diff --git a/ui/.gitignore b/ui/.gitignore
index 96fab4fed34..4405a334052 100644
--- a/ui/.gitignore
+++ b/ui/.gitignore
@@ -26,6 +26,7 @@ coverage
 out/
 build
 dist
+*.tsbuildinfo
 
 
 # Debug
diff --git a/ui/apps/pmm/package.json b/ui/apps/pmm/package.json
index 679f4ba2917..04f0043c767 100644
--- a/ui/apps/pmm/package.json
+++ b/ui/apps/pmm/package.json
@@ -30,6 +30,9 @@
     "@percona/percona-ui": "1.0.24",
     "@pmm/shared": "workspace:*",
     "@reactour/tour": "^3.8.0",
+    "@sep/api": "workspace:*",
+    "@sep/framework": "workspace:*",
+    "@sep/plugins-atw": "workspace:*",
     "@tanstack/react-query": "^5.100.7",
     "axios": "^1.13.5",
     "axios-case-converter": "^1.1.1",
@@ -44,6 +47,7 @@
     "react-markdown": "^9.0.1",
     "react-router": "^7.14.0",
     "react-router-dom": "^7.14.0",
+    "react-syntax-highlighter": "^16.1.0",
     "rehype-raw": "^7.0.0",
     "remark-gfm": "^4.0.0",
     "vite-plugin-svgr": "^5.2.0",
@@ -54,6 +58,7 @@
     "@testing-library/react": "^16.3.0",
     "@types/react": "^19.1.0",
     "@types/react-dom": "^19.1.0",
+    "@types/react-syntax-highlighter": "^15.5.13",
     "@vitejs/plugin-basic-ssl": "^2.3.0",
     "@vitejs/plugin-react-swc": "^4.3.1",
     "jsdom": "^29.1.1",
diff --git a/ui/apps/pmm/src/components/page/Page.tsx b/ui/apps/pmm/src/components/page/Page.tsx
index 029e9e3fd6b..58da10db335 100644
--- a/ui/apps/pmm/src/components/page/Page.tsx
+++ b/ui/apps/pmm/src/components/page/Page.tsx
@@ -8,9 +8,9 @@ import {
   Divider,
   GlobalStyles,
   Link,
-  Stack,
   Typography,
 } from '@mui/material';
+import { PageContainer } from '@percona/percona-ui';
 import { useUser } from 'contexts/user';
 import { Messages } from './Page.messages';
 import { PMM_HOME_URL } from 'lib/constants';
@@ -23,6 +23,7 @@ export const Page: FC<PageProps> = ({
   topBar,
   footer,
   children,
+  maxWidth,
   fullWidth,
   surface,
   roles,
@@ -30,6 +31,9 @@ export const Page: FC<PageProps> = ({
   const { user } = useUser();
   updateDocumentTitle(title);
   const hasAccess = !roles || roles?.some((role) => user?.orgRole === role);
+  // Back-compat: `fullWidth` predates `maxWidth`; treat it as `maxWidth="full"`
+  // unless an explicit `maxWidth` is provided.
+  const resolvedMaxWidth = maxWidth ?? (fullWidth ? 'full' : undefined);
 
   return (
     <>
@@ -45,24 +49,7 @@ export const Page: FC<PageProps> = ({
           })}
         />
       )}
-      <Stack
-        sx={{
-          flex: 1,
-          width: '100%',
-          maxWidth: {
-            lg: 1000,
-          },
-          p: {
-            xs: 2,
-          },
-          px: {
-            md: fullWidth ? 4 : undefined,
-          },
-          mx: 'auto',
-          gap: 2,
-          mt: 1,
-        }}
-      >
+      <PageContainer maxWidth={resolvedMaxWidth}>
         {topBar}
         {!!title && <Typography variant="h2">{title}</Typography>}
         <Box sx={{ flex: 1, display: 'flex', flexDirection: 'column' }}>
@@ -86,7 +73,7 @@ export const Page: FC<PageProps> = ({
         </Box>
         <Divider />
         {footer !== undefined ? footer : <Footer />}
-      </Stack>
+      </PageContainer>
     </>
   );
 };
diff --git a/ui/apps/pmm/src/components/page/Page.types.ts b/ui/apps/pmm/src/components/page/Page.types.ts
index 2217df28c68..b5d61d724c9 100644
--- a/ui/apps/pmm/src/components/page/Page.types.ts
+++ b/ui/apps/pmm/src/components/page/Page.types.ts
@@ -1,10 +1,20 @@
 import { PropsWithChildren, ReactNode } from 'react';
+import type { PageContainerMaxWidth } from '@percona/percona-ui';
 import { OrgRole } from 'types/user.types';
 
 export interface PageProps extends PropsWithChildren {
   title?: string;
   footer?: ReactNode;
   topBar?: ReactNode;
+  /**
+   * Max content width: a pixel number, or `'full'` for 100% width.
+   * @default 1000
+   */
+  maxWidth?: PageContainerMaxWidth;
+  /**
+   * @deprecated Use `maxWidth="full"` instead. Kept as an alias that maps to
+   * `maxWidth="full"` when `maxWidth` is not set.
+   */
   fullWidth?: boolean;
   surface?: 'default' | 'paper';
   roles?: OrgRole[];
diff --git a/ui/apps/pmm/src/components/syntax-highlighter/SyntaxHighlighter.tsx b/ui/apps/pmm/src/components/syntax-highlighter/SyntaxHighlighter.tsx
new file mode 100644
index 00000000000..ccdc51c0335
--- /dev/null
+++ b/ui/apps/pmm/src/components/syntax-highlighter/SyntaxHighlighter.tsx
@@ -0,0 +1,101 @@
+import Box from '@mui/material/Box';
+import Stack from '@mui/material/Stack';
+import IconButton from '@mui/material/IconButton';
+import ContentCopyIcon from '@mui/icons-material/ContentCopy';
+import { useTheme } from '@mui/material/styles';
+import { FC } from 'react';
+import { PrismLight as ReactSyntaxHighlighter } from 'react-syntax-highlighter';
+import { enqueueSnackbar } from 'notistack';
+import { getSyntaxHighlighterStyle } from './SyntaxHighlighter.utils';
+
+// Import only used languages to reduce bundle size
+// @ts-ignore
+import mongodb from 'react-syntax-highlighter/dist/esm/languages/prism/mongodb';
+import json from 'react-syntax-highlighter/dist/esm/languages/prism/json';
+import { SyntaxHighlighterProps } from './SyntaxHighlighter.types';
+
+ReactSyntaxHighlighter.registerLanguage('mongodb', mongodb);
+ReactSyntaxHighlighter.registerLanguage('json', json);
+
+const SyntaxHighlighter: FC<SyntaxHighlighterProps> = ({
+  language,
+  content,
+  showCopyButton = false,
+  disableBorder = false,
+  maxHeight,
+  ...props
+}) => {
+  const theme = useTheme();
+  const highlighterStyle = getSyntaxHighlighterStyle(
+    theme,
+    language,
+    showCopyButton
+  );
+
+  const handleCopy = async () => {
+    if (navigator.clipboard && window.isSecureContext) {
+      try {
+        await navigator.clipboard.writeText(content);
+        enqueueSnackbar('Query copied to clipboard', { variant: 'success' });
+      } catch (error) {
+        enqueueSnackbar('Failed to copy query to clipboard', {
+          variant: 'error',
+        });
+      }
+    } else {
+      enqueueSnackbar('Clipboard is not available', { variant: 'error' });
+    }
+  };
+
+  const highlighterBlock = (
+    <>
+      {/* @ts-ignore - react-syntax-highlighter types can be incompatible with the React version */}
+      <ReactSyntaxHighlighter
+        language={language}
+        style={highlighterStyle}
+        {...props}
+      >
+        {content}
+      </ReactSyntaxHighlighter>
+    </>
+  );
+
+  return (
+    <Stack
+      sx={{
+        overflow: 'hidden',
+        ...(!disableBorder && {
+          borderWidth: 1,
+          borderStyle: 'solid',
+          borderColor: theme.palette.divider,
+          borderRadius: Number(theme.shape.borderRadius) / 2,
+        }),
+        backgroundColor: theme.palette.surfaces?.high || 'transparent',
+        position: 'relative',
+      }}
+    >
+      {maxHeight != null ? (
+        <Box sx={{ maxHeight, overflow: 'auto', minHeight: 0 }}>
+          {highlighterBlock}
+        </Box>
+      ) : (
+        highlighterBlock
+      )}
+      {showCopyButton && (
+        <IconButton
+          sx={{
+            position: 'absolute',
+            top: theme.spacing(1.5),
+            right: theme.spacing(1.8),
+            padding: 0,
+          }}
+          onClick={handleCopy}
+        >
+          <ContentCopyIcon sx={{ width: 18, height: 18 }} color="disabled" />
+        </IconButton>
+      )}
+    </Stack>
+  );
+};
+
+export default SyntaxHighlighter;
diff --git a/ui/apps/pmm/src/components/syntax-highlighter/SyntaxHighlighter.types.ts b/ui/apps/pmm/src/components/syntax-highlighter/SyntaxHighlighter.types.ts
new file mode 100644
index 00000000000..2b8aa31d534
--- /dev/null
+++ b/ui/apps/pmm/src/components/syntax-highlighter/SyntaxHighlighter.types.ts
@@ -0,0 +1,14 @@
+import { SyntaxHighlighterProps as ReactSyntaxHighlighterProps } from 'react-syntax-highlighter';
+import { CodeLanguage } from 'types/util.types';
+
+export interface SyntaxHighlighterProps extends Omit<
+  ReactSyntaxHighlighterProps,
+  'children'
+> {
+  language: CodeLanguage;
+  content: string;
+  showCopyButton?: boolean;
+  disableBorder?: boolean;
+  /** When set, the code area scrolls inside the bordered box (e.g. "70vh") */
+  maxHeight?: string | number;
+}
diff --git a/ui/apps/pmm/src/components/syntax-highlighter/SyntaxHighlighter.utils.ts b/ui/apps/pmm/src/components/syntax-highlighter/SyntaxHighlighter.utils.ts
new file mode 100644
index 00000000000..fbeb8599d52
--- /dev/null
+++ b/ui/apps/pmm/src/components/syntax-highlighter/SyntaxHighlighter.utils.ts
@@ -0,0 +1,74 @@
+import vscDarkPlus from 'react-syntax-highlighter/dist/esm/styles/prism/vsc-dark-plus';
+import { Theme } from '@mui/material/styles';
+import { semanticTokensLight, semanticTokensDark } from '@percona/percona-ui';
+import { CodeLanguage } from 'types/util.types';
+
+export const getSyntaxHighlighterStyle = (
+  theme: Theme,
+  language: CodeLanguage,
+  showCopyButton = false
+) => {
+  const accents =
+    theme.palette.mode === 'light'
+      ? semanticTokensLight.text
+      : semanticTokensDark.text;
+
+  const tokens = {
+    fontFamily: 'Roboto Mono, monospace',
+    background: 'transparent',
+    base: language === 'text' ? theme.palette.text.primary : accents.accent1,
+    attrValue: accents.accent3,
+    string: accents.accent3,
+    number: theme.palette.text.primary,
+    property: accents.accent2,
+    function: accents.accent2,
+    operator: accents.accent3,
+    punctuation: theme.palette.text.secondary,
+  };
+
+  // Define your custom styles to override the base VSC Dark Plus colors
+  const customStyle = {
+    ...vscDarkPlus,
+    'pre[class*="language-"]': {
+      margin: 0,
+      paddingLeft: theme.spacing(2),
+      paddingRight: theme.spacing(showCopyButton ? 3.5 : 2),
+      paddingTop: theme.spacing(1),
+      paddingBottom: theme.spacing(1),
+      background: tokens.background,
+      fontFamily: tokens.fontFamily,
+      overflow: 'hidden',
+      textOverflow: 'ellipsis',
+      whiteSpace: 'nowrap',
+    },
+    'code[class*="language-"]': {
+      ...vscDarkPlus['code[class*="language-"]'],
+      background: tokens.background,
+      color: tokens.base,
+      fontFamily: tokens.fontFamily,
+    },
+    'attr-value': {
+      color: tokens.attrValue,
+    },
+    function: {
+      color: tokens.function,
+    },
+    property: {
+      color: tokens.property,
+    },
+    string: {
+      color: tokens.string,
+    },
+    number: {
+      color: tokens.number,
+    },
+    operator: {
+      color: tokens.operator,
+    },
+    punctuation: {
+      color: tokens.punctuation,
+    },
+  };
+
+  return customStyle;
+};
diff --git a/ui/apps/pmm/src/components/syntax-highlighter/index.ts b/ui/apps/pmm/src/components/syntax-highlighter/index.ts
new file mode 100644
index 00000000000..0d26a17bc15
--- /dev/null
+++ b/ui/apps/pmm/src/components/syntax-highlighter/index.ts
@@ -0,0 +1 @@
+export { default as SyntaxHighlighter } from './SyntaxHighlighter';
diff --git a/ui/apps/pmm/src/contexts/navigation/navigation.provider.tsx b/ui/apps/pmm/src/contexts/navigation/navigation.provider.tsx
index f2d979fa101..0f76d7c0b7d 100644
--- a/ui/apps/pmm/src/contexts/navigation/navigation.provider.tsx
+++ b/ui/apps/pmm/src/contexts/navigation/navigation.provider.tsx
@@ -12,6 +12,7 @@ import {
   addHighAvailability,
   addUsersAndAccess,
   addHomePage,
+  addSepApps,
 } from './navigation.utils';
 import { useUser } from 'contexts/user';
 import { useAdvisors } from 'hooks/api/useAdvisors';
@@ -89,6 +90,10 @@ export const NavigationProvider: FC<PropsWithChildren> = ({ children }) => {
 
         items.push(NAV_INVENTORY);
 
+        // SEP apps mounted as native routes (migration). Shown once the session
+        // is established; role/flag gating comes with real auth (Option B).
+        items.push(...addSepApps());
+
         if (settings.backupManagementEnabled) {
           items.push(NAV_BACKUPS);
         }
diff --git a/ui/apps/pmm/src/contexts/navigation/navigation.utils.tsx b/ui/apps/pmm/src/contexts/navigation/navigation.utils.tsx
index 62e54718f2e..f91a3cacbd7 100644
--- a/ui/apps/pmm/src/contexts/navigation/navigation.utils.tsx
+++ b/ui/apps/pmm/src/contexts/navigation/navigation.utils.tsx
@@ -1,9 +1,15 @@
+import MonitorHeartIcon from '@mui/icons-material/MonitorHeart';
+import { MySqlIcon } from '@percona/percona-ui';
 import { NavItem } from 'types/navigation.types';
 import { ServiceType } from 'types/services.types';
 import { User, UserPreferences } from 'types/user.types';
 import { Advisor } from 'types/advisors.types';
 import { groupAdvisorsIntoCategories } from 'utils/advisors.utils';
-import { PMM_NEW_NAV_GRAFANA_PATH } from 'lib/constants';
+import {
+  PMM_NEW_NAV_GRAFANA_PATH,
+  SEP_ATW_PATH,
+  SEP_MYSQL_BACKUPS_PATH,
+} from 'lib/constants';
 import { ColorMode } from '@pmm/shared';
 import {
   NAV_ACCOUNT,
@@ -291,3 +297,23 @@ export const addHomePage = (preferences?: UserPreferences): NavItem => {
 
   return NAV_HOME_PAGE;
 };
+
+// SEP apps mounted as native PMM routes (migration). Metadata (icons/labels/routes)
+// is lifted from SEP's appNavConfig as data only — no SEP nav component is used.
+// Role/flag gating arrives with real auth (Option B).
+export const addSepApps = (): NavItem[] => [
+  {
+    id: 'sep-atw',
+    text: 'Collect Diagnostic Data',
+    icon: MonitorHeartIcon,
+    url: SEP_ATW_PATH,
+    matches: [SEP_ATW_PATH],
+  },
+  {
+    id: 'sep-mysql-backups',
+    text: 'MySQL Backups',
+    icon: MySqlIcon,
+    url: SEP_MYSQL_BACKUPS_PATH,
+    matches: [SEP_MYSQL_BACKUPS_PATH],
+  },
+];
diff --git a/ui/apps/pmm/src/lib/constants.ts b/ui/apps/pmm/src/lib/constants.ts
index cc28370b528..1d8ff828bfc 100644
--- a/ui/apps/pmm/src/lib/constants.ts
+++ b/ui/apps/pmm/src/lib/constants.ts
@@ -16,6 +16,13 @@ export const PMM_DOCS_UPDATES_URL = 'https://per.co.na/pmm-upgrade';
 export const PMM_DOCS_UPDATE_CLIENT_URL = 'https://per.co.na/pmm-upgrade-agent';
 export const PMM_NEW_NAV_HOME_URL = `${PMM_NEW_NAV_PATH}/graph/d/pmm-home`;
 
+// SEP apps mounted as native PMM routes. Shared by the router (route paths and
+// each plugin's `routeBase`) and the navigation builder (`url` / `matches`), so
+// the two cannot drift: a plugin's absolute nav links resolve against
+// `routeBase`, and a mismatch silently sends them outside the mount.
+export const SEP_ATW_PATH = `${PMM_NEW_NAV_PATH}/sep/atw`;
+export const SEP_MYSQL_BACKUPS_PATH = `${PMM_NEW_NAV_PATH}/sep/mysql-backups`;
+
 export const INTERVALS_MS = {
   // 5 mins
   SERVICE_TYPES: 300000,
diff --git a/ui/apps/pmm/src/main.tsx b/ui/apps/pmm/src/main.tsx
index ac4cde9289c..9824ac111b8 100644
--- a/ui/apps/pmm/src/main.tsx
+++ b/ui/apps/pmm/src/main.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactDOM from 'react-dom/client';
 import App from './App.tsx';
+import { initSepAuth } from './sep/bootstrap';
 
 import '@fontsource/roboto/300.css';
 import '@fontsource/roboto/400.css';
@@ -13,6 +14,8 @@ import '@fontsource/poppins/600.css';
 
 import '@fontsource/roboto-mono';
 
+initSepAuth();
+
 ReactDOM.createRoot(document.getElementById('root')!).render(
   <React.StrictMode>
     <App />
diff --git a/ui/apps/pmm/src/pages/settings/Settings.tsx b/ui/apps/pmm/src/pages/settings/Settings.tsx
index 2632aba112f..9e504182ff4 100644
--- a/ui/apps/pmm/src/pages/settings/Settings.tsx
+++ b/ui/apps/pmm/src/pages/settings/Settings.tsx
@@ -40,12 +40,7 @@ export const Settings: FC = () => {
   const setTab = (value: TabValue) => navigate(`/settings/${value}`);
 
   return (
-    <Page
-      title={Messages.title}
-      fullWidth
-      surface="paper"
-      roles={[OrgRole.Admin]}
-    >
+    <Page title={Messages.title} surface="paper" roles={[OrgRole.Admin]}>
       <Stack gap={3} sx={{ flex: 1 }}>
         <Tabs
           data-testid="settings-tabs"
diff --git a/ui/apps/pmm/src/router.tsx b/ui/apps/pmm/src/router.tsx
index 23097bac786..49a556c1f2c 100644
--- a/ui/apps/pmm/src/router.tsx
+++ b/ui/apps/pmm/src/router.tsx
@@ -8,12 +8,24 @@ import { NotFoundPage } from 'pages/not-found';
 import { HelpCenter } from 'pages/help-center';
 import { RealtimeSelection } from 'pages/rta/selection';
 import Providers from 'Providers';
-import { PMM_NEW_NAV_PATH } from 'lib/constants';
+import {
+  PMM_NEW_NAV_PATH,
+  SEP_ATW_PATH,
+  SEP_MYSQL_BACKUPS_PATH,
+} from 'lib/constants';
 import { RealtimeSessionsPage } from 'pages/rta/sessions';
 import { Redirect, SettingsRedirect } from 'components/redirect';
 import RealtimeOverviewPage from 'pages/rta/overview/RealtimeOverview';
 import RealtimeTab from 'pages/rta/tab/RealtimeTab';
 import { AlertsPage } from 'pages/alerting/status';
+import { AtwApp } from '@sep/plugins-atw';
+import { SchemaDrivenPlugin } from '@sep/framework';
+import { SepPage } from './sep/SepPage';
+
+// Route paths below are relative to the `PMM_NEW_NAV_PATH` parent, while the
+// shared SEP constants are absolute (the nav and each plugin's `routeBase` need
+// them that way), so drop the parent prefix and its separator.
+const relativeToNav = (path: string) => path.slice(PMM_NEW_NAV_PATH.length + 1);
 
 const router = createBrowserRouter(
   [
@@ -75,6 +87,36 @@ const router = createBrowserRouter(
                 },
               ],
             },
+            // SEP apps mounted as native routes. Both plugins compose their own
+            // <Routes>, so the paths are splats.
+            {
+              // ATW ("Collect Diagnostic Data") is now incident-first: AtwApp
+              // composes its own <Routes> (incident list at index, workspace at
+              // :incidentId), so this must be a splat. Backend API calls hit
+              // /apps/atw and the incident / batch-execution endpoints.
+              path: `${relativeToNav(SEP_ATW_PATH)}/*`,
+              element: (
+                <SepPage>
+                  <AtwApp />
+                </SepPage>
+              ),
+            },
+            {
+              path: `${relativeToNav(SEP_MYSQL_BACKUPS_PATH)}/*`,
+              // routeBase must match the mount path (basename-stripped) so the
+              // plugin's absolute nav — detail back/edit/schedule links and the
+              // related-app (Restore) tab bar — resolves under /sep, not the
+              // SEP-default /apps/{name}. PMM_NEW_NAV_PATH is '' so this is the
+              // full path below the /pmm-ui basename.
+              element: (
+                <SepPage>
+                  <SchemaDrivenPlugin
+                    pluginName="mysql_backups"
+                    routeBase={SEP_MYSQL_BACKUPS_PATH}
+                  />
+                </SepPage>
+              ),
+            },
             // Fallback
             {
               path: 'graph/settings/:tab?',
diff --git a/ui/apps/pmm/src/sep/SepPage.tsx b/ui/apps/pmm/src/sep/SepPage.tsx
new file mode 100644
index 00000000000..9ceda00c553
--- /dev/null
+++ b/ui/apps/pmm/src/sep/SepPage.tsx
@@ -0,0 +1,36 @@
+import { FC, PropsWithChildren } from 'react';
+import Stack from '@mui/material/Stack';
+import { Page } from 'components/page';
+import { useUser } from 'contexts/user';
+import { OrgRole } from 'types/user.types';
+
+/**
+ * Shared container for SEP apps mounted as native PMM routes.
+ *
+ * Wraps a plugin (which composes its own <Routes> and renders its own
+ * heading) in the same Page + Stack chrome PMM pages use (see
+ * pages/settings/Settings.tsx), so SEP content gets the standard PMM
+ * padding, width, auth gate, and footer. No `title` is passed: the SEP
+ * plugins already render their own headings.
+ *
+ * The PMM-admin restriction is enforced here rather than left to the sidebar:
+ * NavigationProvider only *hides* the SEP entries for non-admins, while the
+ * routes still match on direct navigation. It reuses the nav's own predicate:
+ * `isPMMAdmin` is `isGrafanaAdmin || orgRole === Admin`, and `roles` (org-role
+ * only) cannot express the Grafana-admin half on its own, so it gates the
+ * remaining case and Page renders its standard unauthorized card.
+ */
+export const SepPage: FC<PropsWithChildren> = ({ children }) => {
+  const { user } = useUser();
+
+  return (
+    <Page
+      maxWidth="full"
+      roles={user?.isPMMAdmin ? undefined : [OrgRole.Admin]}
+    >
+      <Stack gap={3} sx={{ flex: 1 }}>
+        <div>{children}</div>
+      </Stack>
+    </Page>
+  );
+};
diff --git a/ui/apps/pmm/src/sep/bootstrap.ts b/ui/apps/pmm/src/sep/bootstrap.ts
new file mode 100644
index 00000000000..673acd4d977
--- /dev/null
+++ b/ui/apps/pmm/src/sep/bootstrap.ts
@@ -0,0 +1,20 @@
+import { setTokenProvider, setOnUnauthorized } from '@sep/api';
+
+/**
+ * Interim SEP auth wiring (migration Option D).
+ *
+ * SEP's axios client delegates the bearer token via `setTokenProvider`. During the
+ * migration the PMM dev proxy injects `PMM_DEV_SEP_INTERNAL_TOKEN` server-side,
+ * so the browser sends no token — the provider returns `null`. `setOnUnauthorized` is a
+ * no-op because there is no SEP login flow to redirect to (PMM owns the session).
+ *
+ * This is replaced by the token-exchange provider (Option B), which calls
+ * `postSessionExchange()` (`POST /api/oauth/session/exchange`, SEP-1692) to trade
+ * PMM's session cookie for a short-lived SEP bearer, at which point `isAdmin` also
+ * comes from the token's role claim rather than the internal token's service
+ * principal, which hardcodes `is_admin = False`.
+ */
+export const initSepAuth = () => {
+  setTokenProvider(() => null);
+  setOnUnauthorized(() => {});
+};
diff --git a/ui/apps/pmm/src/types/util.types.ts b/ui/apps/pmm/src/types/util.types.ts
index 8c700cf3a6f..cdbba235f6e 100644
--- a/ui/apps/pmm/src/types/util.types.ts
+++ b/ui/apps/pmm/src/types/util.types.ts
@@ -7,3 +7,5 @@ export type DeepPartial<T> = {
 export type SvgIconComponent = typeof SvgIcon;
 
 export type EmptyResponse = Record<string, never>;
+
+export type CodeLanguage = 'text' | 'mongodb' | 'json';
diff --git a/ui/apps/pmm/vite.config.ts b/ui/apps/pmm/vite.config.ts
index 32d07325d95..30f19a0389d 100644
--- a/ui/apps/pmm/vite.config.ts
+++ b/ui/apps/pmm/vite.config.ts
@@ -1,15 +1,57 @@
 import fs from 'fs';
 import tsconfigPaths from 'vite-tsconfig-paths';
 import react from '@vitejs/plugin-react-swc';
+import { loadEnv } from 'vite';
 import { defineConfig } from 'vitest/config';
 import svgr from 'vite-plugin-svgr';
 import basicSsl from '@vitejs/plugin-basic-ssl';
 
+// Vite exposes `.env` files to client code as `import.meta.env`, but never to
+// this config file's `process.env` — so the dev-server settings below would
+// otherwise have to be exported in whichever shell launches the dev server, and
+// silently fall back to their defaults when they are not. Load the files here so
+// a gitignored `apps/pmm/.env.local` works. A real environment variable still
+// wins, which is what CI and the devcontainer rely on.
+// Mode is pinned to 'development': every value read here configures the dev
+// server only, and `.env.local` is loaded for every mode regardless.
+const env = {
+  ...loadEnv('development', import.meta.dirname, ''),
+  ...process.env,
+};
+
 const CERT_KEY = '/srv/nginx/certificate.key';
 const CERT_CRT = '/srv/nginx/certificate.crt';
 const hasNginxCerts = fs.existsSync(CERT_KEY) && fs.existsSync(CERT_CRT);
 const port = hasNginxCerts ? 5173 : 5174;
-const target = hasNginxCerts ? 'https://localhost:8443' : 'https://localhost';
+const target =
+  env.PMM_SERVER_URL ||
+  (hasNginxCerts ? 'https://localhost:8443' : 'https://localhost');
+
+// SEP backend. The dev server proxies SEP's API paths to it so the migrated SEP
+// plugins get real data. Interim auth (Option D): if PMM_DEV_SEP_INTERNAL_TOKEN
+// is set, inject it server-side as a Bearer token so no secret reaches the
+// browser. Both variables are dev-server-only, hence the PMM_DEV_ prefix.
+// Replaced by the token-exchange provider (Option B) later — see src/sep/bootstrap.ts.
+const sepBackendUrl = env.PMM_DEV_SEP_BACKEND_URL || 'http://localhost:8000';
+const sepInternalToken = env.PMM_DEV_SEP_INTERNAL_TOKEN;
+const sepProxy = () => ({
+  target: sepBackendUrl,
+  secure: false,
+  changeOrigin: true,
+  configure: (proxy: {
+    on: (e: string, cb: (...a: unknown[]) => void) => void;
+  }) => {
+    if (!sepInternalToken) {
+      return;
+    }
+    proxy.on('proxyReq', (proxyReq: unknown) => {
+      (proxyReq as { setHeader: (k: string, v: string) => void }).setHeader(
+        'Authorization',
+        `Bearer ${sepInternalToken}`
+      );
+    });
+  },
+});
 
