windmill-components 1.655.2 → 1.665.1

package/package/components/ApiConnectForm.svelte

@@ -15,7 +15,8 @@ import GitHubAppIntegration from './GitHubAppIntegration.svelte';
 import BedrockCredentialsCheck from './BedrockCredentialsCheck.svelte';
 import { isCloudHosted } from '../cloud';
 import ResourceGen from './copilot/ResourceGen.svelte';
-let { resourceType, resourceTypeInfo, args = $bindable({}), linkedSecret = $bindable(undefined), isValid = $bindable(true), linkedSecretCandidates = undefined, description = $bindable(undefined) } = $props();
+import SyncResourceTypes from './SyncResourceTypes.svelte';
+let { resourceType, resourceTypeInfo, args = $bindable({}), linkedSecrets = $bindable([]), isValid = $bindable(true), linkedSecretCandidates = undefined, description = $bindable(undefined), onSynced = undefined } = $props();
 let schema = $state(emptySchema());
 let notFound = $state(false);
 let supabaseWizard = $state(false);
@@ -125,7 +126,7 @@ $effect(() => {
 		/>
 		<ResourceGen
 			bind:args
-			resourceType={resourceType}
+			{resourceType}
 			resourceSchema={notFound ? undefined : schema}
 			isFileset={resourceTypeInfo?.is_fileset ?? false}
 		/>
@@ -200,6 +201,7 @@ $effect(() => {
 		>No corresponding resource type found in your workspace for {resourceType}. Define the value in
 		JSON directly</p
 	>
+	<SyncResourceTypes {onSynced} />
 {/if}
 {#if notFound || viewJsonSchema}
 	{#if !emptyString(error)}<span class="text-red-400 text-xs mb-1 flex flex-row-reverse"
@@ -219,9 +221,7 @@ $effect(() => {
 		{/await}
 	</div>
 {:else if resourceTypeInfo?.is_fileset}
-	<h5 class="mt-1 inline-flex items-center gap-4">
-		Fileset
-	</h5>
+	<h5 class="mt-1 inline-flex items-center gap-4"> Fileset </h5>
 	<FilesetEditor bind:args />
 {:else if resourceTypeInfo?.format_extension}
 	<h5 class="mt-4 inline-flex items-center gap-4">
@@ -246,7 +246,7 @@ $effect(() => {
 		onlyMaskPassword
 		noDelete
 		{linkedSecretCandidates}
-		bind:linkedSecret
+		bind:linkedSecrets
 		isValid
 		{schema}
 		bind:args

package/package/components/ApiConnectForm.svelte.d.ts

@@ -3,11 +3,12 @@ interface Props {
     resourceType: string;
     resourceTypeInfo: ResourceType | undefined;
     args?: Record<string, any> | any;
-    linkedSecret?: string | undefined;
+    linkedSecrets?: string[];
     isValid?: boolean;
     linkedSecretCandidates?: string[] | undefined;
     description?: string | undefined;
+    onSynced?: () => void;
 }
-declare const ApiConnectForm: import("svelte").Component<Props, {}, "description" | "args" | "linkedSecret" | "isValid">;
+declare const ApiConnectForm: import("svelte").Component<Props, {}, "description" | "args" | "linkedSecrets" | "isValid">;
 type ApiConnectForm = ReturnType<typeof ApiConnectForm>;
 export default ApiConnectForm;

package/package/components/AppConnectDrawer.svelte

@@ -4,7 +4,7 @@ import { Button, Drawer } from './common';
 import DrawerContent from './common/drawer/DrawerContent.svelte';
 import AppConnectInner from './AppConnectInner.svelte';
 import DarkModeObserver from './DarkModeObserver.svelte';
-let { expressOAuthSetup = false } = $props();
+let { expressOAuthSetup = false, workspace = undefined, disableChatOffset = false } = $props();
 let drawer = $state();
 let resourceType = $state('');
 let step = $state(1);
@@ -36,6 +36,7 @@ run(() => {
 		dispatch('close')
 	}}
 	size="800px"
+	{disableChatOffset}
 >
 	<DrawerContent
 		title="Add a resource"
@@ -54,6 +55,7 @@ run(() => {
 			on:close={drawer?.closeDrawer}
 			on:refresh
 			express={expressOAuthSetup}
+			{workspace}
 		/>
 		{#snippet actions()}
 			<div class="flex gap-1">

