Merge branch 'feat/table-fks' into feat/reference-row-preview

# Conflicts:
#	apps/sim/app/workspace/[workspaceId]/tables/[tableId]/components/table-grid/cells/cell-content.tsx
#	apps/sim/app/workspace/[workspaceId]/tables/[tableId]/components/table-grid/data-row.tsx
#	apps/sim/app/workspace/[workspaceId]/tables/[tableId]/components/table-grid/table-grid.tsx
#	apps/sim/lib/copilot/generated/tool-catalog-v1.ts
#	apps/sim/lib/copilot/generated/tool-schemas-v1.ts
#	apps/sim/lib/table/service.test.ts

Author: j15z

.agents/skills/add-block-preview/SKILL.md

@@ -41,7 +41,7 @@ A revealed block that is not globally GA (`enabled !== true`, or env-revealed) r
    - GA via config (code cleanup pending): `{ "enabled": true }` — suffix disappears everywhere within ~30s (AppConfig TTL) + client refetch.
 
    Same runbook as `feature-flags`: edit the hosted document, `aws appconfig start-deployment` with the `sim-<env>-fast` strategy (see the infra README).
-5. **GA cleanup:** delete `preview: true` from the block (now visible to self-hosters on their next upgrade), add its `BlockMeta` + regen docs, and drop the AppConfig entry. For a v2 upgrade, this is also when v1 gets `hideFromToolbar: true` (the superseded-version paradigm).
+5. **GA cleanup:** delete `preview: true` from the block (now visible to self-hosters on their next upgrade), add its `BlockMeta` + regen docs, and drop the AppConfig entry. For a v2 upgrade, this is also when v1 gets `hideFromToolbar: true` **and** `sunset: { status: 'legacy', replacedBy: '<v2-type>' }` (the superseded-version paradigm). Both edits must land in the **same commit** as the `preview: true` removal — `check-block-registry` fails a sunset block whose `replacedBy` is still `preview`, so splitting them breaks the build in between. Also move the block's `BLOCK_DISPLAY_WORKFLOWS` entry (`apps/docs/components/workflow-preview/block-display-workflows.ts`) to the new type, or `BlockPreview` silently renders nothing on the docs page.
 
 ## Kill switch (shipped blocks)
 

.agents/skills/add-block/SKILL.md

@@ -207,6 +207,7 @@ silently available.
   id: 'channel',
   title: 'Channel',
   type: 'channel-selector',
+  selectorKey: '{service}.channels',
   serviceId: '{service}',
   placeholder: 'Select channel',
   dependsOn: ['credential'],
@@ -217,6 +218,7 @@ silently available.
   id: 'project',
   title: 'Project',
   type: 'project-selector',
+  selectorKey: '{service}.projects',
   serviceId: '{service}',
   dependsOn: ['credential'],
 }
@@ -226,6 +228,7 @@ silently available.
   id: 'file',
   title: 'File',
   type: 'file-selector',
+  selectorKey: '{service}.files',
   serviceId: '{service}',
   mimeType: 'application/pdf',
   dependsOn: ['credential'],
@@ -236,6 +239,7 @@ silently available.
   id: 'user',
   title: 'User',
   type: 'user-selector',
+  selectorKey: '{service}.users',
   serviceId: '{service}',
   dependsOn: ['credential'],
 }
@@ -691,6 +695,10 @@ export const ServiceBlock: BlockConfig = {
   type: 'service',
   name: 'Service (Legacy)',
   hideFromToolbar: true,  // Hide from toolbar
+  // Required: drives the amber legacy badge and its click-to-upgrade action.
+  // `check-block-registry` fails a legacy block with no `replacedBy`, one whose
+  // target does not exist, or one whose target is itself sunset or still `preview`.
+  sunset: { status: 'legacy', replacedBy: 'service_v2' },
   // ... rest of config
 }
 
@@ -1065,7 +1073,11 @@ After creating the block, you MUST validate it against every tool it references:
 
 A sub-block gets its choices from exactly one of two places. There is no third.
 