 // https://vitejs.dev/config/
 export default defineConfig({
@@ -61,6 +103,12 @@ export default defineConfig({
         secure: false,
         changeOrigin: true,
       },
+      // SEP backend paths (no clash with PMM's /v1 + /graph).
+      '/api': sepProxy(),
+      '/sep_app': sepProxy(),
+      '/stream-logs': sepProxy(),
+      '/execution-events': sepProxy(),
+      '/files': sepProxy(),
     },
     host: '0.0.0.0',
     port,
diff --git a/ui/packages/plugins/atw/package.json b/ui/packages/plugins/atw/package.json
new file mode 100644
index 00000000000..0cdd35dfbf4
--- /dev/null
+++ b/ui/packages/plugins/atw/package.json
@@ -0,0 +1,49 @@
+{
+  "name": "@sep/plugins-atw",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "main": "./src/index.ts",
+  "types": "./src/index.ts",
+  "scripts": {
+    "type-check": "tsc --noEmit",
+    "check-types": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "oxlint --config ../../../oxlintrc.json src",
+    "format": "oxfmt --write src"
+  },
+  "dependencies": {
+    "@sep/api": "workspace:*",
+    "@sep/framework": "workspace:*"
+  },
+  "devDependencies": {
+    "@emotion/react": "^11.11.4",
+    "@emotion/styled": "^11.11.5",
+    "@mui/icons-material": "^7.3.7",
+    "@mui/material": "^7.3.7",
+    "@tanstack/react-query": "^5.100.7",
+    "@testing-library/jest-dom": "^6.6.3",
+    "@testing-library/react": "^16.3.0",
+    "@testing-library/user-event": "^14.6.1",
+    "@types/react": "^19.1.0",
+    "@vitejs/plugin-react-swc": "^4.3.1",
+    "jsdom": "^29.1.1",
+    "notistack": "^3.0.0",
+    "react": "^19.1.0",
+    "react-dom": "^19.1.0",
+    "react-router-dom": "^7.14.0",
+    "typescript": "~6.0.3",
+    "vitest": "^4.0.0"
+  },
+  "peerDependencies": {
+    "@emotion/react": "^11.0.0",
+    "@emotion/styled": "^11.0.0",
+    "@mui/icons-material": "^7.3.7",
+    "@mui/material": "^7.3.7",
+    "@tanstack/react-query": "^5.75.0",
+    "notistack": "^3.0.0",
+    "react": "^19.0.0",
+    "react-router-dom": "^7.14.0"
+  }
+}
diff --git a/ui/packages/plugins/atw/src/AtwApp.tsx b/ui/packages/plugins/atw/src/AtwApp.tsx
new file mode 100644
index 00000000000..3c51ba541b0
--- /dev/null
+++ b/ui/packages/plugins/atw/src/AtwApp.tsx
@@ -0,0 +1,33 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { Route, Routes } from 'react-router-dom';
+import { IncidentListPage } from './IncidentListPage';
+import { IncidentWorkspacePage } from './IncidentWorkspacePage';
+
+/**
+ * ATW app router. The shell mounts this at ``atw/*``; the incident list is the
+ * index route and an incident opens its workspace at ``:incidentId``.
+ */
+export function AtwApp() {
+  return (
+    <Routes>
+      <Route index element={<IncidentListPage />} />
+      <Route path=":incidentId" element={<IncidentWorkspacePage />} />
+    </Routes>
+  );
+}
diff --git a/ui/packages/plugins/atw/src/CategoryBrowser.tsx b/ui/packages/plugins/atw/src/CategoryBrowser.tsx
new file mode 100644
index 00000000000..c0a079dc29a
--- /dev/null
+++ b/ui/packages/plugins/atw/src/CategoryBrowser.tsx
@@ -0,0 +1,198 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useEffect, useMemo, useState } from 'react';
+import {
+  Alert,
+  Box,
+  CircularProgress,
+  FormControl,
+  InputLabel,
+  MenuItem,
+  Select,
+  Stack,
+} from '@mui/material';
+import type { SelectChangeEvent } from '@mui/material/Select';
+import { useAtwCategories } from './hooks';
+import type { AtwCategoryListing, AtwSnippetSummary } from './types';
+
+export interface CategoryBrowserProps {
+  /**
+   * Called with the snippets of the currently-selected leaf category whenever
+   * the selection changes (empty until a leaf category is picked). Memoize this
+   * callback so it does not re-fire the reporting effect on every render.
+   */
+  onSnippetsChange: (snippets: AtwSnippetSummary[]) => void;
+}
+
+/**
+ * Cascading category browser (root → subcategory 1 → subcategory 2) extracted
+ * from the former single-page ATW page. The single-root case auto-selects and
+ * hides the top-level Category control; the selected leaf category's snippets
+ * are reported through `onSnippetsChange` for a caller-owned snippet picker.
+ */
+export function CategoryBrowser({ onSnippetsChange }: CategoryBrowserProps) {
+  const [selectedRoot, setSelectedRoot] = useState<string>('');
+  const [selectedParent, setSelectedParent] = useState<string>('');
+  const [selectedCategory, setSelectedCategory] = useState<string>('');
+
+  const categoriesQuery = useAtwCategories();
+
+  const rootOptions = useMemo(() => {
+    const listing = categoriesQuery.data ?? [];
+    return Array.from(
+      new Set(listing.map((item: AtwCategoryListing) => item.category_root))
+    );
+  }, [categoriesQuery.data]);
+
+  useEffect(() => {
+    if (rootOptions.length !== 1) {
+      return;
+    }
+    const only = rootOptions[0];
+    if (selectedRoot === only) {
+      return;
+    }
+    setSelectedRoot(only);
+    setSelectedParent('');
+    setSelectedCategory('');
+  }, [rootOptions, selectedRoot]);
+
+  const parentOptions = useMemo((): Array<{ value: string; label: string }> => {
+    const listing = categoriesQuery.data ?? [];
+    const seen = new Set<string>();
+    return listing
+      .filter((item: AtwCategoryListing) => item.category_root === selectedRoot)
+      .filter((item: AtwCategoryListing) => {
+        if (seen.has(item.parent_category)) {
+          return false;
+        }
+        seen.add(item.parent_category);
+        return true;
+      })
+      .map((item: AtwCategoryListing) => ({
+        value: item.parent_category,
+        label: item.parent_category_label,
+      }));
+  }, [categoriesQuery.data, selectedRoot]);
+
+  const leafListingOptions = useMemo(() => {
+    const listing = categoriesQuery.data ?? [];
+    return listing.filter(
+      (item: AtwCategoryListing) =>
+        item.category_root === selectedRoot &&
+        item.parent_category === selectedParent
+    );
+  }, [categoriesQuery.data, selectedRoot, selectedParent]);
+
+  const selectedCategoryRow = useMemo<AtwCategoryListing | null>(
+    () =>
+      leafListingOptions.find(
+        (item: AtwCategoryListing) => item.category === selectedCategory
+      ) ?? null,
+    [leafListingOptions, selectedCategory]
+  );
+
+  const availableSnippets = selectedCategoryRow?.snippets ?? EMPTY_SNIPPETS;
+
+  useEffect(() => {
+    onSnippetsChange(availableSnippets);
+  }, [availableSnippets, onSnippetsChange]);
+
+  if (categoriesQuery.isLoading) {
+    return (
+      <Box sx={{ display: 'flex', justifyContent: 'center', py: 4 }}>
+        <CircularProgress />
+      </Box>
+    );
+  }
+
+  if (categoriesQuery.error) {
+    return (
+      <Alert severity="error">
+        Failed to load ATW categories: {categoriesQuery.error.message}
+      </Alert>
+    );
+  }
+
+  return (
+    <Stack direction={{ xs: 'column', md: 'row' }} spacing={2}>
+      {rootOptions.length > 1 ? (
+        <FormControl fullWidth>
+          <InputLabel id="atw-root-label">Category</InputLabel>
+          <Select
+            labelId="atw-root-label"
+            value={selectedRoot}
+            label="Category"
+            onChange={(event: SelectChangeEvent) => {
+              setSelectedRoot(event.target.value);
+              setSelectedParent('');
+              setSelectedCategory('');
+            }}
+          >
+            {rootOptions.map((option) => (
+              <MenuItem key={option} value={option}>
+                {option}
+              </MenuItem>
+            ))}
+          </Select>
+        </FormControl>
+      ) : null}
+
+      <FormControl fullWidth>
+        <InputLabel id="atw-parent-label">Subcategory 1</InputLabel>
+        <Select
+          labelId="atw-parent-label"
+          value={selectedParent}
+          label="Subcategory 1"
+          disabled={!selectedRoot}
+          onChange={(event: SelectChangeEvent) => {
+            setSelectedParent(event.target.value);
+            setSelectedCategory('');
+          }}
+        >
+          {parentOptions.map((option) => (
+            <MenuItem key={option.value} value={option.value}>
+              {option.label}
+            </MenuItem>
+          ))}
+        </Select>
+      </FormControl>
+
+      <FormControl fullWidth disabled={!selectedRoot || !selectedParent}>
+        <InputLabel id="atw-category-label">Subcategory 2</InputLabel>
+        <Select
+          labelId="atw-category-label"
+          value={selectedCategory}
+          label="Subcategory 2"
+          onChange={(event: SelectChangeEvent) => {
+            setSelectedCategory(event.target.value);
+          }}
+        >
+          {leafListingOptions.map((row: AtwCategoryListing) => (
+            <MenuItem key={row.category} value={row.category}>
+              {row.category_label}
+            </MenuItem>
+          ))}
+        </Select>
+      </FormControl>
+    </Stack>
+  );
+}
+
+/** Stable empty reference so the reporting effect does not fire on every render. */
+const EMPTY_SNIPPETS: AtwSnippetSummary[] = [];
diff --git a/ui/packages/plugins/atw/src/CollectPane.tsx b/ui/packages/plugins/atw/src/CollectPane.tsx
new file mode 100644
index 00000000000..b48e7057b6a
--- /dev/null
+++ b/ui/packages/plugins/atw/src/CollectPane.tsx
@@ -0,0 +1,326 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useCallback, useMemo, useState } from 'react';
+import {
+  Alert,
+  Autocomplete,
+  Box,
+  CircularProgress,
+  TextField,
+  Typography,
+} from '@mui/material';
+import {
+  SchemaFormRenderer,
+  SNIPPET_FORM_RESERVED_FIELD_NAMES,
+} from '@sep/framework';
+import type { FormSection, SectionField } from '@sep/api';
+import { CategoryBrowser } from './CategoryBrowser';
+import { useAtwBatchExecute, useAtwMergedSchema } from './hooks';
+import type {
+  AtwBatchExecuteResponse,
+  AtwBatchExecuteWrite,
+  AtwSnippetSummary,
+} from './types';
+
+export interface CollectPaneProps {
+  incidentId: string;
+}
+
+/** Namespace prefix for a selected snippet's override fields, keyed by position. */
+function snippetPrefix(index: number): string {
+  return `overrides.snip${index}.`;
+}
+
+/**
+ * Prefix a field's name (and, for a one-of group, its discriminator and branch
+ * leaf names) so each snippet's override fields live in their own react-hook-form
+ * namespace. Two snippets can declare the same parameter with diverging
+ * definitions — both stay per-snippet — so bare names would collide in a single
+ * form.
+ *
+ * Field-gate predicates (`requires`/`forbidden`) reference sibling field names
+ * verbatim and are NOT rewritten here, so a gated field would silently stop
+ * gating once namespaced. ATW snippet parameters do not declare gates today;
+ * {@link fieldDeclaresGate} detects any that appear so the pane can warn loudly
+ * instead of rendering a quietly-broken form.
+ */
+export function namespaceField(
+  field: SectionField,
+  prefix: string
+): SectionField {
+  if (field.type === 'one_of') {
+    return {
+      ...field,
+      name: `${prefix}${field.name}`,
+      discriminator: `${prefix}${field.discriminator}`,
+      branches: field.branches.map((branch) => ({
+        ...branch,
+        fields: branch.fields.map((leaf) => ({
+          ...leaf,
+          name: `${prefix}${leaf.name}`,
+        })),
+      })),
+    };
+  }
+  return { ...field, name: `${prefix}${field.name}` };
+}
+
+/** Whether a field (or a one-of group's branch leaf) declares a conditional gate. */
+export function fieldDeclaresGate(field: SectionField): boolean {
+  if (field.type === 'one_of') {
+    return field.branches.some((branch) =>
+      branch.fields.some(fieldDeclaresGate)
+    );
+  }
+  return Boolean(field.requires?.length) || Boolean(field.forbidden?.length);
+}
+
+/** Drop reserved UI fields and empty optional values from an args bag. */
+function toArgs(values: Record<string, unknown>): Record<string, unknown> {
+  const args: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(values)) {
+    if (SNIPPET_FORM_RESERVED_FIELD_NAMES.has(key)) {
+      continue;
+    }
+    if (value === '' || value === undefined) {
+      continue;
+    }
+    args[key] = value;
+  }
+  return args;
+}
+
+/** Assemble the batch-execute request from the merged form's coerced values. */
+export function buildBatchPayload(
+  values: Record<string, unknown>,
+  snippets: AtwSnippetSummary[]
+): AtwBatchExecuteWrite {
+  const overrides = (values.overrides ?? {}) as Record<
+    string,
+    Record<string, unknown>
+  >;
+  const sharedValues: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(values)) {
+    if (key === 'overrides') {
+      continue;
+    }
+    sharedValues[key] = value;
+  }
+  return {
+    executor_host: String(values.executor_host ?? ''),
+    sudo: Boolean(values.sudo ?? false),
+    shared_args: toArgs(sharedValues),
+    items: snippets.map((snippet, index) => ({
+      snippet_filename: snippet.name,
+      args: toArgs(overrides[`snip${index}`] ?? {}),
+    })),
+  };
+}
+
+/** Summarise the batch response's per-item errors for a banner. */
+function batchItemErrors(response: AtwBatchExecuteResponse): string[] {
+  return response.items
+    .filter((item) => item.error !== null && item.error !== undefined)
+    .map((item) => {
+      const detail =
+        typeof item.error === 'string' ? item.error : 'validation failed';
+      return `${item.snippet_filename}: ${detail}`;
+    });
+}
+
+/**
+ * The Collect pane: browse categories to feed a snippet multi-select, render the
+ * merged execution form (a shared-parameter section plus one override card per
+ * selected snippet), and batch-execute every selection against the incident.
+ * Per-task status is polled by the Results pane's execution list.
+ */
+export function CollectPane({ incidentId }: CollectPaneProps) {
+  const [available, setAvailable] = useState<AtwSnippetSummary[]>([]);
+  const [selected, setSelected] = useState<AtwSnippetSummary[]>([]);
+  const [itemErrors, setItemErrors] = useState<string[]>([]);
+
+  const handleSnippetsChange = useCallback((snippets: AtwSnippetSummary[]) => {
+    setAvailable(snippets);
+  }, []);
+
+  const selectedNames = useMemo(
+    () => selected.map((snippet) => snippet.name),
+    [selected]
+  );
+  const schemaQuery = useAtwMergedSchema(selectedNames);
+  const batchMutation = useAtwBatchExecute(incidentId);
+
+  // Options merge the current category's snippets with the current selection so
+  // already-picked snippets from other categories still render as removable chips.
+  const options = useMemo(() => {
+    const byName = new Map<string, AtwSnippetSummary>();
+    for (const snippet of [...selected, ...available]) {
+      byName.set(snippet.name, snippet);
+    }
+    return [...byName.values()];
+  }, [available, selected]);
+
+  const sections = useMemo<FormSection[]>(() => {
+    const merged = schemaQuery.data;
+    if (!merged) {
+      return [];
+    }
+    const result: FormSection[] = [];
+    if (merged.shared.length > 0) {
+      result.push({ title: 'Shared parameters', fields: merged.shared });
+    }
+    selected.forEach((snippet, index) => {
+      const entry = merged.per_snippet.find(
+        (item) => item.snippet_filename === snippet.name
+      );
+      const fields = entry?.fields ?? [];
+      if (fields.length === 0) {
+        return;
+      }
+      result.push({
+        title: snippet.title,
+        description: snippet.description || undefined,
+        collapsible: true,
+        fields: fields.map((field) =>
+          namespaceField(field, snippetPrefix(index))
+        ),
+      });
+    });
+    return result;
+  }, [schemaQuery.data, selected]);
+
+  // Namespacing per-snippet fields does not rewrite their gate predicates, so a
+  // gated field would stop gating once namespaced. Detect any such snippet and
+  // warn loudly rather than render a quietly-broken form. ATW snippets declare
+  // no gates today, so this normally stays empty.
+  const gatedSnippetTitles = useMemo(() => {
+    const merged = schemaQuery.data;
+    if (!merged) {
+      return [];
+    }
+    return selected
+      .filter((snippet) => {
+        const entry = merged.per_snippet.find(
+          (item) => item.snippet_filename === snippet.name
+        );
+        return (entry?.fields ?? []).some(fieldDeclaresGate);
+      })
+      .map((snippet) => snippet.title);
+  }, [schemaQuery.data, selected]);
+
+  const handleSubmit = (values: Record<string, unknown>) => {
+    setItemErrors([]);
+    batchMutation.mutate(buildBatchPayload(values, selected), {
+      onSuccess: (response) => {
+        setItemErrors(batchItemErrors(response));
+      },
+    });
+  };
+
+  const submitError = batchMutation.isError
+    ? (batchMutation.error?.message ?? 'Batch execution failed')
+    : null;
+
+  // Remount the form when the selection changes so react-hook-form rebuilds its
+  // registered fields and defaults for the new merged schema.
+  const formKey = selectedNames.join('|');
+
+  return (
+    <Box>
+      <Typography variant="h6" sx={{ mb: 2 }}>
+        Collect
+      </Typography>
+
+      <CategoryBrowser onSnippetsChange={handleSnippetsChange} />
+
+      <Autocomplete
+        multiple
+        sx={{ mt: 3 }}
+        options={options}
+        value={selected}
+        onChange={(_event, value) => {
+          setSelected(value);
+          // The stale batch-result banner belongs to the previous selection.
+          setItemErrors([]);
+        }}
+        getOptionLabel={(option) => option.title}
+        isOptionEqualToValue={(option, value) => option.name === value.name}
+        renderInput={(params) => (
+          <TextField
+            {...params}
+            label="Snippets"
+            placeholder={
+              selected.length === 0 ? 'Select snippets to run' : undefined
+            }
+          />
+        )}
+      />
+
+      {selected.length === 0 && (
+        <Alert severity="info" sx={{ mt: 3 }}>
+          Browse a category and select one or more snippets to build the
+          execution form.
+        </Alert>
+      )}
+
+      {selected.length > 0 && schemaQuery.isLoading && (
+        <Box sx={{ display: 'flex', justifyContent: 'center', py: 4 }}>
+          <CircularProgress />
+        </Box>
+      )}
+
+      {selected.length > 0 && schemaQuery.error && (
+        <Alert severity="error" sx={{ mt: 3 }}>
+          Failed to load execution form: {schemaQuery.error.message}
+        </Alert>
+      )}
+
+      {gatedSnippetTitles.length > 0 && (
+        <Alert severity="warning" sx={{ mt: 3 }}>
+          These snippets use conditional (required/forbidden) fields, which
+          batch collection does not evaluate — review their inputs before
+          executing: {gatedSnippetTitles.join(', ')}.
+        </Alert>
+      )}
+
+      {itemErrors.length > 0 && (
+        <Alert severity="warning" sx={{ mt: 3 }}>
+          Some snippets did not dispatch:
+          <Box component="ul" sx={{ m: 0, pl: 2 }}>
+            {itemErrors.map((message) => (
+              <li key={message}>{message}</li>
+            ))}
+          </Box>
+        </Alert>
+      )}
+
+      {selected.length > 0 && schemaQuery.data && (
+        <Box sx={{ mt: 3 }}>
+          <SchemaFormRenderer
+            key={formKey}
+            sections={sections}
+            onSubmit={handleSubmit}
+            submitLabel="Execute batch"
+            loading={batchMutation.isPending}
+            submitError={submitError}
+          />
+        </Box>
+      )}
+    </Box>
+  );
+}
diff --git a/ui/packages/plugins/atw/src/IncidentListPage.tsx b/ui/packages/plugins/atw/src/IncidentListPage.tsx
new file mode 100644
index 00000000000..97817b9aead
--- /dev/null
+++ b/ui/packages/plugins/atw/src/IncidentListPage.tsx
@@ -0,0 +1,352 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useEffect, useState } from 'react';
+import {
+  Alert,
+  Box,
+  Button,
+  CircularProgress,
+  Dialog,
+  DialogActions,
+  DialogContent,
+  DialogContentText,
+  DialogTitle,
+  IconButton,
+  Link as MuiLink,
+  Stack,
+  TablePagination,
+  TextField,
+  Tooltip,
+  Typography,
+} from '@mui/material';
+import AddIcon from '@mui/icons-material/Add';
+import DeleteOutlineIcon from '@mui/icons-material/DeleteOutline';
+import EditOutlinedIcon from '@mui/icons-material/EditOutlined';
+import { Link } from 'react-router-dom';
+import {
+  ATW_PAGE_SIZE,
+  useAtwIncidents,
+  useCreateAtwIncident,
+  useDeleteAtwIncident,
+  useUpdateAtwIncident,
+} from './hooks';
+import type { AtwIncident } from './types';
+
+/**
+ * Landing page rendered at ``/atw``: the incident list. Supports creating an
+ * incident (optional name — the server defaults it to a timestamp), renaming,
+ * deleting, and opening one into its workspace.
+ */
+export function IncidentListPage() {
+  const [page, setPage] = useState({ offset: 0, limit: ATW_PAGE_SIZE });
+  const { data, isLoading, error } = useAtwIncidents(page);
+  const incidents = data?.items;
+  const createMutation = useCreateAtwIncident();
+  const updateMutation = useUpdateAtwIncident();
+  const deleteMutation = useDeleteAtwIncident();
+
+  useEffect(() => {
+    if (data && data.total > 0 && data.offset >= data.total) {
+      setPage((previous) => ({
+        offset: Math.max(
+          0,
+          (Math.ceil(data.total / previous.limit) - 1) * previous.limit
+        ),
+        limit: previous.limit,
+      }));
+    }
+  }, [data]);
+
+  const [createOpen, setCreateOpen] = useState(false);
+  const [createName, setCreateName] = useState('');
+  const [renameTarget, setRenameTarget] = useState<AtwIncident | null>(null);
+  const [renameValue, setRenameValue] = useState('');
+  const [deleteTarget, setDeleteTarget] = useState<AtwIncident | null>(null);
+
+  const handleCreate = () => {
+    const name = createName.trim();
+    createMutation.mutate(name ? { name } : {}, {
+      onSuccess: () => {
+        setCreateOpen(false);
+        setCreateName('');
+      },
+    });
+  };
+
+  const handleRename = () => {
+    if (!renameTarget) {
+      return;
+    }
+    const name = renameValue.trim();
+    if (!name) {
+      return;
+    }
+    updateMutation.mutate(
+      { incidentId: renameTarget.id, body: { name } },
+      { onSuccess: () => setRenameTarget(null) }
+    );
+  };
+
+  const handleDelete = () => {
+    if (!deleteTarget) {
+      return;
+    }
+    deleteMutation.mutate(deleteTarget.id, {
+      onSuccess: () => setDeleteTarget(null),
+    });
+  };
+
+  return (
+    <Box>
+      <Stack
+        direction="row"
+        alignItems="center"
+        justifyContent="space-between"
+        sx={{ mb: 1 }}
+      >
+        <Typography variant="h4">Collect Diagnostic Data</Typography>
+        <Button
+          variant="contained"
+          startIcon={<AddIcon />}
+          onClick={() => {
+            createMutation.reset();
+            setCreateName('');
+            setCreateOpen(true);
+          }}
+        >
+          New incident
+        </Button>
+      </Stack>
+      <Typography variant="body2" color="text.secondary" sx={{ mb: 3 }}>
+        Open an incident to run diagnostic snippets and review their results in
+        one place.
+      </Typography>
+
+      {isLoading && (
+        <Box sx={{ display: 'flex', justifyContent: 'center', py: 8 }}>
+          <CircularProgress />
+        </Box>
+      )}
+
+      {error && (
+        <Alert severity="error">
+          Failed to load incidents: {error.message}
+        </Alert>
+      )}
+
+      {!isLoading && !error && (!incidents || incidents.length === 0) && (
+        <Alert severity="info">
+          No incidents yet. Create one to get started.
+        </Alert>
+      )}
+
+      {incidents && incidents.length > 0 && (
+        <Stack spacing={1}>
+          {incidents.map((incident) => (
+            <Box
+              key={incident.id}
+              sx={{
+                display: 'flex',
+                alignItems: 'center',
+                gap: 1,
+                p: 1.5,
+                border: 1,
+                borderColor: 'divider',
+                borderRadius: 1,
+              }}
+            >
+              <Box sx={{ flexGrow: 1, minWidth: 0 }}>
+                <MuiLink component={Link} to={incident.id} variant="subtitle1">
+                  {incident.name}
+                </MuiLink>
+                <Typography
+                  variant="caption"
+                  color="text.secondary"
+                  display="block"
+                >
+                  {incident.case_ref ? `Case ${incident.case_ref} · ` : ''}
+                  Created by {incident.created_by}
+                </Typography>
+              </Box>
+              <Tooltip title="Rename">
+                <IconButton
+                  aria-label={`Rename ${incident.name}`}
+                  onClick={() => {
+                    updateMutation.reset();
+                    setRenameTarget(incident);
+                    setRenameValue(incident.name);
+                  }}
+                >
+                  <EditOutlinedIcon fontSize="small" />
+                </IconButton>
+              </Tooltip>
+              <Tooltip title="Delete">
+                <IconButton
+                  aria-label={`Delete ${incident.name}`}
+                  onClick={() => {
+                    deleteMutation.reset();
+                    setDeleteTarget(incident);
+                  }}
+                >
+                  <DeleteOutlineIcon fontSize="small" />
+                </IconButton>
+              </Tooltip>
+            </Box>
+          ))}
+        </Stack>
+      )}
+
+      {data && data.total > data.limit && (
+        <TablePagination
+          component="div"
+          count={data.total}
+          page={Math.floor(data.offset / Math.max(data.limit, 1))}
+          rowsPerPage={data.limit}
+          onPageChange={(_event, newPage) =>
+            setPage((previous) => ({
+              offset: newPage * previous.limit,
+              limit: previous.limit,
+            }))
+          }
+          rowsPerPageOptions={[ATW_PAGE_SIZE]}
+        />
+      )}
+
+      {/* Create */}
+      <Dialog
+        open={createOpen}
+        onClose={() => setCreateOpen(false)}
+        fullWidth
+        maxWidth="sm"
+        aria-labelledby="atw-create-incident-title"
+      >
+        <DialogTitle id="atw-create-incident-title">New incident</DialogTitle>
+        <DialogContent>
+          {createMutation.isError && (
+            <Alert severity="error" sx={{ mb: 2 }}>
+              {createMutation.error?.message ?? 'Failed to create incident'}
+            </Alert>
+          )}
+          <TextField
+            autoFocus
+            fullWidth
+            margin="dense"
+            label="Name (optional)"
+            helperText="Leave blank to use a timestamped default."
+            value={createName}
+            onChange={(event) => setCreateName(event.target.value)}
+            onKeyDown={(event) => {
+              if (event.key === 'Enter') {
+                event.preventDefault();
+                handleCreate();
+              }
+            }}
+          />
+        </DialogContent>
+        <DialogActions>
+          <Button onClick={() => setCreateOpen(false)}>Cancel</Button>
+          <Button
+            variant="contained"
+            onClick={handleCreate}
+            loading={createMutation.isPending}
+          >
+            Create
+          </Button>
+        </DialogActions>
+      </Dialog>
+
+      {/* Rename */}
+      <Dialog
+        open={renameTarget !== null}
+        onClose={() => setRenameTarget(null)}
+        fullWidth
+        maxWidth="sm"
+        aria-labelledby="atw-rename-incident-title"
+      >
+        <DialogTitle id="atw-rename-incident-title">
+          Rename incident
+        </DialogTitle>
+        <DialogContent>
+          {updateMutation.isError && (
+            <Alert severity="error" sx={{ mb: 2 }}>
+              {updateMutation.error?.message ?? 'Failed to rename incident'}
+            </Alert>
+          )}
+          <TextField
+            autoFocus
+            fullWidth
+            margin="dense"
+            label="Name"
+            value={renameValue}
+            onChange={(event) => setRenameValue(event.target.value)}
+            onKeyDown={(event) => {
+              if (event.key === 'Enter') {
+                event.preventDefault();
+                handleRename();
+              }
+            }}
+          />
+        </DialogContent>
+        <DialogActions>
+          <Button onClick={() => setRenameTarget(null)}>Cancel</Button>
+          <Button
+            variant="contained"
+            onClick={handleRename}
+            loading={updateMutation.isPending}
+            disabled={renameValue.trim().length === 0}
+          >
+            Save
+          </Button>
+        </DialogActions>
+      </Dialog>
+
+      {/* Delete */}
+      <Dialog
+        open={deleteTarget !== null}
+        onClose={() => setDeleteTarget(null)}
+        aria-labelledby="atw-delete-incident-title"
+      >
+        <DialogTitle id="atw-delete-incident-title">
+          Delete incident
+        </DialogTitle>
+        <DialogContent>
+          {deleteMutation.isError && (
+            <Alert severity="error" sx={{ mb: 2 }}>
+              {deleteMutation.error?.message ?? 'Failed to delete incident'}
+            </Alert>
+          )}
+          <DialogContentText>
+            Delete “{deleteTarget?.name}”? Its recorded executions are removed.
+            This cannot be undone.
+          </DialogContentText>
+        </DialogContent>
+        <DialogActions>
+          <Button onClick={() => setDeleteTarget(null)}>Cancel</Button>
+          <Button
+            color="error"
+            variant="contained"
+            onClick={handleDelete}
+            loading={deleteMutation.isPending}
+          >
+            Delete
+          </Button>
+        </DialogActions>
+      </Dialog>
+    </Box>
+  );
+}
diff --git a/ui/packages/plugins/atw/src/IncidentWorkspacePage.tsx b/ui/packages/plugins/atw/src/IncidentWorkspacePage.tsx
new file mode 100644
index 00000000000..a58d944339c
--- /dev/null
+++ b/ui/packages/plugins/atw/src/IncidentWorkspacePage.tsx
@@ -0,0 +1,98 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import {
+  Alert,
+  Box,
+  CircularProgress,
+  Link as MuiLink,
+  Paper,
+  Typography,
+} from '@mui/material';
+import { useNavigate, useParams } from 'react-router-dom';
+import { CollectPane } from './CollectPane';
+import { ResultsPane } from './ResultsPane';
+import { useAtwIncident } from './hooks';
+
+/**
+ * Incident workspace rendered at ``/atw/:incidentId``. Two side-by-side panes —
+ * Collect (browse, select, and batch-execute snippets) and Results (each
+ * execution's status, logs, and file listing) — stacked on narrow screens.
+ */
+export function IncidentWorkspacePage() {
+  const { incidentId } = useParams<{ incidentId: string }>();
+  const navigate = useNavigate();
+  const { data: incident, isLoading, error } = useAtwIncident(incidentId);
+
+  if (!incidentId) {
+    return null;
+  }
+
+  return (
+    <Box>
+      <MuiLink
+        component="button"
+        type="button"
+        onClick={() => navigate('..')}
+        sx={{ mb: 2, display: 'inline-block' }}
+      >
+        ← Back to incidents
+      </MuiLink>
+
+      {isLoading && (
+        <Box sx={{ display: 'flex', justifyContent: 'center', py: 4 }}>
+          <CircularProgress />
+        </Box>
+      )}
+
+      {error && (
+        <Alert severity="error" sx={{ mb: 2 }}>
+          Failed to load incident: {error.message}
+        </Alert>
+      )}
+
+      <Typography variant="h4" sx={{ mb: 0.5 }}>
+        {incident?.name ?? 'Incident'}
+      </Typography>
+      {incident?.case_ref && (
+        <Typography variant="body2" color="text.secondary" sx={{ mb: 3 }}>
+          Case reference: {incident.case_ref}
+        </Typography>
+      )}
+
+      <Box
+        sx={{
+          mt: 1,
+          display: 'grid',
+          gap: 2,
+          gridTemplateColumns: {
+            xs: 'minmax(0, 1fr)',
+            md: 'repeat(2, minmax(0, 1fr))',
+          },
+          alignItems: 'start',
+        }}
+      >
+        <Paper variant="outlined" sx={{ p: 2 }}>
+          <CollectPane incidentId={incidentId} />
+        </Paper>
+        <Paper variant="outlined" sx={{ p: 2 }}>
+          <ResultsPane incidentId={incidentId} />
+        </Paper>
+      </Box>
+    </Box>
+  );
+}
diff --git a/ui/packages/plugins/atw/src/ResultsPane.tsx b/ui/packages/plugins/atw/src/ResultsPane.tsx
new file mode 100644
index 00000000000..b9662692e46
--- /dev/null
+++ b/ui/packages/plugins/atw/src/ResultsPane.tsx
@@ -0,0 +1,622 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useEffect, useMemo, useState } from 'react';
+import {
+  Accordion,
+  AccordionDetails,
+  AccordionSummary,
+  Alert,
+  Box,
+  Button,
+  Checkbox,
+  Chip,
+  CircularProgress,
+  Divider,
+  Paper,
+  Stack,
+  TablePagination,
+  Tooltip,
+  Typography,
+} from '@mui/material';
+import ExpandMoreIcon from '@mui/icons-material/ExpandMore';
+import FolderOpenIcon from '@mui/icons-material/FolderOpen';
+import SendIcon from '@mui/icons-material/Send';
+import {
+  TaskFilesDialog,
+  TaskHistoryStatusBadge,
+  TaskLogViewer,
+  isTaskHistoryStatus,
+} from '@sep/framework';
+import {
+  ATW_PAGE_SIZE,
+  sendJobDetail,
+  useAtwConfig,
+  useAtwIncident,
+  useAtwIncidentExecutions,
+  useAtwSendJobs,
+} from './hooks';
+import { SendDialog } from './SendDialog';
+import type {
+  AtwIncidentExecution,
+  AtwSendLog,
+  AtwSendLogExecution,
+} from './types';
+
+export interface ResultsPaneProps {
+  incidentId: string;
+}
+
+/** What a Re-send replays: the attempt's own executions and case reference. */
+interface ResendContext {
+  executions: AtwSendLogExecution[];
+  caseRef: string;
+}
+
+/**
+ * Task statuses whose execution is finished and therefore sendable.
+ *
+ * Mirrors the backend's own `TaskHistoryStatusEnum.is_finished()`; typing it
+ * against the generated status union keeps a renamed or added status a compile
+ * error rather than a silently unselectable row.
+ */
+const FINISHED_TASK_STATUSES: ReadonlySet<
+  NonNullable<AtwIncidentExecution['task_status']>
+> = new Set(['success', 'failed', 'stopped', 'stale']);
+
+const SEND_STATUS_COLORS = {
+  success: 'success',
+  failed: 'error',
+  running: 'info',
+  pending: 'default',
+} as const;
+
+function isSelectable(execution: AtwIncidentExecution): boolean {
+  const status = execution.task_status;
+  return (
+    status !== null &&
+    status !== undefined &&
+    FINISHED_TASK_STATUSES.has(status)
+  );
+}
+
+/**
+ * The Results pane: lists the incident's executions with their status, logs and
+ * files, and lets a support engineer send a selection to the support case.
+ *
+ * Selection is keyed by execution id and held above the row list, so it survives
+ * a page flip — deriving it from the rendered rows would silently drop anything
+ * chosen on an earlier page.
+ */
+export function ResultsPane({ incidentId }: ResultsPaneProps) {
+  const [page, setPage] = useState({ offset: 0, limit: ATW_PAGE_SIZE });
+  const { data, isLoading, error } = useAtwIncidentExecutions(incidentId, page);
+  const { data: incident } = useAtwIncident(incidentId);
+  const { data: config } = useAtwConfig();
+  const { data: sendJobs, error: sendJobsError } = useAtwSendJobs(incidentId);
+
+  const [filesForTask, setFilesForTask] = useState<number | null>(null);
+  const [selectedIds, setSelectedIds] = useState<Set<string>>(new Set());
+  const [sendOpen, setSendOpen] = useState(false);
+  const [sendSessionKey, setSendSessionKey] = useState(0);
+  const [resend, setResend] = useState<ResendContext | null>(null);
+
+  useEffect(() => {
+    if (data && data.total > 0 && data.offset >= data.total) {
+      setPage((previous) => ({
+        offset: Math.max(
+          0,
+          (Math.ceil(data.total / previous.limit) - 1) * previous.limit
+        ),
+        limit: previous.limit,
+      }));
+    }
+  }, [data]);
+
+  const rows = data?.items;
+  const knownExecutions = useMemo(() => {
+    const map = new Map<string, AtwSendLogExecution>();
+    for (const execution of rows ?? []) {
+      map.set(execution.id, {
+        id: execution.id,
+        task_history_id: execution.task_history_id,
+        snippet_filename: execution.snippet_filename,
+      });
+    }
+    return map;
+  }, [rows]);
+
+  const [selectionLabels, setSelectionLabels] = useState<
+    Map<string, AtwSendLogExecution>
+  >(new Map());
+
+  const toggleSelected = (execution: AtwIncidentExecution) => {
+    setSelectedIds((previous) => {
+      const next = new Set(previous);
+      if (next.has(execution.id)) {
+        next.delete(execution.id);
+      } else {
+        next.add(execution.id);
+      }
+      return next;
+    });
+    setSelectionLabels((previous) => {
+      const next = new Map(previous);
+      next.set(execution.id, {
+        id: execution.id,
+        task_history_id: execution.task_history_id,
+        snippet_filename: execution.snippet_filename,
+      });
+      return next;
+    });
+  };
+
+  /**
+   * The finished executions on the page currently rendered.
+   *
+   * Reusing `isSelectable` is what keeps the header toggle and the row
+   * checkboxes from ever disagreeing about which rows are eligible.
+   */
+  const selectablePageIds = useMemo(
+    () => (rows ?? []).filter(isSelectable).map((execution) => execution.id),
+    [rows]
+  );
+
+  const selectedPageCount = selectablePageIds.filter((id) =>
+    selectedIds.has(id)
+  ).length;
+  const allPageSelected =
+    selectablePageIds.length > 0 &&
+    selectedPageCount === selectablePageIds.length;
+  const somePageSelected = selectedPageCount > 0 && !allPageSelected;
+
+  /**
+   * Select or deselect the page's finished executions in one action.
+   *
+   * Deselection removes only this page's ids: the selection deliberately
+   * outlives a page flip, so clearing the whole set would drop rows chosen on
+   * another page.
+   */
+  const toggleSelectAllOnPage = () => {
+    const deselecting = allPageSelected;
+    setSelectedIds((previous) => {
+      const next = new Set(previous);
+      for (const id of selectablePageIds) {
+        if (deselecting) {
+          next.delete(id);
+        } else {
+          next.add(id);
+        }
+      }
+      return next;
+    });
+    if (deselecting) {
+      return;
+    }
+    // Mirror the labels the send dialog needs, so a row the user later pages
+    // away from still names itself. `knownExecutions` already holds them in the
+    // shape `toggleSelected` writes.
+    setSelectionLabels((previous) => {
+      const next = new Map(previous);
+      for (const id of selectablePageIds) {
+        const execution = knownExecutions.get(id);
+        if (execution) {
+          next.set(id, execution);
+        }
+      }
+      return next;
+    });
+  };
+
+  const selectedExecutions = [...selectedIds]
+    .map((id) => knownExecutions.get(id) ?? selectionLabels.get(id))
+    .filter(
+      (execution): execution is AtwSendLogExecution => execution !== undefined
+    );
+
+  const disabledReasons = config?.send_disabled_reasons ?? [];
+  const sendDisabled =
+    selectedExecutions.length === 0 || disabledReasons.length > 0;
+  const sendTooltip = disabledReasons.length
+    ? disabledReasons.join('; ')
+    : selectedExecutions.length === 0
+      ? 'Select one or more finished executions to send.'
+      : '';
+
+  const openSend = (context: ResendContext | null) => {
+    setResend(context);
+    setSendSessionKey((previous) => previous + 1);
+    setSendOpen(true);
+  };
+
+  const closeSend = (started: boolean) => {
+    setSendOpen(false);
+    if (started && resend === null) {
+      setSelectedIds(new Set());
+      setSelectionLabels(new Map());
+    }
+  };
+
+  return (
+    <Box>
+      <Typography variant="h6" sx={{ mb: 2 }}>
+        Results
+      </Typography>
+
+      {isLoading && (
+        <Box sx={{ display: 'flex', justifyContent: 'center', py: 4 }}>
+          <CircularProgress />
+        </Box>
+      )}
+
+      {error && (
+        <Alert severity="error">
+          Failed to load executions: {error.message}
+        </Alert>
+      )}
+
+      {!isLoading && !error && (!rows || rows.length === 0) && (
+        <Alert severity="info">
+          No executions yet. Run snippets from the Collect pane to see results
+          here.
+        </Alert>
+      )}
+
+      {rows && rows.length > 0 && (
+        <Stack
+          direction="row"
+          spacing={2}
+          alignItems="center"
+          sx={{ mb: 2, flexWrap: 'wrap', rowGap: 1 }}
+        >
+          <Tooltip
+            title={
+              selectablePageIds.length === 0
+                ? 'This page has no finished executions to select.'
+                : ''
+            }
+          >
+            <span>
+              <Checkbox
+                size="small"
+                checked={allPageSelected}
+                indeterminate={somePageSelected}
+                disabled={selectablePageIds.length === 0}
+                onChange={toggleSelectAllOnPage}
+                inputProps={{
+                  'aria-label': 'Select all finished executions on this page',
+                }}
+              />
+            </span>
+          </Tooltip>
+          <Typography
+            variant="body2"
+            color="text.secondary"
+            sx={{ flexGrow: 1 }}
+          >
+            {selectedExecutions.length} selected
+          </Typography>
+          <Tooltip title={sendTooltip}>
+            <span>
+              <Button
+                variant="contained"
+                size="small"
+                startIcon={<SendIcon />}
+                disabled={sendDisabled}
+                onClick={() => openSend(null)}
+              >
+                Send to support case
+              </Button>
+            </span>
+          </Tooltip>
+        </Stack>
+      )}
+
+      {rows?.map((execution) => (
+        <ExecutionRow
+          key={execution.id}
+          execution={execution}
+          selected={selectedIds.has(execution.id)}
+          onToggleSelected={() => toggleSelected(execution)}
+          onOpenFiles={() => setFilesForTask(execution.task_history_id)}
+        />
+      ))}
+
+      {data && data.total > data.limit && (
+        <TablePagination
+          component="div"
+          count={data.total}
+          page={Math.floor(data.offset / Math.max(data.limit, 1))}
+          rowsPerPage={data.limit}
+          onPageChange={(_event, newPage) =>
+            setPage((previous) => ({
+              offset: newPage * previous.limit,
+              limit: previous.limit,
+            }))
+          }
+          rowsPerPageOptions={[ATW_PAGE_SIZE]}
+        />
+      )}
+
+      <SendHistory
+        jobs={sendJobs?.items}
+        total={sendJobs?.total}
+        error={sendJobsError}
+        onResend={openSend}
+        disabledReasons={disabledReasons}
+      />
+
+      <TaskFilesDialog
+        open={filesForTask !== null}
+        taskHistoryId={filesForTask}
+        onClose={() => setFilesForTask(null)}
+      />
+
+      <SendDialog
+        key={sendSessionKey}
+        open={sendOpen}
+        incidentId={incidentId}
+        executions={resend?.executions ?? selectedExecutions}
+        defaultCaseRef={resend?.caseRef ?? incident?.case_ref}
+        onClose={closeSend}
+      />
+    </Box>
+  );
+}
+
+/**
+ * Past send attempts for this incident, with Re-send on the failed ones.
+ *
+ * A re-send replays the attempt's own recorded executions and case reference.
+ * Executions deleted since the attempt are rejected by the POST, which names
+ * them — the pane cannot filter them itself, because it only ever holds one
+ * page of executions and would drop every id that happens to sit on another.
+ */
+function SendHistory({
+  jobs,
+  total,
+  error,
+  onResend,
+  disabledReasons,
+}: {
+  jobs: AtwSendLog[] | undefined;
+  total: number | undefined;
+  error: Error | null;
+  onResend: (context: ResendContext) => void;
+  disabledReasons: string[];
+}) {
+  const resendDisabled = disabledReasons.length > 0;
+  const resendTooltip = disabledReasons.join('; ');
+
+  if (error) {
+    return (
+      <Alert severity="error" sx={{ mt: 3 }}>
+        Could not load the send history: {error.message}
+      </Alert>
+    );
+  }
+
+  if (!jobs || jobs.length === 0) {
+    return null;
+  }
+
+  return (
+    <Paper variant="outlined" sx={{ mt: 3, p: 2 }}>
+      <Typography variant="subtitle2" sx={{ mb: 1 }}>
+        Send history
+      </Typography>
+      <Stack divider={<Divider flexItem />} spacing={1}>
+        {jobs.map((job) => {
+          const detail = sendJobDetail(job);
+          return (
+            <Stack
+              key={job.id}
+              direction="row"
+              spacing={1}
+              alignItems="center"
+              sx={{ flexWrap: 'wrap', rowGap: 1 }}
+            >
+              <Chip
+                size="small"
+                label={job.status}
+                color={SEND_STATUS_COLORS[job.status]}
+              />
+              <Typography variant="body2" sx={{ flexGrow: 1 }}>
+                {job.case_ref} · {job.requested_by}
+                {job.finished_at
+                  ? ` · ${new Date(job.finished_at).toLocaleString()}`
+                  : ''}
+              </Typography>
+              {job.status === 'failed' && (
+                <Tooltip title={resendTooltip}>
+                  <span>
+                    <Button
+                      size="small"
+                      disabled={resendDisabled}
+                      onClick={() =>
+                        onResend({
+                          executions: detail.executions ?? [],
+                          caseRef: job.case_ref,
+                        })
+                      }
+                    >
+                      Re-send
+                    </Button>
+                  </span>
+                </Tooltip>
+              )}
+              {job.status === 'failed' && detail.error && (
+                <Typography
+                  variant="body2"
+                  color="error"
+                  sx={{ width: '100%' }}
+                >
+                  {detail.error}
+                </Typography>
+              )}
+            </Stack>
+          );
+        })}
+      </Stack>
+      {total !== undefined && total > jobs.length && (
+        <Typography
+          variant="caption"
+          color="text.secondary"
+          sx={{ display: 'block', mt: 1 }}
+        >
+          Showing the {jobs.length} most recent of {total} attempts.
+        </Typography>
+      )}
+    </Paper>
+  );
+}
+
+function ExecutionRow({
+  execution,
+  selected,
+  onToggleSelected,
+  onOpenFiles,
+}: {
+  execution: AtwIncidentExecution;
+  selected: boolean;
+  onToggleSelected: () => void;
+  onOpenFiles: () => void;
+}) {
+  const {
+    snippet_filename,
+    task_status,
+    task_history_id,
+    has_logs,
+    masked_args,
+    args_withheld,
+  } = execution;
+  const selectable = isSelectable(execution);
+
+  return (
+    <Accordion
+      disableGutters
+      sx={{ mb: 1 }}
+      slotProps={{ transition: { unmountOnExit: true } }}
+    >
+      <AccordionSummary
+        expandIcon={<ExpandMoreIcon />}
+        sx={{ '& .MuiAccordionSummary-content': { minWidth: 0 } }}
+      >
+        <Stack
+          direction="row"
+          spacing={1}
+          alignItems="center"
+          sx={{ width: '100%', pr: 1, flexWrap: 'wrap' }}
+        >
+          <Tooltip
+            title={selectable ? '' : 'Only finished executions can be sent.'}
+          >
+            <span>
+              <Checkbox
+                size="small"
+                checked={selected}
+                disabled={!selectable}
+                onChange={onToggleSelected}
+                onClick={(event) => event.stopPropagation()}
+                inputProps={{ 'aria-label': `Select ${snippet_filename}` }}
+              />
+            </span>
+          </Tooltip>
+          <Box sx={{ flexGrow: 1, minWidth: 0 }}>
+            <Typography variant="subtitle2" sx={{ wordBreak: 'break-all' }}>
+              {snippet_filename}
+            </Typography>
+            {masked_args && (
+              <Typography
+                variant="body2"
+                color="text.secondary"
+                sx={{
+                  fontFamily: 'monospace',
+                  overflow: 'hidden',
+                  textOverflow: 'ellipsis',
+                  whiteSpace: 'nowrap',
+                }}
+              >
+                {masked_args}
+              </Typography>
+            )}
+          </Box>
+          {isTaskHistoryStatus(task_status) ? (
+            <TaskHistoryStatusBadge status={task_status} />
+          ) : (
+            <Chip size="small" label="Unknown" />
+          )}
+        </Stack>
+      </AccordionSummary>
+      <AccordionDetails
+        sx={(theme) => ({ paddingRight: theme.spacing(2) + ' !important' })}
+      >
+        <Stack direction="row" spacing={1} sx={{ mb: 2 }}>
+          <Button
+            size="small"
+            variant="outlined"
+            startIcon={<FolderOpenIcon />}
+            onClick={onOpenFiles}
+          >
+            Files
+          </Button>
+        </Stack>
+
+        <Box sx={{ mb: 2 }}>
+          <Typography
+            variant="caption"
+            color="text.secondary"
+            sx={{ display: 'block' }}
+          >
+            Arguments
+          </Typography>
+          {masked_args ? (
+            <Typography
+              variant="body2"
+              color="text.secondary"
+              sx={{
+                fontFamily: 'monospace',
+                wordBreak: 'break-all',
+                whiteSpace: 'pre-wrap',
+              }}
+            >
+              {masked_args}
+            </Typography>
+          ) : (
+            <Typography variant="body2" color="text.secondary">
+              {args_withheld ? 'Arguments unavailable' : 'No arguments'}
+            </Typography>
+          )}
+        </Box>
+
+        <Divider sx={{ mb: 2 }} />
+
+        {has_logs === false ? (
+          <Typography variant="body2" color="text.secondary">
+            No logs available for this execution.
+          </Typography>
+        ) : (
+          <TaskLogViewer
+            taskHistoryId={task_history_id}
+            taskStatus={task_status ?? undefined}
+            height={360}
+          />
+        )}
+      </AccordionDetails>
+    </Accordion>
+  );
+}
diff --git a/ui/packages/plugins/atw/src/SendDialog.tsx b/ui/packages/plugins/atw/src/SendDialog.tsx
new file mode 100644
index 00000000000..5d05507c35b
--- /dev/null
+++ b/ui/packages/plugins/atw/src/SendDialog.tsx
@@ -0,0 +1,201 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useState } from 'react';
+import {
+  Alert,
+  Button,
+  Dialog,
+  DialogActions,
+  DialogContent,
+  DialogContentText,
+  DialogTitle,
+  LinearProgress,
+  List,
+  ListItem,
+  ListItemText,
+  Stack,
+  TextField,
+  Typography,
+} from '@mui/material';
+import { sendJobDetail, useAtwSendJob, useStartSendJob } from './hooks';
+import type { AtwSendLogExecution } from './types';
+
+export interface SendDialogProps {
+  open: boolean;
+  incidentId: string;
+  /** The executions to send, already resolved to id + label. */
+  executions: AtwSendLogExecution[];
+  /** Prefills the case-reference field; usually the incident's own reference. */
+  defaultCaseRef?: string | null;
+  /** Receives whether a send was started, so the caller can drop its selection. */
+  onClose: (started: boolean) => void;
+}
+
+/**
+ * Collects the support-case reference, starts a diagnostics send, and follows it
+ * to a terminal status.
+ *
+ * The send log the POST returns *is* the job, so the dialog polls that row
+ * rather than a Celery result: an attempt stays readable long after a task
+ * result would have expired, which is what makes "Send again" on a failed row
+ * possible.
+ *
+ * Callers mount this under a per-open `key` so every open starts from a clean
+ * mutation and poll; nothing here resets state on reopen.
+ */
+export function SendDialog({
+  open,
+  incidentId,
+  executions,
+  defaultCaseRef,
+  onClose,
+}: SendDialogProps) {
+  const [caseRef, setCaseRef] = useState(defaultCaseRef ?? '');
+  const [jobId, setJobId] = useState<string | null>(null);
+
+  const startMutation = useStartSendJob(incidentId);
+  const { data: job, error: pollError } = useAtwSendJob(
+    incidentId,
+    open ? jobId : null
+  );
+
+  const detail = sendJobDetail(job);
+  const status = job?.status;
+  const succeeded = status === 'success';
+  const failed = status === 'failed';
+  const startError = startMutation.error;
+  const isSending =
+    startMutation.isPending ||
+    (jobId !== null && !succeeded && !failed && !pollError);
+
+  const handleSend = () => {
+    startMutation.mutate(
+      {
+        case_ref: caseRef.trim(),
+        execution_ids: executions.map((execution) => execution.id),
+      },
+      { onSuccess: (created) => setJobId(created.id) }
+    );
+  };
+
+  const handleClose = () => onClose(jobId !== null);
+
+  const canSend =
+    caseRef.trim().length > 0 && executions.length > 0 && !isSending;
+
+  return (
+    <Dialog
+      open={open}
+      onClose={handleClose}
+      fullWidth
+      maxWidth="sm"
+      aria-labelledby="atw-send-dialog-title"
+    >
+      <DialogTitle id="atw-send-dialog-title">Send to support case</DialogTitle>
+      <DialogContent>
+        {succeeded ? (
+          <Alert severity="success" sx={{ mt: 1 }}>
+            Diagnostics sent
+            {detail.upload_reference
+              ? ` (reference ${detail.upload_reference})`
+              : ''}
+            .
+          </Alert>
+        ) : (
+          <>
+            <DialogContentText sx={{ mb: 2 }}>
+              The selected executions&apos; output files and captured logs are
+              bundled and attached to the support case.
+            </DialogContentText>
+
+            <TextField
+              autoFocus
+              fullWidth
+              required
+              size="small"
+              label="Support case reference"
+              value={caseRef}
+              onChange={(event) => setCaseRef(event.target.value)}
+              disabled={isSending}
+              sx={{ mb: 2 }}
+            />
+
+            <Typography variant="subtitle2">
+              {executions.length} execution{executions.length === 1 ? '' : 's'}{' '}
+              selected
+            </Typography>
+            <List dense disablePadding>
+              {executions.map((execution) => (
+                <ListItem key={execution.id} disableGutters>
+                  <ListItemText
+                    primary={execution.snippet_filename}
+                    secondary={`Task #${execution.task_history_id}`}
+                  />
+                </ListItem>
+              ))}
+            </List>
+
+            {executions.length === 0 && (
+              <Alert severity="warning" sx={{ mt: 1 }}>
+                None of the selected executions still exist on this incident.
+              </Alert>
+            )}
+
+            {isSending && (
+              <Stack spacing={1} sx={{ mt: 2 }}>
+                <Typography variant="body2" color="text.secondary">
+                  {status === 'running' ? 'Bundling and uploading…' : 'Queued…'}
+                </Typography>
+                <LinearProgress />
+              </Stack>
+            )}
+
+            {failed && (
+              <Alert severity="error" sx={{ mt: 2 }}>
+                {detail.error ?? 'The send failed.'}
+              </Alert>
+            )}
+
+            {startError && (
+              <Alert severity="error" sx={{ mt: 2 }}>
+                {startError.message}
+              </Alert>
+            )}
+
+            {pollError && (
+              <Alert severity="error" sx={{ mt: 2 }}>
+                Lost track of this send: {pollError.message}. Check the send
+                history for its outcome.
+              </Alert>
+            )}
+          </>
+        )}
+      </DialogContent>
+      <DialogActions>
+        <Button onClick={handleClose}>
+          {succeeded || isSending ? 'Close' : 'Cancel'}
+        </Button>
+        {!succeeded && (
+          <Button variant="contained" onClick={handleSend} disabled={!canSend}>
+            {failed || startError || pollError ? 'Send again' : 'Send'}
+          </Button>
+        )}
+      </DialogActions>
+    </Dialog>
+  );
+}
diff --git a/ui/packages/plugins/atw/src/hooks.ts b/ui/packages/plugins/atw/src/hooks.ts
new file mode 100644
index 00000000000..965da3d75b8
--- /dev/null
+++ b/ui/packages/plugins/atw/src/hooks.ts
@@ -0,0 +1,366 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import {
+  keepPreviousData,
+  useMutation,
+  useQuery,
+  useQueryClient,
+} from '@tanstack/react-query';
+import { apiClient } from '@sep/api';
+import type {
+  AtwBatchExecuteResponse,
+  AtwBatchExecuteWrite,
+  AtwCategoryListing,
+  AtwConfig,
+  AtwIncident,
+  AtwIncidentExecution,
+  AtwIncidentUpdate,
+  AtwIncidentWrite,
+  AtwMergedSchema,
+  AtwPage,
+  AtwPageParams,
+  AtwSendJobWrite,
+  AtwSendLog,
+  AtwSendLogDetail,
+} from './types';
+
+const ATW_BASE = '/apps/atw';
+
+const ATW_STALE_TIME_MS = 5 * 60 * 1000;
+
+/** Poll interval while any incident execution is still running (ms). */
+const EXECUTIONS_POLL_MS = 5000;
+
+/** Non-terminal task statuses — poll the execution list while any row is here. */
+const RUNNING_TASK_STATUSES: ReadonlySet<
+  NonNullable<AtwIncidentExecution['task_status']>
+> = new Set(['running', 'pending']);
+
+/** Poll interval while a diagnostics send is still in flight (ms). */
+const SEND_JOB_POLL_MS = 2000;
+
+/** Non-terminal send statuses — poll while an attempt is still here. */
+const ACTIVE_SEND_STATUSES: ReadonlySet<AtwSendLog['status']> = new Set([
+  'pending',
+  'running',
+]);
+
+/** Rows per page for both incident and execution lists. */
+export const ATW_PAGE_SIZE = 20;
+
+const incidentsKey = ['atw', 'incidents'] as const;
+
+function incidentExecutionsKey(incidentId: string) {
+  return ['atw', 'incidents', incidentId, 'executions'] as const;
+}
+
+function sendJobsKey(incidentId: string) {
+  return ['atw', 'incidents', incidentId, 'send-jobs'] as const;
+}
+
+/** Return whether a send attempt has not yet reached a terminal status. */
+export function isSendJobActive(job: AtwSendLog | undefined | null): boolean {
+  return Boolean(job && ACTIVE_SEND_STATUSES.has(job.status));
+}
+
+/**
+ * Read a send attempt's evidence under the shape the orchestrator writes.
+ *
+ * The column is free-form JSON, so the generated client types it opaquely; this
+ * is the single place that view is applied.
+ */
+export function sendJobDetail(
+  job: AtwSendLog | undefined | null
+): AtwSendLogDetail {
+  return (job?.detail ?? {}) as AtwSendLogDetail;
+}
+
+// ── Category browser ─────────────────────────────────────────────────────
+
+export function useAtwCategories() {
+  return useQuery<AtwCategoryListing[]>({
+    queryKey: ['atw', 'categories'],
+    queryFn: async () => {
+      const { data } = await apiClient.get<AtwCategoryListing[]>(
+        `${ATW_BASE}/`
+      );
+      return data;
+    },
+    staleTime: ATW_STALE_TIME_MS,
+  });
+}
+
+// ── Incident CRUD ────────────────────────────────────────────────────────
+
+/**
+ * List incidents newest-first, one page at a time.
+ *
+ * Returns the whole envelope rather than just `items`: the caller needs `total`
+ * to render pagination controls, and keeping the previous page in place while
+ * the next one loads stops the list collapsing to a spinner on every page flip.
+ */
+export function useAtwIncidents(
+  page: AtwPageParams = { offset: 0, limit: ATW_PAGE_SIZE }
+) {
+  return useQuery<AtwPage<AtwIncident>>({
+    queryKey: [...incidentsKey, page],
+    placeholderData: keepPreviousData,
+    queryFn: async () => {
+      const { data } = await apiClient.get<AtwPage<AtwIncident>>(
+        `${ATW_BASE}/incidents/`,
+        {
+          params: { offset: page.offset, limit: page.limit },
+        }
+      );
+      return data;
+    },
+  });
+}
+
+export function useAtwIncident(incidentId: string | undefined) {
+  return useQuery<AtwIncident>({
+    queryKey: ['atw', 'incidents', incidentId],
+    enabled: Boolean(incidentId),
+    queryFn: async () => {
+      const { data } = await apiClient.get<AtwIncident>(
+        `${ATW_BASE}/incidents/${incidentId}`
+      );
+      return data;
+    },
+  });
+}
+
+export function useCreateAtwIncident() {
+  const queryClient = useQueryClient();
+  return useMutation<AtwIncident, Error, AtwIncidentWrite>({
+    mutationFn: async (body) => {
+      const { data } = await apiClient.post<AtwIncident>(
+        `${ATW_BASE}/incidents/`,
+        body
+      );
+      return data;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: incidentsKey });
+    },
+  });
+}
+
+export function useUpdateAtwIncident() {
+  const queryClient = useQueryClient();
+  return useMutation<
+    AtwIncident,
+    Error,
+    { incidentId: string; body: AtwIncidentUpdate }
+  >({
+    mutationFn: async ({ incidentId, body }) => {
+      const { data } = await apiClient.patch<AtwIncident>(
+        `${ATW_BASE}/incidents/${incidentId}`,
+        body
+      );
+      return data;
+    },
+    onSuccess: (incident) => {
+      queryClient.invalidateQueries({ queryKey: incidentsKey });
+      queryClient.invalidateQueries({
+        queryKey: ['atw', 'incidents', incident.id],
+      });
+    },
+  });
+}
+
+export function useDeleteAtwIncident() {
+  const queryClient = useQueryClient();
+  return useMutation<void, Error, string>({
+    mutationFn: async (incidentId) => {
+      await apiClient.delete(`${ATW_BASE}/incidents/${incidentId}`);
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: incidentsKey });
+    },
+  });
+}
+
+// ── Merged execution schema ──────────────────────────────────────────────
+
+/**
+ * Fetch the merged execution schema for the selected snippet filenames.
+ *
+ * The filenames ride as repeated `snippet_filename` query params (FastAPI's
+ * list-param form), so `paramsSerializer` emits `?snippet_filename=a&…=b`
+ * rather than axios' default bracket notation. The query is disabled while no
+ * snippet is selected.
+ */
+export function useAtwMergedSchema(snippetFilenames: string[]) {
+  const names = [...new Set(snippetFilenames)];
+  return useQuery<AtwMergedSchema>({
+    queryKey: ['atw', 'execution-schema', names],
+    enabled: names.length > 0,
+    staleTime: ATW_STALE_TIME_MS,
+    queryFn: async () => {
+      const { data } = await apiClient.get<AtwMergedSchema>(
+        `${ATW_BASE}/execution-schema/`,
+        {
+          params: { snippet_filename: names },
+          paramsSerializer: { indexes: null },
+        }
+      );
+      return data;
+    },
+  });
+}
+
+// ── Batch execution ──────────────────────────────────────────────────────
+
+export function useAtwBatchExecute(incidentId: string) {
+  const queryClient = useQueryClient();
+  return useMutation<AtwBatchExecuteResponse, Error, AtwBatchExecuteWrite>({
+    mutationFn: async (body) => {
+      const { data } = await apiClient.post<AtwBatchExecuteResponse>(
+        `${ATW_BASE}/incidents/${incidentId}/executions/`,
+        body
+      );
+      return data;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({
+        queryKey: incidentExecutionsKey(incidentId),
+      });
+    },
+  });
+}
+
+// ── Incident execution history ───────────────────────────────────────────
+
+/**
+ * List an incident's recorded executions, newest-first. Polls while any row on
+ * the current page is still running, so batch progress reflects each task
+ * independently — one failing task never stalls the others.
+ *
+ * Only the current page is watched: a run on a later page is not polled until
+ * the user navigates to it. Newest-first ordering keeps freshly-started runs on
+ * page 1, where they are.
+ */
+export function useAtwIncidentExecutions(
+  incidentId: string | undefined,
+  page: AtwPageParams = { offset: 0, limit: ATW_PAGE_SIZE }
+) {
+  return useQuery<AtwPage<AtwIncidentExecution>>({
+    queryKey: incidentId
+      ? [...incidentExecutionsKey(incidentId), page]
+      : ['atw', 'incidents', 'executions', page],
+    enabled: Boolean(incidentId),
+    placeholderData: keepPreviousData,
+    queryFn: async () => {
+      const { data } = await apiClient.get<AtwPage<AtwIncidentExecution>>(
+        `${ATW_BASE}/incidents/${incidentId}/executions/`,
+        { params: { offset: page.offset, limit: page.limit } }
+      );
+      return data;
+    },
+    refetchInterval: (query) => {
+      const rows = query.state.data?.items;
+      if (!rows) {
+        return false;
+      }
+      const anyRunning = rows.some(
+        (row) =>
+          row.task_status !== null &&
+          row.task_status !== undefined &&
+          RUNNING_TASK_STATUSES.has(row.task_status)
+      );
+      return anyRunning ? EXECUTIONS_POLL_MS : false;
+    },
+  });
+}
+
+// ── Diagnostics send ─────────────────────────────────────────────────────
+
+/**
+ * Probe whether a diagnostics receiver is configured, so the Send action can
+ * carry the reasons it is unavailable. Returns no reasons on any error: a
+ * transient config blip should not silently withhold the action, and the POST's
+ * own 503 gate remains the real guard.
+ */
+export function useAtwConfig() {
+  return useQuery<AtwConfig>({
+    queryKey: ['atw', 'config'],
+    queryFn: async () => {
+      try {
+        const { data } = await apiClient.get<AtwConfig>(`${ATW_BASE}/config/`);
+        return data;
+      } catch {
+        return { send_disabled_reasons: [] };
+      }
+    },
+    staleTime: Infinity,
+    retry: false,
+  });
+}
+
+export function useStartSendJob(incidentId: string) {
+  const queryClient = useQueryClient();
+  return useMutation<AtwSendLog, Error, AtwSendJobWrite>({
+    mutationFn: async (body) => {
+      const { data } = await apiClient.post<AtwSendLog>(
+        `${ATW_BASE}/incidents/${incidentId}/send-jobs/`,
+        body
+      );
+      return data;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: sendJobsKey(incidentId) });
+    },
+  });
+}
+
+/** Poll one send attempt until it reaches a terminal status. */
+export function useAtwSendJob(incidentId: string, jobId: string | null) {
+  return useQuery<AtwSendLog>({
+    queryKey: [...sendJobsKey(incidentId), jobId],
+    enabled: Boolean(jobId),
+    queryFn: async () => {
+      const { data } = await apiClient.get<AtwSendLog>(
+        `${ATW_BASE}/incidents/${incidentId}/send-jobs/${jobId}`
+      );
+      return data;
+    },
+    refetchInterval: (query) =>
+      isSendJobActive(query.state.data) ? SEND_JOB_POLL_MS : false,
+  });
+}
+
+/** List an incident's send attempts, newest-first, polling while any is active. */
+export function useAtwSendJobs(incidentId: string | undefined) {
+  return useQuery<AtwPage<AtwSendLog>>({
+    queryKey: incidentId
+      ? sendJobsKey(incidentId)
+      : ['atw', 'incidents', 'send-jobs'],
+    enabled: Boolean(incidentId),
+    queryFn: async () => {
+      const { data } = await apiClient.get<AtwPage<AtwSendLog>>(
+        `${ATW_BASE}/incidents/${incidentId}/send-jobs/`
+      );
+      return data;
+    },
+    refetchInterval: (query) =>
+      query.state.data?.items.some((row) => isSendJobActive(row))
+        ? SEND_JOB_POLL_MS
+        : false,
+  });
+}
diff --git a/ui/packages/plugins/atw/src/index.ts b/ui/packages/plugins/atw/src/index.ts
new file mode 100644
index 00000000000..ffd40becd0b
--- /dev/null
+++ b/ui/packages/plugins/atw/src/index.ts
@@ -0,0 +1,64 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { AtwApp } from './AtwApp';
+export { IncidentListPage } from './IncidentListPage';
+export { IncidentWorkspacePage } from './IncidentWorkspacePage';
+export { CategoryBrowser } from './CategoryBrowser';
+export { CollectPane } from './CollectPane';
+export { ResultsPane } from './ResultsPane';
+export { SendDialog } from './SendDialog';
+export {
+  useAtwCategories,
+  useAtwIncidents,
+  useAtwIncident,
+  useCreateAtwIncident,
+  useUpdateAtwIncident,
+  useDeleteAtwIncident,
+  useAtwMergedSchema,
+  useAtwBatchExecute,
+  useAtwIncidentExecutions,
+  useAtwConfig,
+  useStartSendJob,
+  useAtwSendJob,
+  useAtwSendJobs,
+  isSendJobActive,
+  sendJobDetail,
+  ATW_PAGE_SIZE,
+} from './hooks';
+export type {
+  AtwCategoryListing,
+  AtwSnippetSummary,
+  AtwIncident,
+  AtwIncidentWrite,
+  AtwIncidentUpdate,
+  AtwMergedSchema,
+  AtwSnippetSchema,
+  AtwBatchExecuteWrite,
+  AtwBatchExecuteItemWrite,
+  AtwBatchExecuteResponse,
+  AtwBatchExecuteItemResponse,
+  AtwIncidentExecution,
+  AtwSendJobWrite,
+  AtwSendLog,
+  AtwSendLogDetail,
+  AtwSendLogExecution,
+  AtwSendLogStep,
+  AtwConfig,
+  AtwPage,
+  AtwPageParams,
+} from './types';
diff --git a/ui/packages/plugins/atw/src/types.ts b/ui/packages/plugins/atw/src/types.ts
new file mode 100644
index 00000000000..067a1d63e7f
--- /dev/null
+++ b/ui/packages/plugins/atw/src/types.ts
@@ -0,0 +1,219 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type { SectionField, TaskHistoryStatus } from '@sep/api';
+
+// ── Category browser ─────────────────────────────────────────────────────
+
+export interface AtwSnippetSummary {
+  /** Snippet filename; use with snippet plugin API path helpers. */
+  name: string;
+  title: string;
+  description: string;
+}
+
+export interface AtwCategoryListing {
+  category_root: string;
+  parent_category: string;
+  parent_category_label: string;
+  category: string;
+  category_label: string;
+  snippet_count: number;
+  snippets: AtwSnippetSummary[];
+}
+
+// ── Incidents ────────────────────────────────────────────────────────────
+//
+// STUB TYPES (backend-assumed): the incident/batch-execution contracts below
+// are served by the ATW backend (SEP-1591 / SEP-1592) but are not yet in PMM's
+// committed OpenAPI spec, so they are authored here to mirror the backend
+// ``atw__*`` schemas. Replace with generated ``SepComponents['schemas'][...]``
+// references once ``specs/sep.json`` is regenerated.
+
+export interface AtwIncident {
+  case_ref: string | null;
+  /** Format: date-time */
+  created_at: string;
+  created_by: string;
+  /** Format: uuid4 */
+  id: string;
+  name: string;
+  updated_at: string | null;
+}
+
+export interface AtwIncidentWrite {
+  case_ref?: string | null;
+  name?: string;
+}
+
+export interface AtwIncidentUpdate {
+  case_ref?: string | null;
+  name?: string;
+}
+
+// ── Merged execution schema ──────────────────────────────────────────────
+
+/**
+ * The merged execution form for a batch selection. `shared` holds the
+ * batch-level execution fields plus every parameter the selection declares
+ * identically; `per_snippet` holds each snippet's remaining fields. The wire
+ * field union matches the framework `SectionField` shape the SchemaFormRenderer
+ * consumes, so both arrays are typed as `SectionField[]`.
+ */
+export interface AtwMergedSchema {
+  shared: SectionField[];
+  per_snippet: AtwSnippetSchema[];
+}
+
+export interface AtwSnippetSchema {
+  snippet_filename: string;
+  fields: SectionField[];
+}
+
+// ── Batch execution ──────────────────────────────────────────────────────
+
+export interface AtwBatchExecuteItemWrite {
+  args: Record<string, unknown>;
+  snippet_filename: string;
+}
+
+export interface AtwBatchExecuteWrite {
+  executor_host: string;
+  items: AtwBatchExecuteItemWrite[];
+  shared_args: Record<string, unknown>;
+  sudo: boolean;
+}
+
+export interface AtwBatchExecuteItemResponse {
+  error?: string | Record<string, unknown>[] | null;
+  snippet_filename: string;
+  task_history_id?: number | null;
+  task_name?: string | null;
+}
+
+export interface AtwBatchExecuteResponse {
+  items: AtwBatchExecuteItemResponse[];
+}
+
+// ── Incident execution history ───────────────────────────────────────────
+
+export interface AtwIncidentExecution {
+  /**
+   * Whether the arguments were suppressed because they could not be masked
+   * safely — distinguishing that from an execution that genuinely ran with
+   * none.
+   */
+  args_withheld: boolean;
+  /** Format: date-time */
+  created_at: string;
+  finished_at?: string | null;
+  has_logs?: boolean | null;
+  /** Format: uuid4 */
+  id: string;
+  /**
+   * The command line the snippet ran with, credential values replaced by a
+   * fixed-width mask. `null` together with `args_withheld=false` means the
+   * execution recorded no arguments.
+   */
+  masked_args?: string | null;
+  snippet_filename: string;
+  started_at?: string | null;
+  task_history_id: number;
+  task_status?: TaskHistoryStatus | null;
+}
+
+// ── Diagnostics send ─────────────────────────────────────────────────────
+//
+// STUB TYPES (backend-assumed): the send contracts below are served by the ATW
+// backend (SEP-1595) but are not yet in PMM's committed OpenAPI spec, so they
+// mirror the backend ``atw__AtwSendJobWrite`` / ``atw__AtwSendLogResponse`` /
+// ``atw__AtwConfigResponse`` schemas by hand.
+
+export type AtwSendStatus = 'pending' | 'running' | 'success' | 'failed';
+
+export interface AtwSendJobWrite {
+  case_ref: string;
+  execution_ids: string[];
+}
+
+export interface AtwSendLog {
+  case_ref: string;
+  /** Format: date-time */
+  created_at: string;
+  detail: Record<string, never>;
+  finished_at: string | null;
+  /** Format: uuid4 */
+  id: string;
+  /** Format: uuid4 */
+  incident_id: string;
+  requested_by: string;
+  started_at: string | null;
+  status: AtwSendStatus;
+}
+
+export interface AtwConfig {
+  send_disabled_reasons: string[];
+}
+
+/** One page of a paginated list endpoint, as the API envelope carries it. */
+export interface AtwPage<T> {
+  items: T[];
+  total: number;
+  offset: number;
+  limit: number;
+}
+
+/** The offset/limit window a paginated list is currently showing. */
+export interface AtwPageParams {
+  offset: number;
+  limit: number;
+}
+
+/**
+ * One execution snapshotted onto a send log's `detail`, so a failed attempt can
+ * be re-sent with the same selection even after the incident has moved on.
+ */
+export interface AtwSendLogExecution {
+  id: string;
+  task_history_id: number;
+  snippet_filename: string;
+}
+
+/** One resolution step the delivery plan reported while the send ran. */
+export interface AtwSendLogStep {
+  name: string;
+  status: 'running' | 'success';
+  outputs: Record<string, string> | null;
+}
+
+/**
+ * The evidence a send attempt records.
+ *
+ * The backend column is free-form JSON, so the response types it as an opaque
+ * record; this is the shape the orchestrator actually writes. Every field is
+ * optional because a row accumulates them as the attempt progresses — a pending
+ * row carries only `executions`.
+ */
+export interface AtwSendLogDetail {
+  executions?: AtwSendLogExecution[];
+  steps?: AtwSendLogStep[];
+  upload_response?: Record<string, unknown> | null;
+  upload_reference?: string | null;
+  bundle_size?: number;
+  file_count?: number;
+  error?: string;
+}
diff --git a/ui/packages/plugins/atw/tests/CategoryBrowser.test.tsx b/ui/packages/plugins/atw/tests/CategoryBrowser.test.tsx
new file mode 100644
index 00000000000..47d02d52914
--- /dev/null
+++ b/ui/packages/plugins/atw/tests/CategoryBrowser.test.tsx
@@ -0,0 +1,112 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { render, screen, waitFor } from '@testing-library/react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import type { ReactNode } from 'react';
+import { CategoryBrowser } from '../src/CategoryBrowser';
+
+vi.mock('@sep/api', () => ({
+  apiClient: { get: vi.fn() },
+}));
+
+import { apiClient } from '@sep/api';
+const mockedApi = apiClient as unknown as { get: ReturnType<typeof vi.fn> };
+
+const singleRoot = [
+  {
+    category_root: 'MySQL',
+    parent_category: 'PERFORMANCE_ISSUES',
+    parent_category_label: 'Performance Issues',
+    category: 'OVERALL_SLOWNESS',
+    category_label: 'Overall Slowness',
+    snippet_count: 1,
+    snippets: [
+      { name: 'diag/slow-query.sh', title: 'Slow Query', description: '' },
+    ],
+  },
+];
+
+function renderBrowser(ui: ReactNode) {
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false, staleTime: Infinity } },
+  });
+  return render(
+    <QueryClientProvider client={queryClient}>{ui}</QueryClientProvider>
+  );
+}
+
+describe('CategoryBrowser', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('hides the Category control when the listing has a single root', async () => {
+    mockedApi.get.mockResolvedValue({ data: singleRoot });
+
+    renderBrowser(<CategoryBrowser onSnippetsChange={vi.fn()} />);
+
+    await waitFor(() => {
+      expect(
+        screen.getByRole('combobox', { name: 'Subcategory 1' })
+      ).toBeTruthy();
+    });
+    expect(screen.queryByRole('combobox', { name: /^Category$/ })).toBeNull();
+    expect(
+      screen.getByRole('combobox', { name: 'Subcategory 2' })
+    ).toBeTruthy();
+  });
+
+  it('shows the Category control when the listing has multiple roots', async () => {
+    mockedApi.get.mockResolvedValue({
+      data: [
+        ...singleRoot,
+        {
+          category_root: 'PostgreSQL',
+          parent_category: 'PERFORMANCE_ISSUES',
+          parent_category_label: 'Performance Issues',
+          category: 'OVERALL_SLOWNESS',
+          category_label: 'Overall Slowness',
+          snippet_count: 1,
+          snippets: [
+            { name: 'diag/other.sh', title: 'Other', description: '' },
+          ],
+        },
+      ],
+    });
+
+    renderBrowser(<CategoryBrowser onSnippetsChange={vi.fn()} />);
+
+    await waitFor(() => {
+      expect(screen.getByRole('combobox', { name: /^Category$/ })).toBeTruthy();
+    });
+    expect(
+      screen.getByRole('combobox', { name: 'Subcategory 1' })
+    ).toBeTruthy();
+  });
+
+  it('surfaces a load error', async () => {
+    mockedApi.get.mockRejectedValue(new Error('boom'));
+
+    renderBrowser(<CategoryBrowser onSnippetsChange={vi.fn()} />);
+
+    await waitFor(() => {
+      expect(screen.getByText(/Failed to load ATW categories/i)).toBeTruthy();
+    });
+  });
+});
diff --git a/ui/packages/plugins/atw/tests/CollectPane.helpers.test.tsx b/ui/packages/plugins/atw/tests/CollectPane.helpers.test.tsx
new file mode 100644
index 00000000000..ed593ec0d38
--- /dev/null
+++ b/ui/packages/plugins/atw/tests/CollectPane.helpers.test.tsx
@@ -0,0 +1,174 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, expect, it } from 'vitest';
+import type { SectionField } from '@sep/api';
+import {
+  buildBatchPayload,
+  fieldDeclaresGate,
+  namespaceField,
+} from '../src/CollectPane';
+import type { AtwSnippetSummary } from '../src/types';
+
+const snippets: AtwSnippetSummary[] = [
+  { name: 'a.sh', title: 'A', description: '' },
+  { name: 'b.sh', title: 'B', description: '' },
+];
+
+describe('buildBatchPayload', () => {
+  it('hoists executor_host and sudo and keeps other top-level values as shared args', () => {
+    const payload = buildBatchPayload(
+      {
+        executor_host: 'db-1',
+        sudo: true,
+        'defaults-file': '/etc/my.cnf',
+        overrides: {},
+      },
+      []
+    );
+
+    expect(payload.executor_host).toBe('db-1');
+    expect(payload.sudo).toBe(true);
+    expect(payload.shared_args).toEqual({ 'defaults-file': '/etc/my.cnf' });
+    expect(payload.items).toEqual([]);
+  });
+
+  it('maps each snippet to its namespaced override args in selection order', () => {
+    const payload = buildBatchPayload(
+      {
+        executor_host: 'db-1',
+        overrides: {
+          snip0: { minutes: 5 },
+          snip1: { minutes: 10 },
+        },
+      },
+      snippets
+    );
+
+    expect(payload.items).toEqual([
+      { snippet_filename: 'a.sh', args: { minutes: 5 } },
+      { snippet_filename: 'b.sh', args: { minutes: 10 } },
+    ]);
+  });
+
+  it('drops empty-string and reserved fields from both shared and per-snippet args', () => {
+    const payload = buildBatchPayload(
+      {
+        executor_host: 'db-1',
+        sudo: false,
+        script_preview: 'ignored',
+        empty: '',
+        overrides: {
+          snip0: { minutes: 5, note: '', executor_host: 'ignored' },
+        },
+      },
+      [snippets[0]]
+    );
+
+    expect(payload.shared_args).toEqual({});
+    expect(payload.items[0].args).toEqual({ minutes: 5 });
+  });
+
+  it('defaults executor_host to an empty string when absent', () => {
+    const payload = buildBatchPayload({ overrides: {} }, []);
+    expect(payload.executor_host).toBe('');
+    expect(payload.sudo).toBe(false);
+  });
+});
+
+describe('namespaceField', () => {
+  it('prefixes a leaf field name', () => {
+    const field: SectionField = {
+      type: 'string',
+      name: 'minutes',
+      label: 'Minutes',
+    };
+    expect(namespaceField(field, 'overrides.snip0.')).toMatchObject({
+      name: 'overrides.snip0.minutes',
+      label: 'Minutes',
+    });
+  });
+
+  it('prefixes a one-of group discriminator and branch leaf names', () => {
+    const group: SectionField = {
+      type: 'one_of',
+      name: 'source',
+      label: 'Source',
+      discriminator: 'source.mode',
+      branches: [
+        {
+          value: 'file',
+          label: 'File',
+          fields: [{ type: 'string', name: 'source.path', label: 'Path' }],
+        },
+      ],
+    };
+
+    const result = namespaceField(group, 'overrides.snip1.');
+    expect(result).toMatchObject({
+      name: 'overrides.snip1.source',
+      discriminator: 'overrides.snip1.source.mode',
+    });
+    if (result.type === 'one_of') {
+      expect(result.branches[0].fields[0].name).toBe(
+        'overrides.snip1.source.path'
+      );
+    }
+  });
+});
+
+describe('fieldDeclaresGate', () => {
+  it('is false for a plain field', () => {
+    expect(
+      fieldDeclaresGate({ type: 'string', name: 'minutes', label: 'Minutes' })
+    ).toBe(false);
+  });
+
+  it('is true when a field declares a requires gate', () => {
+    const field: SectionField = {
+      type: 'string',
+      name: 'path',
+      label: 'Path',
+      requires: [{ when: { truthy: 'enabled' } }],
+    };
+    expect(fieldDeclaresGate(field)).toBe(true);
+  });
+
+  it('is true when a one-of branch leaf declares a forbidden gate', () => {
+    const group: SectionField = {
+      type: 'one_of',
+      name: 'source',
+      label: 'Source',
+      discriminator: 'source.mode',
+      branches: [
+        {
+          value: 'file',
+          label: 'File',
+          fields: [
+            {
+              type: 'string',
+              name: 'source.path',
+              label: 'Path',
+              forbidden: [{ when: { truthy: 'inline' } }],
+            },
+          ],
+        },
+      ],
+    };
+    expect(fieldDeclaresGate(group)).toBe(true);
+  });
+});
diff --git a/ui/packages/plugins/atw/tests/IncidentListPage.test.tsx b/ui/packages/plugins/atw/tests/IncidentListPage.test.tsx
new file mode 100644
index 00000000000..0562d4cbcae
--- /dev/null
+++ b/ui/packages/plugins/atw/tests/IncidentListPage.test.tsx
@@ -0,0 +1,159 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { MemoryRouter } from 'react-router-dom';
+import type { ReactNode } from 'react';
+import { IncidentListPage } from '../src/IncidentListPage';
+
+vi.mock('@sep/api', () => ({
+  apiClient: { get: vi.fn(), post: vi.fn(), patch: vi.fn(), delete: vi.fn() },
+}));
+
+import { apiClient } from '@sep/api';
+const mockedApi = apiClient as unknown as {
+  get: ReturnType<typeof vi.fn>;
+  post: ReturnType<typeof vi.fn>;
+  patch: ReturnType<typeof vi.fn>;
+  delete: ReturnType<typeof vi.fn>;
+};
+
+const incident = {
+  id: '11111111-1111-4111-8111-111111111111',
+  name: 'DB slowness',
+  case_ref: 'CS-42',
+  created_by: 'engineer',
+  created_at: '2026-07-22T10:00:00Z',
+  updated_at: null,
+};
+
+function paginated<T>(items: T[]) {
+  return { data: { items, total: items.length, offset: 0, limit: 50 } };
+}
+
+function renderPage(ui: ReactNode) {
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false, staleTime: Infinity } },
+  });
+  return render(
+    <QueryClientProvider client={queryClient}>
+      <MemoryRouter>{ui}</MemoryRouter>
+    </QueryClientProvider>
+  );
+}
+
+describe('IncidentListPage', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('renders the incident list', async () => {
+    mockedApi.get.mockResolvedValue(paginated([incident]));
+
+    renderPage(<IncidentListPage />);
+
+    await waitFor(() => {
+      expect(screen.getByText('DB slowness')).toBeTruthy();
+    });
+    expect(screen.getByText(/Case CS-42/)).toBeTruthy();
+  });
+
+  it('shows an empty state when there are no incidents', async () => {
+    mockedApi.get.mockResolvedValue(paginated([]));
+
+    renderPage(<IncidentListPage />);
+
+    await waitFor(() => {
+      expect(screen.getByText(/No incidents yet/i)).toBeTruthy();
+    });
+  });
+
+  it('creates an incident from the dialog, sending the trimmed name', async () => {
+    mockedApi.get.mockResolvedValue(paginated([]));
+    mockedApi.post.mockResolvedValue({ data: incident });
+    const user = userEvent.setup();
+
+    renderPage(<IncidentListPage />);
+
+    await waitFor(() =>
+      expect(screen.getByText(/No incidents yet/i)).toBeTruthy()
+    );
+
+    await user.click(screen.getByRole('button', { name: /New incident/i }));
+    await user.type(
+      screen.getByLabelText(/Name \(optional\)/i),
+      '  Prod outage  '
+    );
+    await user.click(screen.getByRole('button', { name: /^Create$/ }));
+
+    await waitFor(() => {
+      expect(mockedApi.post).toHaveBeenCalledWith('/apps/atw/incidents/', {
+        name: 'Prod outage',
+      });
+    });
+  });
+
+  it('omits the name when the create field is left blank', async () => {
+    mockedApi.get.mockResolvedValue(paginated([]));
+    mockedApi.post.mockResolvedValue({ data: incident });
+    const user = userEvent.setup();
+
+    renderPage(<IncidentListPage />);
+
+    await waitFor(() =>
+      expect(screen.getByText(/No incidents yet/i)).toBeTruthy()
+    );
+
+    await user.click(screen.getByRole('button', { name: /New incident/i }));
+    await user.click(screen.getByRole('button', { name: /^Create$/ }));
+
+    await waitFor(() => {
+      expect(mockedApi.post).toHaveBeenCalledWith('/apps/atw/incidents/', {});
+    });
+  });
+
+  it('renders pagination controls once the list exceeds one page', async () => {
+    mockedApi.get.mockResolvedValue({
+      data: { items: [incident], total: 40, offset: 0, limit: 20 },
+    });
+
+    renderPage(<IncidentListPage />);
+
+    await waitFor(() => {
+      expect(
+        screen.getByRole('button', { name: /Go to next page/i })
+      ).toBeTruthy();
+    });
+    expect(screen.getByText(/of 40/)).toBeTruthy();
+  });
+
+  it('omits pagination controls when a single page holds everything', async () => {
+    mockedApi.get.mockResolvedValue(paginated([incident]));
+
+    renderPage(<IncidentListPage />);
+
+    await waitFor(() => {
+      expect(screen.getByText('DB slowness')).toBeTruthy();
+    });
+    expect(
+      screen.queryByRole('button', { name: /Go to next page/i })
+    ).toBeNull();
+  });
+});
diff --git a/ui/packages/plugins/atw/tests/ResultsPane.test.tsx b/ui/packages/plugins/atw/tests/ResultsPane.test.tsx
new file mode 100644
index 00000000000..fa799245b25
--- /dev/null
+++ b/ui/packages/plugins/atw/tests/ResultsPane.test.tsx
@@ -0,0 +1,922 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import type { ReactNode } from 'react';
+import { ResultsPane } from '../src/ResultsPane';
+
+vi.mock('@sep/api', () => ({
+  apiClient: { get: vi.fn() },
+}));
+
+// No test here mounts the log viewer: rows that stay collapsed leave it unmounted
+// (unmountOnExit), and the rows that expand report no logs. The files dialog stays
+// closed throughout — so none of them fires a query.
+
+import { apiClient } from '@sep/api';
+const mockedApi = apiClient as unknown as { get: ReturnType<typeof vi.fn> };
+
+function paginated<T>(items: T[]) {
+  return { data: { items, total: items.length, offset: 0, limit: 50 } };
+}
+
+function renderPane(ui: ReactNode) {
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false, staleTime: Infinity } },
+  });
+  return render(
+    <QueryClientProvider client={queryClient}>{ui}</QueryClientProvider>
+  );
+}
+
+describe('ResultsPane', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('renders each execution with its snippet name and status', async () => {
+    mockedApi.get.mockResolvedValue(
+      paginated([
+        {
+          id: 'exec-1',
+          snippet_filename: 'diag/slow-query.sh',
+          task_history_id: 7,
+          created_at: '2026-07-22T10:00:00Z',
+          task_status: 'success',
+          started_at: null,
+          finished_at: null,
+          has_logs: true,
+        },
+        {
+          id: 'exec-2',
+          snippet_filename: 'diag/dmesg.sh',
+          task_history_id: 8,
+          created_at: '2026-07-22T10:01:00Z',
+          task_status: 'failed',
+          started_at: null,
+          finished_at: null,
+          has_logs: true,
+        },
+      ])
+    );
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(screen.getByText('diag/slow-query.sh')).toBeTruthy();
+    });
+    expect(screen.getByText('diag/dmesg.sh')).toBeTruthy();
+    expect(screen.getByText('Done')).toBeTruthy();
+    expect(screen.getByText('Failed')).toBeTruthy();
+  });
+
+  it('shows an empty state when the incident has no executions', async () => {
+    mockedApi.get.mockResolvedValue(paginated([]));
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(screen.getByText(/No executions yet/i)).toBeTruthy();
+    });
+  });
+
+  it('renders an Unknown chip when the task status could not be hydrated', async () => {
+    mockedApi.get.mockResolvedValue(
+      paginated([
+        {
+          id: 'exec-3',
+          snippet_filename: 'diag/x.sh',
+          task_history_id: 9,
+          created_at: '2026-07-22T10:02:00Z',
+          task_status: null,
+          started_at: null,
+          finished_at: null,
+          has_logs: null,
+        },
+      ])
+    );
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(screen.getByText('Unknown')).toBeTruthy();
+    });
+  });
+});
+
+// ── Recorded arguments ───────────────────────────────────────────────────
+
+/** Build one execution row, overriding only what a case cares about. */
+function executionWithArgs(overrides: Record<string, unknown>) {
+  return {
+    id: 'exec-args',
+    snippet_filename: 'diag/mongo.sh',
+    task_history_id: 21,
+    created_at: '2026-07-22T10:00:00Z',
+    task_status: 'success',
+    started_at: null,
+    finished_at: null,
+    // Keeps the expanded body on its no-logs branch, so these cases can open a
+    // row without mounting the log viewer and its token/stream machinery.
+    has_logs: false,
+    masked_args: null,
+    args_withheld: false,
+    ...overrides,
+  };
+}
+
+const MASKED_ARGS = '--port 27017 --password ***';
+
+describe('ResultsPane recorded arguments', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('renders the masked arguments in the collapsed summary', async () => {
+    mockedApi.get.mockResolvedValue(
+      paginated([executionWithArgs({ masked_args: MASKED_ARGS })])
+    );
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(screen.getByText(MASKED_ARGS)).toBeTruthy();
+    });
+  });
+
+  it('renders the arguments in the expanded body as well as the summary', async () => {
+    mockedApi.get.mockResolvedValue(
+      paginated([executionWithArgs({ masked_args: MASKED_ARGS })])
+    );
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+    await waitFor(() => {
+      expect(screen.getByText('diag/mongo.sh')).toBeTruthy();
+    });
+
+    fireEvent.click(screen.getByText('diag/mongo.sh'));
+
+    await waitFor(() => {
+      expect(screen.getAllByText(MASKED_ARGS)).toHaveLength(2);
+    });
+  });
+
+  it('wraps the arguments in the body while the summary keeps them on one line', async () => {
+    const longArgs = `--dest /var/tmp/${'long-path-segment/'.repeat(12)} --password ***`;
+    mockedApi.get.mockResolvedValue(
+      paginated([executionWithArgs({ masked_args: longArgs })])
+    );
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+    await waitFor(() => {
+      expect(screen.getByText('diag/mongo.sh')).toBeTruthy();
+    });
+
+    fireEvent.click(screen.getByText('diag/mongo.sh'));
+
+    await waitFor(() => {
+      expect(screen.getAllByText(longArgs)).toHaveLength(2);
+    });
+    const [summaryLine, bodyLine] = screen.getAllByText(longArgs);
+    expect(getComputedStyle(summaryLine).whiteSpace).toBe('nowrap');
+    expect(getComputedStyle(summaryLine).textOverflow).toBe('ellipsis');
+    expect(getComputedStyle(bodyLine).whiteSpace).toBe('pre-wrap');
+  });
+
+  it('shows an empty state when the execution recorded no arguments', async () => {
+    mockedApi.get.mockResolvedValue(
+      paginated([
+        executionWithArgs({ masked_args: null, args_withheld: false }),
+      ])
+    );
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+    await waitFor(() => {
+      expect(screen.getByText('diag/mongo.sh')).toBeTruthy();
+    });
+
+    fireEvent.click(screen.getByText('diag/mongo.sh'));
+
+    await waitFor(() => {
+      expect(screen.getByText('No arguments')).toBeTruthy();
+    });
+  });
+
+  it('reports unavailable arguments distinctly from an execution that had none', async () => {
+    mockedApi.get.mockResolvedValue(
+      paginated([executionWithArgs({ masked_args: null, args_withheld: true })])
+    );
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+    await waitFor(() => {
+      expect(screen.getByText('diag/mongo.sh')).toBeTruthy();
+    });
+
+    fireEvent.click(screen.getByText('diag/mongo.sh'));
+
+    await waitFor(() => {
+      expect(screen.getByText('Arguments unavailable')).toBeTruthy();
+    });
+    expect(screen.queryByText('No arguments')).toBeNull();
+  });
+});
+
+// ── Diagnostics send ─────────────────────────────────────────────────────
+
+const FINISHED_EXECUTION = {
+  id: 'exec-1',
+  snippet_filename: 'diag/slow-query.sh',
+  task_history_id: 7,
+  created_at: '2026-07-22T10:00:00Z',
+  task_status: 'success',
+  started_at: null,
+  finished_at: null,
+  has_logs: true,
+};
+
+const RUNNING_EXECUTION = {
+  id: 'exec-2',
+  snippet_filename: 'diag/dmesg.sh',
+  task_history_id: 8,
+  created_at: '2026-07-22T10:01:00Z',
+  task_status: 'running',
+  started_at: null,
+  finished_at: null,
+  has_logs: true,
+};
+
+const STALE_EXECUTION = {
+  id: 'exec-3',
+  snippet_filename: 'diag/vmstat.sh',
+  task_history_id: 9,
+  created_at: '2026-07-22T10:02:00Z',
+  task_status: 'stale',
+  started_at: null,
+  finished_at: null,
+  has_logs: true,
+};
+
+/** An execution recorded on a past attempt but absent from the current page. */
+const OFF_PAGE_EXECUTION = {
+  id: 'exec-99',
+  task_history_id: 99,
+  snippet_filename: 'diag/off-page.sh',
+};
+
+function failedJob(detail: unknown) {
+  return {
+    id: 'job-1',
+    incident_id: 'inc-1',
+    case_ref: 'CS0042',
+    requested_by: 'alice',
+    status: 'failed',
+    started_at: null,
+    finished_at: '2026-07-24T10:01:00Z',
+    created_at: '2026-07-24T10:00:00Z',
+    detail,
+  };
+}
+
+/**
+ * Route each GET by URL, so the executions list, config probe and send-job
+ * history can answer with their own shapes rather than one shared envelope.
+ */
+interface ExecutionsPage {
+  items: unknown[];
+  total: number;
+  offset: number;
+  limit: number;
+}
+
+function routeGet(routes: {
+  executions?: ExecutionsPage | ((offset: number) => ExecutionsPage);
+  config?: unknown;
+  sendJobs?: unknown;
+  incident?: unknown;
+}) {
+  mockedApi.get.mockImplementation(
+    (url: string, config?: { params?: { offset?: number } }) => {
+      if (url.includes('/send-jobs/')) {
+        return Promise.resolve({
+          data: routes.sendJobs ?? {
+            items: [],
+            total: 0,
+            offset: 0,
+            limit: 50,
+          },
+        });
+      }
+      if (url.includes('/executions/')) {
+        // A function route answers per requested offset, so a case can span pages;
+        // the offset arrives in the axios params, not the URL.
+        const executions =
+          typeof routes.executions === 'function'
+            ? routes.executions(config?.params?.offset ?? 0)
+            : routes.executions;
+        return Promise.resolve({
+          data: executions ?? { items: [], total: 0, offset: 0, limit: 20 },
+        });
+      }
+      if (url.includes('/config/')) {
+        return Promise.resolve({
+          data: routes.config ?? { send_disabled_reasons: [] },
+        });
+      }
+      return Promise.resolve({
+        data: routes.incident ?? { id: 'inc-1', case_ref: 'CS0001' },
+      });
+    }
+  );
+}
+
+describe('ResultsPane diagnostics send', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('offers a checkbox only for finished executions', async () => {
+    routeGet({
+      executions: {
+        items: [FINISHED_EXECUTION, RUNNING_EXECUTION],
+        total: 2,
+        offset: 0,
+        limit: 20,
+      },
+    });
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(screen.getByLabelText('Select diag/slow-query.sh')).toBeTruthy();
+    });
+    expect(
+      (screen.getByLabelText('Select diag/slow-query.sh') as HTMLInputElement)
+        .disabled
+    ).toBe(false);
+    expect(
+      (screen.getByLabelText('Select diag/dmesg.sh') as HTMLInputElement)
+        .disabled
+    ).toBe(true);
+  });
+
+  it('enables the send action once an execution is selected', async () => {
+    routeGet({
+      executions: {
+        items: [FINISHED_EXECUTION],
+        total: 1,
+        offset: 0,
+        limit: 20,
+      },
+    });
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(screen.getByLabelText('Select diag/slow-query.sh')).toBeTruthy();
+    });
+    const sendButton = () =>
+      screen.getByRole('button', {
+        name: /Send to support case/i,
+      }) as HTMLButtonElement;
+    expect(sendButton().disabled).toBe(true);
+
+    fireEvent.click(screen.getByLabelText('Select diag/slow-query.sh'));
+
+    await waitFor(() => {
+      expect(sendButton().disabled).toBe(false);
+    });
+    expect(screen.getByText('1 selected')).toBeTruthy();
+  });
+
+  it('keeps the send action disabled while delivery is unconfigured', async () => {
+    routeGet({
+      executions: {
+        items: [FINISHED_EXECUTION],
+        total: 1,
+        offset: 0,
+        limit: 20,
+      },
+      config: {
+        send_disabled_reasons: ['Diagnostics delivery is not configured'],
+      },
+    });
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(screen.getByLabelText('Select diag/slow-query.sh')).toBeTruthy();
+    });
+    fireEvent.click(screen.getByLabelText('Select diag/slow-query.sh'));
+
+    await waitFor(() => {
+      expect(
+        (
+          screen.getByRole('button', {
+            name: /Send to support case/i,
+          }) as HTMLButtonElement
+        ).disabled
+      ).toBe(true);
+    });
+  });
+
+  it('lists past attempts and offers Re-send on a failed one', async () => {
+    routeGet({
+      executions: {
+        items: [FINISHED_EXECUTION],
+        total: 1,
+        offset: 0,
+        limit: 20,
+      },
+      sendJobs: {
+        items: [
+          {
+            id: 'job-1',
+            incident_id: 'inc-1',
+            case_ref: 'CS0042',
+            requested_by: 'alice',
+            status: 'failed',
+            started_at: null,
+            finished_at: '2026-07-24T10:01:00Z',
+            created_at: '2026-07-24T10:00:00Z',
+            detail: {
+              error: 'upstream exploded',
+              executions: [FINISHED_EXECUTION],
+            },
+          },
+        ],
+        total: 1,
+        offset: 0,
+        limit: 50,
+      },
+    });
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(screen.getByText('Send history')).toBeTruthy();
+    });
+    expect(screen.getByText(/CS0042/)).toBeTruthy();
+    expect(screen.getByRole('button', { name: 'Re-send' })).toBeTruthy();
+  });
+
+  it('keeps Re-send disabled while delivery is unconfigured', async () => {
+    routeGet({
+      executions: {
+        items: [FINISHED_EXECUTION],
+        total: 1,
+        offset: 0,
+        limit: 20,
+      },
+      sendJobs: {
+        items: [
+          failedJob({
+            error: 'upstream exploded',
+            executions: [FINISHED_EXECUTION],
+          }),
+        ],
+        total: 1,
+        offset: 0,
+        limit: 50,
+      },
+      config: {
+        send_disabled_reasons: ['Diagnostics delivery is not configured'],
+      },
+    });
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: 'Re-send' })).toBeTruthy();
+    });
+    expect(
+      (screen.getByRole('button', { name: 'Re-send' }) as HTMLButtonElement)
+        .disabled
+    ).toBe(true);
+  });
+
+  it('renders pagination controls once the list exceeds one page', async () => {
+    routeGet({
+      executions: {
+        items: [FINISHED_EXECUTION],
+        total: 40,
+        offset: 0,
+        limit: 20,
+      },
+    });
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(
+        screen.getByRole('button', { name: /Go to next page/i })
+      ).toBeTruthy();
+    });
+    expect(screen.getByText(/of 40/)).toBeTruthy();
+  });
+
+  it('omits pagination controls when a single page holds everything', async () => {
+    routeGet({
+      executions: {
+        items: [FINISHED_EXECUTION],
+        total: 1,
+        offset: 0,
+        limit: 20,
+      },
+    });
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(screen.getByText('diag/slow-query.sh')).toBeTruthy();
+    });
+    expect(
+      screen.queryByRole('button', { name: /Go to next page/i })
+    ).toBeNull();
+  });
+
+  it('offers a checkbox for a stale execution, which the backend counts finished', async () => {
+    routeGet({
+      executions: { items: [STALE_EXECUTION], total: 1, offset: 0, limit: 20 },
+    });
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(screen.getByLabelText('Select diag/vmstat.sh')).toBeTruthy();
+    });
+    expect(
+      (screen.getByLabelText('Select diag/vmstat.sh') as HTMLInputElement)
+        .disabled
+    ).toBe(false);
+  });
+
+  it('shows why a past attempt failed', async () => {
+    routeGet({
+      executions: {
+        items: [FINISHED_EXECUTION],
+        total: 1,
+        offset: 0,
+        limit: 20,
+      },
+      sendJobs: {
+        items: [
+          failedJob({
+            error: 'upstream exploded',
+            executions: [FINISHED_EXECUTION],
+          }),
+        ],
+        total: 1,
+        offset: 0,
+        limit: 50,
+      },
+    });
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(screen.getByText('upstream exploded')).toBeTruthy();
+    });
+  });
+
+  it('re-sends every execution the attempt recorded, not just the current page', async () => {
+    routeGet({
+      executions: {
+        items: [FINISHED_EXECUTION],
+        total: 40,
+        offset: 0,
+        limit: 20,
+      },
+      sendJobs: {
+        items: [failedJob({ error: 'boom', executions: [OFF_PAGE_EXECUTION] })],
+        total: 1,
+        offset: 0,
+        limit: 50,
+      },
+    });
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: 'Re-send' })).toBeTruthy();
+    });
+    fireEvent.click(screen.getByRole('button', { name: 'Re-send' }));
+
+    await waitFor(() => {
+      expect(screen.getByText('diag/off-page.sh')).toBeTruthy();
+    });
+    expect(
+      screen.queryByText(/None of the selected executions still exist/i)
+    ).toBeNull();
+  });
+
+  it('flags a send history it could not load', async () => {
+    mockedApi.get.mockImplementation((url: string) => {
+      if (url.includes('/send-jobs/')) {
+        return Promise.reject(new Error('history unavailable'));
+      }
+      if (url.includes('/executions/')) {
+        return Promise.resolve({
+          data: { items: [FINISHED_EXECUTION], total: 1, offset: 0, limit: 20 },
+        });
+      }
+      if (url.includes('/config/')) {
+        return Promise.resolve({ data: { send_disabled_reasons: [] } });
+      }
+      return Promise.resolve({ data: { id: 'inc-1', case_ref: 'CS0001' } });
+    });
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(screen.getByText(/Could not load the send history/i)).toBeTruthy();
+    });
+  });
+
+  it('cues that the send history is truncated', async () => {
+    routeGet({
+      executions: {
+        items: [FINISHED_EXECUTION],
+        total: 1,
+        offset: 0,
+        limit: 20,
+      },
+      sendJobs: {
+        items: [failedJob({ error: 'boom', executions: [FINISHED_EXECUTION] })],
+        total: 73,
+        offset: 0,
+        limit: 50,
+      },
+    });
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(
+        screen.getByText(/Showing the 1 most recent of 73 attempts/i)
+      ).toBeTruthy();
+    });
+  });
+});
+
+// ── Page-scoped select all ───────────────────────────────────────────────
+
+/** A second page's finished execution, so a selection can span two pages. */
+const SECOND_PAGE_EXECUTION = {
+  id: 'exec-4',
+  snippet_filename: 'diag/iostat.sh',
+  task_history_id: 11,
+  created_at: '2026-07-22T10:03:00Z',
+  task_status: 'success',
+  started_at: null,
+  finished_at: null,
+  has_logs: true,
+};
+
+const SELECT_ALL_LABEL = 'Select all finished executions on this page';
+
+const selectAllToggle = () =>
+  screen.getByLabelText(SELECT_ALL_LABEL) as HTMLInputElement;
+
+const rowToggle = (filename: string) =>
+  screen.getByLabelText(`Select ${filename}`) as HTMLInputElement;
+
+/**
+ * How the toggle presents itself to a screen reader.
+ *
+ * MUI leaves the native `checked` property false in the mixed state, so the
+ * indeterminate case has to be read off an attribute. `aria-checked="mixed"`
+ * is the contract a screen reader consumes, but MUI only started emitting it
+ * after 7.3.7 — the version this repo's lockfile resolves — so fall back to
+ * the `data-indeterminate` attribute MUI documents for that release.
+ */
+const toggleState = () => {
+  const toggle = selectAllToggle();
+  const indeterminate =
+    toggle.getAttribute('aria-checked') === 'mixed' ||
+    toggle.getAttribute('data-indeterminate') === 'true';
+  if (indeterminate) {
+    return 'mixed';
+  }
+  return toggle.checked ? 'checked' : 'unchecked';
+};
+
+/** Serve `pages` keyed by offset, so a case can select across a page flip. */
+function pagesByOffset(pages: Record<number, unknown[]>, total: number) {
+  return (offset: number) => ({
+    items: pages[offset] ?? [],
+    total,
+    offset,
+    limit: 20,
+  });
+}
+
+describe('ResultsPane select all on the page', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('selects every finished execution on the page and skips the unfinished ones', async () => {
+    routeGet({
+      executions: {
+        items: [FINISHED_EXECUTION, RUNNING_EXECUTION, STALE_EXECUTION],
+        total: 3,
+        offset: 0,
+        limit: 20,
+      },
+    });
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(selectAllToggle()).toBeTruthy();
+    });
+    fireEvent.click(selectAllToggle());
+
+    await waitFor(() => {
+      expect(screen.getByText('2 selected')).toBeTruthy();
+    });
+    expect(rowToggle('diag/slow-query.sh').checked).toBe(true);
+    expect(rowToggle('diag/vmstat.sh').checked).toBe(true);
+    expect(rowToggle('diag/dmesg.sh').checked).toBe(false);
+    expect(toggleState()).toBe('checked');
+    expect(
+      (
+        screen.getByRole('button', {
+          name: /Send to support case/i,
+        }) as HTMLButtonElement
+      ).disabled
+    ).toBe(false);
+  });
+
+  it('deselects exactly the page it selected', async () => {
+    routeGet({
+      executions: {
+        items: [FINISHED_EXECUTION, RUNNING_EXECUTION],
+        total: 2,
+        offset: 0,
+        limit: 20,
+      },
+    });
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(selectAllToggle()).toBeTruthy();
+    });
+    fireEvent.click(selectAllToggle());
+    await waitFor(() => {
+      expect(screen.getByText('1 selected')).toBeTruthy();
+    });
+
+    fireEvent.click(selectAllToggle());
+
+    await waitFor(() => {
+      expect(screen.getByText('0 selected')).toBeTruthy();
+    });
+    expect(rowToggle('diag/slow-query.sh').checked).toBe(false);
+  });
+
+  it('renders the toggle indeterminate while only some finished rows are selected', async () => {
+    routeGet({
+      executions: {
+        items: [FINISHED_EXECUTION, STALE_EXECUTION],
+        total: 2,
+        offset: 0,
+        limit: 20,
+      },
+    });
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(selectAllToggle()).toBeTruthy();
+    });
+    expect(toggleState()).toBe('unchecked');
+
+    fireEvent.click(rowToggle('diag/slow-query.sh'));
+
+    await waitFor(() => {
+      expect(toggleState()).toBe('mixed');
+    });
+
+    fireEvent.click(rowToggle('diag/vmstat.sh'));
+
+    await waitFor(() => {
+      expect(toggleState()).toBe('checked');
+    });
+  });
+
+  it('disables the toggle when the page holds no finished execution', async () => {
+    routeGet({
+      executions: {
+        items: [RUNNING_EXECUTION],
+        total: 1,
+        offset: 0,
+        limit: 20,
+      },
+    });
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(selectAllToggle()).toBeTruthy();
+    });
+    expect(selectAllToggle().disabled).toBe(true);
+    expect(toggleState()).toBe('unchecked');
+  });
+
+  it('leaves another page selected when deselecting the current one', async () => {
+    routeGet({
+      executions: pagesByOffset(
+        {
+          0: [FINISHED_EXECUTION, RUNNING_EXECUTION],
+          20: [SECOND_PAGE_EXECUTION],
+        },
+        40
+      ),
+    });
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(selectAllToggle()).toBeTruthy();
+    });
+    fireEvent.click(selectAllToggle());
+    await waitFor(() => {
+      expect(screen.getByText('1 selected')).toBeTruthy();
+    });
+
+    fireEvent.click(screen.getByRole('button', { name: /Go to next page/i }));
+    await waitFor(() => {
+      expect(screen.getByText('diag/iostat.sh')).toBeTruthy();
+    });
+    fireEvent.click(selectAllToggle());
+    await waitFor(() => {
+      expect(screen.getByText('2 selected')).toBeTruthy();
+    });
+
+    // Unchecking page 2 must not touch the execution chosen on page 1.
+    fireEvent.click(selectAllToggle());
+
+    await waitFor(() => {
+      expect(screen.getByText('1 selected')).toBeTruthy();
+    });
+    expect(rowToggle('diag/iostat.sh').checked).toBe(false);
+    expect(
+      (
+        screen.getByRole('button', {
+          name: /Send to support case/i,
+        }) as HTMLButtonElement
+      ).disabled
+    ).toBe(false);
+  });
+
+  it('labels an execution the toggle selected after the user pages away from it', async () => {
+    routeGet({
+      executions: pagesByOffset(
+        { 0: [FINISHED_EXECUTION], 20: [SECOND_PAGE_EXECUTION] },
+        40
+      ),
+    });
+
+    renderPane(<ResultsPane incidentId="inc-1" />);
+
+    await waitFor(() => {
+      expect(selectAllToggle()).toBeTruthy();
+    });
+    fireEvent.click(selectAllToggle());
+    await waitFor(() => {
+      expect(screen.getByText('1 selected')).toBeTruthy();
+    });
+
+    fireEvent.click(screen.getByRole('button', { name: /Go to next page/i }));
+    await waitFor(() => {
+      expect(screen.getByText('diag/iostat.sh')).toBeTruthy();
+    });
+    expect(screen.queryByText('diag/slow-query.sh')).toBeNull();
+
+    fireEvent.click(
+      screen.getByRole('button', { name: /Send to support case/i })
+    );
+
+    await waitFor(() => {
+      expect(screen.getByText('diag/slow-query.sh')).toBeTruthy();
+    });
+  });
+});
diff --git a/ui/packages/plugins/atw/tests/SendDialog.test.tsx b/ui/packages/plugins/atw/tests/SendDialog.test.tsx
new file mode 100644
index 00000000000..f501a3ff58d
--- /dev/null
+++ b/ui/packages/plugins/atw/tests/SendDialog.test.tsx
@@ -0,0 +1,325 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import type { ReactNode } from 'react';
+import { SendDialog } from '../src/SendDialog';
+
+vi.mock('@sep/api', () => ({
+  apiClient: { get: vi.fn(), post: vi.fn() },
+}));
+
+import { apiClient } from '@sep/api';
+
+const mockedApi = apiClient as unknown as {
+  get: ReturnType<typeof vi.fn>;
+  post: ReturnType<typeof vi.fn>;
+};
+
+const EXECUTIONS = [
+  { id: 'exec-1', task_history_id: 7, snippet_filename: 'diag/slow-query.sh' },
+  { id: 'exec-2', task_history_id: 8, snippet_filename: 'diag/dmesg.sh' },
+];
+
+function sendLog(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'job-1',
+    incident_id: 'inc-1',
+    case_ref: 'CS0042',
+    requested_by: 'alice',
+    status: 'pending',
+    started_at: null,
+    finished_at: null,
+    created_at: '2026-07-24T10:00:00Z',
+    detail: {},
+    ...overrides,
+  };
+}
+
+function renderDialog(ui: ReactNode) {
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false } },
+  });
+  return render(
+    <QueryClientProvider client={queryClient}>{ui}</QueryClientProvider>
+  );
+}
+
+describe('SendDialog', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('prefills the case reference from the incident', () => {
+    renderDialog(
+      <SendDialog
+        open
+        incidentId="inc-1"
+        executions={EXECUTIONS}
+        defaultCaseRef="CS0001"
+        onClose={() => {}}
+      />
+    );
+
+    const field = screen.getByLabelText(
+      /Support case reference/i
+    ) as HTMLInputElement;
+    expect(field.value).toBe('CS0001');
+  });
+
+  it('states that the bundle carries both output files and logs', () => {
+    renderDialog(
+      <SendDialog
+        open
+        incidentId="inc-1"
+        executions={EXECUTIONS}
+        onClose={() => {}}
+      />
+    );
+
+    expect(
+      screen.getByText(/output files and captured logs are bundled/i)
+    ).toBeTruthy();
+  });
+
+  it('lists every selected execution', () => {
+    renderDialog(
+      <SendDialog
+        open
+        incidentId="inc-1"
+        executions={EXECUTIONS}
+        onClose={() => {}}
+      />
+    );
+
+    expect(screen.getByText('diag/slow-query.sh')).toBeTruthy();
+    expect(screen.getByText('diag/dmesg.sh')).toBeTruthy();
+    expect(screen.getByText(/2 executions selected/i)).toBeTruthy();
+  });
+
+  it('keeps Send disabled until a case reference is entered', () => {
+    renderDialog(
+      <SendDialog
+        open
+        incidentId="inc-1"
+        executions={EXECUTIONS}
+        onClose={() => {}}
+      />
+    );
+
+    const send = screen.getByRole('button', {
+      name: 'Send',
+    }) as HTMLButtonElement;
+    expect(send.disabled).toBe(true);
+
+    fireEvent.change(screen.getByLabelText(/Support case reference/i), {
+      target: { value: 'CS0042' },
+    });
+
+    expect(
+      (screen.getByRole('button', { name: 'Send' }) as HTMLButtonElement)
+        .disabled
+    ).toBe(false);
+  });
+
+  it('disables Send when the selection is empty', () => {
+    renderDialog(
+      <SendDialog
+        open
+        incidentId="inc-1"
+        executions={[]}
+        defaultCaseRef="CS0042"
+        onClose={() => {}}
+      />
+    );
+
+    expect(
+      (screen.getByRole('button', { name: 'Send' }) as HTMLButtonElement)
+        .disabled
+    ).toBe(true);
+    expect(
+      screen.getByText(/None of the selected executions still exist/i)
+    ).toBeTruthy();
+  });
+
+  it('posts the selection, then follows the job to success', async () => {
+    mockedApi.post.mockResolvedValue({ data: sendLog() });
+    mockedApi.get.mockResolvedValue({
+      data: sendLog({
+        status: 'success',
+        finished_at: '2026-07-24T10:01:00Z',
+        detail: { upload_reference: 'att-9' },
+      }),
+    });
+
+    renderDialog(
+      <SendDialog
+        open
+        incidentId="inc-1"
+        executions={EXECUTIONS}
+        defaultCaseRef="CS0042"
+        onClose={() => {}}
+      />
+    );
+    fireEvent.click(screen.getByRole('button', { name: 'Send' }));
+
+    await waitFor(() => {
+      expect(screen.getByText(/Diagnostics sent/i)).toBeTruthy();
+    });
+    expect(mockedApi.post).toHaveBeenCalledWith(
+      '/apps/atw/incidents/inc-1/send-jobs/',
+      {
+        case_ref: 'CS0042',
+        execution_ids: ['exec-1', 'exec-2'],
+      }
+    );
+    expect(screen.getByText(/att-9/)).toBeTruthy();
+  });
+
+  it('surfaces the recorded error and offers Send again on failure', async () => {
+    mockedApi.post.mockResolvedValue({ data: sendLog() });
+    mockedApi.get.mockResolvedValue({
+      data: sendLog({
+        status: 'failed',
+        finished_at: '2026-07-24T10:01:00Z',
+        detail: {
+          error:
+            'Bundle exceeded the configured 30 MiB limit while being built.',
+        },
+      }),
+    });
+
+    renderDialog(
+      <SendDialog
+        open
+        incidentId="inc-1"
+        executions={EXECUTIONS}
+        defaultCaseRef="CS0042"
+        onClose={() => {}}
+      />
+    );
+    fireEvent.click(screen.getByRole('button', { name: 'Send' }));
+
+    await waitFor(() => {
+      expect(screen.getByText(/30 MiB limit/)).toBeTruthy();
+    });
+    expect(screen.getByRole('button', { name: 'Send again' })).toBeTruthy();
+  });
+
+  it('shows progress while the job is still running', async () => {
+    mockedApi.post.mockResolvedValue({ data: sendLog() });
+    mockedApi.get.mockResolvedValue({ data: sendLog({ status: 'running' }) });
+
+    renderDialog(
+      <SendDialog
+        open
+        incidentId="inc-1"
+        executions={EXECUTIONS}
+        defaultCaseRef="CS0042"
+        onClose={() => {}}
+      />
+    );
+    fireEvent.click(screen.getByRole('button', { name: 'Send' }));
+
+    await waitFor(() => {
+      expect(screen.getByText(/Bundling and uploading/i)).toBeTruthy();
+    });
+    expect(
+      (screen.getByRole('button', { name: 'Send' }) as HTMLButtonElement)
+        .disabled
+    ).toBe(true);
+  });
+
+  it('refuses a second send between the POST landing and the first poll', async () => {
+    mockedApi.post.mockResolvedValue({ data: sendLog() });
+    mockedApi.get.mockReturnValue(new Promise(() => {}));
+
+    renderDialog(
+      <SendDialog
+        open
+        incidentId="inc-1"
+        executions={EXECUTIONS}
+        defaultCaseRef="CS0042"
+        onClose={() => {}}
+      />
+    );
+    fireEvent.click(screen.getByRole('button', { name: 'Send' }));
+
+    await waitFor(() => {
+      expect(
+        (screen.getByRole('button', { name: 'Send' }) as HTMLButtonElement)
+          .disabled
+      ).toBe(true);
+    });
+    fireEvent.click(screen.getByRole('button', { name: 'Send' }));
+
+    expect(mockedApi.post).toHaveBeenCalledTimes(1);
+  });
+
+  it('surfaces a poll it could not complete and re-enables sending', async () => {
+    mockedApi.post.mockResolvedValue({ data: sendLog() });
+    mockedApi.get.mockRejectedValue(new Error('job vanished'));
+
+    renderDialog(
+      <SendDialog
+        open
+        incidentId="inc-1"
+        executions={EXECUTIONS}
+        defaultCaseRef="CS0042"
+        onClose={() => {}}
+      />
+    );
+    fireEvent.click(screen.getByRole('button', { name: 'Send' }));
+
+    await waitFor(() => {
+      expect(screen.getByText(/Lost track of this send/i)).toBeTruthy();
+    });
+    expect(
+      (screen.getByRole('button', { name: 'Send again' }) as HTMLButtonElement)
+        .disabled
+    ).toBe(false);
+  });
+
+  it('reports on close whether a send was started', async () => {
+    mockedApi.post.mockResolvedValue({ data: sendLog() });
+    mockedApi.get.mockReturnValue(new Promise(() => {}));
+    const onClose = vi.fn();
+
+    renderDialog(
+      <SendDialog
+        open
+        incidentId="inc-1"
+        executions={EXECUTIONS}
+        defaultCaseRef="CS0042"
+        onClose={onClose}
+      />
+    );
+
+    fireEvent.click(screen.getByRole('button', { name: 'Cancel' }));
+    expect(onClose).toHaveBeenLastCalledWith(false);
+
+    fireEvent.click(screen.getByRole('button', { name: 'Send' }));
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: 'Close' })).toBeTruthy();
+    });
+    fireEvent.click(screen.getByRole('button', { name: 'Close' }));
+
+    expect(onClose).toHaveBeenLastCalledWith(true);
+  });
+});
diff --git a/ui/packages/plugins/atw/tests/setup.ts b/ui/packages/plugins/atw/tests/setup.ts
new file mode 100644
index 00000000000..1ff291e1f7b
--- /dev/null
+++ b/ui/packages/plugins/atw/tests/setup.ts
@@ -0,0 +1,24 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import '@testing-library/jest-dom/vitest';
+import { afterEach } from 'vitest';
+import { cleanup } from '@testing-library/react';
+
+afterEach(() => {
+  cleanup();
+});
diff --git a/ui/packages/plugins/atw/tsconfig.json b/ui/packages/plugins/atw/tsconfig.json
new file mode 100644
index 00000000000..22d4c24c441
--- /dev/null
+++ b/ui/packages/plugins/atw/tsconfig.json
@@ -0,0 +1,7 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "types": ["vitest/globals", "@testing-library/jest-dom"]
+  },
+  "include": ["./src", "./tests"]
+}
diff --git a/ui/packages/plugins/atw/vitest.config.ts b/ui/packages/plugins/atw/vitest.config.ts
new file mode 100644
index 00000000000..ed0f6ac935a
--- /dev/null
+++ b/ui/packages/plugins/atw/vitest.config.ts
@@ -0,0 +1,46 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import react from '@vitejs/plugin-react-swc';
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  plugins: [react()],
+  resolve: {
+    // Single instance per package under pnpm — see @sep/framework vitest config.
+    dedupe: ['react', 'react-dom', 'react-hook-form', '@tanstack/react-query'],
+  },
+  test: {
+    environment: 'jsdom',
+    globals: true,
+    setupFiles: ['./tests/setup.ts'],
+    css: false,
+    server: {
+      deps: {
+        inline: [
+          'react-dom',
+          '@testing-library/react',
+          '@percona/percona-ui',
+          '@mui/material',
+          '@mui/system',
+          '@mui/utils',
+          'material-react-table',
+        ],
+      },
+    },
+  },
+});
diff --git a/ui/packages/sep/api/README.md b/ui/packages/sep/api/README.md
new file mode 100644
index 00000000000..bea045d3707
--- /dev/null
+++ b/ui/packages/sep/api/README.md
@@ -0,0 +1,200 @@
+# @sep/api
+
+Centralized HTTP client, React Query configuration, and OpenAPI type codegen
+for the SEP frontend.
+
+This package is consumed by `@sep/shell`, `@sep/framework`, and plugin
+packages. Anything that talks to the backend should go through here.
+
+## What's in the package
+
+- **`apiClient`** — preconfigured axios instance with interceptors for Bearer
+  token injection, unauthorized handling, dev logging, and structured error
+  normalization into `ApiError`. Request/response bodies are passed through
+  verbatim — field casing matches the OpenAPI spec.
+- **Typed clients** — `mainApi`, `sepApi` are
+  [`openapi-fetch`](https://openapi-ts.dev/openapi-fetch/) clients typed
+  against the generated `paths` under `src/generated/`. They share
+  Bearer-token and unauthorized handling with `apiClient` via a middleware
+  that reads the same `setTokenProvider` state.
+- **Generated types** — `src/generated/{main,inventory,tasks,sep}.ts` are
+  emitted by `pnpm --filter @sep/api codegen` from the four FastAPI specs.
+  Files are committed so builds don't require a live backend; they are
+  marked `linguist-generated` in `frontend/.gitattributes` to keep GitHub
+  diffs collapsed.
+- **`createQueryClient()`** — factory that returns a `QueryClient` with the
+  dashboard-tuned defaults: 30s stale time, exponential back-off retry that
+  skips 4xx responses, `refetchOnWindowFocus: true`.
+- **`ApiError`** — structured error class surfaced by the client. Every
+  rejection from `apiClient` is an `ApiError`; `throwOnApiError()` adapts
+  the `openapi-fetch` `{ data, error }` tuple to throw the same shape.
+- **Token accessor pattern** — `setTokenProvider()` and `setOnUnauthorized()`
+  let the auth layer plug in without the API package depending on auth state.
+- **Hooks** — `usePluginSchema`, `usePluginTasks`, `usePluginTask`,
+  `useCreatePluginTask` (generic, predate codegen) and `useCurrentUser`
+  (sample of the typed-hook pattern).
+- **Auth functions** — `postLogin`, `postRefresh`, `fetchCurrentUser`.
+  Thin request wrappers consumed by the `AuthProvider` in `@sep/shell`.
+
+## Usage
+
+### Wire up the query client in the app root
+
+```tsx
+import { QueryClientProvider } from '@tanstack/react-query';
+import { createQueryClient } from '@sep/api';
+
+const queryClient = createQueryClient();
+
+<QueryClientProvider client={queryClient}>
+  <App />
+</QueryClientProvider>;
+```
+
+### Wire up auth (from `@sep/shell`'s `AuthProvider`)
+
+```ts
+import { setTokenProvider, setOnUnauthorized } from '@sep/api';
+
+setTokenProvider(() => currentAccessToken);
+setOnUnauthorized(() => redirectToLogin());
+```
+
+### Call the API
+
+```ts
+import { apiClient, ApiError } from '@sep/api';
+
+try {
+  const { data } = await apiClient.get('/apps/checksums/');
+} catch (err) {
+  if (err instanceof ApiError && err.status === 404) {
+    // handle not found
+  }
+}
+```
+
+### Handling errors in React Query
+
+```ts
+const { data, error } = useQuery({
+  queryKey: ['x'],
+  queryFn: () => apiClient.get('/x'),
+});
+
+if (error instanceof ApiError) {
+  // error.kind, error.status, error.message are all reliable
+}
+```
+
+## Conventions
+
+### Field casing
+
+The backend is FastAPI. Most wire payloads are snake_case; a few schemas
+(notably `CasdoorUser`) are served with a camelCase alias generator. Either
+way, the canonical names live in the OpenAPI spec and are reflected in
+`src/generated/*.ts`. Read field names from the generated types — do not
+apply client-side case conversion.
+
+## Codegen
+
+`pnpm --filter @sep/api codegen` reads the committed spec fixtures in
+`specs/{main,inventory,tasks,sep}.json` and writes one typed client per spec
+into `src/generated/`. No running backend is required by default.
+
+```bash
+# Default: regenerate the clients from the committed specs/*.json fixtures.
+pnpm --filter @sep/api codegen
+```
+
+The specs are committed (and marked `linguist-generated`) so codegen, CI, and
+local builds never need a live backend.
+
+### Updating after a backend contract change
+
+The fixtures are committed, so a contract change is a two-step regen — dump the
+specs from the backend, then regenerate the clients:
+
+```bash
+# 1. From the repo root: dump the four whole-app OpenAPI specs (no server needed).
+python scripts/dump_openapi.py
+# 2. Regenerate the typed clients from the refreshed fixtures, then format them
+#    (CI compares against the formatted output).
+pnpm --filter @sep/api codegen
+pnpm --filter @sep/api exec oxfmt --write src/generated
+```
+
+To regenerate directly from a live backend instead of the fixtures, point
+codegen at it (format afterward, as the CI guard does):
+
+```bash
+CODEGEN_BASE_URL=http://localhost:8000 pnpm --filter @sep/api codegen
+pnpm --filter @sep/api exec oxfmt --write src/generated
+```
+
+### Freshness is enforced in CI
+
+Two guards keep the committed clients honest across the spec handoff:
+
+- A backend test (`tests/app/test_openapi_specs_fresh.py`) fails if the
+  committed `specs/*.json` drift from a fresh `python scripts/dump_openapi.py`
+  dump (the spec ↔ backend link).
+- The frontend `checks` job regenerates and formats the clients from the
+  committed specs and fails on any `src/generated/` diff (the TS ↔ spec link):
+
+```bash
+pnpm --filter @sep/api codegen
+pnpm --filter @sep/api exec oxfmt --write src/generated
+git diff --exit-code -- packages/api/src/generated/
+```
+
+## How to add a new typed hook
+
+1. Regenerate types if you're calling a newly-added endpoint.
+2. Pick the client matching the spec: `mainApi` or `sepApi`.
+3. Wrap the call in `throwOnApiError` so errors propagate as `ApiError`:
+
+```ts
+import { useQuery } from '@tanstack/react-query';
+import { sepApi, throwOnApiError, type SepComponents } from '@sep/api';
+
+type Task = SepComponents['schemas']['BaseTaskResponse'];
+
+export function useChecksumTask(name: string) {
+  return useQuery<Task>({
+    queryKey: ['checksums', name],
+    queryFn: () =>
+      throwOnApiError(
+        sepApi.GET('/api/apps/checksums/{task_name}', {
+          params: { path: { task_name: name } },
+        })
+      ),
+  });
+}
+```
+
+See `src/hooks/useCurrentUser.ts` for a minimal reference.
+
+## Testing
+
+Tests run under vitest with MSW:
+
+```bash
+pnpm --filter @sep/api test
+```
+
+Covered:
+
+- Bearer token attachment (present and absent)
+- `ApiError` normalization for 4xx / 5xx / network errors
+- Unauthorized handler invocation on 401 (skipped for refresh endpoint)
+- Retry predicate: skip 4xx, retry 5xx and network, cap at 3 attempts
+- `retryDelay` exponential back-off and ceiling
+
+## Known follow-ups
+
+- `postLogin` / `postRefresh` / `fetchCurrentUser` in `src/auth.ts` are
+  still hand-written wrappers kept as-is to avoid perturbing
+  `AuthProvider`. They can be replaced with typed calls via `mainApi`
+  once the SPA auth flow (SEP-961 + SEP-1029) settles.
diff --git a/ui/packages/sep/api/package.json b/ui/packages/sep/api/package.json
new file mode 100644
index 00000000000..4a292f63616
--- /dev/null
+++ b/ui/packages/sep/api/package.json
@@ -0,0 +1,35 @@
+{
+  "name": "@sep/api",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "main": "./src/index.ts",
+  "types": "./src/index.ts",
+  "scripts": {
+    "type-check": "tsc --noEmit",
+    "check-types": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "oxlint --config ../../../oxlintrc.json src",
+    "format": "oxfmt --write src",
+    "codegen": "tsx scripts/codegen.ts"
+  },
+  "dependencies": {
+    "axios": "^1.15.2",
+    "openapi-fetch": "^0.17.0"
+  },
+  "devDependencies": {
+    "@tanstack/react-query": "^5.100.7",
+    "@types/node": "^20.0.0",
+    "@types/react": "^19.1.0",
+    "msw": "^2.13.6",
+    "openapi-typescript": "^7.9.0",
+    "tsx": "^4.19.0",
+    "typescript": "~6.0.3",
+    "vitest": "^4.0.0"
+  },
+  "peerDependencies": {
+    "@tanstack/react-query": "^5.0.0",
+    "react": "^19.0.0"
+  }
+}
diff --git a/ui/packages/sep/api/scripts/codegen.ts b/ui/packages/sep/api/scripts/codegen.ts
new file mode 100644
index 00000000000..30fb64c1ac4
--- /dev/null
+++ b/ui/packages/sep/api/scripts/codegen.ts
@@ -0,0 +1,106 @@
+#!/usr/bin/env tsx
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/**
+ * OpenAPI → TypeScript codegen.
+ *
+ * Iterates over SPECS and writes one `src/generated/{name}.ts` per entry.
+ * Reads the committed `specs/{name}.json` fixtures by default (no backend
+ * required); set CODEGEN_BASE_URL to regenerate from a live backend instead.
+ * Regenerate the fixtures with `python scripts/dump_openapi.py` after a
+ * backend contract change.
+ *
+ * Usage:
+ *   pnpm --filter @sep/api codegen
+ *   CODEGEN_BASE_URL=http://localhost:8000 pnpm --filter @sep/api codegen
+ */
+import { mkdir, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import openapiTS, { astToString } from 'openapi-typescript';
+
+type SpecSource = { name: string; source: string };
+
+const BASE_URL = process.env.CODEGEN_BASE_URL;
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const OUT_DIR = path.resolve(HERE, '..', 'src', 'generated');
+const SPECS_DIR = path.resolve(HERE, '..', 'specs');
+
+const HTTP_PATHS: Record<string, string> = {
+  main: '/openapi.json',
+  inventory: '/api/inventory/openapi.json',
+  tasks: '/api/tasks/openapi.json',
+  sep: '/api/sep/openapi.json',
+};
+
+const SPECS: SpecSource[] = Object.entries(HTTP_PATHS).map(
+  ([name, httpPath]) => ({
+    name,
+    source: BASE_URL
+      ? `${BASE_URL}${httpPath}`
+      : path.resolve(SPECS_DIR, `${name}.json`),
+  })
+);
+
+const HEADER = [
+  '/**',
+  ' * This file is auto-generated by `pnpm --filter @sep/api codegen`.',
+  ' * Do not edit by hand — regenerate from the source OpenAPI spec.',
+  ' */',
+  '',
+].join('\n');
+
+function toURL(source: string): URL {
+  if (source.startsWith('http://') || source.startsWith('https://')) {
+    return new URL(source);
+  }
+  return pathToFileURL(source);
+}
+
+async function generateOne(spec: SpecSource): Promise<void> {
+  const input = toURL(spec.source);
+  const ast = await openapiTS(input, {
+    enum: false,
+    immutable: false,
+  });
+  const body = astToString(ast);
+  const outPath = path.join(OUT_DIR, `${spec.name}.ts`);
+  await writeFile(outPath, HEADER + body, 'utf8');
+  // eslint-disable-next-line no-console
+  console.log(`[codegen] wrote ${path.relative(process.cwd(), outPath)}`);
+}
+
+async function main(): Promise<void> {
+  await mkdir(OUT_DIR, { recursive: true });
+  for (const spec of SPECS) {
+    try {
+      await generateOne(spec);
+    } catch (err) {
+      // eslint-disable-next-line no-console
+      console.error(`[codegen] FAILED ${spec.name} (${spec.source})`);
+      throw err;
+    }
+  }
+}
+
+main().catch((err) => {
+  // eslint-disable-next-line no-console
+  console.error(err);
+  process.exit(1);
+});
diff --git a/ui/packages/sep/api/specs/inventory.json b/ui/packages/sep/api/specs/inventory.json
new file mode 100644
index 00000000000..b73f279c440
--- /dev/null
+++ b/ui/packages/sep/api/specs/inventory.json
@@ -0,0 +1,3455 @@
+{
+  "components": {
+    "schemas": {
+      "HTTPValidationError": {
+        "properties": {
+          "detail": {
+            "items": {
+              "$ref": "#/components/schemas/ValidationError"
+            },
+            "title": "Detail",
+            "type": "array"
+          }
+        },
+        "title": "HTTPValidationError",
+        "type": "object"
+      },
+      "HostSystemObservationResponse": {
+        "description": "Define the response model for host system observation data.\n\n:param id: The primary key of the observation record.\n:type id: int | None\n:param created_at: When the record was created.\n:type created_at: UTCDatetime\n:param updated_at: When the record was last updated.\n:type updated_at: UTCDatetime | None\n:param node_id: The unique identifier of the observed node.\n:type node_id: int\n:param os_version: The observed operating system version.\n:type os_version: str | None\n:param installed_packages: Snapshot of installed packages.\n:type installed_packages: list[dict[str, Any]] | None\n:param config: Snapshot of host configuration.\n:type config: dict[str, Any] | None\n:param observed_at: When this observation was collected.\n:type observed_at: UTCDatetime",
+        "properties": {
+          "config": {
+            "anyOf": [
+              {
+                "type": "object"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Config"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "installed_packages": {
+            "anyOf": [
+              {
+                "items": {
+                  "type": "object"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Installed Packages"
+          },
+          "node_id": {
+            "title": "Node Id",
+            "type": "integer"
+          },
+          "observed_at": {
+            "format": "date-time",
+            "title": "Observed At",
+            "type": "string"
+          },
+          "os_version": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Os Version"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": ["node_id", "observed_at", "id"],
+        "title": "HostSystemObservationResponse",
+        "type": "object"
+      },
+      "HostSystemObservationWrite": {
+        "description": "Define the model for writing host system observation data to the inventory.\n\n:param node_id: The foreign key referencing the node. Defaults to None.\n:type node_id: int | None\n:param os_version: The observed operating system version. Defaults to None.\n:type os_version: str | None\n:param installed_packages: Snapshot of installed packages. Defaults to None.\n:type installed_packages: list[dict[str, Any]] | None\n:param config: Snapshot of host configuration. Defaults to None.\n:type config: dict[str, Any] | None\n:param observed_at: When this observation was collected.\n:type observed_at: UTCDatetime",
+        "properties": {
+          "config": {
+            "anyOf": [
+              {
+                "type": "object"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Config"
+          },
+          "installed_packages": {
+            "anyOf": [
+              {
+                "items": {
+                  "type": "object"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Installed Packages"
+          },
+          "node_id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Node Id"
+          },
+          "observed_at": {
+            "format": "date-time",
+            "title": "Observed At",
+            "type": "string"
+          },
+          "os_version": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Os Version"
+          }
+        },
+        "required": ["observed_at"],
+        "title": "HostSystemObservationWrite",
+        "type": "object"
+      },
+      "JsonValue": {},
+      "Node": {
+        "description": "Represent a node in the inventory.\n\n:param address: The network address of the node.\n:type address: NonEmptyStr\n:param name: The name of the node.\n:type name: NonEmptyStr\n:param external_id: An external identifier for the node. Must be unique for source,\n    as defined by composite index ix_node_external_id_source.\n:type external_id: NonEmptyStr | None\n:param source: The source from which the node information is derived. Must be unique\n    for external_id, as defined by composite index ix_node_external_id_source.\n:type source: SourceEnum | None\n:param type: The type of the node (e.g., remote, generic).\n:type type: NonEmptyStr\n:param services: A list of services associated with the node.\n:type services: list[Service]",
+        "properties": {
+          "address": {
+            "minLength": 1,
+            "title": "Address",
+            "type": "string"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "external_id": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "External Id"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "source": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/SourceEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "type": {
+            "default": "generic",
+            "minLength": 1,
+            "title": "Type",
+            "type": "string"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": ["id", "address", "name"],
+        "title": "Node",
+        "type": "object"
+      },
+      "NodeResponse": {
+        "description": "Represent a node API response.\n\n:param id: The primary key for the table. Auto-incremented and not nullable.\n:type id: int | None\n:param created_at: The timestamp when the record is created. Defaults to the current\n    time in UTC.\n:type created_at: UTCDatetime\n:param updated_at: The timestamp when the record is last updated. Automatically\n    updated on changes.\n:type updated_at: UTCDatetime | None\n:param address: The network address of the node.\n:type address: NonEmptyStr\n:param name: The name of the node.\n:type name: NonEmptyStr\n:param external_id: An external identifier for the node.\n:type external_id: NonEmptyStr | None\n:param source: The source from which the node information is derived.\n:type source: SourceEnum | None\n:param type: The type of the node (e.g., remote, generic).\n:type type: NonEmptyStr\n:param services: A list of services associated with the node.\n:type services: list[Service]",
+        "properties": {
+          "address": {
+            "minLength": 1,
+            "title": "Address",
+            "type": "string"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "external_id": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "External Id"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "services": {
+            "items": {
+              "$ref": "#/components/schemas/Service"
+            },
+            "title": "Services",
+            "type": "array"
+          },
+          "source": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/SourceEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "type": {
+            "default": "generic",
+            "minLength": 1,
+            "title": "Type",
+            "type": "string"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": ["address", "name", "id", "services"],
+        "title": "NodeResponse",
+        "type": "object"
+      },
+      "NodeWrite": {
+        "description": "Define the model for writing node data to the inventory.\n\n:param address: The network address of the node.\n:type address: NonEmptyStr\n:param name: The name of the node.\n:type name: NonEmptyStr\n:param external_id: An external identifier for the node, indexed for quick lookup.\n    Defaults to None.\n:type external_id: NonEmptyStr | None\n:param source: The source from which the node information is derived. Indexed for\n    quick lookup. Defaults to None.\n:type source: SourceEnum | None\n:param type: The type of the node (e.g., remote, generic). Defaults to \"generic\".\n:type type: NonEmptyStr",
+        "properties": {
+          "address": {
+            "minLength": 1,
+            "title": "Address",
+            "type": "string"
+          },
+          "external_id": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "External Id"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "source": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/SourceEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "type": {
+            "default": "generic",
+            "minLength": 1,
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["address", "name"],
+        "title": "NodeWrite",
+        "type": "object"
+      },
+      "PaginatedResponse_NodeResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/NodeResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[NodeResponse]",
+        "type": "object"
+      },
+      "PaginatedResponse_SchemaResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/SchemaResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[SchemaResponse]",
+        "type": "object"
+      },
+      "PaginatedResponse_ServiceResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/ServiceResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[ServiceResponse]",
+        "type": "object"
+      },
+      "PaginatedResponse_TableResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/TableResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[TableResponse]",
+        "type": "object"
+      },
+      "PaginatedResponse_Union_SchemaResponse__SchemaCompactResponse__": {
+        "properties": {
+          "items": {
+            "items": {
+              "anyOf": [
+                {
+                  "$ref": "#/components/schemas/SchemaResponse"
+                },
+                {
+                  "$ref": "#/components/schemas/SchemaCompactResponse"
+                }
+              ]
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[Union[SchemaResponse, SchemaCompactResponse]]",
+        "type": "object"
+      },
+      "ReloadClassification": {
+        "description": "Declare the reload behavior of an overridable settings field.\n\n:cvar HOT: Field can be overridden via a DB row and the new value takes\n    effect on the next snapshot refresh, without restarting the service.\n    For a nested-model field, ``HOT`` permits both whole-object override\n    (``PATCH {parent: {...}}``) and per-child override (``parent__leaf``).\n:vartype HOT: str\n:cvar NESTED_ONLY: Nested-model field whose children may be overridden\n    (``parent__leaf``) while the parent itself rejects whole-object\n    override (``PATCH {parent: {...}}`` → 422). Children default to\n    HOT-inherit unless explicitly marked :func:`not_overridable_field`.\n:vartype NESTED_ONLY: str\n:cvar NOT_OVERRIDABLE: Field is not overridable from the database; YAML\n    and environment variables remain the only sources of truth.\n:vartype NOT_OVERRIDABLE: str",
+        "enum": ["hot", "nested_only", "not_overridable"],
+        "title": "ReloadClassification",
+        "type": "string"
+      },
+      "Schema": {
+        "description": "Represent a database schema within a service.\n\n:param id: The primary key for the table. Auto-incremented and not nullable.\n:type id: int | None\n:param created_at: The timestamp when the record is created. Defaults to the current\n    time in UTC.\n:type created_at: UTCDatetime\n:param updated_at: The timestamp when the record is last updated. Automatically\n    updated on changes.\n:type updated_at: UTCDatetime | None\n:param name: The name of the schema. Must be unique for service_id, as defined by\n    composite index ix_schema_name_service_id.\n:type name: NonEmptyStr\n:param service_id: The unique identifier of the service to which the schema belongs.\n    Must be unique for name, as defined by composite index\n    ix_schema_name_service_id.\n:type service_id: int\n:param service: The service to which the schema is associated.\n:type service: Service\n:param tables: A list of tables within the schema.\n:type tables: list[Table]",
+        "properties": {
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "service_id": {
+            "title": "Service Id",
+            "type": "integer"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": ["name", "service_id", "id"],
+        "title": "Schema",
+        "type": "object"
+      },
+      "SchemaCompactResponse": {
+        "description": "Define a compact schema response without nested tables.\n\n:param id: The primary key for the schema. Auto-incremented and not nullable.\n:type id: int | None\n:param created_at: The timestamp when the record is created. Defaults to the current\n    time in UTC.\n:type created_at: UTCDatetime\n:param updated_at: The timestamp when the record is last updated. Automatically\n    updated on changes.\n:type updated_at: UTCDatetime | None\n:param name: The name of the schema.\n:type name: NonEmptyStr\n:param service_id: The unique identifier of the service to which the schema belongs.\n:type service_id: int",
+        "properties": {
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "service_id": {
+            "title": "Service Id",
+            "type": "integer"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": ["name", "service_id", "id"],
+        "title": "SchemaCompactResponse",
+        "type": "object"
+      },
+      "SchemaDetailResponse": {
+        "description": "Define the schema retrieve API response.\n\n:param id: The primary key for the table. Auto-incremented and not nullable.\n:type id: int | None\n:param created_at: The timestamp when the record is created. Defaults to the current\n    time in UTC.\n:type created_at: UTCDatetime\n:param updated_at: The timestamp when the record is last updated. Automatically\n    updated on changes.\n:type updated_at: UTCDatetime | None\n:param name: The name of the schema.\n:type name: NonEmptyStr\n:param service_id: The unique identifier of the service to which the schema belongs.\n:type service_id: int\n:param service: The schema's service.\n:type service: Service",
+        "properties": {
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "service": {
+            "$ref": "#/components/schemas/Service"
+          },
+          "service_id": {
+            "title": "Service Id",
+            "type": "integer"
+          },
+          "tables": {
+            "items": {
+              "$ref": "#/components/schemas/Table"
+            },
+            "title": "Tables",
+            "type": "array"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": ["name", "service_id", "id", "tables", "service"],
+        "title": "SchemaDetailResponse",
+        "type": "object"
+      },
+      "SchemaResponse": {
+        "description": "Define the schema API response.\n\n:param id: The primary key for the schema. Auto-incremented and not nullable.\n:type id: int | None\n:param created_at: The timestamp when the record is created. Defaults to the current\n    time in UTC.\n:type created_at: UTCDatetime\n:param updated_at: The timestamp when the record is last updated. Automatically\n    updated on changes.\n:type updated_at: UTCDatetime | None\n:param name: The name of the schema.\n:type name: NonEmptyStr\n:param service_id: The unique identifier of the service to which the schema belongs.\n:type service_id: int\n:param tables: A list of tables within the schema.\n:type tables: list[Table]",
+        "properties": {
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "service_id": {
+            "title": "Service Id",
+            "type": "integer"
+          },
+          "tables": {
+            "items": {
+              "$ref": "#/components/schemas/Table"
+            },
+            "title": "Tables",
+            "type": "array"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": ["name", "service_id", "id", "tables"],
+        "title": "SchemaResponse",
+        "type": "object"
+      },
+      "SchemaWrite": {
+        "description": "Define the model for writing schema data to the inventory.\n\n:param name: The name of the schema.\n:type name: NonEmptyStr\n:param service_id: The foreign key referencing the service to which the schema\n    belongs. Defaults to None.\n:type service_id: int | None",
+        "properties": {
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "service_id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Service Id"
+          }
+        },
+        "required": ["name"],
+        "title": "SchemaWrite",
+        "type": "object"
+      },
+      "Service": {
+        "description": "Represent a service running on a node in the inventory.\n\n:param id: The primary key for the table. Auto-incremented and not nullable.\n:type id: int | None\n:param created_at: The timestamp when the record is created. Defaults to the current\n    time in UTC.\n:type created_at: UTCDatetime\n:param updated_at: The timestamp when the record is last updated. Automatically\n    updated on changes.\n:type updated_at: UTCDatetime | None\n:param external_id: An external identifier for the service. Must be unique for\n    node_id, as defined by composite index ix_service_external_id_node_id.\n:type external_id: NonEmptyStr | None\n:param name: The name of the service.\n:type name: NonEmptyStr\n:param type: The type of the service (e.g., MYSQL, POSTGRESQL).\n:type type: ServiceTypeEnum\n:param port: The port number on which the service is running. Must be unique for\n    node_id, as defined by composite index ix_service_port_node_id.\n:type port: int | None\n:param environment: The environment in which the service is running, if set.\n:type environment: str | None\n:param cluster: The cluster in which the service is running, if set.\n:type cluster: str | None\n:param replication_set: The replication set in which the service is running, if set.\n:type replication_set: str | None\n:param custom_labels: Custom labels associated with the service, if set.\n:type custom_labels: dict[str, Any] | None\n:param node_id: The unique identifier of the node on which the service is running.\n    Must be unique for external_id, as defined by composite index\n    ix_service_external_id_node_id, and for port, as defined by composite index\n    ix_service_port_node_id.\n:type node_id: int\n:param node: The node to which the service is associated.\n:type node: Node\n:param schemas: A list of schemas associated with the service.\n:type schemas: list[Schema]",
+        "properties": {
+          "cluster": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Cluster"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "custom_labels": {