package/package/components/AppConnectDrawer.svelte.d.ts

@@ -1,5 +1,7 @@
 interface Props {
     expressOAuthSetup?: boolean;
+    workspace?: string;
+    disableChatOffset?: boolean;
 }
 interface $$__sveltets_2_IsomorphicComponent<Props extends Record<string, any> = any, Events extends Record<string, any> = any, Slots extends Record<string, any> = any, Exports = {}, Bindings = string> {
     new (options: import('svelte').ComponentConstructorOptions<Props>): import('svelte').SvelteComponent<Props, Events, Slots> & {

package/package/components/AppConnectInner.svelte

@@ -1,7 +1,7 @@
 <script lang="ts">import { run } from 'svelte/legacy';
-import { superadmin, userStore, workspaceStore } from '../stores';
+import { userStore, workspaceStore } from '../stores';
 import IconedResourceType from './IconedResourceType.svelte';
-import { OauthService, ResourceService, VariableService, JobService } from '../gen';
+import { OauthService, ResourceService, VariableService } from '../gen';
 import { emptyString, truncateRev, urlize } from '../utils';
 import { createEventDispatcher, onDestroy } from 'svelte';
 import Path from './Path.svelte';
@@ -21,10 +21,10 @@ import GfmMarkdown from './GfmMarkdown.svelte';
 import { apiTokenApps, forceSecretValue, linkedSecretValue } from './app_connect';
 import Tooltip from './Tooltip.svelte';
 import TextInput from './text_input/TextInput.svelte';
-import { usePromise } from '../svelte5Utils.svelte';
-import { pollJobResult } from './jobs/utils';
 import { sameTopDomainOrigin } from '../cookies';
-let { step = $bindable(1), resourceType = $bindable(''), isGoogleSignin = $bindable(false), disabled = $bindable(false), manual = $bindable(true), express = false } = $props();
+import SyncResourceTypes from './SyncResourceTypes.svelte';
+let { step = $bindable(1), resourceType = $bindable(''), isGoogleSignin = $bindable(false), disabled = $bindable(false), manual = $bindable(true), express = false, workspace = undefined } = $props();
+let effectiveWorkspace = $derived(workspace ?? $workspaceStore);
 let isValid = $state(true);
 const nativeLanguagesCategory = [
     'postgresql',
@@ -48,12 +48,16 @@ function computeCandidates(resourceType, argsKeys, passwords) {
         : argsKeys.filter((x) => passwords.includes(x) ||
             ['token', 'secret', 'key', 'pass', 'private'].some((y) => x.toLowerCase().includes(y)));
 }
-let linkedSecret = $state(undefined);
+let linkedSecrets = $state([]);
 let linkedSecretCandidates = $state(undefined);
-function computeLinkedSecret(resourceType, argsKeys, passwords) {
+function computeDefaultLinkedSecrets(resourceType, argsKeys, passwords) {
     linkedSecretCandidates = computeCandidates(resourceType, argsKeys, passwords);
-    return (forceSecretValue(resourceType) ??
-        linkedSecretCandidates?.sort((ua, ub) => linkedSecretValue(ub) - linkedSecretValue(ua))?.[0]);
+    const forced = forceSecretValue(resourceType);
+    if (forced) {
+        return [forced];
+    }
+    const best = linkedSecretCandidates?.sort((ua, ub) => linkedSecretValue(ub) - linkedSecretValue(ua))?.[0];
+    return best ? [best] : [];
 }
 let scopes = $state([]);
 let extra_params = [];
@@ -80,6 +84,7 @@ let clientId = $state('');
 let clientSecret = $state('');
 let tokenUrl = $state('');
 let resourceTypeInfo = $state(undefined);
+let resourceTypeNotFound = $state(false);
 let pathError = $state('');
 export async function open(rt) {
     if (!rt) {
@@ -144,7 +149,7 @@ run(() => {
                         args['password'] == '' &&
                         args['api_key'] == '' &&
                         args['key'] == '' &&
-                        linkedSecret != undefined
+                        linkedSecrets.length > 0
                     : false)) ||
             step == 3 ||
             (step == 4 && pathError != '') ||
@@ -155,7 +160,7 @@ export async function loadResourceTypes() {
         return;
     }
     const availableRts = await ResourceService.listResourceTypeNames({
-        workspace: $workspaceStore
+        workspace: effectiveWorkspace
     });
     connectsManual = availableRts
         .filter((x) => connectAndManual.includes(x) || !Object.keys(connects ?? {}).includes(x))
@@ -239,22 +244,29 @@ async function getScopesAndParams() {
     supportsClientCredentials = connect.grant_types?.includes('client_credentials') ?? false;
 }
 async function getResourceTypeInfo() {
-    resourceTypeInfo = await ResourceService.getResourceType({
-        workspace: $workspaceStore,
-        path: resourceType
-    });
-    const props = resourceTypeInfo?.schema?.['properties'] ?? {};
-    const newArgsKeys = Object.keys(props).filter((x) => props?.[x]?.type == 'string') ?? [];
-    const passwords = newArgsKeys.filter((x) => {
-        return props?.[x]?.password;
-    });
-    if (!linkedSecret) {
-        linkedSecret = computeLinkedSecret(resourceType, newArgsKeys, passwords);
+    try {
+        resourceTypeNotFound = false;
+        resourceTypeInfo = await ResourceService.getResourceType({
+            workspace: effectiveWorkspace,
+            path: resourceType
+        });
+        const props = resourceTypeInfo?.schema?.['properties'] ?? {};
+        const newArgsKeys = Object.keys(props).filter((x) => props?.[x]?.type == 'string') ?? [];
+        const passwords = newArgsKeys.filter((x) => {
+            return props?.[x]?.password;
+        });
+        if (linkedSecrets.length === 0) {
+            linkedSecrets = computeDefaultLinkedSecrets(resourceType, newArgsKeys, passwords);
+        }
+    }
+    catch (err) {
+        resourceTypeInfo = undefined;
+        resourceTypeNotFound = true;
     }
 }
 export async function next() {
     if (step == 1) {
-        linkedSecret = undefined;
+        linkedSecrets = [];
         if (manual) {
             getResourceTypeInfo();
             args = {};
@@ -334,15 +346,30 @@ export async function next() {
                 return;
             throw Error('Path is not set');
         }
-        let exists = await VariableService.existsVariable({
-            workspace: $workspaceStore,
-            path
-        });
-        if (exists) {
-            throw Error(`Variable at path ${path} already exists. Delete it or pick another path`);
+        // Check if variable paths already exist
+        if (!manual || linkedSecrets.length <= 1) {
+            const exists = await VariableService.existsVariable({
+                workspace: effectiveWorkspace,
+                path
+            });
