": {
+          "name": "scim_group_member_group_id_scim_group_id_fk",
+          "tableFrom": "scim_group_member",
+          "tableTo": "scim_group",
+          "columnsFrom": ["group_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "scim_group_member_scim_user_id_scim_user_id_fk": {
+          "name": "scim_group_member_scim_user_id_scim_user_id_fk",
+          "tableFrom": "scim_group_member",
+          "tableTo": "scim_user",
+          "columnsFrom": ["scim_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.scim_projection_grant": {
+      "name": "scim_projection_grant",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scim_user_id": {
+          "name": "scim_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_kind": {
+          "name": "target_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "permission_type": {
+          "name": "permission_type",
+          "type": "permission_type",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "baseline_permission": {
+          "name": "baseline_permission",
+          "type": "permission_type",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin": {
+          "name": "origin",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'directory'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "scim_projection_grant_user_target_unique": {
+          "name": "scim_projection_grant_user_target_unique",
+          "columns": [
+            {
+              "expression": "scim_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "scim_projection_grant_connection_idx": {
+          "name": "scim_projection_grant_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "scim_projection_grant_connection_id_scim_connection_id_fk": {
+          "name": "scim_projection_grant_connection_id_scim_connection_id_fk",
+          "tableFrom": "scim_projection_grant",
+          "tableTo": "scim_connection",
+          "columnsFrom": ["connection_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "scim_projection_grant_scim_user_id_scim_user_id_fk": {
+          "name": "scim_projection_grant_scim_user_id_scim_user_id_fk",
+          "tableFrom": "scim_projection_grant",
+          "tableTo": "scim_user",
+          "columnsFrom": ["scim_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.scim_request_log": {
+      "name": "scim_request_log",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "credential_id": {
+          "name": "credential_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "method": {
+          "name": "method",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scim_type": {
+          "name": "scim_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "detail": {
+          "name": "detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "scim_request_log_connection_created_idx": {
+          "name": "scim_request_log_connection_created_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "scim_request_log_connection_id_scim_connection_id_fk": {
+          "name": "scim_request_log_connection_id_scim_connection_id_fk",
+          "tableFrom": "scim_request_log",
+          "tableTo": "scim_connection",
+          "columnsFrom": ["connection_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.scim_user": {
+      "name": "scim_user",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_name": {
+          "name": "user_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "active": {
+          "name": "active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "attributes": {
+          "name": "attributes",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "order_key": {
+          "name": "order_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "scim_user_connection_user_unique": {
+          "name": "scim_user_connection_user_unique",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "scim_user_connection_user_name_unique": {
+          "name": "scim_user_connection_user_name_unique",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "scim_user_connection_external_id_unique": {
+          "name": "scim_user_connection_external_id_unique",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "external_id is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "scim_user_connection_order_idx": {
+          "name": "scim_user_connection_order_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "order_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "scim_user_user_idx": {
+          "name": "scim_user_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "scim_user_connection_id_scim_connection_id_fk": {
+          "name": "scim_user_connection_id_scim_connection_id_fk",
+          "tableFrom": "scim_user",
+          "tableTo": "scim_connection",
+          "columnsFrom": ["connection_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "scim_user_user_id_user_id_fk": {
+          "name": "scim_user_user_id_user_id_fk",
+          "tableFrom": "scim_user",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.scim_user_tombstone": {
+      "name": "scim_user_tombstone",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "scim_user_tombstone_connection_external_id_unique": {
+          "name": "scim_user_tombstone_connection_external_id_unique",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "scim_user_tombstone_user_idx": {
+          "name": "scim_user_tombstone_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "scim_user_tombstone_connection_id_scim_connection_id_fk": {
+          "name": "scim_user_tombstone_connection_id_scim_connection_id_fk",
+          "tableFrom": "scim_user_tombstone",
+          "tableTo": "scim_connection",
+          "columnsFrom": ["connection_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "scim_user_tombstone_user_id_user_id_fk": {
+          "name": "scim_user_tombstone_user_id_user_id_fk",
+          "tableFrom": "scim_user_tombstone",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.secret_usage": {
+      "name": "secret_usage",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_name": {
+          "name": "secret_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_scope": {
+          "name": "secret_scope",
+          "type": "secret_usage_scope",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_owner_user_id": {
+          "name": "secret_owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "source": {
+          "name": "source",
+          "type": "secret_usage_source",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "usage_date": {
+          "name": "usage_date",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "use_count": {
+          "name": "use_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_execution_id": {
+          "name": "last_execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_trigger": {
+          "name": "last_trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "secret_usage_bucket_unique": {
+          "name": "secret_usage_bucket_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "secret_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "secret_scope",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "secret_owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "actor_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "usage_date",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_usage_secret_recent_idx": {
+          "name": "secret_usage_secret_recent_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "secret_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "secret_scope",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "secret_owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_used_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "secret_usage_workspace_id_workspace_id_fk": {
+          "name": "secret_usage_workspace_id_workspace_id_fk",
+          "tableFrom": "secret_usage",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.session": {
+      "name": "session",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ip_address": {
+          "name": "ip_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "active_organization_id": {
+          "name": "active_organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "impersonated_by": {
+          "name": "impersonated_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "session_user_id_idx": {
+          "name": "session_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "session_user_id_user_id_fk": {
+          "name": "session_user_id_user_id_fk",
+          "tableFrom": "session",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "session_active_organization_id_organization_id_fk": {
+          "name": "session_active_organization_id_organization_id_fk",
+          "tableFrom": "session",
+          "tableTo": "organization",
+          "columnsFrom": ["active_organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "session_token_unique": {
+          "name": "session_token_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.settings": {
+      "name": "settings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "theme": {
+          "name": "theme",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "auto_connect": {
+          "name": "auto_connect",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "telemetry_enabled": {
+          "name": "telemetry_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "email_preferences": {
+          "name": "email_preferences",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "billing_usage_notifications_enabled": {
+          "name": "billing_usage_notifications_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "show_training_controls": {
+          "name": "show_training_controls",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "super_user_mode_enabled": {
+          "name": "super_user_mode_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "mothership_environment": {
+          "name": "mothership_environment",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "error_notifications_enabled": {
+          "name": "error_notifications_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "snap_to_grid_size": {
+          "name": "snap_to_grid_size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "show_action_bar": {
+          "name": "show_action_bar",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "auto_focus_on_click": {
+          "name": "auto_focus_on_click",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "timezone": {
+          "name": "timezone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "copilot_enabled_models": {
+          "name": "copilot_enabled_models",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "copilot_auto_allowed_tools": {
+          "name": "copilot_auto_allowed_tools",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'"
+        },
+        "last_active_workspace_id": {
+          "name": "last_active_workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "settings_user_id_user_id_fk": {
+          "name": "settings_user_id_user_id_fk",
+          "tableFrom": "settings",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "settings_user_id_unique": {
+          "name": "settings_user_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.sim_trigger_state": {
+      "name": "sim_trigger_state",
+      "schema": "",
+      "columns": {
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "block_id": {
+          "name": "block_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_key": {
+          "name": "scope_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "last_fired_at": {
+          "name": "last_fired_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "sim_trigger_state_workflow_id_workflow_id_fk": {
+          "name": "sim_trigger_state_workflow_id_workflow_id_fk",
+          "tableFrom": "sim_trigger_state",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "sim_trigger_state_workflow_id_block_id_scope_key_pk": {
+          "name": "sim_trigger_state_workflow_id_block_id_scope_key_pk",
+          "columns": ["workflow_id", "block_id", "scope_key"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.skill": {
+      "name": "skill",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "skill_workspace_name_unique": {
+          "name": "skill_workspace_name_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "skill_workspace_id_workspace_id_fk": {
+          "name": "skill_workspace_id_workspace_id_fk",
+          "tableFrom": "skill",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "skill_user_id_user_id_fk": {
+          "name": "skill_user_id_user_id_fk",
+          "tableFrom": "skill",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.skill_member": {
+      "name": "skill_member",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "skill_id": {
+          "name": "skill_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invited_by": {
+          "name": "invited_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "skill_member_user_id_idx": {
+          "name": "skill_member_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "skill_member_unique": {
+          "name": "skill_member_unique",
+          "columns": [
+            {
+              "expression": "skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "skill_member_skill_id_skill_id_fk": {
+          "name": "skill_member_skill_id_skill_id_fk",
+          "tableFrom": "skill_member",
+          "tableTo": "skill",
+          "columnsFrom": ["skill_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "skill_member_user_id_user_id_fk": {
+          "name": "skill_member_user_id_user_id_fk",
+          "tableFrom": "skill_member",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "skill_member_invited_by_user_id_fk": {
+          "name": "skill_member_invited_by_user_id_fk",
+          "tableFrom": "skill_member",
+          "tableTo": "user",
+          "columnsFrom": ["invited_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.slack_app": {
+      "name": "slack_app",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "client_id": {
+          "name": "client_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "encrypted_client_secret": {
+          "name": "encrypted_client_secret",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "encrypted_signing_secret": {
+          "name": "encrypted_signing_secret",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revision": {
+          "name": "revision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "slack_app_organization_id_organization_id_fk": {
+          "name": "slack_app_organization_id_organization_id_fk",
+          "tableFrom": "slack_app",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "slack_app_owner_check": {
+          "name": "slack_app_owner_check",
+          "value": "(\"slack_app\".\"kind\" = 'custom' AND \"slack_app\".\"organization_id\" IS NOT NULL) OR (\"slack_app\".\"kind\" = 'shared' AND \"slack_app\".\"organization_id\" IS NULL)"
+        },
+        "slack_app_custom_credentials_check": {
+          "name": "slack_app_custom_credentials_check",
+          "value": "\"slack_app\".\"kind\" = 'shared' OR (\"slack_app\".\"client_id\" IS NOT NULL AND \"slack_app\".\"encrypted_client_secret\" IS NOT NULL AND \"slack_app\".\"encrypted_signing_secret\" IS NOT NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.slack_search_installation": {
+      "name": "slack_search_installation",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "credential_id": {
+          "name": "credential_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "app_id": {
+          "name": "app_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slack_app_id": {
+          "name": "slack_app_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "team_id": {
+          "name": "team_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "team_name": {
+          "name": "team_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bot_user_id": {
+          "name": "bot_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enterprise_id": {
+          "name": "enterprise_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "credential_version": {
+          "name": "credential_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision": {
+          "name": "revision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_outcome": {
+          "name": "last_outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_event_at": {
+          "name": "last_event_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "slack_search_installation_organization_idx": {
+          "name": "slack_search_installation_organization_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "slack_search_installation_credential_unique": {
+          "name": "slack_search_installation_credential_unique",
+          "columns": [
+            {
+              "expression": "credential_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "slack_search_installation_app_team_unique": {
+          "name": "slack_search_installation_app_team_unique",
+          "columns": [
+            {
+              "expression": "app_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "team_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "slack_search_installation_active_team_unique": {
+          "name": "slack_search_installation_active_team_unique",
+          "columns": [
+            {
+              "expression": "team_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"slack_search_installation\".\"enabled\" = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "slack_search_installation_organization_id_organization_id_fk": {
+          "name": "slack_search_installation_organization_id_organization_id_fk",
+          "tableFrom": "slack_search_installation",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "slack_search_installation_credential_id_credential_id_fk": {
+          "name": "slack_search_installation_credential_id_credential_id_fk",
+          "tableFrom": "slack_search_installation",
+          "tableTo": "credential",
+          "columnsFrom": ["credential_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "slack_search_installation_slack_app_id_slack_app_id_fk": {
+          "name": "slack_search_installation_slack_app_id_slack_app_id_fk",
+          "tableFrom": "slack_search_installation",
+          "tableTo": "slack_app",
+          "columnsFrom": ["slack_app_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.slack_search_turn": {
+      "name": "slack_search_turn",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "ordinal": {
+          "name": "ordinal",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "identity": {
+            "type": "always",
+            "name": "slack_search_turn_ordinal_seq",
+            "schema": "public",
+            "increment": "1",
+            "startWith": "1",
+            "minValue": "1",
+            "maxValue": "2147483647",
+            "cache": "1",
+            "cycle": false
+          }
+        },
+        "installation_id": {
+          "name": "installation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "conversation_key": {
+          "name": "conversation_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_id": {
+          "name": "event_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "lease_id": {
+          "name": "lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_expires_at": {
+          "name": "lease_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "slack_search_turn_event_unique": {
+          "name": "slack_search_turn_event_unique",
+          "columns": [
+            {