+            "anyOf": [
+              {
+                "type": "object"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Custom Labels"
+          },
+          "environment": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Environment"
+          },
+          "external_id": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "External Id"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "node_id": {
+            "title": "Node Id",
+            "type": "integer"
+          },
+          "port": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Port"
+          },
+          "replication_set": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Replication Set"
+          },
+          "type": {
+            "$ref": "#/components/schemas/ServiceTypeEnum"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": ["name", "type", "node_id", "id"],
+        "title": "Service",
+        "type": "object"
+      },
+      "ServiceDetailResponse": {
+        "description": "Define the service retrieve API response.\n\n:param id: The primary key for the table. Auto-incremented and not nullable.\n:type id: int | None\n:param created_at: The timestamp when the record is created. Defaults to the current\n    time in UTC.\n:type created_at: UTCDatetime\n:param updated_at: The timestamp when the record is last updated. Automatically\n    updated on changes.\n:type updated_at: UTCDatetime | None\n:param external_id: An external identifier for the service.\n:type external_id: NonEmptyStr | None\n:param name: The name of the service.\n:type name: NonEmptyStr\n:param type: The type of the service (e.g., MYSQL, POSTGRESQL).\n:type type: ServiceTypeEnum\n:param port: The port number on which the service is running.\n:type port: int | None\n:param environment: The environment in which the service is running, if set.\n:type environment: str | None\n:param cluster: The cluster in which the service is running, if set.\n:type cluster: str | None\n:param replication_set: The replication set in which the service is running, if set.\n:type replication_set: str | None\n:param custom_labels: Custom labels associated with the service, if set.\n:type custom_labels: dict[str, Any] | None\n:param node_id: The unique identifier of the node on which the service is running.\n:type node_id: int\n:param schemas: A list of schemas associated with the service.\n:type schemas: list[Schema]\n:param node: The service's node.\n:type node: Node",
+        "properties": {
+          "cluster": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Cluster"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "custom_labels": {
+            "anyOf": [
+              {
+                "type": "object"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Custom Labels"
+          },
+          "environment": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Environment"
+          },
+          "external_id": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "External Id"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "node": {
+            "$ref": "#/components/schemas/Node"
+          },
+          "node_id": {
+            "title": "Node Id",
+            "type": "integer"
+          },
+          "port": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Port"
+          },
+          "replication_set": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Replication Set"
+          },
+          "schemas": {
+            "items": {
+              "$ref": "#/components/schemas/Schema"
+            },
+            "title": "Schemas",
+            "type": "array"
+          },
+          "type": {
+            "$ref": "#/components/schemas/ServiceTypeEnum"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": ["name", "type", "node_id", "id", "schemas", "node"],
+        "title": "ServiceDetailResponse",
+        "type": "object"
+      },
+      "ServiceResponse": {
+        "description": "Define the service API response.\n\n:param id: The primary key for the table. Auto-incremented and not nullable.\n:type id: int | None\n:param created_at: The timestamp when the record is created. Defaults to the current\n    time in UTC.\n:type created_at: UTCDatetime\n:param updated_at: The timestamp when the record is last updated. Automatically\n    updated on changes.\n:type updated_at: UTCDatetime | None\n:param external_id: An external identifier for the service.\n:type external_id: NonEmptyStr | None\n:param name: The name of the service.\n:type name: NonEmptyStr\n:param type: The type of the service (e.g., MYSQL, POSTGRESQL).\n:type type: ServiceTypeEnum\n:param port: The port number on which the service is running.\n:type port: int | None\n:param environment: The environment in which the service is running, if set.\n:type environment: str | None\n:param cluster: The cluster in which the service is running, if set.\n:type cluster: str | None\n:param replication_set: The replication set in which the service is running, if set.\n:type replication_set: str | None\n:param custom_labels: Custom labels associated with the service, if set.\n:type custom_labels: dict[str, Any] | None\n:param node_id: The unique identifier of the node on which the service is running.\n:type node_id: int\n:param schemas: A list of schemas associated with the service.\n:type schemas: list[Schema]\n:param node: The node to which the service is associated.\n:type node: Node",
+        "properties": {
+          "cluster": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Cluster"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "custom_labels": {
+            "anyOf": [
+              {
+                "type": "object"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Custom Labels"
+          },
+          "environment": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Environment"
+          },
+          "external_id": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "External Id"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "node": {
+            "$ref": "#/components/schemas/Node"
+          },
+          "node_id": {
+            "title": "Node Id",
+            "type": "integer"
+          },
+          "port": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Port"
+          },
+          "replication_set": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Replication Set"
+          },
+          "schemas": {
+            "items": {
+              "$ref": "#/components/schemas/Schema"
+            },
+            "title": "Schemas",
+            "type": "array"
+          },
+          "type": {
+            "$ref": "#/components/schemas/ServiceTypeEnum"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": ["name", "type", "node_id", "id", "schemas", "node"],
+        "title": "ServiceResponse",
+        "type": "object"
+      },
+      "ServiceSystemObservationResponse": {
+        "description": "Define the response model for service system observation data.\n\n:param id: The primary key of the observation record.\n:type id: int | None\n:param created_at: When the record was created.\n:type created_at: UTCDatetime\n:param updated_at: When the record was last updated.\n:type updated_at: UTCDatetime | None\n:param service_id: The unique identifier of the observed service.\n:type service_id: int\n:param db_engine_version: The observed database engine version.\n:type db_engine_version: NonEmptyStr\n:param observed_at: When this observation was collected.\n:type observed_at: UTCDatetime",
+        "properties": {
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "db_engine_version": {
+            "minLength": 1,
+            "title": "Db Engine Version",
+            "type": "string"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "observed_at": {
+            "format": "date-time",
+            "title": "Observed At",
+            "type": "string"
+          },
+          "service_id": {
+            "title": "Service Id",
+            "type": "integer"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": ["service_id", "db_engine_version", "observed_at", "id"],
+        "title": "ServiceSystemObservationResponse",
+        "type": "object"
+      },
+      "ServiceSystemObservationWrite": {
+        "description": "Define the model for writing service system observation data to the inventory.\n\n:param service_id: The foreign key referencing the service. Defaults to None.\n:type service_id: int | None\n:param db_engine_version: The observed database engine version.\n:type db_engine_version: NonEmptyStr\n:param observed_at: When this observation was collected.\n:type observed_at: UTCDatetime",
+        "properties": {
+          "db_engine_version": {
+            "minLength": 1,
+            "title": "Db Engine Version",
+            "type": "string"
+          },
+          "observed_at": {
+            "format": "date-time",
+            "title": "Observed At",
+            "type": "string"
+          },
+          "service_id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Service Id"
+          }
+        },
+        "required": ["db_engine_version", "observed_at"],
+        "title": "ServiceSystemObservationWrite",
+        "type": "object"
+      },
+      "ServiceTypeEnum": {
+        "description": "Enumerate the supported service types.\n\n:cvar MYSQL: Represents the MySQL service type.\n:vartype MYSQL: str\n:cvar POSTGRESQL: Represents the PostgreSQL service type.\n:vartype POSTGRESQL: str\n:cvar MONGODB: Represents the MongoDB service type.\n:vartype MONGODB: str\n:cvar PROXYSQL: Represents the ProxySQL service type.\n:vartype PROXYSQL: str\n:cvar HAPROXY: Represents the HAProxy service type.\n:vartype HAPROXY: str\n:cvar EXTERNAL: Represents an external service type.\n:vartype EXTERNAL: str\n:cvar VALKEY: Represents the Valkey service type.\n:vartype VALKEY: str",
+        "enum": [
+          "mysql",
+          "postgresql",
+          "mongodb",
+          "proxysql",
+          "haproxy",
+          "external",
+          "valkey"
+        ],
+        "title": "ServiceTypeEnum",
+        "type": "string"
+      },
+      "ServiceWrite": {
+        "description": "Define the model for writing service data to the inventory.\n\n:param external_id: An external identifier for the service, indexed for quick\n    lookup. Defaults to None.\n:type external_id: NonEmptyStr | None\n:param name: The name of the service.\n:type name: NonEmptyStr\n:param type: The type of the service (e.g., MYSQL, POSTGRESQL).\n:type type: ServiceTypeEnum\n:param port: The port number on which the service is running. Defaults to None.\n:type port: int | None\n:param environment: The environment in which the service is running (e.g.,\n    production, staging). Defaults to None.\n:type environment: str | None\n:param cluster: The cluster in which the service is running. Defaults to None.\n:type cluster: str | None\n:param replication_set: The replication set in which the service is running. Defaults to None.\n:type replication_set: str | None\n:param custom_labels: Custom labels associated with the service. Defaults to None.\n:type custom_labels: dict[str, Any] | None\n:param node_id: The foreign key referencing the node to which the service belongs.\n    Defaults to None.\n:type node_id: int | None",
+        "properties": {
+          "cluster": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Cluster"
+          },
+          "custom_labels": {
+            "anyOf": [
+              {
+                "type": "object"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Custom Labels"
+          },
+          "environment": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Environment"
+          },
+          "external_id": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "External Id"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "node_id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Node Id"
+          },
+          "port": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Port"
+          },
+          "replication_set": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Replication Set"
+          },
+          "type": {
+            "$ref": "#/components/schemas/ServiceTypeEnum"
+          }
+        },
+        "required": ["name", "type"],
+        "title": "ServiceWrite",
+        "type": "object"
+      },
+      "SettingClassEnum": {
+        "description": "Enumerate settings classes that may have HOT override rows.\n\nThe wired classes are ``SEPSettings``, ``TasksSettings``,\n``SnippetsSettings``, ``MessagesSettings``, the global ``Settings``,\n``AlertSettings``, ``AlertsSettings``, ``AnonymizerSettings`` and\n``InventorySettings``.\n\nTo wire a new settings class:\n\n1. Add a member here whose value matches the Pydantic class ``__name__``.\n2. Generate an Alembic migration on every consumer track that extends the\n   ``CHECK`` constraint on ``settingoverride.setting_class``. The column\n   uses ``native_enum=False`` so the value list lives in a constraint,\n   not a PostgreSQL ``TYPE`` -- the migration ``ALTER``s the constraint.\n   Note that the column and ``CHECK`` constraint persist the enum member\n   *names* (e.g. ``SEP_SETTINGS``), which is distinct from the member\n   *value* (the Pydantic class name, e.g. ``SEPSettings``).\n3. Wire a ``ProxyEntry`` for the new class in the relevant service's\n   lifespan (``app/sep/main.py`` or ``app/tasks/main.py``).",
+        "enum": [
+          "SEPSettings",
+          "TasksSettings",
+          "SnippetsSettings",
+          "MessagesSettings",
+          "Settings",
+          "AlertSettings",
+          "AnonymizerSettings",
+          "AlertsSettings",
+          "InventorySettings"
+        ],
+        "title": "SettingClassEnum",
+        "type": "string"
+      },
+      "SettingClassGroup": {
+        "description": "One settings-class group in the LIST response.\n\n:param setting_class: The settings class this group represents.\n:type setting_class: SettingClassEnum\n:param settings: The fields declared on the settings class, with their\n    current values and metadata.\n:type settings: list[SettingResponse]\n:param is_app_owned: Whether this group belongs to a SEP app under\n    ``app/sep/apps/`` rather than core SEP wiring.\n:type is_app_owned: bool\n:param app_id: The owning app's registry key when ``is_app_owned`` is\n    ``True``; ``None`` for core groups.\n:type app_id: str | None\n:param app_display_name: The owning app's human-facing label when\n    ``is_app_owned`` is ``True``; ``None`` for core groups.\n:type app_display_name: str | None\n:param app_enabled: Whether the owning app is currently enabled when\n    ``is_app_owned`` is ``True``; ``None`` for core groups. Disabled\n    apps remain listed so the frontend can hide them without a second\n    lookup.\n:type app_enabled: bool | None",
+        "properties": {
+          "app_display_name": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "App Display Name"
+          },
+          "app_enabled": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "App Enabled"
+          },
+          "app_id": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "App Id"
+          },
+          "is_app_owned": {
+            "default": false,
+            "title": "Is App Owned",
+            "type": "boolean"
+          },
+          "setting_class": {
+            "$ref": "#/components/schemas/SettingClassEnum"
+          },
+          "settings": {
+            "items": {
+              "$ref": "#/components/schemas/SettingResponse"
+            },
+            "title": "Settings",
+            "type": "array"
+          }
+        },
+        "required": ["setting_class", "settings"],
+        "title": "SettingClassGroup",
+        "type": "object"
+      },
+      "SettingResponse": {
+        "description": "Represent a single setting's metadata and current value.\n\n:param setting_class: The settings class the field belongs to.\n:param key: The field name on the settings class.\n:param key_path: Carry the canonical key segments for ``key`` such that\n    ``\"__\".join(key_path) == key``.\n:param value: The current value visible through the proxy, dumped to a\n    JSON-safe shape via the field's annotation. ``SecretStr`` fields are\n    redacted to ``\"**********\"``.\n:param default_value: The field's declared default value, dumped via the\n    same JSON serialiser. ``None`` when no default exists.\n:param type: A human-readable representation of the field's declared\n    annotation (for operator visibility; validation uses the actual\n    ``FieldInfo``).\n:param reload: The reload classification (HOT or NOT_OVERRIDABLE).\n:param description: The field's free-text description, or ``None``.\n:param is_secret: Whether the field's annotation contains a Pydantic secret\n    (``SecretStr`` / ``SecretBytes``) at any depth.\n:param is_complex: Whether the field's annotation is or contains a Pydantic\n    ``BaseModel`` subclass (true for nested submodels).\n:param has_override: Whether a row exists in the ``settingoverride`` table\n    for this ``(setting_class, key)`` pair, regardless of ``is_active``.\n:param is_advanced: Whether the setting is flagged ``advanced`` so the UI can\n    present it separately from everyday settings. Display-only:\n    it does not affect PATCH/DELETE eligibility.\n:param is_applicable: Whether the setting applies under current runtime state\n    (e.g. the active auth provider). ``False`` lets the UI present the field\n    as inert. Display-only, like ``is_advanced``: it does not block\n    PATCH/DELETE server-side; the runtime gate is the real enforcement.",
+        "properties": {
+          "default_value": {
+            "title": "Default Value"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "has_override": {
+            "title": "Has Override",
+            "type": "boolean"
+          },
+          "is_advanced": {
+            "default": false,
+            "title": "Is Advanced",
+            "type": "boolean"
+          },
+          "is_applicable": {
+            "default": true,
+            "title": "Is Applicable",
+            "type": "boolean"
+          },
+          "is_complex": {
+            "title": "Is Complex",
+            "type": "boolean"
+          },
+          "is_secret": {
+            "title": "Is Secret",
+            "type": "boolean"
+          },
+          "key": {
+            "title": "Key",
+            "type": "string"
+          },
+          "key_path": {
+            "items": {
+              "type": "string"
+            },
+            "title": "Key Path",
+            "type": "array"
+          },
+          "reload": {
+            "$ref": "#/components/schemas/ReloadClassification"
+          },
+          "setting_class": {
+            "$ref": "#/components/schemas/SettingClassEnum"
+          },
+          "type": {
+            "title": "Type",
+            "type": "string"
+          },
+          "value": {
+            "title": "Value"
+          }
+        },
+        "required": [
+          "setting_class",
+          "key",
+          "value",
+          "default_value",
+          "type",
+          "reload",
+          "description",
+          "is_secret",
+          "is_complex",
+          "has_override"
+        ],
+        "title": "SettingResponse",
+        "type": "object"
+      },
+      "SettingsListResponse": {
+        "description": "The LIST endpoint response, grouping settings by class.\n\n:param groups: One :class:`SettingClassGroup` per settings class the\n    router was configured with.\n:type groups: list[SettingClassGroup]",
+        "properties": {
+          "groups": {
+            "items": {
+              "$ref": "#/components/schemas/SettingClassGroup"
+            },
+            "title": "Groups",
+            "type": "array"
+          }
+        },
+        "required": ["groups"],
+        "title": "SettingsListResponse",
+        "type": "object"
+      },
+      "SettingsPatch": {
+        "additionalProperties": {
+          "$ref": "#/components/schemas/JsonValue"
+        },
+        "description": "Batch PATCH payload: a flat ``{field_name: new_value, ...}`` mapping.\n\nAn empty body is rejected as 422 because a no-op PATCH is a client bug, not\na valid request. The server coerces each value to the field's declared\ntype via :func:`coerce_field_value`; validation is all-or-nothing -- if any\nkey fails, nothing is written.",
+        "minProperties": 1,
+        "title": "SettingsPatch",
+        "type": "object"
+      },
+      "SourceEnum": {
+        "const": "pmm",
+        "description": "Enumeration of possible data sources for a node.\n\n:cvar PMM: Represents the PMM data source.\n:vartype PMM: str",
+        "enum": ["pmm"],
+        "title": "SourceEnum",
+        "type": "string"
+      },
+      "Table": {
+        "description": "Represent a table within a schema.\n\n:param id: The primary key for the table. Auto-incremented and not nullable.\n:type id: int | None\n:param created_at: The timestamp when the record is created. Defaults to the current\n    time in UTC.\n:type created_at: UTCDatetime\n:param updated_at: The timestamp when the record is last updated. Automatically\n    updated on changes.\n:type updated_at: UTCDatetime | None\n:param name: The name of the table. Must be unique for schema_id, as defined by\n    composite index ix_table_name_schema_id.\n:type name: NonEmptyStr\n:param create: The SQL statement used to create the table.\n:type create: NonEmptyStr\n:param schema_id: The unique identifier of the schema to which the table belongs.\n    Must be unique for name, as defined by composite index ix_table_name_schema_id.\n:type schema_id: int\n:param database: The schema to which the table is associated.\n:type database: Schema",
+        "properties": {
+          "create": {
+            "minLength": 1,
+            "title": "Create",
+            "type": "string"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "keys": {
+            "title": "Keys",
+            "type": "object"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "schema_id": {
+            "title": "Schema Id",
+            "type": "integer"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": ["name", "create", "schema_id", "keys", "id"],
+        "title": "Table",
+        "type": "object"
+      },
+      "TableDetailResponse": {
+        "description": "Define the schema retrieve API response.\n\n:param id: The primary key for the table. Auto-incremented and not nullable.\n:type id: int | None\n:param created_at: The timestamp when the record is created. Defaults to the current\n    time in UTC.\n:type created_at: UTCDatetime\n:param updated_at: The timestamp when the record is last updated. Automatically\n    updated on changes.\n:type updated_at: UTCDatetime | None\n:param name: The name of the table.\n:type name: NonEmptyStr\n:param create: The SQL statement used to create the table.\n:type create: NonEmptyStr\n:param schema_id: The foreign key referencing the schema to which the table belongs.\n:type schema_id: int\n:param database: The table's schema.\n:type database: Schema",
+        "properties": {
+          "create": {
+            "minLength": 1,
+            "title": "Create",
+            "type": "string"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "database": {
+            "$ref": "#/components/schemas/Schema"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "keys": {
+            "title": "Keys",
+            "type": "object"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "schema_id": {
+            "title": "Schema Id",
+            "type": "integer"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": ["name", "create", "schema_id", "keys", "id", "database"],
+        "title": "TableDetailResponse",
+        "type": "object"
+      },
+      "TableResponse": {
+        "description": "Define the table API response.\n\n:param id: The primary key for the table. Auto-incremented and not nullable.\n:type id: int | None\n:param created_at: The timestamp when the record is created. Defaults to the current\n    time in UTC.\n:type created_at: UTCDatetime\n:param updated_at: The timestamp when the record is last updated. Automatically\n    updated on changes.\n:type updated_at: UTCDatetime | None\n:param name: The name of the table.\n:type name: NonEmptyStr\n:param create: The SQL statement used to create the table.\n:type create: NonEmptyStr\n:param schema_id: The foreign key referencing the schema to which the table belongs.\n:type schema_id: int",
+        "properties": {
+          "create": {
+            "minLength": 1,
+            "title": "Create",
+            "type": "string"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "keys": {
+            "title": "Keys",
+            "type": "object"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "schema_id": {
+            "title": "Schema Id",
+            "type": "integer"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": ["name", "create", "schema_id", "keys", "id"],
+        "title": "TableResponse",
+        "type": "object"
+      },
+      "TableWrite": {
+        "description": "Define the model for writing table data to the inventory.\n\n:param name: The name of the table.\n:type name: NonEmptyStr\n:param create: The SQL statement used to create the table.\n:type create: NonEmptyStr\n:param schema_id: The foreign key referencing the schema to which the table belongs.\n:type schema_id: int | None",
+        "properties": {
+          "create": {
+            "minLength": 1,
+            "title": "Create",
+            "type": "string"
+          },
+          "keys": {
+            "title": "Keys",
+            "type": "object"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "schema_id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Schema Id"
+          }
+        },
+        "required": ["name", "create", "keys"],
+        "title": "TableWrite",
+        "type": "object"
+      },
+      "ValidationError": {
+        "properties": {
+          "ctx": {
+            "title": "Context",
+            "type": "object"
+          },
+          "input": {
+            "title": "Input"
+          },
+          "loc": {
+            "items": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "integer"
+                }
+              ]
+            },
+            "title": "Location",
+            "type": "array"
+          },
+          "msg": {
+            "title": "Message",
+            "type": "string"
+          },
+          "type": {
+            "title": "Error Type",
+            "type": "string"
+          }
+        },
+        "required": ["loc", "msg", "type"],
+        "title": "ValidationError",
+        "type": "object"
+      }
+    },
+    "securitySchemes": {
+      "OAuth2PasswordBearer": {
+        "flows": {
+          "password": {
+            "scopes": {},
+            "tokenUrl": "/api/oauth/token"
+          }
+        },
+        "type": "oauth2"
+      }
+    }
+  },
+  "info": {
+    "description": "Percona Services Enablement Platform — inventory (nodes, services, schemas, tables).",
+    "title": "SEP Inventory API",
+    "version": "v1.0.0.dev0"
+  },
+  "openapi": "3.1.0",
+  "paths": {
+    "/admin/settings/": {
+      "get": {
+        "description": "List every exposed settings class with current values and metadata.\n\nLocal classes are read from their config singletons; remote classes\n(``remote_classes``) are fetched server-side from their owning sub-app\nand appended in declaration order; app-owned classes follow remote\ngroups with per-group app metadata. A failed remote fetch fails the\nwhole request with ``502`` -- the LIST never silently drops a remote\ngroup.\n\n:param session: The sub-app's database session.\n:param remote_api: The client for remote settings classes (``None`` when\n    the router wires none).\n:return: Grouped responses, one group per configured settings class.",
+        "operationId": "settings_list_settings_admin_settings__get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SettingsListResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "List Settings",
+        "tags": ["settings"]
+      }
+    },
+    "/admin/settings/{setting_class}": {
+      "patch": {
+        "description": "Apply a batch of overrides for one settings class atomically.\n\nFor a remote class the batch is forwarded to the owning sub-app, which\nowns the validation and persistence; the upstream's per-field ``422``\n(and its ``detail``) is preserved so the UI can render inline messages.\n\nFor a local class: Phase A validates every key in ``body`` (existence on\nthe class, HOT classification, type/constraint coercion) and collects\nper-key errors. If any key fails, the whole batch is rejected with a\nstructured 422 and nothing is written. Phase B persists every valid entry\nin a single transaction, refreshes the proxy snapshot once, then fires\nthe rebind callbacks for any changed keys so a HOT target rebinds without\nwaiting for the next background refresh cycle.\n\n:param request: The incoming request; its ``app.state`` carries the\n    sub-app's rebind-callback registry.\n:param setting_class: The settings class the override targets.\n:param body: The batch of ``{key: value, ...}`` overrides.\n:param session: The sub-app's database session.\n:param remote_api: The client for remote settings classes (``None`` when\n    the router wires none).\n:return: One :class:`SettingResponse` per applied key, in input order.\n:raises HTTPNotFoundException: If the class isn't exposed.\n:raises HTTPUnprocessableEntityException: If any key fails validation;\n    no rows are written.",
+        "operationId": "settings_patch_settings_admin_settings__setting_class__patch",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "setting_class",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/SettingClassEnum"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SettingsPatch"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "items": {
+                    "$ref": "#/components/schemas/SettingResponse"
+                  },
+                  "title": "Response Settings Patch Settings Admin Settings  Setting Class  Patch",
+                  "type": "array"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Patch Settings",
+        "tags": ["settings"]
+      }
+    },
+    "/admin/settings/{setting_class}/{key}": {
+      "delete": {
+        "description": "Revert one override row to the field's declared default.\n\nFor a remote class the DELETE is forwarded to the owning sub-app, which\nowns the idempotency and ``NOT_OVERRIDABLE`` semantics; its status and\n``detail`` are preserved through the proxy.\n\nFor a local class the DELETE is idempotent: deleting a (class, key) pair\nthat has no override row succeeds with 204. Attempting to delete a field\nthe code declares NOT_OVERRIDABLE responds 409, since it cannot have an\noverride row in the first place and the operator's intent is\nunsatisfiable. A field only ``SETTINGS_OVERRIDE_ALLOWED_KEYS`` withheld\nmay still carry a row written before the restriction applied, so that\nrow is deleted normally and only the no-row case answers 409.\n\nAfter republishing the snapshot, fires the rebind callbacks for the\nreverted key so a HOT target rebinds to its restored value without\nwaiting for the next background refresh cycle.\n\n:param request: The incoming request; its ``app.state`` carries the\n    sub-app's rebind-callback registry.\n:param setting_class: The settings class the field belongs to.\n:param key: The field name on the settings class.\n:param session: The sub-app's database session.\n:param remote_api: The client for remote settings classes (``None`` when\n    the router wires none).\n:raises HTTPNotFoundException: If the class isn't exposed or the key\n    doesn't exist on the class.\n:raises HTTPConflictException: If the field is NOT_OVERRIDABLE and has\n    no row to delete.\n:raises HTTPUnprocessableEntityException: If ``key`` names a\n    ``NESTED_ONLY`` parent (the whole parent cannot be overridden;\n    target an individual ``parent__leaf`` instead).\n:raises HTTPBadGatewayException: For a remote class, when the owning\n    sub-app returns a server error (status >= 500) or is unreachable.",
+        "operationId": "settings_delete_setting_admin_settings__setting_class___key__delete",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "setting_class",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/SettingClassEnum"
+            }
+          },
+          {
+            "in": "path",
+            "name": "key",
+            "required": true,
+            "schema": {
+              "title": "Key",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Delete Setting",
+        "tags": ["settings"]
+      },
+      "get": {
+        "description": "Return one field's metadata and current value.\n\n:param setting_class: The settings class the field belongs to.\n:param key: The field name on the settings class.\n:param session: The sub-app's database session.\n:param remote_api: The client for remote settings classes (``None`` when\n    the router wires none).\n:return: The structured response for the field.\n:raises HTTPNotFoundException: If the class isn't exposed or the key\n    doesn't exist on the class.",
+        "operationId": "settings_get_setting_admin_settings__setting_class___key__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "setting_class",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/SettingClassEnum"
+            }
+          },
+          {
+            "in": "path",
+            "name": "key",
+            "required": true,
+            "schema": {
+              "title": "Key",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SettingResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Get Setting",
+        "tags": ["settings"]
+      }
+    },
+    "/nodes/": {
+      "get": {
+        "description": "List Nodes from Inventory.",
+        "operationId": "nodes_list_nodes_nodes__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "external_id",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "minLength": 1,
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "External Id"
+            }
+          },
+          {
+            "in": "query",
+            "name": "source",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "$ref": "#/components/schemas/SourceEnum"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Source"
+            }
+          },
+          {
+            "in": "query",
+            "name": "node_type",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "minLength": 1,
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Node Type"
+            }
+          },
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PaginatedResponse_NodeResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "List Nodes",
+        "tags": ["nodes"]
+      },
+      "post": {
+        "description": "Create Node.",
+        "operationId": "nodes_create_node_nodes__post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NodeWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Node"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Create Node",
+        "tags": ["nodes"]
+      }
+    },
+    "/nodes/{node_id}": {
+      "delete": {
+        "description": "Delete Node.",
+        "operationId": "nodes_delete_node_nodes__node_id__delete",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "node_id",
+            "required": true,
+            "schema": {
+              "title": "Node Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Delete Node",
+        "tags": ["nodes"]
+      },
+      "get": {
+        "description": "Retrieve Node from inventory.",
+        "operationId": "nodes_retrieve_node_nodes__node_id__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "node_id",
+            "required": true,
+            "schema": {
+              "title": "Node Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NodeResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Retrieve Node",
+        "tags": ["nodes"]
+      },
+      "put": {
+        "description": "Update Node.",
+        "operationId": "nodes_update_node_nodes__node_id__put",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "node_id",
+            "required": true,
+            "schema": {
+              "title": "Node Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NodeWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Node"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Update Node",
+        "tags": ["nodes"]
+      }
+    },
+    "/nodes/{node_id}/services/": {
+      "get": {
+        "description": "List Services by Node.",
+        "operationId": "nodes_list_services_by_node_nodes__node_id__services__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "node_id",
+            "required": true,
+            "schema": {
+              "title": "Node Id",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "service_type",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "$ref": "#/components/schemas/ServiceTypeEnum"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Service Type"
+            }
+          },
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PaginatedResponse_ServiceResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "List Services By Node",
+        "tags": ["nodes"]
+      },
+      "post": {
+        "description": "Create Service for Node.",
+        "operationId": "nodes_create_service_for_node_nodes__node_id__services__post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "node_id",
+            "required": true,
+            "schema": {
+              "title": "Node Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ServiceWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Service"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Create Service For Node",
+        "tags": ["nodes"]
+      }
+    },
+    "/nodes/{node_id}/system-observation": {
+      "get": {
+        "description": "Retrieve host system observation for a node.",
+        "operationId": "nodes_retrieve_host_system_observation_nodes__node_id__system_observation_get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "node_id",
+            "required": true,
+            "schema": {
+              "title": "Node Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HostSystemObservationResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Retrieve Host System Observation",
+        "tags": ["nodes"]
+      },
+      "put": {
+        "description": "Upsert host system observation for a node.",
+        "operationId": "nodes_upsert_host_system_observation_nodes__node_id__system_observation_put",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "node_id",
+            "required": true,
+            "schema": {
+              "title": "Node Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/HostSystemObservationWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HostSystemObservationResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Upsert Host System Observation",
+        "tags": ["nodes"]
+      }
+    },
+    "/schemas/": {
+      "get": {
+        "description": "List Schemas.",
+        "operationId": "schemas_list_schemas_schemas__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PaginatedResponse_SchemaResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "List Schemas",
+        "tags": ["schemas"]
+      }
+    },
+    "/schemas/{schema_id}": {
+      "delete": {
+        "description": "Delete Schema.",
+        "operationId": "schemas_delete_schema_schemas__schema_id__delete",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "schema_id",
+            "required": true,
+            "schema": {
+              "title": "Schema Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Delete Schema",
+        "tags": ["schemas"]
+      },
+      "get": {
+        "description": "Retrieve Schema.",
+        "operationId": "schemas_retrieve_schema_schemas__schema_id__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "schema_id",
+            "required": true,
+            "schema": {
+              "title": "Schema Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SchemaDetailResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Retrieve Schema",
+        "tags": ["schemas"]
+      },
+      "put": {
+        "description": "Update Schema.",
+        "operationId": "schemas_update_schema_schemas__schema_id__put",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "schema_id",
+            "required": true,
+            "schema": {
+              "title": "Schema Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SchemaWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Schema"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Update Schema",
+        "tags": ["schemas"]
+      }
+    },
+    "/schemas/{schema_id}/tables/": {
+      "get": {
+        "description": "List Tables by Schema.",
+        "operationId": "schemas_list_tables_by_schema_schemas__schema_id__tables__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "schema_id",
+            "required": true,
+            "schema": {
+              "title": "Schema Id",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "search",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Search"
+            }
+          },
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PaginatedResponse_TableResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "List Tables By Schema",
+        "tags": ["schemas"]
+      },
+      "post": {
+        "description": "Create Table for Schema.",
+        "operationId": "schemas_create_table_for_schema_schemas__schema_id__tables__post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "schema_id",
+            "required": true,
+            "schema": {
+              "title": "Schema Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/TableWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Table"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Create Table For Schema",
+        "tags": ["schemas"]
+      }
+    },
+    "/services/": {
+      "get": {
+        "description": "List Services.",
+        "operationId": "services_list_services_services__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "service_type",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "$ref": "#/components/schemas/ServiceTypeEnum"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Service Type"
+            }
+          },
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PaginatedResponse_ServiceResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "List Services",
+        "tags": ["services"]
+      }
+    },
+    "/services/{service_id}": {
+      "delete": {
+        "description": "Delete Service.",
+        "operationId": "services_delete_service_services__service_id__delete",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "service_id",
+            "required": true,
+            "schema": {
+              "title": "Service Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Delete Service",
+        "tags": ["services"]
+      },
+      "get": {
+        "description": "Retrieve Service.",
+        "operationId": "services_retrieve_service_services__service_id__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "service_id",
+            "required": true,
+            "schema": {
+              "title": "Service Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ServiceDetailResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Retrieve Service",
+        "tags": ["services"]
+      },
+      "put": {
+        "description": "Update Service.",
+        "operationId": "services_update_service_services__service_id__put",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "service_id",
+            "required": true,
+            "schema": {
+              "title": "Service Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ServiceWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Service"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Update Service",
+        "tags": ["services"]
+      }
+    },
+    "/services/{service_id}/schemas/": {
+      "get": {
+        "description": "List Schemas by Service.\n\nReturn ``SchemaResponse`` (with nested tables) when ``include_tables``\nis set, otherwise return ``SchemaCompactResponse`` (without tables).\n\n:param session: The async database session.\n:type session: AsyncSession\n:param service: The resolved service dependency.\n:type service: Service\n:param search: Filter schemas by name using ILIKE matching.\n:type search: str | None\n:param include_tables: Include nested tables in the response when set to\n    any non-empty value. Defaults to compact mode (no tables).\n:type include_tables: str | None\n:param pagination: Validated offset/limit query parameters.\n:type pagination: Pagination\n:return: A paginated response of schema responses.\n:rtype: PaginatedResponse[SchemaResponse | SchemaCompactResponse]",
+        "operationId": "services_list_schemas_by_service_services__service_id__schemas__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "service_id",
+            "required": true,
+            "schema": {
+              "title": "Service Id",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "search",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Search"
+            }
+          },
+          {
+            "in": "query",
+            "name": "include_tables",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Include Tables"
+            }
+          },
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PaginatedResponse_Union_SchemaResponse__SchemaCompactResponse__"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "List Schemas By Service",
+        "tags": ["services"]
+      },
+      "post": {
+        "description": "Create Schema for Service.",
+        "operationId": "services_create_schema_for_service_services__service_id__schemas__post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "service_id",
+            "required": true,
+            "schema": {
+              "title": "Service Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SchemaWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Schema"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Create Schema For Service",
+        "tags": ["services"]
+      }
+    },
+    "/services/{service_id}/system-observation": {
+      "get": {
+        "description": "Retrieve service system observation for a service.",
+        "operationId": "services_retrieve_service_system_observation_services__service_id__system_observation_get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "service_id",
+            "required": true,
+            "schema": {
+              "title": "Service Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ServiceSystemObservationResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Retrieve Service System Observation",
+        "tags": ["services"]
+      },
+      "put": {
+        "description": "Upsert service system observation for a service.",
+        "operationId": "services_upsert_service_system_observation_services__service_id__system_observation_put",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "service_id",
+            "required": true,
+            "schema": {
+              "title": "Service Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ServiceSystemObservationWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ServiceSystemObservationResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Upsert Service System Observation",
+        "tags": ["services"]
+      }
+    },
+    "/summary/": {
+      "get": {
+        "description": "Retrieve a summary of inventory counts.",
+        "operationId": "summary_get_summary_inventory_summary__get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "additionalProperties": {
+                    "type": "integer"
+                  },
+                  "title": "Response Summary Get Summary Inventory Summary  Get",
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Get Summary Inventory",
+        "tags": ["summary"]
+      }
+    },
+    "/tables/": {
+      "get": {
+        "description": "List Tables.",
+        "operationId": "tables_list_tables_tables__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PaginatedResponse_TableResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "List Tables",
+        "tags": ["tables"]
+      }
+    },
+    "/tables/{table_id}": {
+      "delete": {
+        "description": "Delete Table.",
+        "operationId": "tables_delete_table_tables__table_id__delete",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "table_id",
+            "required": true,
+            "schema": {
+              "title": "Table Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Delete Table",
+        "tags": ["tables"]
+      },
+      "get": {
+        "description": "Retrieve Table.",
+        "operationId": "tables_retrieve_table_tables__table_id__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "table_id",
+            "required": true,
+            "schema": {
+              "title": "Table Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TableDetailResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Retrieve Table",
+        "tags": ["tables"]
+      },
+      "put": {
+        "description": "Update Table.",
+        "operationId": "tables_update_table_tables__table_id__put",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "table_id",
+            "required": true,
+            "schema": {
+              "title": "Table Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/TableWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Table"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Update Table",
+        "tags": ["tables"]
+      }
+    }
+  }
+}
diff --git a/ui/packages/sep/api/specs/main.json b/ui/packages/sep/api/specs/main.json
new file mode 100644
index 00000000000..8d0179be3ed
--- /dev/null
+++ b/ui/packages/sep/api/specs/main.json
@@ -0,0 +1,628 @@
+{
+  "components": {
+    "schemas": {
+      "AlertConfigResponse": {
+        "description": "Represent the response of ``GET /api/config/alerts``.\n\n:param available: Whether at least one alert provider is configured.\n:type available: bool",
+        "properties": {
+          "available": {
+            "title": "Available",
+            "type": "boolean"
+          }
+        },
+        "required": ["available"],
+        "title": "AlertConfigResponse",
+        "type": "object"
+      },
+      "Body_oauth_create_oauth_token_api_oauth_token_post": {
+        "properties": {
+          "client_id": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Client Id"
+          },
+          "client_secret": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "format": "password",
+            "title": "Client Secret"
+          },
+          "grant_type": {
+            "anyOf": [
+              {
+                "pattern": "^password$",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Grant Type"
+          },
+          "password": {
+            "format": "password",
+            "title": "Password",
+            "type": "string"
+          },
+          "scope": {
+            "default": "",
+            "title": "Scope",
+            "type": "string"
+          },
+          "username": {
+            "title": "Username",
+            "type": "string"
+          }
+        },
+        "required": ["username", "password"],
+        "title": "Body_oauth_create_oauth_token_api_oauth_token_post",
+        "type": "object"
+      },
+      "CasdoorUser": {
+        "description": "Represent a Casdoor user.\n\n:param id: The unique identifier of the user.\n:param email: The email address of the user.\n:param first_name: The first name of the user.\n:param last_name: The last name of the user.\n:param is_admin: Whether the user has administrative privileges. Defaults to False.\n:param created_time: The datetime when the user was created. Defaults to current\n    datetime.\n:param updated_time: The datetime when the user was last updated. Defaults to\n    current datetime.\n:param username: The user's Casdoor username.\n:param owner: The user's Casdoor organization.\n:param is_forbidden: Whether the user has the ``is_forbidden`` attribute set in\n    Casdoor. Defaults to False.\n:param is_deleted: Whether the user has the ``is_deleted`` attribute set in Casdoor.\n    Defaults to False.",
+        "properties": {
+          "createdTime": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Createdtime"
+          },
+          "email": {
+            "default": "",
+            "title": "Email",
+            "type": "string"
+          },
+          "firstName": {
+            "default": "",
+            "title": "Firstname",
+            "type": "string"
+          },
+          "fullName": {
+            "description": "The combination of the user's first and last names.\n\n:return: The user's full name.\n:rtype: str",
+            "readOnly": true,
+            "title": "Fullname",
+            "type": "string"
+          },
+          "id": {
+            "format": "uuid4",
+            "title": "Id",
+            "type": "string"
+          },
+          "isActive": {
+            "description": "Return True if the user is not forbidden nor deleted.\n\n:return: True if the user is active.",
+            "readOnly": true,
+            "title": "Isactive",
+            "type": "boolean"
+          },
+          "isAdmin": {
+            "default": false,
+            "title": "Isadmin",
+            "type": "boolean"
+          },
+          "isDeleted": {
+            "default": false,
+            "title": "Isdeleted",
+            "type": "boolean"
+          },
+          "isForbidden": {
+            "default": false,
+            "title": "Isforbidden",
+            "type": "boolean"
+          },
+          "lastName": {
+            "default": "",
+            "title": "Lastname",
+            "type": "string"
+          },
+          "owner": {
+            "title": "Owner",
+            "type": "string"
+          },
+          "updatedTime": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updatedtime"
+          },
+          "username": {
+            "pattern": "^[a-zA-Z0-9]+(?:[_-][a-zA-Z0-9]+)*$",
+            "title": "Username",
+            "type": "string"
+          }
+        },
+        "required": ["id", "username", "owner", "fullName", "isActive"],
+        "title": "CasdoorUser",
+        "type": "object"
+      },
+      "HTTPValidationError": {
+        "properties": {
+          "detail": {
+            "items": {
+              "$ref": "#/components/schemas/ValidationError"
+            },
+            "title": "Detail",
+            "type": "array"
+          }
+        },
+        "title": "HTTPValidationError",
+        "type": "object"
+      },
+      "OAuthToken": {
+        "description": "Represent an OAuth token.\n\n:param access_token: The token used to access protected resources.\n:type access_token: str\n:param id_token: The token that contains identity information about the user.\n:type id_token: str\n:param refresh_token: The token used to obtain new access tokens after the\n    current one expires.\n:type refresh_token: str\n:param token_type: The type of token, typically \"bearer\".\n:type token_type: str\n:param expires_in: The time duration after which the token expires.\n:type expires_in: TimedeltaSeconds\n:param scope: The scope of the access granted by the token.\n:type scope: str",
+        "properties": {
+          "access_token": {
+            "title": "Access Token",
+            "type": "string"
+          },
+          "expires_in": {
+            "title": "Expires In",
+            "type": "integer"
+          },
+          "id_token": {
+            "title": "Id Token",
+            "type": "string"
+          },
+          "refresh_token": {
+            "title": "Refresh Token",
+            "type": "string"
+          },
+          "scope": {
+            "title": "Scope",
+            "type": "string"
+          },
+          "token_type": {
+            "title": "Token Type",
+            "type": "string"
+          }
+        },
+        "required": [
+          "access_token",
+          "id_token",
+          "refresh_token",
+          "token_type",
+          "expires_in",
+          "scope"
+        ],
+        "title": "OAuthToken",
+        "type": "object"
+      },
+      "SPALoginBody": {
+        "description": "Represent the JSON body expected by ``POST /api/oauth/login``.\n\n:param username: The username of the user.\n:type username: str\n:param password: The password of the user.\n:type password: str",
+        "properties": {
+          "password": {
+            "title": "Password",
+            "type": "string"
+          },
+          "username": {
+            "title": "Username",
+            "type": "string"
+          }
+        },
+        "required": ["username", "password"],
+        "title": "SPALoginBody",
+        "type": "object"
+      },
+      "SPAOAuthTokenResponse": {
+        "description": "Represent the slim OAuth token response returned to SPA clients.\n\nOmit ``refresh_token``, ``id_token``, ``token_type``, and ``scope``. The\nSPA keeps the refresh token in an ``HttpOnly`` cookie and derives nothing\nfrom the other fields.\n\n:param access_token: The token used to access protected resources.\n:type access_token: str\n:param expires_in: The time duration after which the access token expires.\n:type expires_in: TimedeltaSeconds",
+        "properties": {
+          "access_token": {
+            "title": "Access Token",
+            "type": "string"
+          },
+          "expires_in": {
+            "title": "Expires In",
+            "type": "integer"
+          }
+        },
+        "required": ["access_token", "expires_in"],
+        "title": "SPAOAuthTokenResponse",
+        "type": "object"
+      },
+      "SessionExchangeTokenResponse": {
+        "description": "Represent the bearer returned when an ambient session is exchanged.\n\nMirror :class:`SPAOAuthTokenResponse`'s field names so a client's token\nprovider reads the same shape, but keep the contract separate: no refresh\ntoken is issued and no cookie is set, so the holder renews by exchanging\nagain rather than by refreshing.\n\n:param access_token: The short-lived token used to access protected\n    resources.\n:param expires_in: The time duration after which the token expires.",
+        "properties": {
+          "access_token": {
+            "title": "Access Token",
+            "type": "string"
+          },
+          "expires_in": {
+            "title": "Expires In",
+            "type": "integer"
+          }
+        },
+        "required": ["access_token", "expires_in"],
+        "title": "SessionExchangeTokenResponse",
+        "type": "object"
+      },
+      "ValidationError": {
+        "properties": {
+          "ctx": {
+            "title": "Context",
+            "type": "object"
+          },
+          "input": {
+            "title": "Input"
+          },
+          "loc": {
+            "items": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "integer"
+                }
+              ]
+            },
+            "title": "Location",
+            "type": "array"
+          },
+          "msg": {
+            "title": "Message",
+            "type": "string"
+          },
+          "type": {
+            "title": "Error Type",
+            "type": "string"
+          }
+        },
+        "required": ["loc", "msg", "type"],
+        "title": "ValidationError",
+        "type": "object"
+      }
+    },
+    "securitySchemes": {
+      "OAuth2PasswordBearer": {
+        "flows": {
+          "password": {
+            "scopes": {},
+            "tokenUrl": "/api/oauth/token"
+          }
+        },
+        "type": "oauth2"
+      }
+    }
+  },
+  "info": {
+    "description": "Percona Services Enablement Platform\n\nThis spec is the **core** API only (OAuth, users). Mounted services publish separate OpenAPI JSON on the same host: ``/api/inventory/openapi.json``, ``/api/tasks/openapi.json``, and ``/api/sep/openapi.json`` (the SEP web app: ``sep_app`` — shared routes, plugins, etc.; not merged into this document).",
+    "title": "SEP HTTP API",
+    "version": "v1.0.0.dev0"
+  },
+  "openapi": "3.1.0",
+  "paths": {
+    "/api/config/alerts": {
+      "get": {
+        "description": "Report whether at least one alert provider is configured.\n\nMirrors the server-side ``bool(alert_settings.PROVIDERS)`` check used by\nthe Jinja2 task forms so the React frontend can drive the same\nenabled/disabled behavior of the *Alert on failure* field. The endpoint\nis gated behind authentication so an anonymous probe cannot leak\nwhether alerting is wired up on this deployment.\n\n:return: The alert provider availability flag.\n:rtype: AlertConfigResponse",
+        "operationId": "config_get_alert_config_api_config_alerts_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AlertConfigResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Get Alert Config",
+        "tags": ["config"]
+      }
+    },
+    "/api/oauth/login": {
+      "post": {
+        "description": "Authenticate the SPA user and establish the refresh cookie.\n\nRun the Casdoor password grant server-side, set the refresh token as an\n``HttpOnly`` cookie scoped to ``/api/oauth``, and return the access token\n(plus its TTL) in JSON. The refresh token is never included in the\nresponse body.\n\n:param body: The JSON body containing username and password.\n:type body: SPALoginBody\n:param response: The HTTP response on which to set the refresh cookie.\n:type response: Response\n:return: The slim OAuth token response for the SPA.\n:rtype: SPAOAuthTokenResponse\n:raises InactiveUserException: If the user is not active.",
+        "operationId": "oauth_spa_login_api_oauth_login_post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SPALoginBody"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SPAOAuthTokenResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Spa Login",
+        "tags": ["oauth"]
+      }
+    },
+    "/api/oauth/logout": {
+      "post": {
+        "description": "End the SPA session: revoke the access token and clear the refresh cookie.\n\nThe SPA authenticates this request via the ``Authorization: Bearer``\nheader. Clear the refresh cookie first so a Casdoor revocation failure\ndoes not leave the browser with a stale cookie, then revoke the access\ntoken upstream. Swallow ``KeyError`` / ``ValidationError`` from the\nupstream revocation so the client always sees a clean 204.\n\n:param user: The authenticated user resolved from the Bearer token.\n:type user: CurrentUser\n:param response: The HTTP response on which to clear the refresh cookie.\n:type response: Response",
+        "operationId": "oauth_spa_logout_api_oauth_logout_post",
+        "responses": {
+          "204": {
+            "description": "Successful Response"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Spa Logout",
+        "tags": ["oauth"]
+      }
+    },
+    "/api/oauth/refresh": {
+      "post": {
+        "description": "Mint a fresh access token from the ``HttpOnly`` refresh cookie.\n\nOn success, rotate the refresh cookie and return a new access token. On\nany failure (missing cookie, Casdoor-rejected token, malformed Casdoor\nresponse), return 401 without mutating the cookie so the SPA observes a\nclean invalidation signal. The route never reads the refresh token from\nthe request body.\n\n:param response: The HTTP response on which to rotate the refresh cookie.\n:type response: Response\n:param refresh_token: The refresh token from the ``refreshToken`` cookie.\n:type refresh_token: str | None\n:return: The slim OAuth token response for the SPA.\n:rtype: SPAOAuthTokenResponse\n:raises HTTPUnauthorizedException: If the refresh token is missing,\n    invalid, expired, or revoked.\n:raises InactiveUserException: If the user is not active.",
+        "operationId": "oauth_refresh_token_api_oauth_refresh_post",
+        "parameters": [
+          {
+            "in": "cookie",
+            "name": "refreshToken",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Refreshtoken"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SPAOAuthTokenResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Refresh Token",
+        "tags": ["oauth"]
+      }
+    },
+    "/api/oauth/session": {
+      "post": {
+        "description": "Authenticate the SPA from an ambient Grafana session cookie.\n\nRead the ambient Grafana session cookie off the request, validate it against\nGrafana, set the ``HttpOnly`` refresh cookie scoped to ``/api/oauth``, and\nreturn the slim access assertion in JSON. A ``401`` (no valid ambient\nsession) tells the SPA to show its login screen.\n\n:param request: The incoming request, carrying the ambient Grafana session\n    cookie.\n:param response: The HTTP response on which to set the refresh cookie.\n:return: The slim OAuth token response for the SPA.\n:raises HTTPUnauthorizedException: If there is no valid ambient session.",
+        "operationId": "oauth_spa_session_login_api_oauth_session_post",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SPAOAuthTokenResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Spa Session Login",
+        "tags": ["oauth"]
+      }
+    },
+    "/api/oauth/session/exchange": {
+      "post": {
+        "description": "Mint a short-lived SEP bearer from an ambient Grafana session.\n\nServes an embedded client that already carries the host's session cookie on\nthe same origin. Unlike ``POST /session``, set no cookie and issue no refresh\ntoken: the caller holds the bearer in memory and exchanges again before it\nexpires, so the deployment never shares a long-lived credential.\n\nEvery exchange re-reads the identity from the provider and no validation is\ncached, so a role change takes effect within one bearer lifetime. A\nsigned-out browser loses embedded access just as fast, because without the\nsession cookie it cannot obtain another bearer -- though whether a\n*previously copied* host cookie stops working depends on the host revoking\nits own session server-side, which is outside SEP's control.\n\nCarries no auth dependency by design: the caller is not yet SEP-authenticated,\nand the ambient session cookie is the credential being presented. No CSRF\nprimitive applies either -- ``IsCsrfValidated`` guards form data on the\nserver-rendered login route, and requiring a Bearer token cannot gate an\nendpoint whose purpose is to issue one. That is safe because a cross-origin\nattacker cannot read this response (the CORS posture is an explicit\nper-environment origin allowlist, with the middleware absent when none is\nconfigured), and the bearer-authenticated calls the token enables are\nCSRF-exempt by design, since browsers never attach an ``Authorization``\nheader automatically.\n\nEvery failure -- no cookie, a rejected session, an unreachable provider --\ndenies with the same ``401`` rather than reporting a reason the route cannot\ndistinguish.\n\n:param request: The incoming request, carrying the ambient session cookie.\n:param response: The HTTP response, marked uncacheable so no intermediary\n    stores the minted bearer.\n:return: The minted bearer and its lifetime.\n:raises HTTPUnauthorizedException: If there is no valid ambient session.",
+        "operationId": "oauth_spa_session_exchange_api_oauth_session_exchange_post",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SessionExchangeTokenResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Spa Session Exchange",
+        "tags": ["oauth"]
+      }
+    },
+    "/api/oauth/token": {
+      "post": {
+        "description": "Generate an OAuth token for a user from their username and password.\n\nOAuth2-style endpoint kept for non-SPA clients. For the React SPA, use\n``POST /api/oauth/login`` which returns a slim response body and places\nthe refresh token in an ``HttpOnly`` cookie.\n\n:param form_data: The form data containing username and password.\n:type form_data: OAuth2PasswordRequestForm\n:return: The OAuth token for the user.\n:rtype: OAuthToken\n:raises InactiveUserException: If the user is not active.",
+        "operationId": "oauth_create_oauth_token_api_oauth_token_post",
+        "requestBody": {
+          "content": {
+            "application/x-www-form-urlencoded": {
+              "schema": {
+                "$ref": "#/components/schemas/Body_oauth_create_oauth_token_api_oauth_token_post"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthToken"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Create Oauth Token",
+        "tags": ["oauth"]
+      }
+    },
+    "/api/users/": {
+      "get": {
+        "description": "List users.\n\n:return: The list of users.\n:rtype: list[User]",
+        "operationId": "users_list_users_api_users__get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "items": {
+                    "$ref": "#/components/schemas/CasdoorUser"
+                  },
+                  "title": "Response Users List Users Api Users  Get",
+                  "type": "array"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "List Users",
+        "tags": ["users"]
+      }
+    },
+    "/api/users/me": {
+      "get": {
+        "description": "Retrieve the current authenticated user.\n\n:param current_user: The current authenticated user.\n:type current_user: CurrentUser\n:return: The current authenticated user.\n:rtype: User",
+        "operationId": "users_retrieve_current_user_api_users_me_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CasdoorUser"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Retrieve Current User",
+        "tags": ["users"]
+      }
+    },
+    "/api/users/{username}": {
+      "get": {
+        "description": "Retrieve a user by username.\n\n:param current_user: The current authenticated user.\n:type current_user: CurrentUser\n:param username: The username of the user to retrieve.\n:type username: str\n:return: The requested user.\n:rtype: User\n:raises HTTPForbiddenException: If the current user is not an admin and tries to\n    access another user's information.",
+        "operationId": "users_retrieve_user_api_users__username__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "username",
+            "required": true,
+            "schema": {
+              "title": "Username",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CasdoorUser"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Retrieve User",
+        "tags": ["users"]
+      }
+    }
+  }
+}
diff --git a/ui/packages/sep/api/specs/sep.json b/ui/packages/sep/api/specs/sep.json
new file mode 100644
index 00000000000..dc2647d174d
--- /dev/null
+++ b/ui/packages/sep/api/specs/sep.json
@@ -0,0 +1,19755 @@
+{
+  "components": {
+    "schemas": {
+      "AlertServiceType": {
+        "description": "Enumerate the supported service types for alert-related features.\n\n:cvar GENERIC: Generic service type.\n:vartype GENERIC: str\n:cvar MYSQL: MySQL service type.\n:vartype MYSQL: str\n:cvar MONGODB: MongoDB service type.\n:vartype MONGODB: str\n:cvar POSTGRESQL: PostgreSQL service type.\n:vartype POSTGRESQL: str",
+        "enum": ["generic", "mysql", "mongodb", "postgresql"],
+        "title": "AlertServiceType",
+        "type": "string"
+      },
+      "AppInfo": {
+        "description": "Represent the response of ``GET /api/sep/app-info``.\n\n:param footer_text: The rendered sidebar footer text (application summary\n    and version by default).",
+        "properties": {
+          "footer_text": {
+            "title": "Footer Text",
+            "type": "string"
+          }
+        },
+        "required": ["footer_text"],
+        "title": "AppInfo",
+        "type": "object"
+      },
+      "AppInfoResponse": {
+        "description": "Represent a per-app info entry returned by ``GET /``.\n\n:param app_key: The plugin module key.\n:type app_key: str\n:param name: The human-readable plugin name.\n:type name: str\n:param enabled: Whether the app is fully enabled (derived; deprecated).\n:type enabled: bool\n:param lifecycle_state: The app's runtime lifecycle state.\n:param toggleable: Whether the app may be toggled (``False`` for protected).\n:type toggleable: bool\n:param uri_path: The plugin's mount URI path.\n:type uri_path: str\n:param css_class: The plugin's CSS class.\n:type css_class: str\n:param sidebar: Whether the plugin appears in the sidebar.\n:type sidebar: bool\n:param has_api_router: Whether the plugin exposes a JSON API router.\n:type has_api_router: bool",
+        "properties": {
+          "app_key": {
+            "title": "App Key",
+            "type": "string"
+          },
+          "css_class": {
+            "title": "Css Class",
+            "type": "string"
+          },
+          "enabled": {
+            "title": "Enabled",
+            "type": "boolean"
+          },
+          "has_api_router": {
+            "title": "Has Api Router",
+            "type": "boolean"
+          },
+          "lifecycle_state": {
+            "$ref": "#/components/schemas/AppLifecycleEnum"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "sidebar": {
+            "title": "Sidebar",
+            "type": "boolean"
+          },
+          "toggleable": {
+            "title": "Toggleable",
+            "type": "boolean"
+          },
+          "uri_path": {
+            "title": "Uri Path",
+            "type": "string"
+          }
+        },
+        "required": [
+          "app_key",
+          "name",
+          "enabled",
+          "lifecycle_state",
+          "toggleable",
+          "uri_path",
+          "css_class",
+          "sidebar",
+          "has_api_router"
+        ],
+        "title": "AppInfoResponse",
+        "type": "object"
+      },
+      "AppKeyResponse": {
+        "description": "Represent a minimal per-app entry for the navigation shell.\n\n:param app_key: The plugin module key.\n:param enabled: Whether the app is currently enabled.\n:param sidebar: Whether the plugin appears in the sidebar.\n:param uri_path: The plugin's mount URI path.\n:param display_name: The human-facing label for the app.\n:param custom_ui: Whether the app ships a bespoke React UI.\n:param group: The nav group key this app nests under; ``None`` when the app\n    renders as a top-level sidebar entry.\n:param nav_order: The app's sort position within the sidebar; ``None`` when\n    unset.\n:param react_route: The canonical React route the shell mounts and links to;\n    always concrete (defaulting to ``/apps/<app_key>``).\n:param nav_icon: The sidebar icon key; ``None`` falls back to the shell's\n    default app icon.\n:param blocking_dependencies: The effective-disabled ``requires_apps`` keys\n    that are the reason this app is effective-disabled. Empty when the app is\n    enabled or disabled by its own state; non-empty only for a\n    dependency-driven disablement, so the shell can name the required app on\n    the disabled splash.",
+        "properties": {
+          "app_key": {
+            "title": "App Key",
+            "type": "string"
+          },
+          "blocking_dependencies": {
+            "default": [],
+            "items": {
+              "type": "string"
+            },
+            "title": "Blocking Dependencies",
+            "type": "array"
+          },
+          "custom_ui": {
+            "title": "Custom Ui",
+            "type": "boolean"
+          },
+          "display_name": {
+            "title": "Display Name",
+            "type": "string"
+          },
+          "enabled": {
+            "title": "Enabled",
+            "type": "boolean"
+          },
+          "group": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Group"
+          },
+          "nav_icon": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/nav_icons__NavIcon"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "nav_order": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Nav Order"
+          },
+          "react_route": {
+            "pattern": "^\\/[^\\s]*$",
+            "title": "React Route",
+            "type": "string"
+          },
+          "sidebar": {
+            "title": "Sidebar",
+            "type": "boolean"
+          },
+          "uri_path": {
+            "title": "Uri Path",
+            "type": "string"
+          }
+        },
+        "required": [
+          "app_key",
+          "enabled",
+          "sidebar",
+          "uri_path",
+          "display_name",
+          "custom_ui",
+          "group",
+          "nav_order",
+          "react_route",
+          "nav_icon"
+        ],
+        "title": "AppKeyResponse",
+        "type": "object"
+      },
+      "AppLifecycleEnum": {
+        "description": "Enumerate the runtime lifecycle states of an app.\n\nMember names equal their values, so the DB column, its CHECK constraint, the\nAPI wire value, and any operator SQL all share one uppercase token. The\ntransitional states ``ENABLING`` and ``DISABLING`` expose an observable\nwindow for future machinery to finish in-flight work before an app goes\nfully offline; the request guard treats every state other than ``ENABLED``\nas unreachable.",
+        "enum": ["ENABLED", "DISABLED", "ENABLING", "DISABLING"],
+        "title": "AppLifecycleEnum",
+        "type": "string"
+      },
+      "AppStateResponse": {
+        "description": "Represent the toggle endpoint's response.\n\n:param app_key: The toggled app's key.\n:type app_key: str\n:param enabled: The resulting enabled flag (derived; deprecated).\n:type enabled: bool\n:param lifecycle_state: The resulting lifecycle state.",
+        "properties": {
+          "app_key": {
+            "title": "App Key",
+            "type": "string"
+          },
+          "enabled": {
+            "title": "Enabled",
+            "type": "boolean"
+          },
+          "lifecycle_state": {
+            "$ref": "#/components/schemas/AppLifecycleEnum"
+          }
+        },
+        "required": ["app_key", "enabled", "lifecycle_state"],
+        "title": "AppStateResponse",
+        "type": "object"
+      },
+      "AppStateWrite": {
+        "description": "Define the write payload for the app-state toggle endpoint.\n\n:param lifecycle_state: The requested target lifecycle state.",
+        "properties": {
+          "lifecycle_state": {
+            "$ref": "#/components/schemas/AppLifecycleEnum"
+          }
+        },
+        "required": ["lifecycle_state"],
+        "title": "AppStateWrite",
+        "type": "object"
+      },
+      "BatchApprovalResponse": {
+        "description": "Successful response for the batch-approve endpoint.\n\n:param approved: Filenames whose approval state was toggled by this\n    request (newly approved as a result of the call).\n:type approved: list[str]\n:param skipped_already_approved: Filenames that were already approved\n    when the call started; the request is treated as a soft-skip\n    (idempotent).\n:type skipped_already_approved: list[str]",
+        "properties": {
+          "approved": {
+            "items": {
+              "type": "string"
+            },
+            "title": "Approved",
+            "type": "array"
+          },
+          "count": {
+            "description": "Return the number of newly approved snippets.\n\n:return: Length of ``approved``.\n:rtype: int",
+            "readOnly": true,
+            "title": "Count",
+            "type": "integer"
+          },
+          "skipped_already_approved": {
+            "items": {
+              "type": "string"
+            },
+            "title": "Skipped Already Approved",
+            "type": "array"
+          }
+        },
+        "required": ["approved", "skipped_already_approved", "count"],
+        "title": "BatchApprovalResponse",
+        "type": "object"
+      },
+      "ConnectivityCheckRequest": {
+        "description": "Carry the required set of services to probe.\n\n:param targets: The services to probe. Must name at least one; duplicates are\n    collapsed so a shared probe (Tasks/Nomad) still runs once.",
+        "properties": {
+          "targets": {
+            "items": {
+              "$ref": "#/components/schemas/ServiceEnum"
+            },
+            "minItems": 1,
+            "title": "Targets",
+            "type": "array"
+          }
+        },
+        "required": ["targets"],
+        "title": "ConnectivityCheckRequest",
+        "type": "object"
+      },
+      "ConnectivityCheckResponse": {
+        "description": "Represent a connectivity check result.\n\n:param success: Whether the connectivity check succeeded.\n:param error: Error message if the check failed. Defaults to ``None``.\n:param task_history_id: The ID of the task history record for this check.",
+        "properties": {
+          "error": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Error"
+          },
+          "success": {
+            "title": "Success",
+            "type": "boolean"
+          },
+          "task_history_id": {
+            "title": "Task History Id",
+            "type": "integer"
+          }
+        },
+        "required": ["success", "task_history_id"],
+        "title": "ConnectivityCheckResponse",
+        "type": "object"
+      },
+      "ConnectivityResult": {
+        "description": "Represent the outcome of probing a single external / inter-service endpoint.\n\n:param service: Stable identifier of the probed service (e.g. ``\"pmm\"``).\n:type service: str\n:param reachable: ``True`` only when the endpoint answered successfully.\n:type reachable: bool\n:param status: Machine-readable outcome state.\n:type status: ConnectivityStatusEnum\n:param detail: Human-readable status / error, free of secrets.\n:type detail: str\n:param version: Optional remote version string when the probe exposes one.\n:type version: str | None",
+        "properties": {
+          "detail": {
+            "title": "Detail",
+            "type": "string"
+          },
+          "reachable": {
+            "title": "Reachable",
+            "type": "boolean"
+          },
+          "service": {
+            "title": "Service",
+            "type": "string"
+          },
+          "status": {
+            "$ref": "#/components/schemas/ConnectivityStatusEnum"
+          },
+          "version": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Version"
+          }
+        },
+        "required": ["service", "reachable", "status", "detail"],
+        "title": "ConnectivityResult",
+        "type": "object"
+      },
+      "ConnectivityStatusEnum": {
+        "description": "Enumerate the mutually-exclusive outcomes of a connectivity probe.",
+        "enum": [
+          "reachable",
+          "auth_failed",
+          "error",
+          "unreachable",
+          "ssl_error",
+          "timeout"
+        ],
+        "title": "ConnectivityStatusEnum",
+        "type": "string"
+      },
+      "DashboardStatsResponse": {
+        "description": "Represent aggregate counts for the four dashboard stat cards.\n\n:param nodes: Total inventory node count.\n:type nodes: int\n:param tasks: Total active task count.\n:type tasks: int\n:param snippets: Total snippet count.\n:type snippets: int\n:param targets: Total executor target (host) count.\n:type targets: int",
+        "properties": {
+          "nodes": {
+            "title": "Nodes",
+            "type": "integer"
+          },
+          "snippets": {
+            "title": "Snippets",
+            "type": "integer"
+          },
+          "targets": {
+            "title": "Targets",
+            "type": "integer"
+          },
+          "tasks": {
+            "title": "Tasks",
+            "type": "integer"
+          }
+        },
+        "required": ["nodes", "tasks", "snippets", "targets"],
+        "title": "DashboardStatsResponse",
+        "type": "object"
+      },
+      "ExecutionEvent": {
+        "description": "A single lifecycle event from a task executor (executor-agnostic shape).\n\n:param timestamp: When the event occurred (UTC).\n:type timestamp: UTCDatetime\n:param event_type: Executor-specific event category (e.g. Nomad task event type).\n:type event_type: str\n:param description: Human-readable message for the event (no step prefix).\n:type description: str\n:param step: Optional executor task/step name (e.g. Nomad task within the group).\n:type step: str | None",
+        "properties": {
+          "description": {
+            "title": "Description",
+            "type": "string"
+          },
+          "step": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Step"
+          },
+          "timestamp": {
+            "format": "date-time",
+            "title": "Timestamp",
+            "type": "string"
+          },
+          "type": {
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["timestamp", "type", "description"],
+        "title": "ExecutionEvent",
+        "type": "object"
+      },
+      "FileMetadata": {
+        "description": "Represent file metadata for task artifacts.",
+        "properties": {
+          "is_dir": {
+            "default": false,
+            "title": "Is Dir",
+            "type": "boolean"
+          },
+          "size": {
+            "default": 0,
+            "title": "Size",
+            "type": "integer"
+          }
+        },
+        "title": "FileMetadata",
+        "type": "object"
+      },
+      "HTTPValidationError": {
+        "properties": {
+          "detail": {
+            "items": {
+              "$ref": "#/components/schemas/ValidationError"
+            },
+            "title": "Detail",
+            "type": "array"
+          }
+        },
+        "title": "HTTPValidationError",
+        "type": "object"
+      },
+      "HostResponse": {
+        "description": "Represent a single executor target enriched with an inventory display name.\n\n:param id: The executor (Nomad / Celery) node name. This is the value\n    consumed by dispatch payloads as ``executor_host``.\n:type id: str\n:param name: Human-readable label sourced from inventory when available;\n    falls back to ``id`` if the host has no inventory match.\n:type name: str\n:param address: The network address reported by the executor.\n:type address: str",
+        "properties": {
+          "address": {
+            "title": "Address",
+            "type": "string"
+          },
+          "id": {
+            "title": "Id",
+            "type": "string"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          }
+        },
+        "required": ["id", "name", "address"],
+        "title": "HostResponse",
+        "type": "object"
+      },
+      "InventorySelectorOption": {
+        "description": "Represent a minimal ``{id, name}`` option for inventory autocomplete selectors.\n\n:param id: The inventory entity ID consumed by form payloads.\n:type id: int\n:param name: The human-readable display label.\n:type name: str",
+        "properties": {
+          "id": {
+            "title": "Id",
+            "type": "integer"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          }
+        },
+        "required": ["id", "name"],
+        "title": "InventorySelectorOption",
+        "type": "object"
+      },
+      "JsonValue": {},
+      "Node": {
+        "description": "Represent a node in the inventory.\n\n:param address: The network address of the node.\n:type address: NonEmptyStr\n:param name: The name of the node.\n:type name: NonEmptyStr\n:param external_id: An external identifier for the node. Must be unique for source,\n    as defined by composite index ix_node_external_id_source.\n:type external_id: NonEmptyStr | None\n:param source: The source from which the node information is derived. Must be unique\n    for external_id, as defined by composite index ix_node_external_id_source.\n:type source: SourceEnum | None\n:param type: The type of the node (e.g., remote, generic).\n:type type: NonEmptyStr\n:param services: A list of services associated with the node.\n:type services: list[Service]",
+        "properties": {
+          "address": {
+            "minLength": 1,
+            "title": "Address",
+            "type": "string"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "external_id": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "External Id"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "source": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/SourceEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "type": {
+            "default": "generic",
+            "minLength": 1,
+            "title": "Type",
+            "type": "string"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": ["id", "address", "name"],
+        "title": "Node",
+        "type": "object"
+      },
+      "PaginatedResponse_Any_": {
+        "properties": {
+          "items": {
+            "items": {},
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[Any]",
+        "type": "object"
+      },
+      "PaginatedResponse_ServiceResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/ServiceResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[ServiceResponse]",
+        "type": "object"
+      },
+      "PaginatedResponse_SnippetResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/SnippetResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[SnippetResponse]",
+        "type": "object"
+      },
+      "PaginatedResponse_TaskHistoryResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/TaskHistoryResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[TaskHistoryResponse]",
+        "type": "object"
+      },
+      "PaginatedResponse_dict_str__Any__": {
+        "properties": {
+          "items": {
+            "items": {
+              "type": "object"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[dict[str, Any]]",
+        "type": "object"
+      },
+      "RefreshResponse": {
+        "description": "Represent the successful result of a manual snippets-refresh operation.\n\n:param refreshed_at: UTC timestamp at which the refresh completed.\n:type refreshed_at: datetime",
+        "properties": {
+          "refreshed_at": {
+            "format": "date-time",
+            "title": "Refreshed At",
+            "type": "string"
+          }
+        },
+        "required": ["refreshed_at"],
+        "title": "RefreshResponse",
+        "type": "object"
+      },
+      "ReloadClassification": {
+        "description": "Declare the reload behavior of an overridable settings field.\n\n:cvar HOT: Field can be overridden via a DB row and the new value takes\n    effect on the next snapshot refresh, without restarting the service.\n    For a nested-model field, ``HOT`` permits both whole-object override\n    (``PATCH {parent: {...}}``) and per-child override (``parent__leaf``).\n:vartype HOT: str\n:cvar NESTED_ONLY: Nested-model field whose children may be overridden\n    (``parent__leaf``) while the parent itself rejects whole-object\n    override (``PATCH {parent: {...}}`` → 422). Children default to\n    HOT-inherit unless explicitly marked :func:`not_overridable_field`.\n:vartype NESTED_ONLY: str\n:cvar NOT_OVERRIDABLE: Field is not overridable from the database; YAML\n    and environment variables remain the only sources of truth.\n:vartype NOT_OVERRIDABLE: str",
+        "enum": ["hot", "nested_only", "not_overridable"],
+        "title": "ReloadClassification",
+        "type": "string"
+      },
+      "Schema": {
+        "description": "Represent a database schema within a service.\n\n:param id: The primary key for the table. Auto-incremented and not nullable.\n:type id: int | None\n:param created_at: The timestamp when the record is created. Defaults to the current\n    time in UTC.\n:type created_at: UTCDatetime\n:param updated_at: The timestamp when the record is last updated. Automatically\n    updated on changes.\n:type updated_at: UTCDatetime | None\n:param name: The name of the schema. Must be unique for service_id, as defined by\n    composite index ix_schema_name_service_id.\n:type name: NonEmptyStr\n:param service_id: The unique identifier of the service to which the schema belongs.\n    Must be unique for name, as defined by composite index\n    ix_schema_name_service_id.\n:type service_id: int\n:param service: The service to which the schema is associated.\n:type service: Service\n:param tables: A list of tables within the schema.\n:type tables: list[Table]",
+        "properties": {
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "service_id": {
+            "title": "Service Id",
+            "type": "integer"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": ["name", "service_id", "id"],
+        "title": "Schema",
+        "type": "object"
+      },
+      "ServiceEnum": {
+        "description": "Enumerate the probeable services, used as stable ``service`` identifiers.",
+        "enum": ["pmm", "inventory", "tasks", "nomad"],
+        "title": "ServiceEnum",
+        "type": "string"
+      },
+      "ServiceResponse": {
+        "description": "Define the service API response.\n\n:param id: The primary key for the table. Auto-incremented and not nullable.\n:type id: int | None\n:param created_at: The timestamp when the record is created. Defaults to the current\n    time in UTC.\n:type created_at: UTCDatetime\n:param updated_at: The timestamp when the record is last updated. Automatically\n    updated on changes.\n:type updated_at: UTCDatetime | None\n:param external_id: An external identifier for the service.\n:type external_id: NonEmptyStr | None\n:param name: The name of the service.\n:type name: NonEmptyStr\n:param type: The type of the service (e.g., MYSQL, POSTGRESQL).\n:type type: ServiceTypeEnum\n:param port: The port number on which the service is running.\n:type port: int | None\n:param environment: The environment in which the service is running, if set.\n:type environment: str | None\n:param cluster: The cluster in which the service is running, if set.\n:type cluster: str | None\n:param replication_set: The replication set in which the service is running, if set.\n:type replication_set: str | None\n:param custom_labels: Custom labels associated with the service, if set.\n:type custom_labels: dict[str, Any] | None\n:param node_id: The unique identifier of the node on which the service is running.\n:type node_id: int\n:param schemas: A list of schemas associated with the service.\n:type schemas: list[Schema]\n:param node: The node to which the service is associated.\n:type node: Node",
+        "properties": {
+          "cluster": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Cluster"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "custom_labels": {
+            "anyOf": [
+              {
+                "type": "object"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Custom Labels"
+          },
+          "environment": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Environment"
+          },
+          "external_id": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "External Id"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "node": {
+            "$ref": "#/components/schemas/Node"
+          },
+          "node_id": {
+            "title": "Node Id",
+            "type": "integer"
+          },
+          "port": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Port"
+          },
+          "replication_set": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Replication Set"
+          },
+          "schemas": {
+            "items": {
+              "$ref": "#/components/schemas/Schema"
+            },
+            "title": "Schemas",
+            "type": "array"
+          },
+          "type": {
+            "$ref": "#/components/schemas/ServiceTypeEnum"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": ["name", "type", "node_id", "id", "schemas", "node"],
+        "title": "ServiceResponse",
+        "type": "object"
+      },
+      "ServiceTypeEnum": {
+        "description": "Enumerate the supported service types.\n\n:cvar MYSQL: Represents the MySQL service type.\n:vartype MYSQL: str\n:cvar POSTGRESQL: Represents the PostgreSQL service type.\n:vartype POSTGRESQL: str\n:cvar MONGODB: Represents the MongoDB service type.\n:vartype MONGODB: str\n:cvar PROXYSQL: Represents the ProxySQL service type.\n:vartype PROXYSQL: str\n:cvar HAPROXY: Represents the HAProxy service type.\n:vartype HAPROXY: str\n:cvar EXTERNAL: Represents an external service type.\n:vartype EXTERNAL: str\n:cvar VALKEY: Represents the Valkey service type.\n:vartype VALKEY: str",
+        "enum": [
+          "mysql",
+          "postgresql",
+          "mongodb",
+          "proxysql",
+          "haproxy",
+          "external",
+          "valkey"
+        ],
+        "title": "ServiceTypeEnum",
+        "type": "string"
+      },
+      "SettingClassEnum": {
+        "description": "Enumerate settings classes that may have HOT override rows.\n\nThe wired classes are ``SEPSettings``, ``TasksSettings``,\n``SnippetsSettings``, ``MessagesSettings``, the global ``Settings``,\n``AlertSettings``, ``AlertsSettings``, ``AnonymizerSettings`` and\n``InventorySettings``.\n\nTo wire a new settings class:\n\n1. Add a member here whose value matches the Pydantic class ``__name__``.\n2. Generate an Alembic migration on every consumer track that extends the\n   ``CHECK`` constraint on ``settingoverride.setting_class``. The column\n   uses ``native_enum=False`` so the value list lives in a constraint,\n   not a PostgreSQL ``TYPE`` -- the migration ``ALTER``s the constraint.\n   Note that the column and ``CHECK`` constraint persist the enum member\n   *names* (e.g. ``SEP_SETTINGS``), which is distinct from the member\n   *value* (the Pydantic class name, e.g. ``SEPSettings``).\n3. Wire a ``ProxyEntry`` for the new class in the relevant service's\n   lifespan (``app/sep/main.py`` or ``app/tasks/main.py``).",
+        "enum": [
+          "SEPSettings",
+          "TasksSettings",
+          "SnippetsSettings",
+          "MessagesSettings",
+          "Settings",
+          "AlertSettings",
+          "AnonymizerSettings",
+          "AlertsSettings",
+          "InventorySettings"
+        ],
+        "title": "SettingClassEnum",
+        "type": "string"
+      },
+      "SettingClassGroup": {
+        "description": "One settings-class group in the LIST response.\n\n:param setting_class: The settings class this group represents.\n:type setting_class: SettingClassEnum\n:param settings: The fields declared on the settings class, with their\n    current values and metadata.\n:type settings: list[SettingResponse]\n:param is_app_owned: Whether this group belongs to a SEP app under\n    ``app/sep/apps/`` rather than core SEP wiring.\n:type is_app_owned: bool\n:param app_id: The owning app's registry key when ``is_app_owned`` is\n    ``True``; ``None`` for core groups.\n:type app_id: str | None\n:param app_display_name: The owning app's human-facing label when\n    ``is_app_owned`` is ``True``; ``None`` for core groups.\n:type app_display_name: str | None\n:param app_enabled: Whether the owning app is currently enabled when\n    ``is_app_owned`` is ``True``; ``None`` for core groups. Disabled\n    apps remain listed so the frontend can hide them without a second\n    lookup.\n:type app_enabled: bool | None",
+        "properties": {
+          "app_display_name": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "App Display Name"
+          },
+          "app_enabled": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "App Enabled"
+          },
+          "app_id": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "App Id"
+          },
+          "is_app_owned": {
+            "default": false,
+            "title": "Is App Owned",
+            "type": "boolean"
+          },
+          "setting_class": {
+            "$ref": "#/components/schemas/SettingClassEnum"
+          },
+          "settings": {
+            "items": {
+              "$ref": "#/components/schemas/SettingResponse"
+            },
+            "title": "Settings",
+            "type": "array"
+          }
+        },
+        "required": ["setting_class", "settings"],
+        "title": "SettingClassGroup",
+        "type": "object"
+      },
+      "SettingResponse": {
+        "description": "Represent a single setting's metadata and current value.\n\n:param setting_class: The settings class the field belongs to.\n:param key: The field name on the settings class.\n:param key_path: Carry the canonical key segments for ``key`` such that\n    ``\"__\".join(key_path) == key``.\n:param value: The current value visible through the proxy, dumped to a\n    JSON-safe shape via the field's annotation. ``SecretStr`` fields are\n    redacted to ``\"**********\"``.\n:param default_value: The field's declared default value, dumped via the\n    same JSON serialiser. ``None`` when no default exists.\n:param type: A human-readable representation of the field's declared\n    annotation (for operator visibility; validation uses the actual\n    ``FieldInfo``).\n:param reload: The reload classification (HOT or NOT_OVERRIDABLE).\n:param description: The field's free-text description, or ``None``.\n:param is_secret: Whether the field's annotation contains a Pydantic secret\n    (``SecretStr`` / ``SecretBytes``) at any depth.\n:param is_complex: Whether the field's annotation is or contains a Pydantic\n    ``BaseModel`` subclass (true for nested submodels).\n:param has_override: Whether a row exists in the ``settingoverride`` table\n    for this ``(setting_class, key)`` pair, regardless of ``is_active``.\n:param is_advanced: Whether the setting is flagged ``advanced`` so the UI can\n    present it separately from everyday settings. Display-only:\n    it does not affect PATCH/DELETE eligibility.\n:param is_applicable: Whether the setting applies under current runtime state\n    (e.g. the active auth provider). ``False`` lets the UI present the field\n    as inert. Display-only, like ``is_advanced``: it does not block\n    PATCH/DELETE server-side; the runtime gate is the real enforcement.",
+        "properties": {
+          "default_value": {
+            "title": "Default Value"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "has_override": {
+            "title": "Has Override",
+            "type": "boolean"
+          },
+          "is_advanced": {
+            "default": false,
+            "title": "Is Advanced",
+            "type": "boolean"
+          },
+          "is_applicable": {
+            "default": true,
+            "title": "Is Applicable",
+            "type": "boolean"
+          },
+          "is_complex": {
+            "title": "Is Complex",
+            "type": "boolean"
+          },
+          "is_secret": {
+            "title": "Is Secret",
+            "type": "boolean"
+          },
+          "key": {
+            "title": "Key",
+            "type": "string"
+          },
+          "key_path": {
+            "items": {
+              "type": "string"
+            },
+            "title": "Key Path",
+            "type": "array"
+          },
+          "reload": {
+            "$ref": "#/components/schemas/ReloadClassification"
+          },
+          "setting_class": {
+            "$ref": "#/components/schemas/SettingClassEnum"
+          },
+          "type": {
+            "title": "Type",
+            "type": "string"
+          },
+          "value": {
+            "title": "Value"
+          }
+        },
+        "required": [
+          "setting_class",
+          "key",
+          "value",
+          "default_value",
+          "type",
+          "reload",
+          "description",
+          "is_secret",
+          "is_complex",
+          "has_override"
+        ],
+        "title": "SettingResponse",
+        "type": "object"
+      },
+      "SettingsListResponse": {
+        "description": "The LIST endpoint response, grouping settings by class.\n\n:param groups: One :class:`SettingClassGroup` per settings class the\n    router was configured with.\n:type groups: list[SettingClassGroup]",
+        "properties": {
+          "groups": {
+            "items": {
+              "$ref": "#/components/schemas/SettingClassGroup"
+            },
+            "title": "Groups",
+            "type": "array"
+          }
+        },
+        "required": ["groups"],
+        "title": "SettingsListResponse",
+        "type": "object"
+      },
+      "SettingsPatch": {
+        "additionalProperties": {
+          "$ref": "#/components/schemas/JsonValue"
+        },
+        "description": "Batch PATCH payload: a flat ``{field_name: new_value, ...}`` mapping.\n\nAn empty body is rejected as 422 because a no-op PATCH is a client bug, not\na valid request. The server coerces each value to the field's declared\ntype via :func:`coerce_field_value`; validation is all-or-nothing -- if any\nkey fails, nothing is written.",
+        "minProperties": 1,
+        "title": "SettingsPatch",
+        "type": "object"
+      },
+      "SnippetApprovalFilter": {
+        "description": "Enumerate the approval-status filter selections.\n\n:cvar ALL: Do not filter on approval status.\n:cvar APPROVED: Keep only approved snippets (``approved_at IS NOT NULL``).\n:cvar NOT_APPROVED: Keep only unapproved snippets (``approved_at IS NULL``).",
+        "enum": ["all", "approved", "not_approved"],
+        "title": "SnippetApprovalFilter",
+        "type": "string"
+      },
+      "SnippetBatchApproveRequest": {
+        "description": "Represent the JSON body for ``PATCH /api/apps/snippets/approvals``.\n\nUnlike the Form-bound :class:`~app.sep.snippets.deps.SnippetBatchApproveForm`\ntwin this is a plain Pydantic body — no ``Form()`` annotations — so FastAPI\nparses it as JSON.\n\n:param filenames: Unique, non-empty list of snippet filenames to approve in a\n    single atomic operation. Duplicates are silently deduplicated by\n    ``UniqueList``.",
+        "properties": {
+          "filenames": {
+            "items": {
+              "minLength": 1,
+              "type": "string"
+            },
+            "minItems": 1,
+            "title": "Filenames",
+            "type": "array"
+          }
+        },
+        "required": ["filenames"],
+        "title": "SnippetBatchApproveRequest",
+        "type": "object"
+      },
+      "SnippetResponse": {
+        "description": "Represent a snippet entity as exposed by the JSON API.\n\n:param filename: The snippet's filename on disk; doubles as its\n    identifier in the API.\n:type filename: NonEmptyStr\n:param title: The display title for the snippet (snippet metadata's\n    ``title`` field, falling back to ``filename`` when unset).\n:type title: NonEmptyStr\n:param description: The snippet's free-text description, or an empty\n    string when no description is set in metadata.\n:type description: str\n:param service_type: The snippet's free-form service type\n    (``service_type`` metadata field, for example ``\"mysql\"`` or\n    ``\"mongodb\"``), or ``None`` when the snippet declares no service\n    type. Distinct from the inventory ``ServiceTypeEnum``.\n:type service_type: str | None\n:param size: Snippet file size in bytes.\n:type size: int\n:param md5_digest: 32-character MD5 hex digest of the snippet file.\n:type md5_digest: str\n:param is_approved: Whether the snippet has been approved for execution.\n:type is_approved: bool\n:param approved_at: When the snippet was last approved, or ``None`` if\n    unapproved.\n:type approved_at: datetime | None\n:param updated_by: User id that last toggled the approval state, or\n    ``None`` if no toggle has occurred.\n:type updated_by: str | None\n:param reason: Free-form reason recorded the last time the snippet's\n    approval state changed.\n:type reason: str\n:param requires_sudo: Whether the snippet requires sudo for execution\n    (either always-sudo or sudo is user-toggleable).\n:type requires_sudo: bool\n:param sudo_optional: Whether the user can toggle sudo at execution\n    time.\n:type sudo_optional: bool\n:param sudo_default: Default value for the sudo toggle when\n    ``sudo_optional`` is ``True``.\n:type sudo_default: bool\n:param interpreter: The shell/interpreter command used to execute the\n    snippet (for example, ``\"bash\"`` or ``\"python3\"``); ``None`` when\n    no interpreter mapping resolves.\n:type interpreter: str | None\n:param created_at: When the snippet row was first inserted.\n:type created_at: datetime\n:param updated_at: When the snippet row was last updated, or ``None``\n    if never updated since insert.\n:type updated_at: datetime | None",
+        "properties": {
+          "approved_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Approved At"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "description": {
+            "title": "Description",
+            "type": "string"
+          },
+          "filename": {
+            "minLength": 1,
+            "title": "Filename",
+            "type": "string"
+          },
+          "interpreter": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Interpreter"
+          },
+          "is_approved": {
+            "title": "Is Approved",
+            "type": "boolean"
+          },
+          "md5_digest": {
+            "title": "Md5 Digest",
+            "type": "string"
+          },
+          "reason": {
+            "title": "Reason",
+            "type": "string"
+          },
+          "requires_sudo": {
+            "title": "Requires Sudo",
+            "type": "boolean"
+          },
+          "service_type": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Service Type"
+          },
+          "size": {
+            "title": "Size",
+            "type": "integer"
+          },
+          "sudo_default": {
+            "title": "Sudo Default",
+            "type": "boolean"
+          },
+          "sudo_optional": {
+            "title": "Sudo Optional",
+            "type": "boolean"
+          },
+          "title": {
+            "minLength": 1,
+            "title": "Title",
+            "type": "string"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          },
+          "updated_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated By"
+          }
+        },
+        "required": [
+          "filename",
+          "title",
+          "description",
+          "size",
+          "md5_digest",
+          "is_approved",
+          "reason",
+          "requires_sudo",
+          "sudo_optional",
+          "sudo_default",
+          "created_at"
+        ],
+        "title": "SnippetResponse",
+        "type": "object"
+      },
+      "SnippetServiceTypesResponse": {
+        "description": "Carry the whole-dataset service-type facet for the list filter.\n\nSourced across every snippet (not the loaded page) so the list page's\nservice-type dropdown can offer every value the dataset contains.\n\n:param service_types: The sorted distinct non-blank service types.\n:param has_uncategorized: Whether any snippet has an absent or blank service\n    type (surfaced as the \"Uncategorized\" filter option).",
+        "properties": {
+          "has_uncategorized": {
+            "title": "Has Uncategorized",
+            "type": "boolean"
+          },
+          "service_types": {
+            "items": {
+              "type": "string"
+            },
+            "title": "Service Types",
+            "type": "array"
+          }
+        },
+        "required": ["service_types", "has_uncategorized"],
+        "title": "SnippetServiceTypesResponse",
+        "type": "object"
+      },
+      "SnippetSortDirection": {
+        "description": "Enumerate the sort direction.\n\n:cvar ASC: Ascending order.\n:cvar DESC: Descending order.",
+        "enum": ["asc", "desc"],
+        "title": "SnippetSortDirection",
+        "type": "string"
+      },
+      "SnippetSortKey": {
+        "description": "Enumerate the allowlisted public sort keys.\n\nMembership is the type: an out-of-allowlist key fails to coerce at the\nrequest boundary, so no raw client-supplied column name can reach a query.\n\n:cvar CREATED_AT: Sort by the ``created_at`` column.\n:cvar FILENAME: Sort by the ``filename`` column.\n:cvar APPROVED_AT: Sort by the ``approved_at`` column.\n:cvar TITLE: Sort by the ``meta.title`` JSON value.\n:cvar SERVICE_TYPE: Sort by the ``meta.service_type`` JSON value.",
+        "enum": [
+          "created_at",
+          "filename",
+          "approved_at",
+          "title",
+          "service_type"
+        ],
+        "title": "SnippetSortKey",
+        "type": "string"
+      },
+      "SnippetsCapabilitiesResponse": {
+        "description": "Represent per-deployment capability flags for the Snippets plugin.\n\nExposes flags that gate the visibility of admin-only UI affordances\n(currently the manual refresh button) so the React shell can decide\nwhether to render those controls without probing the gated endpoints.\n\nDistinct from :class:`~app.sep.apps.framework.schema.Capabilities`,\nwhich describes static UI feature flags on\n:attr:`~app.sep.apps.framework.schema.AppSchema.capabilities`\n(chaining, scheduling, alert_on_fail). This model is the per-\ndeployment runtime counterpart returned by ``GET /capabilities``.\n\n:param manual_sync_enabled: Whether manual snippet refresh is enabled\n    in this deployment (mirrors ``snippets_settings.ENABLE_MANUAL_SYNC``).\n:type manual_sync_enabled: bool",
+        "properties": {
+          "manual_sync_enabled": {
+            "title": "Manual Sync Enabled",
+            "type": "boolean"
+          }
+        },
+        "required": ["manual_sync_enabled"],
+        "title": "SnippetsCapabilitiesResponse",
+        "type": "object"
+      },
+      "SourceEnum": {
+        "const": "pmm",
+        "description": "Enumeration of possible data sources for a node.\n\n:cvar PMM: Represents the PMM data source.\n:vartype PMM: str",
+        "enum": ["pmm"],
+        "title": "SourceEnum",
+        "type": "string"
+      },
+      "TaskBackendEnum": {
+        "description": "Control the choice of backends.\n\n:cvar NOMAD: Enum value for Nomad backend.\n:vartype NOMAD: str\n:cvar PROXY: Enum value for Proxy backend.\n:vartype PROXY: str\n:cvar CELERY: Enum value for Celery backend.\n:vartype CELERY: str",
+        "enum": ["nomad", "proxy", "celery"],
+        "title": "TaskBackendEnum",
+        "type": "string"
+      },
+      "TaskExecutionRequest": {
+        "additionalProperties": true,
+        "description": "Represent an execution request.\n\n:param task: The task name.\n:type task: str\n:param target: The target system or environment.\n:type target: str\n:param meta: Additional metadata for the task. Defaults to an empty dictionary.\n:type meta: dict | None\n:param payload: Optional payload or file path for parameterizing the task.\n    Defaults to None.\n:type payload: str | None\n:param tracking: Tracking information for task execution. Defaults to a dictionary\n    with keys for allocation and evaluation IDs.\n:type tracking: dict | None",
+        "properties": {
+          "eta": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Eta"
+          },
+          "meta": {
+            "anyOf": [
+              {
+                "type": "object"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "default": {},
+            "title": "Meta"
+          },
+          "payload": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Payload"
+          },
+          "target": {
+            "title": "Target",
+            "type": "string"
+          },
+          "task": {
+            "title": "Task",
+            "type": "string"
+          },
+          "tracking": {
+            "anyOf": [
+              {
+                "type": "object"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "default": {},
+            "title": "Tracking"
+          }
+        },
+        "required": ["task", "target"],
+        "title": "TaskExecutionRequest",
+        "type": "object"
+      },
+      "TaskHistoryResponse": {
+        "description": "Represent a task history API response.\n\n:param execution_request: The request that triggered the task execution.\n:type execution_request: TaskExecutionRequest\n:param status: The status of the task execution.\n:type status: TaskHistoryStatusEnum\n:param started_at: The datetime when the task execution started.\n:type started_at: UTCDatetime | None\n:param finished_at: The datetime when the task execution finished.\n:type finished_at: UTCDatetime | None\n:param anonymize_mask: The bitmask representing PII entities to be anonymized in\n    logs and files generated by the execution. Defaults to None, meaning it uses\n    the value defined in the associated task's :attr:`Task.anonymize_mask`.\n:type anonymize_mask: int | None\n:param task: The task associated with this execution history.\n:type task: TaskResponse\n:param executed_by: The user ID of the user who executed the task.\n:type executed_by: str | None\n:param has_logs: Whether this task history has any readable log content --\n    either a chunk-store row or a legacy ``tracking[\"task_logs\"]`` blob.\n    Populated by list/retrieve routes; defaults to ``False``.\n:type has_logs: bool\n:param display_name: A user-meaningful label derived from the task name or\n    execution-request metadata. Read-only; computed on serialisation.",
+        "properties": {
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "display_name": {
+            "description": "Return a user-meaningful display label for this task history row.\n\nFor normal tasks, returns ``task.name``. For generic executor templates\n(``run-python``, ``exec-artifact``, ``exec-python-artifact``), builds a\n``\"<source>/<filename> on <target>\"`` label so otherwise-identical rows\nare distinguishable: the filename comes from the snippet metadata or the\n``file://`` payload basename, the source directory from whichever of those\ncarries one, and the target from the execution request. Falls back to\n``\"<task> on <target>\"`` when no filename is available.\n\n:return: The display label for the task history entry.",
+            "readOnly": true,
+            "title": "Display Name",
+            "type": "string"
+          },
+          "duration": {
+            "anyOf": [
+              {
+                "type": "number"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Return the duration of the task execution in seconds.\n\n:return: The duration in seconds, or None if not available.\n:rtype: float | None",
+            "readOnly": true,
+            "title": "Duration"
+          },
+          "executed_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Executed By"
+          },
+          "execution_request": {
+            "$ref": "#/components/schemas/TaskExecutionRequest"
+          },
+          "finished_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Finished At"
+          },
+          "has_logs": {
+            "default": false,
+            "title": "Has Logs",
+            "type": "boolean"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "started_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Started At"
+          },
+          "status": {
+            "$ref": "#/components/schemas/TaskHistoryStatusEnum",
+            "default": "pending"
+          },
+          "task": {
+            "$ref": "#/components/schemas/TaskResponse"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": [
+          "id",
+          "execution_request",
+          "task",
+          "duration",
+          "display_name"
+        ],
+        "title": "TaskHistoryResponse",
+        "type": "object"
+      },
+      "TaskHistoryStatusEnum": {
+        "description": "Define status codes for task executions.\n\n:cvar FAILED: Enum value for failed tasks.\n:vartype FAILED: str\n:cvar PENDING: Enum value for pending tasks.\n:vartype PENDING: str\n:cvar RUNNING: Enum value for running tasks.\n:vartype RUNNING: str\n:cvar SUCCESS: Enum value for successfully completed tasks.\n:vartype SUCCESS: str\n:cvar STOPPED: Enum value for stopped tasks.\n:vartype STOPPED: str\n:cvar LOST: Enum value for tasks that are lost.\n:vartype LOST: str\n:cvar STALE: Enum value for tasks skipped because Nomad placement\n    exceeded the configured staleness threshold.\n:vartype STALE: str",
+        "enum": [
+          "failed",
+          "pending",
+          "running",
+          "success",
+          "stopped",
+          "lost",
+          "stale"
+        ],
+        "title": "TaskHistoryStatusEnum",
+        "type": "string"
+      },
+      "TaskResponse": {
+        "description": "Represent a task API response.\n\n:param name: The name of the task.\n:param data: The task data stored in JSON format.\n:param backend: The backend used for task execution. Defaults to Nomad.\n:param owner: The owner of the task. Defaults to ``\"ANY\"``.\n:param is_template: Whether the task is a template. Defaults to False.\n:param protected: Whether the task is protected from deletion. Defaults to False.\n:param alert_on_fail: Whether to trigger an alert on task failure and\n    auto-resolve it on subsequent success. Defaults to False.\n:param alert_detail_builder: The ``\"module:function\"`` path of a plugin\n    callable that enriches this task's failure alert, or None.\n:param run_result_recorder: The ``\"module:function\"`` path of a plugin\n    callable that records this task's structured run result at terminal\n    status, or None.\n:param output_files_path: The allocation-relative path where output files\n    generated by the task are expected, or None.\n:param deleted_at: The deletion timestamp, if applicable.\n:param anonymize_mask: The bitmask representing PII entities to be anonymized in\n    logs and files generated by the task. Defaults to 0 (no anonymization).\n:param created_by: The user ID of the user who created the task.\n:param last_updated_by: The user ID of the user who last modified the task.\n:param anonymized_entities: Sorted list of PII entity names derived from\n    ``anonymize_mask`` (or from the owner's configured defaults when the\n    mask is ``None``). Each name is the raw ``PIIEntity`` member name\n    (e.g. ``\"EMAIL_ADDRESS\"``). Read-only; computed on serialisation.",
+        "properties": {
+          "alert_detail_builder": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Alert Detail Builder"
+          },
+          "alert_on_fail": {
+            "default": false,
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "anonymized_entities": {
+            "description": "Return sorted PII entity names decoded from ``anonymize_mask``.",
+            "items": {
+              "type": "string"
+            },
+            "readOnly": true,
+            "title": "Anonymized Entities",
+            "type": "array"
+          },
+          "backend": {
+            "$ref": "#/components/schemas/TaskBackendEnum",
+            "default": "nomad"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "created_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created By"
+          },
+          "data": {
+            "title": "Data",
+            "type": "object"
+          },
+          "deleted_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Deleted At"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "is_template": {
+            "default": false,
+            "title": "Is Template",
+            "type": "boolean"
+          },
+          "last_updated_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Updated By"
+          },
+          "name": {
+            "maxLength": 255,
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "output_files_path": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Output Files Path"
+          },
+          "owner": {
+            "default": "ANY",
+            "title": "Owner",
+            "type": "string"
+          },
+          "protected": {
+            "default": false,
+            "title": "Protected",
+            "type": "boolean"
+          },
+          "run_result_recorder": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Run Result Recorder"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": [
+          "id",
+          "name",
+          "data",
+          "deleted_at",
+          "created_by",
+          "last_updated_by",
+          "anonymized_entities"
+        ],
+        "title": "TaskResponse",
+        "type": "object"
+      },
+      "ValidationError": {
+        "properties": {
+          "ctx": {
+            "title": "Context",
+            "type": "object"
+          },
+          "input": {
+            "title": "Input"
+          },
+          "loc": {
+            "items": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "integer"
+                }
+              ]
+            },
+            "title": "Location",
+            "type": "array"
+          },
+          "msg": {
+            "title": "Message",
+            "type": "string"
+          },
+          "type": {
+            "title": "Error Type",
+            "type": "string"
+          }
+        },
+        "required": ["loc", "msg", "type"],
+        "title": "ValidationError",
+        "type": "object"
+      },
+      "alert_troubleshooting__AlertDetailResponse": {
+        "description": "Wrap the response for the alert detail endpoint.\n\n:param alert: The alert metadata.\n:type alert: AlertInfo\n:param snippets: Snippets associated with this alert.\n:type snippets: list[SnippetResponse]",
+        "properties": {
+          "alert": {
+            "$ref": "#/components/schemas/alert_troubleshooting__AlertInfo"
+          },
+          "snippets": {
+            "items": {
+              "$ref": "#/components/schemas/SnippetResponse"
+            },
+            "title": "Snippets",
+            "type": "array"
+          }
+        },
+        "required": ["alert", "snippets"],
+        "title": "AlertDetailResponse",
+        "type": "object"
+      },
+      "alert_troubleshooting__AlertGroup": {
+        "description": "Group alerts sharing a service type.\n\n:param service_type: The service type enum value.\n:type service_type: AlertServiceType\n:param label: Human-readable label for the service type.\n:type label: str\n:param alerts: Alerts belonging to this group.\n:type alerts: list[AlertSummary]",
+        "properties": {
+          "alerts": {
+            "items": {
+              "$ref": "#/components/schemas/alert_troubleshooting__AlertSummary"
+            },
+            "title": "Alerts",
+            "type": "array"
+          },
+          "label": {
+            "title": "Label",
+            "type": "string"
+          },
+          "service_type": {
+            "$ref": "#/components/schemas/AlertServiceType"
+          }
+        },
+        "required": ["service_type", "label", "alerts"],
+        "title": "AlertGroup",
+        "type": "object"
+      },
+      "alert_troubleshooting__AlertInfo": {
+        "description": "Represent a normalized alert entry with its identifier and display label.\n\nAccept a plain string identifier, a dict with ``name`` (required) and\noptional ``label`` and ``service_type``, or keyword arguments.  Invalid\ninputs raise ``ValidationError``.  The ``service_type`` field is optional\nand, when absent, callers fall back to the snippet-level ``service_type``.\n\n:param name: The alert identifier as declared in snippet frontmatter.\n:type name: NonEmptyStr\n:param label: The human-readable display label for the alert.\n:type label: str\n:param service_type: The service type the alert applies to, overriding\n    the snippet-level ``service_type``.  ``None`` means \"fall back to the\n    snippet-level value\".\n:type service_type: AlertServiceType | None",
+        "properties": {
+          "label": {
+            "title": "Label",
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "service_type": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/AlertServiceType"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        },
+        "required": ["name", "label"],
+        "title": "AlertInfo",
+        "type": "object"
+      },
+      "alert_troubleshooting__AlertSummary": {
+        "description": "Represent a minimal alert for the listing endpoint.\n\n:param name: The alert identifier.\n:type name: str\n:param label: The human-readable display label.\n:type label: str",
+        "properties": {
+          "label": {
+            "title": "Label",
+            "type": "string"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label"],
+        "title": "AlertSummary",
+        "type": "object"
+      },
+      "alerts__BackupDetail": {
+        "description": "Describe the full detail response for a single backup.\n\n:param id: Primary key of the backup row.\n:param created_at: UTC timestamp the backup was written.\n:param templates: Templates captured in the backup.\n:param rules: Rules captured in the backup.\n:param contact_points: Contact points captured in the backup.\n:param folders: Folders captured in the backup.\n:param notification_policy_receiver: Top-level receiver from the captured\n    notification policy, or ``None`` when no policy was captured.",
+        "properties": {
+          "contact_points": {
+            "items": {
+              "$ref": "#/components/schemas/alerts__BackupDetailContactPoint"
+            },
+            "title": "Contact Points",
+            "type": "array"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "folders": {
+            "items": {
+              "$ref": "#/components/schemas/alerts__BackupDetailFolder"
+            },
+            "title": "Folders",
+            "type": "array"
+          },
+          "id": {
+            "title": "Id",
+            "type": "integer"
+          },
+          "notification_policy_receiver": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Notification Policy Receiver"
+          },
+          "rules": {
+            "items": {
+              "$ref": "#/components/schemas/alerts__BackupDetailRule"
+            },
+            "title": "Rules",
+            "type": "array"
+          },
+          "templates": {
+            "items": {
+              "$ref": "#/components/schemas/alerts__BackupDetailTemplate"
+            },
+            "title": "Templates",
+            "type": "array"
+          }
+        },
+        "required": [
+          "id",
+          "created_at",
+          "templates",
+          "rules",
+          "contact_points",
+          "folders",
+          "notification_policy_receiver"
+        ],
+        "title": "BackupDetail",
+        "type": "object"
+      },
+      "alerts__BackupDetailContactPoint": {
+        "description": "Represent a contact-point entry inside a backup snapshot.\n\n:param name: The contact point name.\n:param type: The contact point type (e.g. ``\"pagerduty\"``).",
+        "properties": {
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "type": {
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "type"],
+        "title": "BackupDetailContactPoint",
+        "type": "object"
+      },
+      "alerts__BackupDetailFolder": {
+        "description": "Represent a folder entry inside a backup snapshot.\n\n:param title: The folder title.",
+        "properties": {
+          "title": {
+            "title": "Title",
+            "type": "string"
+          }
+        },
+        "required": ["title"],
+        "title": "BackupDetailFolder",
+        "type": "object"
+      },
+      "alerts__BackupDetailRule": {
+        "description": "Represent a rule entry inside a backup snapshot.\n\n:param title: The rule title.",
+        "properties": {
+          "title": {
+            "title": "Title",
+            "type": "string"
+          }
+        },
+        "required": ["title"],
+        "title": "BackupDetailRule",
+        "type": "object"
+      },
+      "alerts__BackupDetailTemplate": {
+        "description": "Represent a template entry inside a backup snapshot.\n\n:param name: The template name.\n:param summary: The template summary blurb.",
+        "properties": {
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "summary": {
+            "title": "Summary",
+            "type": "string"
+          }
+        },
+        "required": ["name", "summary"],
+        "title": "BackupDetailTemplate",
+        "type": "object"
+      },
+      "alerts__BackupSummary": {
+        "description": "Represent a compact backup row used by the list endpoint.\n\n:param id: Primary key of the backup row.\n:param created_at: UTC timestamp the backup was written.\n:param metadata: Summary counts persisted alongside the backup snapshot.",
+        "properties": {
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "id": {
+            "title": "Id",
+            "type": "integer"
+          },
+          "metadata": {
+            "title": "Metadata",
+            "type": "object"
+          }
+        },
+        "required": ["id", "created_at", "metadata"],
+        "title": "BackupSummary",
+        "type": "object"
+      },
+      "alerts__IndexBackupSummary": {
+        "description": "Represent a compact backup row for the index \"recent backups\" widget.\n\nLeaner than :class:`BackupSummary` (no ``metadata``): the list page only\nrenders the id and timestamp, so the index payload omits the summary counts.\n\n:param id: Primary key of the backup row.\n:param created_at: UTC timestamp the backup was written.",
+        "properties": {
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "id": {
+            "title": "Id",
+            "type": "integer"
+          }
+        },
+        "required": ["id", "created_at"],
+        "title": "IndexBackupSummary",
+        "type": "object"
+      },
+      "alerts__IndexPagerDutyStatus": {
+        "description": "Describe the PagerDuty contact-point status on the index page.\n\n:param configured: ``True`` when a SEP PagerDuty contact point exists in PMM.\n:param uid: The contact point UID when configured, otherwise ``None``.",
+        "properties": {
+          "configured": {
+            "title": "Configured",
+            "type": "boolean"
+          },
+          "uid": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Uid"
+          }
+        },
+        "required": ["configured"],
+        "title": "IndexPagerDutyStatus",
+        "type": "object"
+      },
+      "alerts__IndexResponse": {
+        "description": "Describe the response body for ``GET /api/apps/alerts/``.\n\nAggregate everything the React list page needs in a single call: the alert\ntemplates grouped by service type, whether PMM is reachable, the PagerDuty\ncontact-point status, and the most recent backups.\n\n:param groups: Alert templates grouped by service type. Only service types\n    with at least one template are included.\n:param pmm_connected: ``True`` when PMM is configured and reachable.\n:param pagerduty: The PagerDuty status, or ``None`` when PMM is unreachable.\n:param recent_backups: The most recent alert backups, newest first.",
+        "properties": {
+          "groups": {
+            "items": {
+              "$ref": "#/components/schemas/alerts__IndexTemplateGroup"
+            },
+            "title": "Groups",
+            "type": "array"
+          },
+          "pagerduty": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/alerts__IndexPagerDutyStatus"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "pmm_connected": {
+            "title": "Pmm Connected",
+            "type": "boolean"
+          },
+          "recent_backups": {
+            "items": {
+              "$ref": "#/components/schemas/alerts__IndexBackupSummary"
+            },
+            "title": "Recent Backups",
+            "type": "array"
+          }
+        },
+        "required": ["groups", "pmm_connected", "pagerduty", "recent_backups"],
+        "title": "IndexResponse",
+        "type": "object"
+      },
+      "alerts__IndexTemplate": {
+        "description": "Represent a single alert template row on the index page.\n\n:param name: The display name of the alert template.\n:param service_type: The service category this template applies to.\n:param expression: The PromQL expression backing the alert.\n:param default_threshold: The default numeric threshold for the UI.\n:param severity: The severity level (``\"info\"``, ``\"warning\"``, ``\"critical\"``).\n:param description: A human-readable description of the alert.\n:param summary: A short summary template for notifications.\n:param in_pmm: ``True`` when a template of this name is already present in PMM.",
+        "properties": {
+          "default_threshold": {
+            "title": "Default Threshold",
+            "type": "number"
+          },
+          "description": {
+            "title": "Description",
+            "type": "string"
+          },
+          "expression": {
+            "title": "Expression",
+            "type": "string"
+          },
+          "in_pmm": {
+            "title": "In Pmm",
+            "type": "boolean"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "service_type": {
+            "title": "Service Type",
+            "type": "string"
+          },
+          "severity": {
+            "title": "Severity",
+            "type": "string"
+          },
+          "summary": {
+            "title": "Summary",
+            "type": "string"
+          }
+        },
+        "required": [
+          "name",
+          "service_type",
+          "expression",
+          "default_threshold",
+          "severity",
+          "description",
+          "summary",
+          "in_pmm"
+        ],
+        "title": "IndexTemplate",
+        "type": "object"
+      },
+      "alerts__IndexTemplateGroup": {
+        "description": "Group index templates by service type.\n\n:param service_type: The service type identifier (e.g. ``\"mysql\"``).\n:param label: The human-readable service type label (e.g. ``\"MySQL\"``).\n:param templates: The templates belonging to this service type.",
+        "properties": {
+          "label": {
+            "title": "Label",
+            "type": "string"
+          },
+          "service_type": {
+            "title": "Service Type",
+            "type": "string"
+          },
+          "templates": {
+            "items": {
+              "$ref": "#/components/schemas/alerts__IndexTemplate"
+            },
+            "title": "Templates",
+            "type": "array"
+          }
+        },
+        "required": ["service_type", "label", "templates"],
+        "title": "IndexTemplateGroup",
+        "type": "object"
+      },
+      "alerts__PagerDutyRequest": {
+        "description": "Describe the request body for ``POST /api/apps/alerts/pagerduty``.\n\n:param integration_key: The PagerDuty integration key. Must be non-empty\n    after stripping whitespace.",
+        "properties": {
+          "integration_key": {
+            "minLength": 1,
+            "title": "Integration Key",
+            "type": "string"
+          }
+        },
+        "required": ["integration_key"],
+        "title": "PagerDutyRequest",
+        "type": "object"
+      },
+      "alerts__PagerDutyResponse": {
+        "description": "Describe the response body for the PagerDuty save / delete endpoints.\n\n:param status: ``\"created\"``, ``\"updated\"`` (save) or ``\"deleted\"`` (delete).",
+        "properties": {
+          "status": {
+            "enum": ["created", "updated", "deleted"],
+            "title": "Status",
+            "type": "string"
+          }
+        },
+        "required": ["status"],
+        "title": "PagerDutyResponse",
+        "type": "object"
+      },
+      "alerts__PaginatedResponse_BackupSummary_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/alerts__BackupSummary"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[BackupSummary]",
+        "type": "object"
+      },
+      "alerts__PushItemResult": {
+        "description": "Represent a per-template result row returned by the push endpoint.\n\n:param name: The template name the result applies to.\n:param status: One of ``\"success\"``, ``\"skipped\"``, ``\"error\"``.\n:param message: A human-readable description of the outcome.",
+        "properties": {
+          "message": {
+            "title": "Message",
+            "type": "string"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "status": {
+            "enum": ["success", "skipped", "error"],
+            "title": "Status",
+            "type": "string"
+          }
+        },
+        "required": ["name", "status", "message"],
+        "title": "PushItemResult",
+        "type": "object"
+      },
+      "alerts__PushRequest": {
+        "description": "Describe the request body for ``POST /api/apps/alerts/push``.\n\n:param selected_templates: Names of templates to push to PMM. Must be a\n    non-empty list of non-empty strings.",
+        "properties": {
+          "selected_templates": {
+            "items": {
+              "minLength": 1,
+              "type": "string"
+            },
+            "minItems": 1,
+            "title": "Selected Templates",
+            "type": "array"
+          }
+        },
+        "required": ["selected_templates"],
+        "title": "PushRequest",
+        "type": "object"
+      },
+      "alerts__PushResponse": {
+        "description": "Wrap the per-template results returned by the push endpoint.\n\n:param results: One :class:`PushItemResult` per template in the request.",
+        "properties": {
+          "results": {
+            "items": {
+              "$ref": "#/components/schemas/alerts__PushItemResult"
+            },
+            "title": "Results",
+            "type": "array"
+          }
+        },
+        "required": ["results"],
+        "title": "PushResponse",
+        "type": "object"
+      },
+      "alerts__RestoreRequest": {
+        "description": "Describe the request body for ``POST /api/apps/alerts/restore``.\n\n:param backup_id: Primary key of the :class:`~app.sep.apps.alerts.models.AlertBackup`\n    row to restore from. Must be a positive integer.",
+        "properties": {
+          "backup_id": {
+            "exclusiveMinimum": 0.0,
+            "title": "Backup Id",
+            "type": "integer"
+          }
+        },
+        "required": ["backup_id"],
+        "title": "RestoreRequest",
+        "type": "object"
+      },
+      "alerts__RestoreResponse": {
+        "description": "Wrap the summary returned by the restore endpoint.\n\n:param status: ``\"success\"`` on a complete restore.\n:param details: Per-section restore counts as returned by\n    :func:`~app.sep.apps.alerts.restore.restore_from_backup`.",
+        "properties": {
+          "details": {
+            "title": "Details",
+            "type": "object"
+          },
+          "status": {
+            "const": "success",
+            "enum": ["success"],
+            "title": "Status",
+            "type": "string"
+          }
+        },
+        "required": ["status", "details"],
+        "title": "RestoreResponse",
+        "type": "object"
+      },
+      "alters__AltersCreate": {
+        "description": "Represent the single model-first declaration of the Alters create form.\n\nThis one declaration drives the JSON create/update request body, the Jinja\n``Form()`` body, and — via\n:func:`~app.sep.apps.framework.form_dsl.derive_app_schema` — the\n``GET /schema`` source. The mutual-exclusion and ``dsn`` conditional rules are\nenforced by ``AppFormModel`` inheritance (the field-level ``Requires`` /\n``Forbidden`` gates plus ``__form_rules__``), not by a decorator.\n\nThe schema-display defaults for ``dsn_table`` and ``progress`` diverge from the\nrequest-body defaults: the body defaults both to the empty string (so the\n``dsn_table`` forbidden gate passes for non-``dsn`` recursion, and an omitted\n``progress`` emits no value), while the form renders the Percona-Toolkit DSN\ntable and ``time,10`` via ``Ui(default=...)``.\n\n:param task_name: The name of the task to be created.\n:param hostname: The target hostname for the task execution.\n:param service_id: The Inventory ID of the database service to connect to.\n:param db_schema: The schema to alter — an inventory id or a free-typed name.\n:param db_table: The table to alter — an inventory id or a free-typed name.\n:param recursion_method: The method for handling recursion.\n:param alter: The specific alter command to be executed.\n:param dsn_table: The DSN table for recursion method when using ``dsn``. When\n    recursion is ``dsn`` and this field is omitted or empty, it defaults to\n    ``D=percona,t=dsns`` (Percona Toolkit convention).\n:param pause_file: Execution will be paused while the file specified by this param exists.\n:param new_table_name: New table name before it is swapped.\n:param print_arg: Print SQL statements to STDOUT.\n:param progress: Print progress reports to STDERR while copying rows.\n:param no_swap_tables: Swap the original table and the new, altered table.\n:param no_drop_old_table: Drop the original table after renaming it.\n:param no_drop_new_table: Drop the new table if copying the original table fails.\n:param no_drop_triggers: Drop triggers on the old table.\n:param tries: How many times to try critical operations.\n:param set_vars: Set the MySQL variables in this comma-separated list of variable=value pairs.\n:param critical_load: Examine SHOW GLOBAL STATUS after every chunk, and abort if the load is too high.\n:param max_load: Examine SHOW GLOBAL STATUS after every chunk, and pause if any status variables are\n    higher than their thresholds.\n:param chunk_time: Adjust the chunk size dynamically so each data-copy query takes this long to execute.\n:param max_lag: Pause the data copy until all replicas lag is less than this value.\n:param max_flow_ctl: Pause when PXC flow control exceeds this value.\n:param extra_args: Additional command-line arguments to append to the pt-online-schema-change command.\n:param pre_checks_mysql_config_file: Path to MySQL client defaults file on the executor\n    (user/password): pre-checks always use this path; execute/dry-run use pt-osc's\n    default ~/.my.cnf unless this is set to another path, then --defaults-file is added.\n:param continue_on_pre_check_failure: When True, continue to the run task even if\n    pre-checks fail (overrides the schema's default ``on_failure=\"halt\"`` policy).",
+        "properties": {
+          "alert_on_fail": {
+            "default": false,
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "alter": {
+            "minLength": 1,
+            "title": "Alter",
+            "type": "string"
+          },
+          "chunk_time": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Chunk Time"
+          },
+          "continue_on_pre_check_failure": {
+            "default": false,
+            "title": "Continue On Pre Check Failure",
+            "type": "boolean"
+          },
+          "critical_load": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Critical Load"
+          },
+          "db_schema": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "minLength": 1,
+                "type": "string"
+              }
+            ],
+            "title": "Db Schema"
+          },
+          "db_table": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "minLength": 1,
+                "type": "string"
+              }
+            ],
+            "title": "Db Table"
+          },
+          "dsn_table": {
+            "default": "",
+            "title": "Dsn Table",
+            "type": "string"
+          },
+          "extra_args": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Extra Args"
+          },
+          "hostname": {
+            "minLength": 1,
+            "title": "Hostname",
+            "type": "string"
+          },
+          "max_flow_ctl": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Max Flow Ctl"
+          },
+          "max_lag": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Max Lag"
+          },
+          "max_load": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Max Load"
+          },
+          "new_table_name": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "New Table Name"
+          },
+          "no_drop_new_table": {
+            "default": false,
+            "title": "No Drop New Table",
+            "type": "boolean"
+          },
+          "no_drop_old_table": {
+            "default": false,
+            "title": "No Drop Old Table",
+            "type": "boolean"
+          },
+          "no_drop_triggers": {
+            "default": false,
+            "title": "No Drop Triggers",
+            "type": "boolean"
+          },
+          "no_swap_tables": {
+            "default": false,
+            "title": "No Swap Tables",
+            "type": "boolean"
+          },
+          "pause_file": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Pause File"
+          },
+          "pre_checks_mysql_config_file": {
+            "default": "~/.my.cnf",
+            "title": "Pre Checks Mysql Config File",
+            "type": "string"
+          },
+          "print_arg": {
+            "default": false,
+            "title": "Print Arg",
+            "type": "boolean"
+          },
+          "progress": {
+            "default": "",
+            "title": "Progress",
+            "type": "string"
+          },
+          "recursion_method": {
+            "default": "processlist",
+            "minLength": 1,
+            "title": "Recursion Method",
+            "type": "string"
+          },
+          "service_id": {
+            "title": "Service Id",
+            "type": "integer"
+          },
+          "set_vars": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Set Vars"
+          },
+          "task_name": {
+            "minLength": 1,
+            "title": "Task Name",
+            "type": "string"
+          },
+          "tries": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Tries"
+          }
+        },
+        "required": [
+          "task_name",
+          "hostname",
+          "service_id",
+          "db_schema",
+          "db_table",
+          "alter"
+        ],
+        "title": "AltersCreate",
+        "type": "object"
+      },
+      "alters__AltersTaskResponse": {
+        "description": "Represent an alters task API response for list and detail surfaces.\n\nAdd no fields of its own — the alters list/detail surface is exactly the\nshared task-response surface. The create/update routes return the\n:data:`AltersTaskResponseCreate` / :data:`AltersTaskResponseUpdate` models\nderived from this base, which add ``connectivity_warning`` per the\nframework's derived create-response standard.",
+        "properties": {
+          "alert_on_fail": {
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "anonymized_entities": {
+            "description": "Return sorted PII entity names decoded from ``anonymize_mask``.",
+            "items": {
+              "type": "string"
+            },
+            "readOnly": true,
+            "title": "Anonymized Entities",
+            "type": "array"
+          },
+          "backend": {
+            "$ref": "#/components/schemas/TaskBackendEnum"
+          },
+          "connectivity_warning": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/framework__ConnectivityWarning"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "created_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created At"
+          },
+          "created_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created By"
+          },
+          "data": {
+            "title": "Data",
+            "type": "object"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "last_executed_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Executed At"
+          },
+          "last_updated_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Updated By"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "protected": {
+            "title": "Protected",
+            "type": "boolean"
+          },
+          "status": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": [
+          "name",
+          "backend",
+          "data",
+          "protected",
+          "alert_on_fail",