+            if (exists) {
+                throw Error(`Variable at path ${path} already exists. Delete it or pick another path`);
+            }
+        }
+        else {
+            for (const secretField of linkedSecrets) {
+                const varPath = `${path}_${secretField}`;
+                const exists = await VariableService.existsVariable({
+                    workspace: effectiveWorkspace,
+                    path: varPath
+                });
+                if (exists) {
+                    throw Error(`Variable at path ${varPath} already exists. Delete it or pick another path`);
+                }
+            }
         }
-        exists = await ResourceService.existsResource({
-            workspace: $workspaceStore,
+        let exists = await ResourceService.existsResource({
+            workspace: effectiveWorkspace,
             path
         });
         if (exists) {
@@ -365,6 +392,10 @@ export async function next() {
                 client: resourceType,
                 grant_type: valueToken.grant_type || 'authorization_code'
             };
+            // Store scopes so token refresh uses the same scopes
+            if (scopes.length > 0) {
+                accountData.scopes = scopes;
+            }
             // Add client credentials if using client_credentials flow
             if (useClientCredentials) {
                 accountData.cc_client_id = clientId.trim();
@@ -375,34 +406,76 @@ export async function next() {
                 }
             }
             account = Number(await OauthService.createAccount({
-                workspace: $workspaceStore,
+                workspace: effectiveWorkspace,
                 requestBody: accountData
             }));
         }
         const resourceValue = args;
-        let saveVariable = false;
-        if (!manual || linkedSecret != undefined) {
-            let v = manual ? args[linkedSecret ?? ''] : value;
-            if (typeof v == 'string' && v != '' && !v.startsWith('$var:')) {
-                saveVariable = true;
+        let savedVariableCount = 0;
+        if (!manual) {
+            // OAuth flow: single secret variable for the token
+            if (typeof value == 'string' && value != '' && !value.startsWith('$var:')) {
+                savedVariableCount++;
                 await VariableService.createVariable({
-                    workspace: $workspaceStore,
+                    workspace: effectiveWorkspace,
                     requestBody: {
                         path,
-                        value: v,
+                        value: value,
                         is_secret: true,
                         description: emptyString(description)
-                            ? `${manual ? 'Token' : 'OAuth token'} for ${resourceType}`
+                            ? `OAuth token for ${resourceType}`
                             : description,
-                        is_oauth: !manual,
+                        is_oauth: true,
                         account: account
                     }
                 });
-                resourceValue[linkedSecret ?? 'token'] = `$var:${path}`;
+                resourceValue['token'] = `$var:${path}`;
+            }
+        }
+        else if (linkedSecrets.length === 1) {
+            // Single secret: use the resource path as variable name (original behavior)
+            const secretField = linkedSecrets[0];
+            const v = args[secretField];
+            if (typeof v == 'string' && v != '' && !v.startsWith('$var:')) {
+                savedVariableCount++;
+                await VariableService.createVariable({
+                    workspace: effectiveWorkspace,
+                    requestBody: {
+                        path,
+                        value: v,
+                        is_secret: true,
+                        description: emptyString(description) ? `Token for ${resourceType}` : description,
+                        is_oauth: false
+                    }
+                });
+                resourceValue[secretField] = `$var:${path}`;
+            }
+        }
+        else if (linkedSecrets.length > 1) {
+            // Multiple secrets: append _field_name to each variable path
+            for (const secretField of linkedSecrets) {
+                const v = args[secretField];
+                if (typeof v == 'string' && v != '' && !v.startsWith('$var:')) {
+                    const varPath = `${path}_${secretField}`;
+                    savedVariableCount++;
+                    await VariableService.createVariable({
+                        workspace: effectiveWorkspace,
+                        requestBody: {
+                            path: varPath,
+                            value: v,
+                            is_secret: true,
+                            description: emptyString(description)
+                                ? `${secretField} for ${resourceType}`
+                                : description,
+                            is_oauth: false
+                        }
+                    });
+                    resourceValue[secretField] = `$var:${varPath}`;
+                }
             }
         }
         await ResourceService.createResource({
-            workspace: $workspaceStore,
+            workspace: effectiveWorkspace,
             requestBody: {
                 resource_type: resourceType,
                 path,
@@ -412,7 +485,7 @@ export async function next() {
         });
         dispatch('refresh', path);
         dispatch('close');
-        sendUserToast(`Saved resource${saveVariable ? ' and variable' : ''} path: ${path}`);
+        sendUserToast(`Saved resource${savedVariableCount > 0 ? ` and ${savedVariableCount} variable${savedVariableCount > 1 ? 's' : ''}` : ''} path: ${path}`);
         step = 1;
         resourceType = '';
     }
@@ -433,19 +506,6 @@ const dispatch = createEventDispatcher();
 let filteredConnects = $state([]);
 let filteredConnectsManual = $state([]);
 let editScopes = $state(false);
-let hubRtSync = usePromise(async () => {
-    let jobUuid = await JobService.runScriptByPath({
-        workspace: 'admins',
-        path: 'u/admin/hub_sync',
-        requestBody: {}
-    });
-    await pollJobResult(jobUuid, 'admins');
-    connectsManual = undefined;
-    await loadResourceTypes();
-    connects = undefined;
-    await loadConnects();
-    sendUserToast('Hub resource types sync completed');
-}, { loadInit: false });
 </script>
 