+              "expression": "installation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "event_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "slack_search_turn_pending_idx": {
+          "name": "slack_search_turn_pending_idx",
+          "columns": [
+            {
+              "expression": "installation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "slack_search_turn_thread_idx": {
+          "name": "slack_search_turn_thread_idx",
+          "columns": [
+            {
+              "expression": "conversation_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "slack_search_turn_active_thread_unique": {
+          "name": "slack_search_turn_active_thread_unique",
+          "columns": [
+            {
+              "expression": "conversation_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"slack_search_turn\".\"status\" = 'running'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "slack_search_turn_installation_id_slack_search_installation_id_fk": {
+          "name": "slack_search_turn_installation_id_slack_search_installation_id_fk",
+          "tableFrom": "slack_search_turn",
+          "tableTo": "slack_search_installation",
+          "columnsFrom": ["installation_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.sso_domain": {
+      "name": "sso_domain",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "domain": {
+          "name": "domain",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "verification_token": {
+          "name": "verification_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "verified_at": {
+          "name": "verified_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "sso_domain_organization_id_idx": {
+          "name": "sso_domain_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "sso_domain_domain_idx": {
+          "name": "sso_domain_domain_idx",
+          "columns": [
+            {
+              "expression": "domain",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "sso_domain_org_domain_unique": {
+          "name": "sso_domain_org_domain_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "domain",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "sso_domain_verified_unique": {
+          "name": "sso_domain_verified_unique",
+          "columns": [
+            {
+              "expression": "domain",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "status = 'verified'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "sso_domain_organization_id_organization_id_fk": {
+          "name": "sso_domain_organization_id_organization_id_fk",
+          "tableFrom": "sso_domain",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "sso_domain_created_by_user_id_fk": {
+          "name": "sso_domain_created_by_user_id_fk",
+          "tableFrom": "sso_domain",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.sso_provider": {
+      "name": "sso_provider",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "domain": {
+          "name": "domain",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "oidc_config": {
+          "name": "oidc_config",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "saml_config": {
+          "name": "saml_config",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "domain_verified": {
+          "name": "domain_verified",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "jit_provisioning_enabled": {
+          "name": "jit_provisioning_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        }
+      },
+      "indexes": {
+        "sso_provider_provider_id_unique": {
+          "name": "sso_provider_provider_id_unique",
+          "columns": [
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "sso_provider_org_domain_unique": {
+          "name": "sso_provider_org_domain_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(regexp_replace(btrim(\"domain\"), '^\\*\\.', ''))",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"sso_provider\".\"organization_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "sso_provider_domain_idx": {
+          "name": "sso_provider_domain_idx",
+          "columns": [
+            {
+              "expression": "domain",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "sso_provider_user_id_idx": {
+          "name": "sso_provider_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "sso_provider_organization_id_idx": {
+          "name": "sso_provider_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "sso_provider_user_id_user_id_fk": {
+          "name": "sso_provider_user_id_user_id_fk",
+          "tableFrom": "sso_provider",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "sso_provider_organization_id_organization_id_fk": {
+          "name": "sso_provider_organization_id_organization_id_fk",
+          "tableFrom": "sso_provider",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.subscription": {
+      "name": "subscription",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "plan": {
+          "name": "plan",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reference_id": {
+          "name": "reference_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stripe_customer_id": {
+          "name": "stripe_customer_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stripe_subscription_id": {
+          "name": "stripe_subscription_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "period_start": {
+          "name": "period_start",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "period_end": {
+          "name": "period_end",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancel_at_period_end": {
+          "name": "cancel_at_period_end",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancel_at": {
+          "name": "cancel_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canceled_at": {
+          "name": "canceled_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ended_at": {
+          "name": "ended_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "seats": {
+          "name": "seats",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trial_start": {
+          "name": "trial_start",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trial_end": {
+          "name": "trial_end",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_interval": {
+          "name": "billing_interval",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stripe_schedule_id": {
+          "name": "stripe_schedule_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_closed_period_start": {
+          "name": "last_closed_period_start",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "subscription_reference_status_idx": {
+          "name": "subscription_reference_status_idx",
+          "columns": [
+            {
+              "expression": "reference_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "subscription_cycle_close_lagging_idx": {
+          "name": "subscription_cycle_close_lagging_idx",
+          "columns": [
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"subscription\".\"status\" in ('active', 'past_due') and \"subscription\".\"period_start\" is not null and (\"subscription\".\"last_closed_period_start\" is null or \"subscription\".\"last_closed_period_start\" < \"subscription\".\"period_start\")",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "check_enterprise_metadata": {
+          "name": "check_enterprise_metadata",
+          "value": "plan != 'enterprise' OR metadata IS NOT NULL"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.table_jobs": {
+      "name": "table_jobs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "table_id": {
+          "name": "table_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'running'"
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rows_processed": {
+          "name": "rows_processed",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "table_jobs_one_active_per_table": {
+          "name": "table_jobs_one_active_per_table",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"table_jobs\".\"status\" = 'running' AND \"table_jobs\".\"type\" <> 'export'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "table_jobs_watchdog_idx": {
+          "name": "table_jobs_watchdog_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "table_jobs_table_started_idx": {
+          "name": "table_jobs_table_started_idx",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "table_jobs_table_id_user_table_definitions_id_fk": {
+          "name": "table_jobs_table_id_user_table_definitions_id_fk",
+          "tableFrom": "table_jobs",
+          "tableTo": "user_table_definitions",
+          "columnsFrom": ["table_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "table_jobs_workspace_id_workspace_id_fk": {
+          "name": "table_jobs_workspace_id_workspace_id_fk",
+          "tableFrom": "table_jobs",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.table_row_executions": {
+      "name": "table_row_executions",
+      "schema": "",
+      "columns": {
+        "table_id": {
+          "name": "table_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "row_id": {
+          "name": "row_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "group_id": {
+          "name": "group_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_id": {
+          "name": "execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "job_id": {
+          "name": "job_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "running_block_ids": {
+          "name": "running_block_ids",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::text[]"
+        },
+        "block_errors": {
+          "name": "block_errors",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "cancelled_at": {
+          "name": "cancelled_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "capability_governed_user_id": {
+          "name": "capability_governed_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enrichment_details": {
+          "name": "enrichment_details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "table_row_executions_table_status_idx": {
+          "name": "table_row_executions_table_status_idx",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"table_row_executions\".\"status\" IN ('queued', 'running', 'pending')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "table_row_executions_execution_id_idx": {
+          "name": "table_row_executions_execution_id_idx",
+          "columns": [
+            {
+              "expression": "execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"table_row_executions\".\"execution_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "table_row_executions_table_group_idx": {
+          "name": "table_row_executions_table_group_idx",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "table_row_executions_table_id_user_table_definitions_id_fk": {
+          "name": "table_row_executions_table_id_user_table_definitions_id_fk",
+          "tableFrom": "table_row_executions",
+          "tableTo": "user_table_definitions",
+          "columnsFrom": ["table_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "table_row_executions_row_id_user_table_rows_id_fk": {
+          "name": "table_row_executions_row_id_user_table_rows_id_fk",
+          "tableFrom": "table_row_executions",
+          "tableTo": "user_table_rows",
+          "columnsFrom": ["row_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "table_row_executions_capability_governed_user_id_user_id_fk": {
+          "name": "table_row_executions_capability_governed_user_id_user_id_fk",
+          "tableFrom": "table_row_executions",
+          "tableTo": "user",
+          "columnsFrom": ["capability_governed_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "table_row_executions_row_id_group_id_pk": {
+          "name": "table_row_executions_row_id_group_id_pk",
+          "columns": ["row_id", "group_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.table_run_dispatches": {
+      "name": "table_run_dispatches",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "table_id": {
+          "name": "table_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "request_id": {
+          "name": "request_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope": {
+          "name": "scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "cursor": {
+          "name": "cursor",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "limit": {
+          "name": "limit",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "processed_count": {
+          "name": "processed_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "is_manual_run": {
+          "name": "is_manual_run",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "triggered_by_user_id": {
+          "name": "triggered_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "capability_governed_user_id": {
+          "name": "capability_governed_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_at": {
+          "name": "requested_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "heartbeat_at": {
+          "name": "heartbeat_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancelled_at": {
+          "name": "cancelled_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "table_run_dispatches_active_idx": {
+          "name": "table_run_dispatches_active_idx",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "table_run_dispatches_watchdog_idx": {
+          "name": "table_run_dispatches_watchdog_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "requested_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "table_run_dispatches_governed_active_idx": {
+          "name": "table_run_dispatches_governed_active_idx",
+          "columns": [
+            {
+              "expression": "capability_governed_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"table_run_dispatches\".\"status\" IN ('pending', 'dispatching')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "table_run_dispatches_table_id_user_table_definitions_id_fk": {
+          "name": "table_run_dispatches_table_id_user_table_definitions_id_fk",
+          "tableFrom": "table_run_dispatches",
+          "tableTo": "user_table_definitions",
+          "columnsFrom": ["table_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "table_run_dispatches_workspace_id_workspace_id_fk": {
+          "name": "table_run_dispatches_workspace_id_workspace_id_fk",
+          "tableFrom": "table_run_dispatches",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "table_run_dispatches_triggered_by_user_id_user_id_fk": {
+          "name": "table_run_dispatches_triggered_by_user_id_user_id_fk",
+          "tableFrom": "table_run_dispatches",
+          "tableTo": "user",
+          "columnsFrom": ["triggered_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "table_run_dispatches_capability_governed_user_id_user_id_fk": {
+          "name": "table_run_dispatches_capability_governed_user_id_user_id_fk",
+          "tableFrom": "table_run_dispatches",
+          "tableTo": "user",
+          "columnsFrom": ["capability_governed_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.table_views": {
+      "name": "table_views",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "table_id": {
+          "name": "table_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "table_views_table_created_idx": {
+          "name": "table_views_table_created_idx",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "table_views_workspace_created_idx": {
+          "name": "table_views_workspace_created_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "table_views_table_default_unique": {
+          "name": "table_views_table_default_unique",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "is_default = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "table_views_table_id_user_table_definitions_id_fk": {
+          "name": "table_views_table_id_user_table_definitions_id_fk",
+          "tableFrom": "table_views",
+          "tableTo": "user_table_definitions",
+          "columnsFrom": ["table_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "table_views_workspace_id_workspace_id_fk": {
+          "name": "table_views_workspace_id_workspace_id_fk",
+          "tableFrom": "table_views",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "table_views_created_by_user_id_fk": {
+          "name": "table_views_created_by_user_id_fk",
+          "tableFrom": "table_views",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.upload_session": {
+      "name": "upload_session",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "knowledge_base_id": {
+          "name": "knowledge_base_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_id": {
+          "name": "execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "purpose": {
+          "name": "purpose",
+          "type": "upload_session_purpose",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "method": {
+          "name": "method",
+          "type": "upload_session_method",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "storage_context": {
+          "name": "storage_context",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "final_key": {
+          "name": "final_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "storage_provider": {
+          "name": "storage_provider",
+          "type": "upload_session_provider",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_upload_id": {
+          "name": "provider_upload_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_object_version": {
+          "name": "provider_object_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "file_name": {
+          "name": "file_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content_type": {
+          "name": "content_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "file_size": {
+          "name": "file_size",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "part_size": {
+          "name": "part_size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "part_count": {
+          "name": "part_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "upload_session_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'uploading'"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "processing_lease_id": {
+          "name": "processing_lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "processing_lease_expires_at": {
+          "name": "processing_lease_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_file_id": {
+          "name": "completed_file_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "upload_session_token_hash_unique": {
+          "name": "upload_session_token_hash_unique",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "upload_session_final_key_unique": {
+          "name": "upload_session_final_key_unique",
+          "columns": [
+            {
+              "expression": "final_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "upload_session_status_expires_at_idx": {
+          "name": "upload_session_status_expires_at_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.usage_log": {
+      "name": "usage_log",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "category": {
+          "name": "category",
+          "type": "usage_log_category",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "usage_log_source",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cost": {
+          "name": "cost",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_key": {
+          "name": "event_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_entity_type": {
+          "name": "billing_entity_type",