+          "anonymized_entities"
+        ],
+        "title": "AltersTaskResponse",
+        "type": "object"
+      },
+      "alters__PaginatedResponse_AltersTaskResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/alters__AltersTaskResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[AltersTaskResponse]",
+        "type": "object"
+      },
+      "archives__ArchivesCreate": {
+        "description": "Represent an Archives creation form as a model-first ``TaskFormModel``.\n\nSource, destination, and destination-host are discriminated-union one-of groups;\nthe schema / table / database references are collapsed free-solo fields\n(``int`` inventory id or free-typed ``str`` name). The ``task_name`` /\n``hostname`` Task-section fields and the ``alert_on_fail`` capability control\nare inherited from :class:`TaskFormModel`.\n\n:param task_name: The human-readable task name; required and non-empty\n    (inherited from :class:`TaskFormModel`).\n:param hostname: The executor host the task runs on; required and non-empty\n    (inherited from :class:`TaskFormModel`).\n:param service_id: The inventory id of the source MySQL service (the host whose\n    rows are archived; the connectivity probe targets it).\n:param swap_drop: The archive type; only ``PURGE_ONLY`` is currently supported.\n:param source: The source rows, by schema+table or by query.\n:param destination: The destination table or file; ``None`` when ``delete_data``.\n:param host: The destination host, by service or manual entry; ``None`` reuses\n    the source host.\n:param swp_table_suffix: The swap-table date suffix (SWAP_ARCHIVE_DROP only).\n:param where: The WHERE clause filtering rows; required unless SWAP_DROP.\n:param use_index: An index hint to optimise the query.\n:param extra_args: Additional pt-archiver CLI arguments.\n:param limit: The maximum rows per archiver run.\n:param sleep: The sleep duration between chunk operations (seconds).\n:param disable_binlog: Whether to disable binary logging for the operation.\n:param disable_bulk_insert: Whether to disable the bulk-insert optimisation.\n:param delete_data: Whether to delete source rows without archiving them.",
+        "properties": {
+          "alert_on_fail": {
+            "default": false,
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "delete_data": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Delete Data"
+          },
+          "destination": {
+            "anyOf": [
+              {
+                "discriminator": {
+                  "mapping": {
+                    "file": "#/components/schemas/archives__DestByFile",
+                    "table": "#/components/schemas/archives__DestByTable"
+                  },
+                  "propertyName": "mode"
+                },
+                "oneOf": [
+                  {
+                    "$ref": "#/components/schemas/archives__DestByTable"
+                  },
+                  {
+                    "$ref": "#/components/schemas/archives__DestByFile"
+                  }
+                ]
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Destination"
+          },
+          "disable_binlog": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Disable Binlog"
+          },
+          "disable_bulk_insert": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Disable Bulk Insert"
+          },
+          "extra_args": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Extra Args"
+          },
+          "host": {
+            "anyOf": [
+              {
+                "discriminator": {
+                  "mapping": {
+                    "manual": "#/components/schemas/archives__HostManual",
+                    "service": "#/components/schemas/archives__HostByService"
+                  },
+                  "propertyName": "mode"
+                },
+                "oneOf": [
+                  {
+                    "$ref": "#/components/schemas/archives__HostByService"
+                  },
+                  {
+                    "$ref": "#/components/schemas/archives__HostManual"
+                  }
+                ]
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Host"
+          },
+          "hostname": {
+            "minLength": 1,
+            "title": "Hostname",
+            "type": "string"
+          },
+          "limit": {
+            "anyOf": [
+              {
+                "minimum": 1.0,
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Limit"
+          },
+          "service_id": {
+            "title": "Service Id",
+            "type": "integer"
+          },
+          "sleep": {
+            "anyOf": [
+              {
+                "minimum": 0.0,
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Sleep"
+          },
+          "source": {
+            "discriminator": {
+              "mapping": {
+                "query": "#/components/schemas/archives__SourceByQuery",
+                "table": "#/components/schemas/archives__SourceByTable"
+              },
+              "propertyName": "mode"
+            },
+            "oneOf": [
+              {
+                "$ref": "#/components/schemas/archives__SourceByTable"
+              },
+              {
+                "$ref": "#/components/schemas/archives__SourceByQuery"
+              }
+            ],
+            "title": "Source"
+          },
+          "swap_drop": {
+            "default": 0,
+            "maximum": 2.0,
+            "minimum": 0.0,
+            "title": "Swap Drop",
+            "type": "integer"
+          },
+          "swp_table_suffix": {
+            "anyOf": [
+              {
+                "format": "date",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Swp Table Suffix"
+          },
+          "task_name": {
+            "minLength": 1,
+            "title": "Task Name",
+            "type": "string"
+          },
+          "use_index": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Use Index"
+          },
+          "where": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Where"
+          }
+        },
+        "required": ["task_name", "hostname", "service_id", "source"],
+        "title": "ArchivesCreate",
+        "type": "object"
+      },
+      "archives__DestByFile": {
+        "description": "Represent a file destination.\n\n:param mode: The one-of discriminator (``\"file\"``).\n:param dest_file: The file path the archived rows are written to.",
+        "properties": {
+          "dest_file": {
+            "minLength": 1,
+            "title": "Dest File",
+            "type": "string"
+          },
+          "mode": {
+            "const": "file",
+            "default": "file",
+            "enum": ["file"],
+            "title": "Mode",
+            "type": "string"
+          }
+        },
+        "required": ["dest_file"],
+        "title": "DestByFile",
+        "type": "object"
+      },
+      "archives__DestByTable": {
+        "description": "Represent a table destination (collapsed free-solo references).\n\n:param mode: The one-of discriminator (``\"table\"``).\n:param dest_db: The destination schema — an inventory id, a free-typed name, or\n    ``None`` to reuse the source schema.\n:param dest_table: The destination table — an inventory id or a free-typed name.",
+        "properties": {
+          "dest_db": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Dest Db"
+          },
+          "dest_table": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "minLength": 1,
+                "type": "string"
+              }
+            ],
+            "title": "Dest Table"
+          },
+          "mode": {
+            "const": "table",
+            "default": "table",
+            "enum": ["table"],
+            "title": "Mode",
+            "type": "string"
+          }
+        },
+        "required": ["dest_table"],
+        "title": "DestByTable",
+        "type": "object"
+      },
+      "archives__HostByService": {
+        "description": "Represent a destination host taken from an inventory service.\n\n:param mode: The one-of discriminator (``\"service\"``).\n:param dest_service: The inventory id of the destination MySQL service; its\n    node address and port supply the destination host and port.",
+        "properties": {
+          "dest_service": {
+            "title": "Dest Service",
+            "type": "integer"
+          },
+          "mode": {
+            "const": "service",
+            "default": "service",
+            "enum": ["service"],
+            "title": "Mode",
+            "type": "string"
+          }
+        },
+        "required": ["dest_service"],
+        "title": "HostByService",
+        "type": "object"
+      },
+      "archives__HostManual": {
+        "description": "Represent a manually-entered destination host.\n\n:param mode: The one-of discriminator (``\"manual\"``).\n:param dest_host: The destination host address.\n:param dest_port: The destination port (1-65535); defaults to the MySQL port.",
+        "properties": {
+          "dest_host": {
+            "minLength": 1,
+            "title": "Dest Host",
+            "type": "string"
+          },
+          "dest_port": {
+            "anyOf": [
+              {
+                "maximum": 65535.0,
+                "minimum": 1.0,
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Dest Port"
+          },
+          "mode": {
+            "const": "manual",
+            "default": "manual",
+            "enum": ["manual"],
+            "title": "Mode",
+            "type": "string"
+          }
+        },
+        "required": ["dest_host"],
+        "title": "HostManual",
+        "type": "object"
+      },
+      "archives__SourceByQuery": {
+        "description": "Represent a custom-query source selection.\n\n:param mode: The one-of discriminator (``\"query\"``).\n:param source_query: The query defining the rows to archive.",
+        "properties": {
+          "mode": {
+            "const": "query",
+            "default": "query",
+            "enum": ["query"],
+            "title": "Mode",
+            "type": "string"
+          },
+          "source_query": {
+            "minLength": 1,
+            "title": "Source Query",
+            "type": "string"
+          }
+        },
+        "required": ["source_query"],
+        "title": "SourceByQuery",
+        "type": "object"
+      },
+      "archives__SourceByTable": {
+        "description": "Represent a schema+table source selection (collapsed free-solo references).\n\n:param mode: The one-of discriminator (``\"table\"``).\n:param source_db: The source schema — an inventory id or a free-typed name.\n:param source_table: The source table — an inventory id or a free-typed name.",
+        "properties": {
+          "mode": {
+            "const": "table",
+            "default": "table",
+            "enum": ["table"],
+            "title": "Mode",
+            "type": "string"
+          },
+          "source_db": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "minLength": 1,
+                "type": "string"
+              }
+            ],
+            "title": "Source Db"
+          },
+          "source_table": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "minLength": 1,
+                "type": "string"
+              }
+            ],
+            "title": "Source Table"
+          }
+        },
+        "required": ["source_db", "source_table"],
+        "title": "SourceByTable",
+        "type": "object"
+      },
+      "atw__ATWBatchExecuteItemResponse": {
+        "description": "Describe the outcome of one item in a batch execution.\n\n:param snippet_filename: The snippet this item requested.\n:param task_name: The Tasks-API task name the snippet dispatched under, when\n    the dispatch itself succeeded.\n:param task_history_id: The created task-history id, when the Tasks API\n    returned one.\n:param error: The failure detail when the item did not complete — a message\n    or a validation-error list, depending on what rejected it.",
+        "properties": {
+          "error": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "items": {
+                  "additionalProperties": true,
+                  "type": "object"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Error"
+          },
+          "snippet_filename": {
+            "minLength": 1,
+            "title": "Snippet Filename",
+            "type": "string"
+          },
+          "task_history_id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Task History Id"
+          },
+          "task_name": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Task Name"
+          }
+        },
+        "required": ["snippet_filename"],
+        "title": "ATWBatchExecuteItemResponse",
+        "type": "object"
+      },
+      "atw__ATWBatchExecuteItemWrite": {
+        "description": "Define one snippet execution within a batch.\n\n:param snippet_filename: The snippet to execute.\n:param args: Per-snippet arguments keyed by frontmatter parameter name;\n    they override same-named entries in the batch's ``shared_args``.",
+        "properties": {
+          "args": {
+            "additionalProperties": true,
+            "default": {},
+            "title": "Args",
+            "type": "object"
+          },
+          "snippet_filename": {
+            "minLength": 1,
+            "title": "Snippet Filename",
+            "type": "string"
+          }
+        },
+        "required": ["snippet_filename"],
+        "title": "ATWBatchExecuteItemWrite",
+        "type": "object"
+      },
+      "atw__ATWBatchExecuteResponse": {
+        "description": "Collect every item's outcome for one batch execution.\n\nPartial success lives in the body: the request is created (``201``) whenever\nthe incident resolves, and each item carries its own dispatch result or error.\n\n:param items: One entry per requested item, in request order.",
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/atw__ATWBatchExecuteItemResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          }
+        },
+        "required": ["items"],
+        "title": "ATWBatchExecuteResponse",
+        "type": "object"
+      },
+      "atw__ATWBatchExecuteWrite": {
+        "description": "Define the batch-execute payload for one incident.\n\n:param executor_host: The executor every item in the batch runs on.\n:param sudo: The sudo choice applied to every item; snippets whose sudo\n    option is not optional ignore it.\n:param shared_args: Arguments offered to every item, filtered per snippet to\n    the parameters that snippet declares.\n:param items: The snippets to execute, at least one and at most\n    ``MAX_BATCH_SNIPPETS``.",
+        "properties": {
+          "executor_host": {
+            "minLength": 1,
+            "title": "Execution Host",
+            "type": "string"
+          },
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/atw__ATWBatchExecuteItemWrite"
+            },
+            "maxItems": 50,
+            "minItems": 1,
+            "title": "Items",
+            "type": "array"
+          },
+          "shared_args": {
+            "additionalProperties": true,
+            "default": {},
+            "title": "Shared Args",
+            "type": "object"
+          },
+          "sudo": {
+            "default": false,
+            "title": "Sudo",
+            "type": "boolean"
+          }
+        },
+        "required": ["executor_host", "items"],
+        "title": "ATWBatchExecuteWrite",
+        "type": "object"
+      },
+      "atw__ATWCategoryListing": {
+        "description": "Represent one ATW category row and its snippet members.\n\n:param category_root: The top-level product/category root.\n:type category_root: str\n:param parent_category: The parent category enum name.\n:type parent_category: str\n:param parent_category_label: The parent category display label.\n:type parent_category_label: str\n:param category: The ATW leaf category enum name.\n:type category: str\n:param category_label: The ATW leaf category display label.\n:type category_label: str\n:param snippet_count: Number of snippets in this category.\n:type snippet_count: int\n:param snippets: Snippet summaries belonging to this category.\n:type snippets: list[ATWSnippetSummary]",
+        "properties": {
+          "category": {
+            "title": "Category",
+            "type": "string"
+          },
+          "category_label": {
+            "title": "Category Label",
+            "type": "string"
+          },
+          "category_root": {
+            "title": "Category Root",
+            "type": "string"
+          },
+          "parent_category": {
+            "title": "Parent Category",
+            "type": "string"
+          },
+          "parent_category_label": {
+            "title": "Parent Category Label",
+            "type": "string"
+          },
+          "snippet_count": {
+            "title": "Snippet Count",
+            "type": "integer"
+          },
+          "snippets": {
+            "items": {
+              "$ref": "#/components/schemas/atw__ATWSnippetSummary"
+            },
+            "title": "Snippets",
+            "type": "array"
+          }
+        },
+        "required": [
+          "category_root",
+          "parent_category",
+          "parent_category_label",
+          "category",
+          "category_label",
+          "snippet_count",
+          "snippets"
+        ],
+        "title": "ATWCategoryListing",
+        "type": "object"
+      },
+      "atw__ATWIncidentExecutionResponse": {
+        "description": "Represent one recorded incident execution, hydrated with live task status.\n\nThe hydrated fields are ``None`` when the Tasks API could not be reached for\nthat row; the locally-recorded fields are always present.\n\n:param id: The execution row's UUID primary key.\n:param snippet_filename: The executed snippet's filename.\n:param task_history_id: The tasks-service execution this row references.\n:param created_at: When the execution was recorded.\n:param task_status: The upstream execution status.\n:param started_at: When the upstream execution started.\n:param finished_at: When the upstream execution finished.\n:param has_logs: Whether the upstream execution has readable logs.\n:param masked_args: The command line the snippet ran with, credential values\n    replaced by a fixed-width mask. ``None`` together with\n    ``args_withheld=False`` means the execution recorded no arguments.\n    Defaults to ``None``.\n:param args_withheld: Whether the arguments were suppressed because they\n    could not be masked safely -- distinguishing that from an execution that\n    genuinely ran with none. Defaults to ``False``.",
+        "properties": {
+          "args_withheld": {
+            "default": false,
+            "title": "Args Withheld",
+            "type": "boolean"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "finished_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Finished At"
+          },
+          "has_logs": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Has Logs"
+          },
+          "id": {
+            "format": "uuid4",
+            "title": "Id",
+            "type": "string"
+          },
+          "masked_args": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Masked Args"
+          },
+          "snippet_filename": {
+            "title": "Snippet Filename",
+            "type": "string"
+          },
+          "started_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Started At"
+          },
+          "task_history_id": {
+            "title": "Task History Id",
+            "type": "integer"
+          },
+          "task_status": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        },
+        "required": ["id", "snippet_filename", "task_history_id", "created_at"],
+        "title": "ATWIncidentExecutionResponse",
+        "type": "object"
+      },
+      "atw__ATWMergedSchemaResponse": {
+        "description": "Represent the execution form for a batch of selected snippets.\n\nA purpose-built DTO rather than a plain\n:class:`~app.sep.apps.framework.schema.AppSchema`: the renderer needs to map\nevery non-shared field back to the snippet that declared it, and an\n``AppSchema`` section carries only a display title.\n\n:param shared: The batch-level execution fields followed by every parameter\n    the selection declares identically.\n:param per_snippet: The remaining per-snippet fields, in request order.",
+        "properties": {
+          "per_snippet": {
+            "items": {
+              "$ref": "#/components/schemas/atw__ATWSnippetSchema"
+            },
+            "title": "Per Snippet",
+            "type": "array"
+          },
+          "shared": {
+            "items": {
+              "discriminator": {
+                "mapping": {
+                  "bool": "#/components/schemas/framework__BoolField",
+                  "choice": "#/components/schemas/framework__ChoiceField",
+                  "datetime": "#/components/schemas/framework__DateTimeField",
+                  "file": "#/components/schemas/framework__FileField",
+                  "float": "#/components/schemas/framework__FloatField",
+                  "host": "#/components/schemas/framework__HostField",
+                  "integer": "#/components/schemas/framework__IntegerField",
+                  "multi_choice": "#/components/schemas/framework__MultiChoiceField",
+                  "multi_host": "#/components/schemas/framework__MultiHostField",
+                  "multi_schema": "#/components/schemas/framework__MultiSchemaField",
+                  "multi_service": "#/components/schemas/framework__MultiServiceField",
+                  "multi_table": "#/components/schemas/framework__MultiTableField",
+                  "one_of": "#/components/schemas/framework__OneOfGroup",
+                  "remote_choice": "#/components/schemas/framework__RemoteChoiceField",
+                  "schema": "#/components/schemas/framework__SchemaField",
+                  "script_preview": "#/components/schemas/framework__ScriptPreviewField",
+                  "service": "#/components/schemas/framework__ServiceField",
+                  "string": "#/components/schemas/framework__StringField",
+                  "table": "#/components/schemas/framework__TableField",
+                  "textarea": "#/components/schemas/framework__TextAreaField",
+                  "yaml": "#/components/schemas/framework__YamlField"
+                },
+                "propertyName": "type"
+              },
+              "oneOf": [
+                {
+                  "$ref": "#/components/schemas/framework__BoolField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__ChoiceField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__DateTimeField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__FileField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__FloatField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__HostField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__IntegerField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__MultiChoiceField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__MultiHostField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__MultiSchemaField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__MultiServiceField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__MultiTableField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__RemoteChoiceField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__SchemaField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__ScriptPreviewField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__ServiceField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__StringField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__TableField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__TextAreaField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__YamlField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__OneOfGroup"
+                }
+              ]
+            },
+            "title": "Shared",
+            "type": "array"
+          }
+        },
+        "required": ["shared", "per_snippet"],
+        "title": "ATWMergedSchemaResponse",
+        "type": "object"
+      },
+      "atw__ATWSnippetSchema": {
+        "description": "Represent the fields one selected snippet still owns after merging.\n\n:param snippet_filename: The snippet the remaining fields belong to.\n:param fields: The snippet's parameter fields that did not merge into the\n    shared section.",
+        "properties": {
+          "fields": {
+            "items": {
+              "discriminator": {
+                "mapping": {
+                  "bool": "#/components/schemas/framework__BoolField",
+                  "choice": "#/components/schemas/framework__ChoiceField",
+                  "datetime": "#/components/schemas/framework__DateTimeField",
+                  "file": "#/components/schemas/framework__FileField",
+                  "float": "#/components/schemas/framework__FloatField",
+                  "host": "#/components/schemas/framework__HostField",
+                  "integer": "#/components/schemas/framework__IntegerField",
+                  "multi_choice": "#/components/schemas/framework__MultiChoiceField",
+                  "multi_host": "#/components/schemas/framework__MultiHostField",
+                  "multi_schema": "#/components/schemas/framework__MultiSchemaField",
+                  "multi_service": "#/components/schemas/framework__MultiServiceField",
+                  "multi_table": "#/components/schemas/framework__MultiTableField",
+                  "one_of": "#/components/schemas/framework__OneOfGroup",
+                  "remote_choice": "#/components/schemas/framework__RemoteChoiceField",
+                  "schema": "#/components/schemas/framework__SchemaField",
+                  "script_preview": "#/components/schemas/framework__ScriptPreviewField",
+                  "service": "#/components/schemas/framework__ServiceField",
+                  "string": "#/components/schemas/framework__StringField",
+                  "table": "#/components/schemas/framework__TableField",
+                  "textarea": "#/components/schemas/framework__TextAreaField",
+                  "yaml": "#/components/schemas/framework__YamlField"
+                },
+                "propertyName": "type"
+              },
+              "oneOf": [
+                {
+                  "$ref": "#/components/schemas/framework__BoolField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__ChoiceField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__DateTimeField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__FileField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__FloatField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__HostField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__IntegerField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__MultiChoiceField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__MultiHostField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__MultiSchemaField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__MultiServiceField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__MultiTableField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__RemoteChoiceField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__SchemaField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__ScriptPreviewField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__ServiceField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__StringField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__TableField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__TextAreaField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__YamlField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__OneOfGroup"
+                }
+              ]
+            },
+            "title": "Fields",
+            "type": "array"
+          },
+          "snippet_filename": {
+            "minLength": 1,
+            "title": "Snippet Filename",
+            "type": "string"
+          }
+        },
+        "required": ["snippet_filename", "fields"],
+        "title": "ATWSnippetSchema",
+        "type": "object"
+      },
+      "atw__ATWSnippetSummary": {
+        "description": "Represent one snippet entry under an ATW category.\n\n:param name: The snippet filename, used as its API identifier.\n:type name: str\n:param title: The snippet display title.\n:type title: str\n:param description: The snippet free-text description.\n:type description: str",
+        "properties": {
+          "description": {
+            "title": "Description",
+            "type": "string"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "title": {
+            "title": "Title",
+            "type": "string"
+          }
+        },
+        "required": ["name", "title", "description"],
+        "title": "ATWSnippetSummary",
+        "type": "object"
+      },
+      "atw__AtwConfigResponse": {
+        "description": "Report whether the incident send action is available.\n\n:param send_disabled_reasons: Why sending is unavailable; empty when the\n    receiver is configured and the action is offered.",
+        "properties": {
+          "send_disabled_reasons": {
+            "items": {
+              "type": "string"
+            },
+            "title": "Send Disabled Reasons",
+            "type": "array"
+          }
+        },
+        "required": ["send_disabled_reasons"],
+        "title": "AtwConfigResponse",
+        "type": "object"
+      },
+      "atw__AtwIncidentResponse": {
+        "description": "Represent a persisted diagnostic incident.\n\nEvery field is always present on a stored incident, so — unlike returning\nthe :class:`AtwIncident` table model directly — the generated client types\nthem as required rather than optional.\n\n:param id: The incident's UUID primary key.\n:param name: Human-readable incident label.\n:param case_ref: Support-case reference, if set.\n:param created_by: Username of the support engineer who created the incident.\n:param created_at: When the incident was created.\n:param updated_at: When the incident was last updated, if ever.",
+        "properties": {
+          "case_ref": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Case Ref"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "created_by": {
+            "title": "Created By",
+            "type": "string"
+          },
+          "id": {
+            "format": "uuid4",
+            "title": "Id",
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": [
+          "id",
+          "name",
+          "case_ref",
+          "created_by",
+          "created_at",
+          "updated_at"
+        ],
+        "title": "AtwIncidentResponse",
+        "type": "object"
+      },
+      "atw__AtwIncidentUpdate": {
+        "description": "Define the PATCH payload — all fields optional; unset fields are untouched.\n\n:param name: New incident label. Non-nullable when provided: an omitted\n    ``name`` is left unchanged, while an explicit null or empty string is\n    rejected with 422 (the column is NOT NULL). Typing it as a non-optional\n    ``NonEmptyStr`` with a ``None`` default keeps the omitted-field sentinel\n    out of the JSON schema, so the generated client advertises ``name?: string``\n    (not ``string | null``) — matching what the route actually accepts.\n:param case_ref: New support-case reference; an explicit null clears it.",
+        "properties": {
+          "case_ref": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Case Ref"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          }
+        },
+        "title": "AtwIncidentUpdate",
+        "type": "object"
+      },
+      "atw__AtwIncidentWrite": {
+        "description": "Define the create payload; ``name`` defaults and ``created_by`` is server-stamped.",
+        "properties": {
+          "case_ref": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Case Ref"
+          },
+          "name": {
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          }
+        },
+        "title": "AtwIncidentWrite",
+        "type": "object"
+      },
+      "atw__AtwSendJobWrite": {
+        "description": "Define the payload starting one diagnostics send.\n\n:param case_ref: The support-case reference to attach the bundle to.\n:param execution_ids: The incident executions whose output files and logs to\n    send.",
+        "properties": {
+          "case_ref": {
+            "minLength": 1,
+            "title": "Case Ref",
+            "type": "string"
+          },
+          "execution_ids": {
+            "items": {
+              "format": "uuid4",
+              "type": "string"
+            },
+            "minItems": 1,
+            "title": "Execution Ids",
+            "type": "array"
+          }
+        },
+        "required": ["case_ref", "execution_ids"],
+        "title": "AtwSendJobWrite",
+        "type": "object"
+      },
+      "atw__AtwSendLogResponse": {
+        "description": "Represent one recorded diagnostics send attempt.\n\nEvery field is always present on a stored attempt, so -- unlike returning the\n:class:`AtwSendLog` table model directly -- the generated client types them as\nrequired rather than optional.\n\n:param id: The attempt's UUID primary key.\n:param incident_id: The incident the attempt belongs to.\n:param case_ref: The support-case reference the attempt targeted.\n:param requested_by: Username of the support engineer who started it.\n:param status: The attempt's lifecycle status.\n:param started_at: When the worker picked it up, if it did.\n:param finished_at: When it reached a terminal status, if it did.\n:param created_at: When the attempt was requested.\n:param detail: The attempt's recorded evidence.",
+        "properties": {
+          "case_ref": {
+            "minLength": 1,
+            "title": "Case Ref",
+            "type": "string"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "detail": {
+            "title": "Detail",
+            "type": "object"
+          },
+          "finished_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Finished At"
+          },
+          "id": {
+            "format": "uuid4",
+            "title": "Id",
+            "type": "string"
+          },
+          "incident_id": {
+            "format": "uuid4",
+            "title": "Incident Id",
+            "type": "string"
+          },
+          "requested_by": {
+            "title": "Requested By",
+            "type": "string"
+          },
+          "started_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Started At"
+          },
+          "status": {
+            "$ref": "#/components/schemas/atw__AtwSendStatusEnum"
+          }
+        },
+        "required": [
+          "id",
+          "incident_id",
+          "case_ref",
+          "requested_by",
+          "status",
+          "started_at",
+          "finished_at",
+          "created_at",
+          "detail"
+        ],
+        "title": "AtwSendLogResponse",
+        "type": "object"
+      },
+      "atw__AtwSendStatusEnum": {
+        "description": "Enumerate the lifecycle of one diagnostics send attempt.\n\nThe column stores member *names* (``PENDING``); the API serializes the\n``StrEnum`` *values* (``pending``).",
+        "enum": ["pending", "running", "success", "failed"],
+        "title": "AtwSendStatusEnum",
+        "type": "string"
+      },
+      "atw__PaginatedResponse_ATWIncidentExecutionResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/atw__ATWIncidentExecutionResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[ATWIncidentExecutionResponse]",
+        "type": "object"
+      },
+      "atw__PaginatedResponse_AtwIncidentResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/atw__AtwIncidentResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[AtwIncidentResponse]",
+        "type": "object"
+      },
+      "atw__PaginatedResponse_AtwSendLogResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/atw__AtwSendLogResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[AtwSendLogResponse]",
+        "type": "object"
+      },
+      "backup_mongo__BackupDerivedTaskSummary": {
+        "description": "Represent one derived sibling in a backup task detail response.\n\n:param name: The name of the derived task.\n:type name: str\n:param backup_type: The PBM backup type for this derived task.\n:type backup_type: str\n:param status: The latest execution status of the derived task.\n:type status: TaskHistoryStatusEnum | None",
+        "properties": {
+          "backup_type": {
+            "title": "Backup Type",
+            "type": "string"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "status": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        },
+        "required": ["name", "backup_type"],
+        "title": "BackupDerivedTaskSummary",
+        "type": "object"
+      },
+      "backup_mongo__BackupTaskDetailResponse": {
+        "description": "Represent a backup task detail API response.\n\n:param derived_tasks: Latest status for each derived logical, physical,\n    status, and incremental sibling.\n:type derived_tasks: list[BackupDerivedTaskSummary]\n:param latest_pbm_status: Tail of the latest PBM status task stdout, if\n    available.\n:type latest_pbm_status: str | None",
+        "properties": {
+          "alert_on_fail": {
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "anonymized_entities": {
+            "description": "Return sorted PII entity names decoded from ``anonymize_mask``.",
+            "items": {
+              "type": "string"
+            },
+            "readOnly": true,
+            "title": "Anonymized Entities",
+            "type": "array"
+          },
+          "backend": {
+            "$ref": "#/components/schemas/TaskBackendEnum"
+          },
+          "backup_type": {
+            "title": "Backup Type",
+            "type": "string"
+          },
+          "connectivity_warning": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/framework__ConnectivityWarning"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "created_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created At"
+          },
+          "created_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created By"
+          },
+          "data": {
+            "title": "Data",
+            "type": "object"
+          },
+          "derived_tasks": {
+            "items": {
+              "$ref": "#/components/schemas/backup_mongo__BackupDerivedTaskSummary"
+            },
+            "title": "Derived Tasks",
+            "type": "array"
+          },
+          "hostname": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Hostname"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "last_executed_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Executed At"
+          },
+          "last_updated_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Updated By"
+          },
+          "latest_pbm_status": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Latest Pbm Status"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "protected": {
+            "title": "Protected",
+            "type": "boolean"
+          },
+          "status": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": [
+          "name",
+          "backend",
+          "data",
+          "protected",
+          "alert_on_fail",
+          "backup_type",
+          "anonymized_entities"
+        ],
+        "title": "BackupTaskDetailResponse",
+        "type": "object"
+      },
+      "backup_mongo__BackupTaskResponse": {
+        "description": "Represent a backup task API response.\n\n:param backup_type: The PBM backup type stored on the task.",
+        "properties": {
+          "alert_on_fail": {
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "anonymized_entities": {
+            "description": "Return sorted PII entity names decoded from ``anonymize_mask``.",
+            "items": {
+              "type": "string"
+            },
+            "readOnly": true,
+            "title": "Anonymized Entities",
+            "type": "array"
+          },
+          "backend": {
+            "$ref": "#/components/schemas/TaskBackendEnum"
+          },
+          "backup_type": {
+            "title": "Backup Type",
+            "type": "string"
+          },
+          "connectivity_warning": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/framework__ConnectivityWarning"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "created_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created At"
+          },
+          "created_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created By"
+          },
+          "data": {
+            "title": "Data",
+            "type": "object"
+          },
+          "hostname": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Hostname"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "last_executed_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Executed At"
+          },
+          "last_updated_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Updated By"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "protected": {
+            "title": "Protected",
+            "type": "boolean"
+          },
+          "status": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": [
+          "name",
+          "backend",
+          "data",
+          "protected",
+          "alert_on_fail",
+          "backup_type",
+          "anonymized_entities"
+        ],
+        "title": "BackupTaskResponse",
+        "type": "object"
+      },
+      "backup_mongo__BackupTaskWrite": {
+        "description": "Represent a JSON request body for creating a backup task group.\n\nMirrors :class:`BackupCreate` except ``backup_type``, which is always\n``pbm_config`` on create. POST creates the parent config task plus derived\nlogical, physical, status, and incremental siblings.\n\n:param task_name: The name of the task to be created.\n:type task_name: NonEmptyStr\n:param hostname: The target hostname for the task execution.\n:type hostname: NonEmptyStr\n:param service_id: The Inventory ID of the MongoDB service to connect to.\n:type service_id: int\n:param alert_on_fail: If True, send an alert if the task fails.\n:type alert_on_fail: bool\n:param pitr_oplog_span_min: PITR oplog span in minutes.\n:type pitr_oplog_span_min: int | None\n:param pitr_enabled: Whether PITR is enabled.\n:type pitr_enabled: bool\n:param pitr_compression: PITR compression algorithm.\n:type pitr_compression: str | None\n:param storage_type: Storage backend type (``s3`` or ``filesystem``); required.\n:type storage_type: str\n:param storage_s3_region: S3 region when ``storage_type`` is ``s3``.\n:type storage_s3_region: str | None\n:param storage_s3_bucket: S3 bucket when ``storage_type`` is ``s3``.\n:type storage_s3_bucket: str | None\n:param storage_s3_prefix: S3 key prefix when ``storage_type`` is ``s3``.\n:type storage_s3_prefix: str | None\n:param storage_s3_endpoint_url: S3 endpoint URL when ``storage_type`` is ``s3``.\n:type storage_s3_endpoint_url: str | None\n:param storage_filesystem_path: Filesystem path when ``storage_type`` is\n    ``filesystem``.\n:type storage_filesystem_path: str | None\n:param backup_priority: Node priority mapping as YAML.\n:type backup_priority: str | None\n:param backup_compression: Backup snapshot compression algorithm.\n:type backup_compression: CompressionAlgorithm | None\n:param backup_compression_level: Backup compression level.\n:type backup_compression_level: int | None\n:param backup_timeouts_starting_status: PBM starting-status timeout in seconds.\n:type backup_timeouts_starting_status: int | None\n:param backup_oplog_span_min: Logical backup oplog span in minutes.\n:type backup_oplog_span_min: float | None\n:param backup_num_parallel_collections: Parallel collections for logical backup.\n:type backup_num_parallel_collections: int | None\n:param backup_namespaces: Selective ``--ns`` namespaces for logical backups.\n:type backup_namespaces: str | None\n:param backup_with_users_and_roles: Opt-in ``--with-users-and-roles`` for ``db.*``.\n:type backup_with_users_and_roles: bool\n:param credentials_path: Path to MongoDB URI credentials on the Nomad node.\n:type credentials_path: str | None",
+        "properties": {
+          "alert_on_fail": {
+            "default": false,
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "backup_compression": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/backup_mongo__CompressionAlgorithm"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "backup_compression_level": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Backup Compression Level"
+          },
+          "backup_namespaces": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Backup Namespaces"
+          },
+          "backup_num_parallel_collections": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Backup Num Parallel Collections"
+          },
+          "backup_oplog_span_min": {
+            "anyOf": [
+              {
+                "type": "number"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Backup Oplog Span Min"
+          },
+          "backup_priority": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Backup Priority"
+          },
+          "backup_timeouts_starting_status": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Backup Timeouts Starting Status"
+          },
+          "backup_with_users_and_roles": {
+            "default": false,
+            "title": "Backup With Users And Roles",
+            "type": "boolean"
+          },
+          "credentials_path": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Credentials Path"
+          },
+          "hostname": {
+            "minLength": 1,
+            "title": "Hostname",
+            "type": "string"
+          },
+          "pitr_compression": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Pitr Compression"
+          },
+          "pitr_enabled": {
+            "default": false,
+            "title": "Pitr Enabled",
+            "type": "boolean"
+          },
+          "pitr_oplog_span_min": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Pitr Oplog Span Min"
+          },
+          "service_id": {
+            "title": "Service Id",
+            "type": "integer"
+          },
+          "storage_filesystem_path": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Storage Filesystem Path"
+          },
+          "storage_s3_bucket": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Storage S3 Bucket"
+          },
+          "storage_s3_endpoint_url": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Storage S3 Endpoint Url"
+          },
+          "storage_s3_prefix": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Storage S3 Prefix"
+          },
+          "storage_s3_region": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Storage S3 Region"
+          },
+          "storage_type": {
+            "title": "Storage Type",
+            "type": "string"
+          },
+          "task_name": {
+            "minLength": 1,
+            "title": "Task Name",
+            "type": "string"
+          }
+        },
+        "required": ["task_name", "hostname", "service_id", "storage_type"],
+        "title": "BackupTaskWrite",
+        "type": "object"
+      },
+      "backup_mongo__BackupType": {
+        "description": "Backup types.",
+        "enum": [
+          "pbm_logical",
+          "pbm_physical",
+          "pbm_incremental",
+          "pbm_snapshot",
+          "pbm_config",
+          "pbm_status"
+        ],
+        "title": "BackupType",
+        "type": "string"
+      },
+      "backup_mongo__CompressionAlgorithm": {
+        "description": "Represents algorithm of choice whem compressing wirteTiger datafiles.",
+        "enum": ["gzip", "snappy", "lz4", "s2", "pgzip", "zstd"],
+        "title": "CompressionAlgorithm",
+        "type": "string"
+      },
+      "backup_mongo__PaginatedResponse_BackupTaskResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/backup_mongo__BackupTaskResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[BackupTaskResponse]",
+        "type": "object"
+      },
+      "backup_mongo__PaginatedResponse_RestoreTaskResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/backup_mongo__RestoreTaskResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[RestoreTaskResponse]",
+        "type": "object"
+      },
+      "backup_mongo__RestoreDerivedTaskSummary": {
+        "description": "Represent one child task in a restore task group detail response.\n\n:param name: The name of the child task.\n:type name: str\n:param status: The latest execution status of the child task.\n:type status: TaskHistoryStatusEnum | None",
+        "properties": {
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "status": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        },
+        "required": ["name"],
+        "title": "RestoreDerivedTaskSummary",
+        "type": "object"
+      },
+      "backup_mongo__RestoreTaskDetailResponse": {
+        "description": "Represent a restore task detail API response.\n\n:param derived_tasks: Latest status for each restore child task.\n:type derived_tasks: list[RestoreDerivedTaskSummary]",
+        "properties": {
+          "alert_on_fail": {
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "anonymized_entities": {
+            "description": "Return sorted PII entity names decoded from ``anonymize_mask``.",
+            "items": {
+              "type": "string"
+            },
+            "readOnly": true,
+            "title": "Anonymized Entities",
+            "type": "array"
+          },
+          "backend": {
+            "$ref": "#/components/schemas/TaskBackendEnum"
+          },
+          "backup_source": {
+            "title": "Backup Source",
+            "type": "string"
+          },
+          "backup_type": {
+            "title": "Backup Type",
+            "type": "string"
+          },
+          "connectivity_warning": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/framework__ConnectivityWarning"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "created_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created At"
+          },
+          "created_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created By"
+          },
+          "data": {
+            "title": "Data",
+            "type": "object"
+          },
+          "derived_tasks": {
+            "items": {
+              "$ref": "#/components/schemas/backup_mongo__RestoreDerivedTaskSummary"
+            },
+            "title": "Derived Tasks",
+            "type": "array"
+          },
+          "hostname": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Hostname"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "last_executed_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Executed At"
+          },
+          "last_updated_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Updated By"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "protected": {
+            "title": "Protected",
+            "type": "boolean"
+          },
+          "status": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": [
+          "name",
+          "backend",
+          "data",
+          "protected",
+          "alert_on_fail",
+          "backup_type",
+          "backup_source",
+          "anonymized_entities"
+        ],
+        "title": "RestoreTaskDetailResponse",
+        "type": "object"
+      },
+      "backup_mongo__RestoreTaskResponse": {
+        "description": "Represent a restore task API response.\n\nExtend the standard task-response surface with the restore destination facts\nthe API surfaces; the shared task identity, status, audit, anonymization, and\nconnectivity fields come from\n:class:`~app.sep.apps.framework.responses.BaseTaskResponse`.\n\n:param hostname: The target hostname for the task execution.\n:param backup_type: The PBM backup type for this restore.\n:param backup_source: The backup name or timestamp to restore from.",
+        "properties": {
+          "alert_on_fail": {
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "anonymized_entities": {
+            "description": "Return sorted PII entity names decoded from ``anonymize_mask``.",
+            "items": {
+              "type": "string"
+            },
+            "readOnly": true,
+            "title": "Anonymized Entities",
+            "type": "array"
+          },
+          "backend": {
+            "$ref": "#/components/schemas/TaskBackendEnum"
+          },
+          "backup_source": {
+            "title": "Backup Source",
+            "type": "string"
+          },
+          "backup_type": {
+            "title": "Backup Type",
+            "type": "string"
+          },
+          "connectivity_warning": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/framework__ConnectivityWarning"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "created_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created At"
+          },
+          "created_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created By"
+          },
+          "data": {
+            "title": "Data",
+            "type": "object"
+          },
+          "hostname": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Hostname"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "last_executed_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Executed At"
+          },
+          "last_updated_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Updated By"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "protected": {
+            "title": "Protected",
+            "type": "boolean"
+          },
+          "status": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": [
+          "name",
+          "backend",
+          "data",
+          "protected",
+          "alert_on_fail",
+          "backup_type",
+          "backup_source",
+          "anonymized_entities"
+        ],
+        "title": "RestoreTaskResponse",
+        "type": "object"
+      },
+      "backup_mongo__RestoreTaskWrite": {
+        "description": "Represent a JSON request body for creating a restore task group.\n\nMirrors :class:`RestoreCreate` field-for-field with JSON-native types (notably\n``service_id: int | None``). Routes convert via\n:func:`~app.sep.apps.backup_mongo.restore.deps.restore_create_from_write`\nbefore building task payloads. See :class:`RestoreCreate` for why both models\nremain.\n\nPOST always creates a parent config task plus restore, pbm-list, and optional\nforce-resync children.\n\n:param task_name: The name of the task to be created.\n:type task_name: NonEmptyStr\n:param hostname: The target hostname for the task execution.\n:type hostname: NonEmptyStr\n:param service_id: Optional Inventory ID of the MongoDB service.\n:type service_id: int | None\n:param backup_type: Type of backup to restore from (logical or physical).\n:type backup_type: BackupType\n:param backup_source: Backup name or timestamp to restore from.\n:type backup_source: NonEmptyStr\n:param restore_namespace_filter: Optional database or collection namespace\n    filter for a logical restore.\n:type restore_namespace_filter: str | None\n:param restore_batch_size: Number of documents to buffer.\n:type restore_batch_size: int | None\n:param restore_num_insertion_workers: Insertion workers per collection.\n:type restore_num_insertion_workers: int | None\n:param restore_num_parallel_collections: Parallel collections for logical restore.\n:type restore_num_parallel_collections: int | None\n:param restore_num_download_workers: Download workers for physical restore.\n:type restore_num_download_workers: int | None\n:param restore_max_download_buffer_mb: Max S3 download buffer in MB.\n:type restore_max_download_buffer_mb: int | None\n:param restore_download_chunk_mb: S3 download chunk size in MB.\n:type restore_download_chunk_mb: int | None\n:param restore_mongod_location: Custom path to mongod binaries.\n:type restore_mongod_location: str | None\n:param restore_mongod_location_map: Per-node mongod paths as YAML.\n:type restore_mongod_location_map: str | None\n:param credentials_path: Path to MongoDB URI credentials on the Nomad node.\n:type credentials_path: str | None",
+        "properties": {
+          "backup_source": {
+            "minLength": 1,
+            "title": "Backup Source",
+            "type": "string"
+          },
+          "backup_type": {
+            "$ref": "#/components/schemas/backup_mongo__BackupType"
+          },
+          "credentials_path": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Credentials Path"
+          },
+          "hostname": {
+            "minLength": 1,
+            "title": "Hostname",
+            "type": "string"
+          },
+          "restore_batch_size": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Restore Batch Size"
+          },
+          "restore_download_chunk_mb": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Restore Download Chunk Mb"
+          },
+          "restore_max_download_buffer_mb": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Restore Max Download Buffer Mb"
+          },
+          "restore_mongod_location": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Restore Mongod Location"
+          },
+          "restore_mongod_location_map": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Restore Mongod Location Map"
+          },
+          "restore_namespace_filter": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Restore Namespace Filter"
+          },
+          "restore_num_download_workers": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Restore Num Download Workers"
+          },
+          "restore_num_insertion_workers": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Restore Num Insertion Workers"
+          },
+          "restore_num_parallel_collections": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Restore Num Parallel Collections"
+          },
+          "service_id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Service Id"
+          },
+          "task_name": {
+            "minLength": 1,
+            "title": "Task Name",
+            "type": "string"
+          }
+        },
+        "required": ["task_name", "hostname", "backup_type", "backup_source"],
+        "title": "RestoreTaskWrite",
+        "type": "object"
+      },
+      "backup_pg__BackupPgForm": {
+        "additionalProperties": false,
+        "description": "Define the model-first create/update body and schema source for backup_pg.\n\nThe single source of the JSON request body (the field types and defaults the\nserver validates) *and* the derived ``GET /schema`` form (driven by the\n:class:`Ui` / reference / :class:`Choices` markers). Field set, types, and\nmodel defaults match the JSON create contract; the form-display defaults that\ndiffer from the model default (the pgBackRest tool paths, the default backup\ntype) are carried on ``Ui(default=...)`` so the runtime payload stays\nunchanged while the schema renders those form defaults.\n\nField declaration order is load-bearing: it drives the derived form's\nsection and field order. ``backup_type`` is not a form field — the spec\nbuilder injects :attr:`BackupType.PGBACKREST`. The ``task_name`` / ``hostname``\nTask-section fields and the ``alert_on_fail`` capability control are inherited\nfrom :class:`TaskFormModel` (``alert_on_fail`` is ``Hidden``, off-schema).\n``extra=\"forbid\"`` rejects unknown fields (for example a stale FE submitting\n``host`` / ``port``, which the payload pins itself).",
+        "properties": {
+          "alert_on_fail": {
+            "default": false,
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "backup_dir": {
+            "minLength": 1,
+            "title": "Backup Dir",
+            "type": "string"
+          },
+          "hostname": {
+            "minLength": 1,
+            "title": "Hostname",
+            "type": "string"
+          },
+          "logging_dir": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Logging Dir"
+          },
+          "pgbackrest_backup_type": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/backup_pg__PgBackRestBackupType"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "pgbackrest_bin": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Pgbackrest Bin"
+          },
+          "pgbackrest_config_file": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Pgbackrest Config File"
+          },
+          "pgbackrest_datadir": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Pgbackrest Datadir"
+          },
+          "pgbackrest_incremental_cycle": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Pgbackrest Incremental Cycle"
+          },
+          "pgbackrest_retention_archive": {
+            "anyOf": [
+              {
+                "minimum": 0.0,
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Pgbackrest Retention Archive"
+          },
+          "pgbackrest_retention_full": {
+            "anyOf": [
+              {
+                "minimum": 0.0,
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Pgbackrest Retention Full"
+          },
+          "service_id": {
+            "title": "Service Id",
+            "type": "integer"
+          },
+          "stanza": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z0-9][A-Za-z0-9_-]*$",
+            "title": "Stanza",
+            "type": "string"
+          },
+          "task_name": {
+            "minLength": 1,
+            "title": "Task Name",
+            "type": "string"
+          }
+        },
+        "required": [
+          "task_name",
+          "hostname",
+          "service_id",
+          "stanza",
+          "backup_dir"
+        ],
+        "title": "BackupPgForm",
+        "type": "object"
+      },
+      "backup_pg__BackupTaskDetailResponse": {
+        "description": "Represent a single pgBackRest backup task detail response.\n\nAdd the executor host and port resolved from the task's YAML config so the\nFE detail view can render them alongside the parity Overview block; list\nrows omit these to keep the table response compact.\n\n:param host: The PostgreSQL host the task connects to.\n:param port: The PostgreSQL port the task connects to.",
+        "properties": {
+          "alert_on_fail": {
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "anonymized_entities": {
+            "description": "Return sorted PII entity names decoded from ``anonymize_mask``.",
+            "items": {
+              "type": "string"
+            },
+            "readOnly": true,
+            "title": "Anonymized Entities",
+            "type": "array"
+          },
+          "backend": {
+            "$ref": "#/components/schemas/TaskBackendEnum"
+          },
+          "backup_type": {
+            "title": "Backup Type",
+            "type": "string"
+          },
+          "connectivity_warning": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/framework__ConnectivityWarning"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "created_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created At"
+          },
+          "created_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created By"
+          },
+          "data": {
+            "title": "Data",
+            "type": "object"
+          },
+          "host": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Host"
+          },
+          "hostname": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Hostname"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "last_executed_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Executed At"
+          },
+          "last_updated_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Updated By"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "port": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Port"
+          },
+          "protected": {
+            "title": "Protected",
+            "type": "boolean"
+          },
+          "status": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": [
+          "name",
+          "backend",
+          "data",
+          "protected",
+          "alert_on_fail",
+          "backup_type",
+          "anonymized_entities"
+        ],
+        "title": "BackupTaskDetailResponse",
+        "type": "object"
+      },
+      "backup_pg__BackupTaskResponse": {
+        "description": "Represent a pgBackRest backup task API response.\n\n:param backup_type: The ``backup_type`` discriminator stored on the task.",
+        "properties": {
+          "alert_on_fail": {
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "anonymized_entities": {
+            "description": "Return sorted PII entity names decoded from ``anonymize_mask``.",
+            "items": {
+              "type": "string"
+            },
+            "readOnly": true,
+            "title": "Anonymized Entities",
+            "type": "array"
+          },
+          "backend": {
+            "$ref": "#/components/schemas/TaskBackendEnum"
+          },
+          "backup_type": {
+            "title": "Backup Type",
+            "type": "string"
+          },
+          "connectivity_warning": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/framework__ConnectivityWarning"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "created_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created At"
+          },
+          "created_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created By"
+          },
+          "data": {
+            "title": "Data",
+            "type": "object"
+          },
+          "hostname": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Hostname"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "last_executed_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Executed At"
+          },
+          "last_updated_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Updated By"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "protected": {
+            "title": "Protected",
+            "type": "boolean"
+          },
+          "status": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": [
+          "name",
+          "backend",
+          "data",
+          "protected",
+          "alert_on_fail",
+          "backup_type",
+          "anonymized_entities"
+        ],
+        "title": "BackupTaskResponse",
+        "type": "object"
+      },
+      "backup_pg__PaginatedResponse_BackupTaskResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/backup_pg__BackupTaskResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[BackupTaskResponse]",
+        "type": "object"
+      },
+      "backup_pg__PgBackRestBackupType": {
+        "description": "PgBackRest backup types.",
+        "enum": ["incr", "diff"],
+        "title": "PgBackRestBackupType",
+        "type": "string"
+      },
+      "checksums__ChecksumsForm": {
+        "description": "Define the model-first create/update body and schema source for Checksums.\n\nThe single source of the JSON request body (the field types and defaults the\nserver validates) *and* the derived ``GET /schema`` form (driven by the\n:class:`Ui` / reference / :class:`Choices` markers). Field set, types, and\nmodel defaults match the previous hand-written request body; the form-display\ndefaults that differ from the model default are carried on ``Ui(default=...)``.\n\nField declaration order is load-bearing. The spec builder assembles\n``--databases`` / ``--tables`` from the multi-value reference fields, then the\nframework's ``build_command_args`` emits the remaining ``ArgFormat`` value args\n(in field order) followed by all flag args (in field order). Section order\n(Task, Data, Recursion, Flags, Advanced) follows each section's first field.\n``progress`` is declared last to land at the end of the value args, and\n``Ui(order=...)`` pins the Advanced section's display order where it diverges\nfrom declaration order. The ``task_name`` / ``hostname`` Task-section fields\nand the ``alert_on_fail`` capability control are inherited from\n:class:`TaskFormModel` (``alert_on_fail`` is ``Hidden``, off-schema).",
+        "properties": {
+          "alert_on_fail": {
+            "default": false,
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "binary_index": {
+            "default": false,
+            "title": "Binary Index",
+            "type": "boolean"
+          },
+          "chunk_time": {
+            "default": "",
+            "title": "Chunk Time",
+            "type": "string"
+          },
+          "databases": {
+            "items": {
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "minLength": 1,
+                  "type": "string"
+                }
+              ]
+            },
+            "title": "Databases",
+            "type": "array"
+          },
+          "dsn_table": {
+            "default": "",
+            "title": "Dsn Table",
+            "type": "string"
+          },
+          "explain_arg": {
+            "default": false,
+            "title": "Explain Arg",
+            "type": "boolean"
+          },
+          "fail_on_stopped_replication": {
+            "default": false,
+            "title": "Fail On Stopped Replication",
+            "type": "boolean"
+          },
+          "hostname": {
+            "minLength": 1,
+            "title": "Hostname",
+            "type": "string"
+          },
+          "max_lag": {
+            "default": "",
+            "title": "Max Lag",
+            "type": "string"
+          },
+          "max_load": {
+            "default": "",
+            "title": "Max Load",
+            "type": "string"
+          },
+          "pause_file": {
+            "default": "",
+            "title": "Pause File",
+            "type": "string"
+          },
+          "progress": {
+            "default": "",
+            "title": "Progress",
+            "type": "string"
+          },
+          "recursion_method": {
+            "default": "processlist",
+            "title": "Recursion Method",
+            "type": "string"
+          },
+          "service_id": {
+            "title": "Service Id",
+            "type": "integer"
+          },
+          "set_vars": {
+            "default": "",
+            "title": "Set Vars",
+            "type": "string"
+          },
+          "tables": {
+            "items": {
+              "anyOf": [
+                {
+                  "type": "integer"
+                },
+                {
+                  "minLength": 1,
+                  "type": "string"
+                }
+              ]
+            },
+            "title": "Tables",
+            "type": "array"
+          },
+          "task_name": {
+            "minLength": 1,
+            "title": "Task Name",
+            "type": "string"
+          },
+          "truncate_replicate_table": {
+            "default": false,
+            "title": "Truncate Replicate Table",
+            "type": "boolean"
+          }
+        },
+        "required": ["task_name", "hostname", "service_id"],
+        "title": "ChecksumsForm",
+        "type": "object"
+      },
+      "dipper__CollectorTypeEnum": {
+        "description": "Define enum for Dipper collector types.",
+        "enum": ["environment", "pmm"],
+        "title": "CollectorTypeEnum",
+        "type": "string"
+      },
+      "dipper__DipperExecuteWrite": {
+        "description": "Define the JSON body for ``POST /api/apps/dipper/``.\n\n:param service_id: Inventory ID of the database service to collect data from.\n:type service_id: int\n:param collector_type: Which collector script to run (environment or pmm).\n:type collector_type: CollectorTypeEnum\n:param executor_host: Nomad client hostname that will run the script.\n:type executor_host: NonEmptyStr\n:param sudo: Whether to invoke the script with ``sudo``. ``None`` defers\n    to the script's own sudo policy (the default).\n:type sudo: bool | None\n:param args: Per-parameter arguments keyed by script parameter name. Validated\n    server-side against the script's dynamic execution model.\n:type args: dict[str, Any]",
+        "properties": {
+          "args": {
+            "additionalProperties": true,
+            "title": "Args",
+            "type": "object"
+          },
+          "collector_type": {
+            "$ref": "#/components/schemas/dipper__CollectorTypeEnum",
+            "default": "environment"
+          },
+          "executor_host": {
+            "minLength": 1,
+            "title": "Execution Host",
+            "type": "string"
+          },
+          "service_id": {
+            "title": "Service Id",
+            "type": "integer"
+          },
+          "sudo": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Sudo"
+          }
+        },
+        "required": ["service_id", "executor_host"],
+        "title": "DipperExecuteWrite",
+        "type": "object"
+      },
+      "dipper__DipperExecutionResponse": {
+        "description": "Represent the response from ``POST /api/apps/dipper/``.\n\n:param task_id: ID of the task-history row created by the tasks API.\n:type task_id: int | None\n:param task_name: The execution task name used to dispatch the script.\n:type task_name: str\n:param snippet_filename: Composite path used to correlate history rows.\n:type snippet_filename: str\n:param service_id: Inventory ID of the database service.\n:type service_id: int\n:param collector_type: Collector type that was executed.\n:type collector_type: CollectorTypeEnum",
+        "properties": {
+          "collector_type": {
+            "$ref": "#/components/schemas/dipper__CollectorTypeEnum"
+          },
+          "service_id": {
+            "title": "Service Id",
+            "type": "integer"
+          },
+          "snippet_filename": {
+            "title": "Snippet Filename",
+            "type": "string"
+          },
+          "task_id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Task Id"
+          },
+          "task_name": {
+            "title": "Task Name",
+            "type": "string"
+          }
+        },
+        "required": [
+          "task_name",
+          "snippet_filename",
+          "service_id",
+          "collector_type"
+        ],
+        "title": "DipperExecutionResponse",
+        "type": "object"
+      },
+      "framework__AltersTaskResponseCreate": {
+        "description": "Represent the create response for an alters task group, carrying the post-creation connectivity warning.",
+        "properties": {
+          "alert_on_fail": {
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "anonymized_entities": {
+            "description": "Return sorted PII entity names decoded from ``anonymize_mask``.",
+            "items": {
+              "type": "string"
+            },
+            "readOnly": true,
+            "title": "Anonymized Entities",
+            "type": "array"
+          },
+          "backend": {
+            "$ref": "#/components/schemas/TaskBackendEnum"
+          },
+          "connectivity_warning": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/framework__ConnectivityWarning"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "created_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created At"
+          },
+          "created_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created By"
+          },
+          "data": {
+            "title": "Data",
+            "type": "object"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "last_executed_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Executed At"
+          },
+          "last_updated_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Updated By"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "protected": {
+            "title": "Protected",
+            "type": "boolean"
+          },
+          "status": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": [
+          "name",
+          "backend",
+          "data",
+          "protected",
+          "alert_on_fail",
+          "anonymized_entities"
+        ],
+        "title": "AltersTaskResponseCreate",
+        "type": "object"
+      },
+      "framework__AltersTaskResponseUpdate": {
+        "description": "Represent the update response for an alters task group, carrying the post-update connectivity warning.",
+        "properties": {
+          "alert_on_fail": {
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "anonymized_entities": {
+            "description": "Return sorted PII entity names decoded from ``anonymize_mask``.",
+            "items": {
+              "type": "string"
+            },
+            "readOnly": true,
+            "title": "Anonymized Entities",
+            "type": "array"
+          },
+          "backend": {
+            "$ref": "#/components/schemas/TaskBackendEnum"
+          },
+          "connectivity_warning": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/framework__ConnectivityWarning"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "created_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created At"
+          },
+          "created_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created By"
+          },
+          "data": {
+            "title": "Data",
+            "type": "object"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "last_executed_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Executed At"
+          },
+          "last_updated_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Updated By"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "protected": {
+            "title": "Protected",
+            "type": "boolean"
+          },
+          "status": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": [
+          "name",
+          "backend",
+          "data",
+          "protected",
+          "alert_on_fail",
+          "anonymized_entities"
+        ],
+        "title": "AltersTaskResponseUpdate",
+        "type": "object"
+      },
+      "framework__AppEntitySchema": {
+        "additionalProperties": false,
+        "description": "Describe one CRUD entity for a multi-entity schema-driven plugin.\n\nUsed when a plugin exposes several independent resources (for example\ninventory nodes, services, schemas, and tables), each with its own list\nview and create/edit forms. Task-style plugins omit ``entities`` and use\nthe root ``forms`` / ``list_view`` instead.\n\n:param name: URL segment and API key for the entity (for example ``nodes``).\n:type name: NonEmptyStr\n:param display_name: Human-readable title for this entity's screens.\n:type display_name: NonEmptyStr\n:param description: Optional helper text for this entity. Defaults to\n    ``None``.\n:type description: NonEmptyStr | None\n:param forms: Form sections for create (and edit when the UI supports it).\n:type forms: list[FormSection]\n:param list_view: Column configuration for this entity's list table.\n:type list_view: ListView\n:param detail_highlights: Optional per-field syntax highlighter hints for\n    detail pages. Keys are field names; values are highlighting languages.\n    Defaults to an empty mapping.\n:type detail_highlights: dict[NonEmptyStr, DetailHighlightLanguage]\n:param cardinality_rules: Optional entity-wide cross-field cardinality\n    constraints. Defaults to ``None``.\n:type cardinality_rules: list[CardinalityRule] | None\n:param fail_when: Optional entity-wide predicate-only invariants.\n    Defaults to ``None``.\n:type fail_when: list[FailRule] | None",
+        "properties": {
+          "cardinality_rules": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__CardinalityRule"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Cardinality Rules"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "detail_highlights": {
+            "additionalProperties": {
+              "$ref": "#/components/schemas/framework__DetailHighlightLanguage"
+            },
+            "title": "Detail Highlights",
+            "type": "object"
+          },
+          "display_name": {
+            "minLength": 1,
+            "title": "Display Name",
+            "type": "string"
+          },
+          "fail_when": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FailRule"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Fail When"
+          },
+          "forms": {
+            "items": {
+              "$ref": "#/components/schemas/framework__FormSection"
+            },
+            "title": "Forms",
+            "type": "array"
+          },
+          "list_view": {
+            "$ref": "#/components/schemas/framework__ListView"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          }
+        },
+        "required": ["name", "display_name", "forms", "list_view"],
+        "title": "AppEntitySchema",
+        "type": "object"
+      },
+      "framework__AppSchema": {
+        "additionalProperties": false,
+        "description": "Represent a plugin's complete schema: form sections, list view, capabilities.\n\n:param name: The plugin identifier; must match Python identifier rules,\n    optionally with internal hyphens.\n:type name: NonEmptyStr\n:param display_name: The human-readable plugin title displayed in the UI.\n:type display_name: NonEmptyStr\n:param description: Optional helper text describing the plugin's\n    purpose. Defaults to ``None``.\n:type description: NonEmptyStr | None\n:param task_type: Optional task-type identifier used when creating tasks\n    via the shared task API. Defaults to ``None``.\n:type task_type: NonEmptyStr | None\n:param forms: Form sections for single-entity / task plugins. Defaults to\n    an empty list when ``entities`` is used instead.\n:type forms: list[FormSection]\n:param capabilities: Optional plugin-level feature flags. Defaults to\n    ``None``.\n:type capabilities: Capabilities | None\n:param list_view: List-view configuration when ``entities`` is unset\n    (single-entity / task plugins). Ignored when ``entities`` is set.\n:type list_view: ListView | None\n:param detail_view: Optional declarative layout for the task detail page's\n    section cards (task-style plugins only; ignored when ``entities`` is\n    set). Optional at the model layer for backwards compatibility. A\n    forward-looking guard refuses to load a plugin that sets\n    ``task_type`` without declaring ``detail_view``. Defaults to ``None``.\n:type detail_view: DetailView | None\n:param entities: Optional list of CRUD entities for multi-resource plugins.\n    When non-empty, the React shell renders one list/create/detail flow\n    per entity. Defaults to ``None`` (legacy single-entity mode).\n:param cardinality_rules: Optional plugin-wide cross-field cardinality\n    constraints (task-style plugins only; ignored when ``entities`` is set).\n    Defaults to ``None``.\n:type cardinality_rules: list[CardinalityRule] | None\n:param fail_when: Optional plugin-wide predicate-only invariants (task-style\n    plugins only; ignored when ``entities`` is set). Defaults to ``None``.\n:type fail_when: list[FailRule] | None\n:param derived: Optional declarative specs for sibling tasks derived from\n    the parent task on cascade. Consumed by\n    :mod:`app.sep.apps.framework.cascade` to drive POST/PUT/DELETE\n    across the parent and N derived siblings. Defaults to ``None``.\n:type derived: list[DerivedTask] | None\n:param predecessors: Optional declarative specs for tasks that must run\n    before the parent. Consumed by\n    :mod:`app.sep.apps.framework.cascade` to drive POST/PUT/DELETE\n    across the predecessors and the parent, including the chain wiring\n    applied at execute time. Defaults to ``None``.\n:type predecessors: list[ChainedPredecessor] | None\n:param related_apps: Optional separately registered apps the React shell\n    surfaces as sibling tabs (for example a restore app nested under a\n    backups parent). Defaults to ``None``.\n:type related_apps: list[RelatedApp] | None",
+        "properties": {
+          "capabilities": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/framework__Capabilities"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "cardinality_rules": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__CardinalityRule"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Cardinality Rules"
+          },
+          "derived": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__DerivedTask"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Derived"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "detail_view": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/framework__DetailView"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "display_name": {
+            "minLength": 1,
+            "title": "Display Name",
+            "type": "string"
+          },
+          "entities": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__AppEntitySchema"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Entities"
+          },
+          "fail_when": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FailRule"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Fail When"
+          },
+          "forms": {
+            "items": {
+              "$ref": "#/components/schemas/framework__FormSection"
+            },
+            "title": "Forms",
+            "type": "array"
+          },
+          "list_view": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/framework__ListView"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "predecessors": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__ChainedPredecessor"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Predecessors"
+          },
+          "related_apps": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__RelatedApp"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Related Apps"
+          },
+          "task_type": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Task Type"
+          }
+        },
+        "required": ["name", "display_name"],
+        "title": "AppSchema",
+        "type": "object"
+      },
+      "framework__BackupPgCreateResponse": {
+        "properties": {
+          "alert_on_fail": {
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "anonymized_entities": {
+            "description": "Return sorted PII entity names decoded from ``anonymize_mask``.",
+            "items": {
+              "type": "string"
+            },
+            "readOnly": true,
+            "title": "Anonymized Entities",
+            "type": "array"
+          },
+          "backend": {
+            "$ref": "#/components/schemas/TaskBackendEnum"
+          },
+          "backup_type": {
+            "title": "Backup Type",
+            "type": "string"
+          },
+          "connectivity_warning": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/framework__ConnectivityWarning"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "created_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created At"
+          },
+          "created_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created By"
+          },
+          "data": {
+            "title": "Data",
+            "type": "object"
+          },
+          "host": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Host"
+          },
+          "hostname": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Hostname"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "last_executed_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Executed At"
+          },
+          "last_updated_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Updated By"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "port": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Port"
+          },
+          "protected": {
+            "title": "Protected",
+            "type": "boolean"
+          },
+          "status": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": [
+          "name",
+          "backend",
+          "data",
+          "protected",
+          "alert_on_fail",
+          "backup_type",
+          "anonymized_entities"
+        ],
+        "title": "BackupPgCreateResponse",
+        "type": "object"
+      },
+      "framework__BaseTaskResponse": {
+        "description": "Represent the universal task-response surface for standard task apps.\n\nCarry the fields shared by every standard ``TaskExecutionApp`` response:\nthe task identity, the resolved execution status, the stored configuration,\nand the audit/anonymization metadata. A standard app whose response has no\napp-specific fields uses this model directly; an app with extras subclasses\nit. The model is parametrized by the task ``owner``, which drives the\n``anonymized_entities`` default-entity lookup but is excluded from the\nserialized detail/list payload (as is ``service_type``).\n\n:param name: The task name.\n:param owner: The task-category owner (for example ``BACKUPS``). Kept\n    as a model attribute for ``anonymized_entities`` and server-side\n    filtering; excluded from the serialized detail/list payload.\n:param service_type: The database service type, stamped by the builder;\n    ``None`` for an app without a fixed service type. Excluded from the\n    serialized detail/list payload.\n:param status: The latest known execution status; ``None`` until the task\n    runs.\n:param last_executed_at: The most recent time the task finished executing\n    (``max`` ``finished_at`` across its history). Reported even while a\n    re-run is in progress (showing the prior completion); ``None`` until the\n    task has finished at least once.\n:param id: The task's unique identifier.\n:param backend: The backend worker/engine executing the task.\n:param data: The raw configuration and parameters used for execution. Tasks\n    created through the JSON schema-driven path also carry a reserved additive\n    ``_form`` key holding the verbatim, validated create-form body for\n    prefilling an edit form; it is absent for tasks created through a legacy\n    form, so consumers must treat it as optional.\n:param protected: Whether the task is protected from deletion or modification.\n:param alert_on_fail: Whether a notification is sent on task failure.\n:param anonymize_mask: Bitmask of PII entities to anonymize; ``None`` falls\n    back to the owner's configured defaults.\n:param created_at: The timestamp when the task was first created.\n:param updated_at: The timestamp of the last modification to the task.\n:param created_by: Display name for the user who initiated the task (Casdoor\n    username when resolvable, otherwise the stored user id).\n:param last_updated_by: Display name for the user who last modified the task\n    record (Casdoor username when resolvable, otherwise the stored user id).\n:param connectivity_warning: A warning surfaced when the post-creation\n    database connectivity check fails. ``None`` when the check passes, is\n    opted out, or the task meta lacks the connectivity keys.\n:param anonymized_entities: Sorted PII entity names derived from\n    ``anonymize_mask`` (or from the owner's configured defaults when the mask\n    is ``None``). Read-only; computed on serialisation.",
+        "properties": {
+          "alert_on_fail": {
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "anonymized_entities": {
+            "description": "Return sorted PII entity names decoded from ``anonymize_mask``.",
+            "items": {
+              "type": "string"
+            },
+            "readOnly": true,
+            "title": "Anonymized Entities",
+            "type": "array"
+          },
+          "backend": {
+            "$ref": "#/components/schemas/TaskBackendEnum"
+          },
+          "connectivity_warning": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/framework__ConnectivityWarning"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "created_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created At"
+          },
+          "created_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created By"
+          },
+          "data": {
+            "title": "Data",
+            "type": "object"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "last_executed_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Executed At"
+          },
+          "last_updated_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Updated By"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "protected": {
+            "title": "Protected",
+            "type": "boolean"
+          },
+          "status": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": [
+          "name",
+          "backend",
+          "data",
+          "protected",
+          "alert_on_fail",
+          "anonymized_entities"
+        ],
+        "title": "BaseTaskResponse",
+        "type": "object"
+      },
+      "framework__BoolField": {
+        "additionalProperties": false,
+        "description": "Represent a boolean toggle field.\n\n:param field_type: The discriminator literal; always ``\"bool\"`` for this\n    class. Serialised as the JSON key ``\"type\"``.\n:type field_type: Literal[\"bool\"]",
+        "properties": {
+          "default": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "required": {
+            "default": false,
+            "title": "Required",
+            "type": "boolean"
+          },
+          "requires": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Requires"
+          },
+          "type": {
+            "const": "bool",
+            "default": "bool",
+            "enum": ["bool"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label"],
+        "title": "BoolField",
+        "type": "object"
+      },
+      "framework__Capabilities": {
+        "additionalProperties": false,
+        "description": "Represent plugin-level feature flags.\n\n:param chaining: Whether the plugin supports chaining tasks together.\n    Defaults to ``False``.\n:type chaining: bool\n:param alert_on_fail: Whether the plugin supports configuring a PMM\n    alert when a task fails. Defaults to ``False``.\n:type alert_on_fail: bool\n:param scheduling: Whether the plugin supports scheduling tasks on a\n    periodic interval. Defaults to ``False``.\n:type scheduling: bool\n:param stats: Whether the plugin supports rendering the aggregated\n    execution statistics card on its detail page. Defaults to\n    ``False``.\n:type stats: bool\n:param pii_anonymization: Whether the plugin wires ``anonymize_mask``\n    into task execution and the React detail page should surface which\n    PII entities are anonymized. This is a UI-rendering gate — the\n    anonymization always happens when configured; this flag controls\n    whether the detail view renders the \"PII Anonymization\" section.\n    Defaults to ``False``.\n:type pii_anonymization: bool",
+        "properties": {
+          "alert_on_fail": {
+            "default": false,
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "chaining": {
+            "default": false,
+            "title": "Chaining",
+            "type": "boolean"
+          },
+          "pii_anonymization": {
+            "default": false,
+            "title": "Pii Anonymization",
+            "type": "boolean"
+          },
+          "scheduling": {
+            "default": false,
+            "title": "Scheduling",
+            "type": "boolean"
+          },
+          "stats": {
+            "default": false,
+            "title": "Stats",
+            "type": "boolean"
+          }
+        },
+        "title": "Capabilities",
+        "type": "object"
+      },
+      "framework__CardinalityRule": {
+        "additionalProperties": false,
+        "description": "Express a cardinality constraint over a list of fields.\n\nWhen ``when`` matches (or unconditionally if ``when`` is ``None``), the\ncount of present fields in ``fields`` must lie in ``[min, max]`` with\n``None`` bounds treated as unbounded.\n\n:param when: The predicate that gates the rule. ``None`` means\n    unconditional.\n:type when: Predicate | None\n:param fields: The non-empty list of target field names.\n:type fields: list[str]\n:param min: Optional lower bound on the count of present fields.\n    Defaults to ``None``.\n:type min: int | None\n:param max: Optional upper bound on the count of present fields.\n    Defaults to ``None``.\n:type max: int | None\n:param message: Optional failure message. Defaults to ``None``.\n:type message: str | None",
+        "properties": {
+          "fields": {
+            "items": {
+              "type": "string"
+            },
+            "title": "Fields",
+            "type": "array"
+          },
+          "max": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Max"
+          },
+          "message": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Message"
+          },
+          "min": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Min"
+          },
+          "when": {
+            "anyOf": [
+              {
+                "additionalProperties": true,
+                "description": "Predicate wire shape — a single-key object whose key is the operator name (equals, truthy, all, any, xor, not, etc.). See the plan for the full operator catalogue.",
+                "type": "object"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "When"
+          }
+        },
+        "required": ["fields"],
+        "title": "CardinalityRule",
+        "type": "object"
+      },
+      "framework__ChainedPredecessor": {
+        "additionalProperties": false,
+        "description": "Represent a chained predecessor task that runs before the parent.\n\nThe cascade module (:mod:`app.sep.apps.framework.cascade`) consumes\nthis spec when POSTing, PUTting, or DELETEing a plugin's tasks: each\npredecessor is created with ``data[\"parent\"]`` linked to the parent's\nname (when ``parent_link`` is true) and named\n``f\"{parent_name}{name_suffix}\"``. Create persists task records only;\nwhen the user starts the chain, the consuming plugin fires\n``POST /execute/{first_predecessor_name}`` using\n:func:`build_predecessor_chain_execute_body` for ``chain_task_names``\n(remaining predecessors then parent) and ``chain_on_failure`` derived\nfrom ``on_failure`` (``\"halt\"`` maps to ``False``, ``\"continue\"`` maps\nto ``True``).\n\n:param name_suffix: String appended to the parent's ``name`` to form\n    the predecessor's name (for example ``\"-pre-checks\"``).\n:type name_suffix: NonEmptyStr\n:param on_failure: Chain semantics when the predecessor terminates\n    non-successfully. ``\"halt\"`` (default) stops the chain;\n    ``\"continue\"`` lets the chain continue regardless. Translates to\n    the boolean ``chain_on_failure`` flag at execute time.\n:type on_failure: Literal[\"halt\", \"continue\"]\n:param parent_link: When true, set ``data[\"parent\"]`` on the\n    predecessor payload to the parent's ``name``. Defaults to ``True``.\n:type parent_link: bool",
+        "properties": {
+          "name_suffix": {
+            "minLength": 1,
+            "title": "Name Suffix",
+            "type": "string"
+          },
+          "on_failure": {
+            "default": "halt",
+            "enum": ["halt", "continue"],
+            "title": "On Failure",
+            "type": "string"
+          },
+          "parent_link": {
+            "default": true,
+            "title": "Parent Link",
+            "type": "boolean"
+          }
+        },
+        "required": ["name_suffix"],
+        "title": "ChainedPredecessor",
+        "type": "object"
+      },
+      "framework__Choice": {
+        "additionalProperties": false,
+        "description": "Represent one option in a choice or multi-choice field.\n\n:param label: The human-readable label displayed for the choice.\n:type label: NonEmptyStr\n:param value: The value submitted when the choice is selected.\n:type value: NonEmptyStr\n:param disabled: Whether the option is rendered non-selectable. Optional,\n    defaulting to ``None`` (selectable). Typed ``bool | None`` so the\n    discovery endpoint's ``exclude_none`` posture drops it from the wire\n    until a plugin opts in, keeping the addition byte-compatible with\n    existing schemas. UI hint only; enforcing rejection of a disabled\n    value is the consuming app's responsibility.\n:type disabled: bool | None\n:param disabled_reason: Optional explanatory text surfaced (for example,\n    in a tooltip) when the option is disabled. Defaults to ``None`` and\n    may only be set when ``disabled`` is ``True``.\n:type disabled_reason: NonEmptyStr | None",
+        "properties": {
+          "disabled": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Disabled"
+          },
+          "disabled_reason": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Disabled Reason"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "value": {
+            "minLength": 1,
+            "title": "Value",
+            "type": "string"
+          }
+        },
+        "required": ["label", "value"],
+        "title": "Choice",
+        "type": "object"
+      },
+      "framework__ChoiceField": {
+        "additionalProperties": false,
+        "description": "Represent a single-select dropdown field.\n\n:param field_type: The discriminator literal; always ``\"choice\"`` for this\n    class. Serialised as the JSON key ``\"type\"``.\n:type field_type: Literal[\"choice\"]\n:param choices: The non-empty list of options the user can choose from.\n:type choices: list[Choice]",
+        "properties": {
+          "choices": {
+            "items": {
+              "$ref": "#/components/schemas/framework__Choice"
+            },
+            "minItems": 1,
+            "title": "Choices",
+            "type": "array"
+          },
+          "default": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "required": {
+            "default": false,
+            "title": "Required",
+            "type": "boolean"
+          },
+          "requires": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Requires"
+          },
+          "type": {
+            "const": "choice",
+            "default": "choice",
+            "enum": ["choice"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label", "choices"],
+        "title": "ChoiceField",
+        "type": "object"
+      },
+      "framework__Column": {
+        "additionalProperties": false,
+        "description": "Represent one column in a plugin list view.\n\n:param key: The task attribute path this column displays (for example,\n    ``\"status\"`` or ``\"target.service\"``).\n:type key: NonEmptyStr\n:param label: The human-readable column header.\n:type label: NonEmptyStr\n:param sortable: Whether the column can be used to sort the list.\n    Defaults to ``False``.\n:type sortable: bool\n:param format: Optional formatting hint applied when rendering the\n    column values. Defaults to ``None``.\n:type format: ColumnFormat | None",
+        "properties": {
+          "format": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/framework__ColumnFormat"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "key": {
+            "minLength": 1,
+            "title": "Key",
+            "type": "string"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "sortable": {
+            "default": false,
+            "title": "Sortable",
+            "type": "boolean"
+          }
+        },
+        "required": ["key", "label"],
+        "title": "Column",
+        "type": "object"
+      },
+      "framework__ColumnFormat": {
+        "description": "Enumerate the supported list-view column formatting hints.\n\n:cvar TEXT: Render the column value as plain text.\n:vartype TEXT: str\n:cvar CHIP: Render the column value as a Material UI chip.\n:vartype CHIP: str\n:cvar STATUS: Render the column value as a colour-coded status badge.\n:vartype STATUS: str\n:cvar DATE: Render the column value as an absolute date.\n:vartype DATE: str\n:cvar RELATIVE: Render the column value as a relative time (for example,\n    \"2 hours ago\").\n:vartype RELATIVE: str\n:cvar CODE: Render the column value in a monospaced code font.\n:vartype CODE: str\n:cvar ACTIONS: Row actions (for example delete); not bound to row data.\n    Use with a synthetic column key such as ``_actions``.\n:vartype ACTIONS: str\n:cvar SCHEDULE: Render a generic schedule cell for the row's task. The\n    frontend joins the row to its periodic task by name and shows the next\n    run (relative, with the absolute timestamp on hover) plus a periodicity\n    popover, or a muted \"Not scheduled\" chip when the task has no schedule.\n    Not bound to the column's own cell value.\n:vartype SCHEDULE: str",
+        "enum": [
+          "text",
+          "chip",
+          "status",
+          "date",
+          "relative",
+          "code",
+          "actions",
+          "schedule"
+        ],
+        "title": "ColumnFormat",
+        "type": "string"
+      },
+      "framework__ConnectivityWarning": {
+        "description": "Represent a connectivity-check failure on a JSON API task-creation response.\n\n:param target: The Nomad node the task targets.\n:param service_type: The lowercase database service type (e.g. ``mysql``).\n:param message: A human-readable description of the failure.\n:param task_history_id: The run-script task-history id whose log explains\n    the failure, or ``None`` when no task was created (e.g. the Tasks API\n    was unreachable). Optional for backward compatibility with existing\n    plugin consumers.",
+        "properties": {
+          "message": {
+            "title": "Message",
+            "type": "string"
+          },
+          "service_type": {
+            "title": "Service Type",
+            "type": "string"
+          },
+          "target": {
+            "title": "Target",
+            "type": "string"
+          },
+          "task_history_id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Task History Id"
+          }
+        },
+        "required": ["target", "service_type", "message"],
+        "title": "ConnectivityWarning",
+        "type": "object"
+      },
+      "framework__DateTimeField": {
+        "additionalProperties": false,
+        "description": "Represent a datetime picker field.\n\n:param field_type: The discriminator literal; always ``\"datetime\"`` for\n    this class. Serialised as the JSON key ``\"type\"``.\n:type field_type: Literal[\"datetime\"]",
+        "properties": {
+          "default": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "required": {
+            "default": false,
+            "title": "Required",
+            "type": "boolean"
+          },
+          "requires": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Requires"
+          },
+          "type": {
+            "const": "datetime",
+            "default": "datetime",
+            "enum": ["datetime"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label"],
+        "title": "DateTimeField",
+        "type": "object"
+      },
+      "framework__DerivedTask": {
+        "additionalProperties": false,
+        "description": "Represent a sibling task derived from a parent during cascade operations.\n\nThe cascade module (:mod:`app.sep.apps.framework.cascade`) consumes this\nspec when POSTing, PUTting, or DELETEing a plugin's tasks: the parent task\nis created first, then for each ``DerivedTask`` the parent payload is\ndeep-copied, ``name`` is suffixed with ``name_suffix``, ``arg_substitutions``\nare applied to ``data[\"meta\"][\"args\"]`` as literal :meth:`str.replace`\ncalls in dict insertion order, ``payload_substitutions`` are applied to\n``data[\"payload\"]`` as literal :meth:`str.replace` calls in dict insertion\norder, ``data_overrides`` entries are assigned directly onto ``data`` as\nliteral key/value pairs in iteration order, and ``data[\"parent\"]`` is set\nto the parent's name when ``parent_link`` is true.\n\n:param name_suffix: String appended to the parent's ``name`` to form the\n    derived task's name (for example ``\"-dry-run\"``).\n:type name_suffix: NonEmptyStr\n:param arg_substitutions: Optional ordered mapping of literal substring\n    replacements applied to ``data[\"meta\"][\"args\"]``. Each ``(old, new)``\n    pair is applied once via :meth:`str.replace` in dict insertion order.\n    Defaults to ``None`` (no substitutions).\n:type arg_substitutions: dict[str, str] | None\n:param payload_substitutions: Optional ordered mapping of literal substring\n    replacements applied to ``data[\"payload\"]``. Each ``(old, new)``\n    pair is applied once via :meth:`str.replace` in dict insertion order.\n    Defaults to ``None`` (no substitutions).\n:type payload_substitutions: dict[str, str] | None\n:param data_overrides: Optional mapping of literal key→value pairs\n    assigned directly onto ``data`` after substitutions run. Each\n    pair becomes ``data[key] = value`` in iteration order. Use this\n    for plugin-specific identity fields (e.g. ``{\"backup_type\":\n    \"pbm_logical\"}``) that the framework should not name itself.\n    Defaults to ``None``.\n:type data_overrides: dict[str, Any] | None\n:param parent_link: When true, set ``data[\"parent\"]`` on the derived\n    payload to the parent's ``name``. Defaults to ``True``.\n:type parent_link: bool",
+        "properties": {
+          "arg_substitutions": {
+            "anyOf": [
+              {
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "type": "object"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Arg Substitutions"
+          },
+          "data_overrides": {
+            "anyOf": [
+              {
+                "type": "object"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Data Overrides"
+          },
+          "name_suffix": {
+            "minLength": 1,
+            "title": "Name Suffix",
+            "type": "string"
+          },
+          "parent_link": {
+            "default": true,
+            "title": "Parent Link",
+            "type": "boolean"
+          },
+          "payload_substitutions": {
+            "anyOf": [
+              {
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "type": "object"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Payload Substitutions"
+          }
+        },
+        "required": ["name_suffix"],
+        "title": "DerivedTask",
+        "type": "object"
+      },
+      "framework__DetailField": {
+        "additionalProperties": false,
+        "description": "Declare one labelled field rendered inside a :class:`DetailSection`.\n\n:param path: Dotted path into the task record (for example\n    ``\"data.meta.command\"``). Each segment must be a Python identifier,\n    optionally followed by one or more ``[N]`` array indices.\n:type path: DetailPath\n:param label: Human-readable label rendered alongside the resolved value.\n:type label: NonEmptyStr\n:param highlight: Optional syntax-highlighter hint. Defaults to ``None``.\n:type highlight: DetailHighlightLanguage | None",
+        "properties": {
+          "highlight": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/framework__DetailHighlightLanguage"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "path": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_][A-Za-z0-9_]*(?:\\[\\d+\\])*(?:\\.[A-Za-z_][A-Za-z0-9_]*(?:\\[\\d+\\])*)*$",
+            "title": "Path",
+            "type": "string"
+          }
+        },
+        "required": ["path", "label"],
+        "title": "DetailField",
+        "type": "object"
+      },
+      "framework__DetailHighlightLanguage": {
+        "description": "Enumerate supported syntax highlighters for detail fields.",
+        "enum": ["sql", "json", "bash", "yaml"],
+        "title": "DetailHighlightLanguage",
+        "type": "string"
+      },
+      "framework__DetailSection": {
+        "additionalProperties": false,
+        "description": "Declare one titled section inside a :class:`DetailView`.\n\n:param title: Heading rendered above the section's fields.\n:type title: NonEmptyStr\n:param fields: Ordered list of fields rendered inside the section. An\n    empty list is valid; the frontend hides the section when every\n    field resolves to an empty value.\n:type fields: list[DetailField]",
+        "properties": {
+          "fields": {
+            "items": {
+              "$ref": "#/components/schemas/framework__DetailField"
+            },
+            "title": "Fields",
+            "type": "array"
+          },
+          "title": {
+            "minLength": 1,
+            "title": "Title",
+            "type": "string"
+          }
+        },
+        "required": ["title", "fields"],
+        "title": "DetailSection",
+        "type": "object"
+      },
+      "framework__DetailView": {
+        "additionalProperties": false,
+        "description": "Declare the per-section detail-page layout for a task-style plugin.\n\nMirrors the role of :attr:`AppSchema.list_view` for the list table:\nthe React framework reads ``detail_view`` to render the task detail\npage's section cards instead of inferring structure from the runtime\n``task.data`` shape.\n\n:param sections: Ordered list of sections rendered on the detail page.\n    An empty list is valid; the frontend renders no section cards.\n    Section titles must be unique within a view so the React key can\n    be derived from the title without positional disambiguation.\n:type sections: list[DetailSection]",
+        "properties": {
+          "sections": {
+            "items": {
+              "$ref": "#/components/schemas/framework__DetailSection"
+            },
+            "title": "Sections",
+            "type": "array"
+          }
+        },
+        "required": ["sections"],
+        "title": "DetailView",
+        "type": "object"
+      },
+      "framework__FailRule": {
+        "additionalProperties": false,
+        "description": "Express a predicate-only invariant: rule fails iff predicate matches.\n\n:param fail_when: The predicate whose match triggers a failure.\n:type fail_when: Predicate\n:param error_fields: The field names the FE renderer should attach the\n    error to (informational hint; the runtime evaluator ignores this\n    list). May be empty when no field is logically responsible.\n:type error_fields: list[str]\n:param message: Optional failure message. Defaults to ``None``.\n:type message: str | None",
+        "properties": {
+          "error_fields": {
+            "items": {
+              "type": "string"
+            },
+            "title": "Error Fields",
+            "type": "array"
+          },
+          "fail_when": {
+            "additionalProperties": true,
+            "description": "Predicate wire shape — a single-key object whose key is the operator name (equals, truthy, all, any, xor, not, etc.). See the plan for the full operator catalogue.",
+            "title": "Fail When",
+            "type": "object"
+          },
+          "message": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Message"
+          }
+        },
+        "required": ["fail_when", "error_fields"],
+        "title": "FailRule",
+        "type": "object"
+      },
+      "framework__FieldGate": {
+        "additionalProperties": false,
+        "description": "Express a binary self-cardinality gate at :class:`BaseField` scope.\n\nUsed by :attr:`BaseField.requires` and :attr:`BaseField.forbidden`. The\ntarget field is the field carrying the rule (implicit self).\n\n:param when: The predicate that gates the rule.\n:type when: Predicate\n:param message: Optional failure message surfaced when the rule fires.\n    Defaults to ``None``.\n:type message: str | None",
+        "properties": {
+          "message": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Message"
+          },
+          "when": {
+            "additionalProperties": true,
+            "description": "Predicate wire shape — a single-key object whose key is the operator name (equals, truthy, all, any, xor, not, etc.). See the plan for the full operator catalogue.",
+            "title": "When",
+            "type": "object"
+          }
+        },
+        "required": ["when"],
+        "title": "FieldGate",
+        "type": "object"
+      },
+      "framework__FileField": {
+        "additionalProperties": false,
+        "description": "Represent a file upload field.\n\n:param field_type: The discriminator literal; always ``\"file\"`` for this\n    class. Serialised as the JSON key ``\"type\"``.\n:type field_type: Literal[\"file\"]\n:param accept: Optional list of accepted file types, using the same\n    syntax as the HTML ``accept`` attribute (for example, ``[\".sql\",\n    \".csv\"]`` or ``[\"image/png\"]``). Defaults to ``None``.\n:type accept: list[str] | None",
+        "properties": {
+          "accept": {
+            "anyOf": [
+              {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Accept"
+          },
+          "default": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "required": {
+            "default": false,
+            "title": "Required",
+            "type": "boolean"
+          },
+          "requires": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Requires"
+          },
+          "type": {
+            "const": "file",
+            "default": "file",
+            "enum": ["file"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label"],
+        "title": "FileField",
+        "type": "object"
+      },
+      "framework__FloatField": {
+        "additionalProperties": false,
+        "description": "Represent a float numeric input field.\n\n:param field_type: The discriminator literal; always ``\"float\"`` for this\n    class. Serialised as the JSON key ``\"type\"``.\n:type field_type: Literal[\"float\"]\n:param ge: Optional lower bound (inclusive) for accepted values. Defaults\n    to ``None``.\n:type ge: float | None\n:param le: Optional upper bound (inclusive) for accepted values. Defaults\n    to ``None``.\n:type le: float | None\n:param step: Optional step size for the input control. Defaults to\n    ``None``.\n:type step: float | None",
+        "properties": {
+          "default": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "ge": {
+            "anyOf": [
+              {
+                "type": "number"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Ge"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "le": {
+            "anyOf": [
+              {
+                "type": "number"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Le"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "required": {
+            "default": false,
+            "title": "Required",
+            "type": "boolean"
+          },
+          "requires": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Requires"
+          },
+          "step": {
+            "anyOf": [
+              {
+                "type": "number"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Step"
+          },
+          "type": {
+            "const": "float",
+            "default": "float",
+            "enum": ["float"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label"],
+        "title": "FloatField",
+        "type": "object"
+      },
+      "framework__FormSection": {
+        "additionalProperties": false,
+        "description": "Represent a labelled group of related fields rendered as one fieldset.\n\n:param title: The section heading displayed above the grouped fields.\n:type title: NonEmptyStr\n:param description: Optional helper text rendered beneath the section\n    heading. Defaults to ``None``.\n:type description: NonEmptyStr | None\n:param fields: The list of fields belonging to this section. May include\n    :class:`OneOfGroup` containers alongside leaf fields.\n:type fields: list[AnyField]\n:param cardinality_rules: Optional cross-field cardinality constraints\n    scoped to the fields in this section. Defaults to ``None``.\n:type cardinality_rules: list[CardinalityRule] | None\n:param fail_when: Optional predicate-only invariants scoped to this\n    section. Defaults to ``None``.\n:type fail_when: list[FailRule] | None\n:param collapsible: Whether the renderer may collapse this section behind\n    a toggle. Defaults to ``False``.\n:type collapsible: bool\n:param collapsed_by_default: Whether a collapsible section should start\n    collapsed. Ignored when ``collapsible`` is ``False``. Defaults to\n    ``False``.\n:type collapsed_by_default: bool\n:param render_after_submit: Whether this section should render after the\n    submit button instead of before it. Defaults to ``False``.\n:type render_after_submit: bool\n:param forbidden: Optional gates that hide the entire section when any\n    of them fires. The schema-driven React renderer skips the section\n    and unregisters every child field from the form so stale values\n    do not ship in the submission payload. Gates may reference any\n    field declared in the plugin schema (including fields in other\n    sections). Defaults to ``None`` — sections render unconditionally.\n    Backend ``fail_when`` and conditional-rule validation on hidden\n    sections still applies: hidden-section children arrive in the\n    submitted payload as **absent** (not zeroed or defaulted), so\n    ``truthy``/``present`` predicates silently pass while\n    ``falsy``/``absent`` predicates see the children as missing.\n    Author ``fail_when`` rules accordingly.\n:type forbidden: list[FieldGate] | None",
+        "properties": {
+          "cardinality_rules": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__CardinalityRule"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Cardinality Rules"
+          },
+          "collapsed_by_default": {
+            "default": false,
+            "title": "Collapsed By Default",
+            "type": "boolean"
+          },
+          "collapsible": {
+            "default": false,
+            "title": "Collapsible",
+            "type": "boolean"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "fail_when": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FailRule"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Fail When"
+          },
+          "fields": {
+            "items": {
+              "oneOf": [
+                {
+                  "$ref": "#/components/schemas/framework__BoolField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__ChoiceField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__DateTimeField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__FileField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__FloatField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__HostField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__IntegerField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__MultiChoiceField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__MultiHostField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__MultiSchemaField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__MultiServiceField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__MultiTableField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__RemoteChoiceField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__SchemaField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__ScriptPreviewField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__ServiceField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__StringField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__TableField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__TextAreaField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__YamlField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__OneOfGroup"
+                }
+              ]
+            },
+            "title": "Fields",
+            "type": "array"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "render_after_submit": {
+            "default": false,
+            "title": "Render After Submit",
+            "type": "boolean"
+          },
+          "title": {
+            "minLength": 1,
+            "title": "Title",
+            "type": "string"
+          }
+        },
+        "required": ["title", "fields"],
+        "title": "FormSection",
+        "type": "object"
+      },
+      "framework__HostField": {
+        "additionalProperties": false,
+        "description": "Represent an executor-target (Nomad / Celery) selector field.\n\nThe React renderer loads options from ``GET /api/sep/hosts/`` (an SEP\nproxy endpoint that internally calls Tasks ``/hosts/`` and merges\nInventory display names server-side). When ``depends_on`` is set (typically\na ``ServiceField``), the renderer may auto-select an executor from the\nupstream service; when omitted every available executor is listed and no\ncascade runs.\n\n:param field_type: The discriminator literal; always ``\"host\"`` for this\n    class. Serialised as the JSON key ``\"type\"``.\n:type field_type: Literal[\"host\"]\n:param depends_on: Optional name of the field whose value drives the\n    default executor selection. ``None`` (the default) omits the key from\n    the wire so plugins that do not opt in stay byte-identical.\n:param allow_custom: When ``True``, the selector also accepts a free-typed\n    value alongside the inventory options. ``None`` (the default) omits the\n    key from the wire so plugins that do not opt in stay byte-identical.",
+        "properties": {
+          "allow_custom": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Allow Custom"
+          },
+          "default": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "depends_on": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Depends On"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "required": {
+            "default": false,
+            "title": "Required",
+            "type": "boolean"
+          },
+          "requires": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Requires"
+          },
+          "type": {
+            "const": "host",
+            "default": "host",
+            "enum": ["host"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label"],
+        "title": "HostField",
+        "type": "object"
+      },
+      "framework__IntegerField": {
+        "additionalProperties": false,
+        "description": "Represent an integer numeric input field.\n\n:param field_type: The discriminator literal; always ``\"integer\"`` for this\n    class. Serialised as the JSON key ``\"type\"``.\n:type field_type: Literal[\"integer\"]\n:param ge: Optional lower bound (inclusive) for accepted values. Defaults\n    to ``None``.\n:type ge: int | None\n:param le: Optional upper bound (inclusive) for accepted values. Defaults\n    to ``None``.\n:type le: int | None\n:param step: Optional step size for the input control. Defaults to\n    ``None``.\n:type step: int | None",
+        "properties": {
+          "default": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "ge": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Ge"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "le": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Le"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "required": {
+            "default": false,
+            "title": "Required",
+            "type": "boolean"
+          },
+          "requires": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Requires"
+          },
+          "step": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Step"
+          },
+          "type": {
+            "const": "integer",
+            "default": "integer",
+            "enum": ["integer"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label"],
+        "title": "IntegerField",
+        "type": "object"
+      },
+      "framework__ListView": {
+        "additionalProperties": false,
+        "description": "Represent the list-view configuration for a plugin.\n\n:param columns: The ordered list of columns displayed in the list view.\n:type columns: list[Column]\n:param default_sort: Optional key of the column to sort by on first\n    render. Prefix with ``-`` for descending order (for example,\n    ``\"-lastRun\"``). The unprefixed key must match one of the declared\n    column keys. Defaults to ``None``.\n:type default_sort: NonEmptyStr | None\n:param overview_hidden_fields: Additional task-level keys to suppress\n    from the auto-rendered \"extras\" loop on the plugin detail Overview\n    tab. The framework always hides a baseline set of internal fields\n    (``id``, ``backend``, ``protected``, ``data``, ``updated_at``,\n    ``last_updated_by``, ``connectivity_warning``); any keys listed here\n    are merged with that baseline. Defaults to ``[]``.\n:type overview_hidden_fields: list[str]",
+        "properties": {
+          "columns": {
+            "items": {
+              "$ref": "#/components/schemas/framework__Column"
+            },
+            "title": "Columns",
+            "type": "array"
+          },
+          "default_sort": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default Sort"
+          },
+          "overview_hidden_fields": {
+            "items": {
+              "minLength": 1,
+              "type": "string"
+            },
+            "title": "Overview Hidden Fields",
+            "type": "array"
+          }
+        },
+        "required": ["columns"],
+        "title": "ListView",
+        "type": "object"
+      },
+      "framework__MultiChoiceField": {
+        "additionalProperties": false,
+        "description": "Represent a multi-select dropdown field.\n\n:param field_type: The discriminator literal; always ``\"multi_choice\"``\n    for this class. Serialised as the JSON key ``\"type\"``.\n:type field_type: Literal[\"multi_choice\"]\n:param choices: The non-empty list of options the user can choose from.\n:type choices: list[Choice]",
+        "properties": {
+          "choices": {
+            "items": {
+              "$ref": "#/components/schemas/framework__Choice"
+            },
+            "minItems": 1,
+            "title": "Choices",
+            "type": "array"
+          },
+          "default": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "required": {
+            "default": false,
+            "title": "Required",
+            "type": "boolean"
+          },
+          "requires": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Requires"
+          },
+          "type": {
+            "const": "multi_choice",
+            "default": "multi_choice",
+            "enum": ["multi_choice"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label", "choices"],
+        "title": "MultiChoiceField",
+        "type": "object"
+      },
+      "framework__MultiHostField": {
+        "additionalProperties": false,
+        "description": "Represent a multi-value executor-target selector field.\n\nThe multi-value counterpart of :class:`HostField`: the renderer commits a\nlist of executor targets instead of a single one. Derived from a\n``HostRef(multiple=True)`` marker on a ``list[...]`` / ``set[...]`` field.\n\nCascade auto-select is single-host only (:class:`HostField`). ``depends_on``\nmay still be emitted when ``Ui(depends_on=...)`` is set so derivation stays\nuniform, but the multi-host renderer does not honour it today.\n\n:param field_type: The discriminator literal; always ``\"multi_host\"`` for\n    this class. Serialised as the JSON key ``\"type\"``.\n:param depends_on: Optional upstream field name mirrored from\n    ``Ui(depends_on=...)``. Emitted for wire uniformity with\n    :class:`HostField`; the current multi-host renderer ignores it (no\n    cascade). ``None`` (the default) omits the key from the wire.\n:param allow_custom: When ``True``, the selector also accepts free-typed\n    values alongside the inventory options. ``None`` (the default) omits the\n    key from the wire so plugins that do not opt in stay byte-identical.",
+        "properties": {
+          "allow_custom": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Allow Custom"
+          },
+          "default": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "depends_on": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Depends On"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "required": {
+            "default": false,
+            "title": "Required",
+            "type": "boolean"
+          },
+          "requires": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Requires"
+          },
+          "type": {
+            "const": "multi_host",
+            "default": "multi_host",
+            "enum": ["multi_host"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label"],
+        "title": "MultiHostField",
+        "type": "object"
+      },
+      "framework__MultiSchemaField": {
+        "additionalProperties": false,
+        "description": "Represent a multi-value inventory database-schema selector field.\n\nThe multi-value counterpart of :class:`SchemaField`: the renderer commits a\nlist of schemas instead of a single one. Derived from a\n``SchemaRef(multiple=True)`` marker on a ``list[...]`` / ``set[...]`` field.\n\n:param field_type: The discriminator literal; always ``\"multi_schema\"`` for\n    this class. Serialised as the JSON key ``\"type\"``.\n:param depends_on: The name of the field whose value drives the list of\n    available schemas.\n:param allow_custom: Opt-in flag for free-text (free-solo) entry alongside\n    the cascaded options. ``None`` (the default) omits the key from the wire\n    so plugins that do not opt in stay byte-identical.",
+        "properties": {
+          "allow_custom": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Allow Custom"
+          },
+          "default": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "depends_on": {
+            "minLength": 1,
+            "title": "Depends On",
+            "type": "string"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "required": {
+            "default": false,
+            "title": "Required",
+            "type": "boolean"
+          },
+          "requires": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Requires"
+          },
+          "type": {
+            "const": "multi_schema",
+            "default": "multi_schema",
+            "enum": ["multi_schema"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label", "depends_on"],
+        "title": "MultiSchemaField",
+        "type": "object"
+      },
+      "framework__MultiServiceField": {
+        "additionalProperties": false,
+        "description": "Represent a multi-value inventory service selector field.\n\nThe multi-value counterpart of :class:`ServiceField`: the renderer commits a\nlist of services instead of a single one. Derived from a\n``ServiceRef(multiple=True)`` marker on a ``list[...]`` / ``set[...]`` field.\n\n:param field_type: The discriminator literal; always ``\"multi_service\"`` for\n    this class. Serialised as the JSON key ``\"type\"``.\n:param service_types: The list of service types the selector should offer\n    (for example, ``[ServiceTypeEnum.MYSQL]``).\n:param allow_custom: Opt-in flag for free-text (free-solo) entry alongside\n    the inventory options. ``None`` (the default) omits the key from the wire\n    so plugins that do not opt in stay byte-identical.",
+        "properties": {
+          "allow_custom": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Allow Custom"
+          },
+          "default": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "required": {
+            "default": false,
+            "title": "Required",
+            "type": "boolean"
+          },
+          "requires": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Requires"
+          },
+          "service_types": {
+            "items": {
+              "$ref": "#/components/schemas/ServiceTypeEnum"
+            },
+            "title": "Service Types",
+            "type": "array"
+          },
+          "type": {
+            "const": "multi_service",
+            "default": "multi_service",
+            "enum": ["multi_service"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label", "service_types"],
+        "title": "MultiServiceField",
+        "type": "object"
+      },
+      "framework__MultiTableField": {
+        "additionalProperties": false,
+        "description": "Represent a multi-value inventory table selector field.\n\nThe multi-value counterpart of :class:`TableField`: the renderer commits a\nlist of tables instead of a single one. Derived from a\n``TableRef(multiple=True)`` marker on a ``list[...]`` / ``set[...]`` field.\n\n:param field_type: The discriminator literal; always ``\"multi_table\"`` for\n    this class. Serialised as the JSON key ``\"type\"``.\n:param depends_on: The name of the field whose value drives the list of\n    available tables.\n:param allow_custom: Opt-in flag for free-text (free-solo) entry alongside\n    the cascaded options. ``None`` (the default) omits the key from the wire\n    so plugins that do not opt in stay byte-identical.",
+        "properties": {
+          "allow_custom": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Allow Custom"
+          },
+          "default": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "depends_on": {
+            "minLength": 1,
+            "title": "Depends On",
+            "type": "string"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "required": {
+            "default": false,
+            "title": "Required",
+            "type": "boolean"
+          },
+          "requires": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Requires"
+          },
+          "type": {
+            "const": "multi_table",
+            "default": "multi_table",
+            "enum": ["multi_table"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label", "depends_on"],
+        "title": "MultiTableField",
+        "type": "object"
+      },
+      "framework__MysqlBackupsCreateResponse": {
+        "properties": {
+          "alert_on_fail": {
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "anonymized_entities": {
+            "description": "Return sorted PII entity names decoded from ``anonymize_mask``.",
+            "items": {
+              "type": "string"
+            },
+            "readOnly": true,
+            "title": "Anonymized Entities",
+            "type": "array"
+          },
+          "backend": {
+            "$ref": "#/components/schemas/TaskBackendEnum"
+          },
+          "backup_type": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/mysql_backups__BackupType"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "connectivity_warning": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/framework__ConnectivityWarning"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "created_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created At"
+          },
+          "created_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created By"
+          },
+          "data": {
+            "title": "Data",
+            "type": "object"
+          },
+          "hostname": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Hostname"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "last_executed_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Executed At"
+          },
+          "last_updated_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Updated By"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "protected": {
+            "title": "Protected",
+            "type": "boolean"
+          },
+          "status": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": [
+          "name",
+          "backend",
+          "data",
+          "protected",
+          "alert_on_fail",
+          "anonymized_entities"
+        ],
+        "title": "MysqlBackupsCreateResponse",
+        "type": "object"
+      },
+      "framework__OneOfBranch": {
+        "additionalProperties": false,
+        "description": "Represent one mutually-exclusive branch inside a :class:`OneOfGroup`.\n\n:param value: The discriminator value that selects this branch.\n:param label: The human-readable label for the segmented-control option.\n:param fields: The leaf fields revealed when this branch is active.",
+        "properties": {
+          "fields": {
+            "items": {
+              "discriminator": {
+                "mapping": {
+                  "bool": "#/components/schemas/framework__BoolField",
+                  "choice": "#/components/schemas/framework__ChoiceField",
+                  "datetime": "#/components/schemas/framework__DateTimeField",
+                  "file": "#/components/schemas/framework__FileField",
+                  "float": "#/components/schemas/framework__FloatField",
+                  "host": "#/components/schemas/framework__HostField",
+                  "integer": "#/components/schemas/framework__IntegerField",
+                  "multi_choice": "#/components/schemas/framework__MultiChoiceField",
+                  "multi_host": "#/components/schemas/framework__MultiHostField",
+                  "multi_schema": "#/components/schemas/framework__MultiSchemaField",
+                  "multi_service": "#/components/schemas/framework__MultiServiceField",
+                  "multi_table": "#/components/schemas/framework__MultiTableField",
+                  "remote_choice": "#/components/schemas/framework__RemoteChoiceField",
+                  "schema": "#/components/schemas/framework__SchemaField",
+                  "script_preview": "#/components/schemas/framework__ScriptPreviewField",
+                  "service": "#/components/schemas/framework__ServiceField",
+                  "string": "#/components/schemas/framework__StringField",
+                  "table": "#/components/schemas/framework__TableField",
+                  "textarea": "#/components/schemas/framework__TextAreaField",
+                  "yaml": "#/components/schemas/framework__YamlField"
+                },
+                "propertyName": "type"
+              },
+              "oneOf": [
+                {
+                  "$ref": "#/components/schemas/framework__BoolField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__ChoiceField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__DateTimeField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__FileField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__FloatField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__HostField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__IntegerField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__MultiChoiceField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__MultiHostField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__MultiSchemaField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__MultiServiceField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__MultiTableField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__RemoteChoiceField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__SchemaField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__ScriptPreviewField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__ServiceField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__StringField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__TableField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__TextAreaField"
+                },
+                {
+                  "$ref": "#/components/schemas/framework__YamlField"
+                }
+              ]
+            },
+            "minItems": 1,
+            "title": "Fields",
+            "type": "array"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "value": {
+            "minLength": 1,
+            "title": "Value",
+            "type": "string"
+          }
+        },
+        "required": ["value", "label", "fields"],
+        "title": "OneOfBranch",
+        "type": "object"
+      },
+      "framework__OneOfGroup": {
+        "additionalProperties": false,
+        "description": "Represent a labelled either/or field group with a segmented mode switch.\n\nThe React renderer binds :attr:`discriminator` to a ``ToggleButtonGroup``,\nshows :attr:`description` as helper text, and renders only the active\nbranch's :attr:`~OneOfBranch.fields`. Inactive-branch leaves are forbidden\nat validation time via rules synthesised from the group's branch contract.\n\n:param field_type: The discriminator literal; always ``\"one_of\"`` for this\n    class. Serialised as the JSON key ``\"type\"``.\n:param name: Stable group identifier used as the React list key. Not a\n    separate form value — :attr:`discriminator` names the mode field.\n:param label: The human-readable group heading above the segmented control.\n:param description: Optional helper text rendered beneath the group label.\n    Defaults to ``None``.\n:param discriminator: Dotted path to the mode field (for example,\n    ``\"source.mode\"``) whose value selects the active branch.\n:param default: Optional default branch :attr:`~OneOfBranch.value`. Must\n    match one of the declared branches when set. Defaults to ``None``.\n:param branches: Two or more named branches, each owning its own field list.",
+        "properties": {
+          "branches": {
+            "items": {
+              "$ref": "#/components/schemas/framework__OneOfBranch"
+            },
+            "minItems": 2,
+            "title": "Branches",
+            "type": "array"
+          },
+          "default": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "discriminator": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Discriminator",
+            "type": "string"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "type": {
+            "const": "one_of",
+            "default": "one_of",
+            "enum": ["one_of"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label", "discriminator", "branches"],
+        "title": "OneOfGroup",
+        "type": "object"
+      },
+      "framework__PaginatedResponse_BaseTaskResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/framework__BaseTaskResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[BaseTaskResponse]",
+        "type": "object"
+      },
+      "framework__RelatedApp": {
+        "additionalProperties": false,
+        "description": "Declare a separately registered app surfaced as a sibling tab in the UI.\n\nConsumed by the React ``SchemaDrivenPlugin`` shell to mount a nested\nschema-driven flow for the related registry entry (for example\n``mysql_backups/restore``) under ``{route_base}/{route_segment}`` without\nre-merging the child app's API router into the parent.\n\n:param app_key: The scoped registry key of the related app (for example\n    ``mysql_backups/restore``).\n:type app_key: NonEmptyStr\n:param label: The human-readable tab label (for example ``Restore``).\n:type label: NonEmptyStr\n:param route_segment: The React sub-path segment under the parent's\n    ``route_base`` (for example ``restores``). Must be a single URL path\n    segment — no slashes — and must not be a reserved single-entity route\n    keyword (``new``, ``schedule``, ``task``).\n:type route_segment: NonEmptyStr",
+        "properties": {
+          "app_key": {
+            "minLength": 1,
+            "title": "App Key",
+            "type": "string"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "route_segment": {
+            "minLength": 1,
+            "pattern": "^[a-z][a-z0-9_-]*$",
+            "title": "Route Segment",
+            "type": "string"
+          }
+        },
+        "required": ["app_key", "label", "route_segment"],
+        "title": "RelatedApp",
+        "type": "object"
+      },
+      "framework__RemoteChoiceField": {
+        "additionalProperties": false,
+        "description": "Represent a field whose options are fetched at render from an app endpoint.\n\nThe renderer fetches ``endpoint_url`` and renders the returned\n``Choice``-compatible options (``value`` / ``label`` / optional ``disabled``\n/ ``disabled_reason``). When ``depends_on`` is set, the fetch is\nparameterised by the dependency's value (appended as a query parameter named\nafter ``depends_on``) and the field stays disabled/empty until the\ndependency has a value. When ``allow_custom`` is set, the renderer also\naccepts a free-typed value. The endpoint response contract is a JSON array\nof objects shaped like :class:`Choice`: ``{\"value\": str, \"label\": str,\n\"disabled\"?: bool, \"disabled_reason\"?: str}``.\n\n:param field_type: The discriminator literal; always ``\"remote_choice\"``.\n    Serialised as the JSON key ``\"type\"``.\n:param endpoint_url: The fully-resolved URL the renderer fetches options\n    from, relative to the frontend ``apiClient`` base (``/api``).\n:param depends_on: Optional name of the sibling field whose value drives\n    (and parameterises) the option fetch. ``None`` (the default) omits the\n    key from the wire so plugins that do not cascade stay byte-identical.\n:param allow_custom: When ``True``, the selector also accepts a free-typed\n    value. ``None`` (the default) omits the key from the wire so plugins\n    that do not opt in stay byte-identical.",
+        "properties": {
+          "allow_custom": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Allow Custom"
+          },
+          "default": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "depends_on": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Depends On"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "endpoint_url": {
+            "minLength": 1,
+            "title": "Endpoint Url",
+            "type": "string"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "required": {
+            "default": false,
+            "title": "Required",
+            "type": "boolean"
+          },
+          "requires": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Requires"
+          },
+          "type": {
+            "const": "remote_choice",
+            "default": "remote_choice",
+            "enum": ["remote_choice"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label", "endpoint_url"],
+        "title": "RemoteChoiceField",
+        "type": "object"
+      },
+      "framework__SchemaField": {
+        "additionalProperties": false,
+        "description": "Represent an inventory database-schema selector field.\n\n``depends_on`` is a forward reference to another field's ``name`` in the\nsame plugin schema (typically a ``ServiceField``); the React renderer\ncascades schema options from the selected service. The referenced field\nis not validated at the schema level.\n\n:param field_type: The discriminator literal; always ``\"schema\"`` for\n    this class. Serialised as the JSON key ``\"type\"``.\n:type field_type: Literal[\"schema\"]\n:param depends_on: The name of the field whose value drives the list of\n    available schemas.\n:type depends_on: NonEmptyStr\n:param allow_custom: Opt-in capability flag declaring that a consuming\n    renderer may offer free-text (free-solo) entry in addition to the\n    cascaded inventory options. Optional, defaulting to ``None`` (options\n    only). Typed ``bool | None`` so the discovery endpoint's\n    ``exclude_none`` posture drops it from the wire until a plugin opts\n    in, keeping the addition byte-compatible with existing schemas. The\n    built-in SchemaFormRenderer does not yet consume the flag; the\n    free-solo widget that reads it ships with the consuming plugin.\n:type allow_custom: bool | None",
+        "properties": {
+          "allow_custom": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Allow Custom"
+          },
+          "default": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "depends_on": {
+            "minLength": 1,
+            "title": "Depends On",
+            "type": "string"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "required": {
+            "default": false,
+            "title": "Required",
+            "type": "boolean"
+          },
+          "requires": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Requires"
+          },
+          "type": {
+            "const": "schema",
+            "default": "schema",
+            "enum": ["schema"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label", "depends_on"],
+        "title": "SchemaField",
+        "type": "object"
+      },