 {#if !express}
@@ -562,20 +622,16 @@ let hubRtSync = usePromise(async () => {
 				{/each}
 			{/if}
 		</div>
-		{#if $superadmin}
-			<Button
-				loading={hubRtSync.status === 'loading'}
-				onClick={() => hubRtSync.refresh()}
-				wrapperClasses="mt-6"
-			>
-				Sync resource types with Hub
-			</Button>
-			{#if hubRtSync.status === 'error'}
-				<span class="text-red-400 dark:text-red-500 text-xs">
-					Error syncing resource types : {JSON.stringify(hubRtSync.error)}
-				</span>
-			{/if}
-		{/if}
+		<div class="mt-6">
+			<SyncResourceTypes
+				onSynced={async () => {
+					connectsManual = undefined
+					await loadResourceTypes()
+					connects = undefined
+					await loadConnects()
+				}}
+			/>
+		</div>
 	{:else if step == 2 && manual}
 		<div class="flex flex-col gap-8">
 			<Path
@@ -646,15 +702,24 @@ let hubRtSync = usePromise(async () => {
 				{/if}
 			</div>
 
+			{#if resourceTypeNotFound}
+				<div class="flex flex-col gap-2 mb-4">
+					<p class="text-red-500 dark:text-red-400 text-xs">
+						Resource type '{resourceType}' not found in your workspace
+					</p>
+					<SyncResourceTypes onSynced={getResourceTypeInfo} />
+				</div>
+			{/if}
 			{#key resourceTypeInfo}
 				<ApiConnectForm
-					bind:linkedSecret
+					bind:linkedSecrets
 					bind:description
 					{linkedSecretCandidates}
 					{resourceType}
 					{resourceTypeInfo}
 					bind:args
 					bind:isValid
+					onSynced={getResourceTypeInfo}
 				/>
 			{/key}
 		</div>

package/package/components/AppConnectInner.svelte.d.ts

@@ -5,6 +5,7 @@ interface Props {
     disabled?: boolean;
     manual?: boolean;
     express?: boolean;
+    workspace?: string;
 }
 interface $$__sveltets_2_IsomorphicComponent<Props extends Record<string, any> = any, Events extends Record<string, any> = any, Slots extends Record<string, any> = any, Exports = {}, Bindings = string> {
     new (options: import('svelte').ComponentConstructorOptions<Props>): import('svelte').SvelteComponent<Props, Events, Slots> & {