-**`selectorKey` — every remote list.** Register the list in `hooks/selectors/providers/<service>/selectors.ts`, add its key to `SelectorKey`, and point the sub-block at it. A selector is parameterized by an explicit `SelectorContext`, so the same definition serves the canvas, the workspace-fork sync modal, and anything added later.
+**`selectorKey` — every remote list.** Use the `add-selector` skill to add browser-safe metadata in
+`apps/sim/lib/selectors/manifest.ts`. Attach `provider-server` selectors under
+`apps/sim/lib/selectors/server/providers/` and `internal-server` selectors in
+`apps/sim/lib/selectors/server/internal.ts`. Point the sub-block at that key. All remote selectors
+execute through `selectors.execute`; never add a client provider module or selector-only fetch route.
 
 ```ts
 { id: 'triggerCredentials', type: 'oauth-input', canonicalParamId: 'oauthCredential', mode: 'trigger' },
@@ -1074,7 +1086,13 @@ A sub-block gets its choices from exactly one of two places. There is no third.
 { id: 'manualLabelIds', type: 'short-input', mode: 'trigger-advanced' },
 ```
 
-`canonicalParamId: 'oauthCredential'` on the credential sub-block is the line people forget. `buildSelectorContextFromBlock` keys the context on a sub-block's CANONICAL id, so without it `context.oauthCredential` is never set and the picker looks unfixable without reading the store. (A credential field is also recognised by its `oauth-input` TYPE as a fallback, so a block whose shipped param is already named something else does not have to rename it.)
+`canonicalParamId: 'oauthCredential'` on the credential sub-block is the line people forget. The
+shared context builder projects only active `dependsOn` values and keys canonical pairs by their
+canonical id. Exact environment references such as `{{GMAIL_CREDENTIAL_ID}}` stay unresolved in the
+browser and are resolved only by the authorized server executor. The builder does not infer a
+nonstandard credential id from `type: 'oauth-input'`; give it
+`canonicalParamId: 'oauthCredential'`, or declare an explicit manifest `sourceFields` alias when a
+legacy source id must be retained.
 
 **`options` — everything else.** A static array, or a pure function of the block's own values for a list that narrows to a sibling's selection. No I/O.
 
@@ -1089,5 +1107,6 @@ options: (params) => {
 
 Two rules the checks enforce:
 
-- **A secret never enters a selector's `getQueryKey`.** A query key identifies a resource; a credential authorizes access to it. A credential *id* is fine; a typed password is not (see `imap.mailboxes`).
+- **Selector query keys contain no context values.** This includes credential IDs, raw secrets,
+  unresolved references, and hashes of those values; the shared facade uses an opaque local revision.
 - **A sub-block that `dependsOn` a credential / knowledge-base / table selector must be reconfigurable at fork-sync time** — a `selectorKey`, a canonical pair whose basic member is a selector, or a `short-input`/`long-input`. `bun run check:fork-dependent-coverage` fails otherwise, because a fork sync clears those fields on every push and an unofferable one can never be set anywhere that sticks.

.agents/skills/add-connector/SKILL.md

@@ -197,7 +197,14 @@ Three field types are supported: `short-input`, `dropdown`, and `selector`.
 
 ## Dynamic Selectors (Canonical Pairs)
 
-Use `type: 'selector'` to fetch options dynamically from the existing selector registry (`hooks/selectors/registry.ts`). Selectors are always paired with a manual fallback input using the **canonical pair** pattern — a `selector` field (basic mode) and a `short-input` field (advanced mode) linked by `canonicalParamId`.
+Use `type: 'selector'` for a key declared in the browser-safe selector manifest at
+`apps/sim/lib/selectors/manifest.ts`. Remote selectors execute through the authorized
+`selectors.execute` server operation and a server attachment; connectors never call providers or
+resolve credentials in the browser. Apply the `add-selector` skill when the key does not exist.
+
+Selectors are paired with a manual fallback input using the **canonical pair** pattern — a
+`selector` field (basic mode) and a `short-input` field (advanced mode) linked by
+`canonicalParamId`.
 