+          "type": "billing_entity_type",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_entity_id": {
+          "name": "billing_entity_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_period_start": {
+          "name": "billing_period_start",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_period_end": {
+          "name": "billing_period_end",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_id": {
+          "name": "execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "usage_log_user_created_at_idx": {
+          "name": "usage_log_user_created_at_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "usage_log_source_idx": {
+          "name": "usage_log_source_idx",
+          "columns": [
+            {
+              "expression": "source",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "usage_log_workspace_id_idx": {
+          "name": "usage_log_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "usage_log_workflow_id_idx": {
+          "name": "usage_log_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "usage_log_event_key_unique": {
+          "name": "usage_log_event_key_unique",
+          "columns": [
+            {
+              "expression": "event_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"usage_log\".\"event_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "usage_log_billing_entity_period_idx": {
+          "name": "usage_log_billing_entity_period_idx",
+          "columns": [
+            {
+              "expression": "billing_entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "billing_entity_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "billing_period_start",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "billing_period_end",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"usage_log\".\"billing_entity_type\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "usage_log_billing_period_cost_idx": {
+          "name": "usage_log_billing_period_cost_idx",
+          "columns": [
+            {
+              "expression": "billing_entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "billing_entity_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "billing_period_start",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "billing_period_end",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "cost",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"usage_log\".\"billing_entity_type\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "usage_log_billing_entity_created_at_cost_idx": {
+          "name": "usage_log_billing_entity_created_at_cost_idx",
+          "columns": [
+            {
+              "expression": "billing_entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "billing_entity_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "cost",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"usage_log\".\"billing_entity_type\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "usage_log_workspace_created_at_idx": {
+          "name": "usage_log_workspace_created_at_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "usage_log_execution_id_idx": {
+          "name": "usage_log_execution_id_idx",
+          "columns": [
+            {
+              "expression": "execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "usage_log_user_id_user_id_fk": {
+          "name": "usage_log_user_id_user_id_fk",
+          "tableFrom": "usage_log",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "usage_log_workspace_id_workspace_id_fk": {
+          "name": "usage_log_workspace_id_workspace_id_fk",
+          "tableFrom": "usage_log",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "usage_log_workflow_id_workflow_id_fk": {
+          "name": "usage_log_workflow_id_workflow_id_fk",
+          "tableFrom": "usage_log",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "usage_log_billing_scope_all_or_none": {
+          "name": "usage_log_billing_scope_all_or_none",
+          "value": "(\n        (\"usage_log\".\"billing_entity_type\" IS NULL AND \"usage_log\".\"billing_entity_id\" IS NULL AND \"usage_log\".\"billing_period_start\" IS NULL AND \"usage_log\".\"billing_period_end\" IS NULL)\n        OR\n        (\"usage_log\".\"billing_entity_type\" IS NOT NULL AND \"usage_log\".\"billing_entity_id\" IS NOT NULL AND \"usage_log\".\"billing_period_start\" IS NOT NULL AND \"usage_log\".\"billing_period_end\" IS NOT NULL AND \"usage_log\".\"billing_period_start\" < \"usage_log\".\"billing_period_end\")\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.user": {
+      "name": "user",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "normalized_email": {
+          "name": "normalized_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "email_verified": {
+          "name": "email_verified",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "image": {
+          "name": "image",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stripe_customer_id": {
+          "name": "stripe_customer_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'user'"
+        },
+        "banned": {
+          "name": "banned",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false,
+          "default": false
+        },
+        "ban_reason": {
+          "name": "ban_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ban_expires": {
+          "name": "ban_expires",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "suspended_at": {
+          "name": "suspended_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "suspension_source": {
+          "name": "suspension_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "user_email_lower_idx": {
+          "name": "user_email_lower_idx",
+          "columns": [
+            {
+              "expression": "lower(btrim(\"email\"))",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "user_email_unique": {
+          "name": "user_email_unique",
+          "nullsNotDistinct": false,
+          "columns": ["email"]
+        },
+        "user_normalized_email_unique": {
+          "name": "user_normalized_email_unique",
+          "nullsNotDistinct": false,
+          "columns": ["normalized_email"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_stats": {
+      "name": "user_stats",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "total_manual_executions": {
+          "name": "total_manual_executions",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_api_calls": {
+          "name": "total_api_calls",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_webhook_triggers": {
+          "name": "total_webhook_triggers",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_scheduled_executions": {
+          "name": "total_scheduled_executions",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_chat_executions": {
+          "name": "total_chat_executions",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_mcp_executions": {
+          "name": "total_mcp_executions",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_tokens_used": {
+          "name": "total_tokens_used",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_cost": {
+          "name": "total_cost",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "current_usage_limit": {
+          "name": "current_usage_limit",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'5'"
+        },
+        "usage_limit_updated_at": {
+          "name": "usage_limit_updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "now()"
+        },
+        "current_period_cost": {
+          "name": "current_period_cost",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "last_period_cost": {
+          "name": "last_period_cost",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'0'"
+        },
+        "billed_overage_this_period": {
+          "name": "billed_overage_this_period",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "pro_period_cost_snapshot": {
+          "name": "pro_period_cost_snapshot",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'0'"
+        },
+        "pro_period_cost_snapshot_at": {
+          "name": "pro_period_cost_snapshot_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credit_balance": {
+          "name": "credit_balance",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "total_copilot_cost": {
+          "name": "total_copilot_cost",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "current_period_copilot_cost": {
+          "name": "current_period_copilot_cost",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "last_period_copilot_cost": {
+          "name": "last_period_copilot_cost",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'0'"
+        },
+        "total_copilot_tokens": {
+          "name": "total_copilot_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_copilot_calls": {
+          "name": "total_copilot_calls",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_mcp_copilot_calls": {
+          "name": "total_mcp_copilot_calls",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_mcp_copilot_cost": {
+          "name": "total_mcp_copilot_cost",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "current_period_mcp_copilot_cost": {
+          "name": "current_period_mcp_copilot_cost",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "storage_used_bytes": {
+          "name": "storage_used_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_active": {
+          "name": "last_active",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "billing_blocked": {
+          "name": "billing_blocked",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "billing_blocked_reason": {
+          "name": "billing_blocked_reason",
+          "type": "billing_blocked_reason",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "limit_notifications": {
+          "name": "limit_notifications",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "user_stats_user_id_user_id_fk": {
+          "name": "user_stats_user_id_user_id_fk",
+          "tableFrom": "user_stats",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "user_stats_user_id_unique": {
+          "name": "user_stats_user_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_table_definitions": {
+      "name": "user_table_definitions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "folder_id": {
+          "name": "folder_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "schema": {
+          "name": "schema",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "max_rows": {
+          "name": "max_rows",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 10000
+        },
+        "row_count": {
+          "name": "row_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "rows_version": {
+          "name": "rows_version",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "schema_locked": {
+          "name": "schema_locked",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "insert_locked": {
+          "name": "insert_locked",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "update_locked": {
+          "name": "update_locked",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "delete_locked": {
+          "name": "delete_locked",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_table_def_workspace_id_idx": {
+          "name": "user_table_def_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_table_def_folder_id_idx": {
+          "name": "user_table_def_folder_id_idx",
+          "columns": [
+            {
+              "expression": "folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_table_def_workspace_name_unique": {
+          "name": "user_table_def_workspace_name_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"user_table_definitions\".\"archived_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_table_def_archived_at_idx": {
+          "name": "user_table_def_archived_at_idx",
+          "columns": [
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_table_def_workspace_archived_partial_idx": {
+          "name": "user_table_def_workspace_archived_partial_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"user_table_definitions\".\"archived_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_table_definitions_workspace_id_workspace_id_fk": {
+          "name": "user_table_definitions_workspace_id_workspace_id_fk",
+          "tableFrom": "user_table_definitions",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_table_definitions_folder_id_folder_id_fk": {
+          "name": "user_table_definitions_folder_id_folder_id_fk",
+          "tableFrom": "user_table_definitions",
+          "tableTo": "folder",
+          "columnsFrom": ["folder_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "user_table_definitions_created_by_user_id_fk": {
+          "name": "user_table_definitions_created_by_user_id_fk",
+          "tableFrom": "user_table_definitions",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_table_row_secret_provenance": {
+      "name": "user_table_row_secret_provenance",
+      "schema": "",
+      "columns": {
+        "row_id": {
+          "name": "row_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "content_updated_at": {
+          "name": "content_updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entries": {
+          "name": "entries",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "user_table_row_secret_provenance_row_id_user_table_rows_id_fk": {
+          "name": "user_table_row_secret_provenance_row_id_user_table_rows_id_fk",
+          "tableFrom": "user_table_row_secret_provenance",
+          "tableTo": "user_table_rows",
+          "columnsFrom": ["row_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "user_table_row_secret_provenance_status_check": {
+          "name": "user_table_row_secret_provenance_status_check",
+          "value": "\"user_table_row_secret_provenance\".\"status\" IN ('exact', 'unknown')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.user_table_rows": {
+      "name": "user_table_rows",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "table_id": {
+          "name": "table_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "data": {
+          "name": "data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "position": {
+          "name": "position",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "order_key": {
+          "name": "order_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_provenance_version": {
+          "name": "secret_provenance_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "user_table_rows_tenant_data_gin_idx": {
+          "name": "user_table_rows_tenant_data_gin_idx",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "\"data\" jsonb_path_ops",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "user_table_rows_workspace_table_idx": {
+          "name": "user_table_rows_workspace_table_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_table_rows_table_position_idx": {
+          "name": "user_table_rows_table_position_idx",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_table_rows_table_order_key_idx": {
+          "name": "user_table_rows_table_order_key_idx",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "order_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_table_rows_table_created_id_idx": {
+          "name": "user_table_rows_table_created_id_idx",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_table_rows_table_id_id_idx": {
+          "name": "user_table_rows_table_id_id_idx",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_table_rows_table_id_user_table_definitions_id_fk": {
+          "name": "user_table_rows_table_id_user_table_definitions_id_fk",
+          "tableFrom": "user_table_rows",
+          "tableTo": "user_table_definitions",
+          "columnsFrom": ["table_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_table_rows_workspace_id_workspace_id_fk": {
+          "name": "user_table_rows_workspace_id_workspace_id_fk",
+          "tableFrom": "user_table_rows",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_table_rows_created_by_user_id_fk": {
+          "name": "user_table_rows_created_by_user_id_fk",
+          "tableFrom": "user_table_rows",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.verification": {
+      "name": "verification",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "verification_identifier_idx": {
+          "name": "verification_identifier_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "verification_expires_at_idx": {
+          "name": "verification_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.waitlist": {
+      "name": "waitlist",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "waitlist_email_unique": {
+          "name": "waitlist_email_unique",
+          "nullsNotDistinct": false,
+          "columns": ["email"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.webhook": {
+      "name": "webhook",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deployment_version_id": {
+          "name": "deployment_version_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "registration_status": {
+          "name": "registration_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "registration_generation": {
+          "name": "registration_generation",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "config_fingerprint": {
+          "name": "config_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "prepared_at": {
+          "name": "prepared_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "block_id": {
+          "name": "block_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "routing_key": {
+          "name": "routing_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_config": {
+          "name": "provider_config",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "failed_count": {
+          "name": "failed_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "default": 0
+        },
+        "last_failed_at": {
+          "name": "last_failed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "path_deployment_unique": {
+          "name": "path_deployment_unique",
+          "columns": [
+            {
+              "expression": "path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deployment_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"webhook\".\"archived_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "webhook_workflow_deployment_idx": {
+          "name": "webhook_workflow_deployment_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deployment_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "webhook_routing_key_active_idx": {
+          "name": "webhook_routing_key_active_idx",
+          "columns": [
+            {
+              "expression": "routing_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"webhook\".\"archived_at\" IS NULL AND \"webhook\".\"routing_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "webhook_archived_at_partial_idx": {
+          "name": "webhook_archived_at_partial_idx",
+          "columns": [
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"webhook\".\"archived_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "idx_webhook_on_provider_is_active_workflow_id_deploym_bdeed5468": {
+          "name": "idx_webhook_on_provider_is_active_workflow_id_deploym_bdeed5468",
+          "columns": [
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "is_active",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deployment_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "idx_webhook_on_workflow_id_block_id_updated_at_desc": {