package/package/components/CompareWorkspaces.svelte

@@ -1,4 +1,4 @@
-<script lang="ts">import { AlertTriangle, ArrowDown, ArrowDownRight, ArrowRight, ArrowUp, ArrowUpRight, Building, DiffIcon, GitFork, Loader2, Trash2, Upload } from 'lucide-svelte';
+<script lang="ts">import { AlertTriangle, ArrowDown, ArrowDownRight, ArrowRight, ArrowUp, ArrowUpRight, Building, DiffIcon, FileJson, GitFork, Loader2, Trash2, Upload } from 'lucide-svelte';
 import { Alert, Badge } from './common';
 import { AppService, EmailTriggerService, FlowService, FolderService, GcpTriggerService, HttpTriggerService, KafkaTriggerService, MqttTriggerService, NatsTriggerService, PostgresTriggerService, ScheduleService, ScriptService, SqsTriggerService, UserService, WebsocketTriggerService, WorkspaceService } from '../gen';
 import Button from './common/button/Button.svelte';
@@ -8,7 +8,7 @@ import DiffDrawer from './DiffDrawer.svelte';
 import DeployWorkspaceDrawer from './DeployWorkspaceDrawer.svelte';
 import ParentWorkspaceProtectionAlert from './ParentWorkspaceProtectionAlert.svelte';
 import { userWorkspaces, workspaceStore } from '../stores';
-import { deployItem, getItemValue, getOnBehalfOfEmail } from '../utils_workspace_deploy';
+import { deployItem, getItemValue, getOnBehalfOf } from '../utils_workspace_deploy';
 import Tooltip from './Tooltip.svelte';
 import OnBehalfOfSelector, { needsOnBehalfOfSelection } from './OnBehalfOfSelector.svelte';
 import { sendUserToast } from '../toast';
@@ -54,7 +54,7 @@ let summaryCache = $state({});
 // Source workspace on_behalf_of emails (keyed by workspace/kind:path)
 let onBehalfOfInfo = $state({});
 let onBehalfOfChoice = $state({});
-let customOnBehalfOfEmails = $state({});
+let customOnBehalfOf = $state({});
 let deployTargetWorkspace = $derived(mergeIntoParent ? parentWorkspaceId : currentWorkspaceId);
 function getItemKey(diff) {
     return `${diff.kind}:${diff.path}`;
@@ -69,7 +69,7 @@ async function fetchSummary(kind, path, workspace) {
             const flow = await FlowService.getFlowByPath({ workspace, path });
             return flow.summary;
         }
-        else if (kind === 'app') {
+        else if (kind === 'app' || kind === 'raw_app') {
             const app = await AppService.getAppByPath({ workspace, path });
             return app.summary;
         }
@@ -85,7 +85,7 @@ async function fetchSummary(kind, path, workspace) {
 }
 async function fetchSummaries(diffs) {
     // Only fetch summaries for scripts, flows, and apps
-    const itemsToFetch = diffs.filter((diff) => ['script', 'flow', 'app', 'folder'].includes(diff.kind));
+    const itemsToFetch = diffs.filter((diff) => ['script', 'flow', 'app', 'raw_app', 'folder'].includes(diff.kind));
     for (const diff of itemsToFetch) {
         const key = getItemKey(diff);
         // Skip if already cached or loading
@@ -106,14 +106,14 @@ async function fetchSummaries(diffs) {
     }
 }
 async function fetchOnBehalfOfInfo(diffs) {
-    const flowsAndScripts = diffs.filter((d) => ['flow', 'script', 'app'].includes(d.kind));
+    const flowsAndScripts = diffs.filter((d) => ['flow', 'script', 'app', 'raw_app'].includes(d.kind));
     for (const diff of flowsAndScripts) {
         for (const workspace of [currentWorkspaceId, parentWorkspaceId]) {
             const workspacedKey = getWorkspacedKey(workspace, getItemKey(diff));
             if (onBehalfOfInfo[workspacedKey] !== undefined)
                 continue;
             try {
-                onBehalfOfInfo[workspacedKey] = await getOnBehalfOfEmail(diff.kind, diff.path, workspace);
+                onBehalfOfInfo[workspacedKey] = await getOnBehalfOf(diff.kind, diff.path, workspace);
             }
             catch {
                 onBehalfOfInfo[workspacedKey] = undefined;
@@ -121,19 +121,19 @@ async function fetchOnBehalfOfInfo(diffs) {
         }
     }
 }
-// Get source workspace email for an item
-function getSourceEmail(itemKey) {