+      "framework__ScriptExecuteWrite": {
+        "description": "Define the JSON body for ``POST .../snippet/execute``.\n\nThe per-script frontmatter arguments go in ``args`` and are validated against\nthe script's dynamic execution model, while ``executor_host`` and ``sudo`` are\nexecution-level inputs the consumer's ``build_execution_meta`` reads.\n\n:param executor_host: The hostname of the executor that will run the script.\n:param sudo: Whether to invoke the script with sudo. The consumer's\n    ``build_execution_meta`` decides whether the script honours it.\n:param args: Per-parameter arguments keyed by parameter name, validated\n    against the script's dynamic execution model.",
+        "properties": {
+          "args": {
+            "additionalProperties": true,
+            "default": {},
+            "title": "Args",
+            "type": "object"
+          },
+          "executor_host": {
+            "minLength": 1,
+            "title": "Execution Host",
+            "type": "string"
+          },
+          "sudo": {
+            "default": false,
+            "title": "Sudo",
+            "type": "boolean"
+          }
+        },
+        "required": ["executor_host"],
+        "title": "ScriptExecuteWrite",
+        "type": "object"
+      },
+      "framework__ScriptExecutionResponse": {
+        "description": "Represent the response from the script execute endpoint.\n\n:param task_name: The Tasks-API task name the script executed under.\n:param task_id: The id of the task-history row the Tasks API created, when the\n    upstream response carries one.\n:param snippet_filename: The filename of the executed script.",
+        "properties": {
+          "snippet_filename": {
+            "minLength": 1,
+            "title": "Snippet Filename",
+            "type": "string"
+          },
+          "task_id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Task Id"
+          },
+          "task_name": {
+            "minLength": 1,
+            "title": "Task Name",
+            "type": "string"
+          }
+        },
+        "required": ["task_name", "snippet_filename"],
+        "title": "ScriptExecutionResponse",
+        "type": "object"
+      },
+      "framework__ScriptPreviewField": {
+        "additionalProperties": false,
+        "description": "Represent a read-only field that renders a backend-fetched script preview.\n\nThe renderer fetches ``endpoint_url`` on mount, and re-fetches whenever\nany sibling field listed in ``depends_on`` changes value (debounced and\ncancellation-safe). The response shape is\n``{content: str, language: str, is_truncated: bool}``.\n\n:param field_type: The discriminator literal; always\n    ``\"script_preview\"`` for this class. Serialised as the JSON key\n    ``\"type\"``.\n:type field_type: Literal[\"script_preview\"]\n:param endpoint_url: The fully-resolved URL the renderer fetches preview\n    content from, relative to the FE ``apiClient`` base (``/api``). Schema\n    synthesisers should bake any plugin-specific path segments (for\n    example, ``/apps/snippets/{filename}/preview``) here at\n    schema build time rather than templating client-side.\n:type endpoint_url: NonEmptyStr\n:param depends_on: Names of sibling fields whose values trigger a\n    re-fetch when changed. Empty (the default) means fetch once on\n    mount.\n:type depends_on: list[NonEmptyStr]\n:param language: Optional default highlighter language hint used when\n    the backend response omits ``language``. Defaults to ``None``.\n:type language: NonEmptyStr | None",
+        "properties": {
+          "default": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "depends_on": {
+            "items": {
+              "minLength": 1,
+              "type": "string"
+            },
+            "title": "Depends On",
+            "type": "array"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "endpoint_url": {
+            "minLength": 1,
+            "title": "Endpoint Url",
+            "type": "string"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "language": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Language"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "required": {
+            "default": false,
+            "title": "Required",
+            "type": "boolean"
+          },
+          "requires": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Requires"
+          },
+          "type": {
+            "const": "script_preview",
+            "default": "script_preview",
+            "enum": ["script_preview"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label", "endpoint_url"],
+        "title": "ScriptPreviewField",
+        "type": "object"
+      },
+      "framework__ScriptPreviewResponse": {
+        "description": "Represent the backend response for the preview endpoint.\n\n:param content: The full text content of the snippet file (preamble,\n    frontmatter, and body concatenated).\n:param language: A JS syntax-highlighter language identifier derived\n    from the snippet's MIME type (for example, ``\"bash\"`` or\n    ``\"plaintext\"``).\n:param is_truncated: Whether the preview was truncated to fit\n    within the configured per-file character or line limit.",
+        "properties": {
+          "content": {
+            "title": "Content",
+            "type": "string"
+          },
+          "is_truncated": {
+            "title": "Is Truncated",
+            "type": "boolean"
+          },
+          "language": {
+            "title": "Language",
+            "type": "string"
+          }
+        },
+        "required": ["content", "language", "is_truncated"],
+        "title": "ScriptPreviewResponse",
+        "type": "object"
+      },
+      "framework__ServiceField": {
+        "additionalProperties": false,
+        "description": "Represent an inventory service selector field.\n\n:param field_type: The discriminator literal; always ``\"service\"`` for\n    this class. Serialised as the JSON key ``\"type\"``.\n:type field_type: Literal[\"service\"]\n:param service_types: The list of service types the selector should offer\n    (for example, ``[ServiceTypeEnum.MYSQL]``).\n:type service_types: list[ServiceTypeEnum]\n:param allow_custom: Opt-in capability flag declaring that a consuming\n    renderer may offer free-text (free-solo) entry in addition to the\n    inventory options. Optional, defaulting to ``None`` (options only).\n    Typed ``bool | None`` so the discovery endpoint's ``exclude_none``\n    posture drops it from the wire until a plugin opts in, keeping the\n    addition byte-compatible with existing schemas. The built-in\n    SchemaFormRenderer does not yet consume the flag; the free-solo\n    widget that reads it ships with the consuming plugin.\n:type allow_custom: bool | None",
+        "properties": {
+          "allow_custom": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Allow Custom"
+          },
+          "default": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "required": {
+            "default": false,
+            "title": "Required",
+            "type": "boolean"
+          },
+          "requires": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Requires"
+          },
+          "service_types": {
+            "items": {
+              "$ref": "#/components/schemas/ServiceTypeEnum"
+            },
+            "title": "Service Types",
+            "type": "array"
+          },
+          "type": {
+            "const": "service",
+            "default": "service",
+            "enum": ["service"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label", "service_types"],
+        "title": "ServiceField",
+        "type": "object"
+      },
+      "framework__StringField": {
+        "additionalProperties": false,
+        "description": "Represent a single-line string input field.\n\n:param field_type: The discriminator literal; always ``\"string\"`` for this\n    class. Serialised as the JSON key ``\"type\"``.\n:type field_type: Literal[\"string\"]\n:param min_length: Optional minimum character length. Defaults to\n    ``None``.\n:type min_length: int | None\n:param max_length: Optional maximum character length. Defaults to\n    ``None``.\n:type max_length: int | None\n:param pattern: Optional regular expression the value must match.\n    Defaults to ``None``.\n:type pattern: NonEmptyStr | None\n:param placeholder: Optional placeholder text displayed when the field is\n    empty. Defaults to ``None``.\n:type placeholder: NonEmptyStr | None",
+        "properties": {
+          "default": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "max_length": {
+            "anyOf": [
+              {
+                "minimum": 1.0,
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Max Length"
+          },
+          "min_length": {
+            "anyOf": [
+              {
+                "minimum": 1.0,
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Min Length"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "pattern": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Pattern"
+          },
+          "placeholder": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Placeholder"
+          },
+          "required": {
+            "default": false,
+            "title": "Required",
+            "type": "boolean"
+          },
+          "requires": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Requires"
+          },
+          "type": {
+            "const": "string",
+            "default": "string",
+            "enum": ["string"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label"],
+        "title": "StringField",
+        "type": "object"
+      },
+      "framework__TableField": {
+        "additionalProperties": false,
+        "description": "Represent an inventory table selector field.\n\n``depends_on`` is a forward reference to another field's ``name`` in the\nsame plugin schema (typically a ``SchemaField``); the React renderer\ncascades table options from the selected schema. The referenced field\nis not validated at the schema level.\n\n:param field_type: The discriminator literal; always ``\"table\"`` for this\n    class. Serialised as the JSON key ``\"type\"``.\n:type field_type: Literal[\"table\"]\n:param depends_on: The name of the field whose value drives the list of\n    available tables.\n:type depends_on: NonEmptyStr\n:param allow_custom: Opt-in capability flag declaring that a consuming\n    renderer may offer free-text (free-solo) entry in addition to the\n    cascaded inventory options. Optional, defaulting to ``None`` (options\n    only). Typed ``bool | None`` so the discovery endpoint's\n    ``exclude_none`` posture drops it from the wire until a plugin opts\n    in, keeping the addition byte-compatible with existing schemas. The\n    built-in SchemaFormRenderer does not yet consume the flag; the\n    free-solo widget that reads it ships with the consuming plugin.\n:type allow_custom: bool | None",
+        "properties": {
+          "allow_custom": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Allow Custom"
+          },
+          "default": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "depends_on": {
+            "minLength": 1,
+            "title": "Depends On",
+            "type": "string"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "required": {
+            "default": false,
+            "title": "Required",
+            "type": "boolean"
+          },
+          "requires": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Requires"
+          },
+          "type": {
+            "const": "table",
+            "default": "table",
+            "enum": ["table"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label", "depends_on"],
+        "title": "TableField",
+        "type": "object"
+      },
+      "framework__TaskExecuteWrite": {
+        "description": "Represent the default JSON request body for executing a task.\n\n:param eta: Optional future datetime to schedule execution.\n:param chain_task_names: Optional list of task names to chain after this one.\n:param chain_on_failure: Whether to run chained tasks even on failure.",
+        "properties": {
+          "chain_on_failure": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Chain On Failure"
+          },
+          "chain_task_names": {
+            "anyOf": [
+              {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Chain Task Names"
+          },
+          "eta": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Eta"
+          }
+        },
+        "title": "TaskExecuteWrite",
+        "type": "object"
+      },
+      "framework__TaskExecutionResponse": {
+        "description": "Represent the default response from a task execute route.\n\n:param task_name: The name of the task that was executed.\n:param task_id: The id of the task-history row created by the tasks API.",
+        "properties": {
+          "task_id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Task Id"
+          },
+          "task_name": {
+            "title": "Task Name",
+            "type": "string"
+          }
+        },
+        "required": ["task_name"],
+        "title": "TaskExecutionResponse",
+        "type": "object"
+      },
+      "framework__TextAreaField": {
+        "additionalProperties": false,
+        "description": "Represent a multi-line string input field.\n\n:param field_type: The discriminator literal; always ``\"textarea\"`` for\n    this class. Serialised as the JSON key ``\"type\"``.\n:type field_type: Literal[\"textarea\"]\n:param rows: Optional number of visible text rows. Defaults to ``None``.\n:type rows: int | None\n:param placeholder: Optional placeholder text displayed when the field is\n    empty. Defaults to ``None``.\n:type placeholder: NonEmptyStr | None",
+        "properties": {
+          "default": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "placeholder": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Placeholder"
+          },
+          "required": {
+            "default": false,
+            "title": "Required",
+            "type": "boolean"
+          },
+          "requires": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Requires"
+          },
+          "rows": {
+            "anyOf": [
+              {
+                "minimum": 1.0,
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Rows"
+          },
+          "type": {
+            "const": "textarea",
+            "default": "textarea",
+            "enum": ["textarea"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label"],
+        "title": "TextAreaField",
+        "type": "object"
+      },
+      "framework__YamlField": {
+        "additionalProperties": false,
+        "description": "Represent a YAML-syntax multi-line text input field.\n\n:param field_type: The discriminator literal; always ``\"yaml\"`` for this\n    class. Serialised as the JSON key ``\"type\"``.\n:type field_type: Literal[\"yaml\"]\n:param rows: Optional number of visible text rows. Defaults to ``None``.\n:type rows: int | None\n:param placeholder: Optional placeholder text displayed when the field is\n    empty. Defaults to ``None``.\n:type placeholder: NonEmptyStr | None",
+        "properties": {
+          "default": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Default"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "forbidden": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Forbidden"
+          },
+          "label": {
+            "minLength": 1,
+            "title": "Label",
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "pattern": "^[A-Za-z_](?:[\\w.-]*\\w)?$",
+            "title": "Name",
+            "type": "string"
+          },
+          "placeholder": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Placeholder"
+          },
+          "required": {
+            "default": false,
+            "title": "Required",
+            "type": "boolean"
+          },
+          "requires": {
+            "anyOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/framework__FieldGate"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Requires"
+          },
+          "rows": {
+            "anyOf": [
+              {
+                "minimum": 1.0,
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Rows"
+          },
+          "type": {
+            "const": "yaml",
+            "default": "yaml",
+            "enum": ["yaml"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["name", "label"],
+        "title": "YamlField",
+        "type": "object"
+      },
+      "inventory__AvailableSyncer": {
+        "description": "Provide template-facing metadata for an available syncer.\n\n:param name: The fully qualified ``\"module.ClassName\"`` identifier matching\n    ``BaseSyncer.get_name()`` and the value persisted in\n    ``SyncInstance.syncer``. Used as the wire identifier in form payloads.\n:type name: str\n:param display_name: The human-readable label rendered in the dropdown\n    (the syncer class's short name with any trailing ``Syncer`` suffix\n    stripped).\n:type display_name: str",
+        "properties": {
+          "display_name": {
+            "title": "Display Name",
+            "type": "string"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          }
+        },
+        "required": ["name", "display_name"],
+        "title": "AvailableSyncer",
+        "type": "object"
+      },
+      "inventory__InventorySyncStatusResponse": {
+        "description": "Represent the inventory sync status response.\n\n:param is_running: ``True`` when an inventory-wide sync is currently\n    in progress; ``False`` otherwise.\n:type is_running: bool",
+        "properties": {
+          "is_running": {
+            "title": "Is Running",
+            "type": "boolean"
+          }
+        },
+        "required": ["is_running"],
+        "title": "InventorySyncStatusResponse",
+        "type": "object"
+      },
+      "inventory__InventorySyncTriggerWrite": {
+        "additionalProperties": false,
+        "description": "Carry the optional JSON body for the ad-hoc inventory sync trigger.\n\nA ``None`` or empty ``syncer`` selects the sync-all path; a non-empty\nstring targets a single configured syncer by its fully qualified\n``\"module.ClassName\"`` identifier. Unknown fields are rejected with\nHTTP 422 so a typo on the client never silently degrades to sync-all.\n\n:param syncer: Fully qualified syncer name, or ``None`` for sync-all.\n:type syncer: str | None",
+        "properties": {
+          "syncer": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Syncer"
+          }
+        },
+        "title": "InventorySyncTriggerWrite",
+        "type": "object"
+      },
+      "inventory__PluginTaskResponse": {
+        "description": "Represent a single plugin task entry returned by ``GET /api/apps/inventory/``.\n\n:param name: Machine-readable task identifier (e.g. ``\"inventory-sync\"``).\n:type name: str\n:param display_name: Human-readable label for the schedule UI.\n:type display_name: str",
+        "properties": {
+          "display_name": {
+            "title": "Display Name",
+            "type": "string"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          }
+        },
+        "required": ["name", "display_name"],
+        "title": "PluginTaskResponse",
+        "type": "object"
+      },
+      "mysql_backups__BackupCreate": {
+        "description": "Declare the model-first create/update body and ``GET /schema`` source for MySQL Backups.\n\nDeclares each form field once, in section order (Task, General, Mydumper,\nXtraBackup, Binlog, Encryption, Upload), with the DSL markers driving the\nderived schema. Field declaration order is load-bearing: the derived section\norder follows each section's first field, and the within-section order follows\ndeclaration order, so the order here reproduces the hand-written schema\nbyte-for-byte. The conditional gating that the legacy ``schema.py`` declared\n(per-mode ``forbidden`` gates, the upload-provider ``Contains`` gates, the\nencryption requires/forbidden pair, and the per-mode bool ``FailRule``s in\n:attr:`__form_rules__`) now lives on the model; ``AppFormModel`` extracts it\ninto the conditional-rule plan at class definition, so no\n``@apply_conditional_rules`` decorator is needed. The config sub-models\n(:class:`BackupConfigAll` and friends) stay the serialization target the\npayload builder populates, not this model's base class.\n\n:cvar __form_rules__: The per-mode bool fail rules — a truthy mode-owned bool\n    outside its mode fails validation with a per-field message.",
+        "properties": {
+          "alert_on_fail": {
+            "default": false,
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "alias": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Alias"
+          },
+          "awscli_s3_upload_extra_args": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Awscli S3 Upload Extra Args"
+          },
+          "backup_dir": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Backup Dir"
+          },
+          "backup_type": {
+            "$ref": "#/components/schemas/mysql_backups__BackupType"
+          },
+          "binlog_alternative_host": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Binlog Alternative Host"
+          },
+          "binlog_cmd": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Binlog Cmd"
+          },
+          "binlog_compress_cmd": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Binlog Compress Cmd"
+          },
+          "binlog_extra_args": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Binlog Extra Args"
+          },
+          "binlog_prefix": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Binlog Prefix"
+          },
+          "binlog_purge_days": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Binlog Purge Days"
+          },
+          "binlog_run_all": {
+            "default": true,
+            "title": "Binlog Run All",
+            "type": "boolean"
+          },
+          "check_disk_space": {
+            "default": false,
+            "title": "Check Disk Space",
+            "type": "boolean"
+          },
+          "compress": {
+            "default": false,
+            "title": "Compress",
+            "type": "boolean"
+          },
+          "compression_algorithm": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/mysql_backups__CompressionAlgorithm"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Compression Algorithm"
+          },
+          "defaults_file": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Defaults File"
+          },
+          "encrypt": {
+            "default": false,
+            "title": "Encrypt",
+            "type": "boolean"
+          },
+          "encrypt_using_tmpdir": {
+            "default": false,
+            "title": "Encrypt Using Tmpdir",
+            "type": "boolean"
+          },
+          "encryption_recipient": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Encryption Recipient"
+          },
+          "gs_bucket": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Gs Bucket"
+          },
+          "hardlink": {
+            "default": false,
+            "title": "Hardlink",
+            "type": "boolean"
+          },
+          "hostname": {
+            "minLength": 1,
+            "title": "Hostname",
+            "type": "string"
+          },
+          "logging_dir": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Logging Dir"
+          },
+          "mydumper_daily_purge": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Mydumper Daily Purge"
+          },
+          "mydumper_desync_pxc": {
+            "default": false,
+            "title": "Mydumper Desync Pxc",
+            "type": "boolean"
+          },
+          "mydumper_dump_triggers": {
+            "default": false,
+            "title": "Mydumper Dump Triggers",
+            "type": "boolean"
+          },
+          "mydumper_extra_args": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Mydumper Extra Args"
+          },
+          "mydumper_use_numa": {
+            "default": false,
+            "title": "Mydumper Use Numa",
+            "type": "boolean"
+          },
+          "mydumper_verbose": {
+            "anyOf": [
+              {
+                "maximum": 3.0,
+                "minimum": 0.0,
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Mydumper Verbose"
+          },
+          "mydumper_weekly_purge": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Mydumper Weekly Purge"
+          },
+          "only_if_read_only": {
+            "default": false,
+            "title": "Only If Read Only",
+            "type": "boolean"
+          },
+          "only_if_running_replica": {
+            "default": false,
+            "title": "Only If Running Replica",
+            "type": "boolean"
+          },
+          "post_run_encrypt": {
+            "default": false,
+            "title": "Post Run Encrypt",
+            "type": "boolean"
+          },
+          "rsync_path": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Rsync Path"
+          },
+          "s3_bucket": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "S3 Bucket"
+          },
+          "s3_storage_class": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "S3 Storage Class"
+          },
+          "service_id": {
+            "title": "Service Id",
+            "type": "integer"
+          },
+          "skip_s3_safety_check": {
+            "default": false,
+            "title": "Skip S3 Safety Check",
+            "type": "boolean"
+          },
+          "task_name": {
+            "minLength": 1,
+            "title": "Task Name",
+            "type": "string"
+          },
+          "upload": {
+            "items": {
+              "$ref": "#/components/schemas/mysql_backups__UploadProvider"
+            },
+            "title": "Upload",
+            "type": "array"
+          },
+          "upload_quiet": {
+            "default": false,
+            "title": "Upload Quiet",
+            "type": "boolean"
+          },
+          "use_ftwrl_guardian": {
+            "default": false,
+            "title": "Use Ftwrl Guardian",
+            "type": "boolean"
+          },
+          "xtrabackup_aes256_keyfile": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Xtrabackup Aes256 Keyfile"
+          },
+          "xtrabackup_bin_cmd": {
+            "anyOf": [
+              {
+                "enum": ["xtrabackup", "mariadb-backup", "innobackupex"],
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Xtrabackup Bin Cmd"
+          },
+          "xtrabackup_copies": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Xtrabackup Copies"
+          },
+          "xtrabackup_defaults_file": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Xtrabackup Defaults File"
+          },
+          "xtrabackup_desync_pxc": {
+            "default": false,
+            "title": "Xtrabackup Desync Pxc",
+            "type": "boolean"
+          },
+          "xtrabackup_extra_args": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Xtrabackup Extra Args"
+          },
+          "xtrabackup_incremental_cycle": {
+            "anyOf": [
+              {
+                "enum": ["daily", "weekly", "2", "3", "4", "5", "6", "7"],
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Xtrabackup Incremental Cycle"
+          },
+          "xtrabackup_incremental_method": {
+            "anyOf": [
+              {
+                "enum": ["less_space", "fast_restore"],
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Xtrabackup Incremental Method"
+          },
+          "xtrabackup_kill_queries": {
+            "default": false,
+            "title": "Xtrabackup Kill Queries",
+            "type": "boolean"
+          },
+          "xtrabackup_kill_queries_timeout": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Xtrabackup Kill Queries Timeout"
+          },
+          "xtrabackup_kill_query_type": {
+            "anyOf": [
+              {
+                "enum": ["select", "all"],
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Xtrabackup Kill Query Type"
+          },
+          "xtrabackup_local_ssh_destination": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Xtrabackup Local Ssh Destination"
+          },
+          "xtrabackup_lock_ddl": {
+            "default": false,
+            "title": "Xtrabackup Lock Ddl",
+            "type": "boolean"
+          },
+          "xtrabackup_prepare": {
+            "default": false,
+            "title": "Xtrabackup Prepare",
+            "type": "boolean"
+          },
+          "xtrabackup_prepare_memory": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Xtrabackup Prepare Memory"
+          },
+          "xtrabackup_quiet": {
+            "default": false,
+            "title": "Xtrabackup Quiet",
+            "type": "boolean"
+          },
+          "xtrabackup_replica_info": {
+            "default": false,
+            "title": "Xtrabackup Replica Info",
+            "type": "boolean"
+          },
+          "xtrabackup_rsync": {
+            "default": false,
+            "title": "Xtrabackup Rsync",
+            "type": "boolean"
+          },
+          "xtrabackup_stop_replica": {
+            "default": false,
+            "title": "Xtrabackup Stop Replica",
+            "type": "boolean"
+          },
+          "xtrabackup_verify": {
+            "default": false,
+            "title": "Xtrabackup Verify",
+            "type": "boolean"
+          }
+        },
+        "required": ["task_name", "hostname", "service_id", "backup_type"],
+        "title": "BackupCreate",
+        "type": "object"
+      },
+      "mysql_backups__BackupRunResponse": {
+        "description": "Expose one catalog record over the per-service query path.\n\n:param id: The record's primary key.\n:param service_name: The inventory service the backup was taken from.\n:param hostname: The backup target host.\n:param backup_type: The backup tool, ``\"M\"`` (mydumper) or ``\"X\"`` (xtrabackup).\n    Narrower than :class:`BackupType`: binlog runs are never catalogued, so\n    ``\"B\"`` never appears here.\n:param location: The resolved on-disk directory the run produced.\n:param upload_destination: The upload destination when one was configured.\n:param size_bytes: The backup size in bytes, when the run reported it.\n:param started_at: When the run started.\n:param finished_at: When the run finished.",
+        "properties": {
+          "backup_type": {
+            "enum": ["M", "X"],
+            "title": "Backup Type",
+            "type": "string"
+          },
+          "finished_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Finished At"
+          },
+          "hostname": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Hostname"
+          },
+          "id": {
+            "title": "Id",
+            "type": "integer"
+          },
+          "location": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Location"
+          },
+          "service_name": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Service Name"
+          },
+          "size_bytes": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Size Bytes"
+          },
+          "started_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Started At"
+          },
+          "upload_destination": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Upload Destination"
+          }
+        },
+        "required": [
+          "id",
+          "service_name",
+          "hostname",
+          "backup_type",
+          "location",
+          "upload_destination",
+          "size_bytes",
+          "started_at",
+          "finished_at"
+        ],
+        "title": "BackupRunResponse",
+        "type": "object"
+      },
+      "mysql_backups__BackupTaskResponse": {
+        "description": "Represent a backup task API response.\n\n:param backup_type: The backup type recorded in task config.",
+        "properties": {
+          "alert_on_fail": {
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "anonymized_entities": {
+            "description": "Return sorted PII entity names decoded from ``anonymize_mask``.",
+            "items": {
+              "type": "string"
+            },
+            "readOnly": true,
+            "title": "Anonymized Entities",
+            "type": "array"
+          },
+          "backend": {
+            "$ref": "#/components/schemas/TaskBackendEnum"
+          },
+          "backup_type": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/mysql_backups__BackupType"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "connectivity_warning": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/framework__ConnectivityWarning"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "created_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created At"
+          },
+          "created_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created By"
+          },
+          "data": {
+            "title": "Data",
+            "type": "object"
+          },
+          "hostname": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Hostname"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "last_executed_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Executed At"
+          },
+          "last_updated_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Updated By"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "protected": {
+            "title": "Protected",
+            "type": "boolean"
+          },
+          "status": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": [
+          "name",
+          "backend",
+          "data",
+          "protected",
+          "alert_on_fail",
+          "anonymized_entities"
+        ],
+        "title": "BackupTaskResponse",
+        "type": "object"
+      },
+      "mysql_backups__BackupType": {
+        "description": "Backup types.",
+        "enum": ["M", "X", "B"],
+        "title": "BackupType",
+        "type": "string"
+      },
+      "mysql_backups__CompressionAlgorithm": {
+        "description": "Enumeration for Compression Algorithms.",
+        "enum": ["zstd", "lz4", "gzip", "quicklz"],
+        "title": "CompressionAlgorithm",
+        "type": "string"
+      },
+      "mysql_backups__PaginatedResponse_BackupRunResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/mysql_backups__BackupRunResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[BackupRunResponse]",
+        "type": "object"
+      },
+      "mysql_backups__PaginatedResponse_BackupTaskResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/mysql_backups__BackupTaskResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[BackupTaskResponse]",
+        "type": "object"
+      },
+      "mysql_backups__PaginatedResponse_RestoresResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/mysql_backups__RestoresResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[RestoresResponse]",
+        "type": "object"
+      },
+      "mysql_backups__RestoreCreate": {
+        "description": "Declare the model-first create/update body and ``GET /schema`` source for Restores.\n\nDeclares every restore form field once, in section order (Task, General,\nMydumper, XtraBackup, Binlog), with the DSL markers driving the derived\nschema. The previously-inherited config models (:class:`RestoreConfigAll` and\n:class:`BaseRestoreConfigServer`) stay the YAML-serialization targets the\npayload builder populates via ``extract_model_from_instance``; this model\nre-declares their fields directly so it can also carry presentation metadata.\n\nThe per-``backup_type`` section visibility is expressed in the view layout\n(``restore/views.py``), not as field-level gates: several mode-specific config\nfields carry non-``None`` defaults (``myloader_threads``, ``xb_parallel``,\n``master_port``), so a field-level ``Forbidden`` gate would reject those\ndefaults on a cross-mode restore. Keeping the model permissive preserves the\nlegacy payload contract byte-for-byte.\n\n``service_id`` / ``schema_id`` keep their str-accepting annotation (carrying\nthe ``\"-1\"`` ``UNKNOWN_SERVICE_SENTINEL``); their ``ServiceRef`` / ``SchemaRef``\nmarkers drive only the ``GET /schema`` widgets, while the conditional,\n404-tolerant resolution lives in ``deps.resolve_restore_entities``.",
+        "properties": {
+          "alert_on_fail": {
+            "default": false,
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "backup_source": {
+            "minLength": 1,
+            "title": "Backup Source",
+            "type": "string"
+          },
+          "backup_type": {
+            "$ref": "#/components/schemas/mysql_backups__BackupType"
+          },
+          "binlog_restore_extra_args": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Binlog Restore Extra Args"
+          },
+          "custom_mysql_init_command": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Custom Mysql Init Command"
+          },
+          "datadir": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Datadir"
+          },
+          "gpg_password_file": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Gpg Password File"
+          },
+          "hostname": {
+            "minLength": 1,
+            "title": "Hostname",
+            "type": "string"
+          },
+          "include_databases": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Include Databases"
+          },
+          "incremental_dest_path": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Incremental Dest Path"
+          },
+          "keyring_file_data": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Keyring File Data"
+          },
+          "kill_mysql": {
+            "default": false,
+            "title": "Kill Mysql",
+            "type": "boolean"
+          },
+          "local_path": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Local Path"
+          },
+          "logging_dir": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Logging Dir"
+          },
+          "master_ip": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Master Ip"
+          },
+          "master_password": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Master Password"
+          },
+          "master_port": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "default": 3306,
+            "title": "Master Port"
+          },
+          "master_user": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Master User"
+          },
+          "myloader_extra_args": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Myloader Extra Args"
+          },
+          "myloader_threads": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "default": 4,
+            "title": "Myloader Threads"
+          },
+          "overwrite_tables": {
+            "default": false,
+            "title": "Overwrite Tables",
+            "type": "boolean"
+          },
+          "port": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Port"
+          },
+          "post_script": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Post Script"
+          },
+          "pre_script": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Pre Script"
+          },
+          "restore_mycnf": {
+            "default": false,
+            "title": "Restore Mycnf",
+            "type": "boolean"
+          },
+          "s3_tool": {
+            "$ref": "#/components/schemas/mysql_backups__S3Tool",
+            "default": "s3cmd"
+          },
+          "schema_id": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Schema Id"
+          },
+          "service_id": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Service Id"
+          },
+          "skip_databases": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Skip Databases"
+          },
+          "skip_incrementals": {
+            "default": false,
+            "title": "Skip Incrementals",
+            "type": "boolean"
+          },
+          "slave_from_master": {
+            "default": false,
+            "title": "Slave From Master",
+            "type": "boolean"
+          },
+          "ssh_key": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Ssh Key"
+          },
+          "ssh_port": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "default": 22,
+            "title": "Ssh Port"
+          },
+          "ssh_user": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "default": "percona",
+            "title": "Ssh User"
+          },
+          "start_file": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Start File"
+          },
+          "start_position": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Start Position"
+          },
+          "stop_file": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Stop File"
+          },
+          "stop_position": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Stop Position"
+          },
+          "task_name": {
+            "minLength": 1,
+            "title": "Task Name",
+            "type": "string"
+          },
+          "use_sql_file": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Use Sql File"
+          },
+          "wait_for_catchup": {
+            "default": false,
+            "title": "Wait For Catchup",
+            "type": "boolean"
+          },
+          "xb_parallel": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "default": 4,
+            "title": "Xb Parallel"
+          },
+          "xb_prepare_memory": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Xb Prepare Memory"
+          },
+          "xtrabackup_aes256_keyfile": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Xtrabackup Aes256 Keyfile"
+          },
+          "xtrabackup_bin_cmd": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/mysql_backups__XtraBackupTool"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Xtrabackup Bin Cmd"
+          },
+          "xtrabackup_restore_args": {
+            "anyOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Xtrabackup Restore Args"
+          }
+        },
+        "required": ["task_name", "hostname", "backup_type", "backup_source"],
+        "title": "RestoreCreate",
+        "type": "object"
+      },
+      "mysql_backups__RestoresResponse": {
+        "description": "Represent a restore task API response.\n\nExtend the standard task-response surface with the restore-specific\ndestination facts the detail view renders; the shared task identity,\nstatus, audit, and anonymization fields come from\n:class:`~app.sep.apps.framework.responses.BaseTaskResponse`.\n\n:param backup_type: The backup type recorded in task config.\n:param hostname: The executor hostname target.\n:param host: The destination host recorded in task config.\n:param port: The destination port recorded in task config.",
+        "properties": {
+          "alert_on_fail": {
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "anonymized_entities": {
+            "description": "Return sorted PII entity names decoded from ``anonymize_mask``.",
+            "items": {
+              "type": "string"
+            },
+            "readOnly": true,
+            "title": "Anonymized Entities",
+            "type": "array"
+          },
+          "backend": {
+            "$ref": "#/components/schemas/TaskBackendEnum"
+          },
+          "backup_type": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/mysql_backups__BackupType"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "connectivity_warning": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/framework__ConnectivityWarning"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "created_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created At"
+          },
+          "created_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created By"
+          },
+          "data": {
+            "title": "Data",
+            "type": "object"
+          },
+          "host": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Host"
+          },
+          "hostname": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Hostname"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "last_executed_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Executed At"
+          },
+          "last_updated_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Updated By"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "port": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Port"
+          },
+          "protected": {
+            "title": "Protected",
+            "type": "boolean"
+          },
+          "status": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": [
+          "name",
+          "backend",
+          "data",
+          "protected",
+          "alert_on_fail",
+          "anonymized_entities"
+        ],
+        "title": "RestoresResponse",
+        "type": "object"
+      },
+      "mysql_backups__S3Tool": {
+        "description": "Allowed tools to interact with S3-compatible services.",
+        "enum": ["s3cmd", "awscli"],
+        "title": "S3Tool",
+        "type": "string"
+      },
+      "mysql_backups__UploadProvider": {
+        "description": "Upload providers.",
+        "enum": ["rsync", "s3", "gsutil"],
+        "title": "UploadProvider",
+        "type": "string"
+      },
+      "mysql_backups__XtraBackupTool": {
+        "description": "Allowed commands for XtraBackup-style restores.",
+        "enum": ["innobackupex", "xtrabackup", "mariadb-backup"],
+        "title": "XtraBackupTool",
+        "type": "string"
+      },
+      "nav_icons__NavIcon": {
+        "description": "Enumerate the sidebar icon keys the React shell bundles.",
+        "enum": [
+          "assignment",
+          "code",
+          "support-agent",
+          "description",
+          "troubleshoot",
+          "table-chart",
+          "check-circle",
+          "mysql",
+          "mongo",
+          "postgresql",
+          "archive",
+          "science",
+          "bar-chart",
+          "account-tree"
+        ],
+        "title": "NavIcon",
+        "type": "string"
+      },
+      "report__AdvisorCheck": {
+        "description": "A single advisor check definition (enabled only).\n\n:param name: The unique check name.\n:type name: str\n:param description: Human-readable description of what the check tests.\n:type description: str\n:param summary: Short one-line summary of the check.\n:type summary: str\n:param family: The advisor family key this check belongs to, if any.\n:type family: str | None",
+        "properties": {
+          "description": {
+            "title": "Description",
+            "type": "string"
+          },
+          "family": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Family"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "summary": {
+            "title": "Summary",
+            "type": "string"
+          }
+        },
+        "required": ["name", "description", "summary"],
+        "title": "AdvisorCheck",
+        "type": "object"
+      },
+      "report__AdvisorFamily": {
+        "description": "A group of advisor checks that share the same family.\n\n:param family_key: Internal family key (e.g. ``\"FAMILY_MYSQL\"``).\n:type family_key: str\n:param display_name: Human-readable name shown in the report (e.g. ``\"MySQL\"``).\n:type display_name: str\n:param checks: All enabled checks belonging to this family.\n:type checks: list[AdvisorCheck]\n:param failed: Mapping of check name to its list of failed results.\n:type failed: dict[str, list[FailedCheck]]",
+        "properties": {
+          "checks": {
+            "items": {
+              "$ref": "#/components/schemas/report__AdvisorCheck"
+            },
+            "title": "Checks",
+            "type": "array"
+          },
+          "display_name": {
+            "title": "Display Name",
+            "type": "string"
+          },
+          "failed": {
+            "additionalProperties": {
+              "items": {
+                "$ref": "#/components/schemas/report__FailedCheck"
+              },
+              "type": "array"
+            },
+            "title": "Failed",
+            "type": "object"
+          },
+          "family_key": {
+            "title": "Family Key",
+            "type": "string"
+          }
+        },
+        "required": ["family_key", "display_name"],
+        "title": "AdvisorFamily",
+        "type": "object"
+      },
+      "report__AdvisorSection": {
+        "description": "Aggregated advisor data for the report.\n\n``total_failed`` counts failed advisor results (rows), not distinct check names.",
+        "properties": {
+          "families": {
+            "items": {
+              "$ref": "#/components/schemas/report__AdvisorFamily"
+            },
+            "title": "Families",
+            "type": "array"
+          },
+          "refresh_issues": {
+            "items": {
+              "type": "string"
+            },
+            "title": "Refresh Issues",
+            "type": "array"
+          },
+          "total_checks": {
+            "default": 0,
+            "title": "Total Checks",
+            "type": "integer"
+          },
+          "total_failed": {
+            "default": 0,
+            "title": "Total Failed",
+            "type": "integer"
+          }
+        },
+        "title": "AdvisorSection",
+        "type": "object"
+      },
+      "report__AlertEntry": {
+        "additionalProperties": true,
+        "description": "A single alert annotation extracted from Grafana.",
+        "properties": {
+          "alertname": {
+            "default": "",
+            "title": "Alertname",
+            "type": "string"
+          },
+          "id": {
+            "default": 0,
+            "title": "Id",
+            "type": "integer"
+          },
+          "node_id": {
+            "default": "",
+            "title": "Node Id",
+            "type": "string"
+          },
+          "node_name": {
+            "default": "",
+            "title": "Node Name",
+            "type": "string"
+          },
+          "service": {
+            "default": "",
+            "title": "Service",
+            "type": "string"
+          },
+          "service_id": {
+            "default": "",
+            "title": "Service Id",
+            "type": "string"
+          },
+          "service_type": {
+            "default": "",
+            "title": "Service Type",
+            "type": "string"
+          },
+          "severity": {
+            "default": "",
+            "title": "Severity",
+            "type": "string"
+          },
+          "time": {
+            "default": 0,
+            "title": "Time",
+            "type": "integer"
+          }
+        },
+        "title": "AlertEntry",
+        "type": "object"
+      },
+      "report__AlertSection": {
+        "description": "Aggregated alert data for the report.\n\n:param total_alerts: Total number of alert annotations in the period.\n:type total_alerts: int\n:param alerts_per_service: Alert count keyed by service name.\n:type alerts_per_service: dict[str, int]\n:param alerts_per_rule: Alert count keyed by alert rule name.\n:type alerts_per_rule: dict[str, int]\n:param alerts_per_host: Alert count keyed by node name.\n:type alerts_per_host: dict[str, int]\n:param alerts_daily: Alert count keyed by date string (``YYYY-MM-DD``).\n:type alerts_daily: dict[str, int]\n:param alerts_daily_per_host: Daily alert count per host, keyed by date then host.\n:type alerts_daily_per_host: dict[str, dict[str, int]]\n:param alert_history: Full list of individual alert entries.\n:type alert_history: list[AlertEntry]",
+        "properties": {
+          "alert_history": {
+            "items": {
+              "$ref": "#/components/schemas/report__AlertEntry"
+            },
+            "title": "Alert History",
+            "type": "array"
+          },
+          "alerts_daily": {
+            "additionalProperties": {
+              "type": "integer"
+            },
+            "title": "Alerts Daily",
+            "type": "object"
+          },
+          "alerts_daily_per_host": {
+            "additionalProperties": {
+              "additionalProperties": {
+                "type": "integer"
+              },
+              "type": "object"
+            },
+            "title": "Alerts Daily Per Host",
+            "type": "object"
+          },
+          "alerts_per_host": {
+            "additionalProperties": {
+              "type": "integer"
+            },
+            "title": "Alerts Per Host",
+            "type": "object"
+          },
+          "alerts_per_rule": {
+            "additionalProperties": {
+              "type": "integer"
+            },
+            "title": "Alerts Per Rule",
+            "type": "object"
+          },
+          "alerts_per_service": {
+            "additionalProperties": {
+              "type": "integer"
+            },
+            "title": "Alerts Per Service",
+            "type": "object"
+          },
+          "total_alerts": {
+            "default": 0,
+            "title": "Total Alerts",
+            "type": "integer"
+          }
+        },
+        "title": "AlertSection",
+        "type": "object"
+      },
+      "report__BackupEntry": {
+        "additionalProperties": true,
+        "description": "A single backup record.\n\n:param id: Unique identifier for this backup entry.\n:type id: str\n:param alias: Human-readable alias for the backup schedule.\n:type alias: str\n:param name: Node name where the backup was taken.\n:type name: str\n:param type: Backup type (e.g. ``\"physical\"``, ``\"logical\"``).\n:type type: str\n:param status: Result status of the backup.\n:type status: BackupStatus\n:param size: Raw backup size value from the metric label, or ``\"0\"`` if unknown.\n:type size: str\n:param estimated_data: ``True`` when the time period or size data is estimated.\n:type estimated_data: bool\n:param enabled: Whether the backup schedule is currently enabled, if available.\n:type enabled: bool | None\n:param encryption: Encryption state label reported by PMM.\n:type encryption: str\n:param period: Dictionary with ``start``, ``end``, and ``duration`` of the backup.\n:type period: dict[str, Any]",
+        "properties": {
+          "alias": {
+            "default": "",
+            "title": "Alias",
+            "type": "string"
+          },
+          "enabled": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Enabled"
+          },
+          "encryption": {
+            "default": "Unknown",
+            "title": "Encryption",
+            "type": "string"
+          },
+          "estimated_data": {
+            "default": true,
+            "title": "Estimated Data",
+            "type": "boolean"
+          },
+          "id": {
+            "title": "Id",
+            "type": "string"
+          },
+          "name": {
+            "default": "",
+            "title": "Name",
+            "type": "string"
+          },
+          "period": {
+            "title": "Period",
+            "type": "object"
+          },
+          "size": {
+            "default": "0",
+            "title": "Size",
+            "type": "string"
+          },
+          "status": {
+            "$ref": "#/components/schemas/report__BackupStatus",
+            "default": "unknown"
+          },
+          "type": {
+            "default": "",
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["id"],
+        "title": "BackupEntry",
+        "type": "object"
+      },
+      "report__BackupSection": {
+        "description": "Aggregated backup data for the report.\n\n:param total_backups: Total number of backup entries collected.\n:type total_backups: int\n:param backups_by_host: Backup count keyed by node name.\n:type backups_by_host: dict[str, int]\n:param backups_by_status: Backup count keyed by status string.\n:type backups_by_status: dict[str, int]\n:param backups_by_type: Backup count keyed by backup type.\n:type backups_by_type: dict[str, int]\n:param failed_backups: Subset of backups with a ``fail`` status.\n:type failed_backups: list[BackupEntry]\n:param all_backups: Complete list of all backup entries.\n:type all_backups: list[BackupEntry]",
+        "properties": {
+          "all_backups": {
+            "items": {
+              "$ref": "#/components/schemas/report__BackupEntry"
+            },
+            "title": "All Backups",
+            "type": "array"
+          },
+          "backups_by_host": {
+            "additionalProperties": {
+              "type": "integer"
+            },
+            "title": "Backups By Host",
+            "type": "object"
+          },
+          "backups_by_status": {
+            "additionalProperties": {
+              "type": "integer"
+            },
+            "title": "Backups By Status",
+            "type": "object"
+          },
+          "backups_by_type": {
+            "additionalProperties": {
+              "type": "integer"
+            },
+            "title": "Backups By Type",
+            "type": "object"
+          },
+          "failed_backups": {
+            "items": {
+              "$ref": "#/components/schemas/report__BackupEntry"
+            },
+            "title": "Failed Backups",
+            "type": "array"
+          },
+          "total_backups": {
+            "default": 0,
+            "title": "Total Backups",
+            "type": "integer"
+          }
+        },
+        "title": "BackupSection",
+        "type": "object"
+      },
+      "report__BackupStatus": {
+        "description": "Status values for a backup entry.",
+        "enum": ["pass", "fail", "inactive", "unknown"],
+        "title": "BackupStatus",
+        "type": "string"
+      },
+      "report__CheckSeverity": {
+        "description": "Severity levels for advisor check results.",
+        "enum": [
+          "SEVERITY_EMERGENCY",
+          "SEVERITY_ALERT",
+          "SEVERITY_CRITICAL",
+          "SEVERITY_ERROR",
+          "SEVERITY_WARNING",
+          "SEVERITY_NOTICE",
+          "SEVERITY_INFO",
+          "SEVERITY_DEBUG"
+        ],
+        "title": "CheckSeverity",
+        "type": "string"
+      },
+      "report__DiskUsageEntry": {
+        "description": "Disk usage for a single mountpoint on a node.\n\n:param node_name: Human-readable node hostname.\n:type node_name: str\n:param mountpoint: Filesystem mountpoint path (e.g. ``\"/\"``, ``\"/data\"``).\n:type mountpoint: str\n:param capacity_bytes: Total filesystem capacity in bytes.\n:type capacity_bytes: int\n:param used_start_bytes: Used bytes at the start of the report period.\n:type used_start_bytes: float\n:param used_end_bytes: Used bytes at the end of the report period.\n:type used_end_bytes: float\n:param used_peak_bytes: Peak used bytes observed during the report period.\n:type used_peak_bytes: float\n:param usage_percentage: End-of-period usage as a percentage of total capacity.\n:type usage_percentage: int",
+        "properties": {
+          "capacity_bytes": {
+            "default": 0,
+            "title": "Capacity Bytes",
+            "type": "integer"
+          },
+          "mountpoint": {
+            "title": "Mountpoint",
+            "type": "string"
+          },
+          "node_name": {
+            "title": "Node Name",
+            "type": "string"
+          },
+          "usage_percentage": {
+            "default": 0,
+            "title": "Usage Percentage",
+            "type": "integer"
+          },
+          "used_end_bytes": {
+            "default": 0,
+            "title": "Used End Bytes",
+            "type": "number"
+          },
+          "used_peak_bytes": {
+            "default": 0,
+            "title": "Used Peak Bytes",
+            "type": "number"
+          },
+          "used_start_bytes": {
+            "default": 0,
+            "title": "Used Start Bytes",
+            "type": "number"
+          }
+        },
+        "required": ["node_name", "mountpoint"],
+        "title": "DiskUsageEntry",
+        "type": "object"
+      },
+      "report__FailedCheck": {
+        "description": "A single failed advisor check result.\n\n:param name: The check name that failed.\n:type name: str\n:param description: Human-readable description of what the check tests.\n:type description: str\n:param summary: Short one-line summary of the check.\n:type summary: str\n:param severity: Severity level of the failure.\n:type severity: CheckSeverity\n:param node_name: Name of the node affected, if applicable.\n:type node_name: str | None\n:param node_id: PMM node ID of the affected node, if applicable.\n:type node_id: str | None\n:param service_name: Name of the service affected, if applicable.\n:type service_name: str | None\n:param service_id: PMM service ID of the affected service, if applicable.\n:type service_id: str | None\n:param read_more_url: URL linking to documentation for this check.\n:type read_more_url: str",
+        "properties": {
+          "description": {
+            "title": "Description",
+            "type": "string"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "node_id": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Node Id"
+          },
+          "node_name": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Node Name"
+          },
+          "read_more_url": {
+            "default": "",
+            "title": "Read More Url",
+            "type": "string"
+          },
+          "service_id": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Service Id"
+          },
+          "service_name": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Service Name"
+          },
+          "severity": {
+            "$ref": "#/components/schemas/report__CheckSeverity"
+          },
+          "summary": {
+            "title": "Summary",
+            "type": "string"
+          }
+        },
+        "required": ["name", "description", "summary", "severity"],
+        "title": "FailedCheck",
+        "type": "object"
+      },
+      "report__InventorySection": {
+        "description": "Aggregated inventory data for the report.",
+        "properties": {
+          "entries": {
+            "items": {
+              "$ref": "#/components/schemas/report__InventoryServiceEntry"
+            },
+            "title": "Entries",
+            "type": "array"
+          }
+        },
+        "title": "InventorySection",
+        "type": "object"
+      },
+      "report__InventoryServiceEntry": {
+        "description": "A monitored service with its agent connectivity status.",
+        "properties": {
+          "node_name": {
+            "default": "",
+            "title": "Node Name",
+            "type": "string"
+          },
+          "service_name": {
+            "title": "Service Name",
+            "type": "string"
+          },
+          "service_type": {
+            "title": "Service Type",
+            "type": "string"
+          },
+          "status": {
+            "$ref": "#/components/schemas/report__ServiceStatus",
+            "default": "OK"
+          }
+        },
+        "required": ["service_name", "service_type"],
+        "title": "InventoryServiceEntry",
+        "type": "object"
+      },
+      "report__MonitoredSummary": {
+        "description": "Summary of monitored nodes and services by type.",
+        "properties": {
+          "services_by_type": {
+            "additionalProperties": {
+              "type": "integer"
+            },
+            "title": "Services By Type",
+            "type": "object"
+          },
+          "total_nodes": {
+            "default": 0,
+            "title": "Total Nodes",
+            "type": "integer"
+          },
+          "total_services": {
+            "default": 0,
+            "title": "Total Services",
+            "type": "integer"
+          }
+        },
+        "title": "MonitoredSummary",
+        "type": "object"
+      },
+      "report__ReportData": {
+        "description": "Complete report payload ready for rendering.\n\n:param full: When ``True``, all check results and full backup history are included.\n:type full: bool\n:param refresh: When ``True``, advisor checks were refreshed before data collection.\n:type refresh: bool\n:param metadata: Report title, generation timestamp, and period labels.\n:type metadata: ReportMetadata\n:param monitored: Summary counts of monitored nodes and services.\n:type monitored: MonitoredSummary\n:param advisors: Advisor check results grouped by family.\n:type advisors: AdvisorSection\n:param alerts: Alert annotation history and aggregations.\n:type alerts: AlertSection\n:param backups: Backup status entries and aggregations.\n:type backups: BackupSection\n:param storage: Disk usage entries per node mountpoint.\n:type storage: StorageSection\n:param uptime: Service uptime entries for the report period.\n:type uptime: UptimeSection\n:param inventory: Monitored service inventory with connectivity status.\n:type inventory: InventorySection",
+        "properties": {
+          "advisors": {
+            "$ref": "#/components/schemas/report__AdvisorSection"
+          },
+          "alerts": {
+            "$ref": "#/components/schemas/report__AlertSection"
+          },
+          "backups": {
+            "$ref": "#/components/schemas/report__BackupSection"
+          },
+          "full": {
+            "default": true,
+            "title": "Full",
+            "type": "boolean"
+          },
+          "inventory": {
+            "$ref": "#/components/schemas/report__InventorySection"
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/report__ReportMetadata"
+          },
+          "monitored": {
+            "$ref": "#/components/schemas/report__MonitoredSummary"
+          },
+          "refresh": {
+            "default": false,
+            "title": "Refresh",
+            "type": "boolean"
+          },
+          "storage": {
+            "$ref": "#/components/schemas/report__StorageSection"
+          },
+          "uptime": {
+            "$ref": "#/components/schemas/report__UptimeSection"
+          }
+        },
+        "required": ["metadata"],
+        "title": "ReportData",
+        "type": "object"
+      },
+      "report__ReportJobResponse": {
+        "description": "Expose async report job state.\n\n:param job_id: Celery task identifier.\n:param status: Lowercase Celery task state.\n:param pdf_ready: Whether the PDF result exists and is downloadable.\n:param result: Successful job result payload, if available.\n:param error: Failed job error text, if available.",
+        "properties": {
+          "error": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Error"
+          },
+          "job_id": {
+            "title": "Job Id",
+            "type": "string"
+          },
+          "pdf_ready": {
+            "default": false,
+            "title": "Pdf Ready",
+            "type": "boolean"
+          },
+          "result": {
+            "additionalProperties": true,
+            "anyOf": [
+              {
+                "type": "object"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Result"
+          },
+          "status": {
+            "title": "Status",
+            "type": "string"
+          }
+        },
+        "required": ["job_id", "status"],
+        "title": "ReportJobResponse",
+        "type": "object"
+      },
+      "report__ReportMetadata": {
+        "description": "Metadata about a generated report.\n\n:param title: Report title string.\n:type title: str\n:param generated_at: Timestamp when the report was generated.\n:type generated_at: datetime\n:param report_week: ISO week label, e.g. ``\"Report 2026 Week 15\"``.\n:type report_week: str\n:param report_interval: Human-readable date range string for the report period.\n:type report_interval: str",
+        "properties": {
+          "generated_at": {
+            "format": "date-time",
+            "title": "Generated At",
+            "type": "string"
+          },
+          "report_interval": {
+            "default": "",
+            "title": "Report Interval",
+            "type": "string"
+          },
+          "report_week": {
+            "default": "",
+            "title": "Report Week",
+            "type": "string"
+          },
+          "title": {
+            "default": "",
+            "title": "Title",
+            "type": "string"
+          }
+        },
+        "required": ["generated_at"],
+        "title": "ReportMetadata",
+        "type": "object"
+      },
+      "report__ReportSnapshotWrite": {
+        "description": "Define report snapshot body for PDF/upload jobs.\n\n:param report: Generated report snapshot reused for PDF/upload work.",
+        "properties": {
+          "report": {
+            "$ref": "#/components/schemas/report__ReportData"
+          }
+        },
+        "required": ["report"],
+        "title": "ReportSnapshotWrite",
+        "type": "object"
+      },
+      "report__ServiceStatus": {
+        "description": "Agent connectivity status for an inventory service.",
+        "enum": ["OK", "Not OK"],
+        "title": "ServiceStatus",
+        "type": "string"
+      },
+      "report__StorageSection": {
+        "description": "Aggregated storage data for the report.\n\n:param entries: List of per-mountpoint disk usage entries, sorted by usage descending.\n:type entries: list[DiskUsageEntry]",
+        "properties": {
+          "entries": {
+            "items": {
+              "$ref": "#/components/schemas/report__DiskUsageEntry"
+            },
+            "title": "Entries",
+            "type": "array"
+          }
+        },
+        "title": "StorageSection",
+        "type": "object"
+      },
+      "report__UptimeEntry": {
+        "description": "Uptime for a single monitored service.",
+        "properties": {
+          "service_name": {
+            "title": "Service Name",
+            "type": "string"
+          },
+          "since": {
+            "default": "",
+            "title": "Since",
+            "type": "string"
+          },
+          "uptime": {
+            "format": "duration",
+            "title": "Uptime",
+            "type": "string"
+          }
+        },
+        "required": ["service_name", "uptime"],
+        "title": "UptimeEntry",
+        "type": "object"
+      },
+      "report__UptimeSection": {
+        "description": "Aggregated uptime data for the report.",
+        "properties": {
+          "entries": {
+            "items": {
+              "$ref": "#/components/schemas/report__UptimeEntry"
+            },
+            "title": "Entries",
+            "type": "array"
+          }
+        },
+        "title": "UptimeSection",
+        "type": "object"
+      },
+      "tasks__ExecutorHostMetadata": {
+        "description": "Represent one executor host option for display on the task detail page.\n\n:param value: The executor host value submitted with task execution\n    requests (Nomad node name).\n:type value: str\n:param label: The human-readable label for the host (often an inventory\n    display name).\n:type label: str",
+        "properties": {
+          "label": {
+            "title": "Label",
+            "type": "string"
+          },
+          "value": {
+            "title": "Value",
+            "type": "string"
+          }
+        },
+        "required": ["value", "label"],
+        "title": "ExecutorHostMetadata",
+        "type": "object"
+      },
+      "tasks__PaginatedResponse_TaskListResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/tasks__TaskListResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[TaskListResponse]",
+        "type": "object"
+      },
+      "tasks__PeriodicTaskSummary": {
+        "description": "Represent read-only periodic-schedule metadata for a single task.\n\n:param id: The periodic task's database identifier.\n:type id: int\n:param name: The periodic task's display name.\n:type name: str\n:param enabled: Whether the periodic schedule is currently enabled.\n:type enabled: bool\n:param period: A human-readable schedule description (cron or interval),\n    or ``None`` when unavailable.\n:type period: str | None\n:param next_run_at: The next scheduled run time in ISO 8601 format, or\n    ``None`` when not scheduled.\n:type next_run_at: UTCDatetime | None\n:param last_run_at: The last run time in ISO 8601 format, or ``None`` if\n    the schedule has never run.\n:type last_run_at: UTCDatetime | None\n:param total_run_count: The total number of times the schedule has run,\n    or ``None`` when unavailable.\n:type total_run_count: int | None\n:param last_run_status: The result of this schedule's own most recent run,\n    or ``None`` when the schedule has never run.\n:param chain_task_names: Ordered task names in the periodic execution\n    chain, if any.\n:type chain_task_names: list[str]",
+        "properties": {
+          "chain_task_names": {
+            "items": {
+              "type": "string"
+            },
+            "title": "Chain Task Names",
+            "type": "array"
+          },
+          "enabled": {
+            "title": "Enabled",
+            "type": "boolean"
+          },
+          "id": {
+            "title": "Id",
+            "type": "integer"
+          },
+          "last_run_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Run At"
+          },
+          "last_run_status": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "next_run_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Next Run At"
+          },
+          "period": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Period"
+          },
+          "total_run_count": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Total Run Count"
+          }
+        },
+        "required": ["id", "name", "enabled"],
+        "title": "PeriodicTaskSummary",
+        "type": "object"
+      },
+      "tasks__TaskDetailResponse": {
+        "description": "Represent the aggregate payload for ``GET /api/apps/tasks/{task_name}``.\n\nBundle the task definition, execution history, periodic schedules, and\nexecutor host metadata into a single response for the React detail page.\n\n:param task: The task definition as returned by the tasks API.\n:type task: TaskResponse\n:param execution_history: Paginated task history from the tasks API\n    (``items``, ``total``, ``offset``, ``limit``).\n:type execution_history: dict[str, Any]\n:param periodic_summary: Read-only summaries of periodic schedules\n    attached to this task.\n:type periodic_summary: list[PeriodicTaskSummary]\n:param executor_hosts: Executor hosts available for display, with\n    inventory-resolved labels when possible.\n:type executor_hosts: list[ExecutorHostMetadata]",
+        "properties": {
+          "execution_history": {
+            "title": "Execution History",
+            "type": "object"
+          },
+          "executor_hosts": {
+            "items": {
+              "$ref": "#/components/schemas/tasks__ExecutorHostMetadata"
+            },
+            "title": "Executor Hosts",
+            "type": "array"
+          },
+          "periodic_summary": {
+            "items": {
+              "$ref": "#/components/schemas/tasks__PeriodicTaskSummary"
+            },
+            "title": "Periodic Summary",
+            "type": "array"
+          },
+          "task": {
+            "$ref": "#/components/schemas/TaskResponse"
+          }
+        },
+        "required": ["task"],
+        "title": "TaskDetailResponse",
+        "type": "object"
+      },
+      "tasks__TaskListResponse": {
+        "description": "Represent one task row in the read-only tasks plugin list API.\n\n:param name: The unique name of the task.\n:type name: str\n:param backend: The backend system used for task execution.\n:type backend: TaskBackendEnum\n:param created_at: When the task was created, or ``None`` if unavailable.\n:type created_at: UTCDatetime | None\n:param created_by: Display name for the task creator (Casdoor username when\n    resolvable, otherwise the stored user id), or ``None`` if unknown.\n:type created_by: str | None\n:param last_updated_by: Display name for the user who last updated the\n    task (Casdoor username when resolvable, otherwise the stored user id),\n    or ``None`` if unknown.\n:type last_updated_by: str | None",
+        "properties": {
+          "backend": {
+            "$ref": "#/components/schemas/TaskBackendEnum"
+          },
+          "created_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created At"
+          },
+          "created_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created By"
+          },
+          "last_updated_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Updated By"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          }
+        },
+        "required": ["name", "backend"],
+        "title": "TaskListResponse",
+        "type": "object"
+      },
+      "topology__ClusterNode": {
+        "description": "Represent a synthetic cluster-group node in the topology graph.",
+        "properties": {
+          "data": {
+            "$ref": "#/components/schemas/topology__ClusterNodeData"
+          },
+          "id": {
+            "title": "Id",
+            "type": "string"
+          },
+          "type": {
+            "const": "cluster",
+            "enum": ["cluster"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["id", "type", "data"],
+        "title": "ClusterNode",
+        "type": "object"
+      },
+      "topology__ClusterNodeData": {
+        "description": "Represent the React-Flow ``data`` payload for a synthetic PXC cluster node.",
+        "properties": {
+          "cluster_name": {
+            "title": "Cluster Name",
+            "type": "string"
+          },
+          "members": {
+            "items": {
+              "type": "string"
+            },
+            "title": "Members",
+            "type": "array"
+          },
+          "size": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Size"
+          },
+          "status": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Status"
+          }
+        },
+        "required": ["cluster_name"],
+        "title": "ClusterNodeData",
+        "type": "object"
+      },
+      "topology__DualPrimaryEdge": {
+        "description": "Represent a dual-primary (mutually replicating) edge.",
+        "properties": {
+          "data": {
+            "title": "Data",
+            "type": "object"
+          },
+          "id": {
+            "title": "Id",
+            "type": "string"
+          },
+          "source": {
+            "title": "Source",
+            "type": "string"
+          },
+          "target": {
+            "title": "Target",
+            "type": "string"
+          },
+          "type": {
+            "const": "dual_primary",
+            "enum": ["dual_primary"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["id", "source", "target", "type"],
+        "title": "DualPrimaryEdge",
+        "type": "object"
+      },
+      "topology__MySQLClusterInfo": {
+        "description": "Represent Percona XtraDB Cluster (wsrep) metadata for a host.",
+        "properties": {
+          "cluster_name": {
+            "title": "Cluster Name",
+            "type": "string"
+          },
+          "cluster_size": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Cluster Size"
+          },
+          "cluster_status": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Cluster Status"
+          },
+          "local_state_comment": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Local State Comment"
+          }
+        },
+        "required": ["cluster_name"],
+        "title": "MySQLClusterInfo",
+        "type": "object"
+      },
+      "topology__MySQLNode": {
+        "description": "Represent a MySQL server node in the topology graph.",
+        "properties": {
+          "data": {
+            "$ref": "#/components/schemas/topology__MySQLNodeData"
+          },
+          "id": {
+            "title": "Id",
+            "type": "string"
+          },
+          "type": {
+            "const": "mysql",
+            "enum": ["mysql"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["id", "type", "data"],
+        "title": "MySQLNode",
+        "type": "object"
+      },
+      "topology__MySQLNodeData": {
+        "description": "Represent the React-Flow ``data`` payload for a MySQL node.",
+        "properties": {
+          "address": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Address"
+          },
+          "cluster": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/topology__MySQLClusterInfo"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "error": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Error"
+          },
+          "gtid_mode": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Gtid Mode"
+          },
+          "host_entry": {
+            "title": "Host Entry",
+            "type": "string"
+          },
+          "port": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Port"
+          },
+          "replication": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/topology__MySQLReplicationInfo"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "server": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/topology__MySQLServerInfo"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "status": {
+            "enum": ["ok", "error"],
+            "title": "Status",
+            "type": "string"
+          }
+        },
+        "required": ["host_entry", "status"],
+        "title": "MySQLNodeData",
+        "type": "object"
+      },
+      "topology__MySQLReplicationInfo": {
+        "description": "Represent replication source/state for a replica host (``source_uuid`` stripped).",
+        "properties": {
+          "auto_position": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Auto Position"
+          },
+          "io_running": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Io Running"
+          },
+          "repl_filter": {
+            "anyOf": [
+              {
+                "enum": ["yes", "none"],
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Repl Filter"
+          },
+          "repl_status": {
+            "anyOf": [
+              {
+                "enum": ["ok", "err"],
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Repl Status"
+          },
+          "seconds_behind": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Seconds Behind"
+          },
+          "source_host": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Source Host"
+          },
+          "source_port": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Source Port"
+          },
+          "source_server_id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Source Server Id"
+          },
+          "sql_running": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Sql Running"
+          }
+        },
+        "title": "MySQLReplicationInfo",
+        "type": "object"
+      },
+      "topology__MySQLServerInfo": {
+        "description": "Represent MySQL server identity/mode collected per host.",
+        "properties": {
+          "hostname": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Hostname"
+          },
+          "log_bin": {
+            "anyOf": [
+              {
+                "enum": ["ON", "OFF"],
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Log Bin"
+          },
+          "port": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Port"
+          },
+          "read_only": {
+            "anyOf": [
+              {
+                "enum": ["RW", "RO", "SR"],
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Read Only"
+          },
+          "server_hash": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Server Hash"
+          },
+          "server_id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Server Id"
+          },
+          "server_uuid": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Server Uuid"
+          },
+          "version": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Version"
+          }
+        },
+        "title": "MySQLServerInfo",
+        "type": "object"
+      },
+      "topology__ReplicationEdge": {
+        "description": "Represent a primary -> replica replication edge.",
+        "properties": {
+          "data": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/topology__ReplicationEdgeData"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "id": {
+            "title": "Id",
+            "type": "string"
+          },
+          "source": {
+            "title": "Source",
+            "type": "string"
+          },
+          "target": {
+            "title": "Target",
+            "type": "string"
+          },
+          "type": {
+            "const": "replication",
+            "enum": ["replication"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["id", "source", "target", "type"],
+        "title": "ReplicationEdge",
+        "type": "object"
+      },
+      "topology__ReplicationEdgeData": {
+        "description": "Represent the React-Flow ``data`` payload for a replication edge.",
+        "properties": {
+          "auto_position": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Auto Position"
+          },
+          "filter": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Filter"
+          },
+          "gtid_mode": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Gtid Mode"
+          },
+          "io_running": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Io Running"
+          },
+          "seconds_behind": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Seconds Behind"
+          },
+          "sql_running": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Sql Running"
+          },
+          "status": {
+            "anyOf": [
+              {
+                "enum": ["ok", "err"],
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Status"
+          }
+        },
+        "title": "ReplicationEdgeData",
+        "type": "object"
+      },
+      "topology__TopologyCollectResponse": {
+        "description": "Represent the response body for ``POST /collect``.\n\n``task_history_ids`` lists the dispatched ``run-python`` tasks the\nfrontend then polls (``/result``) to assemble the topology graph.\n``targets`` echoes the executor hosts the work was sharded across so\nthe UI can surface where the collection ran.\n\n:param task_history_ids: Created task history ids, one per shard.\n:param targets: Executor hosts selected for topology collection.\n:param host_count: Number of MySQL hosts included in the collection.\n:param shard_count: Number of dispatched topology shards.",
+        "properties": {
+          "host_count": {
+            "title": "Host Count",
+            "type": "integer"
+          },
+          "shard_count": {
+            "title": "Shard Count",
+            "type": "integer"
+          },
+          "targets": {
+            "items": {
+              "type": "string"
+            },
+            "title": "Targets",
+            "type": "array"
+          },
+          "task_history_ids": {
+            "items": {
+              "type": "integer"
+            },
+            "title": "Task History Ids",
+            "type": "array"
+          }
+        },
+        "required": [
+          "task_history_ids",
+          "targets",
+          "host_count",
+          "shard_count"
+        ],
+        "title": "TopologyCollectResponse",
+        "type": "object"
+      },
+      "topology__TopologyCollectWrite": {
+        "description": "Describe the request body for ``POST /collect``.\n\n:param shards: Number of executor hosts to dispatch in parallel. Hosts\n    are split round-robin across the chosen executors. Capped at\n    :data:`MAX_TOPOLOGY_SHARDS`.\n:param executor_host: Optional explicit executor. Must be used with\n    ``shards=1`` because it selects a single-shard run.\n:param connect_timeout: Per-host MySQL TCP connect timeout (seconds).\n:param read_timeout: Per-host MySQL read/write timeout (seconds).",
+        "properties": {
+          "connect_timeout": {
+            "default": 5,
+            "maximum": 60.0,
+            "minimum": 1.0,
+            "title": "Connect Timeout",
+            "type": "integer"
+          },
+          "executor_host": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Executor Host"
+          },
+          "read_timeout": {
+            "default": 10,
+            "maximum": 120.0,
+            "minimum": 1.0,
+            "title": "Read Timeout",
+            "type": "integer"
+          },
+          "shards": {
+            "default": 1,
+            "maximum": 8.0,
+            "minimum": 1.0,
+            "title": "Shards",
+            "type": "integer"
+          }
+        },
+        "title": "TopologyCollectWrite",
+        "type": "object"
+      },
+      "topology__TopologyGraph": {
+        "description": "Represent the merged React-Flow ``{nodes, edges, summary}`` graph.",
+        "properties": {
+          "edges": {
+            "items": {
+              "discriminator": {
+                "mapping": {
+                  "dual_primary": "#/components/schemas/topology__DualPrimaryEdge",
+                  "replication": "#/components/schemas/topology__ReplicationEdge"
+                },
+                "propertyName": "type"
+              },
+              "oneOf": [
+                {
+                  "$ref": "#/components/schemas/topology__ReplicationEdge"
+                },
+                {
+                  "$ref": "#/components/schemas/topology__DualPrimaryEdge"
+                }
+              ]
+            },
+            "title": "Edges",
+            "type": "array"
+          },
+          "nodes": {
+            "items": {
+              "discriminator": {
+                "mapping": {
+                  "cluster": "#/components/schemas/topology__ClusterNode",
+                  "mysql": "#/components/schemas/topology__MySQLNode",
+                  "unknown_source": "#/components/schemas/topology__UnknownSourceNode"
+                },
+                "propertyName": "type"
+              },
+              "oneOf": [
+                {
+                  "$ref": "#/components/schemas/topology__MySQLNode"
+                },
+                {
+                  "$ref": "#/components/schemas/topology__ClusterNode"
+                },
+                {
+                  "$ref": "#/components/schemas/topology__UnknownSourceNode"
+                }
+              ]
+            },
+            "title": "Nodes",
+            "type": "array"
+          },
+          "summary": {
+            "$ref": "#/components/schemas/topology__TopologyGraphSummary"
+          }
+        },
+        "required": ["summary"],
+        "title": "TopologyGraph",
+        "type": "object"
+      },
+      "topology__TopologyGraphSummary": {
+        "description": "Aggregate counts for the topology graph.",
+        "properties": {
+          "cluster_count": {
+            "title": "Cluster Count",
+            "type": "integer"
+          },
+          "edge_count": {
+            "title": "Edge Count",
+            "type": "integer"
+          },
+          "error_count": {
+            "title": "Error Count",
+            "type": "integer"
+          },
+          "host_count": {
+            "title": "Host Count",
+            "type": "integer"
+          },
+          "ok_count": {
+            "title": "Ok Count",
+            "type": "integer"
+          }
+        },
+        "required": [
+          "host_count",
+          "ok_count",
+          "error_count",
+          "cluster_count",
+          "edge_count"
+        ],
+        "title": "TopologyGraphSummary",
+        "type": "object"
+      },
+      "topology__TopologyResultResponse": {
+        "description": "Represent the response body for ``GET /result``.\n\n``status`` is ``running`` while any of the underlying tasks is\nstill pending, ``ok`` once every task has finished, and ``failed``\nwhen at least one task failed and produced no usable output.\n``graph`` is the merged React-Flow graph; ``pending_task_ids``\nlists the still-running tasks for the UI's progress chip, and\n``failed_task_ids`` lets the UI warn when only some shards failed.\n\n:param status: Aggregate topology collection status.\n:param graph: Merged React-Flow graph when collection output is ready.\n:param pending_task_ids: Task ids still pending or running.\n:param failed_task_ids: Terminal task ids that did not finish successfully.",
+        "properties": {
+          "failed_task_ids": {
+            "items": {
+              "type": "integer"
+            },
+            "title": "Failed Task Ids",
+            "type": "array"
+          },
+          "graph": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/topology__TopologyGraph"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "pending_task_ids": {
+            "items": {
+              "type": "integer"
+            },
+            "title": "Pending Task Ids",
+            "type": "array"
+          },
+          "status": {
+            "enum": ["running", "ok", "failed"],
+            "title": "Status",
+            "type": "string"
+          }
+        },
+        "required": ["status"],
+        "title": "TopologyResultResponse",
+        "type": "object"
+      },
+      "topology__UnknownSourceNode": {
+        "description": "Represent a synthetic node for a replication source absent from inventory.",
+        "properties": {
+          "data": {
+            "$ref": "#/components/schemas/topology__UnknownSourceNodeData"
+          },
+          "id": {
+            "title": "Id",
+            "type": "string"
+          },
+          "type": {
+            "const": "unknown_source",
+            "enum": ["unknown_source"],
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["id", "type", "data"],
+        "title": "UnknownSourceNode",
+        "type": "object"
+      },
+      "topology__UnknownSourceNodeData": {
+        "description": "Represent the React-Flow ``data`` payload for a replication source not in inventory.",
+        "properties": {
+          "address": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Address"
+          },
+          "port": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Port"
+          },
+          "reason": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Reason"
+          }
+        },
+        "title": "UnknownSourceNodeData",
+        "type": "object"
+      }
+    }
+  },
+  "info": {
+    "description": "Percona Services Enablement Platform\n\nBrowser-oriented SEP routes (HTML, redirects, proxies, streams). JSON REST APIs for inventory and tasks live on the mounted sub-apps.",
+    "title": "SEP Web Application API",
+    "version": "v1.0.0.dev0"
+  },
+  "openapi": "3.1.0",
+  "paths": {
+    "/api/admin/apps/": {
+      "get": {
+        "description": "List every configured app with its current enabled state.\n\nReturns one entry per registered app, in declaration order (each parent is\nimmediately followed by its child apps). Apps with no row default to\n``ENABLED`` (``enabled=True``, ``toggleable=True``); protected apps\n(``inventory``) are forced to ``ENABLED`` and reported with\n``toggleable=False``. A child app (``parent_key`` set) is not independently\ntoggleable either (``toggleable=False``) and derives its lifecycle from the\nparent via :attr:`~app.sep.apps.framework.base.BaseApp.state_key`. The list is\nnon-paginated: app cardinality is bounded (<20).\n\n:param session: The database session.\n:return: The per-app info list.",
+        "operationId": "admin_list_apps_api_admin_apps__get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "items": {
+                    "$ref": "#/components/schemas/AppInfoResponse"
+                  },
+                  "title": "Response Admin List Apps Api Admin Apps  Get",
+                  "type": "array"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "List Apps",
+        "tags": ["admin"]
+      }
+    },
+    "/api/admin/apps/{app_key}/force-disable": {
+      "post": {
+        "description": "Force a draining app straight to ``DISABLED``, terminating its tasks.\n\nThe emergency escape hatch when a cooperative drain stalls: it terminates\neach of the app's in-flight tasks with ``revoke(..., terminate=True)``\n(SIGTERM), deletes their :class:`app.sep.models.AppRunningTask` rows, and\ntransitions the app to ``DISABLED``. Requires the app to already be\n``DISABLING`` (else 409); the default toggle path (``PUT .../state``) never\nissues a terminating revoke. No periodic re-gating is needed — the owned\nschedules were already gated off at the ``DISABLING`` write.\n\n:param app_key: The app to force-disable.\n:param session: The SEP database session.\n:return: The resulting ``DISABLED`` app-state response.\n:raises HTTPConflictException: When the app is not currently ``DISABLING``.",
+        "operationId": "admin_force_disable_app_api_admin_apps__app_key__force_disable_post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "app_key",
+            "required": true,
+            "schema": {
+              "title": "App Key",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AppStateResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Force Disable App",
+        "tags": ["admin"]
+      }
+    },
+    "/api/admin/apps/{app_key}/state": {
+      "put": {
+        "description": "Transition an app to a new lifecycle state.\n\nValidates the requested edge against the allowed transitions\n(``ENABLED`` -> ``DISABLING``, ``DISABLED`` -> ``ENABLING``,\n``DISABLING`` -> ``DISABLED``, ``ENABLING`` -> ``ENABLED``); an illegal edge\nreturns 409. Returns 409 for protected apps (``inventory``) and 404 if the\nkey does not match any configured plugin. A configured app with no row yet is\ntreated as ``ENABLED`` for the gate and gets its row created with the\nrequested state. Returns the updated row as an :class:`AppStateResponse`\n(the return annotation drives FastAPI's response schema).\n\nAfter the ``AppState`` write commits, the app's owned periodic schedules are\nre-gated via :func:`app.sep.periodic_tasks.apply_effective_enabled` so a\nnon-``ENABLED`` app also stops its Celery beat tasks (and a return to\n``ENABLED`` resumes them, subject to each schedule's ``user_enabled``\noverride).\n\nA ``DISABLING`` transition on an app with no in-flight tasks drains\nimmediately: :func:`app.sep.app_drain.finalize_drain_if_complete` flips it\nstraight to ``DISABLED`` (no ``task_postrun`` event will ever fire for an idle\napp), and the response reflects that resulting ``DISABLED`` state.\n\nAn ``ENABLING`` transition completes synchronously: there is no warm-up to\nwait for and nothing else ever advances ``ENABLING``, so it is flipped\nstraight to ``ENABLED`` (before re-gating, so the app's schedules resume in\nthe same request) and the response reflects that resulting ``ENABLED`` state.\n\n:param app_key: The app key to transition.\n:type app_key: str\n:param body: The requested target lifecycle state.\n:type body: AppStateWrite\n:param session: The SEP database session.\n:type session: SessionDep\n:param celery_beat_session: The celery-beat database session.\n:return: The updated app-state response payload.\n:rtype: AppStateResponse\n:raises HTTPConflictException: When the requested transition edge is illegal.",
+        "operationId": "admin_update_app_state_api_admin_apps__app_key__state_put",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "app_key",
+            "required": true,
+            "schema": {
+              "title": "App Key",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AppStateWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AppStateResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Update App State",
+        "tags": ["admin"]
+      }
+    },
+    "/api/apps/": {
+      "get": {
+        "description": "Return per-app state for the current user's navigation.\n\nProtected apps are always reported ``enabled=True``. Every other app reflects\nits *effective* state via :meth:`AppRegistry.resolve_effective_enabled`: its\nown row must be ``ENABLED`` (a missing row -> ``enabled=True``: a configured\nplugin is active until explicitly disabled) **and** every app it declares in\n``requires_apps`` must be effectively enabled, so the shell hides an app when\na dependency is off. A child app owns no row, so it resolves through its\nparent via :attr:`~app.sep.apps.framework.base.BaseApp.state_key`.\n\n:param session: The database session.\n:return: The per-app navigation list.",
+        "operationId": "apps_list_apps_for_navigation_api_apps__get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "items": {
+                    "$ref": "#/components/schemas/AppKeyResponse"
+                  },
+                  "title": "Response Apps List Apps For Navigation Api Apps  Get",
+                  "type": "array"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "List Apps For Navigation",
+        "tags": ["apps", "apps"]
+      }
+    },
+    "/api/apps/alert_troubleshooting/": {
+      "get": {
+        "description": "Return alerts grouped by service type.\n\n:param session: The database session.\n:type session: SessionDep\n:return: A list of alert groups, each containing alerts for a service type.\n:rtype: list[AlertGroup]",
+        "operationId": "alert_troubleshooting_alert_troubleshooting_api_list_api_apps_alert_troubleshooting__get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "items": {
+                    "$ref": "#/components/schemas/alert_troubleshooting__AlertGroup"
+                  },
+                  "title": "Response Alert Troubleshooting Alert Troubleshooting Api List Api Apps Alert Troubleshooting  Get",
+                  "type": "array"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Alert Troubleshooting Api List",
+        "tags": ["alert_troubleshooting"]
+      }
+    },
+    "/api/apps/alert_troubleshooting/schema": {
+      "get": {
+        "description": "Return the plugin schema captured at registration time.\n\n:return: The plugin schema instance.",
+        "operationId": "alert_troubleshooting_get_schema_api_apps_alert_troubleshooting_schema_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__AppSchema"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Get Schema",
+        "tags": ["alert_troubleshooting"]
+      }
+    },
+    "/api/apps/alert_troubleshooting/{service_type}/{alert_name}": {
+      "get": {
+        "description": "Return alert info and associated snippets for a specific alert.\n\n:param service_type: The service type of the alert.\n:type service_type: AlertServiceType\n:param alert_name: The alert name identifier.\n:type alert_name: str\n:param session: The database session.\n:type session: SessionDep\n:return: Alert info and associated snippets.\n:rtype: AlertDetailResponse\n:raises HTTPNotFoundException: If no snippets match the alert.",
+        "operationId": "alert_troubleshooting_alert_troubleshooting_api_detail_api_apps_alert_troubleshooting__service_type___alert_name__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "service_type",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/AlertServiceType"
+            }
+          },
+          {
+            "in": "path",
+            "name": "alert_name",
+            "required": true,
+            "schema": {
+              "maxLength": 200,
+              "minLength": 1,
+              "title": "Alert Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/alert_troubleshooting__AlertDetailResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Alert Troubleshooting Api Detail",
+        "tags": ["alert_troubleshooting"]
+      }
+    },
+    "/api/apps/alerts/": {
+      "get": {
+        "description": "Return everything the React list page needs in a single call.\n\nMirror the data assembled for the deprecated Jinja index view\n(:func:`app.sep.apps.alerts.deps.get_alerts_index_context`) as JSON:\nalert templates grouped by service type, PMM connectivity, the PagerDuty\ncontact-point status, and the most recent backups.\n\n``present_names`` is ``None`` when PMM is unconfigured or unreachable, which\nis the same signal used to drive ``pmm_connected`` and per-template\n``in_pmm`` flags so the UI degrades gracefully.\n\n:param alert_templates: Local alert templates grouped by service type.\n:type alert_templates: AlertTemplatesDep\n:param present_names: Template names already present in PMM, or ``None`` when\n    PMM is unreachable.\n:type present_names: set[str] | None\n:param recent_backups: The most recent alert backups, newest first.\n:type recent_backups: list[AlertBackup]\n:param pagerduty_status: PagerDuty contact-point status, or ``None`` when PMM\n    is unreachable.\n:type pagerduty_status: dict[str, Any] | None\n:return: The aggregated index payload.\n:rtype: IndexResponse",
+        "operationId": "alerts_alerts_api_index_api_apps_alerts__get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/alerts__IndexResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Alerts Api Index",
+        "tags": ["alerts"]
+      }
+    },
+    "/api/apps/alerts/backups": {
+      "get": {
+        "description": "Return a paginated page of alert backups, newest first.\n\n:param session: The async database session.\n:type session: SessionDep\n:param pagination: Validated offset/limit query parameters (``limit`` capped at 100).\n:type pagination: Pagination\n:return: A paginated envelope of backup summaries ordered by\n    ``created_at`` descending.\n:rtype: PaginatedResponse[BackupSummary]",
+        "operationId": "alerts_alerts_api_list_backups_api_apps_alerts_backups_get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 100,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/alerts__PaginatedResponse_BackupSummary_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Alerts Api List Backups",
+        "tags": ["alerts"]
+      }
+    },
+    "/api/apps/alerts/backups/{backup_id}": {
+      "get": {
+        "description": "Return a categorised view of a single backup.\n\n:param session: The async database session.\n:type session: SessionDep\n:param backup_id: Primary key of the backup row.\n:type backup_id: int\n:return: The full backup detail.\n:rtype: BackupDetail\n:raises HTTPNotFoundException: If the backup is not found.",
+        "operationId": "alerts_alerts_api_get_backup_api_apps_alerts_backups__backup_id__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "backup_id",
+            "required": true,
+            "schema": {
+              "title": "Backup Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/alerts__BackupDetail"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Alerts Api Get Backup",
+        "tags": ["alerts"]
+      }
+    },
+    "/api/apps/alerts/pagerduty": {
+      "post": {
+        "description": "Create or update the PagerDuty contact point and notification route.\n\nMirror :func:`app.sep.apps.alerts.routes.pagerduty_save` over JSON.\n\n:param payload: PagerDuty save request body.\n:type payload: PagerDutyRequest\n:param pmm_api: The PMM API client. Raises 503 if PMM is not configured.\n:type pmm_api: PMMRemoteAPI\n:return: ``status=\"created\"`` or ``status=\"updated\"``.\n:rtype: PagerDutyResponse\n:raises HTTPBadGatewayException: If the PMM upstream call fails.",
+        "operationId": "alerts_alerts_api_pagerduty_save_api_apps_alerts_pagerduty_post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/alerts__PagerDutyRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/alerts__PagerDutyResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Alerts Api Pagerduty Save",
+        "tags": ["alerts"]
+      }
+    },
+    "/api/apps/alerts/pagerduty/delete": {
+      "post": {
+        "description": "Delete the PagerDuty contact point and remove its notification route.\n\n:param pmm_api: The PMM API client. Raises 503 if PMM is not configured.\n:type pmm_api: PMMRemoteAPI\n:return: ``status=\"deleted\"``.\n:rtype: PagerDutyResponse\n:raises HTTPNotFoundException: If no PagerDuty contact point exists.\n:raises HTTPBadGatewayException: If the PMM upstream call fails.",
+        "operationId": "alerts_alerts_api_pagerduty_delete_api_apps_alerts_pagerduty_delete_post",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/alerts__PagerDutyResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Alerts Api Pagerduty Delete",
+        "tags": ["alerts"]
+      }
+    },
+    "/api/apps/alerts/push": {
+      "post": {
+        "description": "Push selected alert templates to PMM as rules.\n\nMirror :func:`app.sep.apps.alerts.routes.alerts_push` over JSON.\nPreserve the conflict-retry path: on ``create_rule`` collision call\n:func:`app.sep.apps.alerts.restore.delete_conflicting_rules` and\nretry once.\n\n:param payload: Push request body listing template names to push.\n:type payload: PushRequest\n:param pmm_api: The PMM API client. Raises 503 if PMM is not configured.\n:type pmm_api: PMMRemoteAPI\n:param alert_templates: Local alert templates grouped by service type.\n:type alert_templates: AlertTemplatesDep\n:param folder: The PMM alert folder. Raises 502 if unreachable.\n:type folder: Folder\n:param present_names: Template names already present in PMM, or ``None`` if\n    PMM is unreachable for the listing call.\n:type present_names: set[str] | None\n:return: A ``PushResponse`` with one :class:`PushItemResult` per template.\n:rtype: PushResponse",
+        "operationId": "alerts_alerts_api_push_api_apps_alerts_push_post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/alerts__PushRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/alerts__PushResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Alerts Api Push",
+        "tags": ["alerts"]
+      }
+    },
+    "/api/apps/alerts/restore": {
+      "post": {
+        "description": "Restore alert configuration from a backup snapshot.\n\n:param payload: Restore request body identifying the backup to apply.\n:type payload: RestoreRequest\n:param pmm_api: The PMM API client. Raises 503 if PMM is not configured.\n:type pmm_api: PMMRemoteAPI\n:param session: The async database session.\n:type session: SessionDep\n:return: A ``RestoreResponse`` with the per-section restore counts.\n:rtype: RestoreResponse\n:raises HTTPNotFoundException: If the backup is not found.\n:raises HTTPBadGatewayException: If the PMM upstream call fails with\n    ``OSError``.",
+        "operationId": "alerts_alerts_api_restore_api_apps_alerts_restore_post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/alerts__RestoreRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/alerts__RestoreResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Alerts Api Restore",
+        "tags": ["alerts"]
+      }
+    },
+    "/api/apps/alters/": {
+      "get": {
+        "operationId": "alters__list_paginated_api_apps_alters__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 50,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "service_type",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "$ref": "#/components/schemas/ServiceTypeEnum"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Service Type"
+            }
+          },
+          {
+            "in": "query",
+            "name": "status",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Status"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/alters__PaginatedResponse_AltersTaskResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "List",
+        "tags": ["alters"]
+      },
+      "post": {
+        "description": "Create an alters task group from a JSON payload request body.",
+        "operationId": "alters_alters_api_create_api_apps_alters__post",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "check_connectivity",
+            "required": false,
+            "schema": {
+              "default": true,
+              "title": "Check Connectivity",
+              "type": "boolean"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/alters__AltersCreate"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__AltersTaskResponseCreate"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Alters Api Create",
+        "tags": ["alters"]
+      }
+    },
+    "/api/apps/alters/schema": {
+      "get": {
+        "description": "Return the plugin schema captured at registration time.\n\n:return: The plugin schema instance.",
+        "operationId": "alters_get_schema_api_apps_alters_schema_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__AppSchema"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Get Schema",
+        "tags": ["alters"]
+      }
+    },
+    "/api/apps/alters/{task_name}": {
+      "delete": {
+        "description": "Delete an alters task group.",
+        "operationId": "alters_alters_api_delete_api_apps_alters__task_name__delete",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Alters Api Delete",
+        "tags": ["alters"]
+      },
+      "get": {
+        "description": "Retrieve a single parent alters task.",
+        "operationId": "alters_alters_api_detail_api_apps_alters__task_name__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/alters__AltersTaskResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Alters Api Detail",
+        "tags": ["alters"]
+      },
+      "put": {
+        "description": "Update an alters task group from a JSON payload request body.\n\n:param check_connectivity: Whether to verify the target database is\n    reachable after the update. Defaults to ``True``; pass\n    ``check_connectivity=false`` to opt out. Note that the form flow\n    defaults to ``False`` (HTML checkbox semantics); this asymmetry is\n    intentional.\n:type check_connectivity: bool",
+        "operationId": "alters_alters_api_update_api_apps_alters__task_name__put",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "check_connectivity",
+            "required": false,
+            "schema": {
+              "default": true,
+              "title": "Check Connectivity",
+              "type": "boolean"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/alters__AltersCreate"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__AltersTaskResponseUpdate"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Alters Api Update",
+        "tags": ["alters"]
+      }
+    },
+    "/api/apps/alters/{task_name}/execute": {
+      "post": {
+        "description": "Execute an alters task (parent, dry-run, or pre-checks).",
+        "operationId": "alters_alters_api_execute_api_apps_alters__task_name__execute_post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/framework__TaskExecuteWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__TaskExecutionResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Alters Api Execute",
+        "tags": ["alters"]
+      }
+    },
+    "/api/apps/archives/": {
+      "get": {
+        "operationId": "archives__list_paginated_api_apps_archives__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "status",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Status"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__PaginatedResponse_BaseTaskResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "List",
+        "tags": ["archives"]
+      },
+      "post": {
+        "operationId": "archives__create_api_apps_archives__post",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "check_connectivity",
+            "required": false,
+            "schema": {
+              "default": true,
+              "title": "Check Connectivity",
+              "type": "boolean"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/archives__ArchivesCreate"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__BaseTaskResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Create",
+        "tags": ["archives"]
+      }
+    },
+    "/api/apps/archives/schema": {
+      "get": {
+        "description": "Return the plugin schema captured at registration time.\n\n:return: The plugin schema instance.",
+        "operationId": "archives_get_schema_api_apps_archives_schema_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__AppSchema"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Get Schema",
+        "tags": ["archives"]
+      }
+    },
+    "/api/apps/archives/{task_name}": {
+      "delete": {
+        "operationId": "archives__delete_api_apps_archives__task_name__delete",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Delete",
+        "tags": ["archives"]
+      },
+      "get": {
+        "operationId": "archives__detail_api_apps_archives__task_name__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__BaseTaskResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Detail",
+        "tags": ["archives"]
+      },
+      "put": {
+        "operationId": "archives__update_api_apps_archives__task_name__put",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "check_connectivity",
+            "required": false,
+            "schema": {
+              "default": true,
+              "title": "Check Connectivity",
+              "type": "boolean"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/archives__ArchivesCreate"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__BaseTaskResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Update",
+        "tags": ["archives"]
+      }
+    },
+    "/api/apps/archives/{task_name}/execute": {
+      "post": {
+        "description": "Resolve, dispatch, and wrap a standard task execution.",
+        "operationId": "archives_archives_api_execute_api_apps_archives__task_name__execute_post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/framework__TaskExecuteWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__TaskExecutionResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Archives Api Execute",
+        "tags": ["archives"]
+      }
+    },
+    "/api/apps/atw/": {
+      "get": {
+        "description": "List ATW-tagged snippets grouped by category.\n\nCategories with no matching snippets are omitted to keep the payload small;\nthe ATW enum still defines the full taxonomy for validation (plugin schema).\n\n:param session: The database session.\n:return: One listing row per category that has at least one snippet.",
+        "operationId": "atw_atw_api_list_api_apps_atw__get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "items": {
+                    "$ref": "#/components/schemas/atw__ATWCategoryListing"
+                  },
+                  "title": "Response Atw Atw Api List Api Apps Atw  Get",
+                  "type": "array"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Atw Api List",
+        "tags": ["atw"]
+      }
+    },
+    "/api/apps/atw/config/": {
+      "get": {
+        "description": "Report whether the incident send action is available.\n\nNot gated by the send guard -- this endpoint is what reports that guard, so\nit must answer whether or not a receiver is configured.\n\n:return: The reasons the send action is withheld; empty when it is offered.",
+        "operationId": "atw_atw_config_api_apps_atw_config__get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/atw__AtwConfigResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Atw Config",
+        "tags": ["atw"]
+      }
+    },
+    "/api/apps/atw/execution-schema/": {
+      "get": {
+        "description": "Build one execution form covering several snippets, merging common parameters.\n\nUnknown or unsafe filenames fail the whole request — a form the caller cannot\nfill for every selected snippet is not a partial success.\n\n:param snippet_filename: The selected snippet filenames, repeated per snippet\n    and deduplicated order-preserving.\n:return: The shared section followed by each snippet's remaining fields.\n:raises HTTPBadRequestException: When a filename is unsafe or malformed, failing\n    the whole request before any item is dispatched.\n:raises HTTPNotFoundException: When a filename matches no snippet.",
+        "operationId": "atw_atw_execution_schema_api_apps_atw_execution_schema__get",
+        "parameters": [
+          {
+            "description": "Snippet filenames to build a batch form for.",
+            "in": "query",
+            "name": "snippet_filename",
+            "required": true,
+            "schema": {
+              "description": "Snippet filenames to build a batch form for.",
+              "items": {
+                "type": "string"
+              },
+              "maxItems": 50,
+              "minItems": 1,
+              "title": "Snippet Filename",
+              "type": "array"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/atw__ATWMergedSchemaResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Atw Execution Schema",
+        "tags": ["atw"]
+      }
+    },
+    "/api/apps/atw/incidents/": {
+      "get": {
+        "description": "List diagnostic incidents, newest first.\n\n:param session: The database session.\n:param pagination: The offset/limit window for the page.\n:return: A paginated page of incidents, newest first.",
+        "operationId": "atw_atw_list_incidents_api_apps_atw_incidents__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/atw__PaginatedResponse_AtwIncidentResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Atw List Incidents",
+        "tags": ["atw"]
+      },
+      "post": {
+        "description": "Create a diagnostic incident owned by the current user.\n\n:param session: The database session.\n:param current_user: The authenticated user, stamped as ``created_by``.\n:param body: The incident create payload.\n:return: The created incident.",
+        "operationId": "atw_atw_create_incident_api_apps_atw_incidents__post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/atw__AtwIncidentWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/atw__AtwIncidentResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Atw Create Incident",
+        "tags": ["atw"]
+      }
+    },
+    "/api/apps/atw/incidents/{incident_id}": {
+      "delete": {
+        "description": "Delete a diagnostic incident and cascade its execution rows.\n\n:param session: The database session.\n:param incident: The incident resolved from the ``incident_id`` path parameter.",
+        "operationId": "atw_atw_delete_incident_api_apps_atw_incidents__incident_id__delete",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "incident_id",
+            "required": true,
+            "schema": {
+              "format": "uuid4",
+              "title": "Incident Id",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Atw Delete Incident",
+        "tags": ["atw"]
+      },
+      "get": {
+        "description": "Retrieve a single diagnostic incident by id.\n\n:param incident: The incident resolved from the ``incident_id`` path parameter.\n:return: The matching incident.",
+        "operationId": "atw_atw_get_incident_api_apps_atw_incidents__incident_id__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "incident_id",
+            "required": true,
+            "schema": {
+              "format": "uuid4",
+              "title": "Incident Id",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/atw__AtwIncidentResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Atw Get Incident",
+        "tags": ["atw"]
+      },
+      "patch": {
+        "description": "Update a diagnostic incident's name or support-case reference.\n\n:param session: The database session.\n:param incident: The incident resolved from the ``incident_id`` path parameter.\n:param body: The partial update payload; unset fields are untouched.\n:return: The updated incident.",
+        "operationId": "atw_atw_update_incident_api_apps_atw_incidents__incident_id__patch",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "incident_id",
+            "required": true,
+            "schema": {
+              "format": "uuid4",
+              "title": "Incident Id",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/atw__AtwIncidentUpdate"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/atw__AtwIncidentResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Atw Update Incident",
+        "tags": ["atw"]
+      }
+    },
+    "/api/apps/atw/incidents/{incident_id}/executions/": {
+      "get": {
+        "description": "List one incident's snippet executions, newest first, with live task status.\n\nEach row also reports the command line its snippet ran with, credential values\nmasked. A row whose snippet or upstream payload cannot supply what masking\nneeds reports its arguments as withheld; the page still returns.\n\n:param session: The database session.\n:param incident: The incident resolved from the ``incident_id`` path parameter.\n:param pagination: The offset/limit window for the page.\n:param tasks_api: The authenticated Tasks API client.\n:return: A paginated page of executions hydrated from the Tasks API, each with\n    its masked arguments or the reason they are absent.",
+        "operationId": "atw_atw_list_incident_executions_api_apps_atw_incidents__incident_id__executions__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "incident_id",
+            "required": true,
+            "schema": {
+              "format": "uuid4",
+              "title": "Incident Id",
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/atw__PaginatedResponse_ATWIncidentExecutionResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Atw List Incident Executions",
+        "tags": ["atw"]
+      },
+      "post": {
+        "description": "Execute several snippets against one incident, reporting each item separately.\n\nA malformed selection fails the whole request up front: ``resolve_snippets``\nruns the traversal guard over every filename before dispatch, so an unsafe\nfilename raises before any item runs. Past that guard, one failing item never\nblocks the rest: each is dispatched and recorded inside its own guard, and the\nresponse always carries an entry per requested item — an unresolved filename\nbecomes that item's error. A failed attempt produces no task-history row to\nreference, so it is reported here rather than persisted.\n\nThe row-write guard rolls the shared session back before the loop continues,\nor one failed write would leave the transaction aborted and doom every later\nitem on PostgreSQL; the dispatch guard rolls back defensively, having written\nnothing itself. ``incident.id`` is read once up front because both a commit and\na rollback expire the instance, and re-reading it would trigger a lazy load.\n\n:param session: The database session.\n:param incident: The incident resolved from the ``incident_id`` path parameter.\n:param body: The batch payload.\n:param tasks_api: The authenticated Tasks API client.\n:return: One outcome entry per requested item, in request order.\n:raises HTTPBadRequestException: When any filename is unsafe or malformed,\n    failing the whole request before any item is dispatched.",
+        "operationId": "atw_atw_batch_execute_api_apps_atw_incidents__incident_id__executions__post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "incident_id",
+            "required": true,
+            "schema": {
+              "format": "uuid4",
+              "title": "Incident Id",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/atw__ATWBatchExecuteWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/atw__ATWBatchExecuteResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Atw Batch Execute",
+        "tags": ["atw"]
+      }
+    },
+    "/api/apps/atw/incidents/{incident_id}/send-jobs/": {
+      "get": {
+        "description": "List one incident's diagnostics send attempts, newest first.\n\n:param session: The database session.\n:param incident: The incident resolved from the ``incident_id`` path parameter.\n:param pagination: The offset/limit window for the page.\n:return: A paginated page of send attempts, newest first.",
+        "operationId": "atw_atw_list_send_jobs_api_apps_atw_incidents__incident_id__send_jobs__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "incident_id",
+            "required": true,
+            "schema": {
+              "format": "uuid4",
+              "title": "Incident Id",
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/atw__PaginatedResponse_AtwSendLogResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Atw List Send Jobs",
+        "tags": ["atw"]
+      },
+      "post": {
+        "description": "Start delivering the selected executions' output files and logs to the support case.\n\nThe row is created before the task is queued so a broker failure is still\nrecorded as a failed attempt rather than vanishing: the row is the only place\na support engineer can see that a send was ever tried.\n\n:param session: The database session.\n:param incident: The incident resolved from the ``incident_id`` path parameter.\n:param current_user: The authenticated user, stamped as ``requested_by``.\n:param body: The send payload naming the case reference and executions.\n:return: The created send log, pending.\n:raises HTTPUnprocessableEntityException: When an execution id does not belong\n    to this incident.\n:raises HTTPServiceUnavailableException: When the send could not be queued.\n:raises HTTPBadRequestException: Propagated from the manager when the row\n    cannot be written.",
+        "operationId": "atw_atw_start_send_job_api_apps_atw_incidents__incident_id__send_jobs__post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "incident_id",
+            "required": true,
+            "schema": {
+              "format": "uuid4",
+              "title": "Incident Id",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/atw__AtwSendJobWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "202": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/atw__AtwSendLogResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Atw Start Send Job",
+        "tags": ["atw"]
+      }
+    },
+    "/api/apps/atw/incidents/{incident_id}/send-jobs/{send_job_id}": {
+      "get": {
+        "description": "Retrieve one diagnostics send attempt, for the dialog to poll.\n\n:param session: The database session.\n:param incident: The incident resolved from the ``incident_id`` path parameter.\n:param send_job_id: The send attempt's UUID.\n:return: The matching send attempt.\n:raises HTTPNotFoundException: If this incident has no such attempt.",
+        "operationId": "atw_atw_get_send_job_api_apps_atw_incidents__incident_id__send_jobs__send_job_id__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "send_job_id",
+            "required": true,
+            "schema": {
+              "format": "uuid4",
+              "title": "Send Job Id",
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "incident_id",
+            "required": true,
+            "schema": {
+              "format": "uuid4",
+              "title": "Incident Id",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/atw__AtwSendLogResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Atw Get Send Job",
+        "tags": ["atw"]
+      }
+    },
+    "/api/apps/atw/schema": {
+      "get": {
+        "description": "Return the plugin schema captured at registration time.\n\n:return: The plugin schema instance.",
+        "operationId": "atw_get_schema_api_apps_atw_schema_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__AppSchema"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Get Schema",
+        "tags": ["atw"]
+      }
+    },
+    "/api/apps/backup_mongo/": {
+      "get": {
+        "operationId": "backup_mongo__list_paginated_api_apps_backup_mongo__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "status",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Status"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/backup_mongo__PaginatedResponse_BackupTaskResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "List",
+        "tags": ["backup_mongo"]
+      },
+      "post": {
+        "description": "Create a backup task group from a JSON payload request body.",
+        "operationId": "backup_mongo_backup_mongo_api_create_api_apps_backup_mongo__post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/backup_mongo__BackupTaskWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/backup_mongo__BackupTaskDetailResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Backup Mongo Api Create",
+        "tags": ["backup_mongo"]
+      }
+    },
+    "/api/apps/backup_mongo/restore/": {
+      "get": {
+        "description": "List parent PBM restore config tasks.",
+        "operationId": "backup_mongo_restore_restore_mongo_api_list_api_apps_backup_mongo_restore__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "status",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Status"
+            }
+          },
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/backup_mongo__PaginatedResponse_RestoreTaskResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Restore Mongo Api List",
+        "tags": ["backup_mongo/restore"]
+      },
+      "post": {
+        "description": "Create a restore task group from a JSON payload request body.",
+        "operationId": "backup_mongo_restore_restore_mongo_api_create_api_apps_backup_mongo_restore__post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/backup_mongo__RestoreTaskWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/backup_mongo__RestoreTaskDetailResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Restore Mongo Api Create",
+        "tags": ["backup_mongo/restore"]
+      }
+    },
+    "/api/apps/backup_mongo/restore/schema": {
+      "get": {
+        "description": "Return the plugin schema captured at registration time.\n\n:return: The plugin schema instance.",
+        "operationId": "backup_mongo_restore_get_schema_api_apps_backup_mongo_restore_schema_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__AppSchema"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Get Schema",
+        "tags": ["backup_mongo/restore"]
+      }
+    },
+    "/api/apps/backup_mongo/restore/{task_name}": {
+      "delete": {
+        "description": "Delete a restore task group.",
+        "operationId": "backup_mongo_restore_restore_mongo_api_delete_api_apps_backup_mongo_restore__task_name__delete",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Restore Mongo Api Delete",
+        "tags": ["backup_mongo/restore"]
+      },
+      "get": {
+        "description": "Retrieve a single parent restore task with child task status.",
+        "operationId": "backup_mongo_restore_restore_mongo_api_detail_api_apps_backup_mongo_restore__task_name__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/backup_mongo__RestoreTaskDetailResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Restore Mongo Api Detail",
+        "tags": ["backup_mongo/restore"]
+      },
+      "put": {
+        "description": "Update a restore task from a JSON payload request body.\n\nPUTs the parent config payload to the config task name and refreshes each\nchild leg (restore, pbm-list, optional force-resync) in place. The\n``EditableRestoreParent`` dependency resolves a satellite URL to the parent\nand blocks protected or in-flight groups before any write.",
+        "operationId": "backup_mongo_restore_restore_mongo_api_update_api_apps_backup_mongo_restore__task_name__put",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/backup_mongo__RestoreTaskWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/backup_mongo__RestoreTaskResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Restore Mongo Api Update",
+        "tags": ["backup_mongo/restore"]
+      }
+    },
+    "/api/apps/backup_mongo/restore/{task_name}/execute": {
+      "post": {
+        "description": "Resolve, dispatch, and wrap a standard task execution.",
+        "operationId": "backup_mongo_restore_backup_mongo_restores_api_execute_api_apps_backup_mongo_restore__task_name__execute_post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/framework__TaskExecuteWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__TaskExecutionResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Backup Mongo Restores Api Execute",
+        "tags": ["backup_mongo/restore"]
+      }
+    },
+    "/api/apps/backup_mongo/schema": {
+      "get": {
+        "description": "Return the plugin schema captured at registration time.\n\n:return: The plugin schema instance.",
+        "operationId": "backup_mongo_get_schema_api_apps_backup_mongo_schema_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__AppSchema"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Get Schema",
+        "tags": ["backup_mongo"]
+      }
+    },
+    "/api/apps/backup_mongo/{task_name}": {
+      "delete": {
+        "description": "Delete a backup task group.",
+        "operationId": "backup_mongo_backup_mongo_api_delete_api_apps_backup_mongo__task_name__delete",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Backup Mongo Api Delete",
+        "tags": ["backup_mongo"]
+      },
+      "get": {
+        "description": "Retrieve a single parent backup task with derived sibling status.",
+        "operationId": "backup_mongo_backup_mongo_api_detail_api_apps_backup_mongo__task_name__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/backup_mongo__BackupTaskDetailResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Backup Mongo Api Detail",
+        "tags": ["backup_mongo"]
+      },
+      "put": {
+        "description": "Update a backup task group from a JSON payload request body.\n\nCascade-updates the parent ``pbm_config`` task and its derived logical,\nphysical, status, and incremental siblings, re-stamping ``_form`` so the edit page keeps\nprefilling. The ``EditableBackupParent`` dependency resolves a satellite URL\nto the parent and blocks protected or in-flight groups before any write.\nRejects a parent rename with a conflict and surfaces a partial cascade\nfailure as an HTTP 500 naming the failed legs.",
+        "operationId": "backup_mongo_backup_mongo_api_update_api_apps_backup_mongo__task_name__put",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/backup_mongo__BackupTaskWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/backup_mongo__BackupTaskDetailResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Backup Mongo Api Update",
+        "tags": ["backup_mongo"]
+      }
+    },
+    "/api/apps/backup_mongo/{task_name}/execute": {
+      "post": {
+        "description": "Execute a backup task.",
+        "operationId": "backup_mongo_backup_mongo_api_execute_api_apps_backup_mongo__task_name__execute_post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/framework__TaskExecuteWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__TaskExecutionResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Backup Mongo Api Execute",
+        "tags": ["backup_mongo"]
+      }
+    },
+    "/api/apps/backup_pg/": {
+      "get": {
+        "operationId": "backup_pg__list_paginated_api_apps_backup_pg__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "status",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Status"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/backup_pg__PaginatedResponse_BackupTaskResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "List",
+        "tags": ["backup_pg"]
+      },
+      "post": {
+        "operationId": "backup_pg__create_api_apps_backup_pg__post",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "check_connectivity",
+            "required": false,
+            "schema": {
+              "default": true,
+              "title": "Check Connectivity",
+              "type": "boolean"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/backup_pg__BackupPgForm"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__BackupPgCreateResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Create",
+        "tags": ["backup_pg"]
+      }
+    },
+    "/api/apps/backup_pg/schema": {
+      "get": {
+        "description": "Return the plugin schema captured at registration time.\n\n:return: The plugin schema instance.",
+        "operationId": "backup_pg_get_schema_api_apps_backup_pg_schema_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__AppSchema"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Get Schema",
+        "tags": ["backup_pg"]
+      }
+    },
+    "/api/apps/backup_pg/{task_name}": {
+      "delete": {
+        "operationId": "backup_pg__delete_api_apps_backup_pg__task_name__delete",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Delete",
+        "tags": ["backup_pg"]
+      },
+      "get": {
+        "operationId": "backup_pg__detail_api_apps_backup_pg__task_name__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/backup_pg__BackupTaskDetailResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Detail",
+        "tags": ["backup_pg"]
+      },
+      "put": {
+        "operationId": "backup_pg__update_api_apps_backup_pg__task_name__put",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "check_connectivity",
+            "required": false,
+            "schema": {
+              "default": true,
+              "title": "Check Connectivity",
+              "type": "boolean"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/backup_pg__BackupPgForm"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__BackupPgCreateResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Update",
+        "tags": ["backup_pg"]
+      }
+    },
+    "/api/apps/backup_pg/{task_name}/execute": {
+      "post": {
+        "description": "Resolve, dispatch, and wrap a standard task execution.",
+        "operationId": "backup_pg_backup_pg_api_execute_api_apps_backup_pg__task_name__execute_post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/framework__TaskExecuteWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__TaskExecutionResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Backup Pg Api Execute",
+        "tags": ["backup_pg"]
+      }
+    },
+    "/api/apps/checksums/": {
+      "get": {
+        "operationId": "checksums__list_paginated_api_apps_checksums__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "service_type",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "$ref": "#/components/schemas/ServiceTypeEnum"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Service Type"
+            }
+          },
+          {
+            "in": "query",
+            "name": "status",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Status"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__PaginatedResponse_BaseTaskResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "List",
+        "tags": ["checksums"]
+      },
+      "post": {
+        "operationId": "checksums__create_api_apps_checksums__post",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "check_connectivity",
+            "required": false,
+            "schema": {
+              "default": true,
+              "title": "Check Connectivity",
+              "type": "boolean"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/checksums__ChecksumsForm"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__BaseTaskResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Create",
+        "tags": ["checksums"]
+      }
+    },
+    "/api/apps/checksums/schema": {
+      "get": {
+        "description": "Return the plugin schema captured at registration time.\n\n:return: The plugin schema instance.",
+        "operationId": "checksums_get_schema_api_apps_checksums_schema_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__AppSchema"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Get Schema",
+        "tags": ["checksums"]
+      }
+    },
+    "/api/apps/checksums/{task_name}": {
+      "delete": {
+        "operationId": "checksums__delete_api_apps_checksums__task_name__delete",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Delete",
+        "tags": ["checksums"]
+      },
+      "get": {
+        "operationId": "checksums__detail_api_apps_checksums__task_name__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__BaseTaskResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Detail",
+        "tags": ["checksums"]
+      },
+      "put": {
+        "operationId": "checksums__update_api_apps_checksums__task_name__put",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "check_connectivity",
+            "required": false,
+            "schema": {
+              "default": true,
+              "title": "Check Connectivity",
+              "type": "boolean"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/checksums__ChecksumsForm"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__BaseTaskResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Update",
+        "tags": ["checksums"]
+      }
+    },
+    "/api/apps/checksums/{task_name}/execute": {
+      "post": {
+        "description": "Resolve, dispatch, and wrap a standard task execution.",
+        "operationId": "checksums_checksums_api_execute_api_apps_checksums__task_name__execute_post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/framework__TaskExecuteWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__TaskExecutionResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Checksums Api Execute",
+        "tags": ["checksums"]
+      }
+    },
+    "/api/apps/dipper/": {
+      "get": {
+        "description": "Return Dipper execution history rows.\n\n:param tasks_api: Async client for the tasks sub-app.\n:param pagination: Validated offset/limit forwarded to the upstream history call.\n:return: A paginated envelope of task-history rows filtered to Dipper runs. Because\n    the ``dipper/`` filter runs client-side, ``total`` is the filtered count of the\n    current page, not a global count across all pages.",
+        "operationId": "dipper_dipper_api_list_api_apps_dipper__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PaginatedResponse_dict_str__Any__"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Dipper Api List",
+        "tags": ["dipper"]
+      },
+      "post": {
+        "description": "Execute a Dipper collector script against a database service.\n\nDelegates all script resolution, PMM defaults merging, argument\nvalidation, and metadata assembly to ``build_dipper_execution_meta``.\n\n:param request: The HTTP request (used to derive the artifact download URL).\n:type request: Request\n:param body: Validated JSON request body.\n:type body: DipperExecuteWrite\n:param inventory_api: Async client for the inventory sub-app.\n:type inventory_api: RemoteAPI\n:param tasks_api: Async client for the tasks sub-app.\n:type tasks_api: RemoteAPI\n:return: Execution response with the created task identifier.\n:rtype: DipperExecutionResponse\n:raises HTTPNotFoundException: When the service does not exist.\n:raises HTTPUnprocessableEntityException: When the script/args are invalid.",
+        "operationId": "dipper_dipper_api_execute_api_apps_dipper__post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/dipper__DipperExecuteWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/dipper__DipperExecutionResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Dipper Api Execute",
+        "tags": ["dipper"]
+      }
+    },
+    "/api/apps/dipper/form-schema": {
+      "get": {
+        "description": "Return the selected Dipper payload's dynamic execution schema.\n\n:param service_id: Inventory ID of the database service.\n:type service_id: int\n:param collector_type: Which collector variant to render.\n:type collector_type: CollectorTypeEnum\n:param inventory_api: Async client for the inventory sub-app.\n:type inventory_api: RemoteAPI\n:param executor_hosts: Available executor hosts keyed by hostname.\n:type executor_hosts: dict\n:param pmm_api: The configured PMM API client, or ``None`` when PMM is not\n    configured (injected via ``PMMAPIDep``).\n:type pmm_api: PMMRemoteAPI | None\n:return: Context-specific schema including payload parameters.",
+        "operationId": "dipper_dipper_api_form_schema_api_apps_dipper_form_schema_get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "service_id",
+            "required": true,
+            "schema": {
+              "title": "Service Id",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "collector_type",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/dipper__CollectorTypeEnum"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__AppSchema"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Dipper Api Form Schema",
+        "tags": ["dipper"]
+      }
+    },
+    "/api/apps/dipper/schema": {
+      "get": {
+        "description": "Return the plugin schema captured at registration time.\n\n:return: The plugin schema instance.",
+        "operationId": "dipper_get_schema_api_apps_dipper_schema_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__AppSchema"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Get Schema",
+        "tags": ["dipper"]
+      }
+    },
+    "/api/apps/dipper/script-preview": {
+      "get": {
+        "description": "Return a preview of the collector script for the given service.\n\n:param service_id: Inventory ID of the database service.\n:type service_id: int\n:param collector_type: Which collector variant to preview.\n:type collector_type: CollectorTypeEnum\n:param inventory_api: Async client for the inventory sub-app.\n:type inventory_api: RemoteAPI\n:return: Preview content alongside language and truncation metadata.\n:rtype: ScriptPreviewResponse\n:raises HTTPNotFoundException: When the service does not exist.\n:raises HTTPUnprocessableEntityException: When no script is available for\n    the service/collector combination, or when the script contains\n    non-UTF-8 bytes.",
+        "operationId": "dipper_dipper_api_script_preview_api_apps_dipper_script_preview_get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "service_id",
+            "required": true,
+            "schema": {
+              "title": "Service Id",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "collector_type",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/dipper__CollectorTypeEnum"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__ScriptPreviewResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Dipper Api Script Preview",
+        "tags": ["dipper"]
+      }
+    },
+    "/api/apps/inventory/": {
+      "get": {
+        "description": "Return the list of periodic task names for the Inventory plugin.\n\nHard-coded because the Inventory plugin has exactly one periodic task\n(``inventory-sync``). The shape matches what the React\n``usePluginTasks('inventory')`` hook expects: a list of objects with at\nminimum a ``name`` key.",
+        "operationId": "inventory_inventory_plugin_tasks_api_apps_inventory__get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "items": {
+                    "$ref": "#/components/schemas/inventory__PluginTaskResponse"
+                  },
+                  "title": "Response Inventory Inventory Plugin Tasks Api Apps Inventory  Get",
+                  "type": "array"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Inventory Plugin Tasks",
+        "tags": ["inventory"]
+      }
+    },
+    "/api/apps/inventory/available-syncers/": {
+      "get": {
+        "description": "Return syncers capable of syncing inventory.\n\n:param available_syncers: Filtered syncer list from ``InventoryAvailableSyncersDep``.\n:type available_syncers: list[AvailableSyncer]\n:return: Filtered list of syncers that can sync inventory.\n:rtype: list[AvailableSyncer]",
+        "operationId": "inventory_inventory_available_syncers_api_apps_inventory_available_syncers__get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "items": {
+                    "$ref": "#/components/schemas/inventory__AvailableSyncer"
+                  },
+                  "title": "Response Inventory Inventory Available Syncers Api Apps Inventory Available Syncers  Get",
+                  "type": "array"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Inventory Available Syncers",
+        "tags": ["inventory"]
+      }
+    },
+    "/api/apps/inventory/nodes/{node_id}/system-observation": {
+      "get": {