 The user sees a toggle button (ArrowLeftRight) to switch between the selector dropdown and manual text input. On submit, the modal resolves each canonical pair to the active mode's value, keyed by `canonicalParamId`.
 
@@ -217,7 +224,7 @@ configFields: [
     id: 'baseSelector',
     title: 'Base',
     type: 'selector',
-    selectorKey: 'airtable.bases',     // Must exist in hooks/selectors/registry.ts
+    selectorKey: 'airtable.bases',     // Must exist in lib/selectors/manifest.ts
     canonicalParamId: 'baseId',
     mode: 'basic',
     placeholder: 'Select a base',
@@ -260,7 +267,9 @@ configFields: [
 
 ### Selector with domain dependency (Jira/Confluence pattern)
 
-When a selector depends on a plain `short-input` field (no canonical pair), `dependsOn` references that field's `id` directly. The `domain` field's value maps to `SelectorContext.domain` automatically via `SELECTOR_CONTEXT_FIELDS`.
+When a selector depends on a plain `short-input` field (no canonical pair), `dependsOn` references
+that field's `id` directly. Exact references such as `{{JIRA_DOMAIN}}` remain unresolved in the
+browser and are resolved only after workspace authorization on the server.
 
 ```typescript
 configFields: [
@@ -296,16 +305,16 @@ configFields: [
 
 ### How `dependsOn` maps to `SelectorContext`
 
-The connector selector field builds a `SelectorContext` from dependency values. For the mapping to work, each dependency's `canonicalParamId` (or field `id` for non-canonical fields) must exist in `SELECTOR_CONTEXT_FIELDS` (`lib/workflows/subblocks/context.ts`):
-
-```
-oauthCredential, domain, teamId, projectId, knowledgeBaseId, planId,
-siteId, collectionId, spreadsheetId, fileId, baseId, datasetId, serviceDeskId
-```
+The shared connector context builder projects only active dependencies. A canonical dependency uses
+its active basic or advanced value under `canonicalParamId`; a non-canonical dependency uses its
+field `id`. The resulting key must be a `SelectorContextKey` in
+`apps/sim/lib/selectors/types.ts` and must be explicitly allowed by that selector's manifest entry.
+The browser sends the connector's workspace scope, not the complete connector configuration.
 
 ### Available selector keys
 
-Check `hooks/selectors/types.ts` for the full `SelectorKey` union. Common ones for connectors:
+Check `apps/sim/lib/selectors/manifest.ts` for the exhaustive selector keys. Common ones for
+connectors:
 
 | SelectorKey | Context Deps | Returns |
 |-------------|-------------|---------|
@@ -607,9 +616,13 @@ export const CONNECTOR_META_REGISTRY: ConnectorMetaRegistry = {
 - [ ] **Selector fields configured correctly (if applicable):**
   - Every `type: 'selector'` field has a canonical pair (`short-input` or `dropdown` with same `canonicalParamId` and `mode: 'advanced'`)
   - `required` is identical on both fields in each canonical pair
-  - `selectorKey` exists in `hooks/selectors/registry.ts`
+  - `selectorKey` exists in `apps/sim/lib/selectors/manifest.ts`
   - `dependsOn` references selector field IDs (not `canonicalParamId`)
-  - Dependency `canonicalParamId` values exist in `SELECTOR_CONTEXT_FIELDS`
+  - Each projected dependency key is a `SelectorContextKey` allowed by the selector manifest
+  - Every remote key has one server attachment with credential provider binding and a reviewed
+    `fixed`, `credential-bound`, or `user-controlled` destination policy
+  - No connector selector adds a client provider module, browser token request, or selector-only
+    API route
 - [ ] `listDocuments` handles pagination with metadata-based content hashes
 - [ ] `syncContext.listingCapped = true` set whenever the listing is truncated (max-items cap or transient per-item error) — required to prevent the engine's deletion reconciliation from removing unseen documents
 - [ ] `contentDeferred: true` used if content requires per-doc API calls (file download, export, blocks fetch)

.agents/skills/add-integration/SKILL.md

@@ -270,15 +270,24 @@ export const {Service}Block: BlockConfig = {
 {
   id: 'project',
   type: 'project-selector',
+  selectorKey: '{service}.projects',
   dependsOn: ['credential'],
 },
 {
   id: 'issue',
   type: 'file-selector',
+  selectorKey: '{service}.issues',
   dependsOn: ['credential', 'project'],
 }
 ```
 