+// Get source workspace on_behalf_of value for an item (email for runnables, permissioned_as for triggers)
+function getSourceOnBehalfOf(itemKey) {
     const sourceWorkspace = mergeIntoParent ? currentWorkspaceId : parentWorkspaceId;
     return onBehalfOfInfo[getWorkspacedKey(sourceWorkspace, itemKey)];
 }
-// Get target workspace email for an item (existing item in destination)
-function getTargetEmail(itemKey) {
+// Get target workspace on_behalf_of value for an item (existing item in destination)
+function getTargetOnBehalfOf(itemKey) {
     const targetWorkspace = mergeIntoParent ? parentWorkspaceId : currentWorkspaceId;
     return onBehalfOfInfo[getWorkspacedKey(targetWorkspace, itemKey)];
 }
 // Check if an item needs on_behalf_of selection
 function itemNeedsOnBehalfOfSelection(itemKey, kind) {
-    return needsOnBehalfOfSelection(kind, getSourceEmail(itemKey));
+    return needsOnBehalfOfSelection(kind, getSourceOnBehalfOf(itemKey));
 }
 // Check if all required on_behalf_of selections are made
 let hasUnselectedOnBehalfOf = $derived(selectedItems.some((itemKey) => {
@@ -142,14 +142,19 @@ let hasUnselectedOnBehalfOf = $derived(selectedItems.some((itemKey) => {
         return false;
     return (itemNeedsOnBehalfOfSelection(itemKey, diff.kind) && onBehalfOfChoice[itemKey] === undefined);
 }));
-// Get the email to use for deployment based on user's choice
-function getOnBehalfOfEmailForDeploy(itemKey) {
+/**
+ * Get the on_behalf_of value for deployment based on user's choice.
+ * Returns an email for flows/scripts/apps, or permissioned_as (u/username, g/group) for triggers/schedules.
+ */
+function getOnBehalfOfForDeploy(itemKey, kind) {
     const choice = onBehalfOfChoice[itemKey];
     if (choice === 'target')
-        return getTargetEmail(itemKey);
-    if (choice === 'custom')
-        return customOnBehalfOfEmails[itemKey];
-    // 'me' or undefined = don't pass, backend will use deploying user's email
+        return getTargetOnBehalfOf(itemKey);
+    if (choice === 'custom') {
+        const details = customOnBehalfOf[itemKey];
+        return kind === 'trigger' ? details?.permissionedAs : details?.email;
+    }
+    // 'me' or undefined = don't pass, backend will use deploying user's identity
     return undefined;
 }
 let diffDrawer = $state(undefined);
@@ -198,7 +203,7 @@ async function deploy(kind, path, workspaceToDeployTo, workspaceFrom, statusPath
         path,
         workspaceFrom,
         workspaceTo: workspaceToDeployTo,
-        onBehalfOfEmail: getOnBehalfOfEmailForDeploy(statusPath)
+        onBehalfOf: getOnBehalfOfForDeploy(statusPath, kind)
     });
     if (result.success) {
         deploymentStatus[statusPath] = { status: 'deployed' };
@@ -713,7 +718,7 @@ $effect(() => {
 		{#snippet itemActions(item)}
 			{@const diff = item.diff as WorkspaceItemDiff}
 			{@const key = item.key}
-			{@const targetEmail = getTargetEmail(key)}
+			{@const targetOnBehalfOf = getTargetOnBehalfOf(key)}
 			{@const isConflict = diff.ahead > 0 && diff.behind > 0}
 			{@const existsInBothWorkspaces = !(
 				(diff.exists_in_fork && !diff.exists_in_source) ||
@@ -723,17 +728,20 @@ $effect(() => {
 			{#if itemNeedsOnBehalfOfSelection(key, diff.kind)}
 				<OnBehalfOfSelector
 					targetWorkspace={deployTargetWorkspace}
-					{targetEmail}
+					targetValue={targetOnBehalfOf}
 					selected={onBehalfOfChoice[key]}
-					onSelect={(choice, email) => {
+					onSelect={(choice, details) => {
 						onBehalfOfChoice[key] = choice
-						if (email) customOnBehalfOfEmails[key] = email
+						if (details) customOnBehalfOf[key] = details
 					}}
 					kind={diff.kind}
 					canPreserve={canPreserveOnBehalfOf}
-					customEmail={customOnBehalfOfEmails[key]}
+					customValue={customOnBehalfOf[key]?.permissionedAs}
 				/>
 			{/if}
+			{#if diff.kind === 'raw_app'}
+				<Badge small icon={{ icon: FileJson }}>Raw</Badge>
+			{/if}
 			<!-- Status badges -->
 			{#if !diff.exists_in_fork && diff.exists_in_source && diff.ahead == 0 && diff.behind > 0}
 				<Badge