+          "name": "idx_webhook_on_workflow_id_block_id_updated_at_desc",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "block_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "webhook_active_registration_unique": {
+          "name": "webhook_active_registration_unique",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "block_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"webhook\".\"registration_status\" = 'active' AND \"webhook\".\"block_id\" IS NOT NULL AND \"webhook\".\"archived_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "webhook_candidate_registration_unique": {
+          "name": "webhook_candidate_registration_unique",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "block_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"webhook\".\"registration_status\" = 'candidate' AND \"webhook\".\"block_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "webhook_registration_status_generation_idx": {
+          "name": "webhook_registration_status_generation_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "registration_status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "registration_generation",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "webhook_workflow_id_workflow_id_fk": {
+          "name": "webhook_workflow_id_workflow_id_fk",
+          "tableFrom": "webhook",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "webhook_deployment_version_id_workflow_deployment_version_id_fk": {
+          "name": "webhook_deployment_version_id_workflow_deployment_version_id_fk",
+          "tableFrom": "webhook",
+          "tableTo": "workflow_deployment_version",
+          "columnsFrom": ["deployment_version_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "webhook_registration_status_check": {
+          "name": "webhook_registration_status_check",
+          "value": "\"webhook\".\"registration_status\" IS NULL OR \"webhook\".\"registration_status\" IN ('active', 'candidate', 'retired', 'orphaned')"
+        },
+        "webhook_registration_generation_check": {
+          "name": "webhook_registration_generation_check",
+          "value": "\"webhook\".\"registration_generation\" IS NULL OR \"webhook\".\"registration_generation\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.webhook_path_claim": {
+      "name": "webhook_path_claim",
+      "schema": "",
+      "columns": {
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation": {
+          "name": "generation",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "webhook_path_claim_workflow_idx": {
+          "name": "webhook_path_claim_workflow_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "webhook_path_claim_workflow_id_workflow_id_fk": {
+          "name": "webhook_path_claim_workflow_id_workflow_id_fk",
+          "tableFrom": "webhook_path_claim",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "webhook_path_claim_generation_check": {
+          "name": "webhook_path_claim_generation_check",
+          "value": "\"webhook_path_claim\".\"generation\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.workflow": {
+      "name": "workflow",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "folder_id": {
+          "name": "folder_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sort_order": {
+          "name": "sort_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_synced": {
+          "name": "last_synced",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "is_deployed": {
+          "name": "is_deployed",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "deployed_at": {
+          "name": "deployed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_public_api": {
+          "name": "is_public_api",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "locked": {
+          "name": "locked",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "fork_sync_excluded": {
+          "name": "fork_sync_excluded",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "run_count": {
+          "name": "run_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_run_at": {
+          "name": "last_run_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "variables": {
+          "name": "variables",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'{}'"
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "workflow_user_id_idx": {
+          "name": "workflow_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_workspace_id_idx": {
+          "name": "workflow_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_user_workspace_idx": {
+          "name": "workflow_user_workspace_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_workspace_folder_name_active_unique": {
+          "name": "workflow_workspace_folder_name_active_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "coalesce(\"folder_id\", '')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"workflow\".\"archived_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_folder_sort_idx": {
+          "name": "workflow_folder_sort_idx",
+          "columns": [
+            {
+              "expression": "folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sort_order",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_active_workspace_sort_idx": {
+          "name": "workflow_active_workspace_sort_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sort_order",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workflow\".\"archived_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_archived_at_idx": {
+          "name": "workflow_archived_at_idx",
+          "columns": [
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_workspace_archived_partial_idx": {
+          "name": "workflow_workspace_archived_partial_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workflow\".\"archived_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_user_id_user_id_fk": {
+          "name": "workflow_user_id_user_id_fk",
+          "tableFrom": "workflow",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_workspace_id_workspace_id_fk": {
+          "name": "workflow_workspace_id_workspace_id_fk",
+          "tableFrom": "workflow",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_folder_id_folder_id_fk": {
+          "name": "workflow_folder_id_folder_id_fk",
+          "tableFrom": "workflow",
+          "tableTo": "folder",
+          "columnsFrom": ["folder_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_blocks": {
+      "name": "workflow_blocks",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "position_x": {
+          "name": "position_x",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "position_y": {
+          "name": "position_y",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "horizontal_handles": {
+          "name": "horizontal_handles",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "is_wide": {
+          "name": "is_wide",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "advanced_mode": {
+          "name": "advanced_mode",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "trigger_mode": {
+          "name": "trigger_mode",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "error_enabled": {
+          "name": "error_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "retry": {
+          "name": "retry",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked": {
+          "name": "locked",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "height": {
+          "name": "height",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "sub_blocks": {
+          "name": "sub_blocks",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "outputs": {
+          "name": "outputs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "data": {
+          "name": "data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'{}'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workflow_blocks_workflow_id_idx": {
+          "name": "workflow_blocks_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_blocks_type_idx": {
+          "name": "workflow_blocks_type_idx",
+          "columns": [
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_blocks_workflow_id_workflow_id_fk": {
+          "name": "workflow_blocks_workflow_id_workflow_id_fk",
+          "tableFrom": "workflow_blocks",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_checkpoints": {
+      "name": "workflow_checkpoints",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "chat_id": {
+          "name": "chat_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message_id": {
+          "name": "message_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workflow_state": {
+          "name": "workflow_state",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workflow_checkpoints_user_id_idx": {
+          "name": "workflow_checkpoints_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_checkpoints_workflow_id_idx": {
+          "name": "workflow_checkpoints_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_checkpoints_chat_id_idx": {
+          "name": "workflow_checkpoints_chat_id_idx",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_checkpoints_message_id_idx": {
+          "name": "workflow_checkpoints_message_id_idx",
+          "columns": [
+            {
+              "expression": "message_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_checkpoints_user_workflow_idx": {
+          "name": "workflow_checkpoints_user_workflow_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_checkpoints_workflow_chat_idx": {
+          "name": "workflow_checkpoints_workflow_chat_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_checkpoints_created_at_idx": {
+          "name": "workflow_checkpoints_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_checkpoints_chat_created_at_idx": {
+          "name": "workflow_checkpoints_chat_created_at_idx",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_checkpoints_user_id_user_id_fk": {
+          "name": "workflow_checkpoints_user_id_user_id_fk",
+          "tableFrom": "workflow_checkpoints",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_checkpoints_workflow_id_workflow_id_fk": {
+          "name": "workflow_checkpoints_workflow_id_workflow_id_fk",
+          "tableFrom": "workflow_checkpoints",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_checkpoints_chat_id_copilot_chats_id_fk": {
+          "name": "workflow_checkpoints_chat_id_copilot_chats_id_fk",
+          "tableFrom": "workflow_checkpoints",
+          "tableTo": "copilot_chats",
+          "columnsFrom": ["chat_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_deployment_operation": {
+      "name": "workflow_deployment_operation",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deployment_version_id": {
+          "name": "deployment_version_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "previous_active_version_id": {
+          "name": "previous_active_version_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "protocol_version": {
+          "name": "protocol_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation": {
+          "name": "generation",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'preparing'"
+        },
+        "component_readiness": {
+          "name": "component_readiness",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_hash": {
+          "name": "request_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workflow_deployment_operation_workflow_generation_unique": {
+          "name": "workflow_deployment_operation_workflow_generation_unique",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "generation",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_deployment_operation_workflow_idempotency_unique": {
+          "name": "workflow_deployment_operation_workflow_idempotency_unique",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"workflow_deployment_operation\".\"idempotency_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_deployment_operation_workflow_in_flight_unique": {
+          "name": "workflow_deployment_operation_workflow_in_flight_unique",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"workflow_deployment_operation\".\"status\" IN ('preparing', 'activating')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_deployment_operation_workflow_status_idx": {
+          "name": "workflow_deployment_operation_workflow_status_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_deployment_operation_deployment_version_idx": {
+          "name": "workflow_deployment_operation_deployment_version_idx",
+          "columns": [
+            {
+              "expression": "deployment_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_deployment_operation_workflow_version_generation_idx": {
+          "name": "workflow_deployment_operation_workflow_version_generation_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deployment_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "generation",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_deployment_operation_workflow_id_workflow_id_fk": {
+          "name": "workflow_deployment_operation_workflow_id_workflow_id_fk",
+          "tableFrom": "workflow_deployment_operation",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_deployment_operation_deployment_version_id_workflow_deployment_version_id_fk": {
+          "name": "workflow_deployment_operation_deployment_version_id_workflow_deployment_version_id_fk",
+          "tableFrom": "workflow_deployment_operation",
+          "tableTo": "workflow_deployment_version",
+          "columnsFrom": ["deployment_version_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_deployment_operation_previous_active_version_id_workflow_deployment_version_id_fk": {
+          "name": "workflow_deployment_operation_previous_active_version_id_workflow_deployment_version_id_fk",
+          "tableFrom": "workflow_deployment_operation",
+          "tableTo": "workflow_deployment_version",
+          "columnsFrom": ["previous_active_version_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "workflow_deployment_operation_action_check": {
+          "name": "workflow_deployment_operation_action_check",
+          "value": "\"workflow_deployment_operation\".\"action\" IN ('deploy', 'activate')"
+        },
+        "workflow_deployment_operation_status_check": {
+          "name": "workflow_deployment_operation_status_check",
+          "value": "\"workflow_deployment_operation\".\"status\" IN ('preparing', 'activating', 'active', 'failed', 'superseded')"
+        },
+        "workflow_deployment_operation_generation_check": {
+          "name": "workflow_deployment_operation_generation_check",
+          "value": "\"workflow_deployment_operation\".\"generation\" > 0"
+        },
+        "workflow_deployment_operation_protocol_version_check": {
+          "name": "workflow_deployment_operation_protocol_version_check",
+          "value": "\"workflow_deployment_operation\".\"protocol_version\" > 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.workflow_deployment_version": {
+      "name": "workflow_deployment_version",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "state": {
+          "name": "state",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "workflow_deployment_version_workflow_version_unique": {
+          "name": "workflow_deployment_version_workflow_version_unique",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "version",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_deployment_version_workflow_active_idx": {
+          "name": "workflow_deployment_version_workflow_active_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "is_active",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_deployment_version_created_at_idx": {
+          "name": "workflow_deployment_version_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_deployment_version_workflow_id_workflow_id_fk": {
+          "name": "workflow_deployment_version_workflow_id_workflow_id_fk",
+          "tableFrom": "workflow_deployment_version",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_edges": {
+      "name": "workflow_edges",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_block_id": {
+          "name": "source_block_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_block_id": {
+          "name": "target_block_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_handle": {
+          "name": "source_handle",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_handle": {
+          "name": "target_handle",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workflow_edges_workflow_id_idx": {
+          "name": "workflow_edges_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_edges_workflow_source_idx": {
+          "name": "workflow_edges_workflow_source_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_block_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_edges_workflow_target_idx": {
+          "name": "workflow_edges_workflow_target_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_block_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_edges_workflow_id_workflow_id_fk": {
+          "name": "workflow_edges_workflow_id_workflow_id_fk",
+          "tableFrom": "workflow_edges",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_edges_source_block_id_workflow_blocks_id_fk": {
+          "name": "workflow_edges_source_block_id_workflow_blocks_id_fk",
+          "tableFrom": "workflow_edges",
+          "tableTo": "workflow_blocks",
+          "columnsFrom": ["source_block_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_edges_target_block_id_workflow_blocks_id_fk": {
+          "name": "workflow_edges_target_block_id_workflow_blocks_id_fk",
+          "tableFrom": "workflow_edges",
+          "tableTo": "workflow_blocks",
+          "columnsFrom": ["target_block_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_execution_logs": {
+      "name": "workflow_execution_logs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_id": {
+          "name": "execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state_snapshot_id": {
+          "name": "state_snapshot_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deployment_version_id": {
+          "name": "deployment_version_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'running'"
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_deadline_at": {
+          "name": "execution_deadline_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ended_at": {
+          "name": "ended_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "total_duration_ms": {
+          "name": "total_duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_data": {
+          "name": "execution_data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "cost": {
+          "name": "cost",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cost_total": {
+          "name": "cost_total",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "models_used": {
+          "name": "models_used",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "files": {
+          "name": "files",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workflow_execution_logs_workflow_id_idx": {
+          "name": "workflow_execution_logs_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_state_snapshot_id_idx": {
+          "name": "workflow_execution_logs_state_snapshot_id_idx",
+          "columns": [
+            {
+              "expression": "state_snapshot_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_deployment_version_id_idx": {
+          "name": "workflow_execution_logs_deployment_version_id_idx",
+          "columns": [
+            {
+              "expression": "deployment_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_trigger_idx": {