+        "description": "Proxy the host-level system observation for a node (read-only).\n\nForwards to the inventory sub-app's ``/nodes/{node_id}/system-observation``\nendpoint via ``InventoryAPI``. This three-segment literal path cannot\ncollide with the two-segment ``/{entity}/{item_id:int}`` detail matcher. An\nupstream HTTP 404 — the \"not collected yet\" signal — propagates unchanged\nfor the React panel to render as an empty state.\n\n:param node_id: Primary key of the node.\n:param inventory_api: Authenticated inventory ``RemoteAPI`` client.\n:return: The host-level system observation payload.",
+        "operationId": "inventory_inventory_node_system_observation_api_apps_inventory_nodes__node_id__system_observation_get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "node_id",
+            "required": true,
+            "schema": {
+              "title": "Node Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "title": "Response Inventory Inventory Node System Observation Api Apps Inventory Nodes  Node Id  System Observation Get"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Inventory Node System Observation",
+        "tags": ["inventory"]
+      }
+    },
+    "/api/apps/inventory/schema": {
+      "get": {
+        "description": "Return the plugin schema captured at registration time.\n\n:return: The plugin schema instance.",
+        "operationId": "inventory_get_schema_api_apps_inventory_schema_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__AppSchema"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Get Schema",
+        "tags": ["inventory"]
+      }
+    },
+    "/api/apps/inventory/services/{service_id}/check-connectivity/": {
+      "post": {
+        "description": "Run a database connectivity probe for a service from its executor host.\n\nBacks the React connectivity control on the service detail page. A probe\nthat ran but could not connect is reported as HTTP 200 with\n``success=false`` and the upstream message in ``error``; only a probe that\ncould not be attempted at all is an error status. This three-segment\nliteral path cannot collide with the two-segment\n``/{entity}/{item_id:int}`` detail matcher.\n\n:param service: The service to probe, resolved from the path id.\n:param tasks_api: Authenticated Tasks ``RemoteAPI`` client.\n:return: The upstream probe result.\n:raises HTTPBadRequestException: When the service cannot be probed —\n    unsupported type, missing node or port, or no executor registered for\n    the node address.\n:raises HTTPBadGatewayException: When the Tasks API is unreachable or\n    returns an unparseable body.",
+        "operationId": "inventory_inventory_service_check_connectivity_api_apps_inventory_services__service_id__check_connectivity__post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "service_id",
+            "required": true,
+            "schema": {
+              "title": "Service Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ConnectivityCheckResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Inventory Service Check Connectivity",
+        "tags": ["inventory"]
+      }
+    },
+    "/api/apps/inventory/services/{service_id}/system-observation": {
+      "get": {
+        "description": "Proxy the service-level system observation for a service (read-only).\n\nForwards to the inventory sub-app's\n``/services/{service_id}/system-observation`` endpoint via ``InventoryAPI``.\nAn upstream HTTP 404 propagates unchanged so the React panel renders its\n\"not collected yet\" empty state.\n\n:param service_id: Primary key of the service.\n:param inventory_api: Authenticated inventory ``RemoteAPI`` client.\n:return: The service-level system observation payload.",
+        "operationId": "inventory_inventory_service_system_observation_api_apps_inventory_services__service_id__system_observation_get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "service_id",
+            "required": true,
+            "schema": {
+              "title": "Service Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "title": "Response Inventory Inventory Service System Observation Api Apps Inventory Services  Service Id  System Observation Get"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Inventory Service System Observation",
+        "tags": ["inventory"]
+      }
+    },
+    "/api/apps/inventory/sync/": {
+      "post": {
+        "description": "Schedule an ad-hoc inventory sync as a background task.\n\nMirrors the Jinja2 ``POST /inventory/sync/`` handler but accepts an\noptional JSON body ``{\"syncer\": \"<qualified_name>\"}``. When ``syncer``\nis absent, ``None``, or empty, every configured syncer runs in\ndeclaration order; otherwise only the named syncer is forwarded. An\nunknown or inapplicable syncer raises HTTP 400 — never a silent no-op.\n\nAuthentication is enforced by the parent ``api_router``'s\n``IsApiAuthenticated`` dependency, so this handler needs no auth parameter.\n\n:param syncers: Configured syncers from ``SyncersDep``.\n:type syncers: SyncersDep\n:param background_tasks: FastAPI's background task scheduler.\n:type background_tasks: BackgroundTasks\n:param internal_token: SEP-internal service token injected by\n    ``InternalTokenDep`` and forwarded to the background sync task.\n:param body: Optional trigger body.\n:type body: InventorySyncTriggerWrite | None\n:return: Empty 202 Accepted response.\n:rtype: Response\n:raises HTTPBadRequestException: When ``body.syncer`` is set but does\n    not match any configured syncer that can sync inventory.",
+        "operationId": "inventory_inventory_sync_trigger_api_apps_inventory_sync__post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "anyOf": [
+                  {
+                    "$ref": "#/components/schemas/inventory__InventorySyncTriggerWrite"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "title": "Body"
+              }
+            }
+          }
+        },
+        "responses": {
+          "202": {
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Inventory Sync Trigger",
+        "tags": ["inventory"]
+      }
+    },
+    "/api/apps/inventory/sync/status/": {
+      "get": {
+        "description": "Return whether an inventory-wide sync is currently running.\n\nReplaces the server-rendered ``sync_is_running`` template variable\nused by the Jinja2 inventory page so the React control can poll the\nsame state without scraping HTML.\n\n:param session: SQLModel async session.\n:type session: SessionDep\n:return: ``{\"is_running\": <bool>}``.\n:rtype: InventorySyncStatusResponse",
+        "operationId": "inventory_inventory_sync_status_api_apps_inventory_sync_status__get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/inventory__InventorySyncStatusResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Inventory Sync Status",
+        "tags": ["inventory"]
+      }
+    },
+    "/api/apps/inventory/{entity}/": {
+      "get": {
+        "description": "List inventory nodes, services, schemas, or tables.\n\n:param request: Inbound request; its query string carries entity filters.\n:param entity: Inventory entity type (nodes, services, schemas, tables).\n:param inventory_api: Async client for the Inventory sub-app.\n:param pagination: Validated offset/limit forwarded to the upstream call.\n:return: A paginated envelope echoing the requested window.",
+        "operationId": "inventory_inventory_list_entity_api_apps_inventory__entity___get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "entity",
+            "required": true,
+            "schema": {
+              "title": "Entity",
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PaginatedResponse_Any_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Inventory List Entity",
+        "tags": ["inventory"]
+      },
+      "post": {
+        "description": "Create an inventory node, service, schema, or table.",
+        "operationId": "inventory_inventory_create_entity_api_apps_inventory__entity___post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "entity",
+            "required": true,
+            "schema": {
+              "title": "Entity",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "title": "Response Inventory Inventory Create Entity Api Apps Inventory  Entity   Post"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Inventory Create Entity",
+        "tags": ["inventory"]
+      }
+    },
+    "/api/apps/inventory/{entity}/{item_id}": {
+      "delete": {
+        "description": "Delete an inventory node, service, schema, or table.",
+        "operationId": "inventory_inventory_delete_entity_api_apps_inventory__entity___item_id__delete",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "entity",
+            "required": true,
+            "schema": {
+              "title": "Entity",
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "item_id",
+            "required": true,
+            "schema": {
+              "title": "Item Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Inventory Delete Entity",
+        "tags": ["inventory"]
+      },
+      "get": {
+        "description": "Retrieve a single inventory node, service, schema, or table.",
+        "operationId": "inventory_inventory_get_entity_api_apps_inventory__entity___item_id__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "entity",
+            "required": true,
+            "schema": {
+              "title": "Entity",
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "item_id",
+            "required": true,
+            "schema": {
+              "title": "Item Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "title": "Response Inventory Inventory Get Entity Api Apps Inventory  Entity   Item Id  Get"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Inventory Get Entity",
+        "tags": ["inventory"]
+      },
+      "put": {
+        "description": "Update an inventory node, service, schema, or table.",
+        "operationId": "inventory_inventory_update_entity_api_apps_inventory__entity___item_id__put",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "entity",
+            "required": true,
+            "schema": {
+              "title": "Entity",
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "item_id",
+            "required": true,
+            "schema": {
+              "title": "Item Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "title": "Response Inventory Inventory Update Entity Api Apps Inventory  Entity   Item Id  Put"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Inventory Update Entity",
+        "tags": ["inventory"]
+      }
+    },
+    "/api/apps/mysql_backups/": {
+      "get": {
+        "operationId": "mysql_backups__list_paginated_api_apps_mysql_backups__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 50,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "status",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Status"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/mysql_backups__PaginatedResponse_BackupTaskResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "List",
+        "tags": ["mysql_backups"]
+      },
+      "post": {
+        "operationId": "mysql_backups__create_api_apps_mysql_backups__post",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "check_connectivity",
+            "required": false,
+            "schema": {
+              "default": true,
+              "title": "Check Connectivity",
+              "type": "boolean"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/mysql_backups__BackupCreate"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__MysqlBackupsCreateResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Create",
+        "tags": ["mysql_backups"]
+      }
+    },
+    "/api/apps/mysql_backups/restore/": {
+      "get": {
+        "operationId": "mysql_backups_restore__list_paginated_api_apps_mysql_backups_restore__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 50,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "status",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Status"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/mysql_backups__PaginatedResponse_RestoresResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "List",
+        "tags": ["mysql_backups/restore"]
+      },
+      "post": {
+        "operationId": "mysql_backups_restore__create_api_apps_mysql_backups_restore__post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/mysql_backups__RestoreCreate"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/mysql_backups__RestoresResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Create",
+        "tags": ["mysql_backups/restore"]
+      }
+    },
+    "/api/apps/mysql_backups/restore/schema": {
+      "get": {
+        "description": "Return the plugin schema captured at registration time.\n\n:return: The plugin schema instance.",
+        "operationId": "mysql_backups_restore_get_schema_api_apps_mysql_backups_restore_schema_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__AppSchema"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Get Schema",
+        "tags": ["mysql_backups/restore"]
+      }
+    },
+    "/api/apps/mysql_backups/restore/{task_name}": {
+      "delete": {
+        "operationId": "mysql_backups_restore__delete_api_apps_mysql_backups_restore__task_name__delete",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Delete",
+        "tags": ["mysql_backups/restore"]
+      },
+      "get": {
+        "operationId": "mysql_backups_restore__detail_api_apps_mysql_backups_restore__task_name__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/mysql_backups__RestoresResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Detail",
+        "tags": ["mysql_backups/restore"]
+      },
+      "put": {
+        "operationId": "mysql_backups_restore__update_api_apps_mysql_backups_restore__task_name__put",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/mysql_backups__RestoreCreate"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/mysql_backups__RestoresResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Update",
+        "tags": ["mysql_backups/restore"]
+      }
+    },
+    "/api/apps/mysql_backups/restore/{task_name}/execute": {
+      "post": {
+        "description": "Resolve, dispatch, and wrap a standard task execution.",
+        "operationId": "mysql_backups_restore_mysql_backups_restores_api_execute_api_apps_mysql_backups_restore__task_name__execute_post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/framework__TaskExecuteWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__TaskExecutionResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Mysql Backups Restores Api Execute",
+        "tags": ["mysql_backups/restore"]
+      }
+    },
+    "/api/apps/mysql_backups/schema": {
+      "get": {
+        "description": "Return the plugin schema captured at registration time.\n\n:return: The plugin schema instance.",
+        "operationId": "mysql_backups_get_schema_api_apps_mysql_backups_schema_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__AppSchema"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Get Schema",
+        "tags": ["mysql_backups"]
+      }
+    },
+    "/api/apps/mysql_backups/services/{service_id}/backups": {
+      "get": {
+        "description": "Return a page of a MySQL service's completed backup runs, newest run first.\n\nThe ``service_id`` path parameter is resolved by\n:data:`~app.sep.apps.mysql_backups.deps.ResolvedMysqlService`, which lets an\nunknown service surface as a ``404``. A resolvable service with no recorded\nruns yields an empty page, so a caller building a restore selector is never\nblocked by an empty catalog but is still told when the service itself is\nunknown.\n\n:param service: The inventory service resolved from the ``service_id`` path\n    parameter.\n:param session: The database session the catalog is queried on.\n:param pagination: The requested offset/limit window.\n:return: The requested page of the service's recorded backup runs, newest\n    run first.",
+        "operationId": "mysql_backups_list_service_backups_api_apps_mysql_backups_services__service_id__backups_get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "service_id",
+            "required": true,
+            "schema": {
+              "title": "Service Id",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/mysql_backups__PaginatedResponse_BackupRunResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "List Service Backups",
+        "tags": ["mysql_backups"]
+      }
+    },
+    "/api/apps/mysql_backups/{task_name}": {
+      "delete": {
+        "operationId": "mysql_backups__delete_api_apps_mysql_backups__task_name__delete",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Delete",
+        "tags": ["mysql_backups"]
+      },
+      "get": {
+        "operationId": "mysql_backups__detail_api_apps_mysql_backups__task_name__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/mysql_backups__BackupTaskResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Detail",
+        "tags": ["mysql_backups"]
+      },
+      "put": {
+        "operationId": "mysql_backups__update_api_apps_mysql_backups__task_name__put",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "check_connectivity",
+            "required": false,
+            "schema": {
+              "default": true,
+              "title": "Check Connectivity",
+              "type": "boolean"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/mysql_backups__BackupCreate"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__MysqlBackupsCreateResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Update",
+        "tags": ["mysql_backups"]
+      }
+    },
+    "/api/apps/mysql_backups/{task_name}/execute": {
+      "post": {
+        "description": "Resolve, dispatch, and wrap a standard task execution.",
+        "operationId": "mysql_backups_mysql_backups_api_execute_api_apps_mysql_backups__task_name__execute_post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/framework__TaskExecuteWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__TaskExecutionResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Mysql Backups Api Execute",
+        "tags": ["mysql_backups"]
+      }
+    },
+    "/api/apps/report/config": {
+      "get": {
+        "description": "Return upload configuration status.\n\n:return: JSON response with ``upload_disabled_reasons``.\n:rtype: JSONResponse",
+        "operationId": "report_report_config_api_apps_report_config_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Report Config",
+        "tags": ["report"]
+      }
+    },
+    "/api/apps/report/generate/json": {
+      "get": {
+        "description": "Generate a report and return as JSON.\n\n:param pmm_api: PMM API client dependency.\n:type pmm_api: PMMRemoteAPI\n:param since: Relative start of the report period.\n:type since: str\n:param until: Relative end of the report period.\n:type until: str\n:param full: Include all check results and full backup history.\n:type full: bool\n:param refresh: Force advisor refresh before fetching results.\n:type refresh: bool\n:param sections: Optional list of sections to include.\n:type sections: list[str] | None\n:return: JSON response with full report data.\n:rtype: JSONResponse",
+        "operationId": "report_report_generate_json_api_api_apps_report_generate_json_get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "since",
+            "required": false,
+            "schema": {
+              "default": "now-7d",
+              "title": "Since",
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "until",
+            "required": false,
+            "schema": {
+              "default": "now",
+              "title": "Until",
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "full",
+            "required": false,
+            "schema": {
+              "default": true,
+              "title": "Full",
+              "type": "boolean"
+            }
+          },
+          {
+            "in": "query",
+            "name": "refresh",
+            "required": false,
+            "schema": {
+              "default": false,
+              "title": "Refresh",
+              "type": "boolean"
+            }
+          },
+          {
+            "in": "query",
+            "name": "sections",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "items": {
+                    "type": "string"
+                  },
+                  "type": "array"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Sections"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Report Generate Json Api",
+        "tags": ["report"]
+      }
+    },
+    "/api/apps/report/pdf-jobs": {
+      "post": {
+        "description": "Enqueue PDF rendering from a report JSON snapshot.\n\n:param body: Request body containing the report snapshot.\n:type body: ReportSnapshotWrite\n:return: PDF job status response.\n:rtype: ReportJobResponse",
+        "operationId": "report_report_start_pdf_job_api_api_apps_report_pdf_jobs_post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/report__ReportSnapshotWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/report__ReportJobResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Report Start Pdf Job Api",
+        "tags": ["report"]
+      }
+    },
+    "/api/apps/report/pdf-jobs/{job_id}": {
+      "get": {
+        "description": "Return PDF job status.\n\n:param job_id: Celery task identifier.\n:type job_id: str\n:return: PDF job status response.\n:rtype: ReportJobResponse",
+        "operationId": "report_report_pdf_job_api_api_apps_report_pdf_jobs__job_id__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "job_id",
+            "required": true,
+            "schema": {
+              "title": "Job Id",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/report__ReportJobResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Report Pdf Job Api",
+        "tags": ["report"]
+      }
+    },
+    "/api/apps/report/pdf-jobs/{job_id}/pdf": {
+      "get": {
+        "description": "Download a ready PDF result for a report job.\n\n:param job_id: Celery task identifier.\n:type job_id: str\n:return: PDF file response.\n:rtype: Response\n:raises HTTPInternalServerErrorException: If the Celery job failed.\n:raises HTTPConflictException: If the PDF result is not ready yet.\n:raises HTTPGoneException: If the staged PDF artifact has expired.",
+        "operationId": "report_report_download_pdf_api_api_apps_report_pdf_jobs__job_id__pdf_get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "job_id",
+            "required": true,
+            "schema": {
+              "title": "Job Id",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Report Download Pdf Api",
+        "tags": ["report"]
+      }
+    },
+    "/api/apps/report/upload-jobs": {
+      "post": {
+        "description": "Enqueue ServiceNow upload from a report JSON snapshot.\n\n:param body: Request body containing the report snapshot.\n:type body: ReportSnapshotWrite\n:return: Upload job status response.\n:rtype: ReportJobResponse\n:raises HTTPServiceUnavailableException: If ServiceNow upload is not configured.",
+        "operationId": "report_report_start_upload_job_api_api_apps_report_upload_jobs_post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/report__ReportSnapshotWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/report__ReportJobResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Report Start Upload Job Api",
+        "tags": ["report"]
+      }
+    },
+    "/api/apps/report/upload-jobs/{job_id}": {
+      "get": {
+        "description": "Return ServiceNow upload job status.\n\n:param job_id: Celery task identifier.\n:type job_id: str\n:return: Upload job status response.\n:rtype: ReportJobResponse",
+        "operationId": "report_report_upload_job_api_api_apps_report_upload_jobs__job_id__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "job_id",
+            "required": true,
+            "schema": {
+              "title": "Job Id",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/report__ReportJobResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Report Upload Job Api",
+        "tags": ["report"]
+      }
+    },
+    "/api/apps/snippets/": {
+      "get": {
+        "description": "List scripts as a server-filtered, sorted, paginated projection.",
+        "operationId": "snippets_snippets_api_list_api_apps_snippets__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Case-insensitive search over filename, title, description.",
+            "in": "query",
+            "name": "search",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Case-insensitive search over filename, title, description.",
+              "title": "Search"
+            }
+          },
+          {
+            "description": "Sort key; one of the allowlisted public sort keys.",
+            "in": "query",
+            "name": "sort",
+            "required": false,
+            "schema": {
+              "$ref": "#/components/schemas/SnippetSortKey",
+              "default": "created_at",
+              "description": "Sort key; one of the allowlisted public sort keys."
+            }
+          },
+          {
+            "description": "Sort direction.",
+            "in": "query",
+            "name": "order",
+            "required": false,
+            "schema": {
+              "$ref": "#/components/schemas/SnippetSortDirection",
+              "default": "desc",
+              "description": "Sort direction."
+            }
+          },
+          {
+            "description": "Approval-status filter.",
+            "in": "query",
+            "name": "approval",
+            "required": false,
+            "schema": {
+              "$ref": "#/components/schemas/SnippetApprovalFilter",
+              "default": "all",
+              "description": "Approval-status filter."
+            }
+          },
+          {
+            "description": "Service-type equality filter, or omitted for no filter.",
+            "in": "query",
+            "name": "service_type",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Service-type equality filter, or omitted for no filter.",
+              "title": "Service Type"
+            }
+          },
+          {
+            "description": "When true, keep only snippets with no (absent or blank) service type. A separate flag so a real service type can never collide with a reserved sentinel. Takes precedence over 'service_type'.",
+            "in": "query",
+            "name": "uncategorized",
+            "required": false,
+            "schema": {
+              "default": false,
+              "description": "When true, keep only snippets with no (absent or blank) service type. A separate flag so a real service type can never collide with a reserved sentinel. Takes precedence over 'service_type'.",
+              "title": "Uncategorized",
+              "type": "boolean"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PaginatedResponse_SnippetResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "List",
+        "tags": ["snippets"]
+      }
+    },
+    "/api/apps/snippets/approvals": {
+      "patch": {
+        "description": "Approve a set of snippets atomically (idempotent partial-update).\n\nReject the whole batch with ``400`` and a\n:class:`BatchApprovalErrorResponse` payload when any filename has no\nDB row or its file is missing on disk. Filenames that are already\napproved when the call starts are reported in\n``skipped_already_approved`` — not as errors. The atomic write uses\n``approved_at IS NULL`` as a CAS filter so two concurrent admins\ncannot double-approve.\n\n:param existence: Pre-validated batch existence result from the dependency.\n:type existence: SnippetBatchExistenceResult\n:param user: The authenticated admin performing the action.\n:type user: User\n:param session: The active database session.\n:type session: AsyncSession\n:return: The success payload listing approved + skipped filenames.\n:rtype: BatchApprovalResponse\n:raises HTTPBadRequestException: On hard-error precheck failures with\n    a :class:`BatchApprovalErrorResponse` body.",
+        "operationId": "snippets_snippets_api_batch_approve_api_apps_snippets_approvals_patch",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SnippetBatchApproveRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/BatchApprovalResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Snippets Api Batch Approve",
+        "tags": ["snippets"]
+      }
+    },
+    "/api/apps/snippets/capabilities": {
+      "get": {
+        "description": "Return per-deployment capability flags for the snippets plugin.\n\nRead live from ``snippets_settings`` so a deployment-config hot reload between\ntwo requests is reflected on the next response.\n\n:return: Capability flags reflecting the current deployment config.",
+        "operationId": "snippets__snippets_capabilities_provider_api_apps_snippets_capabilities_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SnippetsCapabilitiesResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": " Snippets Capabilities Provider",
+        "tags": ["snippets"]
+      }
+    },
+    "/api/apps/snippets/refresh": {
+      "post": {
+        "description": "Refresh the snippets cache from disk.\n\nAdmin-only and additionally gated by manual sync being enabled.\nMirrors the legacy Jinja2 ``POST /snippets/refresh`` route.\n\n:param user: The authenticated admin performing the refresh.\n:type user: User\n:param session: The SEP database session.\n:return: A response carrying the UTC timestamp of the refresh.\n:rtype: RefreshResponse",
+        "operationId": "snippets_snippets_api_refresh_api_apps_snippets_refresh_post",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RefreshResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Snippets Api Refresh",
+        "tags": ["snippets"]
+      }
+    },
+    "/api/apps/snippets/schema": {
+      "get": {
+        "description": "Return the plugin schema captured at registration time.\n\n:return: The plugin schema instance.",
+        "operationId": "snippets_get_schema_api_apps_snippets_schema_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__AppSchema"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Get Schema",
+        "tags": ["snippets"]
+      }
+    },
+    "/api/apps/snippets/service_types": {
+      "get": {
+        "description": "List the distinct service types across the whole snippets dataset.\n\nBacks the list page's service-type filter so its options reflect every value\nin the dataset rather than only the loaded page.\n\n:param session: The SEP database session.\n:return: The sorted distinct service types and whether any snippet is\n    uncategorized (absent or blank service type).",
+        "operationId": "snippets_snippets_api_service_types_api_apps_snippets_service_types_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SnippetServiceTypesResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Snippets Api Service Types",
+        "tags": ["snippets"]
+      }
+    },
+    "/api/apps/snippets/snippet/approval": {
+      "delete": {
+        "description": "Remove approval from a single snippet (idempotent).\n\nRemoving an approval that doesn't exist is a no-op ``204``. The\nsnippet missing → ``404`` (handled by ``SnippetDep``); approval\nmissing → ``204``.\n\n:param snippet: The snippet whose approval is being cleared.\n:type snippet: Snippet\n:param user: The authenticated admin performing the action.\n:type user: User\n:param session: The active database session.\n:type session: AsyncSession\n:return: An empty 204 response.\n:rtype: Response",
+        "operationId": "snippets_snippets_api_remove_approval_api_apps_snippets_snippet_approval_delete",
+        "parameters": [
+          {
+            "description": "Snippet filename (relative path under snippets root).",
+            "in": "query",
+            "name": "snippet_filename",
+            "required": true,
+            "schema": {
+              "description": "Snippet filename (relative path under snippets root).",
+              "title": "Snippet Filename",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Snippets Api Remove Approval",
+        "tags": ["snippets"]
+      },
+      "put": {
+        "description": "Approve a single snippet (idempotent).\n\nRe-approving an already-approved snippet returns ``200`` with the\ncurrent state — ``approved_at`` is *not* overwritten so the audit\ntrail is preserved.\n\n:param snippet: The snippet whose approval is being set.\n:type snippet: Snippet\n:param user: The authenticated admin performing the action.\n:type user: User\n:param session: The active database session.\n:type session: AsyncSession\n:return: The snippet entity after the call, including approval state.\n:rtype: SnippetResponse",
+        "operationId": "snippets_snippets_api_approve_api_apps_snippets_snippet_approval_put",
+        "parameters": [
+          {
+            "description": "Snippet filename (relative path under snippets root).",
+            "in": "query",
+            "name": "snippet_filename",
+            "required": true,
+            "schema": {
+              "description": "Snippet filename (relative path under snippets root).",
+              "title": "Snippet Filename",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SnippetResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Snippets Api Approve",
+        "tags": ["snippets"]
+      }
+    },
+    "/api/apps/snippets/snippet/download": {
+      "get": {
+        "description": "Stream the raw snippet file as a download attachment.\n\nReturns the on-disk source verbatim — full bash/Python body plus its\nYAML frontmatter — so end users can save the file locally without\nbeing capped by the preview truncation limits. The\n``SnippetDep`` dependency already validates both the DB row and the\non-disk file, so a missing snippet or missing file surfaces as 404.\n\n:param snippet: The snippet whose raw file is requested.\n:type snippet: Snippet\n:return: The snippet file streamed as ``attachment; filename=...``\n    with a MIME type guessed from the on-disk path.\n:rtype: FileResponse",
+        "operationId": "snippets_snippets_api_download_api_apps_snippets_snippet_download_get",
+        "parameters": [
+          {
+            "description": "Snippet filename (relative path under snippets root).",
+            "in": "query",
+            "name": "snippet_filename",
+            "required": true,
+            "schema": {
+              "description": "Snippet filename (relative path under snippets root).",
+              "title": "Snippet Filename",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Snippets Api Download",
+        "tags": ["snippets"]
+      }
+    },
+    "/api/apps/snippets/snippet/execute": {
+      "post": {
+        "description": "Validate the args, assemble the meta, and dispatch the execution.",
+        "operationId": "snippets_snippets_api_script_execute_api_apps_snippets_snippet_execute_post",
+        "parameters": [
+          {
+            "description": "Script filename (relative path under the script dir).",
+            "in": "query",
+            "name": "snippet_filename",
+            "required": true,
+            "schema": {
+              "description": "Script filename (relative path under the script dir).",
+              "title": "Snippet Filename",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/framework__ScriptExecuteWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__ScriptExecutionResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Execute script",
+        "tags": ["snippets"]
+      }
+    },
+    "/api/apps/snippets/snippet/history": {
+      "get": {
+        "description": "Proxy the per-script execution history from the Tasks API by filename.",
+        "operationId": "snippets_snippets_api_script_history_api_apps_snippets_snippet_history_get",
+        "parameters": [
+          {
+            "description": "Script filename (relative path under the script dir).",
+            "in": "query",
+            "name": "snippet_filename",
+            "required": true,
+            "schema": {
+              "description": "Script filename (relative path under the script dir).",
+              "title": "Snippet Filename",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "title": "Response Snippets Snippets Api Script History Api Apps Snippets Snippet History Get",
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Script history",
+        "tags": ["snippets"]
+      }
+    },
+    "/api/apps/snippets/snippet/preview": {
+      "get": {
+        "description": "Return the snippet's preview content with a highlighter language hint.\n\n:param snippet: The snippet whose preview is requested.\n:type snippet: Snippet\n:return: The preview content alongside metadata about it.\n:rtype: ScriptPreviewResponse\n:raises HTTPUnprocessableEntityException: When the snippet contains\n    bytes that cannot be decoded as UTF-8.",
+        "operationId": "snippets_snippets_api_script_preview_api_apps_snippets_snippet_preview_get",
+        "parameters": [
+          {
+            "description": "Snippet filename (relative path under snippets root).",
+            "in": "query",
+            "name": "snippet_filename",
+            "required": true,
+            "schema": {
+              "description": "Snippet filename (relative path under snippets root).",
+              "title": "Snippet Filename",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__ScriptPreviewResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Snippets Api Script Preview",
+        "tags": ["snippets"]
+      }
+    },
+    "/api/apps/snippets/snippet/schema": {
+      "get": {
+        "description": "Return the per-script form schema synthesised from its parameters.",
+        "operationId": "snippets_snippets_api_script_schema_api_apps_snippets_snippet_schema_get",
+        "parameters": [
+          {
+            "description": "Script filename (relative path under the script dir).",
+            "in": "query",
+            "name": "snippet_filename",
+            "required": true,
+            "schema": {
+              "description": "Script filename (relative path under the script dir).",
+              "title": "Snippet Filename",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__AppSchema"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Script schema",
+        "tags": ["snippets"]
+      }
+    },
+    "/api/apps/tasks/": {
+      "get": {
+        "description": "List task definitions for the read-only plugin UI.\n\n:param tasks_api: Async client for the tasks sub-app.\n:param pagination: Validated offset/limit forwarded to the upstream Tasks API.\n:return: A paginated envelope of task rows for the schema-driven list view.",
+        "operationId": "task_manager_tasks_api_list_api_apps_tasks__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/tasks__PaginatedResponse_TaskListResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Tasks Api List",
+        "tags": ["Task Manager"]
+      }
+    },
+    "/api/apps/tasks/schema": {
+      "get": {
+        "description": "Return the plugin schema captured at registration time.\n\n:return: The plugin schema instance.",
+        "operationId": "task_manager_get_schema_api_apps_tasks_schema_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/framework__AppSchema"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Get Schema",
+        "tags": ["Task Manager"]
+      }
+    },
+    "/api/apps/tasks/{task_name}": {
+      "get": {
+        "description": "Return the per-task detail bundle for the read-only plugin UI.\n\n:param task: The task definition resolved by name.\n:type task: Task\n:param tasks_api: Async client for the tasks sub-app.\n:type tasks_api: TaskAPI\n:param executor_hosts_ctx: Executor hosts enriched with inventory labels.\n:type executor_hosts_ctx: ExecutorHostsCtx\n:return: Task definition, history, periodic schedules, and executor hosts.\n:rtype: TaskDetailResponse",
+        "operationId": "task_manager_tasks_api_detail_api_apps_tasks__task_name__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "owner",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Owner"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/tasks__TaskDetailResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Tasks Api Detail",
+        "tags": ["Task Manager"]
+      }
+    },
+    "/api/apps/topology/collect": {
+      "post": {
+        "description": "Dispatch one or more topology collector tasks. Returns the task ids.\n\nHosts are pulled from the inventory MySQL service list; no inventory\npersistence side effects occur. With ``shards > 1`` the host list is\nsplit round-robin across the first N executor hosts so geographically\nsplit inventories run in parallel.\n\n:param body: Collection request (shard count, optional executor, timeouts).\n:param inventory_api: Remote inventory API client used to source MySQL hosts.\n:param tasks_api: Remote Tasks API client used to dispatch collector tasks.\n:return: Dispatched task history ids plus the executor targets and counts.",
+        "operationId": "topology_topology_collect_api_apps_topology_collect_post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/topology__TopologyCollectWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "202": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/topology__TopologyCollectResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Topology Collect",
+        "tags": ["topology"]
+      }
+    },
+    "/api/apps/topology/result": {
+      "get": {
+        "description": "Return the merged graph for the supplied task history ids.\n\nStatus mirrors the underlying tasks: ``running`` while any are pending\nor running, ``failed`` when any task failed and produced no usable\noutput, ``ok`` once every task is finished. The React client caches\nthe response via TanStack Query (long ``staleTime``) and stops\npolling once status flips to ``ok``, so the server doesn't bother\nwith HTTP cache validation here.\n\n:param tasks_api: Remote Tasks API client used to fetch task histories and logs.\n:param current_user: Authenticated caller; results are scoped to their own tasks.\n:param ids: Comma-separated task history ids to merge into one graph.\n:return: Aggregate status plus the merged graph (when ready) and task-id lists.",
+        "operationId": "topology_topology_result_api_apps_topology_result_get",
+        "parameters": [
+          {
+            "description": "Comma-separated task history ids",
+            "in": "query",
+            "name": "ids",
+            "required": true,
+            "schema": {
+              "description": "Comma-separated task history ids",
+              "title": "Ids",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/topology__TopologyResultResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Topology Result",
+        "tags": ["topology"]
+      }
+    },
+    "/api/sep/admin/connectivity-check/": {
+      "post": {
+        "description": "Probe the requested external / inter-service endpoints and report status.\n\nProbe only the services named in ``body.targets``, running the selected\nprobes concurrently. Each is isolated: one endpoint's failure is classified\nindependently and never fails the whole response, which always returns\n``200`` with one entry per requested service, in request order. Tasks and\nNomad share a single ``/hosts/`` probe, so requesting either (or both) runs\nit once.\n\n:param body: The request naming which services to probe.\n:param pmm_api: The PMM client dependency, or ``None`` when unconfigured.\n:param inventory_api: The authenticated Inventory API client.\n:param tasks_api: The authenticated Tasks API client.\n:return: One normalized connectivity result per requested service.",
+        "operationId": "sep_check_connectivity_api_sep_admin_connectivity_check__post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ConnectivityCheckRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "items": {
+                    "$ref": "#/components/schemas/ConnectivityResult"
+                  },
+                  "title": "Response Sep Check Connectivity Api Sep Admin Connectivity Check  Post",
+                  "type": "array"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Check Connectivity",
+        "tags": ["sep"]
+      }
+    },
+    "/api/sep/admin/settings/": {
+      "get": {
+        "description": "List every exposed settings class with current values and metadata.\n\nLocal classes are read from their config singletons; remote classes\n(``remote_classes``) are fetched server-side from their owning sub-app\nand appended in declaration order; app-owned classes follow remote\ngroups with per-group app metadata. A failed remote fetch fails the\nwhole request with ``502`` -- the LIST never silently drops a remote\ngroup.\n\n:param session: The sub-app's database session.\n:param remote_api: The client for remote settings classes (``None`` when\n    the router wires none).\n:return: Grouped responses, one group per configured settings class.",
+        "operationId": "sep_list_settings_api_sep_admin_settings__get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SettingsListResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "List Settings",
+        "tags": ["sep"]
+      }
+    },
+    "/api/sep/admin/settings/export": {
+      "get": {
+        "description": "Return the merged effective configuration as a YAML attachment.\n\nAggregates the SEP-wired core settings classes and app-owned settings\nclasses locally and fans out to ``GET /admin/settings/`` on the Tasks API\nfor ``TasksSettings``. Values use the same dump path as the settings LIST\nendpoints. On upstream failure, re-raise as\n:class:`~app.core.exceptions.HTTPBadGatewayException` — no partial export.\n\nWhen ``keys`` is omitted the full merged export is returned exactly as\nbefore. When provided, each entry is a fully-qualified selector\n(``Class.KEY`` or a bare ``Class``); the response is narrowed to only the\nrequested classes/keys. Class names and SEP keys are validated with no\nupstream call; the Tasks fan-out is skipped entirely unless a selector\ntargets ``TasksSettings``, and Tasks keys are validated against the fetched\nblock. Output blocks always follow the canonical declaration order\n(``SEP_ADMIN_SETTINGS_CLASSES``, then app-owned classes, then\n``TasksSettings``), independent of selector order.\n\n:param session: The active database session for SEP override queries.\n:type session: AsyncSession\n:param tasks_api: The Tasks API client used to fetch ``TasksSettings``.\n:type tasks_api: TaskAPI\n:param keys: Optional, repeatable selectors restricting the export to a\n    subset of classes/keys. ``None`` (omitted) means the full export.\n:type keys: list[str] | None\n:return: YAML bytes with ``Content-Disposition`` set for download.\n:rtype: Response\n:raises HTTPBadRequestException: If a selector is blank, malformed, names an\n    unwired class, or names a key that does not exist on its class.\n:raises HTTPBadGatewayException: If the Tasks settings LIST call fails\n    with an ``HTTPException`` (e.g. an upstream non-2xx response), an\n    ``OSError`` (e.g. a connection failure), an unexpected payload shape,\n    or a missing ``TasksSettings`` group.",
+        "operationId": "sep_export_settings_api_sep_admin_settings_export_get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "keys",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "items": {
+                    "type": "string"
+                  },
+                  "type": "array"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Keys"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          },
+          "502": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "properties": {
+                    "detail": {
+                      "type": "string"
+                    }
+                  },
+                  "required": ["detail"],
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Upstream Tasks API failure."
+          }
+        },
+        "summary": "Export Settings",
+        "tags": ["sep"]
+      }
+    },
+    "/api/sep/admin/settings/{setting_class}": {
+      "patch": {
+        "description": "Apply a batch of overrides for one settings class atomically.\n\nFor a remote class the batch is forwarded to the owning sub-app, which\nowns the validation and persistence; the upstream's per-field ``422``\n(and its ``detail``) is preserved so the UI can render inline messages.\n\nFor a local class: Phase A validates every key in ``body`` (existence on\nthe class, HOT classification, type/constraint coercion) and collects\nper-key errors. If any key fails, the whole batch is rejected with a\nstructured 422 and nothing is written. Phase B persists every valid entry\nin a single transaction, refreshes the proxy snapshot once, then fires\nthe rebind callbacks for any changed keys so a HOT target rebinds without\nwaiting for the next background refresh cycle.\n\n:param request: The incoming request; its ``app.state`` carries the\n    sub-app's rebind-callback registry.\n:param setting_class: The settings class the override targets.\n:param body: The batch of ``{key: value, ...}`` overrides.\n:param session: The sub-app's database session.\n:param remote_api: The client for remote settings classes (``None`` when\n    the router wires none).\n:return: One :class:`SettingResponse` per applied key, in input order.\n:raises HTTPNotFoundException: If the class isn't exposed.\n:raises HTTPUnprocessableEntityException: If any key fails validation;\n    no rows are written.",
+        "operationId": "sep_patch_settings_api_sep_admin_settings__setting_class__patch",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "setting_class",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/SettingClassEnum"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SettingsPatch"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "items": {
+                    "$ref": "#/components/schemas/SettingResponse"
+                  },
+                  "title": "Response Sep Patch Settings Api Sep Admin Settings  Setting Class  Patch",
+                  "type": "array"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Patch Settings",
+        "tags": ["sep"]
+      }
+    },
+    "/api/sep/admin/settings/{setting_class}/{key}": {
+      "delete": {
+        "description": "Revert one override row to the field's declared default.\n\nFor a remote class the DELETE is forwarded to the owning sub-app, which\nowns the idempotency and ``NOT_OVERRIDABLE`` semantics; its status and\n``detail`` are preserved through the proxy.\n\nFor a local class the DELETE is idempotent: deleting a (class, key) pair\nthat has no override row succeeds with 204. Attempting to delete a field\nthe code declares NOT_OVERRIDABLE responds 409, since it cannot have an\noverride row in the first place and the operator's intent is\nunsatisfiable. A field only ``SETTINGS_OVERRIDE_ALLOWED_KEYS`` withheld\nmay still carry a row written before the restriction applied, so that\nrow is deleted normally and only the no-row case answers 409.\n\nAfter republishing the snapshot, fires the rebind callbacks for the\nreverted key so a HOT target rebinds to its restored value without\nwaiting for the next background refresh cycle.\n\n:param request: The incoming request; its ``app.state`` carries the\n    sub-app's rebind-callback registry.\n:param setting_class: The settings class the field belongs to.\n:param key: The field name on the settings class.\n:param session: The sub-app's database session.\n:param remote_api: The client for remote settings classes (``None`` when\n    the router wires none).\n:raises HTTPNotFoundException: If the class isn't exposed or the key\n    doesn't exist on the class.\n:raises HTTPConflictException: If the field is NOT_OVERRIDABLE and has\n    no row to delete.\n:raises HTTPUnprocessableEntityException: If ``key`` names a\n    ``NESTED_ONLY`` parent (the whole parent cannot be overridden;\n    target an individual ``parent__leaf`` instead).\n:raises HTTPBadGatewayException: For a remote class, when the owning\n    sub-app returns a server error (status >= 500) or is unreachable.",
+        "operationId": "sep_delete_setting_api_sep_admin_settings__setting_class___key__delete",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "setting_class",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/SettingClassEnum"
+            }
+          },
+          {
+            "in": "path",
+            "name": "key",
+            "required": true,
+            "schema": {
+              "title": "Key",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Delete Setting",
+        "tags": ["sep"]
+      },
+      "get": {
+        "description": "Return one field's metadata and current value.\n\n:param setting_class: The settings class the field belongs to.\n:param key: The field name on the settings class.\n:param session: The sub-app's database session.\n:param remote_api: The client for remote settings classes (``None`` when\n    the router wires none).\n:return: The structured response for the field.\n:raises HTTPNotFoundException: If the class isn't exposed or the key\n    doesn't exist on the class.",
+        "operationId": "sep_get_setting_api_sep_admin_settings__setting_class___key__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "setting_class",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/SettingClassEnum"
+            }
+          },
+          {
+            "in": "path",
+            "name": "key",
+            "required": true,
+            "schema": {
+              "title": "Key",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SettingResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Get Setting",
+        "tags": ["sep"]
+      }
+    },
+    "/api/sep/app-info/": {
+      "get": {
+        "description": "Return shell metadata for the React frontend.\n\nRender ``footer_text`` from the shared :func:`render_footer_text` helper so\nthe JSON endpoint and the legacy Jinja sidebar footer cannot drift. The\nhelper reads the hot ``FOOTER_TEMPLATE`` setting per request, so a live\n``SEP__FOOTER_TEMPLATE`` override is reflected without a restart. Access is\ngated by the router-level ``IsApiAuthenticated`` dependency.\n\n:return: The rendered footer text.",
+        "operationId": "sep_get_app_info_api_sep_app_info__get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AppInfo"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Get App Info",
+        "tags": ["sep"]
+      }
+    },
+    "/api/sep/dashboard/": {
+      "get": {
+        "description": "Return aggregate counts for all four dashboard stat cards.\n\nSources (each degrades to ``0`` on failure):\n\n* ``nodes`` — ``GET /summary/`` on the Inventory API.\n* ``tasks`` — ``GET /`` on the Tasks API (``limit=1``; reads ``total``).\n* ``snippets`` — :meth:`SnippetManager.count` on the SEP database.\n* ``targets`` — ``GET /hosts/`` on the Tasks API; count of returned items.\n\nWhen one or more sources fail the names of the failed sources are joined\nwith commas and set on the ``X-Sep-Upstream-Error`` response header so the\ncaller can surface a partial-failure warning without treating all-zero\ncounts as healthy data.\n\n:param response: The outgoing response used to attach the error header.\n:type response: Response\n:param session: The active database session for snippet queries.\n:type session: AsyncSession\n:param tasks_api: Async client for the Tasks sub-app.\n:type tasks_api: RemoteAPI\n:param inventory_api: Async client for the Inventory sub-app.\n:type inventory_api: RemoteAPI\n:return: Aggregate counts for nodes, tasks, snippets, and targets.\n:rtype: DashboardStatsResponse",
+        "operationId": "sep_get_dashboard_stats_api_sep_dashboard__get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/DashboardStatsResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Get Dashboard Stats",
+        "tags": ["sep"]
+      }
+    },
+    "/api/sep/hosts/": {
+      "get": {
+        "description": "Return executor hosts merged with inventory display names.\n\nCall ``tasks_api.get('/hosts/')`` for executor targets and the Inventory\nAPI for display-name enrichment. The two upstream calls degrade\ndifferently: Inventory failures cause hosts without a match to keep the\nraw executor node name (the response still returns ``200``), but a\nTasks-API failure (HTTP or connection error) is re-raised as\n:class:`~app.core.exceptions.HTTPBadGatewayException` so the SEP exception\nhandler emits a ``502`` JSON body ``{\"detail\": \"<upstream detail>\"}`` that\nthe React frontend surfaces through its React Query error slot.\n\n:param tasks_api: The Tasks API client used to fetch executor hosts.\n:type tasks_api: TaskAPI\n:param inventory_api: The Inventory API client used to enrich the hosts\n    with their display names.\n:type inventory_api: InventoryAPI\n:return: Sorted list of hosts, each with executor id, friendly name,\n    and network address.\n:rtype: list[HostResponse]\n:raises HTTPBadGatewayException: If the Tasks API call fails with an\n    ``HTTPException`` (e.g. an upstream non-2xx response) or an\n    ``OSError`` (e.g. a connection failure).",
+        "operationId": "sep_list_hosts_api_sep_hosts__get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "items": {
+                    "$ref": "#/components/schemas/HostResponse"
+                  },
+                  "title": "Response Sep List Hosts Api Sep Hosts  Get",
+                  "type": "array"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "502": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "properties": {
+                    "detail": {
+                      "type": "string"
+                    }
+                  },
+                  "required": ["detail"],
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Upstream Tasks API failure."
+          }
+        },
+        "summary": "List Hosts",
+        "tags": ["sep"]
+      }
+    },
+    "/api/sep/periodic-tasks/": {
+      "get": {
+        "description": "Return the upstream periodic-task list through the SEP gateway.\n\n:param tasks_api: The Tasks API client used to fetch the upstream list.\n:return: The upstream periodic-task list, or ``[]`` when the upstream\n    payload is not a list.\n:raises HTTPException: Re-raised unchanged for an upstream client error\n    (status < 500).\n:raises HTTPBadGatewayException: For an upstream server error (status >= 500)\n    or a connection-level ``OSError``.",
+        "operationId": "tasks_list_periodic_tasks_api_sep_periodic_tasks__get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "items": {
+                    "type": "object"
+                  },
+                  "title": "Response Tasks List Periodic Tasks Api Sep Periodic Tasks  Get",
+                  "type": "array"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "502": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "properties": {
+                    "detail": {
+                      "type": "string"
+                    }
+                  },
+                  "required": ["detail"],
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Upstream Tasks API failure."
+          }
+        },
+        "summary": "List Periodic Tasks",
+        "tags": ["tasks"]
+      }
+    },
+    "/api/sep/periodic-tasks/{periodic_task_id}": {
+      "delete": {
+        "description": "Dispatch deletion of a periodic task to the Tasks API.\n\n:param periodic_task_id: The id of the periodic task to delete.\n:param tasks_api: The Tasks API client used to delete the periodic task.\n:raises HTTPException: Re-raised unchanged for an upstream client error\n    (status < 500).\n:raises HTTPBadGatewayException: For an upstream server error (status >= 500)\n    or a connection-level ``OSError``.",
+        "operationId": "tasks_delete_periodic_task_api_sep_periodic_tasks__periodic_task_id__delete",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "periodic_task_id",
+            "required": true,
+            "schema": {
+              "title": "Periodic Task Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          },
+          "502": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "properties": {
+                    "detail": {
+                      "type": "string"
+                    }
+                  },
+                  "required": ["detail"],
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Upstream Tasks API failure."
+          }
+        },
+        "summary": "Delete Periodic Task",
+        "tags": ["tasks"]
+      },
+      "put": {
+        "description": "Dispatch a full-replacement update of a periodic task to the Tasks API.\n\n:param periodic_task_id: The id of the periodic task to update.\n:param tasks_api: The Tasks API client used to update the periodic task.\n:param body: The ``PeriodicTaskUpdate`` JSON body, forwarded verbatim.\n:return: The updated periodic task as returned by the Tasks API.\n:raises HTTPException: Re-raised unchanged for an upstream client error\n    (status < 500).\n:raises HTTPBadGatewayException: For an upstream server error (status >= 500)\n    or a connection-level ``OSError``.",
+        "operationId": "tasks_update_periodic_task_api_sep_periodic_tasks__periodic_task_id__put",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "periodic_task_id",
+            "required": true,
+            "schema": {
+              "title": "Periodic Task Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "title": "Body",
+                "type": "object"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "title": "Response Tasks Update Periodic Task Api Sep Periodic Tasks  Periodic Task Id  Put",
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          },
+          "502": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "properties": {
+                    "detail": {
+                      "type": "string"
+                    }
+                  },
+                  "required": ["detail"],
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Upstream Tasks API failure."
+          }
+        },
+        "summary": "Update Periodic Task",
+        "tags": ["tasks"]
+      }
+    },
+    "/api/sep/periodic-tasks/{task_name}/": {
+      "post": {
+        "description": "Dispatch creation of a periodic task for ``task_name`` to the Tasks API.\n\n:param task_name: The task name the new periodic schedule runs.\n:param tasks_api: The Tasks API client used to create the periodic task.\n:param body: The ``PeriodicTaskCreate`` JSON body, forwarded verbatim.\n:return: The created periodic task as returned by the Tasks API.\n:raises HTTPException: Re-raised unchanged for an upstream client error\n    (status < 500).\n:raises HTTPBadGatewayException: For an upstream server error (status >= 500)\n    or a connection-level ``OSError``.",
+        "operationId": "tasks_create_periodic_task_api_sep_periodic_tasks__task_name___post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "title": "Body",
+                "type": "object"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "title": "Response Tasks Create Periodic Task Api Sep Periodic Tasks  Task Name   Post",
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          },
+          "502": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "properties": {
+                    "detail": {
+                      "type": "string"
+                    }
+                  },
+                  "required": ["detail"],
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Upstream Tasks API failure."
+          }
+        },
+        "summary": "Create Periodic Task",
+        "tags": ["tasks"]
+      }
+    },
+    "/api/sep/schemas/{schema_id}/tables": {
+      "get": {
+        "description": "Return tables for a schema via the SEP gateway.\n\nProxies Inventory ``GET /schemas/{schema_id}/tables/`` for React\n``TableSelector`` components. Returns an empty list only when Inventory\nresponds with 404 (missing schema); other HTTP errors propagate to the\nglobal handler (matches legacy AJAX empty-selector UX for not-found only).\n\n:param schema_id: The inventory schema ID whose tables are listed.\n:type schema_id: int\n:param inventory_api: The Inventory API client used to proxy the request.\n:type inventory_api: InventoryAPI\n:param search: Optional substring filter forwarded to inventory.\n:type search: str | None\n:return: Minimal id/name options for each table in the schema.\n:rtype: list[InventorySelectorOption]",
+        "operationId": "sep_list_schema_tables_api_sep_schemas__schema_id__tables_get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "schema_id",
+            "required": true,
+            "schema": {
+              "title": "Schema Id",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "search",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Search"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "items": {
+                    "$ref": "#/components/schemas/InventorySelectorOption"
+                  },
+                  "title": "Response Sep List Schema Tables Api Sep Schemas  Schema Id  Tables Get",
+                  "type": "array"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "List Schema Tables",
+        "tags": ["sep"]
+      }
+    },
+    "/api/sep/services/": {
+      "get": {
+        "description": "Return a paginated list of inventory services via the SEP gateway.\n\n:param inventory_api: The Inventory API client used to proxy the request.\n:type inventory_api: InventoryAPI\n:param service_type: Optional service type filter forwarded to inventory.\n:type service_type: ServiceTypeEnum | None\n:param pagination: Validated pagination window for this request.\n:type pagination: Pagination\n:return: Paginated services payload.\n:rtype: PaginatedResponse[ServiceResponse]",
+        "operationId": "sep_list_services_api_sep_services__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "service_type",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "$ref": "#/components/schemas/ServiceTypeEnum"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Service Type"
+            }
+          },
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PaginatedResponse_ServiceResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "List Services",
+        "tags": ["sep"]
+      }
+    },
+    "/api/sep/services/{service_id}/schemas": {
+      "get": {
+        "description": "Return schemas for a service via the SEP gateway.\n\nProxies Inventory ``GET /services/{service_id}/schemas/`` for React\n``SchemaSelector`` components. Returns an empty list only when Inventory\nresponds with 404 (missing service); other HTTP errors propagate to the\nglobal handler (matches legacy AJAX empty-selector UX for not-found only).\n\n:param service_id: The inventory service ID whose schemas are listed.\n:type service_id: int\n:param inventory_api: The Inventory API client used to proxy the request.\n:type inventory_api: InventoryAPI\n:param search: Optional substring filter forwarded to inventory.\n:type search: str | None\n:return: Minimal id/name options for each schema on the service.\n:rtype: list[InventorySelectorOption]",
+        "operationId": "sep_list_service_schemas_api_sep_services__service_id__schemas_get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "service_id",
+            "required": true,
+            "schema": {
+              "title": "Service Id",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "search",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Search"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "items": {
+                    "$ref": "#/components/schemas/InventorySelectorOption"
+                  },
+                  "title": "Response Sep List Service Schemas Api Sep Services  Service Id  Schemas Get",
+                  "type": "array"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "List Service Schemas",
+        "tags": ["sep"]
+      }
+    },
+    "/api/sep/task-history/": {
+      "get": {
+        "description": "Return task-history rows, listing all of them or merging selected names.\n\nThree-way on ``task_names``:\n\n* **omitted** (``None``) -- proxy the upstream ``GET /history/`` list, already\n  paginated, forwarding the ``status`` filter, ``exclude_internal`` flag, and\n  client ``offset`` / ``limit``.\n* **provided, at least one non-blank name** -- query each name independently\n  against the Tasks API, then merge, sort newest-first, and paginate globally.\n* **provided, every name blank after trimming** -- reject with ``422``.\n\n:param tasks_api: The Tasks API client used to fetch upstream history.\n:param pagination: Validated offset/limit query parameters.\n:param task_names: Zero or more task names (repeat the query param); omit to\n    list all history.\n:param task_status: Optional exact status filter forwarded upstream.\n:param exclude_internal: When ``True``, forward the filter to the upstream\n    list-all path so internal maintenance tasks are excluded before pagination.\n    Not forwarded on the ``task_names`` merge path. Defaults to ``False``.\n:return: Paginated task history, either the upstream list or the merged set.\n:raises HTTPUnprocessableEntityException: When ``task_names`` is supplied but\n    every value is empty after trimming.\n:raises HTTPBadGatewayException: For an upstream server error (status >= 500)\n    or a connection-level ``OSError``, on either the list-all passthrough or\n    the merged-history fan-out.",
+        "operationId": "tasks_list_merged_task_history_api_sep_task_history__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "task_names",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "items": {
+                    "type": "string"
+                  },
+                  "type": "array"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Task Names"
+            }
+          },
+          {
+            "in": "query",
+            "name": "status",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Status"
+            }
+          },
+          {
+            "in": "query",
+            "name": "exclude_internal",
+            "required": false,
+            "schema": {
+              "default": false,
+              "title": "Exclude Internal",
+              "type": "boolean"
+            }
+          },
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PaginatedResponse_TaskHistoryResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          },
+          "502": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "properties": {
+                    "detail": {
+                      "type": "string"
+                    }
+                  },
+                  "required": ["detail"],
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Upstream Tasks API failure."
+          }
+        },
+        "summary": "List Merged Task History",
+        "tags": ["tasks"]
+      }
+    },
+    "/api/sep/task-history/{task_history_id}/stop/": {
+      "post": {
+        "description": "Dispatch a stop request for a single task-history row to the Tasks API.\n\n:param task_history_id: The id of the task-history row to stop.\n:param tasks_api: The Tasks API client used to issue the stop request.\n:return: The stopped task-history row as returned by the Tasks API.\n:raises HTTPException: Re-raised unchanged for an upstream client error\n    (status < 500), e.g. a ``400`` when the task is not running.\n:raises HTTPBadGatewayException: For an upstream server error (status >= 500)\n    or a connection-level ``OSError``.",
+        "operationId": "tasks_stop_task_history_api_sep_task_history__task_history_id__stop__post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_history_id",
+            "required": true,
+            "schema": {
+              "title": "Task History Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "title": "Response Tasks Stop Task History Api Sep Task History  Task History Id  Stop  Post",
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          },
+          "502": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "properties": {
+                    "detail": {
+                      "type": "string"
+                    }
+                  },
+                  "required": ["detail"],
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Upstream Tasks API failure."
+          }
+        },
+        "summary": "Stop Task History",
+        "tags": ["tasks"]
+      }
+    },
+    "/api/sep/task-stats/{task_name}": {
+      "get": {
+        "description": "Return aggregated execution statistics for ``task_name``.\n\nProxy to the Tasks-service ``GET /stats/{task_name}`` aggregation so the\nReact frontend reaches the data through SEP rather than calling the Tasks\nsub-app directly. On upstream failure, re-raise as\n:class:`~app.core.exceptions.HTTPBadGatewayException` so the SEP exception\nhandler emits a ``502`` JSON body ``{\"detail\": \"<upstream detail>\"}`` that\nthe React frontend surfaces through React Query's error state.\n\n:param task_name: The task name (not the database id) whose stats are\n    being requested.\n:type task_name: str\n:param tasks_api: The Tasks API client used to fetch the upstream stats.\n:type tasks_api: TaskAPI\n:return: The raw upstream stats payload.\n:rtype: dict[str, Any]\n:raises HTTPBadGatewayException: If the Tasks API call fails with an\n    ``HTTPException`` (e.g. an upstream non-2xx response) or an\n    ``OSError`` (e.g. a connection failure).",
+        "operationId": "tasks_get_task_stats_api_sep_task_stats__task_name__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "title": "Response Tasks Get Task Stats Api Sep Task Stats  Task Name  Get",
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          },
+          "502": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "properties": {
+                    "detail": {
+                      "type": "string"
+                    }
+                  },
+                  "required": ["detail"],
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Upstream Tasks API failure."
+          }
+        },
+        "summary": "Get Task Stats",
+        "tags": ["tasks"]
+      }
+    },
+    "/execution-events/{task_history_id}": {
+      "get": {
+        "description": "Return executor tracking events for a task history (Tasks API proxy).",
+        "operationId": "tasks_list_task_execution_events_execution_events__task_history_id__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_history_id",
+            "required": true,
+            "schema": {
+              "title": "Task History Id",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "owner",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Owner"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "items": {
+                    "$ref": "#/components/schemas/ExecutionEvent"
+                  },
+                  "title": "Response Tasks List Task Execution Events Execution Events  Task History Id  Get",
+                  "type": "array"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "List Task Execution Events",
+        "tags": ["tasks"]
+      }
+    },
+    "/files/{task_history_id}": {
+      "get": {
+        "description": "Return files available for the given task history.",
+        "operationId": "tasks_list_task_history_files_files__task_history_id__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_history_id",
+            "required": true,
+            "schema": {
+              "title": "Task History Id",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "owner",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Owner"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "additionalProperties": {
+                    "$ref": "#/components/schemas/FileMetadata"
+                  },
+                  "title": "Response Tasks List Task History Files Files  Task History Id  Get",
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "List Task History Files",
+        "tags": ["tasks"]
+      }
+    },
+    "/files/{task_history_id}/download": {
+      "get": {
+        "description": "Stream a task history's archived file as a binary download.",
+        "operationId": "tasks_download_task_history_file_files__task_history_id__download_get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_history_id",
+            "required": true,
+            "schema": {
+              "title": "Task History Id",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "owner",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Owner"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Download Task History File",
+        "tags": ["tasks"]
+      }
+    },
+    "/stream-logs/{task_history_id}": {
+      "get": {
+        "description": "Stream a task history's logs as server-sent events.",
+        "operationId": "tasks_task_logs_event_stream_stream_logs__task_history_id__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_history_id",
+            "required": true,
+            "schema": {
+              "title": "Task History Id",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "owner",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Owner"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Task Logs Event Stream",
+        "tags": ["tasks"]
+      }
+    },
+    "/stream-logs/{task_history_id}/execution-events": {
+      "get": {
+        "description": "Stream task execution events as server-sent events.",
+        "operationId": "tasks_task_execution_events_stream_stream_logs__task_history_id__execution_events_get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_history_id",
+            "required": true,
+            "schema": {
+              "title": "Task History Id",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "owner",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Owner"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Task Execution Events Stream",
+        "tags": ["tasks"]
+      }
+    }
+  }
+}
diff --git a/ui/packages/sep/api/specs/tasks.json b/ui/packages/sep/api/specs/tasks.json
new file mode 100644
index 00000000000..62bae4428a3
--- /dev/null
+++ b/ui/packages/sep/api/specs/tasks.json
@@ -0,0 +1,3382 @@
+{
+  "components": {
+    "schemas": {
+      "ConnectivityCheckResponse": {
+        "description": "Represent a connectivity check result.\n\n:param success: Whether the connectivity check succeeded.\n:param error: Error message if the check failed. Defaults to ``None``.\n:param task_history_id: The ID of the task history record for this check.",
+        "properties": {
+          "error": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Error"
+          },
+          "success": {
+            "title": "Success",
+            "type": "boolean"
+          },
+          "task_history_id": {
+            "title": "Task History Id",
+            "type": "integer"
+          }
+        },
+        "required": ["success", "task_history_id"],
+        "title": "ConnectivityCheckResponse",
+        "type": "object"
+      },
+      "ConnectivityCheckWrite": {
+        "description": "Represent a connectivity check request payload.\n\n:param target: The Nomad node name to run the check on.\n:param host: The database host address.\n:param port: The database port number.\n:param service_type: The type of database service to check.\n:param timeout: Connect-phase budget in seconds, counted only once the\n    ``run-script`` task starts. Total server wait is ``PROVISIONING_TIMEOUT``\n    (provisioning phase) plus this value. Defaults to 30.",
+        "properties": {
+          "host": {
+            "title": "Host",
+            "type": "string"
+          },
+          "port": {
+            "title": "Port",
+            "type": "integer"
+          },
+          "service_type": {
+            "$ref": "#/components/schemas/ConnectivityServiceType"
+          },
+          "target": {
+            "title": "Target",
+            "type": "string"
+          },
+          "timeout": {
+            "default": 30,
+            "exclusiveMinimum": 0.0,
+            "maximum": 60.0,
+            "title": "Timeout",
+            "type": "integer"
+          }
+        },
+        "required": ["target", "host", "port", "service_type"],
+        "title": "ConnectivityCheckWrite",
+        "type": "object"
+      },
+      "ConnectivityServiceType": {
+        "description": "Define supported database service types for connectivity checks.\n\n:cvar MYSQL: MySQL database service.\n:vartype MYSQL: str\n:cvar POSTGRESQL: PostgreSQL database service.\n:vartype POSTGRESQL: str\n:cvar MONGODB: MongoDB database service.\n:vartype MONGODB: str",
+        "enum": ["mysql", "postgresql", "mongodb"],
+        "title": "ConnectivityServiceType",
+        "type": "string"
+      },
+      "CrontabSchedule": {
+        "description": "Representing a crontab schedule.\n\n:param minute: Represents the minute component in cron format. Defaults to `\"*\"`.\n:type minute: str\n:param hour: Represents the hour component in cron format. Defaults to `\"*\"`.\n:type hour: str\n:param day_of_week: Represents the day of the week component in cron format.\n    Defaults to `\"*\"`.\n:type day_of_week: str\n:param day_of_month: Represents the day of the month component in cron format.\n    Defaults to `\"*\"`.\n:type day_of_month: str\n:param month_of_year: Represents the month component in cron format.\n    Defaults to `\"*\"`.\n:type month_of_year: str\n:param timezone: The timezone for the cron schedule. Defaults to \"UTC\". Must be a\n    valid timezone as returned in `available_timezones()`\n:type timezone: str",
+        "properties": {
+          "day_of_month": {
+            "default": "*",
+            "title": "Day Of Month",
+            "type": "string"
+          },
+          "day_of_week": {
+            "default": "*",
+            "title": "Day Of Week",
+            "type": "string"
+          },
+          "hour": {
+            "default": "*",
+            "title": "Hour",
+            "type": "string"
+          },
+          "minute": {
+            "default": "*",
+            "title": "Minute",
+            "type": "string"
+          },
+          "month_of_year": {
+            "default": "*",
+            "title": "Month Of Year",
+            "type": "string"
+          },
+          "timezone": {
+            "default": "UTC",
+            "title": "Timezone",
+            "type": "string"
+          }
+        },
+        "title": "CrontabSchedule",
+        "type": "object"
+      },
+      "ExecutionEvent": {
+        "description": "A single lifecycle event from a task executor (executor-agnostic shape).\n\n:param timestamp: When the event occurred (UTC).\n:type timestamp: UTCDatetime\n:param event_type: Executor-specific event category (e.g. Nomad task event type).\n:type event_type: str\n:param description: Human-readable message for the event (no step prefix).\n:type description: str\n:param step: Optional executor task/step name (e.g. Nomad task within the group).\n:type step: str | None",
+        "properties": {
+          "description": {
+            "title": "Description",
+            "type": "string"
+          },
+          "step": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Step"
+          },
+          "timestamp": {
+            "format": "date-time",
+            "title": "Timestamp",
+            "type": "string"
+          },
+          "type": {
+            "title": "Type",
+            "type": "string"
+          }
+        },
+        "required": ["timestamp", "type", "description"],
+        "title": "ExecutionEvent",
+        "type": "object"
+      },
+      "FileMetadata": {
+        "description": "Represent file metadata for task artifacts.",
+        "properties": {
+          "is_dir": {
+            "default": false,
+            "title": "Is Dir",
+            "type": "boolean"
+          },
+          "size": {
+            "default": 0,
+            "title": "Size",
+            "type": "integer"
+          }
+        },
+        "title": "FileMetadata",
+        "type": "object"
+      },
+      "HTTPValidationError": {
+        "properties": {
+          "detail": {
+            "items": {
+              "$ref": "#/components/schemas/ValidationError"
+            },
+            "title": "Detail",
+            "type": "array"
+          }
+        },
+        "title": "HTTPValidationError",
+        "type": "object"
+      },
+      "IntervalSchedule": {
+        "description": "Represent an interval schedule.\n\n:param every: The number of periods between each execution.\n:type every: PositiveInt\n:param period: The period unit for the interval (e.g., hours, minutes).\n:type period: Period",
+        "properties": {
+          "every": {
+            "exclusiveMinimum": 0.0,
+            "title": "Every",
+            "type": "integer"
+          },
+          "period": {
+            "$ref": "#/components/schemas/Period"
+          }
+        },
+        "required": ["every", "period"],
+        "title": "IntervalSchedule",
+        "type": "object"
+      },
+      "JsonValue": {},
+      "PaginatedResponse_TaskHistoryResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/TaskHistoryResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[TaskHistoryResponse]",
+        "type": "object"
+      },
+      "PaginatedResponse_TaskResponse_": {
+        "properties": {
+          "items": {
+            "items": {
+              "$ref": "#/components/schemas/TaskResponse"
+            },
+            "title": "Items",
+            "type": "array"
+          },
+          "limit": {
+            "title": "Limit",
+            "type": "integer"
+          },
+          "offset": {
+            "title": "Offset",
+            "type": "integer"
+          },
+          "total": {
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["items", "total", "offset", "limit"],
+        "title": "PaginatedResponse[TaskResponse]",
+        "type": "object"
+      },
+      "Period": {
+        "enum": ["days", "hours", "minutes", "seconds", "microseconds"],
+        "title": "Period",
+        "type": "string"
+      },
+      "PeriodicTaskCreate": {
+        "description": "Define the model for creating periodic tasks.\n\nExtends `PeriodicTaskWrite` and includes additional fields required for creating\nnew periodic tasks.\n\n:param task: The Celery task name.\n:type task: str\n:param execute_request: The execution request details for the task.\n:type execute_request: PeriodicTaskExecuteRequest | None\n:param interval: The interval schedule for the task. Defaults to None.\n:type interval: IntervalSchedule | None\n:param crontab: The crontab schedule for the task. Defaults to None.\n:type crontab: CrontabSchedule | None\n:param kwargs: A JSON string representing additional keyword arguments for the task.\n:type kwargs: str\n:param name: The name of the periodic task. Defaults to an empty string, meaning\n    the value will be automatically generated on create.\n:type name: str\n:param start_time: The start time for the task execution. Defaults to None.\n:type start_time:  UTCDatetime | None\n:param enabled: Whether the task is enabled. Defaults to True.\n:type enabled: bool\n:param description: A description of the task. Defaults to an empty string.\n:type description: str",
+        "properties": {
+          "crontab": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/CrontabSchedule"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "description": {
+            "default": "",
+            "title": "Description",
+            "type": "string"
+          },
+          "enabled": {
+            "default": true,
+            "title": "Enabled",
+            "type": "boolean"
+          },
+          "execute_request": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/PeriodicTaskExecuteRequest"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "interval": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/IntervalSchedule"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "kwargs": {
+            "title": "Kwargs",
+            "type": "string"
+          },
+          "name": {
+            "default": "",
+            "title": "Name",
+            "type": "string"
+          },
+          "start_time": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Start Time"
+          },
+          "task": {
+            "title": "Task",
+            "type": "string"
+          }
+        },
+        "required": ["task", "kwargs"],
+        "title": "PeriodicTaskCreate",
+        "type": "object"
+      },
+      "PeriodicTaskExecuteRequest": {
+        "description": "Represent the execute request the periodic task will use for executions.\n\n:param meta: A dictionary of meta variables for the task execution.\n    Defaults to an empty dictionary.\n:type meta: dict[str, Any]\n:param payload: Optional payload data or file path for the task execution.\n    Defaults to None.\n:type payload: str | None\n:param eta: The earliest time the task can be executed. Forced to None, as periodic\n    tasks are always executed on the defined schedule.\n:type eta: datetime | None",
+        "properties": {
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "chain_on_failure": {
+            "default": false,
+            "title": "Chain On Failure",
+            "type": "boolean"
+          },
+          "chain_task_names": {
+            "anyOf": [
+              {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Chain Task Names"
+          },
+          "eta": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Eta"
+          },
+          "meta": {
+            "default": {},
+            "title": "Meta",
+            "type": "object"
+          },
+          "payload": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Payload"
+          }
+        },
+        "title": "PeriodicTaskExecuteRequest",
+        "type": "object"
+      },
+      "PeriodicTaskResponse": {
+        "description": "Represent a response for a periodic task API call.\n\nThis model extends `BasePeriodicTask` and includes additional fields such as ID,\nlast run time, total run count, and date changed.\n\n:param name: The name of the periodic task.\n:type name: str\n:param task: The SEP task name.\n:type task: str\n:param start_time: The start time for the task execution.\n:type start_time: UTCDatetime | None\n:param enabled: Whether the task is enabled.\n:type enabled: bool\n:param description: A description of the task.\n:type description: str\n:param execute_request: The execution request details for the task.\n:type execute_request: PeriodicTaskExecuteRequest | None\n:param id: The unique identifier of the periodic task.\n:type id: int\n:param last_run_at: The datetime of the last run.\n:type last_run_at: UTCDatetime | None\n:param total_run_count: The total number of times the task has run.\n:type total_run_count: int\n:param date_changed: The datetime when the task was last changed.\n:type date_changed: UTCDatetime | None\n:param last_run_status: The result of this schedule's own most recent\n    run, or ``None`` when the schedule has never run. Resolved as the\n    earliest system-triggered history for this task name at or after the\n    schedule's ``last_run_at``, so a later unrelated system run of the same\n    task name is not misattributed.\n:param interval: The interval schedule for the task. Defaults to None. This field\n    is populated with the alias \"model_intervalschedule\".\n:type interval: IntervalSchedule | None\n:param crontab: The crontab schedule for the task. Defaults to None. This field\n    is populated with the alias \"model_crontabschedule\".\n:type crontab: CrontabSchedule | None",
+        "properties": {
+          "crontab": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/CrontabSchedule"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "date_changed": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Date Changed"
+          },
+          "description": {
+            "title": "Description",
+            "type": "string"
+          },
+          "enabled": {
+            "title": "Enabled",
+            "type": "boolean"
+          },
+          "execute_request": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/PeriodicTaskExecuteRequest"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "id": {
+            "title": "Id",
+            "type": "integer"
+          },
+          "interval": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/IntervalSchedule"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "last_run_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Run At"
+          },
+          "last_run_status": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "next_run_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Compute the next scheduled execution time.\n\nReturn the next execution time based on the task's schedule. For crontab\nschedules, use `croniter` to compute the next fire time from the cron\nexpression in the schedule's timezone, converted to UTC. For interval\nschedules, add the interval duration to `last_run_at`, falling back to\n`start_time`, then the current time.\n\n:return: The next scheduled execution time in UTC, or `None` if the task\n    is disabled.\n:rtype: UTCDatetime | None",
+            "readOnly": true,
+            "title": "Next Run At"
+          },
+          "period": {
+            "description": "Get the period string for the periodic task.\n\nReturns a string representation of the task's schedule based on whether it uses\nan interval or crontab schedule.\n\n:return: A string representing the task's period.\n:rtype: str",
+            "readOnly": true,
+            "title": "Period",
+            "type": "string"
+          },
+          "start_time": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Start Time"
+          },
+          "task": {
+            "title": "Task",
+            "type": "string"
+          },
+          "total_run_count": {
+            "default": 0,
+            "title": "Total Run Count",
+            "type": "integer"
+          }
+        },
+        "required": [
+          "name",
+          "task",
+          "start_time",
+          "enabled",
+          "description",
+          "id",
+          "last_run_at",
+          "date_changed",
+          "period",
+          "next_run_at"
+        ],
+        "title": "PeriodicTaskResponse",
+        "type": "object"
+      },
+      "PeriodicTaskUpdate": {
+        "description": "Define the model for updating periodic tasks.\n\nExtends `PeriodicTaskWrite` and adds validations specific to updating tasks.\n\n:param name: The name of the periodic task.\n:type name: str\n:param task: The Celery task name.\n:type task: str\n:param start_time: The start time for the task execution.\n:type start_time: UTCDatetime | None\n:param enabled: Whether the task is enabled.\n:type enabled: bool\n:param description: A description of the task.\n:type description: str\n:param execute_request: The execution request details for the task.\n:type execute_request: PeriodicTaskExecuteRequest | None\n:param interval: The interval schedule for the task. Defaults to None.\n:type interval: IntervalSchedule | None\n:param crontab: The crontab schedule for the task. Defaults to None.\n:type crontab: CrontabSchedule | None\n:param kwargs: A JSON string representing additional keyword arguments for the task.\n:type kwargs: str",
+        "properties": {
+          "crontab": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/CrontabSchedule"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "description": {
+            "title": "Description",
+            "type": "string"
+          },
+          "enabled": {
+            "title": "Enabled",
+            "type": "boolean"
+          },
+          "execute_request": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/PeriodicTaskExecuteRequest"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "interval": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/IntervalSchedule"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "kwargs": {
+            "title": "Kwargs",
+            "type": "string"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "start_time": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Start Time"
+          },
+          "task": {
+            "title": "Task",
+            "type": "string"
+          }
+        },
+        "required": [
+          "name",
+          "task",
+          "start_time",
+          "enabled",
+          "description",
+          "kwargs"
+        ],
+        "title": "PeriodicTaskUpdate",
+        "type": "object"
+      },
+      "ReloadClassification": {
+        "description": "Declare the reload behavior of an overridable settings field.\n\n:cvar HOT: Field can be overridden via a DB row and the new value takes\n    effect on the next snapshot refresh, without restarting the service.\n    For a nested-model field, ``HOT`` permits both whole-object override\n    (``PATCH {parent: {...}}``) and per-child override (``parent__leaf``).\n:vartype HOT: str\n:cvar NESTED_ONLY: Nested-model field whose children may be overridden\n    (``parent__leaf``) while the parent itself rejects whole-object\n    override (``PATCH {parent: {...}}`` → 422). Children default to\n    HOT-inherit unless explicitly marked :func:`not_overridable_field`.\n:vartype NESTED_ONLY: str\n:cvar NOT_OVERRIDABLE: Field is not overridable from the database; YAML\n    and environment variables remain the only sources of truth.\n:vartype NOT_OVERRIDABLE: str",
+        "enum": ["hot", "nested_only", "not_overridable"],
+        "title": "ReloadClassification",
+        "type": "string"
+      },
+      "SettingClassEnum": {
+        "description": "Enumerate settings classes that may have HOT override rows.\n\nThe wired classes are ``SEPSettings``, ``TasksSettings``,\n``SnippetsSettings``, ``MessagesSettings``, the global ``Settings``,\n``AlertSettings``, ``AlertsSettings``, ``AnonymizerSettings`` and\n``InventorySettings``.\n\nTo wire a new settings class:\n\n1. Add a member here whose value matches the Pydantic class ``__name__``.\n2. Generate an Alembic migration on every consumer track that extends the\n   ``CHECK`` constraint on ``settingoverride.setting_class``. The column\n   uses ``native_enum=False`` so the value list lives in a constraint,\n   not a PostgreSQL ``TYPE`` -- the migration ``ALTER``s the constraint.\n   Note that the column and ``CHECK`` constraint persist the enum member\n   *names* (e.g. ``SEP_SETTINGS``), which is distinct from the member\n   *value* (the Pydantic class name, e.g. ``SEPSettings``).\n3. Wire a ``ProxyEntry`` for the new class in the relevant service's\n   lifespan (``app/sep/main.py`` or ``app/tasks/main.py``).",
+        "enum": [
+          "SEPSettings",
+          "TasksSettings",
+          "SnippetsSettings",
+          "MessagesSettings",
+          "Settings",
+          "AlertSettings",
+          "AnonymizerSettings",
+          "AlertsSettings",
+          "InventorySettings"
+        ],
+        "title": "SettingClassEnum",
+        "type": "string"
+      },
+      "SettingClassGroup": {
+        "description": "One settings-class group in the LIST response.\n\n:param setting_class: The settings class this group represents.\n:type setting_class: SettingClassEnum\n:param settings: The fields declared on the settings class, with their\n    current values and metadata.\n:type settings: list[SettingResponse]\n:param is_app_owned: Whether this group belongs to a SEP app under\n    ``app/sep/apps/`` rather than core SEP wiring.\n:type is_app_owned: bool\n:param app_id: The owning app's registry key when ``is_app_owned`` is\n    ``True``; ``None`` for core groups.\n:type app_id: str | None\n:param app_display_name: The owning app's human-facing label when\n    ``is_app_owned`` is ``True``; ``None`` for core groups.\n:type app_display_name: str | None\n:param app_enabled: Whether the owning app is currently enabled when\n    ``is_app_owned`` is ``True``; ``None`` for core groups. Disabled\n    apps remain listed so the frontend can hide them without a second\n    lookup.\n:type app_enabled: bool | None",
+        "properties": {
+          "app_display_name": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "App Display Name"
+          },
+          "app_enabled": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "App Enabled"
+          },
+          "app_id": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "App Id"
+          },
+          "is_app_owned": {
+            "default": false,
+            "title": "Is App Owned",
+            "type": "boolean"
+          },
+          "setting_class": {
+            "$ref": "#/components/schemas/SettingClassEnum"
+          },
+          "settings": {
+            "items": {
+              "$ref": "#/components/schemas/SettingResponse"
+            },
+            "title": "Settings",
+            "type": "array"
+          }
+        },
+        "required": ["setting_class", "settings"],
+        "title": "SettingClassGroup",
+        "type": "object"
+      },
+      "SettingResponse": {
+        "description": "Represent a single setting's metadata and current value.\n\n:param setting_class: The settings class the field belongs to.\n:param key: The field name on the settings class.\n:param key_path: Carry the canonical key segments for ``key`` such that\n    ``\"__\".join(key_path) == key``.\n:param value: The current value visible through the proxy, dumped to a\n    JSON-safe shape via the field's annotation. ``SecretStr`` fields are\n    redacted to ``\"**********\"``.\n:param default_value: The field's declared default value, dumped via the\n    same JSON serialiser. ``None`` when no default exists.\n:param type: A human-readable representation of the field's declared\n    annotation (for operator visibility; validation uses the actual\n    ``FieldInfo``).\n:param reload: The reload classification (HOT or NOT_OVERRIDABLE).\n:param description: The field's free-text description, or ``None``.\n:param is_secret: Whether the field's annotation contains a Pydantic secret\n    (``SecretStr`` / ``SecretBytes``) at any depth.\n:param is_complex: Whether the field's annotation is or contains a Pydantic\n    ``BaseModel`` subclass (true for nested submodels).\n:param has_override: Whether a row exists in the ``settingoverride`` table\n    for this ``(setting_class, key)`` pair, regardless of ``is_active``.\n:param is_advanced: Whether the setting is flagged ``advanced`` so the UI can\n    present it separately from everyday settings. Display-only:\n    it does not affect PATCH/DELETE eligibility.\n:param is_applicable: Whether the setting applies under current runtime state\n    (e.g. the active auth provider). ``False`` lets the UI present the field\n    as inert. Display-only, like ``is_advanced``: it does not block\n    PATCH/DELETE server-side; the runtime gate is the real enforcement.",
+        "properties": {
+          "default_value": {
+            "title": "Default Value"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Description"
+          },
+          "has_override": {
+            "title": "Has Override",
+            "type": "boolean"
+          },
+          "is_advanced": {
+            "default": false,
+            "title": "Is Advanced",
+            "type": "boolean"
+          },
+          "is_applicable": {
+            "default": true,
+            "title": "Is Applicable",
+            "type": "boolean"
+          },
+          "is_complex": {
+            "title": "Is Complex",
+            "type": "boolean"
+          },
+          "is_secret": {
+            "title": "Is Secret",
+            "type": "boolean"
+          },
+          "key": {
+            "title": "Key",
+            "type": "string"
+          },
+          "key_path": {
+            "items": {
+              "type": "string"
+            },
+            "title": "Key Path",
+            "type": "array"
+          },
+          "reload": {
+            "$ref": "#/components/schemas/ReloadClassification"
+          },
+          "setting_class": {
+            "$ref": "#/components/schemas/SettingClassEnum"
+          },
+          "type": {
+            "title": "Type",
+            "type": "string"
+          },
+          "value": {
+            "title": "Value"
+          }
+        },
+        "required": [
+          "setting_class",
+          "key",
+          "value",
+          "default_value",
+          "type",
+          "reload",
+          "description",
+          "is_secret",
+          "is_complex",
+          "has_override"
+        ],
+        "title": "SettingResponse",
+        "type": "object"
+      },
+      "SettingsListResponse": {
+        "description": "The LIST endpoint response, grouping settings by class.\n\n:param groups: One :class:`SettingClassGroup` per settings class the\n    router was configured with.\n:type groups: list[SettingClassGroup]",
+        "properties": {
+          "groups": {
+            "items": {
+              "$ref": "#/components/schemas/SettingClassGroup"
+            },
+            "title": "Groups",
+            "type": "array"
+          }
+        },
+        "required": ["groups"],
+        "title": "SettingsListResponse",
+        "type": "object"
+      },
+      "SettingsPatch": {
+        "additionalProperties": {
+          "$ref": "#/components/schemas/JsonValue"
+        },
+        "description": "Batch PATCH payload: a flat ``{field_name: new_value, ...}`` mapping.\n\nAn empty body is rejected as 422 because a no-op PATCH is a client bug, not\na valid request. The server coerces each value to the field's declared\ntype via :func:`coerce_field_value`; validation is all-or-nothing -- if any\nkey fails, nothing is written.",
+        "minProperties": 1,
+        "title": "SettingsPatch",
+        "type": "object"
+      },
+      "TaskBackendEnum": {
+        "description": "Control the choice of backends.\n\n:cvar NOMAD: Enum value for Nomad backend.\n:vartype NOMAD: str\n:cvar PROXY: Enum value for Proxy backend.\n:vartype PROXY: str\n:cvar CELERY: Enum value for Celery backend.\n:vartype CELERY: str",
+        "enum": ["nomad", "proxy", "celery"],
+        "title": "TaskBackendEnum",
+        "type": "string"
+      },
+      "TaskExecuteRequest": {
+        "description": "Represent a request to execute a task with additional metadata and payload.\n\n:param meta: A dictionary of meta variables for the task execution.\n    Defaults to an empty dictionary.\n:type meta: dict[str, Any]\n:param payload: Optional payload data or file path for the task execution.\n    Defaults to None.\n:type payload: str | None\n:param eta: The earliest time the task can be executed. Defaults to None, meaning\n    it will be executed as soon as possible.\n:type eta: datetime | None\n:param anonymize_mask: Bitmask of PII entities to anonymize. Defaults to None.\n:type anonymize_mask: int | None\n:param chain_task_names: Ordered list of task names to execute sequentially after\n    this one completes. Defaults to None.\n:type chain_task_names: list[str] | None\n:param chain_on_failure: Whether the chain should continue when a task fails,\n    stops, or is lost. Defaults to False (chain only on success).\n:type chain_on_failure: bool",
+        "properties": {
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "chain_on_failure": {
+            "default": false,
+            "title": "Chain On Failure",
+            "type": "boolean"
+          },
+          "chain_task_names": {
+            "anyOf": [
+              {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Chain Task Names"
+          },
+          "eta": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Eta"
+          },
+          "meta": {
+            "default": {},
+            "title": "Meta",
+            "type": "object"
+          },
+          "payload": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Payload"
+          }
+        },
+        "title": "TaskExecuteRequest",
+        "type": "object"
+      },
+      "TaskExecutionRequest": {
+        "additionalProperties": true,
+        "description": "Represent an execution request.\n\n:param task: The task name.\n:type task: str\n:param target: The target system or environment.\n:type target: str\n:param meta: Additional metadata for the task. Defaults to an empty dictionary.\n:type meta: dict | None\n:param payload: Optional payload or file path for parameterizing the task.\n    Defaults to None.\n:type payload: str | None\n:param tracking: Tracking information for task execution. Defaults to a dictionary\n    with keys for allocation and evaluation IDs.\n:type tracking: dict | None",
+        "properties": {
+          "eta": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Eta"
+          },
+          "meta": {
+            "anyOf": [
+              {
+                "type": "object"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "default": {},
+            "title": "Meta"
+          },
+          "payload": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Payload"
+          },
+          "target": {
+            "title": "Target",
+            "type": "string"
+          },
+          "task": {
+            "title": "Task",
+            "type": "string"
+          },
+          "tracking": {
+            "anyOf": [
+              {
+                "type": "object"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "default": {},
+            "title": "Tracking"
+          }
+        },
+        "required": ["task", "target"],
+        "title": "TaskExecutionRequest",
+        "type": "object"
+      },
+      "TaskHistory": {
+        "description": "Represent a task execution history.\n\n:param execution_request: The request that triggered the task execution.\n:type execution_request: TaskExecutionRequest\n:param status: The status of the task execution. Defaults to pending.\n:type status: TaskHistoryStatusEnum\n:param started_at: The datetime when the task execution started.\n:type started_at: UTCDatetime | None\n:param finished_at: The datetime when the task execution finished.\n:type finished_at: UTCDatetime | None\n:param anonymize_mask: The bitmask representing PII entities to be anonymized in\n    logs and files generated by the execution. Defaults to None, meaning it uses\n    the value defined in the associated task's :attr:`Task.anonymize_mask`.\n:type anonymize_mask: int | None\n:param task_id: The ID of the task associated with the execution.\n:type task_id: int\n:param task: The task associated with this execution history.\n:type task: Task\n:param sync_in_progress_started_at: Timestamp lock for a sync currently in progress.\n:type sync_in_progress_started_at: UTCDatetime | None\n:param log_allocation_epoch: Task-level high-water mark of the current Nomad\n    allocation ``CreateIndex``, stamped whenever the log frontier is reset. The\n    log writer consults it on the first-insert path (before any per-stream\n    ``TaskHistoryLogState`` row exists) to discard writes from a superseded\n    allocation. ``0`` is the legacy/unknown sentinel that is trusted\n    unconditionally.\n:param executed_by: The user ID of the user who executed the task.\n:type executed_by: str | None",
+        "properties": {
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "executed_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Executed By"
+          },
+          "execution_request": {
+            "$ref": "#/components/schemas/TaskExecutionRequest"
+          },
+          "finished_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Finished At"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "log_allocation_epoch": {
+            "title": "Log Allocation Epoch",
+            "type": "integer"
+          },
+          "started_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Started At"
+          },
+          "status": {
+            "$ref": "#/components/schemas/TaskHistoryStatusEnum",
+            "default": "pending"
+          },
+          "sync_in_progress_started_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Sync In Progress Started At"
+          },
+          "task_id": {
+            "title": "Task Id",
+            "type": "integer"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": [
+          "id",
+          "execution_request",
+          "task_id",
+          "log_allocation_epoch"
+        ],
+        "title": "TaskHistory",
+        "type": "object"
+      },
+      "TaskHistoryLatestStatus": {
+        "description": "Represent the latest-history projection for a single task.\n\n:param status: The latest known execution status, taken from the newest\n    history row; ``None`` only when the task has no history rows at all.\n:param finished_at: The most recent ``finished_at`` across all of the task's\n    history rows (a ``max``), so a task with an in-progress re-run still\n    reports its prior completion; ``None`` when no run has ever finished.",
+        "properties": {
+          "finished_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Finished At"
+          },
+          "status": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        },
+        "title": "TaskHistoryLatestStatus",
+        "type": "object"
+      },
+      "TaskHistoryLatestStatusRequest": {
+        "description": "Define request body for batch latest-history status lookup.\n\n:param names: Task names to resolve latest non-null history statuses for.\n:type names: list[str]",
+        "properties": {
+          "names": {
+            "items": {
+              "type": "string"
+            },
+            "maxItems": 200,
+            "title": "Names",
+            "type": "array"
+          }
+        },
+        "title": "TaskHistoryLatestStatusRequest",
+        "type": "object"
+      },
+      "TaskHistoryResponse": {
+        "description": "Represent a task history API response.\n\n:param execution_request: The request that triggered the task execution.\n:type execution_request: TaskExecutionRequest\n:param status: The status of the task execution.\n:type status: TaskHistoryStatusEnum\n:param started_at: The datetime when the task execution started.\n:type started_at: UTCDatetime | None\n:param finished_at: The datetime when the task execution finished.\n:type finished_at: UTCDatetime | None\n:param anonymize_mask: The bitmask representing PII entities to be anonymized in\n    logs and files generated by the execution. Defaults to None, meaning it uses\n    the value defined in the associated task's :attr:`Task.anonymize_mask`.\n:type anonymize_mask: int | None\n:param task: The task associated with this execution history.\n:type task: TaskResponse\n:param executed_by: The user ID of the user who executed the task.\n:type executed_by: str | None\n:param has_logs: Whether this task history has any readable log content --\n    either a chunk-store row or a legacy ``tracking[\"task_logs\"]`` blob.\n    Populated by list/retrieve routes; defaults to ``False``.\n:type has_logs: bool\n:param display_name: A user-meaningful label derived from the task name or\n    execution-request metadata. Read-only; computed on serialisation.",
+        "properties": {
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "display_name": {
+            "description": "Return a user-meaningful display label for this task history row.\n\nFor normal tasks, returns ``task.name``. For generic executor templates\n(``run-python``, ``exec-artifact``, ``exec-python-artifact``), builds a\n``\"<source>/<filename> on <target>\"`` label so otherwise-identical rows\nare distinguishable: the filename comes from the snippet metadata or the\n``file://`` payload basename, the source directory from whichever of those\ncarries one, and the target from the execution request. Falls back to\n``\"<task> on <target>\"`` when no filename is available.\n\n:return: The display label for the task history entry.",
+            "readOnly": true,
+            "title": "Display Name",
+            "type": "string"
+          },
+          "duration": {
+            "anyOf": [
+              {
+                "type": "number"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Return the duration of the task execution in seconds.\n\n:return: The duration in seconds, or None if not available.\n:rtype: float | None",
+            "readOnly": true,
+            "title": "Duration"
+          },
+          "executed_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Executed By"
+          },
+          "execution_request": {
+            "$ref": "#/components/schemas/TaskExecutionRequest"
+          },
+          "finished_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Finished At"
+          },
+          "has_logs": {
+            "default": false,
+            "title": "Has Logs",
+            "type": "boolean"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "started_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Started At"
+          },
+          "status": {
+            "$ref": "#/components/schemas/TaskHistoryStatusEnum",
+            "default": "pending"
+          },
+          "task": {
+            "$ref": "#/components/schemas/TaskResponse"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": [
+          "id",
+          "execution_request",
+          "task",
+          "duration",
+          "display_name"
+        ],
+        "title": "TaskHistoryResponse",
+        "type": "object"
+      },
+      "TaskHistoryStatusEnum": {
+        "description": "Define status codes for task executions.\n\n:cvar FAILED: Enum value for failed tasks.\n:vartype FAILED: str\n:cvar PENDING: Enum value for pending tasks.\n:vartype PENDING: str\n:cvar RUNNING: Enum value for running tasks.\n:vartype RUNNING: str\n:cvar SUCCESS: Enum value for successfully completed tasks.\n:vartype SUCCESS: str\n:cvar STOPPED: Enum value for stopped tasks.\n:vartype STOPPED: str\n:cvar LOST: Enum value for tasks that are lost.\n:vartype LOST: str\n:cvar STALE: Enum value for tasks skipped because Nomad placement\n    exceeded the configured staleness threshold.\n:vartype STALE: str",
+        "enum": [
+          "failed",
+          "pending",
+          "running",
+          "success",
+          "stopped",
+          "lost",
+          "stale"
+        ],
+        "title": "TaskHistoryStatusEnum",
+        "type": "string"
+      },
+      "TaskResponse": {
+        "description": "Represent a task API response.\n\n:param name: The name of the task.\n:param data: The task data stored in JSON format.\n:param backend: The backend used for task execution. Defaults to Nomad.\n:param owner: The owner of the task. Defaults to ``\"ANY\"``.\n:param is_template: Whether the task is a template. Defaults to False.\n:param protected: Whether the task is protected from deletion. Defaults to False.\n:param alert_on_fail: Whether to trigger an alert on task failure and\n    auto-resolve it on subsequent success. Defaults to False.\n:param alert_detail_builder: The ``\"module:function\"`` path of a plugin\n    callable that enriches this task's failure alert, or None.\n:param run_result_recorder: The ``\"module:function\"`` path of a plugin\n    callable that records this task's structured run result at terminal\n    status, or None.\n:param output_files_path: The allocation-relative path where output files\n    generated by the task are expected, or None.\n:param deleted_at: The deletion timestamp, if applicable.\n:param anonymize_mask: The bitmask representing PII entities to be anonymized in\n    logs and files generated by the task. Defaults to 0 (no anonymization).\n:param created_by: The user ID of the user who created the task.\n:param last_updated_by: The user ID of the user who last modified the task.\n:param anonymized_entities: Sorted list of PII entity names derived from\n    ``anonymize_mask`` (or from the owner's configured defaults when the\n    mask is ``None``). Each name is the raw ``PIIEntity`` member name\n    (e.g. ``\"EMAIL_ADDRESS\"``). Read-only; computed on serialisation.",
+        "properties": {
+          "alert_detail_builder": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Alert Detail Builder"
+          },
+          "alert_on_fail": {
+            "default": false,
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "anonymized_entities": {
+            "description": "Return sorted PII entity names decoded from ``anonymize_mask``.",
+            "items": {
+              "type": "string"
+            },
+            "readOnly": true,
+            "title": "Anonymized Entities",
+            "type": "array"
+          },
+          "backend": {
+            "$ref": "#/components/schemas/TaskBackendEnum",
+            "default": "nomad"
+          },
+          "created_at": {
+            "format": "date-time",
+            "title": "Created At",
+            "type": "string"
+          },
+          "created_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Created By"
+          },
+          "data": {
+            "title": "Data",
+            "type": "object"
+          },
+          "deleted_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Deleted At"
+          },
+          "id": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Id"
+          },
+          "is_template": {
+            "default": false,
+            "title": "Is Template",
+            "type": "boolean"
+          },
+          "last_updated_by": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Last Updated By"
+          },
+          "name": {
+            "maxLength": 255,
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "output_files_path": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Output Files Path"
+          },
+          "owner": {
+            "default": "ANY",
+            "title": "Owner",
+            "type": "string"
+          },
+          "protected": {
+            "default": false,
+            "title": "Protected",
+            "type": "boolean"
+          },
+          "run_result_recorder": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Run Result Recorder"
+          },
+          "updated_at": {
+            "anyOf": [
+              {
+                "format": "date-time",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Updated At"
+          }
+        },
+        "required": [
+          "id",
+          "name",
+          "data",
+          "deleted_at",
+          "created_by",
+          "last_updated_by",
+          "anonymized_entities"
+        ],
+        "title": "TaskResponse",
+        "type": "object"
+      },
+      "TaskStats": {
+        "description": "Model for task statistics.\n\n:param engine: The backend engine used for task execution. Defaults to \"nomad\".\n:type engine: str\n:param tasks: A list of task execution histories.\n:type tasks: list[TaskHistory]",
+        "properties": {
+          "duration": {
+            "description": "Return the task duration summary.\n\n:return: A dictionary summarizing average, last, and total task durations.\n:rtype: dict[str, Any]",
+            "readOnly": true,
+            "title": "Duration",
+            "type": "object"
+          },
+          "engine": {
+            "default": "nomad",
+            "title": "Engine",
+            "type": "string"
+          },
+          "last_finished_at": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Return the last finished task timestamp.\n\n:return: The timestamp of the last task finished, or None if not available.\n:rtype: str | None",
+            "readOnly": true,
+            "title": "Last Finished At"
+          },
+          "status": {
+            "description": "Return the task status summary.\n\n:return: A dictionary summarizing the number of passed and failed tasks.\n:rtype: dict[str, int]",
+            "readOnly": true,
+            "title": "Status",
+            "type": "object"
+          },
+          "total": {
+            "description": "Return the total number of tasks.\n\n:return: The total number of tasks.\n:rtype: int",
+            "readOnly": true,
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": ["total", "status", "duration", "last_finished_at"],
+        "title": "TaskStats",
+        "type": "object"
+      },
+      "TaskWrite": {
+        "description": "Define the model for creating new tasks.\n\n:param name: The name of the task.\n:param data: The task data stored in JSON format.\n:param backend: The backend used for task execution. Defaults to Nomad.\n:param owner: The owner of the task. Defaults to ``\"ANY\"``.\n:param is_template: Whether the task is a template. Defaults to False.\n:param protected: Whether the task is protected from deletion. Defaults to False.\n:param alert_on_fail: Whether to trigger an alert on task failure and\n    auto-resolve it on subsequent success. Defaults to False.\n:param alert_detail_builder: The ``\"module:function\"`` path of a plugin\n    callable that enriches this task's failure alert, or None.\n:param run_result_recorder: The ``\"module:function\"`` path of a plugin\n    callable that records this task's structured run result at terminal\n    status, or None.\n:param output_files_path: The allocation-relative path where output files\n    generated by the task are expected, or None.\n:param anonymize_mask: The bitmask representing PII entities to be anonymized in\n    logs and files generated by the task. Defaults to 0 (no anonymization).",
+        "properties": {
+          "alert_detail_builder": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Alert Detail Builder"
+          },
+          "alert_on_fail": {
+            "default": false,
+            "title": "Alert On Fail",
+            "type": "boolean"
+          },
+          "anonymize_mask": {
+            "anyOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Anonymize Mask"
+          },
+          "backend": {
+            "$ref": "#/components/schemas/TaskBackendEnum",
+            "default": "nomad"
+          },
+          "data": {
+            "title": "Data",
+            "type": "object"
+          },
+          "is_template": {
+            "default": false,
+            "title": "Is Template",
+            "type": "boolean"
+          },
+          "name": {
+            "maxLength": 255,
+            "minLength": 1,
+            "title": "Name",
+            "type": "string"
+          },
+          "output_files_path": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Output Files Path"
+          },
+          "owner": {
+            "default": "ANY",
+            "title": "Owner",
+            "type": "string"
+          },
+          "protected": {
+            "default": false,
+            "title": "Protected",
+            "type": "boolean"
+          },
+          "run_result_recorder": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Run Result Recorder"
+          }
+        },
+        "required": ["name", "data"],
+        "title": "TaskWrite",
+        "type": "object"
+      },
+      "TransformPayloadRequest": {
+        "description": "Define the request body for the /transform/ API route.\n\n:param payload: The job specification payload to be parsed.\n:type payload: str | bytes\n:param fmt: The format of the payload, which can be \"hcl\", \"json\", or \"yaml\".\n:type fmt: Literal[\"hcl\", \"json\", \"yaml\"]",
+        "properties": {
+          "fmt": {
+            "enum": ["hcl", "json", "yaml"],
+            "title": "Fmt",
+            "type": "string"
+          },
+          "payload": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "contentMediaType": "application/octet-stream",
+                "type": "string"
+              }
+            ],
+            "title": "Payload"
+          }
+        },
+        "required": ["payload", "fmt"],
+        "title": "TransformPayloadRequest",
+        "type": "object"
+      },
+      "TransformPayloadResponse": {
+        "additionalProperties": true,
+        "description": "Define the parsed job specification returned from ``POST /transform/``.\n\nThe concrete keys depend on the executor backend; clients should treat values as\nuntyped JSON except where they validate domain-specific job fields themselves.",
+        "properties": {},
+        "title": "TransformPayloadResponse",
+        "type": "object"
+      },
+      "ValidationError": {
+        "properties": {
+          "ctx": {
+            "title": "Context",
+            "type": "object"
+          },
+          "input": {
+            "title": "Input"
+          },
+          "loc": {
+            "items": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "integer"
+                }
+              ]
+            },
+            "title": "Location",
+            "type": "array"
+          },
+          "msg": {
+            "title": "Message",
+            "type": "string"
+          },
+          "type": {
+            "title": "Error Type",
+            "type": "string"
+          }
+        },
+        "required": ["loc", "msg", "type"],
+        "title": "ValidationError",
+        "type": "object"
+      }
+    },
+    "securitySchemes": {
+      "OAuth2PasswordBearer": {
+        "flows": {
+          "password": {
+            "scopes": {},
+            "tokenUrl": "/api/oauth/token"
+          }
+        },
+        "type": "oauth2"
+      }
+    }
+  },
+  "info": {
+    "description": "Percona Services Enablement Platform — task execution, history, periodic jobs, connectivity.",
+    "title": "SEP Tasks API",
+    "version": "v1.0.0.dev0"
+  },
+  "openapi": "3.1.0",
+  "paths": {
+    "/": {
+      "get": {
+        "description": "List all active tasks.",
+        "operationId": "tasks_list_tasks__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "owner",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Owner"
+            }
+          },
+          {
+            "in": "query",
+            "name": "target",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Target"
+            }
+          },
+          {
+            "in": "query",
+            "name": "parent_is_null",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Parent Is Null"
+            }
+          },
+          {
+            "in": "query",
+            "name": "backup_type",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Backup Type"
+            }
+          },
+          {
+            "in": "query",
+            "name": "self_parent",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Self Parent"
+            }
+          },
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PaginatedResponse_TaskResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "List Tasks",
+        "tags": ["tasks"]
+      },
+      "post": {
+        "description": "Create a new task.",
+        "operationId": "tasks_create_task__post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/TaskWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TaskResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Create Task",
+        "tags": ["tasks"]
+      }
+    },
+    "/admin/settings/": {
+      "get": {
+        "description": "List every exposed settings class with current values and metadata.\n\nLocal classes are read from their config singletons; remote classes\n(``remote_classes``) are fetched server-side from their owning sub-app\nand appended in declaration order; app-owned classes follow remote\ngroups with per-group app metadata. A failed remote fetch fails the\nwhole request with ``502`` -- the LIST never silently drops a remote\ngroup.\n\n:param session: The sub-app's database session.\n:param remote_api: The client for remote settings classes (``None`` when\n    the router wires none).\n:return: Grouped responses, one group per configured settings class.",
+        "operationId": "settings_list_settings_admin_settings__get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SettingsListResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "List Settings",
+        "tags": ["settings"]
+      }
+    },
+    "/admin/settings/{setting_class}": {
+      "patch": {
+        "description": "Apply a batch of overrides for one settings class atomically.\n\nFor a remote class the batch is forwarded to the owning sub-app, which\nowns the validation and persistence; the upstream's per-field ``422``\n(and its ``detail``) is preserved so the UI can render inline messages.\n\nFor a local class: Phase A validates every key in ``body`` (existence on\nthe class, HOT classification, type/constraint coercion) and collects\nper-key errors. If any key fails, the whole batch is rejected with a\nstructured 422 and nothing is written. Phase B persists every valid entry\nin a single transaction, refreshes the proxy snapshot once, then fires\nthe rebind callbacks for any changed keys so a HOT target rebinds without\nwaiting for the next background refresh cycle.\n\n:param request: The incoming request; its ``app.state`` carries the\n    sub-app's rebind-callback registry.\n:param setting_class: The settings class the override targets.\n:param body: The batch of ``{key: value, ...}`` overrides.\n:param session: The sub-app's database session.\n:param remote_api: The client for remote settings classes (``None`` when\n    the router wires none).\n:return: One :class:`SettingResponse` per applied key, in input order.\n:raises HTTPNotFoundException: If the class isn't exposed.\n:raises HTTPUnprocessableEntityException: If any key fails validation;\n    no rows are written.",
+        "operationId": "settings_patch_settings_admin_settings__setting_class__patch",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "setting_class",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/SettingClassEnum"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SettingsPatch"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "items": {
+                    "$ref": "#/components/schemas/SettingResponse"
+                  },
+                  "title": "Response Settings Patch Settings Admin Settings  Setting Class  Patch",
+                  "type": "array"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Patch Settings",
+        "tags": ["settings"]
+      }
+    },
+    "/admin/settings/{setting_class}/{key}": {
+      "delete": {
+        "description": "Revert one override row to the field's declared default.\n\nFor a remote class the DELETE is forwarded to the owning sub-app, which\nowns the idempotency and ``NOT_OVERRIDABLE`` semantics; its status and\n``detail`` are preserved through the proxy.\n\nFor a local class the DELETE is idempotent: deleting a (class, key) pair\nthat has no override row succeeds with 204. Attempting to delete a field\nthe code declares NOT_OVERRIDABLE responds 409, since it cannot have an\noverride row in the first place and the operator's intent is\nunsatisfiable. A field only ``SETTINGS_OVERRIDE_ALLOWED_KEYS`` withheld\nmay still carry a row written before the restriction applied, so that\nrow is deleted normally and only the no-row case answers 409.\n\nAfter republishing the snapshot, fires the rebind callbacks for the\nreverted key so a HOT target rebinds to its restored value without\nwaiting for the next background refresh cycle.\n\n:param request: The incoming request; its ``app.state`` carries the\n    sub-app's rebind-callback registry.\n:param setting_class: The settings class the field belongs to.\n:param key: The field name on the settings class.\n:param session: The sub-app's database session.\n:param remote_api: The client for remote settings classes (``None`` when\n    the router wires none).\n:raises HTTPNotFoundException: If the class isn't exposed or the key\n    doesn't exist on the class.\n:raises HTTPConflictException: If the field is NOT_OVERRIDABLE and has\n    no row to delete.\n:raises HTTPUnprocessableEntityException: If ``key`` names a\n    ``NESTED_ONLY`` parent (the whole parent cannot be overridden;\n    target an individual ``parent__leaf`` instead).\n:raises HTTPBadGatewayException: For a remote class, when the owning\n    sub-app returns a server error (status >= 500) or is unreachable.",
+        "operationId": "settings_delete_setting_admin_settings__setting_class___key__delete",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "setting_class",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/SettingClassEnum"
+            }
+          },
+          {
+            "in": "path",
+            "name": "key",
+            "required": true,
+            "schema": {
+              "title": "Key",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Delete Setting",
+        "tags": ["settings"]
+      },
+      "get": {
+        "description": "Return one field's metadata and current value.\n\n:param setting_class: The settings class the field belongs to.\n:param key: The field name on the settings class.\n:param session: The sub-app's database session.\n:param remote_api: The client for remote settings classes (``None`` when\n    the router wires none).\n:return: The structured response for the field.\n:raises HTTPNotFoundException: If the class isn't exposed or the key\n    doesn't exist on the class.",
+        "operationId": "settings_get_setting_admin_settings__setting_class___key__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "setting_class",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/SettingClassEnum"
+            }
+          },
+          {
+            "in": "path",
+            "name": "key",
+            "required": true,
+            "schema": {
+              "title": "Key",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SettingResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Get Setting",
+        "tags": ["settings"]
+      }
+    },
+    "/connectivity-check/": {
+      "post": {
+        "description": "Check database connectivity via a Nomad task.\n\n:param session: The async database session.\n:type session: AsyncSession\n:param request: The connectivity check request parameters.\n:type request: ConnectivityCheckWrite\n:return: The connectivity check result.\n:rtype: ConnectivityCheckResponse",
+        "operationId": "connectivity_connectivity_check_connectivity_check__post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ConnectivityCheckWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ConnectivityCheckResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Connectivity Check",
+        "tags": ["connectivity"]
+      }
+    },
+    "/execute/{task_name}": {
+      "post": {
+        "description": "Send a task for execution.\n\nWhen ``tasks_settings.PRE_EXECUTION_CONNECTIVITY_CHECK`` is enabled and the\ntask carries ``_connectivity_*`` meta fields, run a Nomad-side connectivity\ncheck against the target before dispatch. In ``block`` mode, dispatch is\nrejected with HTTP 400 on failure; in ``warn`` mode, a warning is logged\nand dispatch proceeds. ETA-scheduled tasks always skip the check.",
+        "operationId": "tasks_execute_task_name_execute__task_name__post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "anyOf": [
+                  {
+                    "$ref": "#/components/schemas/TaskExecuteRequest"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "title": "Execution Data"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TaskHistoryResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Execute Task Name",
+        "tags": ["tasks"]
+      }
+    },
+    "/history/": {
+      "get": {
+        "description": "List all task history records.",
+        "operationId": "tasks_list_task_history_history__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "status",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Status"
+            }
+          },
+          {
+            "in": "query",
+            "name": "exclude_internal",
+            "required": false,
+            "schema": {
+              "default": false,
+              "title": "Exclude Internal",
+              "type": "boolean"
+            }
+          },
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PaginatedResponse_TaskHistoryResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "List Task History",
+        "tags": ["tasks"]
+      },
+      "post": {
+        "description": "Create a new task history.\n\n``has_logs`` is not populated on this response -- a row that was just\ncreated has no chunk-store entry or legacy tracking blob yet, so the\nfield defaults to ``False`` on serialization.",
+        "operationId": "tasks_create_task_history_history__post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/TaskHistory"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TaskHistoryResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Create Task History",
+        "tags": ["tasks"]
+      }
+    },
+    "/history/latest": {
+      "post": {
+        "description": "Return the latest-history projection (status + finished_at) per task name.",
+        "operationId": "tasks_latest_task_history_history_latest_post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/TaskHistoryLatestStatusRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "additionalProperties": {
+                    "anyOf": [
+                      {
+                        "$ref": "#/components/schemas/TaskHistoryLatestStatus"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "title": "Response Tasks Latest Task History History Latest Post",
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Latest Task History",
+        "tags": ["tasks"]
+      }
+    },
+    "/history/{task_history_id}": {
+      "get": {
+        "description": "Retrieve a task history by id.",
+        "operationId": "tasks_retrieve_task_history_history__task_history_id__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_history_id",
+            "required": true,
+            "schema": {
+              "title": "Task History Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TaskHistoryResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Retrieve Task History",
+        "tags": ["tasks"]
+      }
+    },
+    "/history/{task_history_id}/events": {
+      "get": {
+        "description": "Return structured execution events from executor tracking (oldest first).",
+        "operationId": "tasks_list_task_history_events_history__task_history_id__events_get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_history_id",
+            "required": true,
+            "schema": {
+              "title": "Task History Id",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "backend",
+            "required": false,
+            "schema": {
+              "$ref": "#/components/schemas/TaskBackendEnum",
+              "default": "nomad"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "items": {
+                    "$ref": "#/components/schemas/ExecutionEvent"
+                  },
+                  "title": "Response Tasks List Task History Events History  Task History Id  Events Get",
+                  "type": "array"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "List Task History Events",
+        "tags": ["tasks"]
+      }
+    },
+    "/history/{task_history_id}/file/": {
+      "get": {
+        "description": "Stream a file from a task history.",
+        "operationId": "tasks_stream_task_history_file_history__task_history_id__file__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_history_id",
+            "required": true,
+            "schema": {
+              "title": "Task History Id",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "path",
+            "required": true,
+            "schema": {
+              "title": "Path",
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "backend",
+            "required": false,
+            "schema": {
+              "$ref": "#/components/schemas/TaskBackendEnum",
+              "default": "nomad"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Stream Task History File",
+        "tags": ["tasks"]
+      }
+    },
+    "/history/{task_history_id}/files/": {
+      "get": {
+        "description": "List files from a task history.",
+        "operationId": "tasks_list_task_history_files_history__task_history_id__files__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_history_id",
+            "required": true,
+            "schema": {
+              "title": "Task History Id",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "backend",
+            "required": false,
+            "schema": {
+              "$ref": "#/components/schemas/TaskBackendEnum",
+              "default": "nomad"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "additionalProperties": {
+                    "$ref": "#/components/schemas/FileMetadata"
+                  },
+                  "title": "Response Tasks List Task History Files History  Task History Id  Files  Get",
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "List Task History Files",
+        "tags": ["tasks"]
+      }
+    },
+    "/history/{task_history_id}/logs/": {
+      "get": {
+        "description": "Stream a task history's logs.\n\n``tail`` limits output to the last N lines per stream for finished histories\nonly. It is ignored while the task is ``RUNNING`` (live executor stream).",
+        "operationId": "tasks_stream_task_history_logs_history__task_history_id__logs__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_history_id",
+            "required": true,
+            "schema": {
+              "title": "Task History Id",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "step",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Step"
+            }
+          },
+          {
+            "in": "query",
+            "name": "tail",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "minimum": 1,
+                  "type": "integer"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Tail"
+            }
+          },
+          {
+            "in": "query",
+            "name": "backend",
+            "required": false,
+            "schema": {
+              "$ref": "#/components/schemas/TaskBackendEnum",
+              "default": "nomad"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Stream Task History Logs",
+        "tags": ["tasks"]
+      }
+    },
+    "/history/{task_history_id}/stop/": {
+      "post": {
+        "description": "Stop a task history.",
+        "operationId": "tasks_stop_task_history_history__task_history_id__stop__post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_history_id",
+            "required": true,
+            "schema": {
+              "title": "Task History Id",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "backend",
+            "required": false,
+            "schema": {
+              "$ref": "#/components/schemas/TaskBackendEnum",
+              "default": "nomad"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TaskHistoryResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Stop Task History",
+        "tags": ["tasks"]
+      }
+    },
+    "/history/{task_history_id}/sync/": {
+      "post": {
+        "description": "Sync task history with the executor and persist the latest status.\n\nAtomically claim the ``sync_in_progress_started_at`` lock before calling\nthe executor so the celery ``sync_running_tasks`` periodic and this route\nnever both progress past the executor call for the same row. When the\nclaim returns no rows — either because another syncer holds the lock or\nbecause the status has already flipped to terminal — refresh the row\nfrom the DB and return without re-syncing. The holder (or completed\nsyncer) is responsible for dispatching any chained task.",
+        "operationId": "tasks_sync_task_history_history__task_history_id__sync__post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_history_id",
+            "required": true,
+            "schema": {
+              "title": "Task History Id",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "backend",
+            "required": false,
+            "schema": {
+              "$ref": "#/components/schemas/TaskBackendEnum",
+              "default": "nomad"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TaskHistoryResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Sync Task History",
+        "tags": ["tasks"]
+      }
+    },
+    "/hosts/": {
+      "get": {
+        "description": "Return the executor hosts from the executor.\n\nWrap the upstream executor call so connection failures or non-JSON\nbodies surface as a 502 JSON response instead of leaking a default\n500 + text/plain that masks the real failure on the dashboard banner.\n\n:param executor: The task executor backend used to fetch host metadata.\n:type executor: TaskExecutor\n:return: A mapping of executor node name to network address.\n:rtype: dict[str, str]\n:raises HTTPBadGatewayException: If the executor backend raises a\n    ``requests.exceptions.RequestException`` (e.g. a non-JSON response\n    body or a connection failure outside the Nomad SDK's own wrapping).",
+        "operationId": "tasks_get_executor_hosts_hosts__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "backend",
+            "required": false,
+            "schema": {
+              "$ref": "#/components/schemas/TaskBackendEnum",
+              "default": "nomad"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "additionalProperties": {
+                    "type": "string"
+                  },
+                  "title": "Response Tasks Get Executor Hosts Hosts  Get",
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Get Executor Hosts",
+        "tags": ["tasks"]
+      }
+    },
+    "/periodic/": {
+      "get": {
+        "description": "List all periodic tasks.",
+        "operationId": "periodic_list_periodic_tasks_periodic__get",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "owner",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Owner"
+            }
+          },
+          {
+            "in": "query",
+            "name": "enabled",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Enabled"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "items": {
+                    "$ref": "#/components/schemas/PeriodicTaskResponse"
+                  },
+                  "title": "Response Periodic List Periodic Tasks Periodic  Get",
+                  "type": "array"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "List Periodic Tasks",
+        "tags": ["periodic", "schedule", "tasks"]
+      }
+    },
+    "/periodic/{periodic_task_id}": {
+      "delete": {
+        "description": "Delete a periodic task.",
+        "operationId": "periodic_delete_periodic_task_periodic__periodic_task_id__delete",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "periodic_task_id",
+            "required": true,
+            "schema": {
+              "title": "Periodic Task Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Delete Periodic Task",
+        "tags": ["periodic", "schedule", "tasks"]
+      },
+      "get": {
+        "description": "Retrieve a periodic task by ID.",
+        "operationId": "periodic_retrieve_periodic_task_periodic__periodic_task_id__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "periodic_task_id",
+            "required": true,
+            "schema": {
+              "title": "Periodic Task Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PeriodicTaskResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Retrieve Periodic Task",
+        "tags": ["periodic", "schedule", "tasks"]
+      },
+      "put": {
+        "description": "Update a periodic task.",
+        "operationId": "periodic_update_periodic_task_periodic__periodic_task_id__put",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "periodic_task_id",
+            "required": true,
+            "schema": {
+              "title": "Periodic Task Id",
+              "type": "integer"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PeriodicTaskUpdate"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PeriodicTaskResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Update Periodic Task",
+        "tags": ["periodic", "schedule", "tasks"]
+      }
+    },
+    "/stats/{task}": {
+      "get": {
+        "description": "Calculate the statistics for the task.",
+        "operationId": "tasks_get_task_stats_stats__task__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task",