package/package/components/DBManager.svelte

@@ -487,36 +487,30 @@ export const dbTable = () => _dbTable;
 						dbTableEditorState = { open: false }
 					}}
 					{dbType}
-					computePreview={({ values }) => {
+					computePreview={async ({ values }) => {
 						if (dbTableEditorState.alterTableKey && dbTableEditorAlterTableData.current) {
 							let diff = diffTableEditorValues(dbTableEditorAlterTableData.current, values)
-							let queries = dbSchemaOps.previewAlterSql({
-								values: diff,
-								schema: selected.schemaKey
-							})
+							let sql = await dbSchemaOps.previewAlterSql({ values: diff, schema: selected.schemaKey })
 							let alert = !dbSupportsTransactionalDdl(dbType)
 								? {
 										title: capitalize(dbType) + ' does not support transactional DDL',
 										body: 'Any of these statements failing may leave your database in an intermediate state.'
 									}
 								: undefined
-							return { sql: queries.join('\n'), ...(alert ? { alert } : {}) }
+							return { sql, ...(alert ? { alert } : {}) }
 						} else {
-							return { sql: dbSchemaOps.previewCreateSql({ values, schema: selected.schemaKey }) }
+							let sql = await dbSchemaOps.previewCreateSql({ values, schema: selected.schemaKey })
+							return { sql }
 						}
 					}}
 					computeBtnProps={({ values }) => {
 						if (dbTableEditorState.alterTableKey && dbTableEditorAlterTableData.current) {
 							let diff = diffTableEditorValues(dbTableEditorAlterTableData.current, values)
-							let queries = dbSchemaOps.previewAlterSql({
-								values: diff,
-								schema: selected.schemaKey
-							})
-							if (!queries.length) {
+							if (!diff.operations.length) {
 								return { text: 'No changes detected', disabled: true }
 							}
 							return {
-								text: `Alter table (${pluralize(queries.length, 'change')} detected)`
+								text: `Alter table (${pluralize(diff.operations.length, 'change')} detected)`
 							}
 						} else {
 							return { text: 'Create table' }

package/package/components/DBTable.svelte

@@ -104,8 +104,8 @@ function updateGrid() {
                         refresh?.();
                         sendUserToast('Row deleted');
                     })
-                        .catch(() => {
-                        sendUserToast('Error deleting row', true);
+                        .catch((e) => {
+                        sendUserToast(`Error deleting row: ${e?.message ?? e}`, true);
                     });
                 }
             })