+Every remote `selectorKey` must use the unified server selector path. Apply the `add-selector` skill:
+add browser-safe metadata to `apps/sim/lib/selectors/manifest.ts`, reuse or extract a server-only
+provider listing primitive, and add a credential- and destination-bound server attachment. Do not
+add code under `hooks/selectors/providers`, a provider-specific query key, browser token acquisition,
+or a selector-only API route. The shared context builder sends only active `dependsOn` values and
+preserves exact `{{KEY}}` environment references for server-side resolution.
+
 **Basic/Advanced mode for dual UX:**
 ```typescript
 // Basic: Visual selector
@@ -589,7 +598,15 @@ If creating V2 versions (API-aligned outputs):
 
 1. **V2 Tools** - Add `_v2` suffix, version `2.0.0`, flat outputs
 2. **V2 Block** - Add `_v2` type, use `createVersionedToolSelector`
-3. **V1 Block** - Add `(Legacy)` to name, set `hideFromToolbar: true`
+3. **V1 Block** - Add `(Legacy)` to name, set `hideFromToolbar: true`, and add
+   `sunset: { status: 'legacy', replacedBy: '{service}_v2' }` — `check-block-registry`
+   fails a legacy block with no `replacedBy`, and the amber legacy badge plus its
+   click-to-upgrade action read from that field.
+
+   **Only add `replacedBy` once the target is GA.** The same check also fails when
+   the target is unregistered, itself sunset, or still `preview: true`. If v2 is
+   preview-gated, leave v1 alone until GA and drop `preview` in the *same commit*
+   that adds the sunset — splitting them breaks the build in between.
 4. **Registry** - Register both versions
 
 ```typescript
@@ -630,6 +647,10 @@ If creating V2 versions (API-aligned outputs):
 - [ ] Added credential field with `requiredScopes: getScopesForService('{service}')`
 - [ ] Added conditional fields per operation
 - [ ] Set up dependsOn for cascading selectors
+- [ ] Every remote `selectorKey` exists in the shared manifest and has one server attachment with
+      trusted credential provider binding and a fixed, credential-bound, or explicitly reviewed
+      user-controlled destination policy
+- [ ] No selector provider logic, credential resolution, or provider route call runs in the browser
 - [ ] Configured tools.access with all tool IDs
 - [ ] Configured tools.config.tool selector
 - [ ] Defined outputs matching tool outputs
@@ -922,7 +943,8 @@ requiredScopes: getScopesForService('{service}'),
 3. **Block type is snake_case** - `type: 'stripe'`, not `type: 'Stripe'`
 4. **Alphabetical ordering** - Keep imports and registry entries alphabetically sorted
 5. **Required can be conditional** - Use `required: { field: 'op', value: 'create' }` instead of always true
-6. **DependsOn clears options** - When a dependency changes, selector options are refetched
+6. **DependsOn clears options** - When an active dependency changes, the shared selector facade
+   refetches with an opaque query revision; dependency values and references never enter query keys
 7. **Never pass Buffer directly to fetch** - Convert to `new Uint8Array(buffer)` for TypeScript compatibility
 8. **Always handle legacy file params** - Keep hidden `fileContent` params for backwards compatibility
 9. **Optional fields use advanced mode** - Set `mode: 'advanced'` on rarely-used optional fields