+            "required": true,
+            "schema": {
+              "title": "Task",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TaskStats"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Get Task Stats",
+        "tags": ["tasks"]
+      }
+    },
+    "/transform/": {
+      "post": {
+        "description": "Transform a payload string into a dictionary.",
+        "operationId": "tasks_transform_payload_transform__post",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "backend",
+            "required": false,
+            "schema": {
+              "$ref": "#/components/schemas/TaskBackendEnum",
+              "default": "nomad"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/TransformPayloadRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TransformPayloadResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Transform Payload",
+        "tags": ["tasks"]
+      }
+    },
+    "/{task_name}": {
+      "delete": {
+        "description": "Delete a task.",
+        "operationId": "tasks_delete_task__task_name__delete",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TaskResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Delete Task",
+        "tags": ["tasks"]
+      },
+      "get": {
+        "description": "Retrieve a task by its name.",
+        "operationId": "tasks_get_task__task_name__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TaskResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Get Task",
+        "tags": ["tasks"]
+      },
+      "put": {
+        "description": "Update an existing task.",
+        "operationId": "tasks_update_task__task_name__put",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/TaskWrite"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TaskResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Update Task",
+        "tags": ["tasks"]
+      }
+    },
+    "/{task_name}/periodic/": {
+      "get": {
+        "description": "List periodic tasks by task name.",
+        "operationId": "tasks_list_periodic_tasks_by_task_name__task_name__periodic__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "items": {
+                    "$ref": "#/components/schemas/PeriodicTaskResponse"
+                  },
+                  "title": "Response Tasks List Periodic Tasks By Task Name  Task Name  Periodic  Get",
+                  "type": "array"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "List Periodic Tasks By Task Name",
+        "tags": ["tasks"]
+      },
+      "post": {
+        "description": "Create a new periodic task for the specified task name.",
+        "operationId": "tasks_create_periodic_task_for_task_name__task_name__periodic__post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task_name",
+            "required": true,
+            "schema": {
+              "title": "Task Name",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PeriodicTaskCreate"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PeriodicTaskResponse"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Create Periodic Task For Task Name",
+        "tags": ["tasks"]
+      }
+    },
+    "/{task}/history/": {
+      "get": {
+        "description": "Retrieve task history by task name.",
+        "operationId": "tasks_get_task_history__task__history__get",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "task",
+            "required": true,
+            "schema": {
+              "title": "Task",
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "status",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "$ref": "#/components/schemas/TaskHistoryStatusEnum"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Status"
+            }
+          },
+          {
+            "in": "query",
+            "name": "snippet_filename",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "minLength": 1,
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Snippet Filename"
+            }
+          },
+          {
+            "in": "query",
+            "name": "offset",
+            "required": false,
+            "schema": {
+              "default": 0,
+              "minimum": 0,
+              "title": "Offset",
+              "type": "integer"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "required": false,
+            "schema": {
+              "default": 50,
+              "maximum": 200,
+              "minimum": 1,
+              "title": "Limit",
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PaginatedResponse_TaskHistoryResponse_"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "security": [
+          {
+            "OAuth2PasswordBearer": []
+          }
+        ],
+        "summary": "Get Task History",
+        "tags": ["tasks"]
+      }
+    }
+  }
+}
diff --git a/ui/packages/sep/api/src/auth.ts b/ui/packages/sep/api/src/auth.ts
new file mode 100644
index 00000000000..30547f8b22c
--- /dev/null
+++ b/ui/packages/sep/api/src/auth.ts
@@ -0,0 +1,119 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { apiClient } from './client';
+import type {
+  SessionExchangeTokenResponse,
+  SPAOAuthTokenResponse,
+  User,
+} from './types/api';
+
+/**
+ * POST /api/oauth/login
+ *
+ * SPA login. Backend runs the Casdoor password grant server-side, stores
+ * the refresh token in an `HttpOnly` cookie scoped to `/api/oauth`, and
+ * returns the access token (plus TTL) in JSON. The refresh token is never
+ * seen by JavaScript.
+ */
+export async function postLogin(
+  username: string,
+  password: string
+): Promise<SPAOAuthTokenResponse> {
+  const { data } = await apiClient.post<SPAOAuthTokenResponse>('/oauth/login', {
+    username,
+    password,
+  });
+  return data;
+}
+
+/**
+ * POST /api/oauth/refresh
+ *
+ * Mint a fresh access token from the `HttpOnly` refresh cookie. The cookie
+ * is sent automatically by the browser; there is no request body. The
+ * backend rotates the cookie on success.
+ *
+ * Returns the slim SPA shape — `access_token` and `expires_in` only. The
+ * refresh token is never in the response body.
+ *
+ * Note: most callers should funnel through `refreshAccessToken()` in
+ * `./client` instead, which single-flights concurrent refresh calls so the
+ * cookie is not rotated twice by parallel code paths.
+ */
+export async function postRefresh(): Promise<SPAOAuthTokenResponse> {
+  const { data } =
+    await apiClient.post<SPAOAuthTokenResponse>('/oauth/refresh');
+  return data;
+}
+
+/**
+ * POST /api/oauth/session
+ *
+ * Ambient auto-login from an existing PMM/Grafana session cookie. The browser
+ * sends the `grafana_session` cookie automatically; there is no request body.
+ * On success the backend sets the `HttpOnly` refresh cookie and returns the
+ * slim access shape; a 401 (no valid ambient session) means "not signed in".
+ */
+export async function postSession(): Promise<SPAOAuthTokenResponse> {
+  const { data } =
+    await apiClient.post<SPAOAuthTokenResponse>('/oauth/session');
+  return data;
+}
+
+/**
+ * POST /api/oauth/session/exchange
+ *
+ * Exchange an ambient PMM/Grafana session cookie for a short-lived SEP bearer.
+ * The browser sends the `grafana_session` cookie automatically; there is no
+ * request body. Unlike `postSession`, no cookie is set and no refresh token is
+ * issued — the caller holds the token in memory and re-exchanges before
+ * `expires_in` elapses. A 401 means "no valid ambient session".
+ *
+ * This is the endpoint the PMM-embedded token provider will call to replace
+ * the interim `PMM_DEV_SEP_INTERNAL_TOKEN` wiring in
+ * `apps/pmm/src/sep/bootstrap.ts`,
+ * whose service principal hardcodes `is_admin = False`.
+ */
+export async function postSessionExchange(): Promise<SessionExchangeTokenResponse> {
+  const { data } = await apiClient.post<SessionExchangeTokenResponse>(
+    '/oauth/session/exchange'
+  );
+  return data;
+}
+
+/**
+ * POST /api/oauth/logout
+ *
+ * End the SPA session server-side: clears/rotates the `HttpOnly` refresh
+ * cookie so a subsequent bootstrap refresh cannot mint a new access token,
+ * and revokes the access token at Casdoor. Returns 204 on success;
+ * callers should still clear local state even if this request fails.
+ */
+export async function postLogout(): Promise<void> {
+  await apiClient.post('/oauth/logout');
+}
+
+/**
+ * GET /api/users/me
+ *
+ * Fetch the currently authenticated user profile.
+ */
+export async function fetchCurrentUser(): Promise<User> {
+  const { data } = await apiClient.get<User>('/users/me');
+  return data;
+}
diff --git a/ui/packages/sep/api/src/client.ts b/ui/packages/sep/api/src/client.ts
new file mode 100644
index 00000000000..30c9c6df130
--- /dev/null
+++ b/ui/packages/sep/api/src/client.ts
@@ -0,0 +1,248 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/// <reference path="./vite-env.d.ts" />
+import axios, { type AxiosError, type InternalAxiosRequestConfig } from 'axios';
+import { ApiError, normalizeAxiosError } from './errors';
+
+// ── Token provider ─────────────────────────────────────────────────────
+// Instead of owning a copy of the access token, the API layer delegates
+// token retrieval to a provider injected by the auth layer (AuthProvider).
+// This ensures a single source of truth and prevents desync between
+// AuthProvider state and the API client.
+type TokenProvider = () => string | null;
+type OnUnauthorized = () => void;
+type OnRefreshed = (accessToken: string, expiresIn: number) => void;
+
+let _getToken: TokenProvider = () => null;
+let _onUnauthorized: OnUnauthorized = () => {};
+let _onRefreshed: OnRefreshed = () => {};
+
+/** Inject a callback that returns the current access token. */
+export function setTokenProvider(provider: TokenProvider) {
+  _getToken = provider;
+}
+
+/** Inject a callback invoked when the API receives an unauthorized response. */
+export function setOnUnauthorized(handler: OnUnauthorized) {
+  _onUnauthorized = handler;
+}
+
+/**
+ * Inject a callback invoked after a successful silent refresh triggered by
+ * the 401 retry interceptor. Lets the auth layer sync state + re-schedule
+ * its own refresh timer without owning the refresh network call.
+ */
+export function setOnRefreshed(handler: OnRefreshed) {
+  _onRefreshed = handler;
+}
+
+/** Read the currently registered token provider. Used by the typed client. */
+export function getToken(): string | null {
+  return _getToken();
+}
+
+/** Invoke the currently registered unauthorized handler. */
+export function emitUnauthorized(): void {
+  _onUnauthorized();
+}
+
+// ── Dev logging flag ───────────────────────────────────────────────────
+// Vite statically replaces `import.meta.env.DEV` at build time, so the
+// logging branches are dead-code-eliminated in production bundles.
+const IS_DEV = import.meta.env.DEV;
+
+/**
+ * Primary API client. Request/response payloads are passed through verbatim —
+ * field casing matches the OpenAPI spec (see `src/generated/`).
+ */
+export const apiClient = axios.create({
+  baseURL: '/api',
+  // Send the HttpOnly refresh cookie on /api/oauth/* requests (same-origin
+  // requests already send cookies, but make the intent explicit so tests
+  // and any future cross-origin config keep working).
+  withCredentials: true,
+  headers: {
+    'Content-Type': 'application/json',
+  },
+  validateStatus: (status) => status >= 200 && status < 300,
+});
+
+// ── Request: attach Bearer token, optionally log ───────────────────────
+apiClient.interceptors.request.use((config: InternalAxiosRequestConfig) => {
+  // Do not overwrite an already-set Authorization header so the 401 retry
+  // path (which sets the header explicitly from the freshly-refreshed
+  // token) is correct even if the external token provider has not yet
+  // observed the refresh.
+  if (!config.headers.Authorization) {
+    const token = _getToken();
+    if (token) {
+      config.headers.Authorization = `Bearer ${token}`;
+    }
+  }
+  if (IS_DEV) {
+    const method = config.method?.toUpperCase() ?? 'GET';
+    // eslint-disable-next-line no-console
+    console.debug(`[api] → ${method} ${config.url ?? ''}`);
+  }
+  return config;
+});
+
+// ── Response: 401 refresh-retry, unauthorized handling, error normalization ──
+// Refresh endpoint is the recovery mechanism — its failures must not trigger
+// the retry loop or the global unauthorized handler, or a genuine refresh
+// rejection would hard-redirect instead of letting the AuthProvider bootstrap
+// handle it cleanly.
+const isRefreshRequest = (url: string | undefined) =>
+  !!url && url.includes('/oauth/refresh');
+const isLoginRequest = (url: string | undefined) =>
+  !!url && url.includes('/oauth/login');
+
+// Internal marker so retried requests don't loop through the refresh path
+// again on a second 401.
+type RetriableConfig = InternalAxiosRequestConfig & { _retried?: boolean };
+
+// Single-flight refresh: concurrent callers (401 retry path + background
+// timer + bootstrap) share one in-flight /oauth/refresh call. The promise
+// resolves to the new access token on success and null on failure so
+// callers can decide whether to retry, surface the 401, or force logout.
+//
+// All refresh traffic must funnel through here — the refresh token cookie
+// rotates on every successful call, so parallel refreshes from different
+// code paths would invalidate each other.
+let refreshInFlight: Promise<string | null> | null = null;
+
+/**
+ * Trigger (or join) the shared silent refresh. Resolves with the new
+ * access token, or null if the refresh failed (missing/invalid cookie,
+ * network error, Casdoor rejection).
+ */
+export function refreshAccessToken(): Promise<string | null> {
+  if (!refreshInFlight) {
+    refreshInFlight = (async () => {
+      // Only the network call is inside the try/catch — a synchronous throw
+      // from the externally-injected _onRefreshed handler must NOT be reported
+      // as a failed refresh, otherwise the auth layer would force-logout a
+      // user whose cookie rotation succeeded on the backend.
+      let data: { access_token: string; expires_in: number };
+      try {
+        const response = await apiClient.post<{
+          access_token: string;
+          expires_in: number;
+        }>('/oauth/refresh');
+        data = response.data;
+      } catch {
+        return null;
+      } finally {
+        // Clear after the microtask so all concurrent awaiters see the same
+        // resolved value before a fresh attempt becomes possible.
+        queueMicrotask(() => {
+          refreshInFlight = null;
+        });
+      }
+      try {
+        _onRefreshed(data.access_token, data.expires_in);
+      } catch (handlerError) {
+        // A throwing auth-layer handler must not invalidate a cookie rotation
+        // that already succeeded on the backend: it would reject the shared
+        // promise and force-logout every awaiting caller. It does leave the
+        // auth layer without the new token or its expiry while this function
+        // still returns the token, so record that inconsistency — never the
+        // token or expiry themselves.
+        // eslint-disable-next-line no-console
+        console.error(
+          '[api] onRefreshed handler threw; the rotated token was not recorded',
+          handlerError
+        );
+      }
+      return data.access_token;
+    })();
+  }
+  return refreshInFlight;
+}
+
+apiClient.interceptors.response.use(
+  (response) => {
+    const ct = String(response.headers['content-type'] ?? '');
+    if (ct.includes('text/html') && !isRefreshRequest(response.config?.url)) {
+      _onUnauthorized();
+      return Promise.reject(
+        new ApiError({
+          kind: 'http',
+          status: 401,
+          message: 'Session expired (redirected to login page)',
+          url: response.config?.url,
+          method: response.config?.method?.toUpperCase(),
+        })
+      );
+    }
+    if (IS_DEV) {
+      const method = response.config?.method?.toUpperCase() ?? 'GET';
+      // eslint-disable-next-line no-console
+      console.debug(
+        `[api] ← ${response.status} ${method} ${response.config?.url ?? ''}`
+      );
+    }
+    return response;
+  },
+  async (error: AxiosError) => {
+    if (axios.isAxiosError(error)) {
+      const status = error.response?.status;
+      const config = error.config as RetriableConfig | undefined;
+      const url = config?.url;
+
+      // 401 on a normal request: attempt one silent refresh, then retry.
+      // Skip the refresh/login endpoints themselves and already-retried requests.
+      if (
+        status === 401 &&
+        config &&
+        !config._retried &&
+        !isRefreshRequest(url) &&
+        !isLoginRequest(url)
+      ) {
+        const newToken = await refreshAccessToken();
+        if (newToken) {
+          config._retried = true;
+          // Set the header explicitly from the refreshed token so the
+          // retry is self-contained and not dependent on external token-
+          // provider wiring. The request interceptor preserves an already-
+          // set Authorization header.
+          config.headers = config.headers ?? {};
+          config.headers.Authorization = `Bearer ${newToken}`;
+          return apiClient.request(config);
+        }
+        // Refresh failed — treat as unauthorized.
+        _onUnauthorized();
+      } else if ((status === 401 || status === 303) && !isRefreshRequest(url)) {
+        // Retried request still 401, or non-retriable 401 (e.g. login itself).
+        _onUnauthorized();
+      }
+    }
+    const apiError = normalizeAxiosError(error);
+    if (IS_DEV) {
+      const loc =
+        apiError.method && apiError.url
+          ? `${apiError.method} ${apiError.url}`
+          : '';
+      // eslint-disable-next-line no-console
+      console.debug(
+        `[api] ✗ ${apiError.kind}${apiError.status ? ` ${apiError.status}` : ''} ${loc} — ${apiError.message}`
+      );
+    }
+    return Promise.reject(apiError);
+  }
+);
diff --git a/ui/packages/sep/api/src/errors.ts b/ui/packages/sep/api/src/errors.ts
new file mode 100644
index 00000000000..9e0c067eab1
--- /dev/null
+++ b/ui/packages/sep/api/src/errors.ts
@@ -0,0 +1,193 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import axios, {
+  AxiosError,
+  type AxiosRequestConfig,
+  type AxiosResponse,
+} from 'axios';
+
+export type ApiErrorKind =
+  | 'network'
+  | 'timeout'
+  | 'canceled'
+  | 'http'
+  | 'unknown';
+
+export interface ApiErrorDetails {
+  kind: ApiErrorKind;
+  status?: number;
+  code?: string;
+  message: string;
+  url?: string;
+  method?: string;
+  data?: unknown;
+}
+
+/**
+ * Structured error surfaced to UI consumers. Wraps the original AxiosError
+ * so detailed inspection is still possible, but exposes a stable shape that
+ * components can rely on without knowing about axios internals.
+ */
+export class ApiError extends Error implements ApiErrorDetails {
+  readonly kind: ApiErrorKind;
+  readonly status?: number;
+  readonly code?: string;
+  readonly url?: string;
+  readonly method?: string;
+  readonly data?: unknown;
+  readonly original?: unknown;
+
+  constructor(details: ApiErrorDetails, original?: unknown) {
+    super(details.message);
+    this.name = 'ApiError';
+    this.kind = details.kind;
+    this.status = details.status;
+    this.code = details.code;
+    this.url = details.url;
+    this.method = details.method;
+    this.data = details.data;
+    this.original = original;
+  }
+}
+
+function messageFromPayload(payload: unknown, fallback: string): string {
+  if (payload && typeof payload === 'object') {
+    const obj = payload as Record<string, unknown>;
+    const detail = obj.detail ?? obj.message ?? obj.error;
+    if (typeof detail === 'string') {
+      return detail;
+    }
+  }
+  return fallback;
+}
+
+/** A single backend per-field validation failure, ready to map onto a form field. */
+export interface FieldValidationError {
+  /** Dot-joined field path (react-hook-form name). Empty string for form-level errors. */
+  path: string;
+  /** Human-readable message from the backend (`detail[].msg`). */
+  message: string;
+}
+
+/**
+ * Parse a 422 payload (`ApiError.data.detail[]`, a Pydantic ``errors()`` array)
+ * into ``{ path, message }`` pairs.
+ *
+ * Each entry's ``loc`` tuple is joined into a dot path matching the form's
+ * react-hook-form field names. FastAPI request-body validation prefixes ``loc``
+ * with a ``"body"`` segment (e.g. ``["body", "limit"]``); manual
+ * ``model_validate`` failures do not. The leading ``"body"`` is stripped so both
+ * shapes resolve to the same field path. The ``"body"`` strip is positional, so
+ * a top-level field literally named ``body`` is indistinguishable from FastAPI's
+ * wrapper segment; plugin schemas do not use that name. Entries whose ``loc``
+ * carries no field segment yield an empty ``path`` so callers can surface them
+ * as form-level errors rather than dropping them.
+ *
+ * Returns an empty array when the payload is not a recognizable detail array.
+ */
+export function parseFieldErrors(error: unknown): FieldValidationError[] {
+  const data = error instanceof ApiError ? error.data : error;
+  const detail = (data as { detail?: unknown } | null | undefined)?.detail;
+  if (!Array.isArray(detail)) {
+    return [];
+  }
+
+  const result: FieldValidationError[] = [];
+  for (const entry of detail) {
+    if (!entry || typeof entry !== 'object') {
+      continue;
+    }
+    const { loc, msg } = entry as { loc?: unknown; msg?: unknown };
+    const message =
+      typeof msg === 'string' && msg.length > 0 ? msg : 'Invalid value';
+    let segments = Array.isArray(loc)
+      ? loc.filter(
+          (s): s is string | number =>
+            typeof s === 'string' || typeof s === 'number'
+        )
+      : [];
+    if (segments[0] === 'body') {
+      segments = segments.slice(1);
+    }
+    result.push({ path: segments.map(String).join('.'), message });
+  }
+  return result;
+}
+
+export function normalizeAxiosError(error: unknown): ApiError {
+  if (error instanceof ApiError) {
+    return error;
+  }
+
+  if (axios.isCancel(error)) {
+    return new ApiError(
+      { kind: 'canceled', message: 'Request canceled' },
+      error
+    );
+  }
+
+  if (error instanceof AxiosError) {
+    const config = error.config as AxiosRequestConfig | undefined;
+    const response = error.response as AxiosResponse | undefined;
+    const url = config?.url;
+    const method = config?.method?.toUpperCase();
+
+    if (error.code === 'ECONNABORTED' || error.code === 'ETIMEDOUT') {
+      return new ApiError(
+        {
+          kind: 'timeout',
+          code: error.code,
+          message: 'Request timed out',
+          url,
+          method,
+        },
+        error
+      );
+    }
+
+    if (response) {
+      const status = response.status;
+      return new ApiError(
+        {
+          kind: 'http',
+          status,
+          code: error.code,
+          message: messageFromPayload(response.data, `HTTP ${status}`),
+          url,
+          method,
+          data: response.data,
+        },
+        error
+      );
+    }
+
+    return new ApiError(
+      {
+        kind: 'network',
+        code: error.code,
+        message: error.message || 'Network error',
+        url,
+        method,
+      },
+      error
+    );
+  }
+
+  const message = error instanceof Error ? error.message : 'Unknown error';
+  return new ApiError({ kind: 'unknown', message }, error);
+}
diff --git a/ui/packages/sep/api/src/generated/inventory.ts b/ui/packages/sep/api/src/generated/inventory.ts
new file mode 100644
index 00000000000..237d82c45e3
--- /dev/null
+++ b/ui/packages/sep/api/src/generated/inventory.ts
@@ -0,0 +1,2641 @@
+/**
+ * This file is auto-generated by `pnpm --filter @sep/api codegen`.
+ * Do not edit by hand — regenerate from the source OpenAPI spec.
+ */
+export interface paths {
+  '/admin/settings/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Settings
+     * @description List every exposed settings class with current values and metadata.
+     *
+     *     Local classes are read from their config singletons; remote classes
+     *     (``remote_classes``) are fetched server-side from their owning sub-app
+     *     and appended in declaration order; app-owned classes follow remote
+     *     groups with per-group app metadata. A failed remote fetch fails the
+     *     whole request with ``502`` -- the LIST never silently drops a remote
+     *     group.
+     *
+     *     :param session: The sub-app's database session.
+     *     :param remote_api: The client for remote settings classes (``None`` when
+     *         the router wires none).
+     *     :return: Grouped responses, one group per configured settings class.
+     */
+    get: operations['settings_list_settings_admin_settings__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/admin/settings/{setting_class}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    /**
+     * Patch Settings
+     * @description Apply a batch of overrides for one settings class atomically.
+     *
+     *     For a remote class the batch is forwarded to the owning sub-app, which
+     *     owns the validation and persistence; the upstream's per-field ``422``
+     *     (and its ``detail``) is preserved so the UI can render inline messages.
+     *
+     *     For a local class: Phase A validates every key in ``body`` (existence on
+     *     the class, HOT classification, type/constraint coercion) and collects
+     *     per-key errors. If any key fails, the whole batch is rejected with a
+     *     structured 422 and nothing is written. Phase B persists every valid entry
+     *     in a single transaction, refreshes the proxy snapshot once, then fires
+     *     the rebind callbacks for any changed keys so a HOT target rebinds without
+     *     waiting for the next background refresh cycle.
+     *
+     *     :param request: The incoming request; its ``app.state`` carries the
+     *         sub-app's rebind-callback registry.
+     *     :param setting_class: The settings class the override targets.
+     *     :param body: The batch of ``{key: value, ...}`` overrides.
+     *     :param session: The sub-app's database session.
+     *     :param remote_api: The client for remote settings classes (``None`` when
+     *         the router wires none).
+     *     :return: One :class:`SettingResponse` per applied key, in input order.
+     *     :raises HTTPNotFoundException: If the class isn't exposed.
+     *     :raises HTTPUnprocessableEntityException: If any key fails validation;
+     *         no rows are written.
+     */
+    patch: operations['settings_patch_settings_admin_settings__setting_class__patch'];
+    trace?: never;
+  };
+  '/admin/settings/{setting_class}/{key}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Setting
+     * @description Return one field's metadata and current value.
+     *
+     *     :param setting_class: The settings class the field belongs to.
+     *     :param key: The field name on the settings class.
+     *     :param session: The sub-app's database session.
+     *     :param remote_api: The client for remote settings classes (``None`` when
+     *         the router wires none).
+     *     :return: The structured response for the field.
+     *     :raises HTTPNotFoundException: If the class isn't exposed or the key
+     *         doesn't exist on the class.
+     */
+    get: operations['settings_get_setting_admin_settings__setting_class___key__get'];
+    put?: never;
+    post?: never;
+    /**
+     * Delete Setting
+     * @description Revert one override row to the field's declared default.
+     *
+     *     For a remote class the DELETE is forwarded to the owning sub-app, which
+     *     owns the idempotency and ``NOT_OVERRIDABLE`` semantics; its status and
+     *     ``detail`` are preserved through the proxy.
+     *
+     *     For a local class the DELETE is idempotent: deleting a (class, key) pair
+     *     that has no override row succeeds with 204. Attempting to delete a field
+     *     the code declares NOT_OVERRIDABLE responds 409, since it cannot have an
+     *     override row in the first place and the operator's intent is
+     *     unsatisfiable. A field only ``SETTINGS_OVERRIDE_ALLOWED_KEYS`` withheld
+     *     may still carry a row written before the restriction applied, so that
+     *     row is deleted normally and only the no-row case answers 409.
+     *
+     *     After republishing the snapshot, fires the rebind callbacks for the
+     *     reverted key so a HOT target rebinds to its restored value without
+     *     waiting for the next background refresh cycle.
+     *
+     *     :param request: The incoming request; its ``app.state`` carries the
+     *         sub-app's rebind-callback registry.
+     *     :param setting_class: The settings class the field belongs to.
+     *     :param key: The field name on the settings class.
+     *     :param session: The sub-app's database session.
+     *     :param remote_api: The client for remote settings classes (``None`` when
+     *         the router wires none).
+     *     :raises HTTPNotFoundException: If the class isn't exposed or the key
+     *         doesn't exist on the class.
+     *     :raises HTTPConflictException: If the field is NOT_OVERRIDABLE and has
+     *         no row to delete.
+     *     :raises HTTPUnprocessableEntityException: If ``key`` names a
+     *         ``NESTED_ONLY`` parent (the whole parent cannot be overridden;
+     *         target an individual ``parent__leaf`` instead).
+     *     :raises HTTPBadGatewayException: For a remote class, when the owning
+     *         sub-app returns a server error (status >= 500) or is unreachable.
+     */
+    delete: operations['settings_delete_setting_admin_settings__setting_class___key__delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/nodes/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Nodes
+     * @description List Nodes from Inventory.
+     */
+    get: operations['nodes_list_nodes_nodes__get'];
+    put?: never;
+    /**
+     * Create Node
+     * @description Create Node.
+     */
+    post: operations['nodes_create_node_nodes__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/nodes/{node_id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Retrieve Node
+     * @description Retrieve Node from inventory.
+     */
+    get: operations['nodes_retrieve_node_nodes__node_id__get'];
+    /**
+     * Update Node
+     * @description Update Node.
+     */
+    put: operations['nodes_update_node_nodes__node_id__put'];
+    post?: never;
+    /**
+     * Delete Node
+     * @description Delete Node.
+     */
+    delete: operations['nodes_delete_node_nodes__node_id__delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/nodes/{node_id}/services/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Services By Node
+     * @description List Services by Node.
+     */
+    get: operations['nodes_list_services_by_node_nodes__node_id__services__get'];
+    put?: never;
+    /**
+     * Create Service For Node
+     * @description Create Service for Node.
+     */
+    post: operations['nodes_create_service_for_node_nodes__node_id__services__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/nodes/{node_id}/system-observation': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Retrieve Host System Observation
+     * @description Retrieve host system observation for a node.
+     */
+    get: operations['nodes_retrieve_host_system_observation_nodes__node_id__system_observation_get'];
+    /**
+     * Upsert Host System Observation
+     * @description Upsert host system observation for a node.
+     */
+    put: operations['nodes_upsert_host_system_observation_nodes__node_id__system_observation_put'];
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/schemas/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Schemas
+     * @description List Schemas.
+     */
+    get: operations['schemas_list_schemas_schemas__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/schemas/{schema_id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Retrieve Schema
+     * @description Retrieve Schema.
+     */
+    get: operations['schemas_retrieve_schema_schemas__schema_id__get'];
+    /**
+     * Update Schema
+     * @description Update Schema.
+     */
+    put: operations['schemas_update_schema_schemas__schema_id__put'];
+    post?: never;
+    /**
+     * Delete Schema
+     * @description Delete Schema.
+     */
+    delete: operations['schemas_delete_schema_schemas__schema_id__delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/schemas/{schema_id}/tables/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Tables By Schema
+     * @description List Tables by Schema.
+     */
+    get: operations['schemas_list_tables_by_schema_schemas__schema_id__tables__get'];
+    put?: never;
+    /**
+     * Create Table For Schema
+     * @description Create Table for Schema.
+     */
+    post: operations['schemas_create_table_for_schema_schemas__schema_id__tables__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/services/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Services
+     * @description List Services.
+     */
+    get: operations['services_list_services_services__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/services/{service_id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Retrieve Service
+     * @description Retrieve Service.
+     */
+    get: operations['services_retrieve_service_services__service_id__get'];
+    /**
+     * Update Service
+     * @description Update Service.
+     */
+    put: operations['services_update_service_services__service_id__put'];
+    post?: never;
+    /**
+     * Delete Service
+     * @description Delete Service.
+     */
+    delete: operations['services_delete_service_services__service_id__delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/services/{service_id}/schemas/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Schemas By Service
+     * @description List Schemas by Service.
+     *
+     *     Return ``SchemaResponse`` (with nested tables) when ``include_tables``
+     *     is set, otherwise return ``SchemaCompactResponse`` (without tables).
+     *
+     *     :param session: The async database session.
+     *     :type session: AsyncSession
+     *     :param service: The resolved service dependency.
+     *     :type service: Service
+     *     :param search: Filter schemas by name using ILIKE matching.
+     *     :type search: str | None
+     *     :param include_tables: Include nested tables in the response when set to
+     *         any non-empty value. Defaults to compact mode (no tables).
+     *     :type include_tables: str | None
+     *     :param pagination: Validated offset/limit query parameters.
+     *     :type pagination: Pagination
+     *     :return: A paginated response of schema responses.
+     *     :rtype: PaginatedResponse[SchemaResponse | SchemaCompactResponse]
+     */
+    get: operations['services_list_schemas_by_service_services__service_id__schemas__get'];
+    put?: never;
+    /**
+     * Create Schema For Service
+     * @description Create Schema for Service.
+     */
+    post: operations['services_create_schema_for_service_services__service_id__schemas__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/services/{service_id}/system-observation': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Retrieve Service System Observation
+     * @description Retrieve service system observation for a service.
+     */
+    get: operations['services_retrieve_service_system_observation_services__service_id__system_observation_get'];
+    /**
+     * Upsert Service System Observation
+     * @description Upsert service system observation for a service.
+     */
+    put: operations['services_upsert_service_system_observation_services__service_id__system_observation_put'];
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/summary/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Summary Inventory
+     * @description Retrieve a summary of inventory counts.
+     */
+    get: operations['summary_get_summary_inventory_summary__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/tables/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Tables
+     * @description List Tables.
+     */
+    get: operations['tables_list_tables_tables__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/tables/{table_id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Retrieve Table
+     * @description Retrieve Table.
+     */
+    get: operations['tables_retrieve_table_tables__table_id__get'];
+    /**
+     * Update Table
+     * @description Update Table.
+     */
+    put: operations['tables_update_table_tables__table_id__put'];
+    post?: never;
+    /**
+     * Delete Table
+     * @description Delete Table.
+     */
+    delete: operations['tables_delete_table_tables__table_id__delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+  schemas: {
+    /** HTTPValidationError */
+    HTTPValidationError: {
+      /** Detail */
+      detail?: components['schemas']['ValidationError'][];
+    };
+    /**
+     * HostSystemObservationResponse
+     * @description Define the response model for host system observation data.
+     *
+     *     :param id: The primary key of the observation record.
+     *     :type id: int | None
+     *     :param created_at: When the record was created.
+     *     :type created_at: UTCDatetime
+     *     :param updated_at: When the record was last updated.
+     *     :type updated_at: UTCDatetime | None
+     *     :param node_id: The unique identifier of the observed node.
+     *     :type node_id: int
+     *     :param os_version: The observed operating system version.
+     *     :type os_version: str | None
+     *     :param installed_packages: Snapshot of installed packages.
+     *     :type installed_packages: list[dict[str, Any]] | None
+     *     :param config: Snapshot of host configuration.
+     *     :type config: dict[str, Any] | None
+     *     :param observed_at: When this observation was collected.
+     *     :type observed_at: UTCDatetime
+     */
+    HostSystemObservationResponse: {
+      /** Config */
+      config?: Record<string, never> | null;
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /** Id */
+      id: number | null;
+      /** Installed Packages */
+      installed_packages?: Record<string, never>[] | null;
+      /** Node Id */
+      node_id: number;
+      /**
+       * Observed At
+       * Format: date-time
+       */
+      observed_at: string;
+      /** Os Version */
+      os_version?: string | null;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * HostSystemObservationWrite
+     * @description Define the model for writing host system observation data to the inventory.
+     *
+     *     :param node_id: The foreign key referencing the node. Defaults to None.
+     *     :type node_id: int | None
+     *     :param os_version: The observed operating system version. Defaults to None.
+     *     :type os_version: str | None
+     *     :param installed_packages: Snapshot of installed packages. Defaults to None.
+     *     :type installed_packages: list[dict[str, Any]] | None
+     *     :param config: Snapshot of host configuration. Defaults to None.
+     *     :type config: dict[str, Any] | None
+     *     :param observed_at: When this observation was collected.
+     *     :type observed_at: UTCDatetime
+     */
+    HostSystemObservationWrite: {
+      /** Config */
+      config?: Record<string, never> | null;
+      /** Installed Packages */
+      installed_packages?: Record<string, never>[] | null;
+      /** Node Id */
+      node_id?: number | null;
+      /**
+       * Observed At
+       * Format: date-time
+       */
+      observed_at: string;
+      /** Os Version */
+      os_version?: string | null;
+    };
+    JsonValue: unknown;
+    /**
+     * Node
+     * @description Represent a node in the inventory.
+     *
+     *     :param address: The network address of the node.
+     *     :type address: NonEmptyStr
+     *     :param name: The name of the node.
+     *     :type name: NonEmptyStr
+     *     :param external_id: An external identifier for the node. Must be unique for source,
+     *         as defined by composite index ix_node_external_id_source.
+     *     :type external_id: NonEmptyStr | None
+     *     :param source: The source from which the node information is derived. Must be unique
+     *         for external_id, as defined by composite index ix_node_external_id_source.
+     *     :type source: SourceEnum | None
+     *     :param type: The type of the node (e.g., remote, generic).
+     *     :type type: NonEmptyStr
+     *     :param services: A list of services associated with the node.
+     *     :type services: list[Service]
+     */
+    Node: {
+      /** Address */
+      address: string;
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /** External Id */
+      external_id?: string | null;
+      /** Id */
+      id: number | null;
+      /** Name */
+      name: string;
+      source?: components['schemas']['SourceEnum'] | null;
+      /**
+       * Type
+       * @default generic
+       */
+      type: string;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * NodeResponse
+     * @description Represent a node API response.
+     *
+     *     :param id: The primary key for the table. Auto-incremented and not nullable.
+     *     :type id: int | None
+     *     :param created_at: The timestamp when the record is created. Defaults to the current
+     *         time in UTC.
+     *     :type created_at: UTCDatetime
+     *     :param updated_at: The timestamp when the record is last updated. Automatically
+     *         updated on changes.
+     *     :type updated_at: UTCDatetime | None
+     *     :param address: The network address of the node.
+     *     :type address: NonEmptyStr
+     *     :param name: The name of the node.
+     *     :type name: NonEmptyStr
+     *     :param external_id: An external identifier for the node.
+     *     :type external_id: NonEmptyStr | None
+     *     :param source: The source from which the node information is derived.
+     *     :type source: SourceEnum | None
+     *     :param type: The type of the node (e.g., remote, generic).
+     *     :type type: NonEmptyStr
+     *     :param services: A list of services associated with the node.
+     *     :type services: list[Service]
+     */
+    NodeResponse: {
+      /** Address */
+      address: string;
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /** External Id */
+      external_id?: string | null;
+      /** Id */
+      id: number | null;
+      /** Name */
+      name: string;
+      /** Services */
+      services: components['schemas']['Service'][];
+      source?: components['schemas']['SourceEnum'] | null;
+      /**
+       * Type
+       * @default generic
+       */
+      type: string;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * NodeWrite
+     * @description Define the model for writing node data to the inventory.
+     *
+     *     :param address: The network address of the node.
+     *     :type address: NonEmptyStr
+     *     :param name: The name of the node.
+     *     :type name: NonEmptyStr
+     *     :param external_id: An external identifier for the node, indexed for quick lookup.
+     *         Defaults to None.
+     *     :type external_id: NonEmptyStr | None
+     *     :param source: The source from which the node information is derived. Indexed for
+     *         quick lookup. Defaults to None.
+     *     :type source: SourceEnum | None
+     *     :param type: The type of the node (e.g., remote, generic). Defaults to "generic".
+     *     :type type: NonEmptyStr
+     */
+    NodeWrite: {
+      /** Address */
+      address: string;
+      /** External Id */
+      external_id?: string | null;
+      /** Name */
+      name: string;
+      source?: components['schemas']['SourceEnum'] | null;
+      /**
+       * Type
+       * @default generic
+       */
+      type: string;
+    };
+    /** PaginatedResponse[NodeResponse] */
+    PaginatedResponse_NodeResponse_: {
+      /** Items */
+      items: components['schemas']['NodeResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /** PaginatedResponse[SchemaResponse] */
+    PaginatedResponse_SchemaResponse_: {
+      /** Items */
+      items: components['schemas']['SchemaResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /** PaginatedResponse[ServiceResponse] */
+    PaginatedResponse_ServiceResponse_: {
+      /** Items */
+      items: components['schemas']['ServiceResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /** PaginatedResponse[TableResponse] */
+    PaginatedResponse_TableResponse_: {
+      /** Items */
+      items: components['schemas']['TableResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /** PaginatedResponse[Union[SchemaResponse, SchemaCompactResponse]] */
+    PaginatedResponse_Union_SchemaResponse__SchemaCompactResponse__: {
+      /** Items */
+      items: (
+        | components['schemas']['SchemaResponse']
+        | components['schemas']['SchemaCompactResponse']
+      )[];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /**
+     * ReloadClassification
+     * @description Declare the reload behavior of an overridable settings field.
+     *
+     *     :cvar HOT: Field can be overridden via a DB row and the new value takes
+     *         effect on the next snapshot refresh, without restarting the service.
+     *         For a nested-model field, ``HOT`` permits both whole-object override
+     *         (``PATCH {parent: {...}}``) and per-child override (``parent__leaf``).
+     *     :vartype HOT: str
+     *     :cvar NESTED_ONLY: Nested-model field whose children may be overridden
+     *         (``parent__leaf``) while the parent itself rejects whole-object
+     *         override (``PATCH {parent: {...}}`` → 422). Children default to
+     *         HOT-inherit unless explicitly marked :func:`not_overridable_field`.
+     *     :vartype NESTED_ONLY: str
+     *     :cvar NOT_OVERRIDABLE: Field is not overridable from the database; YAML
+     *         and environment variables remain the only sources of truth.
+     *     :vartype NOT_OVERRIDABLE: str
+     * @enum {string}
+     */
+    ReloadClassification: 'hot' | 'nested_only' | 'not_overridable';
+    /**
+     * Schema
+     * @description Represent a database schema within a service.
+     *
+     *     :param id: The primary key for the table. Auto-incremented and not nullable.
+     *     :type id: int | None
+     *     :param created_at: The timestamp when the record is created. Defaults to the current
+     *         time in UTC.
+     *     :type created_at: UTCDatetime
+     *     :param updated_at: The timestamp when the record is last updated. Automatically
+     *         updated on changes.
+     *     :type updated_at: UTCDatetime | None
+     *     :param name: The name of the schema. Must be unique for service_id, as defined by
+     *         composite index ix_schema_name_service_id.
+     *     :type name: NonEmptyStr
+     *     :param service_id: The unique identifier of the service to which the schema belongs.
+     *         Must be unique for name, as defined by composite index
+     *         ix_schema_name_service_id.
+     *     :type service_id: int
+     *     :param service: The service to which the schema is associated.
+     *     :type service: Service
+     *     :param tables: A list of tables within the schema.
+     *     :type tables: list[Table]
+     */
+    Schema: {
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /** Id */
+      id: number | null;
+      /** Name */
+      name: string;
+      /** Service Id */
+      service_id: number;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * SchemaCompactResponse
+     * @description Define a compact schema response without nested tables.
+     *
+     *     :param id: The primary key for the schema. Auto-incremented and not nullable.
+     *     :type id: int | None
+     *     :param created_at: The timestamp when the record is created. Defaults to the current
+     *         time in UTC.
+     *     :type created_at: UTCDatetime
+     *     :param updated_at: The timestamp when the record is last updated. Automatically
+     *         updated on changes.
+     *     :type updated_at: UTCDatetime | None
+     *     :param name: The name of the schema.
+     *     :type name: NonEmptyStr
+     *     :param service_id: The unique identifier of the service to which the schema belongs.
+     *     :type service_id: int
+     */
+    SchemaCompactResponse: {
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /** Id */
+      id: number | null;
+      /** Name */
+      name: string;
+      /** Service Id */
+      service_id: number;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * SchemaDetailResponse
+     * @description Define the schema retrieve API response.
+     *
+     *     :param id: The primary key for the table. Auto-incremented and not nullable.
+     *     :type id: int | None
+     *     :param created_at: The timestamp when the record is created. Defaults to the current
+     *         time in UTC.
+     *     :type created_at: UTCDatetime
+     *     :param updated_at: The timestamp when the record is last updated. Automatically
+     *         updated on changes.
+     *     :type updated_at: UTCDatetime | None
+     *     :param name: The name of the schema.
+     *     :type name: NonEmptyStr
+     *     :param service_id: The unique identifier of the service to which the schema belongs.
+     *     :type service_id: int
+     *     :param service: The schema's service.
+     *     :type service: Service
+     */
+    SchemaDetailResponse: {
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /** Id */
+      id: number | null;
+      /** Name */
+      name: string;
+      service: components['schemas']['Service'];
+      /** Service Id */
+      service_id: number;
+      /** Tables */
+      tables: components['schemas']['Table'][];
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * SchemaResponse
+     * @description Define the schema API response.
+     *
+     *     :param id: The primary key for the schema. Auto-incremented and not nullable.
+     *     :type id: int | None
+     *     :param created_at: The timestamp when the record is created. Defaults to the current
+     *         time in UTC.
+     *     :type created_at: UTCDatetime
+     *     :param updated_at: The timestamp when the record is last updated. Automatically
+     *         updated on changes.
+     *     :type updated_at: UTCDatetime | None
+     *     :param name: The name of the schema.
+     *     :type name: NonEmptyStr
+     *     :param service_id: The unique identifier of the service to which the schema belongs.
+     *     :type service_id: int
+     *     :param tables: A list of tables within the schema.
+     *     :type tables: list[Table]
+     */
+    SchemaResponse: {
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /** Id */
+      id: number | null;
+      /** Name */
+      name: string;
+      /** Service Id */
+      service_id: number;
+      /** Tables */
+      tables: components['schemas']['Table'][];
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * SchemaWrite
+     * @description Define the model for writing schema data to the inventory.
+     *
+     *     :param name: The name of the schema.
+     *     :type name: NonEmptyStr
+     *     :param service_id: The foreign key referencing the service to which the schema
+     *         belongs. Defaults to None.
+     *     :type service_id: int | None
+     */
+    SchemaWrite: {
+      /** Name */
+      name: string;
+      /** Service Id */
+      service_id?: number | null;
+    };
+    /**
+     * Service
+     * @description Represent a service running on a node in the inventory.
+     *
+     *     :param id: The primary key for the table. Auto-incremented and not nullable.
+     *     :type id: int | None
+     *     :param created_at: The timestamp when the record is created. Defaults to the current
+     *         time in UTC.
+     *     :type created_at: UTCDatetime
+     *     :param updated_at: The timestamp when the record is last updated. Automatically
+     *         updated on changes.
+     *     :type updated_at: UTCDatetime | None
+     *     :param external_id: An external identifier for the service. Must be unique for
+     *         node_id, as defined by composite index ix_service_external_id_node_id.
+     *     :type external_id: NonEmptyStr | None
+     *     :param name: The name of the service.
+     *     :type name: NonEmptyStr
+     *     :param type: The type of the service (e.g., MYSQL, POSTGRESQL).
+     *     :type type: ServiceTypeEnum
+     *     :param port: The port number on which the service is running. Must be unique for
+     *         node_id, as defined by composite index ix_service_port_node_id.
+     *     :type port: int | None
+     *     :param environment: The environment in which the service is running, if set.
+     *     :type environment: str | None
+     *     :param cluster: The cluster in which the service is running, if set.
+     *     :type cluster: str | None
+     *     :param replication_set: The replication set in which the service is running, if set.
+     *     :type replication_set: str | None
+     *     :param custom_labels: Custom labels associated with the service, if set.
+     *     :type custom_labels: dict[str, Any] | None
+     *     :param node_id: The unique identifier of the node on which the service is running.
+     *         Must be unique for external_id, as defined by composite index
+     *         ix_service_external_id_node_id, and for port, as defined by composite index
+     *         ix_service_port_node_id.
+     *     :type node_id: int
+     *     :param node: The node to which the service is associated.
+     *     :type node: Node
+     *     :param schemas: A list of schemas associated with the service.
+     *     :type schemas: list[Schema]
+     */
+    Service: {
+      /** Cluster */
+      cluster?: string | null;
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /** Custom Labels */
+      custom_labels?: Record<string, never> | null;
+      /** Environment */
+      environment?: string | null;
+      /** External Id */
+      external_id?: string | null;
+      /** Id */
+      id: number | null;
+      /** Name */
+      name: string;
+      /** Node Id */
+      node_id: number;
+      /** Port */
+      port?: number | null;
+      /** Replication Set */
+      replication_set?: string | null;
+      type: components['schemas']['ServiceTypeEnum'];
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * ServiceDetailResponse
+     * @description Define the service retrieve API response.
+     *
+     *     :param id: The primary key for the table. Auto-incremented and not nullable.
+     *     :type id: int | None
+     *     :param created_at: The timestamp when the record is created. Defaults to the current
+     *         time in UTC.
+     *     :type created_at: UTCDatetime
+     *     :param updated_at: The timestamp when the record is last updated. Automatically
+     *         updated on changes.
+     *     :type updated_at: UTCDatetime | None
+     *     :param external_id: An external identifier for the service.
+     *     :type external_id: NonEmptyStr | None
+     *     :param name: The name of the service.
+     *     :type name: NonEmptyStr
+     *     :param type: The type of the service (e.g., MYSQL, POSTGRESQL).
+     *     :type type: ServiceTypeEnum
+     *     :param port: The port number on which the service is running.
+     *     :type port: int | None
+     *     :param environment: The environment in which the service is running, if set.
+     *     :type environment: str | None
+     *     :param cluster: The cluster in which the service is running, if set.
+     *     :type cluster: str | None
+     *     :param replication_set: The replication set in which the service is running, if set.
+     *     :type replication_set: str | None
+     *     :param custom_labels: Custom labels associated with the service, if set.
+     *     :type custom_labels: dict[str, Any] | None
+     *     :param node_id: The unique identifier of the node on which the service is running.
+     *     :type node_id: int
+     *     :param schemas: A list of schemas associated with the service.
+     *     :type schemas: list[Schema]
+     *     :param node: The service's node.
+     *     :type node: Node
+     */
+    ServiceDetailResponse: {
+      /** Cluster */
+      cluster?: string | null;
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /** Custom Labels */
+      custom_labels?: Record<string, never> | null;
+      /** Environment */
+      environment?: string | null;
+      /** External Id */
+      external_id?: string | null;
+      /** Id */
+      id: number | null;
+      /** Name */
+      name: string;
+      node: components['schemas']['Node'];
+      /** Node Id */
+      node_id: number;
+      /** Port */
+      port?: number | null;
+      /** Replication Set */
+      replication_set?: string | null;
+      /** Schemas */
+      schemas: components['schemas']['Schema'][];
+      type: components['schemas']['ServiceTypeEnum'];
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * ServiceResponse
+     * @description Define the service API response.
+     *
+     *     :param id: The primary key for the table. Auto-incremented and not nullable.
+     *     :type id: int | None
+     *     :param created_at: The timestamp when the record is created. Defaults to the current
+     *         time in UTC.
+     *     :type created_at: UTCDatetime
+     *     :param updated_at: The timestamp when the record is last updated. Automatically
+     *         updated on changes.
+     *     :type updated_at: UTCDatetime | None
+     *     :param external_id: An external identifier for the service.
+     *     :type external_id: NonEmptyStr | None
+     *     :param name: The name of the service.
+     *     :type name: NonEmptyStr
+     *     :param type: The type of the service (e.g., MYSQL, POSTGRESQL).
+     *     :type type: ServiceTypeEnum
+     *     :param port: The port number on which the service is running.
+     *     :type port: int | None
+     *     :param environment: The environment in which the service is running, if set.
+     *     :type environment: str | None
+     *     :param cluster: The cluster in which the service is running, if set.
+     *     :type cluster: str | None
+     *     :param replication_set: The replication set in which the service is running, if set.
+     *     :type replication_set: str | None
+     *     :param custom_labels: Custom labels associated with the service, if set.
+     *     :type custom_labels: dict[str, Any] | None
+     *     :param node_id: The unique identifier of the node on which the service is running.
+     *     :type node_id: int
+     *     :param schemas: A list of schemas associated with the service.
+     *     :type schemas: list[Schema]
+     *     :param node: The node to which the service is associated.
+     *     :type node: Node
+     */
+    ServiceResponse: {
+      /** Cluster */
+      cluster?: string | null;
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /** Custom Labels */
+      custom_labels?: Record<string, never> | null;
+      /** Environment */
+      environment?: string | null;
+      /** External Id */
+      external_id?: string | null;
+      /** Id */
+      id: number | null;
+      /** Name */
+      name: string;
+      node: components['schemas']['Node'];
+      /** Node Id */
+      node_id: number;
+      /** Port */
+      port?: number | null;
+      /** Replication Set */
+      replication_set?: string | null;
+      /** Schemas */
+      schemas: components['schemas']['Schema'][];
+      type: components['schemas']['ServiceTypeEnum'];
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * ServiceSystemObservationResponse
+     * @description Define the response model for service system observation data.
+     *
+     *     :param id: The primary key of the observation record.
+     *     :type id: int | None
+     *     :param created_at: When the record was created.
+     *     :type created_at: UTCDatetime
+     *     :param updated_at: When the record was last updated.
+     *     :type updated_at: UTCDatetime | None
+     *     :param service_id: The unique identifier of the observed service.
+     *     :type service_id: int
+     *     :param db_engine_version: The observed database engine version.
+     *     :type db_engine_version: NonEmptyStr
+     *     :param observed_at: When this observation was collected.
+     *     :type observed_at: UTCDatetime
+     */
+    ServiceSystemObservationResponse: {
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /** Db Engine Version */
+      db_engine_version: string;
+      /** Id */
+      id: number | null;
+      /**
+       * Observed At
+       * Format: date-time
+       */
+      observed_at: string;
+      /** Service Id */
+      service_id: number;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * ServiceSystemObservationWrite
+     * @description Define the model for writing service system observation data to the inventory.
+     *
+     *     :param service_id: The foreign key referencing the service. Defaults to None.
+     *     :type service_id: int | None
+     *     :param db_engine_version: The observed database engine version.
+     *     :type db_engine_version: NonEmptyStr
+     *     :param observed_at: When this observation was collected.
+     *     :type observed_at: UTCDatetime
+     */
+    ServiceSystemObservationWrite: {
+      /** Db Engine Version */
+      db_engine_version: string;
+      /**
+       * Observed At
+       * Format: date-time
+       */
+      observed_at: string;
+      /** Service Id */
+      service_id?: number | null;
+    };
+    /**
+     * ServiceTypeEnum
+     * @description Enumerate the supported service types.
+     *
+     *     :cvar MYSQL: Represents the MySQL service type.
+     *     :vartype MYSQL: str
+     *     :cvar POSTGRESQL: Represents the PostgreSQL service type.
+     *     :vartype POSTGRESQL: str
+     *     :cvar MONGODB: Represents the MongoDB service type.
+     *     :vartype MONGODB: str
+     *     :cvar PROXYSQL: Represents the ProxySQL service type.
+     *     :vartype PROXYSQL: str
+     *     :cvar HAPROXY: Represents the HAProxy service type.
+     *     :vartype HAPROXY: str
+     *     :cvar EXTERNAL: Represents an external service type.
+     *     :vartype EXTERNAL: str
+     *     :cvar VALKEY: Represents the Valkey service type.
+     *     :vartype VALKEY: str
+     * @enum {string}
+     */
+    ServiceTypeEnum:
+      | 'mysql'
+      | 'postgresql'
+      | 'mongodb'
+      | 'proxysql'
+      | 'haproxy'
+      | 'external'
+      | 'valkey';
+    /**
+     * ServiceWrite
+     * @description Define the model for writing service data to the inventory.
+     *
+     *     :param external_id: An external identifier for the service, indexed for quick
+     *         lookup. Defaults to None.
+     *     :type external_id: NonEmptyStr | None
+     *     :param name: The name of the service.
+     *     :type name: NonEmptyStr
+     *     :param type: The type of the service (e.g., MYSQL, POSTGRESQL).
+     *     :type type: ServiceTypeEnum
+     *     :param port: The port number on which the service is running. Defaults to None.
+     *     :type port: int | None
+     *     :param environment: The environment in which the service is running (e.g.,
+     *         production, staging). Defaults to None.
+     *     :type environment: str | None
+     *     :param cluster: The cluster in which the service is running. Defaults to None.
+     *     :type cluster: str | None
+     *     :param replication_set: The replication set in which the service is running. Defaults to None.
+     *     :type replication_set: str | None
+     *     :param custom_labels: Custom labels associated with the service. Defaults to None.
+     *     :type custom_labels: dict[str, Any] | None
+     *     :param node_id: The foreign key referencing the node to which the service belongs.
+     *         Defaults to None.
+     *     :type node_id: int | None
+     */
+    ServiceWrite: {
+      /** Cluster */
+      cluster?: string | null;
+      /** Custom Labels */
+      custom_labels?: Record<string, never> | null;
+      /** Environment */
+      environment?: string | null;
+      /** External Id */
+      external_id?: string | null;
+      /** Name */
+      name: string;
+      /** Node Id */
+      node_id?: number | null;
+      /** Port */
+      port?: number | null;
+      /** Replication Set */
+      replication_set?: string | null;
+      type: components['schemas']['ServiceTypeEnum'];
+    };
+    /**
+     * SettingClassEnum
+     * @description Enumerate settings classes that may have HOT override rows.
+     *
+     *     The wired classes are ``SEPSettings``, ``TasksSettings``,
+     *     ``SnippetsSettings``, ``MessagesSettings``, the global ``Settings``,
+     *     ``AlertSettings``, ``AlertsSettings``, ``AnonymizerSettings`` and
+     *     ``InventorySettings``.
+     *
+     *     To wire a new settings class:
+     *
+     *     1. Add a member here whose value matches the Pydantic class ``__name__``.
+     *     2. Generate an Alembic migration on every consumer track that extends the
+     *        ``CHECK`` constraint on ``settingoverride.setting_class``. The column
+     *        uses ``native_enum=False`` so the value list lives in a constraint,
+     *        not a PostgreSQL ``TYPE`` -- the migration ``ALTER``s the constraint.
+     *        Note that the column and ``CHECK`` constraint persist the enum member
+     *        *names* (e.g. ``SEP_SETTINGS``), which is distinct from the member
+     *        *value* (the Pydantic class name, e.g. ``SEPSettings``).
+     *     3. Wire a ``ProxyEntry`` for the new class in the relevant service's
+     *        lifespan (``app/sep/main.py`` or ``app/tasks/main.py``).
+     * @enum {string}
+     */
+    SettingClassEnum:
+      | 'SEPSettings'
+      | 'TasksSettings'
+      | 'SnippetsSettings'
+      | 'MessagesSettings'
+      | 'Settings'
+      | 'AlertSettings'
+      | 'AnonymizerSettings'
+      | 'AlertsSettings'
+      | 'InventorySettings';
+    /**
+     * SettingClassGroup
+     * @description One settings-class group in the LIST response.
+     *
+     *     :param setting_class: The settings class this group represents.
+     *     :type setting_class: SettingClassEnum
+     *     :param settings: The fields declared on the settings class, with their
+     *         current values and metadata.
+     *     :type settings: list[SettingResponse]
+     *     :param is_app_owned: Whether this group belongs to a SEP app under
+     *         ``app/sep/apps/`` rather than core SEP wiring.
+     *     :type is_app_owned: bool
+     *     :param app_id: The owning app's registry key when ``is_app_owned`` is
+     *         ``True``; ``None`` for core groups.
+     *     :type app_id: str | None
+     *     :param app_display_name: The owning app's human-facing label when
+     *         ``is_app_owned`` is ``True``; ``None`` for core groups.
+     *     :type app_display_name: str | None
+     *     :param app_enabled: Whether the owning app is currently enabled when
+     *         ``is_app_owned`` is ``True``; ``None`` for core groups. Disabled
+     *         apps remain listed so the frontend can hide them without a second
+     *         lookup.
+     *     :type app_enabled: bool | None
+     */
+    SettingClassGroup: {
+      /** App Display Name */
+      app_display_name?: string | null;
+      /** App Enabled */
+      app_enabled?: boolean | null;
+      /** App Id */
+      app_id?: string | null;
+      /**
+       * Is App Owned
+       * @default false
+       */
+      is_app_owned: boolean;
+      setting_class: components['schemas']['SettingClassEnum'];
+      /** Settings */
+      settings: components['schemas']['SettingResponse'][];
+    };
+    /**
+     * SettingResponse
+     * @description Represent a single setting's metadata and current value.
+     *
+     *     :param setting_class: The settings class the field belongs to.
+     *     :param key: The field name on the settings class.
+     *     :param key_path: Carry the canonical key segments for ``key`` such that
+     *         ``"__".join(key_path) == key``.
+     *     :param value: The current value visible through the proxy, dumped to a
+     *         JSON-safe shape via the field's annotation. ``SecretStr`` fields are
+     *         redacted to ``"**********"``.
+     *     :param default_value: The field's declared default value, dumped via the
+     *         same JSON serialiser. ``None`` when no default exists.
+     *     :param type: A human-readable representation of the field's declared
+     *         annotation (for operator visibility; validation uses the actual
+     *         ``FieldInfo``).
+     *     :param reload: The reload classification (HOT or NOT_OVERRIDABLE).
+     *     :param description: The field's free-text description, or ``None``.
+     *     :param is_secret: Whether the field's annotation contains a Pydantic secret
+     *         (``SecretStr`` / ``SecretBytes``) at any depth.
+     *     :param is_complex: Whether the field's annotation is or contains a Pydantic
+     *         ``BaseModel`` subclass (true for nested submodels).
+     *     :param has_override: Whether a row exists in the ``settingoverride`` table
+     *         for this ``(setting_class, key)`` pair, regardless of ``is_active``.
+     *     :param is_advanced: Whether the setting is flagged ``advanced`` so the UI can
+     *         present it separately from everyday settings. Display-only:
+     *         it does not affect PATCH/DELETE eligibility.
+     *     :param is_applicable: Whether the setting applies under current runtime state
+     *         (e.g. the active auth provider). ``False`` lets the UI present the field
+     *         as inert. Display-only, like ``is_advanced``: it does not block
+     *         PATCH/DELETE server-side; the runtime gate is the real enforcement.
+     */
+    SettingResponse: {
+      /** Default Value */
+      default_value: unknown;
+      /** Description */
+      description: string | null;
+      /** Has Override */
+      has_override: boolean;
+      /**
+       * Is Advanced
+       * @default false
+       */
+      is_advanced: boolean;
+      /**
+       * Is Applicable
+       * @default true
+       */
+      is_applicable: boolean;
+      /** Is Complex */
+      is_complex: boolean;
+      /** Is Secret */
+      is_secret: boolean;
+      /** Key */
+      key: string;
+      /** Key Path */
+      key_path?: string[];
+      reload: components['schemas']['ReloadClassification'];
+      setting_class: components['schemas']['SettingClassEnum'];
+      /** Type */
+      type: string;
+      /** Value */
+      value: unknown;
+    };
+    /**
+     * SettingsListResponse
+     * @description The LIST endpoint response, grouping settings by class.
+     *
+     *     :param groups: One :class:`SettingClassGroup` per settings class the
+     *         router was configured with.
+     *     :type groups: list[SettingClassGroup]
+     */
+    SettingsListResponse: {
+      /** Groups */
+      groups: components['schemas']['SettingClassGroup'][];
+    };
+    /**
+     * SettingsPatch
+     * @description Batch PATCH payload: a flat ``{field_name: new_value, ...}`` mapping.
+     *
+     *     An empty body is rejected as 422 because a no-op PATCH is a client bug, not
+     *     a valid request. The server coerces each value to the field's declared
+     *     type via :func:`coerce_field_value`; validation is all-or-nothing -- if any
+     *     key fails, nothing is written.
+     */
+    SettingsPatch: {
+      [key: string]: components['schemas']['JsonValue'];
+    };
+    /**
+     * SourceEnum
+     * @description Enumeration of possible data sources for a node.
+     *
+     *     :cvar PMM: Represents the PMM data source.
+     *     :vartype PMM: str
+     * @constant
+     * @enum {string}
+     */
+    SourceEnum: 'pmm';
+    /**
+     * Table
+     * @description Represent a table within a schema.
+     *
+     *     :param id: The primary key for the table. Auto-incremented and not nullable.
+     *     :type id: int | None
+     *     :param created_at: The timestamp when the record is created. Defaults to the current
+     *         time in UTC.
+     *     :type created_at: UTCDatetime
+     *     :param updated_at: The timestamp when the record is last updated. Automatically
+     *         updated on changes.
+     *     :type updated_at: UTCDatetime | None
+     *     :param name: The name of the table. Must be unique for schema_id, as defined by
+     *         composite index ix_table_name_schema_id.
+     *     :type name: NonEmptyStr
+     *     :param create: The SQL statement used to create the table.
+     *     :type create: NonEmptyStr
+     *     :param schema_id: The unique identifier of the schema to which the table belongs.
+     *         Must be unique for name, as defined by composite index ix_table_name_schema_id.
+     *     :type schema_id: int
+     *     :param database: The schema to which the table is associated.
+     *     :type database: Schema
+     */
+    Table: {
+      /** Create */
+      create: string;
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /** Id */
+      id: number | null;
+      /** Keys */
+      keys: Record<string, never>;
+      /** Name */
+      name: string;
+      /** Schema Id */
+      schema_id: number;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * TableDetailResponse
+     * @description Define the schema retrieve API response.
+     *
+     *     :param id: The primary key for the table. Auto-incremented and not nullable.
+     *     :type id: int | None
+     *     :param created_at: The timestamp when the record is created. Defaults to the current
+     *         time in UTC.
+     *     :type created_at: UTCDatetime
+     *     :param updated_at: The timestamp when the record is last updated. Automatically
+     *         updated on changes.
+     *     :type updated_at: UTCDatetime | None
+     *     :param name: The name of the table.
+     *     :type name: NonEmptyStr
+     *     :param create: The SQL statement used to create the table.
+     *     :type create: NonEmptyStr
+     *     :param schema_id: The foreign key referencing the schema to which the table belongs.
+     *     :type schema_id: int
+     *     :param database: The table's schema.
+     *     :type database: Schema
+     */
+    TableDetailResponse: {
+      /** Create */
+      create: string;
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      database: components['schemas']['Schema'];
+      /** Id */
+      id: number | null;
+      /** Keys */
+      keys: Record<string, never>;
+      /** Name */
+      name: string;
+      /** Schema Id */
+      schema_id: number;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * TableResponse
+     * @description Define the table API response.
+     *
+     *     :param id: The primary key for the table. Auto-incremented and not nullable.
+     *     :type id: int | None
+     *     :param created_at: The timestamp when the record is created. Defaults to the current
+     *         time in UTC.
+     *     :type created_at: UTCDatetime
+     *     :param updated_at: The timestamp when the record is last updated. Automatically
+     *         updated on changes.
+     *     :type updated_at: UTCDatetime | None
+     *     :param name: The name of the table.
+     *     :type name: NonEmptyStr
+     *     :param create: The SQL statement used to create the table.
+     *     :type create: NonEmptyStr
+     *     :param schema_id: The foreign key referencing the schema to which the table belongs.
+     *     :type schema_id: int
+     */
+    TableResponse: {
+      /** Create */
+      create: string;
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /** Id */
+      id: number | null;
+      /** Keys */
+      keys: Record<string, never>;
+      /** Name */
+      name: string;
+      /** Schema Id */
+      schema_id: number;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * TableWrite
+     * @description Define the model for writing table data to the inventory.
+     *
+     *     :param name: The name of the table.
+     *     :type name: NonEmptyStr
+     *     :param create: The SQL statement used to create the table.
+     *     :type create: NonEmptyStr
+     *     :param schema_id: The foreign key referencing the schema to which the table belongs.
+     *     :type schema_id: int | None
+     */
+    TableWrite: {
+      /** Create */
+      create: string;
+      /** Keys */
+      keys: Record<string, never>;
+      /** Name */
+      name: string;
+      /** Schema Id */
+      schema_id?: number | null;
+    };
+    /** ValidationError */
+    ValidationError: {
+      /** Context */
+      ctx?: Record<string, never>;
+      /** Input */
+      input?: unknown;
+      /** Location */
+      loc: (string | number)[];
+      /** Message */
+      msg: string;
+      /** Error Type */
+      type: string;
+    };
+  };
+  responses: never;
+  parameters: never;
+  requestBodies: never;
+  headers: never;
+  pathItems: never;
+}
+export type $defs = Record<string, never>;
+export interface operations {
+  settings_list_settings_admin_settings__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['SettingsListResponse'];
+        };
+      };
+    };
+  };
+  settings_patch_settings_admin_settings__setting_class__patch: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        setting_class: components['schemas']['SettingClassEnum'];
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['SettingsPatch'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['SettingResponse'][];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  settings_get_setting_admin_settings__setting_class___key__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        setting_class: components['schemas']['SettingClassEnum'];
+        key: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['SettingResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  settings_delete_setting_admin_settings__setting_class___key__delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        setting_class: components['schemas']['SettingClassEnum'];
+        key: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  nodes_list_nodes_nodes__get: {
+    parameters: {
+      query?: {
+        external_id?: string | null;
+        source?: components['schemas']['SourceEnum'] | null;
+        node_type?: string | null;
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PaginatedResponse_NodeResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  nodes_create_node_nodes__post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['NodeWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Node'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  nodes_retrieve_node_nodes__node_id__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        node_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['NodeResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  nodes_update_node_nodes__node_id__put: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        node_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['NodeWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Node'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  nodes_delete_node_nodes__node_id__delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        node_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  nodes_list_services_by_node_nodes__node_id__services__get: {
+    parameters: {
+      query?: {
+        service_type?: components['schemas']['ServiceTypeEnum'] | null;
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path: {
+        node_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PaginatedResponse_ServiceResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  nodes_create_service_for_node_nodes__node_id__services__post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        node_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['ServiceWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Service'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  nodes_retrieve_host_system_observation_nodes__node_id__system_observation_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        node_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HostSystemObservationResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  nodes_upsert_host_system_observation_nodes__node_id__system_observation_put: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        node_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['HostSystemObservationWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HostSystemObservationResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  schemas_list_schemas_schemas__get: {
+    parameters: {
+      query?: {
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PaginatedResponse_SchemaResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  schemas_retrieve_schema_schemas__schema_id__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        schema_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['SchemaDetailResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  schemas_update_schema_schemas__schema_id__put: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        schema_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['SchemaWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Schema'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  schemas_delete_schema_schemas__schema_id__delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        schema_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  schemas_list_tables_by_schema_schemas__schema_id__tables__get: {
+    parameters: {
+      query?: {
+        search?: string | null;
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path: {
+        schema_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PaginatedResponse_TableResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  schemas_create_table_for_schema_schemas__schema_id__tables__post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        schema_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['TableWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Table'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  services_list_services_services__get: {
+    parameters: {
+      query?: {
+        service_type?: components['schemas']['ServiceTypeEnum'] | null;
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PaginatedResponse_ServiceResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  services_retrieve_service_services__service_id__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        service_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['ServiceDetailResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  services_update_service_services__service_id__put: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        service_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['ServiceWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Service'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  services_delete_service_services__service_id__delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        service_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  services_list_schemas_by_service_services__service_id__schemas__get: {
+    parameters: {
+      query?: {
+        search?: string | null;
+        include_tables?: string | null;
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path: {
+        service_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PaginatedResponse_Union_SchemaResponse__SchemaCompactResponse__'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  services_create_schema_for_service_services__service_id__schemas__post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        service_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['SchemaWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Schema'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  services_retrieve_service_system_observation_services__service_id__system_observation_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        service_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['ServiceSystemObservationResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  services_upsert_service_system_observation_services__service_id__system_observation_put: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        service_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['ServiceSystemObservationWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['ServiceSystemObservationResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  summary_get_summary_inventory_summary__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': {
+            [key: string]: number;
+          };
+        };
+      };
+    };
+  };
+  tables_list_tables_tables__get: {
+    parameters: {
+      query?: {
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PaginatedResponse_TableResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tables_retrieve_table_tables__table_id__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        table_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['TableDetailResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tables_update_table_tables__table_id__put: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        table_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['TableWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Table'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tables_delete_table_tables__table_id__delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        table_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+}
diff --git a/ui/packages/sep/api/src/generated/main.ts b/ui/packages/sep/api/src/generated/main.ts
new file mode 100644
index 00000000000..01af8ebd759
--- /dev/null
+++ b/ui/packages/sep/api/src/generated/main.ts
@@ -0,0 +1,803 @@
+/**
+ * This file is auto-generated by `pnpm --filter @sep/api codegen`.
+ * Do not edit by hand — regenerate from the source OpenAPI spec.
+ */
+export interface paths {
+  '/api/config/alerts': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Alert Config
+     * @description Report whether at least one alert provider is configured.
+     *
+     *     Mirrors the server-side ``bool(alert_settings.PROVIDERS)`` check used by
+     *     the Jinja2 task forms so the React frontend can drive the same
+     *     enabled/disabled behavior of the *Alert on failure* field. The endpoint
+     *     is gated behind authentication so an anonymous probe cannot leak
+     *     whether alerting is wired up on this deployment.
+     *
+     *     :return: The alert provider availability flag.
+     *     :rtype: AlertConfigResponse
+     */
+    get: operations['config_get_alert_config_api_config_alerts_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/oauth/login': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Spa Login
+     * @description Authenticate the SPA user and establish the refresh cookie.
+     *
+     *     Run the Casdoor password grant server-side, set the refresh token as an
+     *     ``HttpOnly`` cookie scoped to ``/api/oauth``, and return the access token
+     *     (plus its TTL) in JSON. The refresh token is never included in the
+     *     response body.
+     *
+     *     :param body: The JSON body containing username and password.
+     *     :type body: SPALoginBody
+     *     :param response: The HTTP response on which to set the refresh cookie.
+     *     :type response: Response
+     *     :return: The slim OAuth token response for the SPA.
+     *     :rtype: SPAOAuthTokenResponse
+     *     :raises InactiveUserException: If the user is not active.
+     */
+    post: operations['oauth_spa_login_api_oauth_login_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/oauth/logout': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Spa Logout
+     * @description End the SPA session: revoke the access token and clear the refresh cookie.
+     *
+     *     The SPA authenticates this request via the ``Authorization: Bearer``
+     *     header. Clear the refresh cookie first so a Casdoor revocation failure
+     *     does not leave the browser with a stale cookie, then revoke the access
+     *     token upstream. Swallow ``KeyError`` / ``ValidationError`` from the
+     *     upstream revocation so the client always sees a clean 204.
+     *
+     *     :param user: The authenticated user resolved from the Bearer token.
+     *     :type user: CurrentUser
+     *     :param response: The HTTP response on which to clear the refresh cookie.
+     *     :type response: Response
+     */
+    post: operations['oauth_spa_logout_api_oauth_logout_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/oauth/refresh': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Refresh Token
+     * @description Mint a fresh access token from the ``HttpOnly`` refresh cookie.
+     *
+     *     On success, rotate the refresh cookie and return a new access token. On
+     *     any failure (missing cookie, Casdoor-rejected token, malformed Casdoor
+     *     response), return 401 without mutating the cookie so the SPA observes a
+     *     clean invalidation signal. The route never reads the refresh token from
+     *     the request body.
+     *
+     *     :param response: The HTTP response on which to rotate the refresh cookie.
+     *     :type response: Response
+     *     :param refresh_token: The refresh token from the ``refreshToken`` cookie.
+     *     :type refresh_token: str | None
+     *     :return: The slim OAuth token response for the SPA.
+     *     :rtype: SPAOAuthTokenResponse
+     *     :raises HTTPUnauthorizedException: If the refresh token is missing,
+     *         invalid, expired, or revoked.
+     *     :raises InactiveUserException: If the user is not active.
+     */
+    post: operations['oauth_refresh_token_api_oauth_refresh_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/oauth/session': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Spa Session Login
+     * @description Authenticate the SPA from an ambient Grafana session cookie.
+     *
+     *     Read the ambient Grafana session cookie off the request, validate it against
+     *     Grafana, set the ``HttpOnly`` refresh cookie scoped to ``/api/oauth``, and
+     *     return the slim access assertion in JSON. A ``401`` (no valid ambient
+     *     session) tells the SPA to show its login screen.
+     *
+     *     :param request: The incoming request, carrying the ambient Grafana session
+     *         cookie.
+     *     :param response: The HTTP response on which to set the refresh cookie.
+     *     :return: The slim OAuth token response for the SPA.
+     *     :raises HTTPUnauthorizedException: If there is no valid ambient session.
+     */
+    post: operations['oauth_spa_session_login_api_oauth_session_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/oauth/session/exchange': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Spa Session Exchange
+     * @description Mint a short-lived SEP bearer from an ambient Grafana session.
+     *
+     *     Serves an embedded client that already carries the host's session cookie on
+     *     the same origin. Unlike ``POST /session``, set no cookie and issue no refresh
+     *     token: the caller holds the bearer in memory and exchanges again before it
+     *     expires, so the deployment never shares a long-lived credential.
+     *
+     *     Every exchange re-reads the identity from the provider and no validation is
+     *     cached, so a role change takes effect within one bearer lifetime. A
+     *     signed-out browser loses embedded access just as fast, because without the
+     *     session cookie it cannot obtain another bearer -- though whether a
+     *     *previously copied* host cookie stops working depends on the host revoking
+     *     its own session server-side, which is outside SEP's control.
+     *
+     *     Carries no auth dependency by design: the caller is not yet SEP-authenticated,
+     *     and the ambient session cookie is the credential being presented. No CSRF
+     *     primitive applies either -- ``IsCsrfValidated`` guards form data on the
+     *     server-rendered login route, and requiring a Bearer token cannot gate an
+     *     endpoint whose purpose is to issue one. That is safe because a cross-origin
+     *     attacker cannot read this response (the CORS posture is an explicit
+     *     per-environment origin allowlist, with the middleware absent when none is
+     *     configured), and the bearer-authenticated calls the token enables are
+     *     CSRF-exempt by design, since browsers never attach an ``Authorization``
+     *     header automatically.
+     *
+     *     Every failure -- no cookie, a rejected session, an unreachable provider --
+     *     denies with the same ``401`` rather than reporting a reason the route cannot
+     *     distinguish.
+     *
+     *     :param request: The incoming request, carrying the ambient session cookie.
+     *     :param response: The HTTP response, marked uncacheable so no intermediary
+     *         stores the minted bearer.
+     *     :return: The minted bearer and its lifetime.
+     *     :raises HTTPUnauthorizedException: If there is no valid ambient session.
+     */
+    post: operations['oauth_spa_session_exchange_api_oauth_session_exchange_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/oauth/token': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Create Oauth Token
+     * @description Generate an OAuth token for a user from their username and password.
+     *
+     *     OAuth2-style endpoint kept for non-SPA clients. For the React SPA, use
+     *     ``POST /api/oauth/login`` which returns a slim response body and places
+     *     the refresh token in an ``HttpOnly`` cookie.
+     *
+     *     :param form_data: The form data containing username and password.
+     *     :type form_data: OAuth2PasswordRequestForm
+     *     :return: The OAuth token for the user.
+     *     :rtype: OAuthToken
+     *     :raises InactiveUserException: If the user is not active.
+     */
+    post: operations['oauth_create_oauth_token_api_oauth_token_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/users/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Users
+     * @description List users.
+     *
+     *     :return: The list of users.
+     *     :rtype: list[User]
+     */
+    get: operations['users_list_users_api_users__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/users/me': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Retrieve Current User
+     * @description Retrieve the current authenticated user.
+     *
+     *     :param current_user: The current authenticated user.
+     *     :type current_user: CurrentUser
+     *     :return: The current authenticated user.
+     *     :rtype: User
+     */
+    get: operations['users_retrieve_current_user_api_users_me_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/users/{username}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Retrieve User
+     * @description Retrieve a user by username.
+     *
+     *     :param current_user: The current authenticated user.
+     *     :type current_user: CurrentUser
+     *     :param username: The username of the user to retrieve.
+     *     :type username: str
+     *     :return: The requested user.
+     *     :rtype: User
+     *     :raises HTTPForbiddenException: If the current user is not an admin and tries to
+     *         access another user's information.
+     */
+    get: operations['users_retrieve_user_api_users__username__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+  schemas: {
+    /**
+     * AlertConfigResponse
+     * @description Represent the response of ``GET /api/config/alerts``.
+     *
+     *     :param available: Whether at least one alert provider is configured.
+     *     :type available: bool
+     */
+    AlertConfigResponse: {
+      /** Available */
+      available: boolean;
+    };
+    /** Body_oauth_create_oauth_token_api_oauth_token_post */
+    Body_oauth_create_oauth_token_api_oauth_token_post: {
+      /** Client Id */
+      client_id?: string | null;
+      /**
+       * Client Secret
+       * Format: password
+       */
+      client_secret?: string | null;
+      /** Grant Type */
+      grant_type?: string | null;
+      /**
+       * Password
+       * Format: password
+       */
+      password: string;
+      /**
+       * Scope
+       * @default
+       */
+      scope: string;
+      /** Username */
+      username: string;
+    };
+    /**
+     * CasdoorUser
+     * @description Represent a Casdoor user.
+     *
+     *     :param id: The unique identifier of the user.
+     *     :param email: The email address of the user.
+     *     :param first_name: The first name of the user.
+     *     :param last_name: The last name of the user.
+     *     :param is_admin: Whether the user has administrative privileges. Defaults to False.
+     *     :param created_time: The datetime when the user was created. Defaults to current
+     *         datetime.
+     *     :param updated_time: The datetime when the user was last updated. Defaults to
+     *         current datetime.
+     *     :param username: The user's Casdoor username.
+     *     :param owner: The user's Casdoor organization.
+     *     :param is_forbidden: Whether the user has the ``is_forbidden`` attribute set in
+     *         Casdoor. Defaults to False.
+     *     :param is_deleted: Whether the user has the ``is_deleted`` attribute set in Casdoor.
+     *         Defaults to False.
+     */
+    CasdoorUser: {
+      /** Createdtime */
+      createdTime?: string | null;
+      /**
+       * Email
+       * @default
+       */
+      email: string;
+      /**
+       * Firstname
+       * @default
+       */
+      firstName: string;
+      /**
+       * Fullname
+       * @description The combination of the user's first and last names.
+       *
+       *     :return: The user's full name.
+       *     :rtype: str
+       */
+      readonly fullName: string;
+      /**
+       * Id
+       * Format: uuid4
+       */
+      id: string;
+      /**
+       * Isactive
+       * @description Return True if the user is not forbidden nor deleted.
+       *
+       *     :return: True if the user is active.
+       */
+      readonly isActive: boolean;
+      /**
+       * Isadmin
+       * @default false
+       */
+      isAdmin: boolean;
+      /**
+       * Isdeleted
+       * @default false
+       */
+      isDeleted: boolean;
+      /**
+       * Isforbidden
+       * @default false
+       */
+      isForbidden: boolean;
+      /**
+       * Lastname
+       * @default
+       */
+      lastName: string;
+      /** Owner */
+      owner: string;
+      /** Updatedtime */
+      updatedTime?: string | null;
+      /** Username */
+      username: string;
+    };
+    /** HTTPValidationError */
+    HTTPValidationError: {
+      /** Detail */
+      detail?: components['schemas']['ValidationError'][];
+    };
+    /**
+     * OAuthToken
+     * @description Represent an OAuth token.
+     *
+     *     :param access_token: The token used to access protected resources.
+     *     :type access_token: str
+     *     :param id_token: The token that contains identity information about the user.
+     *     :type id_token: str
+     *     :param refresh_token: The token used to obtain new access tokens after the
+     *         current one expires.
+     *     :type refresh_token: str
+     *     :param token_type: The type of token, typically "bearer".
+     *     :type token_type: str
+     *     :param expires_in: The time duration after which the token expires.
+     *     :type expires_in: TimedeltaSeconds
+     *     :param scope: The scope of the access granted by the token.
+     *     :type scope: str
+     */
+    OAuthToken: {
+      /** Access Token */
+      access_token: string;
+      /** Expires In */
+      expires_in: number;
+      /** Id Token */
+      id_token: string;
+      /** Refresh Token */
+      refresh_token: string;
+      /** Scope */
+      scope: string;
+      /** Token Type */
+      token_type: string;
+    };
+    /**
+     * SPALoginBody
+     * @description Represent the JSON body expected by ``POST /api/oauth/login``.
+     *
+     *     :param username: The username of the user.
+     *     :type username: str
+     *     :param password: The password of the user.
+     *     :type password: str
+     */
+    SPALoginBody: {
+      /** Password */
+      password: string;
+      /** Username */
+      username: string;
+    };
+    /**
+     * SPAOAuthTokenResponse
+     * @description Represent the slim OAuth token response returned to SPA clients.
+     *
+     *     Omit ``refresh_token``, ``id_token``, ``token_type``, and ``scope``. The
+     *     SPA keeps the refresh token in an ``HttpOnly`` cookie and derives nothing
+     *     from the other fields.
+     *
+     *     :param access_token: The token used to access protected resources.
+     *     :type access_token: str
+     *     :param expires_in: The time duration after which the access token expires.
+     *     :type expires_in: TimedeltaSeconds
+     */
+    SPAOAuthTokenResponse: {
+      /** Access Token */
+      access_token: string;
+      /** Expires In */
+      expires_in: number;
+    };
+    /**
+     * SessionExchangeTokenResponse
+     * @description Represent the bearer returned when an ambient session is exchanged.
+     *
+     *     Mirror :class:`SPAOAuthTokenResponse`'s field names so a client's token
+     *     provider reads the same shape, but keep the contract separate: no refresh
+     *     token is issued and no cookie is set, so the holder renews by exchanging
+     *     again rather than by refreshing.
+     *
+     *     :param access_token: The short-lived token used to access protected
+     *         resources.
+     *     :param expires_in: The time duration after which the token expires.
+     */
+    SessionExchangeTokenResponse: {
+      /** Access Token */
+      access_token: string;
+      /** Expires In */
+      expires_in: number;
+    };
+    /** ValidationError */
+    ValidationError: {
+      /** Context */
+      ctx?: Record<string, never>;
+      /** Input */
+      input?: unknown;
+      /** Location */
+      loc: (string | number)[];
+      /** Message */
+      msg: string;
+      /** Error Type */
+      type: string;
+    };
+  };
+  responses: never;
+  parameters: never;
+  requestBodies: never;
+  headers: never;
+  pathItems: never;
+}
+export type $defs = Record<string, never>;
+export interface operations {
+  config_get_alert_config_api_config_alerts_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['AlertConfigResponse'];
+        };
+      };
+    };
+  };
+  oauth_spa_login_api_oauth_login_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['SPALoginBody'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['SPAOAuthTokenResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  oauth_spa_logout_api_oauth_logout_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  oauth_refresh_token_api_oauth_refresh_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: {
+        refreshToken?: string | null;
+      };
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['SPAOAuthTokenResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  oauth_spa_session_login_api_oauth_session_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['SPAOAuthTokenResponse'];
+        };
+      };
+    };
+  };
+  oauth_spa_session_exchange_api_oauth_session_exchange_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['SessionExchangeTokenResponse'];
+        };
+      };
+    };
+  };
+  oauth_create_oauth_token_api_oauth_token_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/x-www-form-urlencoded': components['schemas']['Body_oauth_create_oauth_token_api_oauth_token_post'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['OAuthToken'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  users_list_users_api_users__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['CasdoorUser'][];
+        };
+      };
+    };
+  };
+  users_retrieve_current_user_api_users_me_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['CasdoorUser'];
+        };
+      };
+    };
+  };
+  users_retrieve_user_api_users__username__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        username: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['CasdoorUser'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+}
diff --git a/ui/packages/sep/api/src/generated/sep.ts b/ui/packages/sep/api/src/generated/sep.ts
new file mode 100644
index 00000000000..20387aeea4b
--- /dev/null
+++ b/ui/packages/sep/api/src/generated/sep.ts
@@ -0,0 +1,14997 @@
+/**
+ * This file is auto-generated by `pnpm --filter @sep/api codegen`.
+ * Do not edit by hand — regenerate from the source OpenAPI spec.
+ */
+export interface paths {
+  '/api/admin/apps/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Apps
+     * @description List every configured app with its current enabled state.
+     *
+     *     Returns one entry per registered app, in declaration order (each parent is
+     *     immediately followed by its child apps). Apps with no row default to
+     *     ``ENABLED`` (``enabled=True``, ``toggleable=True``); protected apps
+     *     (``inventory``) are forced to ``ENABLED`` and reported with
+     *     ``toggleable=False``. A child app (``parent_key`` set) is not independently
+     *     toggleable either (``toggleable=False``) and derives its lifecycle from the
+     *     parent via :attr:`~app.sep.apps.framework.base.BaseApp.state_key`. The list is
+     *     non-paginated: app cardinality is bounded (<20).
+     *
+     *     :param session: The database session.
+     *     :return: The per-app info list.
+     */
+    get: operations['admin_list_apps_api_admin_apps__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/admin/apps/{app_key}/force-disable': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Force Disable App
+     * @description Force a draining app straight to ``DISABLED``, terminating its tasks.
+     *
+     *     The emergency escape hatch when a cooperative drain stalls: it terminates
+     *     each of the app's in-flight tasks with ``revoke(..., terminate=True)``
+     *     (SIGTERM), deletes their :class:`app.sep.models.AppRunningTask` rows, and
+     *     transitions the app to ``DISABLED``. Requires the app to already be
+     *     ``DISABLING`` (else 409); the default toggle path (``PUT .../state``) never
+     *     issues a terminating revoke. No periodic re-gating is needed — the owned
+     *     schedules were already gated off at the ``DISABLING`` write.
+     *
+     *     :param app_key: The app to force-disable.
+     *     :param session: The SEP database session.
+     *     :return: The resulting ``DISABLED`` app-state response.
+     *     :raises HTTPConflictException: When the app is not currently ``DISABLING``.
+     */
+    post: operations['admin_force_disable_app_api_admin_apps__app_key__force_disable_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/admin/apps/{app_key}/state': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    /**
+     * Update App State
+     * @description Transition an app to a new lifecycle state.
+     *
+     *     Validates the requested edge against the allowed transitions
+     *     (``ENABLED`` -> ``DISABLING``, ``DISABLED`` -> ``ENABLING``,
+     *     ``DISABLING`` -> ``DISABLED``, ``ENABLING`` -> ``ENABLED``); an illegal edge
+     *     returns 409. Returns 409 for protected apps (``inventory``) and 404 if the
+     *     key does not match any configured plugin. A configured app with no row yet is
+     *     treated as ``ENABLED`` for the gate and gets its row created with the
+     *     requested state. Returns the updated row as an :class:`AppStateResponse`
+     *     (the return annotation drives FastAPI's response schema).
+     *
+     *     After the ``AppState`` write commits, the app's owned periodic schedules are
+     *     re-gated via :func:`app.sep.periodic_tasks.apply_effective_enabled` so a
+     *     non-``ENABLED`` app also stops its Celery beat tasks (and a return to
+     *     ``ENABLED`` resumes them, subject to each schedule's ``user_enabled``
+     *     override).
+     *
+     *     A ``DISABLING`` transition on an app with no in-flight tasks drains
+     *     immediately: :func:`app.sep.app_drain.finalize_drain_if_complete` flips it
+     *     straight to ``DISABLED`` (no ``task_postrun`` event will ever fire for an idle
+     *     app), and the response reflects that resulting ``DISABLED`` state.
+     *
+     *     An ``ENABLING`` transition completes synchronously: there is no warm-up to
+     *     wait for and nothing else ever advances ``ENABLING``, so it is flipped
+     *     straight to ``ENABLED`` (before re-gating, so the app's schedules resume in
+     *     the same request) and the response reflects that resulting ``ENABLED`` state.
+     *
+     *     :param app_key: The app key to transition.
+     *     :type app_key: str
+     *     :param body: The requested target lifecycle state.
+     *     :type body: AppStateWrite
+     *     :param session: The SEP database session.
+     *     :type session: SessionDep
+     *     :param celery_beat_session: The celery-beat database session.
+     *     :return: The updated app-state response payload.
+     *     :rtype: AppStateResponse
+     *     :raises HTTPConflictException: When the requested transition edge is illegal.
+     */
+    put: operations['admin_update_app_state_api_admin_apps__app_key__state_put'];
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Apps For Navigation
+     * @description Return per-app state for the current user's navigation.
+     *
+     *     Protected apps are always reported ``enabled=True``. Every other app reflects
+     *     its *effective* state via :meth:`AppRegistry.resolve_effective_enabled`: its
+     *     own row must be ``ENABLED`` (a missing row -> ``enabled=True``: a configured
+     *     plugin is active until explicitly disabled) **and** every app it declares in
+     *     ``requires_apps`` must be effectively enabled, so the shell hides an app when
+     *     a dependency is off. A child app owns no row, so it resolves through its
+     *     parent via :attr:`~app.sep.apps.framework.base.BaseApp.state_key`.
+     *
+     *     :param session: The database session.
+     *     :return: The per-app navigation list.
+     */
+    get: operations['apps_list_apps_for_navigation_api_apps__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/alert_troubleshooting/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Alert Troubleshooting Api List
+     * @description Return alerts grouped by service type.
+     *
+     *     :param session: The database session.
+     *     :type session: SessionDep
+     *     :return: A list of alert groups, each containing alerts for a service type.
+     *     :rtype: list[AlertGroup]
+     */
+    get: operations['alert_troubleshooting_alert_troubleshooting_api_list_api_apps_alert_troubleshooting__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/alert_troubleshooting/schema': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Schema
+     * @description Return the plugin schema captured at registration time.
+     *
+     *     :return: The plugin schema instance.
+     */
+    get: operations['alert_troubleshooting_get_schema_api_apps_alert_troubleshooting_schema_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/alert_troubleshooting/{service_type}/{alert_name}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Alert Troubleshooting Api Detail
+     * @description Return alert info and associated snippets for a specific alert.
+     *
+     *     :param service_type: The service type of the alert.
+     *     :type service_type: AlertServiceType
+     *     :param alert_name: The alert name identifier.
+     *     :type alert_name: str
+     *     :param session: The database session.
+     *     :type session: SessionDep
+     *     :return: Alert info and associated snippets.
+     *     :rtype: AlertDetailResponse
+     *     :raises HTTPNotFoundException: If no snippets match the alert.
+     */
+    get: operations['alert_troubleshooting_alert_troubleshooting_api_detail_api_apps_alert_troubleshooting__service_type___alert_name__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/alerts/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Alerts Api Index
+     * @description Return everything the React list page needs in a single call.
+     *
+     *     Mirror the data assembled for the deprecated Jinja index view
+     *     (:func:`app.sep.apps.alerts.deps.get_alerts_index_context`) as JSON:
+     *     alert templates grouped by service type, PMM connectivity, the PagerDuty
+     *     contact-point status, and the most recent backups.
+     *
+     *     ``present_names`` is ``None`` when PMM is unconfigured or unreachable, which
+     *     is the same signal used to drive ``pmm_connected`` and per-template
+     *     ``in_pmm`` flags so the UI degrades gracefully.
+     *
+     *     :param alert_templates: Local alert templates grouped by service type.
+     *     :type alert_templates: AlertTemplatesDep
+     *     :param present_names: Template names already present in PMM, or ``None`` when
+     *         PMM is unreachable.
+     *     :type present_names: set[str] | None
+     *     :param recent_backups: The most recent alert backups, newest first.
+     *     :type recent_backups: list[AlertBackup]
+     *     :param pagerduty_status: PagerDuty contact-point status, or ``None`` when PMM
+     *         is unreachable.
+     *     :type pagerduty_status: dict[str, Any] | None
+     *     :return: The aggregated index payload.
+     *     :rtype: IndexResponse
+     */
+    get: operations['alerts_alerts_api_index_api_apps_alerts__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/alerts/backups': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Alerts Api List Backups
+     * @description Return a paginated page of alert backups, newest first.
+     *
+     *     :param session: The async database session.
+     *     :type session: SessionDep
+     *     :param pagination: Validated offset/limit query parameters (``limit`` capped at 100).
+     *     :type pagination: Pagination
+     *     :return: A paginated envelope of backup summaries ordered by
+     *         ``created_at`` descending.
+     *     :rtype: PaginatedResponse[BackupSummary]
+     */
+    get: operations['alerts_alerts_api_list_backups_api_apps_alerts_backups_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/alerts/backups/{backup_id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Alerts Api Get Backup
+     * @description Return a categorised view of a single backup.
+     *
+     *     :param session: The async database session.
+     *     :type session: SessionDep
+     *     :param backup_id: Primary key of the backup row.
+     *     :type backup_id: int
+     *     :return: The full backup detail.
+     *     :rtype: BackupDetail
+     *     :raises HTTPNotFoundException: If the backup is not found.
+     */
+    get: operations['alerts_alerts_api_get_backup_api_apps_alerts_backups__backup_id__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/alerts/pagerduty': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Alerts Api Pagerduty Save
+     * @description Create or update the PagerDuty contact point and notification route.
+     *
+     *     Mirror :func:`app.sep.apps.alerts.routes.pagerduty_save` over JSON.
+     *
+     *     :param payload: PagerDuty save request body.
+     *     :type payload: PagerDutyRequest
+     *     :param pmm_api: The PMM API client. Raises 503 if PMM is not configured.
+     *     :type pmm_api: PMMRemoteAPI
+     *     :return: ``status="created"`` or ``status="updated"``.
+     *     :rtype: PagerDutyResponse
+     *     :raises HTTPBadGatewayException: If the PMM upstream call fails.
+     */
+    post: operations['alerts_alerts_api_pagerduty_save_api_apps_alerts_pagerduty_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/alerts/pagerduty/delete': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Alerts Api Pagerduty Delete
+     * @description Delete the PagerDuty contact point and remove its notification route.
+     *
+     *     :param pmm_api: The PMM API client. Raises 503 if PMM is not configured.
+     *     :type pmm_api: PMMRemoteAPI
+     *     :return: ``status="deleted"``.
+     *     :rtype: PagerDutyResponse
+     *     :raises HTTPNotFoundException: If no PagerDuty contact point exists.
+     *     :raises HTTPBadGatewayException: If the PMM upstream call fails.
+     */
+    post: operations['alerts_alerts_api_pagerduty_delete_api_apps_alerts_pagerduty_delete_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/alerts/push': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Alerts Api Push
+     * @description Push selected alert templates to PMM as rules.
+     *
+     *     Mirror :func:`app.sep.apps.alerts.routes.alerts_push` over JSON.
+     *     Preserve the conflict-retry path: on ``create_rule`` collision call
+     *     :func:`app.sep.apps.alerts.restore.delete_conflicting_rules` and
+     *     retry once.
+     *
+     *     :param payload: Push request body listing template names to push.
+     *     :type payload: PushRequest
+     *     :param pmm_api: The PMM API client. Raises 503 if PMM is not configured.
+     *     :type pmm_api: PMMRemoteAPI
+     *     :param alert_templates: Local alert templates grouped by service type.
+     *     :type alert_templates: AlertTemplatesDep
+     *     :param folder: The PMM alert folder. Raises 502 if unreachable.
+     *     :type folder: Folder
+     *     :param present_names: Template names already present in PMM, or ``None`` if
+     *         PMM is unreachable for the listing call.
+     *     :type present_names: set[str] | None
+     *     :return: A ``PushResponse`` with one :class:`PushItemResult` per template.
+     *     :rtype: PushResponse
+     */
+    post: operations['alerts_alerts_api_push_api_apps_alerts_push_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/alerts/restore': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Alerts Api Restore
+     * @description Restore alert configuration from a backup snapshot.
+     *
+     *     :param payload: Restore request body identifying the backup to apply.
+     *     :type payload: RestoreRequest
+     *     :param pmm_api: The PMM API client. Raises 503 if PMM is not configured.
+     *     :type pmm_api: PMMRemoteAPI
+     *     :param session: The async database session.
+     *     :type session: SessionDep
+     *     :return: A ``RestoreResponse`` with the per-section restore counts.
+     *     :rtype: RestoreResponse
+     *     :raises HTTPNotFoundException: If the backup is not found.
+     *     :raises HTTPBadGatewayException: If the PMM upstream call fails with
+     *         ``OSError``.
+     */
+    post: operations['alerts_alerts_api_restore_api_apps_alerts_restore_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/alters/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** List */
+    get: operations['alters__list_paginated_api_apps_alters__get'];
+    put?: never;
+    /**
+     * Alters Api Create
+     * @description Create an alters task group from a JSON payload request body.
+     */
+    post: operations['alters_alters_api_create_api_apps_alters__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/alters/schema': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Schema
+     * @description Return the plugin schema captured at registration time.
+     *
+     *     :return: The plugin schema instance.
+     */
+    get: operations['alters_get_schema_api_apps_alters_schema_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/alters/{task_name}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Alters Api Detail
+     * @description Retrieve a single parent alters task.
+     */
+    get: operations['alters_alters_api_detail_api_apps_alters__task_name__get'];
+    /**
+     * Alters Api Update
+     * @description Update an alters task group from a JSON payload request body.
+     *
+     *     :param check_connectivity: Whether to verify the target database is
+     *         reachable after the update. Defaults to ``True``; pass
+     *         ``check_connectivity=false`` to opt out. Note that the form flow
+     *         defaults to ``False`` (HTML checkbox semantics); this asymmetry is
+     *         intentional.
+     *     :type check_connectivity: bool
+     */
+    put: operations['alters_alters_api_update_api_apps_alters__task_name__put'];
+    post?: never;
+    /**
+     * Alters Api Delete
+     * @description Delete an alters task group.
+     */
+    delete: operations['alters_alters_api_delete_api_apps_alters__task_name__delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/alters/{task_name}/execute': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Alters Api Execute
+     * @description Execute an alters task (parent, dry-run, or pre-checks).
+     */
+    post: operations['alters_alters_api_execute_api_apps_alters__task_name__execute_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/archives/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** List */
+    get: operations['archives__list_paginated_api_apps_archives__get'];
+    put?: never;
+    /** Create */
+    post: operations['archives__create_api_apps_archives__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/archives/schema': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Schema
+     * @description Return the plugin schema captured at registration time.
+     *
+     *     :return: The plugin schema instance.
+     */
+    get: operations['archives_get_schema_api_apps_archives_schema_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/archives/{task_name}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** Detail */
+    get: operations['archives__detail_api_apps_archives__task_name__get'];
+    /** Update */
+    put: operations['archives__update_api_apps_archives__task_name__put'];
+    post?: never;
+    /** Delete */
+    delete: operations['archives__delete_api_apps_archives__task_name__delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/archives/{task_name}/execute': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Archives Api Execute
+     * @description Resolve, dispatch, and wrap a standard task execution.
+     */
+    post: operations['archives_archives_api_execute_api_apps_archives__task_name__execute_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/atw/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Atw Api List
+     * @description List ATW-tagged snippets grouped by category.
+     *
+     *     Categories with no matching snippets are omitted to keep the payload small;
+     *     the ATW enum still defines the full taxonomy for validation (plugin schema).
+     *
+     *     :param session: The database session.
+     *     :return: One listing row per category that has at least one snippet.
+     */
+    get: operations['atw_atw_api_list_api_apps_atw__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/atw/config/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Atw Config
+     * @description Report whether the incident send action is available.
+     *
+     *     Not gated by the send guard -- this endpoint is what reports that guard, so
+     *     it must answer whether or not a receiver is configured.
+     *
+     *     :return: The reasons the send action is withheld; empty when it is offered.
+     */
+    get: operations['atw_atw_config_api_apps_atw_config__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/atw/execution-schema/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Atw Execution Schema
+     * @description Build one execution form covering several snippets, merging common parameters.
+     *
+     *     Unknown or unsafe filenames fail the whole request — a form the caller cannot
+     *     fill for every selected snippet is not a partial success.
+     *
+     *     :param snippet_filename: The selected snippet filenames, repeated per snippet
+     *         and deduplicated order-preserving.
+     *     :return: The shared section followed by each snippet's remaining fields.
+     *     :raises HTTPBadRequestException: When a filename is unsafe or malformed, failing
+     *         the whole request before any item is dispatched.
+     *     :raises HTTPNotFoundException: When a filename matches no snippet.
+     */
+    get: operations['atw_atw_execution_schema_api_apps_atw_execution_schema__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/atw/incidents/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Atw List Incidents
+     * @description List diagnostic incidents, newest first.
+     *
+     *     :param session: The database session.
+     *     :param pagination: The offset/limit window for the page.
+     *     :return: A paginated page of incidents, newest first.
+     */
+    get: operations['atw_atw_list_incidents_api_apps_atw_incidents__get'];
+    put?: never;
+    /**
+     * Atw Create Incident
+     * @description Create a diagnostic incident owned by the current user.
+     *
+     *     :param session: The database session.
+     *     :param current_user: The authenticated user, stamped as ``created_by``.
+     *     :param body: The incident create payload.
+     *     :return: The created incident.
+     */
+    post: operations['atw_atw_create_incident_api_apps_atw_incidents__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/atw/incidents/{incident_id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Atw Get Incident
+     * @description Retrieve a single diagnostic incident by id.
+     *
+     *     :param incident: The incident resolved from the ``incident_id`` path parameter.
+     *     :return: The matching incident.
+     */
+    get: operations['atw_atw_get_incident_api_apps_atw_incidents__incident_id__get'];
+    put?: never;
+    post?: never;
+    /**
+     * Atw Delete Incident
+     * @description Delete a diagnostic incident and cascade its execution rows.
+     *
+     *     :param session: The database session.
+     *     :param incident: The incident resolved from the ``incident_id`` path parameter.
+     */
+    delete: operations['atw_atw_delete_incident_api_apps_atw_incidents__incident_id__delete'];
+    options?: never;
+    head?: never;
+    /**
+     * Atw Update Incident
+     * @description Update a diagnostic incident's name or support-case reference.
+     *
+     *     :param session: The database session.
+     *     :param incident: The incident resolved from the ``incident_id`` path parameter.
+     *     :param body: The partial update payload; unset fields are untouched.
+     *     :return: The updated incident.
+     */
+    patch: operations['atw_atw_update_incident_api_apps_atw_incidents__incident_id__patch'];
+    trace?: never;
+  };
+  '/api/apps/atw/incidents/{incident_id}/executions/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Atw List Incident Executions
+     * @description List one incident's snippet executions, newest first, with live task status.
+     *
+     *     Each row also reports the command line its snippet ran with, credential values
+     *     masked. A row whose snippet or upstream payload cannot supply what masking
+     *     needs reports its arguments as withheld; the page still returns.
+     *
+     *     :param session: The database session.
+     *     :param incident: The incident resolved from the ``incident_id`` path parameter.
+     *     :param pagination: The offset/limit window for the page.
+     *     :param tasks_api: The authenticated Tasks API client.
+     *     :return: A paginated page of executions hydrated from the Tasks API, each with
+     *         its masked arguments or the reason they are absent.
+     */
+    get: operations['atw_atw_list_incident_executions_api_apps_atw_incidents__incident_id__executions__get'];
+    put?: never;
+    /**
+     * Atw Batch Execute
+     * @description Execute several snippets against one incident, reporting each item separately.
+     *
+     *     A malformed selection fails the whole request up front: ``resolve_snippets``
+     *     runs the traversal guard over every filename before dispatch, so an unsafe
+     *     filename raises before any item runs. Past that guard, one failing item never
+     *     blocks the rest: each is dispatched and recorded inside its own guard, and the
+     *     response always carries an entry per requested item — an unresolved filename
+     *     becomes that item's error. A failed attempt produces no task-history row to
+     *     reference, so it is reported here rather than persisted.
+     *
+     *     The row-write guard rolls the shared session back before the loop continues,
+     *     or one failed write would leave the transaction aborted and doom every later
+     *     item on PostgreSQL; the dispatch guard rolls back defensively, having written
+     *     nothing itself. ``incident.id`` is read once up front because both a commit and
+     *     a rollback expire the instance, and re-reading it would trigger a lazy load.
+     *
+     *     :param session: The database session.
+     *     :param incident: The incident resolved from the ``incident_id`` path parameter.
+     *     :param body: The batch payload.
+     *     :param tasks_api: The authenticated Tasks API client.
+     *     :return: One outcome entry per requested item, in request order.
+     *     :raises HTTPBadRequestException: When any filename is unsafe or malformed,
+     *         failing the whole request before any item is dispatched.
+     */
+    post: operations['atw_atw_batch_execute_api_apps_atw_incidents__incident_id__executions__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/atw/incidents/{incident_id}/send-jobs/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Atw List Send Jobs
+     * @description List one incident's diagnostics send attempts, newest first.
+     *
+     *     :param session: The database session.
+     *     :param incident: The incident resolved from the ``incident_id`` path parameter.
+     *     :param pagination: The offset/limit window for the page.
+     *     :return: A paginated page of send attempts, newest first.
+     */
+    get: operations['atw_atw_list_send_jobs_api_apps_atw_incidents__incident_id__send_jobs__get'];
+    put?: never;
+    /**
+     * Atw Start Send Job
+     * @description Start delivering the selected executions' output files and logs to the support case.
+     *
+     *     The row is created before the task is queued so a broker failure is still
+     *     recorded as a failed attempt rather than vanishing: the row is the only place
+     *     a support engineer can see that a send was ever tried.
+     *
+     *     :param session: The database session.
+     *     :param incident: The incident resolved from the ``incident_id`` path parameter.
+     *     :param current_user: The authenticated user, stamped as ``requested_by``.
+     *     :param body: The send payload naming the case reference and executions.
+     *     :return: The created send log, pending.
+     *     :raises HTTPUnprocessableEntityException: When an execution id does not belong
+     *         to this incident.
+     *     :raises HTTPServiceUnavailableException: When the send could not be queued.
+     *     :raises HTTPBadRequestException: Propagated from the manager when the row
+     *         cannot be written.
+     */
+    post: operations['atw_atw_start_send_job_api_apps_atw_incidents__incident_id__send_jobs__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/atw/incidents/{incident_id}/send-jobs/{send_job_id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Atw Get Send Job
+     * @description Retrieve one diagnostics send attempt, for the dialog to poll.
+     *
+     *     :param session: The database session.
+     *     :param incident: The incident resolved from the ``incident_id`` path parameter.
+     *     :param send_job_id: The send attempt's UUID.
+     *     :return: The matching send attempt.
+     *     :raises HTTPNotFoundException: If this incident has no such attempt.
+     */
+    get: operations['atw_atw_get_send_job_api_apps_atw_incidents__incident_id__send_jobs__send_job_id__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/atw/schema': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Schema
+     * @description Return the plugin schema captured at registration time.
+     *
+     *     :return: The plugin schema instance.
+     */
+    get: operations['atw_get_schema_api_apps_atw_schema_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/backup_mongo/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** List */
+    get: operations['backup_mongo__list_paginated_api_apps_backup_mongo__get'];
+    put?: never;
+    /**
+     * Backup Mongo Api Create
+     * @description Create a backup task group from a JSON payload request body.
+     */
+    post: operations['backup_mongo_backup_mongo_api_create_api_apps_backup_mongo__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/backup_mongo/restore/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Restore Mongo Api List
+     * @description List parent PBM restore config tasks.
+     */
+    get: operations['backup_mongo_restore_restore_mongo_api_list_api_apps_backup_mongo_restore__get'];
+    put?: never;
+    /**
+     * Restore Mongo Api Create
+     * @description Create a restore task group from a JSON payload request body.
+     */
+    post: operations['backup_mongo_restore_restore_mongo_api_create_api_apps_backup_mongo_restore__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/backup_mongo/restore/schema': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Schema
+     * @description Return the plugin schema captured at registration time.
+     *
+     *     :return: The plugin schema instance.
+     */
+    get: operations['backup_mongo_restore_get_schema_api_apps_backup_mongo_restore_schema_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/backup_mongo/restore/{task_name}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Restore Mongo Api Detail
+     * @description Retrieve a single parent restore task with child task status.
+     */
+    get: operations['backup_mongo_restore_restore_mongo_api_detail_api_apps_backup_mongo_restore__task_name__get'];
+    /**
+     * Restore Mongo Api Update
+     * @description Update a restore task from a JSON payload request body.
+     *
+     *     PUTs the parent config payload to the config task name and refreshes each
+     *     child leg (restore, pbm-list, optional force-resync) in place. The
+     *     ``EditableRestoreParent`` dependency resolves a satellite URL to the parent
+     *     and blocks protected or in-flight groups before any write.
+     */
+    put: operations['backup_mongo_restore_restore_mongo_api_update_api_apps_backup_mongo_restore__task_name__put'];
+    post?: never;
+    /**
+     * Restore Mongo Api Delete
+     * @description Delete a restore task group.
+     */
+    delete: operations['backup_mongo_restore_restore_mongo_api_delete_api_apps_backup_mongo_restore__task_name__delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/backup_mongo/restore/{task_name}/execute': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Backup Mongo Restores Api Execute
+     * @description Resolve, dispatch, and wrap a standard task execution.
+     */
+    post: operations['backup_mongo_restore_backup_mongo_restores_api_execute_api_apps_backup_mongo_restore__task_name__execute_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/backup_mongo/schema': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Schema
+     * @description Return the plugin schema captured at registration time.
+     *
+     *     :return: The plugin schema instance.
+     */
+    get: operations['backup_mongo_get_schema_api_apps_backup_mongo_schema_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/backup_mongo/{task_name}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Backup Mongo Api Detail
+     * @description Retrieve a single parent backup task with derived sibling status.
+     */
+    get: operations['backup_mongo_backup_mongo_api_detail_api_apps_backup_mongo__task_name__get'];
+    /**
+     * Backup Mongo Api Update
+     * @description Update a backup task group from a JSON payload request body.
+     *
+     *     Cascade-updates the parent ``pbm_config`` task and its derived logical,
+     *     physical, status, and incremental siblings, re-stamping ``_form`` so the edit page keeps
+     *     prefilling. The ``EditableBackupParent`` dependency resolves a satellite URL
+     *     to the parent and blocks protected or in-flight groups before any write.
+     *     Rejects a parent rename with a conflict and surfaces a partial cascade
+     *     failure as an HTTP 500 naming the failed legs.
+     */
+    put: operations['backup_mongo_backup_mongo_api_update_api_apps_backup_mongo__task_name__put'];
+    post?: never;
+    /**
+     * Backup Mongo Api Delete
+     * @description Delete a backup task group.
+     */
+    delete: operations['backup_mongo_backup_mongo_api_delete_api_apps_backup_mongo__task_name__delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/backup_mongo/{task_name}/execute': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Backup Mongo Api Execute
+     * @description Execute a backup task.
+     */
+    post: operations['backup_mongo_backup_mongo_api_execute_api_apps_backup_mongo__task_name__execute_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/backup_pg/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** List */
+    get: operations['backup_pg__list_paginated_api_apps_backup_pg__get'];
+    put?: never;
+    /** Create */
+    post: operations['backup_pg__create_api_apps_backup_pg__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/backup_pg/schema': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Schema
+     * @description Return the plugin schema captured at registration time.
+     *
+     *     :return: The plugin schema instance.
+     */
+    get: operations['backup_pg_get_schema_api_apps_backup_pg_schema_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/backup_pg/{task_name}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** Detail */
+    get: operations['backup_pg__detail_api_apps_backup_pg__task_name__get'];
+    /** Update */
+    put: operations['backup_pg__update_api_apps_backup_pg__task_name__put'];
+    post?: never;
+    /** Delete */
+    delete: operations['backup_pg__delete_api_apps_backup_pg__task_name__delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/backup_pg/{task_name}/execute': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Backup Pg Api Execute
+     * @description Resolve, dispatch, and wrap a standard task execution.
+     */
+    post: operations['backup_pg_backup_pg_api_execute_api_apps_backup_pg__task_name__execute_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/checksums/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** List */
+    get: operations['checksums__list_paginated_api_apps_checksums__get'];
+    put?: never;
+    /** Create */
+    post: operations['checksums__create_api_apps_checksums__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/checksums/schema': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Schema
+     * @description Return the plugin schema captured at registration time.
+     *
+     *     :return: The plugin schema instance.
+     */
+    get: operations['checksums_get_schema_api_apps_checksums_schema_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/checksums/{task_name}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** Detail */
+    get: operations['checksums__detail_api_apps_checksums__task_name__get'];
+    /** Update */
+    put: operations['checksums__update_api_apps_checksums__task_name__put'];
+    post?: never;
+    /** Delete */
+    delete: operations['checksums__delete_api_apps_checksums__task_name__delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/checksums/{task_name}/execute': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Checksums Api Execute
+     * @description Resolve, dispatch, and wrap a standard task execution.
+     */
+    post: operations['checksums_checksums_api_execute_api_apps_checksums__task_name__execute_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/dipper/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Dipper Api List
+     * @description Return Dipper execution history rows.
+     *
+     *     :param tasks_api: Async client for the tasks sub-app.
+     *     :param pagination: Validated offset/limit forwarded to the upstream history call.
+     *     :return: A paginated envelope of task-history rows filtered to Dipper runs. Because
+     *         the ``dipper/`` filter runs client-side, ``total`` is the filtered count of the
+     *         current page, not a global count across all pages.
+     */
+    get: operations['dipper_dipper_api_list_api_apps_dipper__get'];
+    put?: never;
+    /**
+     * Dipper Api Execute
+     * @description Execute a Dipper collector script against a database service.
+     *
+     *     Delegates all script resolution, PMM defaults merging, argument
+     *     validation, and metadata assembly to ``build_dipper_execution_meta``.
+     *
+     *     :param request: The HTTP request (used to derive the artifact download URL).
+     *     :type request: Request
+     *     :param body: Validated JSON request body.
+     *     :type body: DipperExecuteWrite
+     *     :param inventory_api: Async client for the inventory sub-app.
+     *     :type inventory_api: RemoteAPI
+     *     :param tasks_api: Async client for the tasks sub-app.
+     *     :type tasks_api: RemoteAPI
+     *     :return: Execution response with the created task identifier.
+     *     :rtype: DipperExecutionResponse
+     *     :raises HTTPNotFoundException: When the service does not exist.
+     *     :raises HTTPUnprocessableEntityException: When the script/args are invalid.
+     */
+    post: operations['dipper_dipper_api_execute_api_apps_dipper__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/dipper/form-schema': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Dipper Api Form Schema
+     * @description Return the selected Dipper payload's dynamic execution schema.
+     *
+     *     :param service_id: Inventory ID of the database service.
+     *     :type service_id: int
+     *     :param collector_type: Which collector variant to render.
+     *     :type collector_type: CollectorTypeEnum
+     *     :param inventory_api: Async client for the inventory sub-app.
+     *     :type inventory_api: RemoteAPI
+     *     :param executor_hosts: Available executor hosts keyed by hostname.
+     *     :type executor_hosts: dict
+     *     :param pmm_api: The configured PMM API client, or ``None`` when PMM is not
+     *         configured (injected via ``PMMAPIDep``).
+     *     :type pmm_api: PMMRemoteAPI | None
+     *     :return: Context-specific schema including payload parameters.
+     */
+    get: operations['dipper_dipper_api_form_schema_api_apps_dipper_form_schema_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/dipper/schema': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Schema
+     * @description Return the plugin schema captured at registration time.
+     *
+     *     :return: The plugin schema instance.
+     */
+    get: operations['dipper_get_schema_api_apps_dipper_schema_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/dipper/script-preview': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Dipper Api Script Preview
+     * @description Return a preview of the collector script for the given service.
+     *
+     *     :param service_id: Inventory ID of the database service.
+     *     :type service_id: int
+     *     :param collector_type: Which collector variant to preview.
+     *     :type collector_type: CollectorTypeEnum
+     *     :param inventory_api: Async client for the inventory sub-app.
+     *     :type inventory_api: RemoteAPI
+     *     :return: Preview content alongside language and truncation metadata.
+     *     :rtype: ScriptPreviewResponse
+     *     :raises HTTPNotFoundException: When the service does not exist.
+     *     :raises HTTPUnprocessableEntityException: When no script is available for
+     *         the service/collector combination, or when the script contains
+     *         non-UTF-8 bytes.
+     */
+    get: operations['dipper_dipper_api_script_preview_api_apps_dipper_script_preview_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/inventory/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Inventory Plugin Tasks
+     * @description Return the list of periodic task names for the Inventory plugin.
+     *
+     *     Hard-coded because the Inventory plugin has exactly one periodic task
+     *     (``inventory-sync``). The shape matches what the React
+     *     ``usePluginTasks('inventory')`` hook expects: a list of objects with at
+     *     minimum a ``name`` key.
+     */
+    get: operations['inventory_inventory_plugin_tasks_api_apps_inventory__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/inventory/available-syncers/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Inventory Available Syncers
+     * @description Return syncers capable of syncing inventory.
+     *
+     *     :param available_syncers: Filtered syncer list from ``InventoryAvailableSyncersDep``.
+     *     :type available_syncers: list[AvailableSyncer]
+     *     :return: Filtered list of syncers that can sync inventory.
+     *     :rtype: list[AvailableSyncer]
+     */
+    get: operations['inventory_inventory_available_syncers_api_apps_inventory_available_syncers__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/inventory/nodes/{node_id}/system-observation': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Inventory Node System Observation
+     * @description Proxy the host-level system observation for a node (read-only).
+     *
+     *     Forwards to the inventory sub-app's ``/nodes/{node_id}/system-observation``
+     *     endpoint via ``InventoryAPI``. This three-segment literal path cannot
+     *     collide with the two-segment ``/{entity}/{item_id:int}`` detail matcher. An
+     *     upstream HTTP 404 — the "not collected yet" signal — propagates unchanged
+     *     for the React panel to render as an empty state.
+     *
+     *     :param node_id: Primary key of the node.
+     *     :param inventory_api: Authenticated inventory ``RemoteAPI`` client.
+     *     :return: The host-level system observation payload.
+     */
+    get: operations['inventory_inventory_node_system_observation_api_apps_inventory_nodes__node_id__system_observation_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/inventory/schema': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Schema
+     * @description Return the plugin schema captured at registration time.
+     *
+     *     :return: The plugin schema instance.
+     */
+    get: operations['inventory_get_schema_api_apps_inventory_schema_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/inventory/services/{service_id}/check-connectivity/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Inventory Service Check Connectivity
+     * @description Run a database connectivity probe for a service from its executor host.
+     *
+     *     Backs the React connectivity control on the service detail page. A probe
+     *     that ran but could not connect is reported as HTTP 200 with
+     *     ``success=false`` and the upstream message in ``error``; only a probe that
+     *     could not be attempted at all is an error status. This three-segment
+     *     literal path cannot collide with the two-segment
+     *     ``/{entity}/{item_id:int}`` detail matcher.
+     *
+     *     :param service: The service to probe, resolved from the path id.
+     *     :param tasks_api: Authenticated Tasks ``RemoteAPI`` client.
+     *     :return: The upstream probe result.
+     *     :raises HTTPBadRequestException: When the service cannot be probed —
+     *         unsupported type, missing node or port, or no executor registered for
+     *         the node address.
+     *     :raises HTTPBadGatewayException: When the Tasks API is unreachable or
+     *         returns an unparseable body.
+     */
+    post: operations['inventory_inventory_service_check_connectivity_api_apps_inventory_services__service_id__check_connectivity__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/inventory/services/{service_id}/system-observation': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Inventory Service System Observation
+     * @description Proxy the service-level system observation for a service (read-only).
+     *
+     *     Forwards to the inventory sub-app's
+     *     ``/services/{service_id}/system-observation`` endpoint via ``InventoryAPI``.
+     *     An upstream HTTP 404 propagates unchanged so the React panel renders its
+     *     "not collected yet" empty state.
+     *
+     *     :param service_id: Primary key of the service.
+     *     :param inventory_api: Authenticated inventory ``RemoteAPI`` client.
+     *     :return: The service-level system observation payload.
+     */
+    get: operations['inventory_inventory_service_system_observation_api_apps_inventory_services__service_id__system_observation_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/inventory/sync/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Inventory Sync Trigger
+     * @description Schedule an ad-hoc inventory sync as a background task.
+     *
+     *     Mirrors the Jinja2 ``POST /inventory/sync/`` handler but accepts an
+     *     optional JSON body ``{"syncer": "<qualified_name>"}``. When ``syncer``
+     *     is absent, ``None``, or empty, every configured syncer runs in
+     *     declaration order; otherwise only the named syncer is forwarded. An
+     *     unknown or inapplicable syncer raises HTTP 400 — never a silent no-op.
+     *
+     *     Authentication is enforced by the parent ``api_router``'s
+     *     ``IsApiAuthenticated`` dependency, so this handler needs no auth parameter.
+     *
+     *     :param syncers: Configured syncers from ``SyncersDep``.
+     *     :type syncers: SyncersDep
+     *     :param background_tasks: FastAPI's background task scheduler.
+     *     :type background_tasks: BackgroundTasks
+     *     :param internal_token: SEP-internal service token injected by
+     *         ``InternalTokenDep`` and forwarded to the background sync task.
+     *     :param body: Optional trigger body.
+     *     :type body: InventorySyncTriggerWrite | None
+     *     :return: Empty 202 Accepted response.
+     *     :rtype: Response