+          "name": "workflow_execution_logs_trigger_idx",
+          "columns": [
+            {
+              "expression": "trigger",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_level_idx": {
+          "name": "workflow_execution_logs_level_idx",
+          "columns": [
+            {
+              "expression": "level",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_started_at_idx": {
+          "name": "workflow_execution_logs_started_at_idx",
+          "columns": [
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_execution_id_unique": {
+          "name": "workflow_execution_logs_execution_id_unique",
+          "columns": [
+            {
+              "expression": "execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_workflow_started_at_idx": {
+          "name": "workflow_execution_logs_workflow_started_at_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_workspace_started_at_idx": {
+          "name": "workflow_execution_logs_workspace_started_at_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_workspace_started_at_id_desc_idx": {
+          "name": "workflow_execution_logs_workspace_started_at_id_desc_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "\"started_at\" DESC NULLS LAST",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "\"id\" DESC",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_workspace_cost_total_idx": {
+          "name": "workflow_execution_logs_workspace_cost_total_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "cost_total",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_models_used_idx": {
+          "name": "workflow_execution_logs_models_used_idx",
+          "columns": [
+            {
+              "expression": "models_used",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "workflow_execution_logs_workspace_ended_at_id_idx": {
+          "name": "workflow_execution_logs_workspace_ended_at_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "date_trunc('milliseconds', \"ended_at\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_running_started_at_idx": {
+          "name": "workflow_execution_logs_running_started_at_idx",
+          "columns": [
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "status = 'running'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_running_deadline_idx": {
+          "name": "workflow_execution_logs_running_deadline_idx",
+          "columns": [
+            {
+              "expression": "execution_deadline_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workflow_execution_logs\".\"status\" = 'running' AND \"workflow_execution_logs\".\"execution_deadline_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_redacting_started_at_idx": {
+          "name": "workflow_execution_logs_redacting_started_at_idx",
+          "columns": [
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "status = 'redacting'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_redacting_deadline_idx": {
+          "name": "workflow_execution_logs_redacting_deadline_idx",
+          "columns": [
+            {
+              "expression": "execution_deadline_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workflow_execution_logs\".\"status\" = 'redacting' AND \"workflow_execution_logs\".\"execution_deadline_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_completed_ended_at_idx": {
+          "name": "workflow_execution_logs_completed_ended_at_idx",
+          "columns": [
+            {
+              "expression": "ended_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workflow_execution_logs\".\"status\" = 'completed' AND \"workflow_execution_logs\".\"level\" = 'info' AND \"workflow_execution_logs\".\"ended_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_execution_logs_workflow_id_workflow_id_fk": {
+          "name": "workflow_execution_logs_workflow_id_workflow_id_fk",
+          "tableFrom": "workflow_execution_logs",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workflow_execution_logs_workspace_id_workspace_id_fk": {
+          "name": "workflow_execution_logs_workspace_id_workspace_id_fk",
+          "tableFrom": "workflow_execution_logs",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_execution_logs_state_snapshot_id_workflow_execution_snapshots_id_fk": {
+          "name": "workflow_execution_logs_state_snapshot_id_workflow_execution_snapshots_id_fk",
+          "tableFrom": "workflow_execution_logs",
+          "tableTo": "workflow_execution_snapshots",
+          "columnsFrom": ["state_snapshot_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "workflow_execution_logs_deployment_version_id_workflow_deployment_version_id_fk": {
+          "name": "workflow_execution_logs_deployment_version_id_workflow_deployment_version_id_fk",
+          "tableFrom": "workflow_execution_logs",
+          "tableTo": "workflow_deployment_version",
+          "columnsFrom": ["deployment_version_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_execution_snapshots": {
+      "name": "workflow_execution_snapshots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "state_hash": {
+          "name": "state_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state_data": {
+          "name": "state_data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workflow_snapshots_workflow_id_idx": {
+          "name": "workflow_snapshots_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_snapshots_hash_idx": {
+          "name": "workflow_snapshots_hash_idx",
+          "columns": [
+            {
+              "expression": "state_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_snapshots_workflow_hash_idx": {
+          "name": "workflow_snapshots_workflow_hash_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "state_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_snapshots_created_at_idx": {
+          "name": "workflow_snapshots_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_execution_snapshots_workflow_id_workflow_id_fk": {
+          "name": "workflow_execution_snapshots_workflow_id_workflow_id_fk",
+          "tableFrom": "workflow_execution_snapshots",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_mcp_server": {
+      "name": "workflow_mcp_server",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_public": {
+          "name": "is_public",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workflow_mcp_server_workspace_id_idx": {
+          "name": "workflow_mcp_server_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_mcp_server_created_by_idx": {
+          "name": "workflow_mcp_server_created_by_idx",
+          "columns": [
+            {
+              "expression": "created_by",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_mcp_server_deleted_at_idx": {
+          "name": "workflow_mcp_server_deleted_at_idx",
+          "columns": [
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_mcp_server_workspace_deleted_partial_idx": {
+          "name": "workflow_mcp_server_workspace_deleted_partial_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workflow_mcp_server\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_mcp_server_workspace_id_workspace_id_fk": {
+          "name": "workflow_mcp_server_workspace_id_workspace_id_fk",
+          "tableFrom": "workflow_mcp_server",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_mcp_server_created_by_user_id_fk": {
+          "name": "workflow_mcp_server_created_by_user_id_fk",
+          "tableFrom": "workflow_mcp_server",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_mcp_tool": {
+      "name": "workflow_mcp_tool",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "server_id": {
+          "name": "server_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tool_description": {
+          "name": "tool_description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parameter_schema": {
+          "name": "parameter_schema",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "parameter_description_overrides": {
+          "name": "parameter_description_overrides",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::json"
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workflow_mcp_tool_server_id_idx": {
+          "name": "workflow_mcp_tool_server_id_idx",
+          "columns": [
+            {
+              "expression": "server_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_mcp_tool_workflow_id_idx": {
+          "name": "workflow_mcp_tool_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_mcp_tool_server_workflow_unique": {
+          "name": "workflow_mcp_tool_server_workflow_unique",
+          "columns": [
+            {
+              "expression": "server_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"workflow_mcp_tool\".\"archived_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_mcp_tool_archived_at_partial_idx": {
+          "name": "workflow_mcp_tool_archived_at_partial_idx",
+          "columns": [
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workflow_mcp_tool\".\"archived_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_mcp_tool_server_id_workflow_mcp_server_id_fk": {
+          "name": "workflow_mcp_tool_server_id_workflow_mcp_server_id_fk",
+          "tableFrom": "workflow_mcp_tool",
+          "tableTo": "workflow_mcp_server",
+          "columnsFrom": ["server_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_mcp_tool_workflow_id_workflow_id_fk": {
+          "name": "workflow_mcp_tool_workflow_id_workflow_id_fk",
+          "tableFrom": "workflow_mcp_tool",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_schedule": {
+      "name": "workflow_schedule",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deployment_version_id": {
+          "name": "deployment_version_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deployment_operation_id": {
+          "name": "deployment_operation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "block_id": {
+          "name": "block_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cron_expression": {
+          "name": "cron_expression",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_run_at": {
+          "name": "next_run_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_ran_at": {
+          "name": "last_ran_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_queued_at": {
+          "name": "last_queued_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger_type": {
+          "name": "trigger_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "timezone": {
+          "name": "timezone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'UTC'"
+        },
+        "failed_count": {
+          "name": "failed_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "infra_retry_count": {
+          "name": "infra_retry_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "last_failed_at": {
+          "name": "last_failed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_type": {
+          "name": "source_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'workflow'"
+        },
+        "job_title": {
+          "name": "job_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "prompt": {
+          "name": "prompt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lifecycle": {
+          "name": "lifecycle",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'persistent'"
+        },
+        "success_condition": {
+          "name": "success_condition",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "max_runs": {
+          "name": "max_runs",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_count": {
+          "name": "run_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "source_chat_id": {
+          "name": "source_chat_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_task_name": {
+          "name": "source_task_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_user_id": {
+          "name": "source_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_workspace_id": {
+          "name": "source_workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_scope": {
+          "name": "secret_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'all'"
+        },
+        "mounted_secrets": {
+          "name": "mounted_secrets",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "job_history": {
+          "name": "job_history",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "contexts": {
+          "name": "contexts",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "excluded_dates": {
+          "name": "excluded_dates",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ends_at": {
+          "name": "ends_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workflow_schedule_workflow_block_deployment_unique": {
+          "name": "workflow_schedule_workflow_block_deployment_unique",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "block_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deployment_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"workflow_schedule\".\"archived_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_schedule_workflow_deployment_idx": {
+          "name": "workflow_schedule_workflow_deployment_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deployment_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_schedule_archived_at_partial_idx": {
+          "name": "workflow_schedule_archived_at_partial_idx",
+          "columns": [
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workflow_schedule\".\"archived_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "idx_workflow_schedule_on_source_workspace_id_source_t_c07f3bba6": {
+          "name": "idx_workflow_schedule_on_source_workspace_id_source_t_c07f3bba6",
+          "columns": [
+            {
+              "expression": "source_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_schedule_due_workflow_idx": {
+          "name": "workflow_schedule_due_workflow_idx",
+          "columns": [
+            {
+              "expression": "next_run_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_queued_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deployment_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workflow_schedule\".\"archived_at\" IS NULL AND \"workflow_schedule\".\"status\" NOT IN ('disabled', 'completed') AND (\"workflow_schedule\".\"source_type\" = 'workflow' OR \"workflow_schedule\".\"source_type\" IS NULL)",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_schedule_due_job_idx": {
+          "name": "workflow_schedule_due_job_idx",
+          "columns": [
+            {
+              "expression": "next_run_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_queued_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workflow_schedule\".\"archived_at\" IS NULL AND \"workflow_schedule\".\"status\" NOT IN ('disabled', 'completed') AND \"workflow_schedule\".\"source_type\" = 'job'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_schedule_workflow_id_workflow_id_fk": {
+          "name": "workflow_schedule_workflow_id_workflow_id_fk",
+          "tableFrom": "workflow_schedule",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_schedule_deployment_version_id_workflow_deployment_version_id_fk": {
+          "name": "workflow_schedule_deployment_version_id_workflow_deployment_version_id_fk",
+          "tableFrom": "workflow_schedule",
+          "tableTo": "workflow_deployment_version",
+          "columnsFrom": ["deployment_version_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_schedule_deployment_operation_id_workflow_deployment_operation_id_fk": {
+          "name": "workflow_schedule_deployment_operation_id_workflow_deployment_operation_id_fk",
+          "tableFrom": "workflow_schedule",
+          "tableTo": "workflow_deployment_operation",
+          "columnsFrom": ["deployment_operation_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workflow_schedule_source_user_id_user_id_fk": {
+          "name": "workflow_schedule_source_user_id_user_id_fk",
+          "tableFrom": "workflow_schedule",
+          "tableTo": "user",
+          "columnsFrom": ["source_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_schedule_source_workspace_id_workspace_id_fk": {
+          "name": "workflow_schedule_source_workspace_id_workspace_id_fk",
+          "tableFrom": "workflow_schedule",
+          "tableTo": "workspace",
+          "columnsFrom": ["source_workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_subflows": {
+      "name": "workflow_subflows",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workflow_subflows_workflow_id_idx": {
+          "name": "workflow_subflows_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_subflows_workflow_type_idx": {
+          "name": "workflow_subflows_workflow_type_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_subflows_workflow_id_workflow_id_fk": {
+          "name": "workflow_subflows_workflow_id_workflow_id_fk",
+          "tableFrom": "workflow_subflows",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace": {
+      "name": "workspace",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'#33C482'"
+        },
+        "logo_url": {
+          "name": "logo_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_id": {
+          "name": "owner_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_mode": {
+          "name": "workspace_mode",
+          "type": "workspace_mode",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'grandfathered_shared'"
+        },
+        "billed_account_user_id": {
+          "name": "billed_account_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "storage_used_bytes": {
+          "name": "storage_used_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "allow_personal_api_keys": {
+          "name": "allow_personal_api_keys",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "inbox_enabled": {
+          "name": "inbox_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "inbox_address": {
+          "name": "inbox_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "inbox_provider_id": {
+          "name": "inbox_provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "inbox_secret_scope": {
+          "name": "inbox_secret_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'all'"
+        },
+        "inbox_mounted_secrets": {
+          "name": "inbox_mounted_secrets",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "organization_assigned_at": {
+          "name": "organization_assigned_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "forked_from_workspace_id": {
+          "name": "forked_from_workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_owner_id_idx": {
+          "name": "workspace_owner_id_idx",
+          "columns": [
+            {
+              "expression": "owner_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_organization_id_idx": {
+          "name": "workspace_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_mode_idx": {
+          "name": "workspace_mode_idx",
+          "columns": [
+            {
+              "expression": "workspace_mode",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_forked_from_workspace_id_idx": {
+          "name": "workspace_forked_from_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "forked_from_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_inbox_provider_id_idx": {
+          "name": "workspace_inbox_provider_id_idx",
+          "columns": [
+            {
+              "expression": "inbox_provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"workspace\".\"inbox_provider_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_owner_id_user_id_fk": {
+          "name": "workspace_owner_id_user_id_fk",
+          "tableFrom": "workspace",
+          "tableTo": "user",
+          "columnsFrom": ["owner_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_organization_id_organization_id_fk": {
+          "name": "workspace_organization_id_organization_id_fk",
+          "tableFrom": "workspace",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_billed_account_user_id_user_id_fk": {
+          "name": "workspace_billed_account_user_id_user_id_fk",
+          "tableFrom": "workspace",
+          "tableTo": "user",
+          "columnsFrom": ["billed_account_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "workspace_forked_from_workspace_id_workspace_id_fk": {
+          "name": "workspace_forked_from_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace",
+          "tableTo": "workspace",
+          "columnsFrom": ["forked_from_workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "workspace_storage_used_bytes_non_negative": {
+          "name": "workspace_storage_used_bytes_non_negative",
+          "value": "\"workspace\".\"storage_used_bytes\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.workspace_byok_keys": {
+      "name": "workspace_byok_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "encrypted_api_key": {
+          "name": "encrypted_api_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_byok_workspace_provider_idx": {
+          "name": "workspace_byok_workspace_provider_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_byok_keys_workspace_id_workspace_id_fk": {
+          "name": "workspace_byok_keys_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace_byok_keys",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_byok_keys_created_by_user_id_fk": {
+          "name": "workspace_byok_keys_created_by_user_id_fk",
+          "tableFrom": "workspace_byok_keys",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_environment": {
+      "name": "workspace_environment",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "variables": {
+          "name": "variables",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_environment_workspace_unique": {
+          "name": "workspace_environment_workspace_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_environment_workspace_id_workspace_id_fk": {
+          "name": "workspace_environment_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace_environment",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_file": {
+      "name": "workspace_file",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "size": {
+          "name": "size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uploaded_by": {
+          "name": "uploaded_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "uploaded_at": {
+          "name": "uploaded_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_file_workspace_id_idx": {
+          "name": "workspace_file_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_file_deleted_at_idx": {
+          "name": "workspace_file_deleted_at_idx",
+          "columns": [
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_file_workspace_deleted_partial_idx": {
+          "name": "workspace_file_workspace_deleted_partial_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workspace_file\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_file_workspace_id_workspace_id_fk": {
+          "name": "workspace_file_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace_file",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_file_uploaded_by_user_id_fk": {
+          "name": "workspace_file_uploaded_by_user_id_fk",
+          "tableFrom": "workspace_file",
+          "tableTo": "user",
+          "columnsFrom": ["uploaded_by"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "workspace_file_key_unique": {
+          "name": "workspace_file_key_unique",
+          "nullsNotDistinct": false,
+          "columns": ["key"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_file_collab_state": {
+      "name": "workspace_file_collab_state",
+      "schema": "",
+      "columns": {
+        "file_id": {
+          "name": "file_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "doc_state": {
+          "name": "doc_state",
+          "type": "bytea",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_hash": {
+          "name": "source_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "workspace_file_collab_state_file_id_workspace_files_id_fk": {
+          "name": "workspace_file_collab_state_file_id_workspace_files_id_fk",
+          "tableFrom": "workspace_file_collab_state",
+          "tableTo": "workspace_files",
+          "columnsFrom": ["file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_file_search_backfill": {
+      "name": "workspace_file_search_backfill",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "after_workspace_id": {
+          "name": "after_workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "after_file_id": {
+          "name": "after_file_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_file_search_dispatch_queue": {
+      "name": "workspace_file_search_dispatch_queue",
+      "schema": "",
+      "columns": {
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "enqueued_at": {
+          "name": "enqueued_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_dispatched_at": {
+          "name": "last_dispatched_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_file_search_dispatch_queue_schedule_idx": {
+          "name": "workspace_file_search_dispatch_queue_schedule_idx",
+          "columns": [
+            {
+              "expression": "last_dispatched_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "first"
+            },
+            {
+              "expression": "enqueued_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_file_search_queue_workspace_fk": {
+          "name": "workspace_file_search_queue_workspace_fk",
+          "tableFrom": "workspace_file_search_dispatch_queue",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_file_search_index": {
+      "name": "workspace_file_search_index",
+      "schema": "",
+      "columns": {
+        "file_id": {
+          "name": "file_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_content_updated_at": {
+          "name": "source_content_updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "workspace_file_search_index_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "partial": {
+          "name": "partial",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "line_count": {
+          "name": "line_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "indexed_bytes": {
+          "name": "indexed_bytes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "dispatched_at": {
+          "name": "dispatched_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_file_search_index_workspace_status_idx": {
+          "name": "workspace_file_search_index_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_content_updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_file_search_index_pending_dispatch_idx": {
+          "name": "workspace_file_search_index_pending_dispatch_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_content_updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workspace_file_search_index\".\"status\" = 'pending' AND \"workspace_file_search_index\".\"dispatched_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_file_search_index_active_dispatch_idx": {
+          "name": "workspace_file_search_index_active_dispatch_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "dispatched_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workspace_file_search_index\".\"status\" = 'pending' AND \"workspace_file_search_index\".\"dispatched_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_file_search_index_file_fk": {
+          "name": "workspace_file_search_index_file_fk",
+          "tableFrom": "workspace_file_search_index",
+          "tableTo": "workspace_files",
+          "columnsFrom": ["file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_file_search_index_workspace_fk": {
+          "name": "workspace_file_search_index_workspace_fk",
+          "tableFrom": "workspace_file_search_index",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "workspace_file_search_index_pk": {
+          "name": "workspace_file_search_index_pk",
+          "columns": ["file_id", "source_content_updated_at"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_file_search_segment": {
+      "name": "workspace_file_search_segment",
+      "schema": "",
+      "columns": {
+        "file_id": {
+          "name": "file_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_content_updated_at": {
+          "name": "source_content_updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "line_number": {
+          "name": "line_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "segment_number": {
+          "name": "segment_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "segment_start": {
+          "name": "segment_start",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "line_length": {
+          "name": "line_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "workspace_file_search_segment_workspace_revision_idx": {
+          "name": "workspace_file_search_segment_workspace_revision_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_content_updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_file_search_segment_workspace_content_trgm_idx": {
+          "name": "workspace_file_search_segment_workspace_content_trgm_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "text_ops"
+            },
+            {
+              "expression": "content",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_file_search_segment_file_fk": {
+          "name": "workspace_file_search_segment_file_fk",
+          "tableFrom": "workspace_file_search_segment",
+          "tableTo": "workspace_files",
+          "columnsFrom": ["file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_file_search_segment_workspace_fk": {
+          "name": "workspace_file_search_segment_workspace_fk",
+          "tableFrom": "workspace_file_search_segment",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "workspace_file_search_segment_pk": {
+          "name": "workspace_file_search_segment_pk",
+          "columns": ["file_id", "source_content_updated_at", "line_number", "segment_number"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_file_secret_provenance": {
+      "name": "workspace_file_secret_provenance",
+      "schema": "",
+      "columns": {
+        "file_id": {
+          "name": "file_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "content_updated_at": {
+          "name": "content_updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entries": {
+          "name": "entries",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "workspace_file_secret_provenance_file_id_workspace_files_id_fk": {
+          "name": "workspace_file_secret_provenance_file_id_workspace_files_id_fk",
+          "tableFrom": "workspace_file_secret_provenance",
+          "tableTo": "workspace_files",
+          "columnsFrom": ["file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "workspace_file_secret_provenance_status_check": {
+          "name": "workspace_file_secret_provenance_status_check",
+          "value": "\"workspace_file_secret_provenance\".\"status\" IN ('exact', 'unknown', 'unrecorded')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.workspace_files": {
+      "name": "workspace_files",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "folder_id": {
+          "name": "folder_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "context": {
+          "name": "context",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "chat_id": {
+          "name": "chat_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "message_id": {
+          "name": "message_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "original_name": {
+          "name": "original_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "content_type": {
+          "name": "content_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "size": {
+          "name": "size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "size_bytes": {
+          "name": "size_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "width": {
+          "name": "width",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "height": {
+          "name": "height",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "uploaded_at": {
+          "name": "uploaded_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "content_updated_at": {
+          "name": "content_updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "secret_provenance_version": {
+          "name": "secret_provenance_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "workspace_files_key_active_unique": {
+          "name": "workspace_files_key_active_unique",
+          "columns": [
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"workspace_files\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_workspace_folder_name_active_unique": {
+          "name": "workspace_files_workspace_folder_name_active_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "coalesce(\"folder_id\", '')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "original_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"workspace_files\".\"deleted_at\" IS NULL AND \"workspace_files\".\"context\" = 'workspace' AND \"workspace_files\".\"workspace_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_chat_display_name_unique": {
+          "name": "workspace_files_chat_display_name_unique",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "display_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"workspace_files\".\"context\" = 'mothership' AND \"workspace_files\".\"chat_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_organization_id_idx": {
+          "name": "workspace_files_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_key_idx": {
+          "name": "workspace_files_key_idx",
+          "columns": [
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_user_id_idx": {
+          "name": "workspace_files_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_workspace_id_idx": {
+          "name": "workspace_files_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_folder_id_idx": {
+          "name": "workspace_files_folder_id_idx",
+          "columns": [
+            {
+              "expression": "folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_context_idx": {
+          "name": "workspace_files_context_idx",
+          "columns": [
+            {
+              "expression": "context",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_chat_id_idx": {
+          "name": "workspace_files_chat_id_idx",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_deleted_at_idx": {
+          "name": "workspace_files_deleted_at_idx",
+          "columns": [
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_workspace_deleted_partial_idx": {
+          "name": "workspace_files_workspace_deleted_partial_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workspace_files\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_files_user_id_user_id_fk": {
+          "name": "workspace_files_user_id_user_id_fk",
+          "tableFrom": "workspace_files",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_files_workspace_id_workspace_id_fk": {
+          "name": "workspace_files_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace_files",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_files_organization_id_organization_id_fk": {
+          "name": "workspace_files_organization_id_organization_id_fk",
+          "tableFrom": "workspace_files",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_files_folder_id_folder_id_fk": {
+          "name": "workspace_files_folder_id_folder_id_fk",
+          "tableFrom": "workspace_files",
+          "tableTo": "folder",
+          "columnsFrom": ["folder_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_files_chat_id_copilot_chats_id_fk": {
+          "name": "workspace_files_chat_id_copilot_chats_id_fk",
+          "tableFrom": "workspace_files",
+          "tableTo": "copilot_chats",
+          "columnsFrom": ["chat_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "workspace_files_organization_binding_check": {
+          "name": "workspace_files_organization_binding_check",
+          "value": "\"workspace_files\".\"organization_id\" IS NULL OR (\"workspace_files\".\"workspace_id\" IS NULL AND \"workspace_files\".\"context\" = 'knowledge-base' AND \"workspace_files\".\"folder_id\" IS NULL AND \"workspace_files\".\"chat_id\" IS NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.workspace_fork_block_map": {
+      "name": "workspace_fork_block_map",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "child_workspace_id": {
+          "name": "child_workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_workflow_id": {
+          "name": "parent_workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_block_id": {
+          "name": "parent_block_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "child_workflow_id": {
+          "name": "child_workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "child_block_id": {
+          "name": "child_block_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_fork_block_map_child_ws_parent_unique": {
+          "name": "workspace_fork_block_map_child_ws_parent_unique",
+          "columns": [
+            {
+              "expression": "child_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_block_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_fork_block_map_child_ws_child_unique": {
+          "name": "workspace_fork_block_map_child_ws_child_unique",
+          "columns": [
+            {
+              "expression": "child_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "child_block_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_fork_block_map_child_ws_parent_wf_idx": {
+          "name": "workspace_fork_block_map_child_ws_parent_wf_idx",
+          "columns": [
+            {
+              "expression": "child_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_fork_block_map_child_ws_child_wf_idx": {
+          "name": "workspace_fork_block_map_child_ws_child_wf_idx",
+          "columns": [
+            {
+              "expression": "child_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "child_workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_fork_block_map_child_workspace_id_workspace_id_fk": {
+          "name": "workspace_fork_block_map_child_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace_fork_block_map",
+          "tableTo": "workspace",
+          "columnsFrom": ["child_workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_fork_dependent_value": {
+      "name": "workspace_fork_dependent_value",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "child_workspace_id": {
+          "name": "child_workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_workflow_id": {
+          "name": "target_workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_block_id": {
+          "name": "target_block_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sub_block_key": {
+          "name": "sub_block_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_fork_dependent_value_child_ws_wf_idx": {
+          "name": "workspace_fork_dependent_value_child_ws_wf_idx",
+          "columns": [
+            {
+              "expression": "child_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_fork_dependent_value_field_unique": {
+          "name": "workspace_fork_dependent_value_field_unique",
+          "columns": [
+            {
+              "expression": "child_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_block_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sub_block_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_fork_dependent_value_child_workspace_id_workspace_id_fk": {
+          "name": "workspace_fork_dependent_value_child_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace_fork_dependent_value",
+          "tableTo": "workspace",
+          "columnsFrom": ["child_workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_fork_promote_run": {
+      "name": "workspace_fork_promote_run",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "child_workspace_id": {
+          "name": "child_workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_workspace_id": {
+          "name": "source_workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_workspace_id": {
+          "name": "target_workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "direction": {
+          "name": "direction",
+          "type": "workspace_fork_promote_direction",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_fork_promote_run_child_ws_target_unique": {
+          "name": "workspace_fork_promote_run_child_ws_target_unique",
+          "columns": [
+            {
+              "expression": "child_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_fork_promote_run_target_ws_idx": {
+          "name": "workspace_fork_promote_run_target_ws_idx",
+          "columns": [
+            {
+              "expression": "target_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_fork_promote_run_child_workspace_id_workspace_id_fk": {
+          "name": "workspace_fork_promote_run_child_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace_fork_promote_run",
+          "tableTo": "workspace",
+          "columnsFrom": ["child_workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_fork_promote_run_created_by_user_id_fk": {
+          "name": "workspace_fork_promote_run_created_by_user_id_fk",
+          "tableFrom": "workspace_fork_promote_run",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_fork_resource_map": {
+      "name": "workspace_fork_resource_map",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "child_workspace_id": {
+          "name": "child_workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_type": {
+          "name": "resource_type",
+          "type": "workspace_fork_resource_type",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_resource_id": {
+          "name": "parent_resource_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "child_resource_id": {
+          "name": "child_resource_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_fork_resource_map_child_ws_idx": {
+          "name": "workspace_fork_resource_map_child_ws_idx",
+          "columns": [
+            {
+              "expression": "child_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_fork_resource_map_child_ws_type_idx": {
+          "name": "workspace_fork_resource_map_child_ws_type_idx",
+          "columns": [
+            {
+              "expression": "child_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_fork_resource_map_child_type_parent_unique": {
+          "name": "workspace_fork_resource_map_child_type_parent_unique",
+          "columns": [
+            {
+              "expression": "child_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_fork_resource_map_child_workspace_id_workspace_id_fk": {
+          "name": "workspace_fork_resource_map_child_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace_fork_resource_map",
+          "tableTo": "workspace",
+          "columnsFrom": ["child_workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_fork_resource_map_created_by_user_id_fk": {
+          "name": "workspace_fork_resource_map_created_by_user_id_fk",
+          "tableFrom": "workspace_fork_resource_map",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_operation_receipt": {
+      "name": "workspace_operation_receipt",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "request_id": {
+          "name": "request_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "request_hash": {
+          "name": "request_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "report": {
+          "name": "report",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_operation_receipt_request_unique": {
+          "name": "workspace_operation_receipt_request_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "request_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_operation_receipt_workspace_created_idx": {
+          "name": "workspace_operation_receipt_workspace_created_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_operation_receipt_workspace_id_workspace_id_fk": {
+          "name": "workspace_operation_receipt_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace_operation_receipt",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_sandbox": {
+      "name": "workspace_sandbox",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "language": {
+          "name": "language",
+          "type": "sandbox_language",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "dependencies": {
+          "name": "dependencies",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "cli_tools": {
+          "name": "cli_tools",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "system_packages": {
+          "name": "system_packages",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "spec_hash": {
+          "name": "spec_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_sandbox_workspace_name_unique": {
+          "name": "workspace_sandbox_workspace_name_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_sandbox_workspace_idx": {
+          "name": "workspace_sandbox_workspace_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_sandbox_spec_hash_idx": {
+          "name": "workspace_sandbox_spec_hash_idx",
+          "columns": [
+            {
+              "expression": "spec_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_sandbox_workspace_id_workspace_id_fk": {
+          "name": "workspace_sandbox_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace_sandbox",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_sandbox_created_by_user_id_fk": {
+          "name": "workspace_sandbox_created_by_user_id_fk",
+          "tableFrom": "workspace_sandbox",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {
+    "public.academy_cert_status": {
+      "name": "academy_cert_status",
+      "schema": "public",
+      "values": ["active", "revoked", "expired"]
+    },
+    "public.background_work_kind": {
+      "name": "background_work_kind",
+      "schema": "public",
+      "values": ["deployment_side_effects", "fork_content_copy", "fork_sync", "fork_rollback"]
+    },
+    "public.background_work_status_value": {
+      "name": "background_work_status_value",
+      "schema": "public",
+      "values": ["pending", "processing", "completed", "completed_with_warnings", "failed"]
+    },
+    "public.billing_blocked_reason": {
+      "name": "billing_blocked_reason",
+      "schema": "public",
+      "values": ["payment_failed", "dispute"]
+    },
+    "public.billing_entity_type": {
+      "name": "billing_entity_type",
+      "schema": "public",
+      "values": ["user", "organization"]
+    },
+    "public.chat_type": {
+      "name": "chat_type",
+      "schema": "public",
+      "values": ["mothership", "copilot"]
+    },
+    "public.copilot_async_tool_status": {
+      "name": "copilot_async_tool_status",
+      "schema": "public",
+      "values": ["pending", "running", "completed", "failed", "cancelled", "delivered"]
+    },
+    "public.copilot_run_status": {
+      "name": "copilot_run_status",
+      "schema": "public",
+      "values": ["active", "paused_waiting_for_tool", "resuming", "complete", "error", "cancelled"]
+    },
+    "public.copilot_tool_permission_decision": {
+      "name": "copilot_tool_permission_decision",
+      "schema": "public",
+      "values": ["allow", "allow_chat", "always_allow", "skip"]
+    },
+    "public.credential_group_enrollment_status": {
+      "name": "credential_group_enrollment_status",
+      "schema": "public",
+      "values": ["invited", "delivery_failed", "in_progress", "completed", "revoked"]
+    },
+    "public.credential_group_status": {
+      "name": "credential_group_status",
+      "schema": "public",
+      "values": ["active", "disabled"]
+    },
+    "public.credential_member_role": {
+      "name": "credential_member_role",
+      "schema": "public",
+      "values": ["admin", "member"]
+    },
+    "public.credential_member_status": {
+      "name": "credential_member_status",
+      "schema": "public",
+      "values": ["active", "pending", "revoked"]
+    },
+    "public.credential_type": {
+      "name": "credential_type",
+      "schema": "public",
+      "values": [
+        "oauth",
+        "managed_oauth",
+        "managed_mcp",
+        "env_workspace",
+        "env_personal",
+        "service_account",
+        "personal_token"
+      ]
+    },
+    "public.data_drain_cadence": {
+      "name": "data_drain_cadence",
+      "schema": "public",
+      "values": ["hourly", "daily"]
+    },
+    "public.data_drain_destination": {
+      "name": "data_drain_destination",
+      "schema": "public",
+      "values": ["s3", "gcs", "azure_blob", "datadog", "bigquery", "snowflake", "webhook"]
+    },
+    "public.data_drain_run_status": {
+      "name": "data_drain_run_status",
+      "schema": "public",
+      "values": ["running", "success", "failed"]
+    },
+    "public.data_drain_run_trigger": {
+      "name": "data_drain_run_trigger",
+      "schema": "public",
+      "values": ["cron", "manual"]
+    },
+    "public.data_drain_source": {
+      "name": "data_drain_source",
+      "schema": "public",
+      "values": ["workflow_logs", "job_logs", "audit_logs", "copilot_chats", "copilot_runs"]
+    },
+    "public.execution_large_value_reference_source": {
+      "name": "execution_large_value_reference_source",
+      "schema": "public",
+      "values": ["execution_log", "paused_snapshot"]
+    },
+    "public.folder_resource_type": {
+      "name": "folder_resource_type",
+      "schema": "public",
+      "values": ["workflow", "file", "knowledge_base", "table"]
+    },
+    "public.invitation_kind": {
+      "name": "invitation_kind",
+      "schema": "public",
+      "values": ["organization", "workspace"]
+    },
+    "public.invitation_membership_intent": {
+      "name": "invitation_membership_intent",
+      "schema": "public",
+      "values": ["internal", "external"]
+    },
+    "public.invitation_status": {
+      "name": "invitation_status",
+      "schema": "public",
+      "values": ["pending", "accepted", "rejected", "cancelled", "expired"]
+    },
+    "public.managed_oauth_credential_status": {
+      "name": "managed_oauth_credential_status",
+      "schema": "public",
+      "values": ["active", "needs_reauth", "revoked"]
+    },
+    "public.permission_type": {
+      "name": "permission_type",
+      "schema": "public",
+      "values": ["admin", "write", "read"]
+    },
+    "public.sandbox_image_status": {
+      "name": "sandbox_image_status",
+      "schema": "public",
+      "values": ["pending", "building", "ready", "failed"]
+    },
+    "public.sandbox_language": {
+      "name": "sandbox_language",
+      "schema": "public",
+      "values": ["javascript", "python"]
+    },
+    "public.secret_usage_scope": {
+      "name": "secret_usage_scope",
+      "schema": "public",
+      "values": ["workspace", "personal"]
+    },
+    "public.secret_usage_source": {
+      "name": "secret_usage_source",
+      "schema": "public",
+      "values": ["workflow", "copilot", "mcp"]
+    },
+    "public.upload_session_method": {
+      "name": "upload_session_method",
+      "schema": "public",
+      "values": ["put", "multipart"]
+    },
+    "public.upload_session_provider": {
+      "name": "upload_session_provider",
+      "schema": "public",
+      "values": ["local", "s3", "blob", "gcs"]
+    },
+    "public.upload_session_purpose": {
+      "name": "upload_session_purpose",
+      "schema": "public",
+      "values": [
+        "workspace_file",
+        "table_import",
+        "knowledge_document",
+        "profile_picture",
+        "workspace_logo",
+        "organization_logo",
+        "mothership_attachment",
+        "execution_attachment"
+      ]
+    },
+    "public.upload_session_status": {
+      "name": "upload_session_status",
+      "schema": "public",
+      "values": [
+        "uploading",
+        "completing",
+        "finalizing",
+        "completed",
+        "aborting",
+        "aborted",
+        "failed",
+        "expired"
+      ]
+    },
+    "public.usage_log_category": {
+      "name": "usage_log_category",
+      "schema": "public",
+      "values": ["model", "fixed", "tool", "model_unbilled"]
+    },
+    "public.usage_log_source": {
+      "name": "usage_log_source",
+      "schema": "public",
+      "values": [
+        "workflow",
+        "wand",
+        "copilot",
+        "workspace-chat",
+        "mcp_copilot",
+        "mothership_block",
+        "knowledge-base",
+        "voice-input",
+        "enrichment",
+        "voice-output",
+        "api-tool"
+      ]
+    },
+    "public.workspace_file_search_index_status": {
+      "name": "workspace_file_search_index_status",
+      "schema": "public",
+      "values": ["pending", "ready", "skipped", "failed"]
+    },
+    "public.workspace_fork_promote_direction": {
+      "name": "workspace_fork_promote_direction",
+      "schema": "public",
+      "values": ["push", "pull"]
+    },
+    "public.workspace_fork_resource_type": {
+      "name": "workspace_fork_resource_type",
+      "schema": "public",
+      "values": [
+        "workflow",
+        "oauth_credential",
+        "service_account_credential",
+        "env_var",
+        "table",
+        "knowledge_base",
+        "knowledge_document",
+        "file",
+        "file_folder",
+        "mcp_server",
+        "workflow_mcp_server",
+        "custom_block",
+        "custom_tool",
+        "skill",
+        "sandbox"
+      ]
+    },
+    "public.workspace_mode": {
+      "name": "workspace_mode",
+      "schema": "public",
+      "values": ["personal", "organization", "grandfathered_shared"]
+    }
+  },
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
diff --git a/packages/db/migrations/meta/_journal.json b/packages/db/migrations/meta/_journal.json
index 89e2f336758..450ef61c1c2 100644
--- a/packages/db/migrations/meta/_journal.json
+++ b/packages/db/migrations/meta/_journal.json
@@ -2388,6 +2388,13 @@
       "when": 1789154850550,
       "tag": "0341_organization_logo_uploads",
       "breakpoints": true
+    },
+    {
+      "idx": 342,
+      "version": "7",
+      "when": 1789171419865,
+      "tag": "0342_clean_weapon_omega",
+      "breakpoints": true
     }
   ]
 }
diff --git a/packages/db/schema.ts b/packages/db/schema.ts
index 67ab4b1aa6e..07af0cf9eb9 100644
--- a/packages/db/schema.ts
+++ b/packages/db/schema.ts
@@ -3269,6 +3269,23 @@ export const embedding = pgTable(
         ef_construction: 64,
       }),
 
+    /** Permission-filtered searches traverse compact candidates, then rerank the stored vectors. */
+    embeddingBinaryHnswIdx: index('embedding_binary_hnsw_idx')
+      .using('hnsw', sql`(binary_quantize(${table.embedding})::bit(1536)) bit_hamming_ops`)
+      .with({ m: 16, ef_construction: 64 }),
+    embedding384BinaryHnswIdx: index('embedding_384_binary_hnsw_idx')
+      .using('hnsw', sql`(binary_quantize(${table.embedding384})::bit(384)) bit_hamming_ops`)
+      .with({ m: 16, ef_construction: 64 }),
+    embedding768BinaryHnswIdx: index('embedding_768_binary_hnsw_idx')
+      .using('hnsw', sql`(binary_quantize(${table.embedding768})::bit(768)) bit_hamming_ops`)
+      .with({ m: 16, ef_construction: 64 }),
+    embedding1024BinaryHnswIdx: index('embedding_1024_binary_hnsw_idx')
+      .using('hnsw', sql`(binary_quantize(${table.embedding1024})::bit(1024)) bit_hamming_ops`)
+      .with({ m: 16, ef_construction: 64 }),
+    embedding3072BinaryHnswIdx: index('embedding_3072_binary_hnsw_idx')
+      .using('hnsw', sql`(binary_quantize(${table.embedding3072})::bit(3072)) bit_hamming_ops`)
+      .with({ m: 16, ef_construction: 64 }),
+
     // Text tag indexes
     tag1Idx: index('emb_kb_tag1_lower_idx').on(table.knowledgeBaseId, sql`lower(${table.tag1})`),
     tag2Idx: index('emb_kb_tag2_lower_idx').on(table.knowledgeBaseId, sql`lower(${table.tag2})`),
diff --git a/packages/emcn/src/components/chip-modal/chip-modal.tsx b/packages/emcn/src/components/chip-modal/chip-modal.tsx
index b714d85f060..87f1b872abf 100644
--- a/packages/emcn/src/components/chip-modal/chip-modal.tsx
+++ b/packages/emcn/src/components/chip-modal/chip-modal.tsx
@@ -387,7 +387,7 @@ function ChipModalTabs({
       onChange={onChange}
       aria-label={ariaLabel}
       options={tabs.map((tab) => ({ value: tab.value, label: tab.label, icon: tab.icon }))}
-      className={className}
+      className={cn('shrink-0', className)}
     />
   )
 }
diff --git a/packages/emcn/src/components/dropdown-menu/dropdown-menu.tsx b/packages/emcn/src/components/dropdown-menu/dropdown-menu.tsx
index 87d6295f58d..8417f9e6208 100644
--- a/packages/emcn/src/components/dropdown-menu/dropdown-menu.tsx
+++ b/packages/emcn/src/components/dropdown-menu/dropdown-menu.tsx
@@ -22,9 +22,10 @@
 
 import * as React from 'react'
 import * as DropdownMenuPrimitive from '@radix-ui/react-dropdown-menu'
+import { cva, type VariantProps } from 'class-variance-authority'
 import { Check, ChevronRight, Circle, Search } from '../../icons'
 import { cn } from '../../lib/cn'
-import { chipContentGap, chipFieldSurfaceClass } from '../chip/chip-chrome'
+import { chipContentGap, chipFieldSurfaceClass, chipGeometryClass } from '../chip/chip-chrome'
 import { InsideModalContext } from '../modal/modal'
 import { OverflowText, type OverflowTextProps } from '../overflow-text/overflow-text'
 
@@ -300,64 +301,87 @@ DropdownMenuContent.displayName = DropdownMenuPrimitive.Content.displayName
  */
 export const dropdownMenuRowClass = `relative flex ${MENU_ROW_HEIGHT_CLASS} min-w-0 cursor-pointer select-none items-center ${chipContentGap} ${MENU_ROW_RADIUS_CLASS} px-2 text-[var(--text-body)] text-small outline-hidden ${MENU_ROW_TRANSITION_CLASS} data-[disabled]:pointer-events-none data-[disabled]:opacity-50 ${MENU_ROW_SINGLE_LINE_CLASS} [&_svg]:pointer-events-none [&_svg]:size-[14px] [&_svg]:shrink-0 [&_svg]:text-[var(--text-icon)]`
 
+/** Large rows match the sidebar's chip geometry without changing menu behavior. */
+export const dropdownMenuItemVariants = cva(dropdownMenuRowClass, {
+  variants: {
+    size: { default: '', lg: chipGeometryClass },
+  },
+  defaultVariants: { size: 'default' },
+})
+
 const DropdownMenuItem = React.forwardRef<
   React.ElementRef<typeof DropdownMenuPrimitive.Item>,
-  React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.Item> & {
-    inset?: boolean
-    /**
-     * Renders the row as selected — the current route, the checked value, the row
-     * whose own menu is open. Selected is a state the row *holds*, so it keeps
-     * `--surface-active` through hover rather than dimming to the hover fill.
-     *
-     * Not for a pointer/keyboard cursor: that is the row highlight, which the row
-     * already paints on its own. A menu that marks its cursor row `active` puts two
-     * selections on screen.
-     */
-    active?: boolean
-    /**
-     * Optional inline action rendered on the right edge of the item — e.g. a
-     * "more" icon button. Reveals on hover/focus of the row, and the row stays
-     * highlighted while the cursor is over the action.
-     */
-    action?: React.ReactNode
-  }
->(({ className, inset, active, action, asChild, children, ...props }, ref) => {
-  const content = asChild ? children : withOverflowLabel(children)
-  const stateClasses = active ? MENU_ROW_SELECTED_CLASS : MENU_ROW_HIGHLIGHT_CLASS
-  if (action) {
-    return (
-      <div className='group/dropdownitem relative'>
-        <DropdownMenuPrimitive.Item
-          ref={ref}
-          className={cn(
-            dropdownMenuRowClass,
-            stateClasses,
-            'pr-[28px]',
-            inset && 'pl-7',
-            className
-          )}
-          asChild={asChild}
-          {...props}
-        >
-          {content}
-        </DropdownMenuPrimitive.Item>
-        <div className='-translate-y-1/2 absolute top-1/2 right-1 flex items-center opacity-0 transition-opacity group-focus-within/dropdownitem:opacity-100 group-hover/dropdownitem:opacity-100'>
-          {action}
+  React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.Item> &
+    VariantProps<typeof dropdownMenuItemVariants> & {
+      inset?: boolean
+      /**
+       * Renders the row as selected — the current route, the checked value, the row
+       * whose own menu is open. Selected is a state the row *holds*, so it keeps
+       * `--surface-active` through hover rather than dimming to the hover fill.
+       *
+       * Not for a pointer/keyboard cursor: that is the row highlight, which the row
+       * already paints on its own. A menu that marks its cursor row `active` puts two
+       * selections on screen.
+       */
+      active?: boolean
+      /**
+       * Optional inline action rendered on the right edge of the item — e.g. a
+       * "more" icon button. Reveals on hover/focus of the row, and the row stays
+       * highlighted while the cursor is over the action.
+       */
+      action?: React.ReactNode
+      /** Idle indicator sharing the action slot so the label never shifts. */
+      actionIndicator?: React.ReactNode
+    }
+>(
+  (
+    { className, size, inset, active, action, actionIndicator, asChild, children, ...props },
+    ref
+  ) => {
+    const content = asChild ? children : withOverflowLabel(children)
+    const stateClasses = active ? MENU_ROW_SELECTED_CLASS : MENU_ROW_HIGHLIGHT_CLASS
+    if (action) {
+      return (
+        <div className='group/dropdownitem relative'>
+          <DropdownMenuPrimitive.Item
+            ref={ref}
+            className={cn(
+              dropdownMenuItemVariants({ size }),
+              stateClasses,
+              'pr-[28px]',
+              inset && 'pl-7',
+              className
+            )}
+            asChild={asChild}
+            {...props}
+          >
+            {content}
+          </DropdownMenuPrimitive.Item>
+          <div className='-translate-y-1/2 absolute top-1/2 right-1 flex items-center'>
+            {actionIndicator && (
+              <div className='pointer-events-none absolute inset-0 flex items-center justify-center group-focus-within/dropdownitem:opacity-0 group-hover/dropdownitem:opacity-0'>
+                {actionIndicator}
+              </div>
+            )}
+            <div className='flex items-center opacity-0 transition-opacity group-focus-within/dropdownitem:opacity-100 group-hover/dropdownitem:opacity-100'>
+              {action}
+            </div>
+          </div>
         </div>
-      </div>
+      )
+    }
+    return (
+      <DropdownMenuPrimitive.Item
+        ref={ref}
+        className={cn(dropdownMenuItemVariants({ size }), stateClasses, inset && 'pl-7', className)}
+        asChild={asChild}
+        {...props}
+      >
+        {content}
+      </DropdownMenuPrimitive.Item>
     )
   }
-  return (
-    <DropdownMenuPrimitive.Item
-      ref={ref}
-      className={cn(dropdownMenuRowClass, stateClasses, inset && 'pl-7', className)}
-      asChild={asChild}
-      {...props}
-    >
-      {content}
-    </DropdownMenuPrimitive.Item>
-  )
-})
+)
 DropdownMenuItem.displayName = DropdownMenuPrimitive.Item.displayName
 
 /**
diff --git a/packages/realtime-protocol/src/constants.ts b/packages/realtime-protocol/src/constants.ts
index fe6c2c87bf6..1bae03b498c 100644
--- a/packages/realtime-protocol/src/constants.ts
+++ b/packages/realtime-protocol/src/constants.ts
@@ -7,6 +7,11 @@ export const BLOCK_OPERATIONS = {
   UPDATE_ERROR_ENABLED: 'update-error-enabled',
   UPDATE_RETRY: 'update-retry',
   UPDATE_CANONICAL_MODE: 'update-canonical-mode',
+  /**
+   * No longer sent by the editor, which persists tool reindexing with
+   * `SUBBLOCK_OPERATIONS.UPDATE_WITH_CANONICAL_MODES`. Still accepted and applied so tabs loaded
+   * before that change keep saving and syncing across a rolling deploy.
+   */
   REPLACE_CANONICAL_MODES: 'replace-canonical-modes',
   TOGGLE_HANDLES: 'toggle-handles',
 } as const
@@ -62,6 +67,7 @@ export type WorkflowOperation = (typeof WORKFLOW_OPERATIONS)[keyof typeof WORKFL
 export const SUBBLOCK_OPERATIONS = {
   UPDATE: 'subblock-update',
   BATCH_UPDATE: 'subblock-batch-update',
+  UPDATE_WITH_CANONICAL_MODES: 'subblock-update-with-canonical-modes',
 } as const
 
 export type SubblockOperation = (typeof SUBBLOCK_OPERATIONS)[keyof typeof SUBBLOCK_OPERATIONS]
diff --git a/packages/realtime-protocol/src/schemas.ts b/packages/realtime-protocol/src/schemas.ts
index dd15b86af62..5de6d60397a 100644
--- a/packages/realtime-protocol/src/schemas.ts
+++ b/packages/realtime-protocol/src/schemas.ts
@@ -36,6 +36,8 @@ const AutoConnectEdgeSchema = z.object({
   type: z.string().optional(),
 })
 
+const CanonicalModeSchema = z.enum(['basic', 'advanced'])
+
 export const BlockOperationSchema = z.object({
   operation: z.enum([
     BLOCK_OPERATIONS.UPDATE_POSITION,
@@ -67,7 +69,7 @@ export const BlockOperationSchema = z.object({
     retry: BlockRetrySchema.optional(),
     horizontalHandles: z.boolean().optional(),
     canonicalId: z.string().optional(),
-    canonicalMode: z.enum(['basic', 'advanced']).optional(),
+    canonicalMode: CanonicalModeSchema.optional(),
     triggerMode: z.boolean().optional(),
     height: z.number().optional(),
   }),
@@ -168,6 +170,24 @@ export const SubblockOperationSchema = z.object({
   operationId: z.string().optional(),
 })
 
+/**
+ * Writes one subblock value and replaces its block's `canonicalModes` in the same transaction.
+ * A `tool-input` keys its tools' modes by array position, so a reorder or removal must persist
+ * both together or a failure between two separate writes leaves modes on the wrong tools.
+ */
+export const SubblockCanonicalModesUpdateSchema = z.object({
+  operation: z.literal(SUBBLOCK_OPERATIONS.UPDATE_WITH_CANONICAL_MODES),
+  target: z.literal(OPERATION_TARGETS.SUBBLOCK),
+  payload: z.object({
+    blockId: z.string(),
+    subblockId: z.string(),
+    value: z.any(),
+    canonicalModes: z.record(z.string(), CanonicalModeSchema),
+  }),
+  timestamp: z.number(),
+  operationId: z.string().optional(),
+})
+
 export const BatchAddBlocksSchema = z.object({
   operation: z.literal(BLOCKS_OPERATIONS.BATCH_ADD_BLOCKS),
   target: z.literal(OPERATION_TARGETS.BLOCKS),
@@ -285,4 +305,5 @@ export const WorkflowOperationSchema = z.union([
   VariableOperationSchema,
   WorkflowStateOperationSchema,
   SubblockOperationSchema,
+  SubblockCanonicalModesUpdateSchema,
 ])
diff --git a/scripts/check-tool-registry-boundary.baseline.json b/scripts/check-tool-registry-boundary.baseline.json
index af93cacb593..66d5fe7185f 100644
--- a/scripts/check-tool-registry-boundary.baseline.json
+++ b/scripts/check-tool-registry-boundary.baseline.json
@@ -402,16 +402,16 @@
       "gateways": {}
     },
     "app/workspace/[workspaceId]/settings/[section]/page.tsx": {
-      "modules": 2292,
+      "modules": 2348,
       "gateways": {
-        "apps/sim/app/workspace/[workspaceId]/settings/[section]/settings.tsx": 707,
+        "apps/sim/app/workspace/[workspaceId]/settings/[section]/settings.tsx": 739,
         "apps/sim/triggers/registry.ts": 485,
-        "apps/sim/lib/auth/index.ts": 366,
+        "apps/sim/lib/auth/index.ts": 378,
         "apps/sim/blocks/registry.ts": 354,
-        "apps/sim/lib/webhooks/providers/index.ts": 118,
-        "apps/sim/lib/webhooks/providers/registry.ts": 116,
-        "apps/sim/ee/access-control/components/access-control.tsx": 75,
-        "apps/sim/ee/access-control/components/group-detail.tsx": 73
+        "apps/sim/lib/webhooks/providers/index.ts": 117,
+        "apps/sim/lib/webhooks/providers/registry.ts": 115,
+        "apps/sim/app/workspace/[workspaceId]/settings/components/recently-deleted/recently-deleted.tsx": 80,
+        "apps/sim/ee/access-control/components/access-control.tsx": 75
       }
     },
     "app/workspace/[workspaceId]/settings/billing/credit-usage/layout.tsx": {