+     *     :raises HTTPBadRequestException: When ``body.syncer`` is set but does
+     *         not match any configured syncer that can sync inventory.
+     */
+    post: operations['inventory_inventory_sync_trigger_api_apps_inventory_sync__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/inventory/sync/status/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Inventory Sync Status
+     * @description Return whether an inventory-wide sync is currently running.
+     *
+     *     Replaces the server-rendered ``sync_is_running`` template variable
+     *     used by the Jinja2 inventory page so the React control can poll the
+     *     same state without scraping HTML.
+     *
+     *     :param session: SQLModel async session.
+     *     :type session: SessionDep
+     *     :return: ``{"is_running": <bool>}``.
+     *     :rtype: InventorySyncStatusResponse
+     */
+    get: operations['inventory_inventory_sync_status_api_apps_inventory_sync_status__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/inventory/{entity}/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Inventory List Entity
+     * @description List inventory nodes, services, schemas, or tables.
+     *
+     *     :param request: Inbound request; its query string carries entity filters.
+     *     :param entity: Inventory entity type (nodes, services, schemas, tables).
+     *     :param inventory_api: Async client for the Inventory sub-app.
+     *     :param pagination: Validated offset/limit forwarded to the upstream call.
+     *     :return: A paginated envelope echoing the requested window.
+     */
+    get: operations['inventory_inventory_list_entity_api_apps_inventory__entity___get'];
+    put?: never;
+    /**
+     * Inventory Create Entity
+     * @description Create an inventory node, service, schema, or table.
+     */
+    post: operations['inventory_inventory_create_entity_api_apps_inventory__entity___post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/inventory/{entity}/{item_id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Inventory Get Entity
+     * @description Retrieve a single inventory node, service, schema, or table.
+     */
+    get: operations['inventory_inventory_get_entity_api_apps_inventory__entity___item_id__get'];
+    /**
+     * Inventory Update Entity
+     * @description Update an inventory node, service, schema, or table.
+     */
+    put: operations['inventory_inventory_update_entity_api_apps_inventory__entity___item_id__put'];
+    post?: never;
+    /**
+     * Inventory Delete Entity
+     * @description Delete an inventory node, service, schema, or table.
+     */
+    delete: operations['inventory_inventory_delete_entity_api_apps_inventory__entity___item_id__delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/mysql_backups/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** List */
+    get: operations['mysql_backups__list_paginated_api_apps_mysql_backups__get'];
+    put?: never;
+    /** Create */
+    post: operations['mysql_backups__create_api_apps_mysql_backups__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/mysql_backups/restore/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** List */
+    get: operations['mysql_backups_restore__list_paginated_api_apps_mysql_backups_restore__get'];
+    put?: never;
+    /** Create */
+    post: operations['mysql_backups_restore__create_api_apps_mysql_backups_restore__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/mysql_backups/restore/schema': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Schema
+     * @description Return the plugin schema captured at registration time.
+     *
+     *     :return: The plugin schema instance.
+     */
+    get: operations['mysql_backups_restore_get_schema_api_apps_mysql_backups_restore_schema_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/mysql_backups/restore/{task_name}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** Detail */
+    get: operations['mysql_backups_restore__detail_api_apps_mysql_backups_restore__task_name__get'];
+    /** Update */
+    put: operations['mysql_backups_restore__update_api_apps_mysql_backups_restore__task_name__put'];
+    post?: never;
+    /** Delete */
+    delete: operations['mysql_backups_restore__delete_api_apps_mysql_backups_restore__task_name__delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/mysql_backups/restore/{task_name}/execute': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Mysql Backups Restores Api Execute
+     * @description Resolve, dispatch, and wrap a standard task execution.
+     */
+    post: operations['mysql_backups_restore_mysql_backups_restores_api_execute_api_apps_mysql_backups_restore__task_name__execute_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/mysql_backups/schema': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Schema
+     * @description Return the plugin schema captured at registration time.
+     *
+     *     :return: The plugin schema instance.
+     */
+    get: operations['mysql_backups_get_schema_api_apps_mysql_backups_schema_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/mysql_backups/services/{service_id}/backups': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Service Backups
+     * @description Return a page of a MySQL service's completed backup runs, newest run first.
+     *
+     *     The ``service_id`` path parameter is resolved by
+     *     :data:`~app.sep.apps.mysql_backups.deps.ResolvedMysqlService`, which lets an
+     *     unknown service surface as a ``404``. A resolvable service with no recorded
+     *     runs yields an empty page, so a caller building a restore selector is never
+     *     blocked by an empty catalog but is still told when the service itself is
+     *     unknown.
+     *
+     *     :param service: The inventory service resolved from the ``service_id`` path
+     *         parameter.
+     *     :param session: The database session the catalog is queried on.
+     *     :param pagination: The requested offset/limit window.
+     *     :return: The requested page of the service's recorded backup runs, newest
+     *         run first.
+     */
+    get: operations['mysql_backups_list_service_backups_api_apps_mysql_backups_services__service_id__backups_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/mysql_backups/{task_name}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** Detail */
+    get: operations['mysql_backups__detail_api_apps_mysql_backups__task_name__get'];
+    /** Update */
+    put: operations['mysql_backups__update_api_apps_mysql_backups__task_name__put'];
+    post?: never;
+    /** Delete */
+    delete: operations['mysql_backups__delete_api_apps_mysql_backups__task_name__delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/mysql_backups/{task_name}/execute': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Mysql Backups Api Execute
+     * @description Resolve, dispatch, and wrap a standard task execution.
+     */
+    post: operations['mysql_backups_mysql_backups_api_execute_api_apps_mysql_backups__task_name__execute_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/report/config': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Report Config
+     * @description Return upload configuration status.
+     *
+     *     :return: JSON response with ``upload_disabled_reasons``.
+     *     :rtype: JSONResponse
+     */
+    get: operations['report_report_config_api_apps_report_config_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/report/generate/json': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Report Generate Json Api
+     * @description Generate a report and return as JSON.
+     *
+     *     :param pmm_api: PMM API client dependency.
+     *     :type pmm_api: PMMRemoteAPI
+     *     :param since: Relative start of the report period.
+     *     :type since: str
+     *     :param until: Relative end of the report period.
+     *     :type until: str
+     *     :param full: Include all check results and full backup history.
+     *     :type full: bool
+     *     :param refresh: Force advisor refresh before fetching results.
+     *     :type refresh: bool
+     *     :param sections: Optional list of sections to include.
+     *     :type sections: list[str] | None
+     *     :return: JSON response with full report data.
+     *     :rtype: JSONResponse
+     */
+    get: operations['report_report_generate_json_api_api_apps_report_generate_json_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/report/pdf-jobs': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Report Start Pdf Job Api
+     * @description Enqueue PDF rendering from a report JSON snapshot.
+     *
+     *     :param body: Request body containing the report snapshot.
+     *     :type body: ReportSnapshotWrite
+     *     :return: PDF job status response.
+     *     :rtype: ReportJobResponse
+     */
+    post: operations['report_report_start_pdf_job_api_api_apps_report_pdf_jobs_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/report/pdf-jobs/{job_id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Report Pdf Job Api
+     * @description Return PDF job status.
+     *
+     *     :param job_id: Celery task identifier.
+     *     :type job_id: str
+     *     :return: PDF job status response.
+     *     :rtype: ReportJobResponse
+     */
+    get: operations['report_report_pdf_job_api_api_apps_report_pdf_jobs__job_id__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/report/pdf-jobs/{job_id}/pdf': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Report Download Pdf Api
+     * @description Download a ready PDF result for a report job.
+     *
+     *     :param job_id: Celery task identifier.
+     *     :type job_id: str
+     *     :return: PDF file response.
+     *     :rtype: Response
+     *     :raises HTTPInternalServerErrorException: If the Celery job failed.
+     *     :raises HTTPConflictException: If the PDF result is not ready yet.
+     *     :raises HTTPGoneException: If the staged PDF artifact has expired.
+     */
+    get: operations['report_report_download_pdf_api_api_apps_report_pdf_jobs__job_id__pdf_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/report/upload-jobs': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Report Start Upload Job Api
+     * @description Enqueue ServiceNow upload from a report JSON snapshot.
+     *
+     *     :param body: Request body containing the report snapshot.
+     *     :type body: ReportSnapshotWrite
+     *     :return: Upload job status response.
+     *     :rtype: ReportJobResponse
+     *     :raises HTTPServiceUnavailableException: If ServiceNow upload is not configured.
+     */
+    post: operations['report_report_start_upload_job_api_api_apps_report_upload_jobs_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/report/upload-jobs/{job_id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Report Upload Job Api
+     * @description Return ServiceNow upload job status.
+     *
+     *     :param job_id: Celery task identifier.
+     *     :type job_id: str
+     *     :return: Upload job status response.
+     *     :rtype: ReportJobResponse
+     */
+    get: operations['report_report_upload_job_api_api_apps_report_upload_jobs__job_id__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/snippets/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List
+     * @description List scripts as a server-filtered, sorted, paginated projection.
+     */
+    get: operations['snippets_snippets_api_list_api_apps_snippets__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/snippets/approvals': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    /**
+     * Snippets Api Batch Approve
+     * @description Approve a set of snippets atomically (idempotent partial-update).
+     *
+     *     Reject the whole batch with ``400`` and a
+     *     :class:`BatchApprovalErrorResponse` payload when any filename has no
+     *     DB row or its file is missing on disk. Filenames that are already
+     *     approved when the call starts are reported in
+     *     ``skipped_already_approved`` — not as errors. The atomic write uses
+     *     ``approved_at IS NULL`` as a CAS filter so two concurrent admins
+     *     cannot double-approve.
+     *
+     *     :param existence: Pre-validated batch existence result from the dependency.
+     *     :type existence: SnippetBatchExistenceResult
+     *     :param user: The authenticated admin performing the action.
+     *     :type user: User
+     *     :param session: The active database session.
+     *     :type session: AsyncSession
+     *     :return: The success payload listing approved + skipped filenames.
+     *     :rtype: BatchApprovalResponse
+     *     :raises HTTPBadRequestException: On hard-error precheck failures with
+     *         a :class:`BatchApprovalErrorResponse` body.
+     */
+    patch: operations['snippets_snippets_api_batch_approve_api_apps_snippets_approvals_patch'];
+    trace?: never;
+  };
+  '/api/apps/snippets/capabilities': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Snippets Capabilities Provider
+     * @description Return per-deployment capability flags for the snippets plugin.
+     *
+     *     Read live from ``snippets_settings`` so a deployment-config hot reload between
+     *     two requests is reflected on the next response.
+     *
+     *     :return: Capability flags reflecting the current deployment config.
+     */
+    get: operations['snippets__snippets_capabilities_provider_api_apps_snippets_capabilities_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/snippets/refresh': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Snippets Api Refresh
+     * @description Refresh the snippets cache from disk.
+     *
+     *     Admin-only and additionally gated by manual sync being enabled.
+     *     Mirrors the legacy Jinja2 ``POST /snippets/refresh`` route.
+     *
+     *     :param user: The authenticated admin performing the refresh.
+     *     :type user: User
+     *     :param session: The SEP database session.
+     *     :return: A response carrying the UTC timestamp of the refresh.
+     *     :rtype: RefreshResponse
+     */
+    post: operations['snippets_snippets_api_refresh_api_apps_snippets_refresh_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/snippets/schema': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Schema
+     * @description Return the plugin schema captured at registration time.
+     *
+     *     :return: The plugin schema instance.
+     */
+    get: operations['snippets_get_schema_api_apps_snippets_schema_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/snippets/service_types': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Snippets Api Service Types
+     * @description List the distinct service types across the whole snippets dataset.
+     *
+     *     Backs the list page's service-type filter so its options reflect every value
+     *     in the dataset rather than only the loaded page.
+     *
+     *     :param session: The SEP database session.
+     *     :return: The sorted distinct service types and whether any snippet is
+     *         uncategorized (absent or blank service type).
+     */
+    get: operations['snippets_snippets_api_service_types_api_apps_snippets_service_types_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/snippets/snippet/approval': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    /**
+     * Snippets Api Approve
+     * @description Approve a single snippet (idempotent).
+     *
+     *     Re-approving an already-approved snippet returns ``200`` with the
+     *     current state — ``approved_at`` is *not* overwritten so the audit
+     *     trail is preserved.
+     *
+     *     :param snippet: The snippet whose approval is being set.
+     *     :type snippet: Snippet
+     *     :param user: The authenticated admin performing the action.
+     *     :type user: User
+     *     :param session: The active database session.
+     *     :type session: AsyncSession
+     *     :return: The snippet entity after the call, including approval state.
+     *     :rtype: SnippetResponse
+     */
+    put: operations['snippets_snippets_api_approve_api_apps_snippets_snippet_approval_put'];
+    post?: never;
+    /**
+     * Snippets Api Remove Approval
+     * @description Remove approval from a single snippet (idempotent).
+     *
+     *     Removing an approval that doesn't exist is a no-op ``204``. The
+     *     snippet missing → ``404`` (handled by ``SnippetDep``); approval
+     *     missing → ``204``.
+     *
+     *     :param snippet: The snippet whose approval is being cleared.
+     *     :type snippet: Snippet
+     *     :param user: The authenticated admin performing the action.
+     *     :type user: User
+     *     :param session: The active database session.
+     *     :type session: AsyncSession
+     *     :return: An empty 204 response.
+     *     :rtype: Response
+     */
+    delete: operations['snippets_snippets_api_remove_approval_api_apps_snippets_snippet_approval_delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/snippets/snippet/download': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Snippets Api Download
+     * @description Stream the raw snippet file as a download attachment.
+     *
+     *     Returns the on-disk source verbatim — full bash/Python body plus its
+     *     YAML frontmatter — so end users can save the file locally without
+     *     being capped by the preview truncation limits. The
+     *     ``SnippetDep`` dependency already validates both the DB row and the
+     *     on-disk file, so a missing snippet or missing file surfaces as 404.
+     *
+     *     :param snippet: The snippet whose raw file is requested.
+     *     :type snippet: Snippet
+     *     :return: The snippet file streamed as ``attachment; filename=...``
+     *         with a MIME type guessed from the on-disk path.
+     *     :rtype: FileResponse
+     */
+    get: operations['snippets_snippets_api_download_api_apps_snippets_snippet_download_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/snippets/snippet/execute': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Execute script
+     * @description Validate the args, assemble the meta, and dispatch the execution.
+     */
+    post: operations['snippets_snippets_api_script_execute_api_apps_snippets_snippet_execute_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/snippets/snippet/history': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Script history
+     * @description Proxy the per-script execution history from the Tasks API by filename.
+     */
+    get: operations['snippets_snippets_api_script_history_api_apps_snippets_snippet_history_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/snippets/snippet/preview': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Snippets Api Script Preview
+     * @description Return the snippet's preview content with a highlighter language hint.
+     *
+     *     :param snippet: The snippet whose preview is requested.
+     *     :type snippet: Snippet
+     *     :return: The preview content alongside metadata about it.
+     *     :rtype: ScriptPreviewResponse
+     *     :raises HTTPUnprocessableEntityException: When the snippet contains
+     *         bytes that cannot be decoded as UTF-8.
+     */
+    get: operations['snippets_snippets_api_script_preview_api_apps_snippets_snippet_preview_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/snippets/snippet/schema': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Script schema
+     * @description Return the per-script form schema synthesised from its parameters.
+     */
+    get: operations['snippets_snippets_api_script_schema_api_apps_snippets_snippet_schema_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/tasks/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Tasks Api List
+     * @description List task definitions for the read-only plugin UI.
+     *
+     *     :param tasks_api: Async client for the tasks sub-app.
+     *     :param pagination: Validated offset/limit forwarded to the upstream Tasks API.
+     *     :return: A paginated envelope of task rows for the schema-driven list view.
+     */
+    get: operations['task_manager_tasks_api_list_api_apps_tasks__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/tasks/schema': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Schema
+     * @description Return the plugin schema captured at registration time.
+     *
+     *     :return: The plugin schema instance.
+     */
+    get: operations['task_manager_get_schema_api_apps_tasks_schema_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/tasks/{task_name}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Tasks Api Detail
+     * @description Return the per-task detail bundle for the read-only plugin UI.
+     *
+     *     :param task: The task definition resolved by name.
+     *     :type task: Task
+     *     :param tasks_api: Async client for the tasks sub-app.
+     *     :type tasks_api: TaskAPI
+     *     :param executor_hosts_ctx: Executor hosts enriched with inventory labels.
+     *     :type executor_hosts_ctx: ExecutorHostsCtx
+     *     :return: Task definition, history, periodic schedules, and executor hosts.
+     *     :rtype: TaskDetailResponse
+     */
+    get: operations['task_manager_tasks_api_detail_api_apps_tasks__task_name__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/topology/collect': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Topology Collect
+     * @description Dispatch one or more topology collector tasks. Returns the task ids.
+     *
+     *     Hosts are pulled from the inventory MySQL service list; no inventory
+     *     persistence side effects occur. With ``shards > 1`` the host list is
+     *     split round-robin across the first N executor hosts so geographically
+     *     split inventories run in parallel.
+     *
+     *     :param body: Collection request (shard count, optional executor, timeouts).
+     *     :param inventory_api: Remote inventory API client used to source MySQL hosts.
+     *     :param tasks_api: Remote Tasks API client used to dispatch collector tasks.
+     *     :return: Dispatched task history ids plus the executor targets and counts.
+     */
+    post: operations['topology_topology_collect_api_apps_topology_collect_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/apps/topology/result': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Topology Result
+     * @description Return the merged graph for the supplied task history ids.
+     *
+     *     Status mirrors the underlying tasks: ``running`` while any are pending
+     *     or running, ``failed`` when any task failed and produced no usable
+     *     output, ``ok`` once every task is finished. The React client caches
+     *     the response via TanStack Query (long ``staleTime``) and stops
+     *     polling once status flips to ``ok``, so the server doesn't bother
+     *     with HTTP cache validation here.
+     *
+     *     :param tasks_api: Remote Tasks API client used to fetch task histories and logs.
+     *     :param current_user: Authenticated caller; results are scoped to their own tasks.
+     *     :param ids: Comma-separated task history ids to merge into one graph.
+     *     :return: Aggregate status plus the merged graph (when ready) and task-id lists.
+     */
+    get: operations['topology_topology_result_api_apps_topology_result_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/sep/admin/connectivity-check/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Check Connectivity
+     * @description Probe the requested external / inter-service endpoints and report status.
+     *
+     *     Probe only the services named in ``body.targets``, running the selected
+     *     probes concurrently. Each is isolated: one endpoint's failure is classified
+     *     independently and never fails the whole response, which always returns
+     *     ``200`` with one entry per requested service, in request order. Tasks and
+     *     Nomad share a single ``/hosts/`` probe, so requesting either (or both) runs
+     *     it once.
+     *
+     *     :param body: The request naming which services to probe.
+     *     :param pmm_api: The PMM client dependency, or ``None`` when unconfigured.
+     *     :param inventory_api: The authenticated Inventory API client.
+     *     :param tasks_api: The authenticated Tasks API client.
+     *     :return: One normalized connectivity result per requested service.
+     */
+    post: operations['sep_check_connectivity_api_sep_admin_connectivity_check__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/sep/admin/settings/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Settings
+     * @description List every exposed settings class with current values and metadata.
+     *
+     *     Local classes are read from their config singletons; remote classes
+     *     (``remote_classes``) are fetched server-side from their owning sub-app
+     *     and appended in declaration order; app-owned classes follow remote
+     *     groups with per-group app metadata. A failed remote fetch fails the
+     *     whole request with ``502`` -- the LIST never silently drops a remote
+     *     group.
+     *
+     *     :param session: The sub-app's database session.
+     *     :param remote_api: The client for remote settings classes (``None`` when
+     *         the router wires none).
+     *     :return: Grouped responses, one group per configured settings class.
+     */
+    get: operations['sep_list_settings_api_sep_admin_settings__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/sep/admin/settings/export': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Export Settings
+     * @description Return the merged effective configuration as a YAML attachment.
+     *
+     *     Aggregates the SEP-wired core settings classes and app-owned settings
+     *     classes locally and fans out to ``GET /admin/settings/`` on the Tasks API
+     *     for ``TasksSettings``. Values use the same dump path as the settings LIST
+     *     endpoints. On upstream failure, re-raise as
+     *     :class:`~app.core.exceptions.HTTPBadGatewayException` — no partial export.
+     *
+     *     When ``keys`` is omitted the full merged export is returned exactly as
+     *     before. When provided, each entry is a fully-qualified selector
+     *     (``Class.KEY`` or a bare ``Class``); the response is narrowed to only the
+     *     requested classes/keys. Class names and SEP keys are validated with no
+     *     upstream call; the Tasks fan-out is skipped entirely unless a selector
+     *     targets ``TasksSettings``, and Tasks keys are validated against the fetched
+     *     block. Output blocks always follow the canonical declaration order
+     *     (``SEP_ADMIN_SETTINGS_CLASSES``, then app-owned classes, then
+     *     ``TasksSettings``), independent of selector order.
+     *
+     *     :param session: The active database session for SEP override queries.
+     *     :type session: AsyncSession
+     *     :param tasks_api: The Tasks API client used to fetch ``TasksSettings``.
+     *     :type tasks_api: TaskAPI
+     *     :param keys: Optional, repeatable selectors restricting the export to a
+     *         subset of classes/keys. ``None`` (omitted) means the full export.
+     *     :type keys: list[str] | None
+     *     :return: YAML bytes with ``Content-Disposition`` set for download.
+     *     :rtype: Response
+     *     :raises HTTPBadRequestException: If a selector is blank, malformed, names an
+     *         unwired class, or names a key that does not exist on its class.
+     *     :raises HTTPBadGatewayException: If the Tasks settings LIST call fails
+     *         with an ``HTTPException`` (e.g. an upstream non-2xx response), an
+     *         ``OSError`` (e.g. a connection failure), an unexpected payload shape,
+     *         or a missing ``TasksSettings`` group.
+     */
+    get: operations['sep_export_settings_api_sep_admin_settings_export_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/sep/admin/settings/{setting_class}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    /**
+     * Patch Settings
+     * @description Apply a batch of overrides for one settings class atomically.
+     *
+     *     For a remote class the batch is forwarded to the owning sub-app, which
+     *     owns the validation and persistence; the upstream's per-field ``422``
+     *     (and its ``detail``) is preserved so the UI can render inline messages.
+     *
+     *     For a local class: Phase A validates every key in ``body`` (existence on
+     *     the class, HOT classification, type/constraint coercion) and collects
+     *     per-key errors. If any key fails, the whole batch is rejected with a
+     *     structured 422 and nothing is written. Phase B persists every valid entry
+     *     in a single transaction, refreshes the proxy snapshot once, then fires
+     *     the rebind callbacks for any changed keys so a HOT target rebinds without
+     *     waiting for the next background refresh cycle.
+     *
+     *     :param request: The incoming request; its ``app.state`` carries the
+     *         sub-app's rebind-callback registry.
+     *     :param setting_class: The settings class the override targets.
+     *     :param body: The batch of ``{key: value, ...}`` overrides.
+     *     :param session: The sub-app's database session.
+     *     :param remote_api: The client for remote settings classes (``None`` when
+     *         the router wires none).
+     *     :return: One :class:`SettingResponse` per applied key, in input order.
+     *     :raises HTTPNotFoundException: If the class isn't exposed.
+     *     :raises HTTPUnprocessableEntityException: If any key fails validation;
+     *         no rows are written.
+     */
+    patch: operations['sep_patch_settings_api_sep_admin_settings__setting_class__patch'];
+    trace?: never;
+  };
+  '/api/sep/admin/settings/{setting_class}/{key}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Setting
+     * @description Return one field's metadata and current value.
+     *
+     *     :param setting_class: The settings class the field belongs to.
+     *     :param key: The field name on the settings class.
+     *     :param session: The sub-app's database session.
+     *     :param remote_api: The client for remote settings classes (``None`` when
+     *         the router wires none).
+     *     :return: The structured response for the field.
+     *     :raises HTTPNotFoundException: If the class isn't exposed or the key
+     *         doesn't exist on the class.
+     */
+    get: operations['sep_get_setting_api_sep_admin_settings__setting_class___key__get'];
+    put?: never;
+    post?: never;
+    /**
+     * Delete Setting
+     * @description Revert one override row to the field's declared default.
+     *
+     *     For a remote class the DELETE is forwarded to the owning sub-app, which
+     *     owns the idempotency and ``NOT_OVERRIDABLE`` semantics; its status and
+     *     ``detail`` are preserved through the proxy.
+     *
+     *     For a local class the DELETE is idempotent: deleting a (class, key) pair
+     *     that has no override row succeeds with 204. Attempting to delete a field
+     *     the code declares NOT_OVERRIDABLE responds 409, since it cannot have an
+     *     override row in the first place and the operator's intent is
+     *     unsatisfiable. A field only ``SETTINGS_OVERRIDE_ALLOWED_KEYS`` withheld
+     *     may still carry a row written before the restriction applied, so that
+     *     row is deleted normally and only the no-row case answers 409.
+     *
+     *     After republishing the snapshot, fires the rebind callbacks for the
+     *     reverted key so a HOT target rebinds to its restored value without
+     *     waiting for the next background refresh cycle.
+     *
+     *     :param request: The incoming request; its ``app.state`` carries the
+     *         sub-app's rebind-callback registry.
+     *     :param setting_class: The settings class the field belongs to.
+     *     :param key: The field name on the settings class.
+     *     :param session: The sub-app's database session.
+     *     :param remote_api: The client for remote settings classes (``None`` when
+     *         the router wires none).
+     *     :raises HTTPNotFoundException: If the class isn't exposed or the key
+     *         doesn't exist on the class.
+     *     :raises HTTPConflictException: If the field is NOT_OVERRIDABLE and has
+     *         no row to delete.
+     *     :raises HTTPUnprocessableEntityException: If ``key`` names a
+     *         ``NESTED_ONLY`` parent (the whole parent cannot be overridden;
+     *         target an individual ``parent__leaf`` instead).
+     *     :raises HTTPBadGatewayException: For a remote class, when the owning
+     *         sub-app returns a server error (status >= 500) or is unreachable.
+     */
+    delete: operations['sep_delete_setting_api_sep_admin_settings__setting_class___key__delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/sep/app-info/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get App Info
+     * @description Return shell metadata for the React frontend.
+     *
+     *     Render ``footer_text`` from the shared :func:`render_footer_text` helper so
+     *     the JSON endpoint and the legacy Jinja sidebar footer cannot drift. The
+     *     helper reads the hot ``FOOTER_TEMPLATE`` setting per request, so a live
+     *     ``SEP__FOOTER_TEMPLATE`` override is reflected without a restart. Access is
+     *     gated by the router-level ``IsApiAuthenticated`` dependency.
+     *
+     *     :return: The rendered footer text.
+     */
+    get: operations['sep_get_app_info_api_sep_app_info__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/sep/dashboard/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Dashboard Stats
+     * @description Return aggregate counts for all four dashboard stat cards.
+     *
+     *     Sources (each degrades to ``0`` on failure):
+     *
+     *     * ``nodes`` — ``GET /summary/`` on the Inventory API.
+     *     * ``tasks`` — ``GET /`` on the Tasks API (``limit=1``; reads ``total``).
+     *     * ``snippets`` — :meth:`SnippetManager.count` on the SEP database.
+     *     * ``targets`` — ``GET /hosts/`` on the Tasks API; count of returned items.
+     *
+     *     When one or more sources fail the names of the failed sources are joined
+     *     with commas and set on the ``X-Sep-Upstream-Error`` response header so the
+     *     caller can surface a partial-failure warning without treating all-zero
+     *     counts as healthy data.
+     *
+     *     :param response: The outgoing response used to attach the error header.
+     *     :type response: Response
+     *     :param session: The active database session for snippet queries.
+     *     :type session: AsyncSession
+     *     :param tasks_api: Async client for the Tasks sub-app.
+     *     :type tasks_api: RemoteAPI
+     *     :param inventory_api: Async client for the Inventory sub-app.
+     *     :type inventory_api: RemoteAPI
+     *     :return: Aggregate counts for nodes, tasks, snippets, and targets.
+     *     :rtype: DashboardStatsResponse
+     */
+    get: operations['sep_get_dashboard_stats_api_sep_dashboard__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/sep/hosts/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Hosts
+     * @description Return executor hosts merged with inventory display names.
+     *
+     *     Call ``tasks_api.get('/hosts/')`` for executor targets and the Inventory
+     *     API for display-name enrichment. The two upstream calls degrade
+     *     differently: Inventory failures cause hosts without a match to keep the
+     *     raw executor node name (the response still returns ``200``), but a
+     *     Tasks-API failure (HTTP or connection error) is re-raised as
+     *     :class:`~app.core.exceptions.HTTPBadGatewayException` so the SEP exception
+     *     handler emits a ``502`` JSON body ``{"detail": "<upstream detail>"}`` that
+     *     the React frontend surfaces through its React Query error slot.
+     *
+     *     :param tasks_api: The Tasks API client used to fetch executor hosts.
+     *     :type tasks_api: TaskAPI
+     *     :param inventory_api: The Inventory API client used to enrich the hosts
+     *         with their display names.
+     *     :type inventory_api: InventoryAPI
+     *     :return: Sorted list of hosts, each with executor id, friendly name,
+     *         and network address.
+     *     :rtype: list[HostResponse]
+     *     :raises HTTPBadGatewayException: If the Tasks API call fails with an
+     *         ``HTTPException`` (e.g. an upstream non-2xx response) or an
+     *         ``OSError`` (e.g. a connection failure).
+     */
+    get: operations['sep_list_hosts_api_sep_hosts__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/sep/periodic-tasks/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Periodic Tasks
+     * @description Return the upstream periodic-task list through the SEP gateway.
+     *
+     *     :param tasks_api: The Tasks API client used to fetch the upstream list.
+     *     :return: The upstream periodic-task list, or ``[]`` when the upstream
+     *         payload is not a list.
+     *     :raises HTTPException: Re-raised unchanged for an upstream client error
+     *         (status < 500).
+     *     :raises HTTPBadGatewayException: For an upstream server error (status >= 500)
+     *         or a connection-level ``OSError``.
+     */
+    get: operations['tasks_list_periodic_tasks_api_sep_periodic_tasks__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/sep/periodic-tasks/{periodic_task_id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    /**
+     * Update Periodic Task
+     * @description Dispatch a full-replacement update of a periodic task to the Tasks API.
+     *
+     *     :param periodic_task_id: The id of the periodic task to update.
+     *     :param tasks_api: The Tasks API client used to update the periodic task.
+     *     :param body: The ``PeriodicTaskUpdate`` JSON body, forwarded verbatim.
+     *     :return: The updated periodic task as returned by the Tasks API.
+     *     :raises HTTPException: Re-raised unchanged for an upstream client error
+     *         (status < 500).
+     *     :raises HTTPBadGatewayException: For an upstream server error (status >= 500)
+     *         or a connection-level ``OSError``.
+     */
+    put: operations['tasks_update_periodic_task_api_sep_periodic_tasks__periodic_task_id__put'];
+    post?: never;
+    /**
+     * Delete Periodic Task
+     * @description Dispatch deletion of a periodic task to the Tasks API.
+     *
+     *     :param periodic_task_id: The id of the periodic task to delete.
+     *     :param tasks_api: The Tasks API client used to delete the periodic task.
+     *     :raises HTTPException: Re-raised unchanged for an upstream client error
+     *         (status < 500).
+     *     :raises HTTPBadGatewayException: For an upstream server error (status >= 500)
+     *         or a connection-level ``OSError``.
+     */
+    delete: operations['tasks_delete_periodic_task_api_sep_periodic_tasks__periodic_task_id__delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/sep/periodic-tasks/{task_name}/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Create Periodic Task
+     * @description Dispatch creation of a periodic task for ``task_name`` to the Tasks API.
+     *
+     *     :param task_name: The task name the new periodic schedule runs.
+     *     :param tasks_api: The Tasks API client used to create the periodic task.
+     *     :param body: The ``PeriodicTaskCreate`` JSON body, forwarded verbatim.
+     *     :return: The created periodic task as returned by the Tasks API.
+     *     :raises HTTPException: Re-raised unchanged for an upstream client error
+     *         (status < 500).
+     *     :raises HTTPBadGatewayException: For an upstream server error (status >= 500)
+     *         or a connection-level ``OSError``.
+     */
+    post: operations['tasks_create_periodic_task_api_sep_periodic_tasks__task_name___post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/sep/schemas/{schema_id}/tables': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Schema Tables
+     * @description Return tables for a schema via the SEP gateway.
+     *
+     *     Proxies Inventory ``GET /schemas/{schema_id}/tables/`` for React
+     *     ``TableSelector`` components. Returns an empty list only when Inventory
+     *     responds with 404 (missing schema); other HTTP errors propagate to the
+     *     global handler (matches legacy AJAX empty-selector UX for not-found only).
+     *
+     *     :param schema_id: The inventory schema ID whose tables are listed.
+     *     :type schema_id: int
+     *     :param inventory_api: The Inventory API client used to proxy the request.
+     *     :type inventory_api: InventoryAPI
+     *     :param search: Optional substring filter forwarded to inventory.
+     *     :type search: str | None
+     *     :return: Minimal id/name options for each table in the schema.
+     *     :rtype: list[InventorySelectorOption]
+     */
+    get: operations['sep_list_schema_tables_api_sep_schemas__schema_id__tables_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/sep/services/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Services
+     * @description Return a paginated list of inventory services via the SEP gateway.
+     *
+     *     :param inventory_api: The Inventory API client used to proxy the request.
+     *     :type inventory_api: InventoryAPI
+     *     :param service_type: Optional service type filter forwarded to inventory.
+     *     :type service_type: ServiceTypeEnum | None
+     *     :param pagination: Validated pagination window for this request.
+     *     :type pagination: Pagination
+     *     :return: Paginated services payload.
+     *     :rtype: PaginatedResponse[ServiceResponse]
+     */
+    get: operations['sep_list_services_api_sep_services__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/sep/services/{service_id}/schemas': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Service Schemas
+     * @description Return schemas for a service via the SEP gateway.
+     *
+     *     Proxies Inventory ``GET /services/{service_id}/schemas/`` for React
+     *     ``SchemaSelector`` components. Returns an empty list only when Inventory
+     *     responds with 404 (missing service); other HTTP errors propagate to the
+     *     global handler (matches legacy AJAX empty-selector UX for not-found only).
+     *
+     *     :param service_id: The inventory service ID whose schemas are listed.
+     *     :type service_id: int
+     *     :param inventory_api: The Inventory API client used to proxy the request.
+     *     :type inventory_api: InventoryAPI
+     *     :param search: Optional substring filter forwarded to inventory.
+     *     :type search: str | None
+     *     :return: Minimal id/name options for each schema on the service.
+     *     :rtype: list[InventorySelectorOption]
+     */
+    get: operations['sep_list_service_schemas_api_sep_services__service_id__schemas_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/sep/task-history/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Merged Task History
+     * @description Return task-history rows, listing all of them or merging selected names.
+     *
+     *     Three-way on ``task_names``:
+     *
+     *     * **omitted** (``None``) -- proxy the upstream ``GET /history/`` list, already
+     *       paginated, forwarding the ``status`` filter, ``exclude_internal`` flag, and
+     *       client ``offset`` / ``limit``.
+     *     * **provided, at least one non-blank name** -- query each name independently
+     *       against the Tasks API, then merge, sort newest-first, and paginate globally.
+     *     * **provided, every name blank after trimming** -- reject with ``422``.
+     *
+     *     :param tasks_api: The Tasks API client used to fetch upstream history.
+     *     :param pagination: Validated offset/limit query parameters.
+     *     :param task_names: Zero or more task names (repeat the query param); omit to
+     *         list all history.
+     *     :param task_status: Optional exact status filter forwarded upstream.
+     *     :param exclude_internal: When ``True``, forward the filter to the upstream
+     *         list-all path so internal maintenance tasks are excluded before pagination.
+     *         Not forwarded on the ``task_names`` merge path. Defaults to ``False``.
+     *     :return: Paginated task history, either the upstream list or the merged set.
+     *     :raises HTTPUnprocessableEntityException: When ``task_names`` is supplied but
+     *         every value is empty after trimming.
+     *     :raises HTTPBadGatewayException: For an upstream server error (status >= 500)
+     *         or a connection-level ``OSError``, on either the list-all passthrough or
+     *         the merged-history fan-out.
+     */
+    get: operations['tasks_list_merged_task_history_api_sep_task_history__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/sep/task-history/{task_history_id}/stop/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Stop Task History
+     * @description Dispatch a stop request for a single task-history row to the Tasks API.
+     *
+     *     :param task_history_id: The id of the task-history row to stop.
+     *     :param tasks_api: The Tasks API client used to issue the stop request.
+     *     :return: The stopped task-history row as returned by the Tasks API.
+     *     :raises HTTPException: Re-raised unchanged for an upstream client error
+     *         (status < 500), e.g. a ``400`` when the task is not running.
+     *     :raises HTTPBadGatewayException: For an upstream server error (status >= 500)
+     *         or a connection-level ``OSError``.
+     */
+    post: operations['tasks_stop_task_history_api_sep_task_history__task_history_id__stop__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/sep/task-stats/{task_name}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Task Stats
+     * @description Return aggregated execution statistics for ``task_name``.
+     *
+     *     Proxy to the Tasks-service ``GET /stats/{task_name}`` aggregation so the
+     *     React frontend reaches the data through SEP rather than calling the Tasks
+     *     sub-app directly. On upstream failure, re-raise as
+     *     :class:`~app.core.exceptions.HTTPBadGatewayException` so the SEP exception
+     *     handler emits a ``502`` JSON body ``{"detail": "<upstream detail>"}`` that
+     *     the React frontend surfaces through React Query's error state.
+     *
+     *     :param task_name: The task name (not the database id) whose stats are
+     *         being requested.
+     *     :type task_name: str
+     *     :param tasks_api: The Tasks API client used to fetch the upstream stats.
+     *     :type tasks_api: TaskAPI
+     *     :return: The raw upstream stats payload.
+     *     :rtype: dict[str, Any]
+     *     :raises HTTPBadGatewayException: If the Tasks API call fails with an
+     *         ``HTTPException`` (e.g. an upstream non-2xx response) or an
+     *         ``OSError`` (e.g. a connection failure).
+     */
+    get: operations['tasks_get_task_stats_api_sep_task_stats__task_name__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/execution-events/{task_history_id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Task Execution Events
+     * @description Return executor tracking events for a task history (Tasks API proxy).
+     */
+    get: operations['tasks_list_task_execution_events_execution_events__task_history_id__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/files/{task_history_id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Task History Files
+     * @description Return files available for the given task history.
+     */
+    get: operations['tasks_list_task_history_files_files__task_history_id__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/files/{task_history_id}/download': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Download Task History File
+     * @description Stream a task history's archived file as a binary download.
+     */
+    get: operations['tasks_download_task_history_file_files__task_history_id__download_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/stream-logs/{task_history_id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Task Logs Event Stream
+     * @description Stream a task history's logs as server-sent events.
+     */
+    get: operations['tasks_task_logs_event_stream_stream_logs__task_history_id__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/stream-logs/{task_history_id}/execution-events': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Task Execution Events Stream
+     * @description Stream task execution events as server-sent events.
+     */
+    get: operations['tasks_task_execution_events_stream_stream_logs__task_history_id__execution_events_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+  schemas: {
+    /**
+     * AlertServiceType
+     * @description Enumerate the supported service types for alert-related features.
+     *
+     *     :cvar GENERIC: Generic service type.
+     *     :vartype GENERIC: str
+     *     :cvar MYSQL: MySQL service type.
+     *     :vartype MYSQL: str
+     *     :cvar MONGODB: MongoDB service type.
+     *     :vartype MONGODB: str
+     *     :cvar POSTGRESQL: PostgreSQL service type.
+     *     :vartype POSTGRESQL: str
+     * @enum {string}
+     */
+    AlertServiceType: 'generic' | 'mysql' | 'mongodb' | 'postgresql';
+    /**
+     * AppInfo
+     * @description Represent the response of ``GET /api/sep/app-info``.
+     *
+     *     :param footer_text: The rendered sidebar footer text (application summary
+     *         and version by default).
+     */
+    AppInfo: {
+      /** Footer Text */
+      footer_text: string;
+    };
+    /**
+     * AppInfoResponse
+     * @description Represent a per-app info entry returned by ``GET /``.
+     *
+     *     :param app_key: The plugin module key.
+     *     :type app_key: str
+     *     :param name: The human-readable plugin name.
+     *     :type name: str
+     *     :param enabled: Whether the app is fully enabled (derived; deprecated).
+     *     :type enabled: bool
+     *     :param lifecycle_state: The app's runtime lifecycle state.
+     *     :param toggleable: Whether the app may be toggled (``False`` for protected).
+     *     :type toggleable: bool
+     *     :param uri_path: The plugin's mount URI path.
+     *     :type uri_path: str
+     *     :param css_class: The plugin's CSS class.
+     *     :type css_class: str
+     *     :param sidebar: Whether the plugin appears in the sidebar.
+     *     :type sidebar: bool
+     *     :param has_api_router: Whether the plugin exposes a JSON API router.
+     *     :type has_api_router: bool
+     */
+    AppInfoResponse: {
+      /** App Key */
+      app_key: string;
+      /** Css Class */
+      css_class: string;
+      /** Enabled */
+      enabled: boolean;
+      /** Has Api Router */
+      has_api_router: boolean;
+      lifecycle_state: components['schemas']['AppLifecycleEnum'];
+      /** Name */
+      name: string;
+      /** Sidebar */
+      sidebar: boolean;
+      /** Toggleable */
+      toggleable: boolean;
+      /** Uri Path */
+      uri_path: string;
+    };
+    /**
+     * AppKeyResponse
+     * @description Represent a minimal per-app entry for the navigation shell.
+     *
+     *     :param app_key: The plugin module key.
+     *     :param enabled: Whether the app is currently enabled.
+     *     :param sidebar: Whether the plugin appears in the sidebar.
+     *     :param uri_path: The plugin's mount URI path.
+     *     :param display_name: The human-facing label for the app.
+     *     :param custom_ui: Whether the app ships a bespoke React UI.
+     *     :param group: The nav group key this app nests under; ``None`` when the app
+     *         renders as a top-level sidebar entry.
+     *     :param nav_order: The app's sort position within the sidebar; ``None`` when
+     *         unset.
+     *     :param react_route: The canonical React route the shell mounts and links to;
+     *         always concrete (defaulting to ``/apps/<app_key>``).
+     *     :param nav_icon: The sidebar icon key; ``None`` falls back to the shell's
+     *         default app icon.
+     *     :param blocking_dependencies: The effective-disabled ``requires_apps`` keys
+     *         that are the reason this app is effective-disabled. Empty when the app is
+     *         enabled or disabled by its own state; non-empty only for a
+     *         dependency-driven disablement, so the shell can name the required app on
+     *         the disabled splash.
+     */
+    AppKeyResponse: {
+      /** App Key */
+      app_key: string;
+      /**
+       * Blocking Dependencies
+       * @default []
+       */
+      blocking_dependencies: string[];
+      /** Custom Ui */
+      custom_ui: boolean;
+      /** Display Name */
+      display_name: string;
+      /** Enabled */
+      enabled: boolean;
+      /** Group */
+      group: string | null;
+      nav_icon: components['schemas']['nav_icons__NavIcon'] | null;
+      /** Nav Order */
+      nav_order: number | null;
+      /** React Route */
+      react_route: string;
+      /** Sidebar */
+      sidebar: boolean;
+      /** Uri Path */
+      uri_path: string;
+    };
+    /**
+     * AppLifecycleEnum
+     * @description Enumerate the runtime lifecycle states of an app.
+     *
+     *     Member names equal their values, so the DB column, its CHECK constraint, the
+     *     API wire value, and any operator SQL all share one uppercase token. The
+     *     transitional states ``ENABLING`` and ``DISABLING`` expose an observable
+     *     window for future machinery to finish in-flight work before an app goes
+     *     fully offline; the request guard treats every state other than ``ENABLED``
+     *     as unreachable.
+     * @enum {string}
+     */
+    AppLifecycleEnum: 'ENABLED' | 'DISABLED' | 'ENABLING' | 'DISABLING';
+    /**
+     * AppStateResponse
+     * @description Represent the toggle endpoint's response.
+     *
+     *     :param app_key: The toggled app's key.
+     *     :type app_key: str
+     *     :param enabled: The resulting enabled flag (derived; deprecated).
+     *     :type enabled: bool
+     *     :param lifecycle_state: The resulting lifecycle state.
+     */
+    AppStateResponse: {
+      /** App Key */
+      app_key: string;
+      /** Enabled */
+      enabled: boolean;
+      lifecycle_state: components['schemas']['AppLifecycleEnum'];
+    };
+    /**
+     * AppStateWrite
+     * @description Define the write payload for the app-state toggle endpoint.
+     *
+     *     :param lifecycle_state: The requested target lifecycle state.
+     */
+    AppStateWrite: {
+      lifecycle_state: components['schemas']['AppLifecycleEnum'];
+    };
+    /**
+     * BatchApprovalResponse
+     * @description Successful response for the batch-approve endpoint.
+     *
+     *     :param approved: Filenames whose approval state was toggled by this
+     *         request (newly approved as a result of the call).
+     *     :type approved: list[str]
+     *     :param skipped_already_approved: Filenames that were already approved
+     *         when the call started; the request is treated as a soft-skip
+     *         (idempotent).
+     *     :type skipped_already_approved: list[str]
+     */
+    BatchApprovalResponse: {
+      /** Approved */
+      approved: string[];
+      /**
+       * Count
+       * @description Return the number of newly approved snippets.
+       *
+       *     :return: Length of ``approved``.
+       *     :rtype: int
+       */
+      readonly count: number;
+      /** Skipped Already Approved */
+      skipped_already_approved: string[];
+    };
+    /**
+     * ConnectivityCheckRequest
+     * @description Carry the required set of services to probe.
+     *
+     *     :param targets: The services to probe. Must name at least one; duplicates are
+     *         collapsed so a shared probe (Tasks/Nomad) still runs once.
+     */
+    ConnectivityCheckRequest: {
+      /** Targets */
+      targets: components['schemas']['ServiceEnum'][];
+    };
+    /**
+     * ConnectivityCheckResponse
+     * @description Represent a connectivity check result.
+     *
+     *     :param success: Whether the connectivity check succeeded.
+     *     :param error: Error message if the check failed. Defaults to ``None``.
+     *     :param task_history_id: The ID of the task history record for this check.
+     */
+    ConnectivityCheckResponse: {
+      /** Error */
+      error?: string | null;
+      /** Success */
+      success: boolean;
+      /** Task History Id */
+      task_history_id: number;
+    };
+    /**
+     * ConnectivityResult
+     * @description Represent the outcome of probing a single external / inter-service endpoint.
+     *
+     *     :param service: Stable identifier of the probed service (e.g. ``"pmm"``).
+     *     :type service: str
+     *     :param reachable: ``True`` only when the endpoint answered successfully.
+     *     :type reachable: bool
+     *     :param status: Machine-readable outcome state.
+     *     :type status: ConnectivityStatusEnum
+     *     :param detail: Human-readable status / error, free of secrets.
+     *     :type detail: str
+     *     :param version: Optional remote version string when the probe exposes one.
+     *     :type version: str | None
+     */
+    ConnectivityResult: {
+      /** Detail */
+      detail: string;
+      /** Reachable */
+      reachable: boolean;
+      /** Service */
+      service: string;
+      status: components['schemas']['ConnectivityStatusEnum'];
+      /** Version */
+      version?: string | null;
+    };
+    /**
+     * ConnectivityStatusEnum
+     * @description Enumerate the mutually-exclusive outcomes of a connectivity probe.
+     * @enum {string}
+     */
+    ConnectivityStatusEnum:
+      | 'reachable'
+      | 'auth_failed'
+      | 'error'
+      | 'unreachable'
+      | 'ssl_error'
+      | 'timeout';
+    /**
+     * DashboardStatsResponse
+     * @description Represent aggregate counts for the four dashboard stat cards.
+     *
+     *     :param nodes: Total inventory node count.
+     *     :type nodes: int
+     *     :param tasks: Total active task count.
+     *     :type tasks: int
+     *     :param snippets: Total snippet count.
+     *     :type snippets: int
+     *     :param targets: Total executor target (host) count.
+     *     :type targets: int
+     */
+    DashboardStatsResponse: {
+      /** Nodes */
+      nodes: number;
+      /** Snippets */
+      snippets: number;
+      /** Targets */
+      targets: number;
+      /** Tasks */
+      tasks: number;
+    };
+    /**
+     * ExecutionEvent
+     * @description A single lifecycle event from a task executor (executor-agnostic shape).
+     *
+     *     :param timestamp: When the event occurred (UTC).
+     *     :type timestamp: UTCDatetime
+     *     :param event_type: Executor-specific event category (e.g. Nomad task event type).
+     *     :type event_type: str
+     *     :param description: Human-readable message for the event (no step prefix).
+     *     :type description: str
+     *     :param step: Optional executor task/step name (e.g. Nomad task within the group).
+     *     :type step: str | None
+     */
+    ExecutionEvent: {
+      /** Description */
+      description: string;
+      /** Step */
+      step?: string | null;
+      /**
+       * Timestamp
+       * Format: date-time
+       */
+      timestamp: string;
+      /** Type */
+      type: string;
+    };
+    /**
+     * FileMetadata
+     * @description Represent file metadata for task artifacts.
+     */
+    FileMetadata: {
+      /**
+       * Is Dir
+       * @default false
+       */
+      is_dir: boolean;
+      /**
+       * Size
+       * @default 0
+       */
+      size: number;
+    };
+    /** HTTPValidationError */
+    HTTPValidationError: {
+      /** Detail */
+      detail?: components['schemas']['ValidationError'][];
+    };
+    /**
+     * HostResponse
+     * @description Represent a single executor target enriched with an inventory display name.
+     *
+     *     :param id: The executor (Nomad / Celery) node name. This is the value
+     *         consumed by dispatch payloads as ``executor_host``.
+     *     :type id: str
+     *     :param name: Human-readable label sourced from inventory when available;
+     *         falls back to ``id`` if the host has no inventory match.
+     *     :type name: str
+     *     :param address: The network address reported by the executor.
+     *     :type address: str
+     */
+    HostResponse: {
+      /** Address */
+      address: string;
+      /** Id */
+      id: string;
+      /** Name */
+      name: string;
+    };
+    /**
+     * InventorySelectorOption
+     * @description Represent a minimal ``{id, name}`` option for inventory autocomplete selectors.
+     *
+     *     :param id: The inventory entity ID consumed by form payloads.
+     *     :type id: int
+     *     :param name: The human-readable display label.
+     *     :type name: str
+     */
+    InventorySelectorOption: {
+      /** Id */
+      id: number;
+      /** Name */
+      name: string;
+    };
+    JsonValue: unknown;
+    /**
+     * Node
+     * @description Represent a node in the inventory.
+     *
+     *     :param address: The network address of the node.
+     *     :type address: NonEmptyStr
+     *     :param name: The name of the node.
+     *     :type name: NonEmptyStr
+     *     :param external_id: An external identifier for the node. Must be unique for source,
+     *         as defined by composite index ix_node_external_id_source.
+     *     :type external_id: NonEmptyStr | None
+     *     :param source: The source from which the node information is derived. Must be unique
+     *         for external_id, as defined by composite index ix_node_external_id_source.
+     *     :type source: SourceEnum | None
+     *     :param type: The type of the node (e.g., remote, generic).
+     *     :type type: NonEmptyStr
+     *     :param services: A list of services associated with the node.
+     *     :type services: list[Service]
+     */
+    Node: {
+      /** Address */
+      address: string;
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /** External Id */
+      external_id?: string | null;
+      /** Id */
+      id: number | null;
+      /** Name */
+      name: string;
+      source?: components['schemas']['SourceEnum'] | null;
+      /**
+       * Type
+       * @default generic
+       */
+      type: string;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /** PaginatedResponse[Any] */
+    PaginatedResponse_Any_: {
+      /** Items */
+      items: unknown[];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /** PaginatedResponse[ServiceResponse] */
+    PaginatedResponse_ServiceResponse_: {
+      /** Items */
+      items: components['schemas']['ServiceResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /** PaginatedResponse[SnippetResponse] */
+    PaginatedResponse_SnippetResponse_: {
+      /** Items */
+      items: components['schemas']['SnippetResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /** PaginatedResponse[TaskHistoryResponse] */
+    PaginatedResponse_TaskHistoryResponse_: {
+      /** Items */
+      items: components['schemas']['TaskHistoryResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /** PaginatedResponse[dict[str, Any]] */
+    PaginatedResponse_dict_str__Any__: {
+      /** Items */
+      items: Record<string, never>[];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /**
+     * RefreshResponse
+     * @description Represent the successful result of a manual snippets-refresh operation.
+     *
+     *     :param refreshed_at: UTC timestamp at which the refresh completed.
+     *     :type refreshed_at: datetime
+     */
+    RefreshResponse: {
+      /**
+       * Refreshed At
+       * Format: date-time
+       */
+      refreshed_at: string;
+    };
+    /**
+     * ReloadClassification
+     * @description Declare the reload behavior of an overridable settings field.
+     *
+     *     :cvar HOT: Field can be overridden via a DB row and the new value takes
+     *         effect on the next snapshot refresh, without restarting the service.
+     *         For a nested-model field, ``HOT`` permits both whole-object override
+     *         (``PATCH {parent: {...}}``) and per-child override (``parent__leaf``).
+     *     :vartype HOT: str
+     *     :cvar NESTED_ONLY: Nested-model field whose children may be overridden
+     *         (``parent__leaf``) while the parent itself rejects whole-object
+     *         override (``PATCH {parent: {...}}`` → 422). Children default to
+     *         HOT-inherit unless explicitly marked :func:`not_overridable_field`.
+     *     :vartype NESTED_ONLY: str
+     *     :cvar NOT_OVERRIDABLE: Field is not overridable from the database; YAML
+     *         and environment variables remain the only sources of truth.
+     *     :vartype NOT_OVERRIDABLE: str
+     * @enum {string}
+     */
+    ReloadClassification: 'hot' | 'nested_only' | 'not_overridable';
+    /**
+     * Schema
+     * @description Represent a database schema within a service.
+     *
+     *     :param id: The primary key for the table. Auto-incremented and not nullable.
+     *     :type id: int | None
+     *     :param created_at: The timestamp when the record is created. Defaults to the current
+     *         time in UTC.
+     *     :type created_at: UTCDatetime
+     *     :param updated_at: The timestamp when the record is last updated. Automatically
+     *         updated on changes.
+     *     :type updated_at: UTCDatetime | None
+     *     :param name: The name of the schema. Must be unique for service_id, as defined by
+     *         composite index ix_schema_name_service_id.
+     *     :type name: NonEmptyStr
+     *     :param service_id: The unique identifier of the service to which the schema belongs.
+     *         Must be unique for name, as defined by composite index
+     *         ix_schema_name_service_id.
+     *     :type service_id: int
+     *     :param service: The service to which the schema is associated.
+     *     :type service: Service
+     *     :param tables: A list of tables within the schema.
+     *     :type tables: list[Table]
+     */
+    Schema: {
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /** Id */
+      id: number | null;
+      /** Name */
+      name: string;
+      /** Service Id */
+      service_id: number;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * ServiceEnum
+     * @description Enumerate the probeable services, used as stable ``service`` identifiers.
+     * @enum {string}
+     */
+    ServiceEnum: 'pmm' | 'inventory' | 'tasks' | 'nomad';
+    /**
+     * ServiceResponse
+     * @description Define the service API response.
+     *
+     *     :param id: The primary key for the table. Auto-incremented and not nullable.
+     *     :type id: int | None
+     *     :param created_at: The timestamp when the record is created. Defaults to the current
+     *         time in UTC.
+     *     :type created_at: UTCDatetime
+     *     :param updated_at: The timestamp when the record is last updated. Automatically
+     *         updated on changes.
+     *     :type updated_at: UTCDatetime | None
+     *     :param external_id: An external identifier for the service.
+     *     :type external_id: NonEmptyStr | None
+     *     :param name: The name of the service.
+     *     :type name: NonEmptyStr
+     *     :param type: The type of the service (e.g., MYSQL, POSTGRESQL).
+     *     :type type: ServiceTypeEnum
+     *     :param port: The port number on which the service is running.
+     *     :type port: int | None
+     *     :param environment: The environment in which the service is running, if set.
+     *     :type environment: str | None
+     *     :param cluster: The cluster in which the service is running, if set.
+     *     :type cluster: str | None
+     *     :param replication_set: The replication set in which the service is running, if set.
+     *     :type replication_set: str | None
+     *     :param custom_labels: Custom labels associated with the service, if set.
+     *     :type custom_labels: dict[str, Any] | None
+     *     :param node_id: The unique identifier of the node on which the service is running.
+     *     :type node_id: int
+     *     :param schemas: A list of schemas associated with the service.
+     *     :type schemas: list[Schema]
+     *     :param node: The node to which the service is associated.
+     *     :type node: Node
+     */
+    ServiceResponse: {
+      /** Cluster */
+      cluster?: string | null;
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /** Custom Labels */
+      custom_labels?: Record<string, never> | null;
+      /** Environment */
+      environment?: string | null;
+      /** External Id */
+      external_id?: string | null;
+      /** Id */
+      id: number | null;
+      /** Name */
+      name: string;
+      node: components['schemas']['Node'];
+      /** Node Id */
+      node_id: number;
+      /** Port */
+      port?: number | null;
+      /** Replication Set */
+      replication_set?: string | null;
+      /** Schemas */
+      schemas: components['schemas']['Schema'][];
+      type: components['schemas']['ServiceTypeEnum'];
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * ServiceTypeEnum
+     * @description Enumerate the supported service types.
+     *
+     *     :cvar MYSQL: Represents the MySQL service type.
+     *     :vartype MYSQL: str
+     *     :cvar POSTGRESQL: Represents the PostgreSQL service type.
+     *     :vartype POSTGRESQL: str
+     *     :cvar MONGODB: Represents the MongoDB service type.
+     *     :vartype MONGODB: str
+     *     :cvar PROXYSQL: Represents the ProxySQL service type.
+     *     :vartype PROXYSQL: str
+     *     :cvar HAPROXY: Represents the HAProxy service type.
+     *     :vartype HAPROXY: str
+     *     :cvar EXTERNAL: Represents an external service type.
+     *     :vartype EXTERNAL: str
+     *     :cvar VALKEY: Represents the Valkey service type.
+     *     :vartype VALKEY: str
+     * @enum {string}
+     */
+    ServiceTypeEnum:
+      | 'mysql'
+      | 'postgresql'
+      | 'mongodb'
+      | 'proxysql'
+      | 'haproxy'
+      | 'external'
+      | 'valkey';
+    /**
+     * SettingClassEnum
+     * @description Enumerate settings classes that may have HOT override rows.
+     *
+     *     The wired classes are ``SEPSettings``, ``TasksSettings``,
+     *     ``SnippetsSettings``, ``MessagesSettings``, the global ``Settings``,
+     *     ``AlertSettings``, ``AlertsSettings``, ``AnonymizerSettings`` and
+     *     ``InventorySettings``.
+     *
+     *     To wire a new settings class:
+     *
+     *     1. Add a member here whose value matches the Pydantic class ``__name__``.
+     *     2. Generate an Alembic migration on every consumer track that extends the
+     *        ``CHECK`` constraint on ``settingoverride.setting_class``. The column
+     *        uses ``native_enum=False`` so the value list lives in a constraint,
+     *        not a PostgreSQL ``TYPE`` -- the migration ``ALTER``s the constraint.
+     *        Note that the column and ``CHECK`` constraint persist the enum member
+     *        *names* (e.g. ``SEP_SETTINGS``), which is distinct from the member
+     *        *value* (the Pydantic class name, e.g. ``SEPSettings``).
+     *     3. Wire a ``ProxyEntry`` for the new class in the relevant service's
+     *        lifespan (``app/sep/main.py`` or ``app/tasks/main.py``).
+     * @enum {string}
+     */
+    SettingClassEnum:
+      | 'SEPSettings'
+      | 'TasksSettings'
+      | 'SnippetsSettings'
+      | 'MessagesSettings'
+      | 'Settings'
+      | 'AlertSettings'
+      | 'AnonymizerSettings'
+      | 'AlertsSettings'
+      | 'InventorySettings';
+    /**
+     * SettingClassGroup
+     * @description One settings-class group in the LIST response.
+     *
+     *     :param setting_class: The settings class this group represents.
+     *     :type setting_class: SettingClassEnum
+     *     :param settings: The fields declared on the settings class, with their
+     *         current values and metadata.
+     *     :type settings: list[SettingResponse]
+     *     :param is_app_owned: Whether this group belongs to a SEP app under
+     *         ``app/sep/apps/`` rather than core SEP wiring.
+     *     :type is_app_owned: bool
+     *     :param app_id: The owning app's registry key when ``is_app_owned`` is
+     *         ``True``; ``None`` for core groups.
+     *     :type app_id: str | None
+     *     :param app_display_name: The owning app's human-facing label when
+     *         ``is_app_owned`` is ``True``; ``None`` for core groups.
+     *     :type app_display_name: str | None
+     *     :param app_enabled: Whether the owning app is currently enabled when
+     *         ``is_app_owned`` is ``True``; ``None`` for core groups. Disabled
+     *         apps remain listed so the frontend can hide them without a second
+     *         lookup.
+     *     :type app_enabled: bool | None
+     */
+    SettingClassGroup: {
+      /** App Display Name */
+      app_display_name?: string | null;
+      /** App Enabled */
+      app_enabled?: boolean | null;
+      /** App Id */
+      app_id?: string | null;
+      /**
+       * Is App Owned
+       * @default false
+       */
+      is_app_owned: boolean;
+      setting_class: components['schemas']['SettingClassEnum'];
+      /** Settings */
+      settings: components['schemas']['SettingResponse'][];
+    };
+    /**
+     * SettingResponse
+     * @description Represent a single setting's metadata and current value.
+     *
+     *     :param setting_class: The settings class the field belongs to.
+     *     :param key: The field name on the settings class.
+     *     :param key_path: Carry the canonical key segments for ``key`` such that
+     *         ``"__".join(key_path) == key``.
+     *     :param value: The current value visible through the proxy, dumped to a
+     *         JSON-safe shape via the field's annotation. ``SecretStr`` fields are
+     *         redacted to ``"**********"``.
+     *     :param default_value: The field's declared default value, dumped via the
+     *         same JSON serialiser. ``None`` when no default exists.
+     *     :param type: A human-readable representation of the field's declared
+     *         annotation (for operator visibility; validation uses the actual
+     *         ``FieldInfo``).
+     *     :param reload: The reload classification (HOT or NOT_OVERRIDABLE).
+     *     :param description: The field's free-text description, or ``None``.
+     *     :param is_secret: Whether the field's annotation contains a Pydantic secret
+     *         (``SecretStr`` / ``SecretBytes``) at any depth.
+     *     :param is_complex: Whether the field's annotation is or contains a Pydantic
+     *         ``BaseModel`` subclass (true for nested submodels).
+     *     :param has_override: Whether a row exists in the ``settingoverride`` table
+     *         for this ``(setting_class, key)`` pair, regardless of ``is_active``.
+     *     :param is_advanced: Whether the setting is flagged ``advanced`` so the UI can
+     *         present it separately from everyday settings. Display-only:
+     *         it does not affect PATCH/DELETE eligibility.
+     *     :param is_applicable: Whether the setting applies under current runtime state
+     *         (e.g. the active auth provider). ``False`` lets the UI present the field
+     *         as inert. Display-only, like ``is_advanced``: it does not block
+     *         PATCH/DELETE server-side; the runtime gate is the real enforcement.
+     */
+    SettingResponse: {
+      /** Default Value */
+      default_value: unknown;
+      /** Description */
+      description: string | null;
+      /** Has Override */
+      has_override: boolean;
+      /**
+       * Is Advanced
+       * @default false
+       */
+      is_advanced: boolean;
+      /**
+       * Is Applicable
+       * @default true
+       */
+      is_applicable: boolean;
+      /** Is Complex */
+      is_complex: boolean;
+      /** Is Secret */
+      is_secret: boolean;
+      /** Key */
+      key: string;
+      /** Key Path */
+      key_path?: string[];
+      reload: components['schemas']['ReloadClassification'];
+      setting_class: components['schemas']['SettingClassEnum'];
+      /** Type */
+      type: string;
+      /** Value */
+      value: unknown;
+    };
+    /**
+     * SettingsListResponse
+     * @description The LIST endpoint response, grouping settings by class.
+     *
+     *     :param groups: One :class:`SettingClassGroup` per settings class the
+     *         router was configured with.
+     *     :type groups: list[SettingClassGroup]
+     */
+    SettingsListResponse: {
+      /** Groups */
+      groups: components['schemas']['SettingClassGroup'][];
+    };
+    /**
+     * SettingsPatch
+     * @description Batch PATCH payload: a flat ``{field_name: new_value, ...}`` mapping.
+     *
+     *     An empty body is rejected as 422 because a no-op PATCH is a client bug, not
+     *     a valid request. The server coerces each value to the field's declared
+     *     type via :func:`coerce_field_value`; validation is all-or-nothing -- if any
+     *     key fails, nothing is written.
+     */
+    SettingsPatch: {
+      [key: string]: components['schemas']['JsonValue'];
+    };
+    /**
+     * SnippetApprovalFilter
+     * @description Enumerate the approval-status filter selections.
+     *
+     *     :cvar ALL: Do not filter on approval status.
+     *     :cvar APPROVED: Keep only approved snippets (``approved_at IS NOT NULL``).
+     *     :cvar NOT_APPROVED: Keep only unapproved snippets (``approved_at IS NULL``).
+     * @enum {string}
+     */
+    SnippetApprovalFilter: 'all' | 'approved' | 'not_approved';
+    /**
+     * SnippetBatchApproveRequest
+     * @description Represent the JSON body for ``PATCH /api/apps/snippets/approvals``.
+     *
+     *     Unlike the Form-bound :class:`~app.sep.snippets.deps.SnippetBatchApproveForm`
+     *     twin this is a plain Pydantic body — no ``Form()`` annotations — so FastAPI
+     *     parses it as JSON.
+     *
+     *     :param filenames: Unique, non-empty list of snippet filenames to approve in a
+     *         single atomic operation. Duplicates are silently deduplicated by
+     *         ``UniqueList``.
+     */
+    SnippetBatchApproveRequest: {
+      /** Filenames */
+      filenames: string[];
+    };
+    /**
+     * SnippetResponse
+     * @description Represent a snippet entity as exposed by the JSON API.
+     *
+     *     :param filename: The snippet's filename on disk; doubles as its
+     *         identifier in the API.
+     *     :type filename: NonEmptyStr
+     *     :param title: The display title for the snippet (snippet metadata's
+     *         ``title`` field, falling back to ``filename`` when unset).
+     *     :type title: NonEmptyStr
+     *     :param description: The snippet's free-text description, or an empty
+     *         string when no description is set in metadata.
+     *     :type description: str
+     *     :param service_type: The snippet's free-form service type
+     *         (``service_type`` metadata field, for example ``"mysql"`` or
+     *         ``"mongodb"``), or ``None`` when the snippet declares no service
+     *         type. Distinct from the inventory ``ServiceTypeEnum``.
+     *     :type service_type: str | None
+     *     :param size: Snippet file size in bytes.
+     *     :type size: int
+     *     :param md5_digest: 32-character MD5 hex digest of the snippet file.
+     *     :type md5_digest: str
+     *     :param is_approved: Whether the snippet has been approved for execution.
+     *     :type is_approved: bool
+     *     :param approved_at: When the snippet was last approved, or ``None`` if
+     *         unapproved.
+     *     :type approved_at: datetime | None
+     *     :param updated_by: User id that last toggled the approval state, or
+     *         ``None`` if no toggle has occurred.
+     *     :type updated_by: str | None
+     *     :param reason: Free-form reason recorded the last time the snippet's
+     *         approval state changed.
+     *     :type reason: str
+     *     :param requires_sudo: Whether the snippet requires sudo for execution
+     *         (either always-sudo or sudo is user-toggleable).
+     *     :type requires_sudo: bool
+     *     :param sudo_optional: Whether the user can toggle sudo at execution
+     *         time.
+     *     :type sudo_optional: bool
+     *     :param sudo_default: Default value for the sudo toggle when
+     *         ``sudo_optional`` is ``True``.
+     *     :type sudo_default: bool
+     *     :param interpreter: The shell/interpreter command used to execute the
+     *         snippet (for example, ``"bash"`` or ``"python3"``); ``None`` when
+     *         no interpreter mapping resolves.
+     *     :type interpreter: str | None
+     *     :param created_at: When the snippet row was first inserted.
+     *     :type created_at: datetime
+     *     :param updated_at: When the snippet row was last updated, or ``None``
+     *         if never updated since insert.
+     *     :type updated_at: datetime | None
+     */
+    SnippetResponse: {
+      /** Approved At */
+      approved_at?: string | null;
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at: string;
+      /** Description */
+      description: string;
+      /** Filename */
+      filename: string;
+      /** Interpreter */
+      interpreter?: string | null;
+      /** Is Approved */
+      is_approved: boolean;
+      /** Md5 Digest */
+      md5_digest: string;
+      /** Reason */
+      reason: string;
+      /** Requires Sudo */
+      requires_sudo: boolean;
+      /** Service Type */
+      service_type?: string | null;
+      /** Size */
+      size: number;
+      /** Sudo Default */
+      sudo_default: boolean;
+      /** Sudo Optional */
+      sudo_optional: boolean;
+      /** Title */
+      title: string;
+      /** Updated At */
+      updated_at?: string | null;
+      /** Updated By */
+      updated_by?: string | null;
+    };
+    /**
+     * SnippetServiceTypesResponse
+     * @description Carry the whole-dataset service-type facet for the list filter.
+     *
+     *     Sourced across every snippet (not the loaded page) so the list page's
+     *     service-type dropdown can offer every value the dataset contains.
+     *
+     *     :param service_types: The sorted distinct non-blank service types.
+     *     :param has_uncategorized: Whether any snippet has an absent or blank service
+     *         type (surfaced as the "Uncategorized" filter option).
+     */
+    SnippetServiceTypesResponse: {
+      /** Has Uncategorized */
+      has_uncategorized: boolean;
+      /** Service Types */
+      service_types: string[];
+    };
+    /**
+     * SnippetSortDirection
+     * @description Enumerate the sort direction.
+     *
+     *     :cvar ASC: Ascending order.
+     *     :cvar DESC: Descending order.
+     * @enum {string}
+     */
+    SnippetSortDirection: 'asc' | 'desc';
+    /**
+     * SnippetSortKey
+     * @description Enumerate the allowlisted public sort keys.
+     *
+     *     Membership is the type: an out-of-allowlist key fails to coerce at the
+     *     request boundary, so no raw client-supplied column name can reach a query.
+     *
+     *     :cvar CREATED_AT: Sort by the ``created_at`` column.
+     *     :cvar FILENAME: Sort by the ``filename`` column.
+     *     :cvar APPROVED_AT: Sort by the ``approved_at`` column.
+     *     :cvar TITLE: Sort by the ``meta.title`` JSON value.
+     *     :cvar SERVICE_TYPE: Sort by the ``meta.service_type`` JSON value.
+     * @enum {string}
+     */
+    SnippetSortKey:
+      | 'created_at'
+      | 'filename'
+      | 'approved_at'
+      | 'title'
+      | 'service_type';
+    /**
+     * SnippetsCapabilitiesResponse
+     * @description Represent per-deployment capability flags for the Snippets plugin.
+     *
+     *     Exposes flags that gate the visibility of admin-only UI affordances
+     *     (currently the manual refresh button) so the React shell can decide
+     *     whether to render those controls without probing the gated endpoints.
+     *
+     *     Distinct from :class:`~app.sep.apps.framework.schema.Capabilities`,
+     *     which describes static UI feature flags on
+     *     :attr:`~app.sep.apps.framework.schema.AppSchema.capabilities`
+     *     (chaining, scheduling, alert_on_fail). This model is the per-
+     *     deployment runtime counterpart returned by ``GET /capabilities``.
+     *
+     *     :param manual_sync_enabled: Whether manual snippet refresh is enabled
+     *         in this deployment (mirrors ``snippets_settings.ENABLE_MANUAL_SYNC``).
+     *     :type manual_sync_enabled: bool
+     */
+    SnippetsCapabilitiesResponse: {
+      /** Manual Sync Enabled */
+      manual_sync_enabled: boolean;
+    };
+    /**
+     * SourceEnum
+     * @description Enumeration of possible data sources for a node.
+     *
+     *     :cvar PMM: Represents the PMM data source.
+     *     :vartype PMM: str
+     * @constant
+     * @enum {string}
+     */
+    SourceEnum: 'pmm';
+    /**
+     * TaskBackendEnum
+     * @description Control the choice of backends.
+     *
+     *     :cvar NOMAD: Enum value for Nomad backend.
+     *     :vartype NOMAD: str
+     *     :cvar PROXY: Enum value for Proxy backend.
+     *     :vartype PROXY: str
+     *     :cvar CELERY: Enum value for Celery backend.
+     *     :vartype CELERY: str
+     * @enum {string}
+     */
+    TaskBackendEnum: 'nomad' | 'proxy' | 'celery';
+    /**
+     * TaskExecutionRequest
+     * @description Represent an execution request.
+     *
+     *     :param task: The task name.
+     *     :type task: str
+     *     :param target: The target system or environment.
+     *     :type target: str
+     *     :param meta: Additional metadata for the task. Defaults to an empty dictionary.
+     *     :type meta: dict | None
+     *     :param payload: Optional payload or file path for parameterizing the task.
+     *         Defaults to None.
+     *     :type payload: str | None
+     *     :param tracking: Tracking information for task execution. Defaults to a dictionary
+     *         with keys for allocation and evaluation IDs.
+     *     :type tracking: dict | None
+     */
+    TaskExecutionRequest: {
+      /** Eta */
+      eta?: string | null;
+      /**
+       * Meta
+       * @default {}
+       */
+      meta: Record<string, never> | null;
+      /** Payload */
+      payload?: string | null;
+      /** Target */
+      target: string;
+      /** Task */
+      task: string;
+      /**
+       * Tracking
+       * @default {}
+       */
+      tracking: Record<string, never> | null;
+    } & {
+      [key: string]: unknown;
+    };
+    /**
+     * TaskHistoryResponse
+     * @description Represent a task history API response.
+     *
+     *     :param execution_request: The request that triggered the task execution.
+     *     :type execution_request: TaskExecutionRequest
+     *     :param status: The status of the task execution.
+     *     :type status: TaskHistoryStatusEnum
+     *     :param started_at: The datetime when the task execution started.
+     *     :type started_at: UTCDatetime | None
+     *     :param finished_at: The datetime when the task execution finished.
+     *     :type finished_at: UTCDatetime | None
+     *     :param anonymize_mask: The bitmask representing PII entities to be anonymized in
+     *         logs and files generated by the execution. Defaults to None, meaning it uses
+     *         the value defined in the associated task's :attr:`Task.anonymize_mask`.
+     *     :type anonymize_mask: int | None
+     *     :param task: The task associated with this execution history.
+     *     :type task: TaskResponse
+     *     :param executed_by: The user ID of the user who executed the task.
+     *     :type executed_by: str | None
+     *     :param has_logs: Whether this task history has any readable log content --
+     *         either a chunk-store row or a legacy ``tracking["task_logs"]`` blob.
+     *         Populated by list/retrieve routes; defaults to ``False``.
+     *     :type has_logs: bool
+     *     :param display_name: A user-meaningful label derived from the task name or
+     *         execution-request metadata. Read-only; computed on serialisation.
+     */
+    TaskHistoryResponse: {
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /**
+       * Display Name
+       * @description Return a user-meaningful display label for this task history row.
+       *
+       *     For normal tasks, returns ``task.name``. For generic executor templates
+       *     (``run-python``, ``exec-artifact``, ``exec-python-artifact``), builds a
+       *     ``"<source>/<filename> on <target>"`` label so otherwise-identical rows
+       *     are distinguishable: the filename comes from the snippet metadata or the
+       *     ``file://`` payload basename, the source directory from whichever of those
+       *     carries one, and the target from the execution request. Falls back to
+       *     ``"<task> on <target>"`` when no filename is available.
+       *
+       *     :return: The display label for the task history entry.
+       */
+      readonly display_name: string;
+      /**
+       * Duration
+       * @description Return the duration of the task execution in seconds.
+       *
+       *     :return: The duration in seconds, or None if not available.
+       *     :rtype: float | None
+       */
+      readonly duration: number | null;
+      /** Executed By */
+      executed_by?: string | null;
+      execution_request: components['schemas']['TaskExecutionRequest'];
+      /** Finished At */
+      finished_at?: string | null;
+      /**
+       * Has Logs
+       * @default false
+       */
+      has_logs: boolean;
+      /** Id */
+      id: number | null;
+      /** Started At */
+      started_at?: string | null;
+      /** @default pending */
+      status: components['schemas']['TaskHistoryStatusEnum'];
+      task: components['schemas']['TaskResponse'];
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * TaskHistoryStatusEnum
+     * @description Define status codes for task executions.
+     *
+     *     :cvar FAILED: Enum value for failed tasks.
+     *     :vartype FAILED: str
+     *     :cvar PENDING: Enum value for pending tasks.
+     *     :vartype PENDING: str
+     *     :cvar RUNNING: Enum value for running tasks.
+     *     :vartype RUNNING: str
+     *     :cvar SUCCESS: Enum value for successfully completed tasks.
+     *     :vartype SUCCESS: str
+     *     :cvar STOPPED: Enum value for stopped tasks.
+     *     :vartype STOPPED: str
+     *     :cvar LOST: Enum value for tasks that are lost.
+     *     :vartype LOST: str
+     *     :cvar STALE: Enum value for tasks skipped because Nomad placement
+     *         exceeded the configured staleness threshold.
+     *     :vartype STALE: str
+     * @enum {string}
+     */
+    TaskHistoryStatusEnum:
+      | 'failed'
+      | 'pending'
+      | 'running'
+      | 'success'
+      | 'stopped'
+      | 'lost'
+      | 'stale';
+    /**
+     * TaskResponse
+     * @description Represent a task API response.
+     *
+     *     :param name: The name of the task.
+     *     :param data: The task data stored in JSON format.
+     *     :param backend: The backend used for task execution. Defaults to Nomad.
+     *     :param owner: The owner of the task. Defaults to ``"ANY"``.
+     *     :param is_template: Whether the task is a template. Defaults to False.
+     *     :param protected: Whether the task is protected from deletion. Defaults to False.
+     *     :param alert_on_fail: Whether to trigger an alert on task failure and
+     *         auto-resolve it on subsequent success. Defaults to False.
+     *     :param alert_detail_builder: The ``"module:function"`` path of a plugin
+     *         callable that enriches this task's failure alert, or None.
+     *     :param run_result_recorder: The ``"module:function"`` path of a plugin
+     *         callable that records this task's structured run result at terminal
+     *         status, or None.
+     *     :param output_files_path: The allocation-relative path where output files
+     *         generated by the task are expected, or None.
+     *     :param deleted_at: The deletion timestamp, if applicable.
+     *     :param anonymize_mask: The bitmask representing PII entities to be anonymized in
+     *         logs and files generated by the task. Defaults to 0 (no anonymization).
+     *     :param created_by: The user ID of the user who created the task.
+     *     :param last_updated_by: The user ID of the user who last modified the task.
+     *     :param anonymized_entities: Sorted list of PII entity names derived from
+     *         ``anonymize_mask`` (or from the owner's configured defaults when the
+     *         mask is ``None``). Each name is the raw ``PIIEntity`` member name
+     *         (e.g. ``"EMAIL_ADDRESS"``). Read-only; computed on serialisation.
+     */
+    TaskResponse: {
+      /** Alert Detail Builder */
+      alert_detail_builder?: string | null;
+      /**
+       * Alert On Fail
+       * @default false
+       */
+      alert_on_fail: boolean;
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Anonymized Entities
+       * @description Return sorted PII entity names decoded from ``anonymize_mask``.
+       */
+      readonly anonymized_entities: string[];
+      /** @default nomad */
+      backend: components['schemas']['TaskBackendEnum'];
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /** Created By */
+      created_by: string | null;
+      /** Data */
+      data: Record<string, never>;
+      /** Deleted At */
+      deleted_at: string | null;
+      /** Id */
+      id: number | null;
+      /**
+       * Is Template
+       * @default false
+       */
+      is_template: boolean;
+      /** Last Updated By */
+      last_updated_by: string | null;
+      /** Name */
+      name: string;
+      /** Output Files Path */
+      output_files_path?: string | null;
+      /**
+       * Owner
+       * @default ANY
+       */
+      owner: string;
+      /**
+       * Protected
+       * @default false
+       */
+      protected: boolean;
+      /** Run Result Recorder */
+      run_result_recorder?: string | null;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /** ValidationError */
+    ValidationError: {
+      /** Context */
+      ctx?: Record<string, never>;
+      /** Input */
+      input?: unknown;
+      /** Location */
+      loc: (string | number)[];
+      /** Message */
+      msg: string;
+      /** Error Type */
+      type: string;
+    };
+    /**
+     * AlertDetailResponse
+     * @description Wrap the response for the alert detail endpoint.
+     *
+     *     :param alert: The alert metadata.
+     *     :type alert: AlertInfo
+     *     :param snippets: Snippets associated with this alert.
+     *     :type snippets: list[SnippetResponse]
+     */
+    alert_troubleshooting__AlertDetailResponse: {
+      alert: components['schemas']['alert_troubleshooting__AlertInfo'];
+      /** Snippets */
+      snippets: components['schemas']['SnippetResponse'][];
+    };
+    /**
+     * AlertGroup
+     * @description Group alerts sharing a service type.
+     *
+     *     :param service_type: The service type enum value.
+     *     :type service_type: AlertServiceType
+     *     :param label: Human-readable label for the service type.
+     *     :type label: str
+     *     :param alerts: Alerts belonging to this group.
+     *     :type alerts: list[AlertSummary]
+     */
+    alert_troubleshooting__AlertGroup: {
+      /** Alerts */
+      alerts: components['schemas']['alert_troubleshooting__AlertSummary'][];
+      /** Label */
+      label: string;
+      service_type: components['schemas']['AlertServiceType'];
+    };
+    /**
+     * AlertInfo
+     * @description Represent a normalized alert entry with its identifier and display label.
+     *
+     *     Accept a plain string identifier, a dict with ``name`` (required) and
+     *     optional ``label`` and ``service_type``, or keyword arguments.  Invalid
+     *     inputs raise ``ValidationError``.  The ``service_type`` field is optional
+     *     and, when absent, callers fall back to the snippet-level ``service_type``.
+     *
+     *     :param name: The alert identifier as declared in snippet frontmatter.
+     *     :type name: NonEmptyStr
+     *     :param label: The human-readable display label for the alert.
+     *     :type label: str
+     *     :param service_type: The service type the alert applies to, overriding
+     *         the snippet-level ``service_type``.  ``None`` means "fall back to the
+     *         snippet-level value".
+     *     :type service_type: AlertServiceType | None
+     */
+    alert_troubleshooting__AlertInfo: {
+      /** Label */
+      label: string;
+      /** Name */
+      name: string;
+      service_type?: components['schemas']['AlertServiceType'] | null;
+    };
+    /**
+     * AlertSummary
+     * @description Represent a minimal alert for the listing endpoint.
+     *
+     *     :param name: The alert identifier.
+     *     :type name: str
+     *     :param label: The human-readable display label.
+     *     :type label: str
+     */
+    alert_troubleshooting__AlertSummary: {
+      /** Label */
+      label: string;
+      /** Name */
+      name: string;
+    };
+    /**
+     * BackupDetail
+     * @description Describe the full detail response for a single backup.
+     *
+     *     :param id: Primary key of the backup row.
+     *     :param created_at: UTC timestamp the backup was written.
+     *     :param templates: Templates captured in the backup.
+     *     :param rules: Rules captured in the backup.
+     *     :param contact_points: Contact points captured in the backup.
+     *     :param folders: Folders captured in the backup.
+     *     :param notification_policy_receiver: Top-level receiver from the captured
+     *         notification policy, or ``None`` when no policy was captured.
+     */
+    alerts__BackupDetail: {
+      /** Contact Points */
+      contact_points: components['schemas']['alerts__BackupDetailContactPoint'][];
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at: string;
+      /** Folders */
+      folders: components['schemas']['alerts__BackupDetailFolder'][];
+      /** Id */
+      id: number;
+      /** Notification Policy Receiver */
+      notification_policy_receiver: string | null;
+      /** Rules */
+      rules: components['schemas']['alerts__BackupDetailRule'][];
+      /** Templates */
+      templates: components['schemas']['alerts__BackupDetailTemplate'][];
+    };
+    /**
+     * BackupDetailContactPoint
+     * @description Represent a contact-point entry inside a backup snapshot.
+     *
+     *     :param name: The contact point name.
+     *     :param type: The contact point type (e.g. ``"pagerduty"``).
+     */
+    alerts__BackupDetailContactPoint: {
+      /** Name */
+      name: string;
+      /** Type */
+      type: string;
+    };
+    /**
+     * BackupDetailFolder
+     * @description Represent a folder entry inside a backup snapshot.
+     *
+     *     :param title: The folder title.
+     */
+    alerts__BackupDetailFolder: {
+      /** Title */
+      title: string;
+    };
+    /**
+     * BackupDetailRule
+     * @description Represent a rule entry inside a backup snapshot.
+     *
+     *     :param title: The rule title.
+     */
+    alerts__BackupDetailRule: {
+      /** Title */
+      title: string;
+    };
+    /**
+     * BackupDetailTemplate
+     * @description Represent a template entry inside a backup snapshot.
+     *
+     *     :param name: The template name.
+     *     :param summary: The template summary blurb.
+     */
+    alerts__BackupDetailTemplate: {
+      /** Name */
+      name: string;
+      /** Summary */
+      summary: string;
+    };
+    /**
+     * BackupSummary
+     * @description Represent a compact backup row used by the list endpoint.
+     *
+     *     :param id: Primary key of the backup row.
+     *     :param created_at: UTC timestamp the backup was written.
+     *     :param metadata: Summary counts persisted alongside the backup snapshot.
+     */
+    alerts__BackupSummary: {
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at: string;
+      /** Id */
+      id: number;
+      /** Metadata */
+      metadata: Record<string, never>;
+    };
+    /**
+     * IndexBackupSummary
+     * @description Represent a compact backup row for the index "recent backups" widget.
+     *
+     *     Leaner than :class:`BackupSummary` (no ``metadata``): the list page only
+     *     renders the id and timestamp, so the index payload omits the summary counts.
+     *
+     *     :param id: Primary key of the backup row.
+     *     :param created_at: UTC timestamp the backup was written.
+     */
+    alerts__IndexBackupSummary: {
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at: string;
+      /** Id */
+      id: number;
+    };
+    /**
+     * IndexPagerDutyStatus
+     * @description Describe the PagerDuty contact-point status on the index page.
+     *
+     *     :param configured: ``True`` when a SEP PagerDuty contact point exists in PMM.
+     *     :param uid: The contact point UID when configured, otherwise ``None``.
+     */
+    alerts__IndexPagerDutyStatus: {
+      /** Configured */
+      configured: boolean;
+      /** Uid */
+      uid?: string | null;
+    };
+    /**
+     * IndexResponse
+     * @description Describe the response body for ``GET /api/apps/alerts/``.
+     *
+     *     Aggregate everything the React list page needs in a single call: the alert
+     *     templates grouped by service type, whether PMM is reachable, the PagerDuty
+     *     contact-point status, and the most recent backups.
+     *
+     *     :param groups: Alert templates grouped by service type. Only service types
+     *         with at least one template are included.
+     *     :param pmm_connected: ``True`` when PMM is configured and reachable.
+     *     :param pagerduty: The PagerDuty status, or ``None`` when PMM is unreachable.
+     *     :param recent_backups: The most recent alert backups, newest first.
+     */
+    alerts__IndexResponse: {
+      /** Groups */
+      groups: components['schemas']['alerts__IndexTemplateGroup'][];
+      pagerduty: components['schemas']['alerts__IndexPagerDutyStatus'] | null;
+      /** Pmm Connected */
+      pmm_connected: boolean;
+      /** Recent Backups */
+      recent_backups: components['schemas']['alerts__IndexBackupSummary'][];
+    };
+    /**
+     * IndexTemplate
+     * @description Represent a single alert template row on the index page.
+     *
+     *     :param name: The display name of the alert template.
+     *     :param service_type: The service category this template applies to.
+     *     :param expression: The PromQL expression backing the alert.
+     *     :param default_threshold: The default numeric threshold for the UI.
+     *     :param severity: The severity level (``"info"``, ``"warning"``, ``"critical"``).
+     *     :param description: A human-readable description of the alert.
+     *     :param summary: A short summary template for notifications.
+     *     :param in_pmm: ``True`` when a template of this name is already present in PMM.
+     */
+    alerts__IndexTemplate: {
+      /** Default Threshold */
+      default_threshold: number;
+      /** Description */
+      description: string;
+      /** Expression */
+      expression: string;
+      /** In Pmm */
+      in_pmm: boolean;
+      /** Name */
+      name: string;
+      /** Service Type */
+      service_type: string;
+      /** Severity */
+      severity: string;
+      /** Summary */
+      summary: string;
+    };
+    /**
+     * IndexTemplateGroup
+     * @description Group index templates by service type.
+     *
+     *     :param service_type: The service type identifier (e.g. ``"mysql"``).
+     *     :param label: The human-readable service type label (e.g. ``"MySQL"``).
+     *     :param templates: The templates belonging to this service type.
+     */
+    alerts__IndexTemplateGroup: {
+      /** Label */
+      label: string;
+      /** Service Type */
+      service_type: string;
+      /** Templates */
+      templates: components['schemas']['alerts__IndexTemplate'][];
+    };
+    /**
+     * PagerDutyRequest
+     * @description Describe the request body for ``POST /api/apps/alerts/pagerduty``.
+     *
+     *     :param integration_key: The PagerDuty integration key. Must be non-empty
+     *         after stripping whitespace.
+     */
+    alerts__PagerDutyRequest: {
+      /** Integration Key */
+      integration_key: string;
+    };
+    /**
+     * PagerDutyResponse
+     * @description Describe the response body for the PagerDuty save / delete endpoints.
+     *
+     *     :param status: ``"created"``, ``"updated"`` (save) or ``"deleted"`` (delete).
+     */
+    alerts__PagerDutyResponse: {
+      /**
+       * Status
+       * @enum {string}
+       */
+      status: 'created' | 'updated' | 'deleted';
+    };
+    /** PaginatedResponse[BackupSummary] */
+    alerts__PaginatedResponse_BackupSummary_: {
+      /** Items */
+      items: components['schemas']['alerts__BackupSummary'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /**
+     * PushItemResult
+     * @description Represent a per-template result row returned by the push endpoint.
+     *
+     *     :param name: The template name the result applies to.
+     *     :param status: One of ``"success"``, ``"skipped"``, ``"error"``.
+     *     :param message: A human-readable description of the outcome.
+     */
+    alerts__PushItemResult: {
+      /** Message */
+      message: string;
+      /** Name */
+      name: string;
+      /**
+       * Status
+       * @enum {string}
+       */
+      status: 'success' | 'skipped' | 'error';
+    };
+    /**
+     * PushRequest
+     * @description Describe the request body for ``POST /api/apps/alerts/push``.
+     *
+     *     :param selected_templates: Names of templates to push to PMM. Must be a
+     *         non-empty list of non-empty strings.
+     */
+    alerts__PushRequest: {
+      /** Selected Templates */
+      selected_templates: string[];
+    };
+    /**
+     * PushResponse
+     * @description Wrap the per-template results returned by the push endpoint.
+     *
+     *     :param results: One :class:`PushItemResult` per template in the request.
+     */
+    alerts__PushResponse: {
+      /** Results */
+      results: components['schemas']['alerts__PushItemResult'][];
+    };
+    /**
+     * RestoreRequest
+     * @description Describe the request body for ``POST /api/apps/alerts/restore``.
+     *
+     *     :param backup_id: Primary key of the :class:`~app.sep.apps.alerts.models.AlertBackup`
+     *         row to restore from. Must be a positive integer.
+     */
+    alerts__RestoreRequest: {
+      /** Backup Id */
+      backup_id: number;
+    };
+    /**
+     * RestoreResponse
+     * @description Wrap the summary returned by the restore endpoint.
+     *
+     *     :param status: ``"success"`` on a complete restore.
+     *     :param details: Per-section restore counts as returned by
+     *         :func:`~app.sep.apps.alerts.restore.restore_from_backup`.
+     */
+    alerts__RestoreResponse: {
+      /** Details */
+      details: Record<string, never>;
+      /**
+       * Status
+       * @constant
+       * @enum {string}
+       */
+      status: 'success';
+    };
+    /**
+     * AltersCreate
+     * @description Represent the single model-first declaration of the Alters create form.
+     *
+     *     This one declaration drives the JSON create/update request body, the Jinja
+     *     ``Form()`` body, and — via
+     *     :func:`~app.sep.apps.framework.form_dsl.derive_app_schema` — the
+     *     ``GET /schema`` source. The mutual-exclusion and ``dsn`` conditional rules are
+     *     enforced by ``AppFormModel`` inheritance (the field-level ``Requires`` /
+     *     ``Forbidden`` gates plus ``__form_rules__``), not by a decorator.
+     *
+     *     The schema-display defaults for ``dsn_table`` and ``progress`` diverge from the
+     *     request-body defaults: the body defaults both to the empty string (so the
+     *     ``dsn_table`` forbidden gate passes for non-``dsn`` recursion, and an omitted
+     *     ``progress`` emits no value), while the form renders the Percona-Toolkit DSN
+     *     table and ``time,10`` via ``Ui(default=...)``.
+     *
+     *     :param task_name: The name of the task to be created.
+     *     :param hostname: The target hostname for the task execution.
+     *     :param service_id: The Inventory ID of the database service to connect to.
+     *     :param db_schema: The schema to alter — an inventory id or a free-typed name.
+     *     :param db_table: The table to alter — an inventory id or a free-typed name.
+     *     :param recursion_method: The method for handling recursion.
+     *     :param alter: The specific alter command to be executed.
+     *     :param dsn_table: The DSN table for recursion method when using ``dsn``. When
+     *         recursion is ``dsn`` and this field is omitted or empty, it defaults to
+     *         ``D=percona,t=dsns`` (Percona Toolkit convention).
+     *     :param pause_file: Execution will be paused while the file specified by this param exists.
+     *     :param new_table_name: New table name before it is swapped.
+     *     :param print_arg: Print SQL statements to STDOUT.
+     *     :param progress: Print progress reports to STDERR while copying rows.
+     *     :param no_swap_tables: Swap the original table and the new, altered table.
+     *     :param no_drop_old_table: Drop the original table after renaming it.
+     *     :param no_drop_new_table: Drop the new table if copying the original table fails.
+     *     :param no_drop_triggers: Drop triggers on the old table.
+     *     :param tries: How many times to try critical operations.
+     *     :param set_vars: Set the MySQL variables in this comma-separated list of variable=value pairs.
+     *     :param critical_load: Examine SHOW GLOBAL STATUS after every chunk, and abort if the load is too high.
+     *     :param max_load: Examine SHOW GLOBAL STATUS after every chunk, and pause if any status variables are
+     *         higher than their thresholds.
+     *     :param chunk_time: Adjust the chunk size dynamically so each data-copy query takes this long to execute.
+     *     :param max_lag: Pause the data copy until all replicas lag is less than this value.
+     *     :param max_flow_ctl: Pause when PXC flow control exceeds this value.
+     *     :param extra_args: Additional command-line arguments to append to the pt-online-schema-change command.
+     *     :param pre_checks_mysql_config_file: Path to MySQL client defaults file on the executor
+     *         (user/password): pre-checks always use this path; execute/dry-run use pt-osc's
+     *         default ~/.my.cnf unless this is set to another path, then --defaults-file is added.
+     *     :param continue_on_pre_check_failure: When True, continue to the run task even if
+     *         pre-checks fail (overrides the schema's default ``on_failure="halt"`` policy).
+     */
+    alters__AltersCreate: {
+      /**
+       * Alert On Fail
+       * @default false
+       */
+      alert_on_fail: boolean;
+      /** Alter */
+      alter: string;
+      /** Chunk Time */
+      chunk_time?: string | null;
+      /**
+       * Continue On Pre Check Failure
+       * @default false
+       */
+      continue_on_pre_check_failure: boolean;
+      /** Critical Load */
+      critical_load?: string | null;
+      /** Db Schema */
+      db_schema: number | string;
+      /** Db Table */
+      db_table: number | string;
+      /**
+       * Dsn Table
+       * @default
+       */
+      dsn_table: string;
+      /** Extra Args */
+      extra_args?: string | null;
+      /** Hostname */
+      hostname: string;
+      /** Max Flow Ctl */
+      max_flow_ctl?: string | null;
+      /** Max Lag */
+      max_lag?: string | null;
+      /** Max Load */
+      max_load?: string | null;
+      /** New Table Name */
+      new_table_name?: string | null;
+      /**
+       * No Drop New Table
+       * @default false
+       */
+      no_drop_new_table: boolean;
+      /**
+       * No Drop Old Table
+       * @default false
+       */
+      no_drop_old_table: boolean;
+      /**
+       * No Drop Triggers
+       * @default false
+       */
+      no_drop_triggers: boolean;
+      /**
+       * No Swap Tables
+       * @default false
+       */
+      no_swap_tables: boolean;
+      /** Pause File */
+      pause_file?: string | null;
+      /**
+       * Pre Checks Mysql Config File
+       * @default ~/.my.cnf
+       */
+      pre_checks_mysql_config_file: string;
+      /**
+       * Print Arg
+       * @default false
+       */
+      print_arg: boolean;
+      /**
+       * Progress
+       * @default
+       */
+      progress: string;
+      /**
+       * Recursion Method
+       * @default processlist
+       */
+      recursion_method: string;
+      /** Service Id */
+      service_id: number;
+      /** Set Vars */
+      set_vars?: string | null;
+      /** Task Name */
+      task_name: string;
+      /** Tries */
+      tries?: string | null;
+    };
+    /**
+     * AltersTaskResponse
+     * @description Represent an alters task API response for list and detail surfaces.
+     *
+     *     Add no fields of its own — the alters list/detail surface is exactly the
+     *     shared task-response surface. The create/update routes return the
+     *     :data:`AltersTaskResponseCreate` / :data:`AltersTaskResponseUpdate` models
+     *     derived from this base, which add ``connectivity_warning`` per the
+     *     framework's derived create-response standard.
+     */
+    alters__AltersTaskResponse: {
+      /** Alert On Fail */
+      alert_on_fail: boolean;
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Anonymized Entities
+       * @description Return sorted PII entity names decoded from ``anonymize_mask``.
+       */
+      readonly anonymized_entities: string[];
+      backend: components['schemas']['TaskBackendEnum'];
+      connectivity_warning?:
+        | components['schemas']['framework__ConnectivityWarning']
+        | null;
+      /** Created At */
+      created_at?: string | null;
+      /** Created By */
+      created_by?: string | null;
+      /** Data */
+      data: Record<string, never>;
+      /** Id */
+      id?: number | null;
+      /** Last Executed At */
+      last_executed_at?: string | null;
+      /** Last Updated By */
+      last_updated_by?: string | null;
+      /** Name */
+      name: string;
+      /** Protected */
+      protected: boolean;
+      status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /** PaginatedResponse[AltersTaskResponse] */
+    alters__PaginatedResponse_AltersTaskResponse_: {
+      /** Items */
+      items: components['schemas']['alters__AltersTaskResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /**
+     * ArchivesCreate
+     * @description Represent an Archives creation form as a model-first ``TaskFormModel``.
+     *
+     *     Source, destination, and destination-host are discriminated-union one-of groups;
+     *     the schema / table / database references are collapsed free-solo fields
+     *     (``int`` inventory id or free-typed ``str`` name). The ``task_name`` /
+     *     ``hostname`` Task-section fields and the ``alert_on_fail`` capability control
+     *     are inherited from :class:`TaskFormModel`.
+     *
+     *     :param task_name: The human-readable task name; required and non-empty
+     *         (inherited from :class:`TaskFormModel`).
+     *     :param hostname: The executor host the task runs on; required and non-empty
+     *         (inherited from :class:`TaskFormModel`).
+     *     :param service_id: The inventory id of the source MySQL service (the host whose
+     *         rows are archived; the connectivity probe targets it).
+     *     :param swap_drop: The archive type; only ``PURGE_ONLY`` is currently supported.
+     *     :param source: The source rows, by schema+table or by query.
+     *     :param destination: The destination table or file; ``None`` when ``delete_data``.
+     *     :param host: The destination host, by service or manual entry; ``None`` reuses
+     *         the source host.
+     *     :param swp_table_suffix: The swap-table date suffix (SWAP_ARCHIVE_DROP only).
+     *     :param where: The WHERE clause filtering rows; required unless SWAP_DROP.
+     *     :param use_index: An index hint to optimise the query.
+     *     :param extra_args: Additional pt-archiver CLI arguments.
+     *     :param limit: The maximum rows per archiver run.
+     *     :param sleep: The sleep duration between chunk operations (seconds).
+     *     :param disable_binlog: Whether to disable binary logging for the operation.
+     *     :param disable_bulk_insert: Whether to disable the bulk-insert optimisation.
+     *     :param delete_data: Whether to delete source rows without archiving them.
+     */
+    archives__ArchivesCreate: {
+      /**
+       * Alert On Fail
+       * @default false
+       */
+      alert_on_fail: boolean;
+      /** Delete Data */
+      delete_data?: boolean | null;
+      /** Destination */
+      destination?:
+        | (
+            | components['schemas']['archives__DestByTable']
+            | components['schemas']['archives__DestByFile']
+          )
+        | null;
+      /** Disable Binlog */
+      disable_binlog?: boolean | null;
+      /** Disable Bulk Insert */
+      disable_bulk_insert?: boolean | null;
+      /** Extra Args */
+      extra_args?: string | null;
+      /** Host */
+      host?:
+        | (
+            | components['schemas']['archives__HostByService']
+            | components['schemas']['archives__HostManual']
+          )
+        | null;
+      /** Hostname */
+      hostname: string;
+      /** Limit */
+      limit?: number | null;
+      /** Service Id */
+      service_id: number;
+      /** Sleep */
+      sleep?: number | null;
+      /** Source */
+      source:
+        | components['schemas']['archives__SourceByTable']
+        | components['schemas']['archives__SourceByQuery'];
+      /**
+       * Swap Drop
+       * @default 0
+       */
+      swap_drop: number;
+      /** Swp Table Suffix */
+      swp_table_suffix?: string | null;
+      /** Task Name */
+      task_name: string;
+      /** Use Index */
+      use_index?: string | null;
+      /** Where */
+      where?: string | null;
+    };
+    /**
+     * DestByFile
+     * @description Represent a file destination.
+     *
+     *     :param mode: The one-of discriminator (``"file"``).
+     *     :param dest_file: The file path the archived rows are written to.
+     */
+    archives__DestByFile: {
+      /** Dest File */
+      dest_file: string;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      mode: 'file';
+    };
+    /**
+     * DestByTable
+     * @description Represent a table destination (collapsed free-solo references).
+     *
+     *     :param mode: The one-of discriminator (``"table"``).
+     *     :param dest_db: The destination schema — an inventory id, a free-typed name, or
+     *         ``None`` to reuse the source schema.
+     *     :param dest_table: The destination table — an inventory id or a free-typed name.
+     */
+    archives__DestByTable: {
+      /** Dest Db */
+      dest_db?: number | string | null;
+      /** Dest Table */
+      dest_table: number | string;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      mode: 'table';
+    };
+    /**
+     * HostByService
+     * @description Represent a destination host taken from an inventory service.
+     *
+     *     :param mode: The one-of discriminator (``"service"``).
+     *     :param dest_service: The inventory id of the destination MySQL service; its
+     *         node address and port supply the destination host and port.
+     */
+    archives__HostByService: {
+      /** Dest Service */
+      dest_service: number;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      mode: 'service';
+    };
+    /**
+     * HostManual
+     * @description Represent a manually-entered destination host.
+     *
+     *     :param mode: The one-of discriminator (``"manual"``).
+     *     :param dest_host: The destination host address.
+     *     :param dest_port: The destination port (1-65535); defaults to the MySQL port.
+     */
+    archives__HostManual: {
+      /** Dest Host */
+      dest_host: string;
+      /** Dest Port */
+      dest_port?: number | null;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      mode: 'manual';
+    };
+    /**
+     * SourceByQuery
+     * @description Represent a custom-query source selection.
+     *
+     *     :param mode: The one-of discriminator (``"query"``).
+     *     :param source_query: The query defining the rows to archive.
+     */
+    archives__SourceByQuery: {
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      mode: 'query';
+      /** Source Query */
+      source_query: string;
+    };
+    /**
+     * SourceByTable
+     * @description Represent a schema+table source selection (collapsed free-solo references).
+     *
+     *     :param mode: The one-of discriminator (``"table"``).
+     *     :param source_db: The source schema — an inventory id or a free-typed name.
+     *     :param source_table: The source table — an inventory id or a free-typed name.
+     */
+    archives__SourceByTable: {
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      mode: 'table';
+      /** Source Db */
+      source_db: number | string;
+      /** Source Table */
+      source_table: number | string;
+    };
+    /**
+     * ATWBatchExecuteItemResponse
+     * @description Describe the outcome of one item in a batch execution.
+     *
+     *     :param snippet_filename: The snippet this item requested.
+     *     :param task_name: The Tasks-API task name the snippet dispatched under, when
+     *         the dispatch itself succeeded.
+     *     :param task_history_id: The created task-history id, when the Tasks API
+     *         returned one.
+     *     :param error: The failure detail when the item did not complete — a message
+     *         or a validation-error list, depending on what rejected it.
+     */
+    atw__ATWBatchExecuteItemResponse: {
+      /** Error */
+      error?:
+        | string
+        | {
+            [key: string]: unknown;
+          }[]
+        | null;
+      /** Snippet Filename */
+      snippet_filename: string;
+      /** Task History Id */
+      task_history_id?: number | null;
+      /** Task Name */
+      task_name?: string | null;
+    };
+    /**
+     * ATWBatchExecuteItemWrite
+     * @description Define one snippet execution within a batch.
+     *
+     *     :param snippet_filename: The snippet to execute.
+     *     :param args: Per-snippet arguments keyed by frontmatter parameter name;
+     *         they override same-named entries in the batch's ``shared_args``.
+     */
+    atw__ATWBatchExecuteItemWrite: {
+      /**
+       * Args
+       * @default {}
+       */
+      args: {
+        [key: string]: unknown;
+      };
+      /** Snippet Filename */
+      snippet_filename: string;
+    };
+    /**
+     * ATWBatchExecuteResponse
+     * @description Collect every item's outcome for one batch execution.
+     *
+     *     Partial success lives in the body: the request is created (``201``) whenever
+     *     the incident resolves, and each item carries its own dispatch result or error.
+     *
+     *     :param items: One entry per requested item, in request order.
+     */
+    atw__ATWBatchExecuteResponse: {
+      /** Items */
+      items: components['schemas']['atw__ATWBatchExecuteItemResponse'][];
+    };
+    /**
+     * ATWBatchExecuteWrite
+     * @description Define the batch-execute payload for one incident.
+     *
+     *     :param executor_host: The executor every item in the batch runs on.
+     *     :param sudo: The sudo choice applied to every item; snippets whose sudo
+     *         option is not optional ignore it.
+     *     :param shared_args: Arguments offered to every item, filtered per snippet to
+     *         the parameters that snippet declares.
+     *     :param items: The snippets to execute, at least one and at most
+     *         ``MAX_BATCH_SNIPPETS``.
+     */
+    atw__ATWBatchExecuteWrite: {
+      /** Execution Host */
+      executor_host: string;
+      /** Items */
+      items: components['schemas']['atw__ATWBatchExecuteItemWrite'][];
+      /**
+       * Shared Args
+       * @default {}
+       */
+      shared_args: {
+        [key: string]: unknown;
+      };
+      /**
+       * Sudo
+       * @default false
+       */
+      sudo: boolean;
+    };
+    /**
+     * ATWCategoryListing
+     * @description Represent one ATW category row and its snippet members.
+     *
+     *     :param category_root: The top-level product/category root.
+     *     :type category_root: str
+     *     :param parent_category: The parent category enum name.
+     *     :type parent_category: str
+     *     :param parent_category_label: The parent category display label.
+     *     :type parent_category_label: str
+     *     :param category: The ATW leaf category enum name.
+     *     :type category: str
+     *     :param category_label: The ATW leaf category display label.
+     *     :type category_label: str
+     *     :param snippet_count: Number of snippets in this category.
+     *     :type snippet_count: int
+     *     :param snippets: Snippet summaries belonging to this category.
+     *     :type snippets: list[ATWSnippetSummary]
+     */
+    atw__ATWCategoryListing: {
+      /** Category */
+      category: string;
+      /** Category Label */
+      category_label: string;
+      /** Category Root */
+      category_root: string;
+      /** Parent Category */
+      parent_category: string;
+      /** Parent Category Label */
+      parent_category_label: string;
+      /** Snippet Count */
+      snippet_count: number;
+      /** Snippets */
+      snippets: components['schemas']['atw__ATWSnippetSummary'][];
+    };
+    /**
+     * ATWIncidentExecutionResponse
+     * @description Represent one recorded incident execution, hydrated with live task status.
+     *
+     *     The hydrated fields are ``None`` when the Tasks API could not be reached for
+     *     that row; the locally-recorded fields are always present.
+     *
+     *     :param id: The execution row's UUID primary key.
+     *     :param snippet_filename: The executed snippet's filename.
+     *     :param task_history_id: The tasks-service execution this row references.
+     *     :param created_at: When the execution was recorded.
+     *     :param task_status: The upstream execution status.
+     *     :param started_at: When the upstream execution started.
+     *     :param finished_at: When the upstream execution finished.
+     *     :param has_logs: Whether the upstream execution has readable logs.
+     *     :param masked_args: The command line the snippet ran with, credential values
+     *         replaced by a fixed-width mask. ``None`` together with
+     *         ``args_withheld=False`` means the execution recorded no arguments.
+     *         Defaults to ``None``.
+     *     :param args_withheld: Whether the arguments were suppressed because they
+     *         could not be masked safely -- distinguishing that from an execution that
+     *         genuinely ran with none. Defaults to ``False``.
+     */
+    atw__ATWIncidentExecutionResponse: {
+      /**
+       * Args Withheld
+       * @default false
+       */
+      args_withheld: boolean;
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at: string;
+      /** Finished At */
+      finished_at?: string | null;
+      /** Has Logs */
+      has_logs?: boolean | null;
+      /**
+       * Id
+       * Format: uuid4
+       */
+      id: string;
+      /** Masked Args */
+      masked_args?: string | null;
+      /** Snippet Filename */
+      snippet_filename: string;
+      /** Started At */
+      started_at?: string | null;
+      /** Task History Id */
+      task_history_id: number;
+      task_status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+    };
+    /**
+     * ATWMergedSchemaResponse
+     * @description Represent the execution form for a batch of selected snippets.
+     *
+     *     A purpose-built DTO rather than a plain
+     *     :class:`~app.sep.apps.framework.schema.AppSchema`: the renderer needs to map
+     *     every non-shared field back to the snippet that declared it, and an
+     *     ``AppSchema`` section carries only a display title.
+     *
+     *     :param shared: The batch-level execution fields followed by every parameter
+     *         the selection declares identically.
+     *     :param per_snippet: The remaining per-snippet fields, in request order.
+     */
+    atw__ATWMergedSchemaResponse: {
+      /** Per Snippet */
+      per_snippet: components['schemas']['atw__ATWSnippetSchema'][];
+      /** Shared */
+      shared: (
+        | components['schemas']['framework__BoolField']
+        | components['schemas']['framework__ChoiceField']
+        | components['schemas']['framework__DateTimeField']
+        | components['schemas']['framework__FileField']
+        | components['schemas']['framework__FloatField']
+        | components['schemas']['framework__HostField']
+        | components['schemas']['framework__IntegerField']
+        | components['schemas']['framework__MultiChoiceField']
+        | components['schemas']['framework__MultiHostField']
+        | components['schemas']['framework__MultiSchemaField']
+        | components['schemas']['framework__MultiServiceField']
+        | components['schemas']['framework__MultiTableField']
+        | components['schemas']['framework__RemoteChoiceField']
+        | components['schemas']['framework__SchemaField']
+        | components['schemas']['framework__ScriptPreviewField']
+        | components['schemas']['framework__ServiceField']
+        | components['schemas']['framework__StringField']
+        | components['schemas']['framework__TableField']
+        | components['schemas']['framework__TextAreaField']
+        | components['schemas']['framework__YamlField']
+        | components['schemas']['framework__OneOfGroup']
+      )[];
+    };
+    /**
+     * ATWSnippetSchema
+     * @description Represent the fields one selected snippet still owns after merging.
+     *
+     *     :param snippet_filename: The snippet the remaining fields belong to.
+     *     :param fields: The snippet's parameter fields that did not merge into the
+     *         shared section.
+     */
+    atw__ATWSnippetSchema: {
+      /** Fields */
+      fields: (
+        | components['schemas']['framework__BoolField']
+        | components['schemas']['framework__ChoiceField']
+        | components['schemas']['framework__DateTimeField']
+        | components['schemas']['framework__FileField']
+        | components['schemas']['framework__FloatField']
+        | components['schemas']['framework__HostField']
+        | components['schemas']['framework__IntegerField']
+        | components['schemas']['framework__MultiChoiceField']
+        | components['schemas']['framework__MultiHostField']
+        | components['schemas']['framework__MultiSchemaField']
+        | components['schemas']['framework__MultiServiceField']
+        | components['schemas']['framework__MultiTableField']
+        | components['schemas']['framework__RemoteChoiceField']
+        | components['schemas']['framework__SchemaField']
+        | components['schemas']['framework__ScriptPreviewField']
+        | components['schemas']['framework__ServiceField']
+        | components['schemas']['framework__StringField']
+        | components['schemas']['framework__TableField']
+        | components['schemas']['framework__TextAreaField']
+        | components['schemas']['framework__YamlField']
+        | components['schemas']['framework__OneOfGroup']
+      )[];
+      /** Snippet Filename */
+      snippet_filename: string;
+    };
+    /**
+     * ATWSnippetSummary
+     * @description Represent one snippet entry under an ATW category.
+     *
+     *     :param name: The snippet filename, used as its API identifier.
+     *     :type name: str
+     *     :param title: The snippet display title.
+     *     :type title: str
+     *     :param description: The snippet free-text description.
+     *     :type description: str
+     */
+    atw__ATWSnippetSummary: {
+      /** Description */
+      description: string;
+      /** Name */
+      name: string;
+      /** Title */
+      title: string;
+    };
+    /**
+     * AtwConfigResponse
+     * @description Report whether the incident send action is available.
+     *
+     *     :param send_disabled_reasons: Why sending is unavailable; empty when the
+     *         receiver is configured and the action is offered.
+     */
+    atw__AtwConfigResponse: {
+      /** Send Disabled Reasons */
+      send_disabled_reasons: string[];
+    };
+    /**
+     * AtwIncidentResponse
+     * @description Represent a persisted diagnostic incident.
+     *
+     *     Every field is always present on a stored incident, so — unlike returning
+     *     the :class:`AtwIncident` table model directly — the generated client types
+     *     them as required rather than optional.
+     *
+     *     :param id: The incident's UUID primary key.
+     *     :param name: Human-readable incident label.
+     *     :param case_ref: Support-case reference, if set.
+     *     :param created_by: Username of the support engineer who created the incident.
+     *     :param created_at: When the incident was created.
+     *     :param updated_at: When the incident was last updated, if ever.
+     */
+    atw__AtwIncidentResponse: {
+      /** Case Ref */
+      case_ref: string | null;
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at: string;
+      /** Created By */
+      created_by: string;
+      /**
+       * Id
+       * Format: uuid4
+       */
+      id: string;
+      /** Name */
+      name: string;
+      /** Updated At */
+      updated_at: string | null;
+    };
+    /**
+     * AtwIncidentUpdate
+     * @description Define the PATCH payload — all fields optional; unset fields are untouched.
+     *
+     *     :param name: New incident label. Non-nullable when provided: an omitted
+     *         ``name`` is left unchanged, while an explicit null or empty string is
+     *         rejected with 422 (the column is NOT NULL). Typing it as a non-optional
+     *         ``NonEmptyStr`` with a ``None`` default keeps the omitted-field sentinel
+     *         out of the JSON schema, so the generated client advertises ``name?: string``
+     *         (not ``string | null``) — matching what the route actually accepts.
+     *     :param case_ref: New support-case reference; an explicit null clears it.
+     */
+    atw__AtwIncidentUpdate: {
+      /** Case Ref */
+      case_ref?: string | null;
+      /** Name */
+      name?: string;
+    };
+    /**
+     * AtwIncidentWrite
+     * @description Define the create payload; ``name`` defaults and ``created_by`` is server-stamped.
+     */
+    atw__AtwIncidentWrite: {
+      /** Case Ref */
+      case_ref?: string | null;
+      /** Name */
+      name?: string;
+    };
+    /**
+     * AtwSendJobWrite
+     * @description Define the payload starting one diagnostics send.
+     *
+     *     :param case_ref: The support-case reference to attach the bundle to.
+     *     :param execution_ids: The incident executions whose output files and logs to
+     *         send.
+     */
+    atw__AtwSendJobWrite: {
+      /** Case Ref */
+      case_ref: string;
+      /** Execution Ids */
+      execution_ids: string[];
+    };
+    /**
+     * AtwSendLogResponse
+     * @description Represent one recorded diagnostics send attempt.
+     *
+     *     Every field is always present on a stored attempt, so -- unlike returning the
+     *     :class:`AtwSendLog` table model directly -- the generated client types them as
+     *     required rather than optional.
+     *
+     *     :param id: The attempt's UUID primary key.
+     *     :param incident_id: The incident the attempt belongs to.
+     *     :param case_ref: The support-case reference the attempt targeted.
+     *     :param requested_by: Username of the support engineer who started it.
+     *     :param status: The attempt's lifecycle status.
+     *     :param started_at: When the worker picked it up, if it did.
+     *     :param finished_at: When it reached a terminal status, if it did.
+     *     :param created_at: When the attempt was requested.
+     *     :param detail: The attempt's recorded evidence.
+     */
+    atw__AtwSendLogResponse: {
+      /** Case Ref */
+      case_ref: string;
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at: string;
+      /** Detail */
+      detail: Record<string, never>;
+      /** Finished At */
+      finished_at: string | null;
+      /**
+       * Id
+       * Format: uuid4
+       */
+      id: string;
+      /**
+       * Incident Id
+       * Format: uuid4
+       */
+      incident_id: string;
+      /** Requested By */
+      requested_by: string;
+      /** Started At */
+      started_at: string | null;
+      status: components['schemas']['atw__AtwSendStatusEnum'];
+    };
+    /**
+     * AtwSendStatusEnum
+     * @description Enumerate the lifecycle of one diagnostics send attempt.
+     *
+     *     The column stores member *names* (``PENDING``); the API serializes the
+     *     ``StrEnum`` *values* (``pending``).
+     * @enum {string}
+     */
+    atw__AtwSendStatusEnum: 'pending' | 'running' | 'success' | 'failed';
+    /** PaginatedResponse[ATWIncidentExecutionResponse] */
+    atw__PaginatedResponse_ATWIncidentExecutionResponse_: {
+      /** Items */
+      items: components['schemas']['atw__ATWIncidentExecutionResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /** PaginatedResponse[AtwIncidentResponse] */
+    atw__PaginatedResponse_AtwIncidentResponse_: {
+      /** Items */
+      items: components['schemas']['atw__AtwIncidentResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /** PaginatedResponse[AtwSendLogResponse] */
+    atw__PaginatedResponse_AtwSendLogResponse_: {
+      /** Items */
+      items: components['schemas']['atw__AtwSendLogResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /**
+     * BackupDerivedTaskSummary
+     * @description Represent one derived sibling in a backup task detail response.
+     *
+     *     :param name: The name of the derived task.
+     *     :type name: str
+     *     :param backup_type: The PBM backup type for this derived task.
+     *     :type backup_type: str
+     *     :param status: The latest execution status of the derived task.
+     *     :type status: TaskHistoryStatusEnum | None
+     */
+    backup_mongo__BackupDerivedTaskSummary: {
+      /** Backup Type */
+      backup_type: string;
+      /** Name */
+      name: string;
+      status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+    };
+    /**
+     * BackupTaskDetailResponse
+     * @description Represent a backup task detail API response.
+     *
+     *     :param derived_tasks: Latest status for each derived logical, physical,
+     *         status, and incremental sibling.
+     *     :type derived_tasks: list[BackupDerivedTaskSummary]
+     *     :param latest_pbm_status: Tail of the latest PBM status task stdout, if
+     *         available.
+     *     :type latest_pbm_status: str | None
+     */
+    backup_mongo__BackupTaskDetailResponse: {
+      /** Alert On Fail */
+      alert_on_fail: boolean;
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Anonymized Entities
+       * @description Return sorted PII entity names decoded from ``anonymize_mask``.
+       */
+      readonly anonymized_entities: string[];
+      backend: components['schemas']['TaskBackendEnum'];
+      /** Backup Type */
+      backup_type: string;
+      connectivity_warning?:
+        | components['schemas']['framework__ConnectivityWarning']
+        | null;
+      /** Created At */
+      created_at?: string | null;
+      /** Created By */
+      created_by?: string | null;
+      /** Data */
+      data: Record<string, never>;
+      /** Derived Tasks */
+      derived_tasks?: components['schemas']['backup_mongo__BackupDerivedTaskSummary'][];
+      /** Hostname */
+      hostname?: string | null;
+      /** Id */
+      id?: number | null;
+      /** Last Executed At */
+      last_executed_at?: string | null;
+      /** Last Updated By */
+      last_updated_by?: string | null;
+      /** Latest Pbm Status */
+      latest_pbm_status?: string | null;
+      /** Name */
+      name: string;
+      /** Protected */
+      protected: boolean;
+      status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * BackupTaskResponse
+     * @description Represent a backup task API response.
+     *
+     *     :param backup_type: The PBM backup type stored on the task.
+     */
+    backup_mongo__BackupTaskResponse: {
+      /** Alert On Fail */
+      alert_on_fail: boolean;
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Anonymized Entities
+       * @description Return sorted PII entity names decoded from ``anonymize_mask``.
+       */
+      readonly anonymized_entities: string[];
+      backend: components['schemas']['TaskBackendEnum'];
+      /** Backup Type */
+      backup_type: string;
+      connectivity_warning?:
+        | components['schemas']['framework__ConnectivityWarning']
+        | null;
+      /** Created At */
+      created_at?: string | null;
+      /** Created By */
+      created_by?: string | null;
+      /** Data */
+      data: Record<string, never>;
+      /** Hostname */
+      hostname?: string | null;
+      /** Id */
+      id?: number | null;
+      /** Last Executed At */
+      last_executed_at?: string | null;
+      /** Last Updated By */
+      last_updated_by?: string | null;
+      /** Name */
+      name: string;
+      /** Protected */
+      protected: boolean;
+      status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * BackupTaskWrite
+     * @description Represent a JSON request body for creating a backup task group.
+     *
+     *     Mirrors :class:`BackupCreate` except ``backup_type``, which is always
+     *     ``pbm_config`` on create. POST creates the parent config task plus derived
+     *     logical, physical, status, and incremental siblings.
+     *
+     *     :param task_name: The name of the task to be created.
+     *     :type task_name: NonEmptyStr
+     *     :param hostname: The target hostname for the task execution.
+     *     :type hostname: NonEmptyStr
+     *     :param service_id: The Inventory ID of the MongoDB service to connect to.
+     *     :type service_id: int
+     *     :param alert_on_fail: If True, send an alert if the task fails.
+     *     :type alert_on_fail: bool
+     *     :param pitr_oplog_span_min: PITR oplog span in minutes.
+     *     :type pitr_oplog_span_min: int | None
+     *     :param pitr_enabled: Whether PITR is enabled.
+     *     :type pitr_enabled: bool
+     *     :param pitr_compression: PITR compression algorithm.
+     *     :type pitr_compression: str | None
+     *     :param storage_type: Storage backend type (``s3`` or ``filesystem``); required.
+     *     :type storage_type: str
+     *     :param storage_s3_region: S3 region when ``storage_type`` is ``s3``.
+     *     :type storage_s3_region: str | None
+     *     :param storage_s3_bucket: S3 bucket when ``storage_type`` is ``s3``.
+     *     :type storage_s3_bucket: str | None
+     *     :param storage_s3_prefix: S3 key prefix when ``storage_type`` is ``s3``.
+     *     :type storage_s3_prefix: str | None
+     *     :param storage_s3_endpoint_url: S3 endpoint URL when ``storage_type`` is ``s3``.
+     *     :type storage_s3_endpoint_url: str | None
+     *     :param storage_filesystem_path: Filesystem path when ``storage_type`` is
+     *         ``filesystem``.
+     *     :type storage_filesystem_path: str | None
+     *     :param backup_priority: Node priority mapping as YAML.
+     *     :type backup_priority: str | None
+     *     :param backup_compression: Backup snapshot compression algorithm.
+     *     :type backup_compression: CompressionAlgorithm | None
+     *     :param backup_compression_level: Backup compression level.
+     *     :type backup_compression_level: int | None
+     *     :param backup_timeouts_starting_status: PBM starting-status timeout in seconds.
+     *     :type backup_timeouts_starting_status: int | None
+     *     :param backup_oplog_span_min: Logical backup oplog span in minutes.
+     *     :type backup_oplog_span_min: float | None
+     *     :param backup_num_parallel_collections: Parallel collections for logical backup.
+     *     :type backup_num_parallel_collections: int | None
+     *     :param backup_namespaces: Selective ``--ns`` namespaces for logical backups.
+     *     :type backup_namespaces: str | None
+     *     :param backup_with_users_and_roles: Opt-in ``--with-users-and-roles`` for ``db.*``.
+     *     :type backup_with_users_and_roles: bool
+     *     :param credentials_path: Path to MongoDB URI credentials on the Nomad node.
+     *     :type credentials_path: str | None
+     */
+    backup_mongo__BackupTaskWrite: {
+      /**
+       * Alert On Fail
+       * @default false
+       */
+      alert_on_fail: boolean;
+      backup_compression?:
+        | components['schemas']['backup_mongo__CompressionAlgorithm']
+        | null;
+      /** Backup Compression Level */
+      backup_compression_level?: number | null;
+      /** Backup Namespaces */
+      backup_namespaces?: string | null;
+      /** Backup Num Parallel Collections */
+      backup_num_parallel_collections?: number | null;
+      /** Backup Oplog Span Min */
+      backup_oplog_span_min?: number | null;
+      /** Backup Priority */
+      backup_priority?: string | null;
+      /** Backup Timeouts Starting Status */
+      backup_timeouts_starting_status?: number | null;
+      /**
+       * Backup With Users And Roles
+       * @default false
+       */
+      backup_with_users_and_roles: boolean;
+      /** Credentials Path */
+      credentials_path?: string | null;
+      /** Hostname */
+      hostname: string;
+      /** Pitr Compression */
+      pitr_compression?: string | null;
+      /**
+       * Pitr Enabled
+       * @default false
+       */
+      pitr_enabled: boolean;
+      /** Pitr Oplog Span Min */
+      pitr_oplog_span_min?: number | null;
+      /** Service Id */
+      service_id: number;
+      /** Storage Filesystem Path */
+      storage_filesystem_path?: string | null;
+      /** Storage S3 Bucket */
+      storage_s3_bucket?: string | null;
+      /** Storage S3 Endpoint Url */
+      storage_s3_endpoint_url?: string | null;
+      /** Storage S3 Prefix */
+      storage_s3_prefix?: string | null;
+      /** Storage S3 Region */
+      storage_s3_region?: string | null;
+      /** Storage Type */
+      storage_type: string;
+      /** Task Name */
+      task_name: string;
+    };
+    /**
+     * BackupType
+     * @description Backup types.
+     * @enum {string}
+     */
+    backup_mongo__BackupType:
+      | 'pbm_logical'
+      | 'pbm_physical'
+      | 'pbm_incremental'
+      | 'pbm_snapshot'
+      | 'pbm_config'
+      | 'pbm_status';
+    /**
+     * CompressionAlgorithm
+     * @description Represents algorithm of choice whem compressing wirteTiger datafiles.
+     * @enum {string}
+     */
+    backup_mongo__CompressionAlgorithm:
+      | 'gzip'
+      | 'snappy'
+      | 'lz4'
+      | 's2'
+      | 'pgzip'
+      | 'zstd';
+    /** PaginatedResponse[BackupTaskResponse] */
+    backup_mongo__PaginatedResponse_BackupTaskResponse_: {
+      /** Items */
+      items: components['schemas']['backup_mongo__BackupTaskResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /** PaginatedResponse[RestoreTaskResponse] */
+    backup_mongo__PaginatedResponse_RestoreTaskResponse_: {
+      /** Items */
+      items: components['schemas']['backup_mongo__RestoreTaskResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /**
+     * RestoreDerivedTaskSummary
+     * @description Represent one child task in a restore task group detail response.
+     *
+     *     :param name: The name of the child task.
+     *     :type name: str
+     *     :param status: The latest execution status of the child task.
+     *     :type status: TaskHistoryStatusEnum | None
+     */
+    backup_mongo__RestoreDerivedTaskSummary: {
+      /** Name */
+      name: string;
+      status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+    };
+    /**
+     * RestoreTaskDetailResponse
+     * @description Represent a restore task detail API response.
+     *
+     *     :param derived_tasks: Latest status for each restore child task.
+     *     :type derived_tasks: list[RestoreDerivedTaskSummary]
+     */
+    backup_mongo__RestoreTaskDetailResponse: {
+      /** Alert On Fail */
+      alert_on_fail: boolean;
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Anonymized Entities
+       * @description Return sorted PII entity names decoded from ``anonymize_mask``.
+       */
+      readonly anonymized_entities: string[];
+      backend: components['schemas']['TaskBackendEnum'];
+      /** Backup Source */
+      backup_source: string;
+      /** Backup Type */
+      backup_type: string;
+      connectivity_warning?:
+        | components['schemas']['framework__ConnectivityWarning']
+        | null;
+      /** Created At */
+      created_at?: string | null;
+      /** Created By */
+      created_by?: string | null;
+      /** Data */
+      data: Record<string, never>;
+      /** Derived Tasks */
+      derived_tasks?: components['schemas']['backup_mongo__RestoreDerivedTaskSummary'][];
+      /** Hostname */
+      hostname?: string | null;
+      /** Id */
+      id?: number | null;
+      /** Last Executed At */
+      last_executed_at?: string | null;
+      /** Last Updated By */
+      last_updated_by?: string | null;
+      /** Name */
+      name: string;
+      /** Protected */
+      protected: boolean;
+      status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * RestoreTaskResponse
+     * @description Represent a restore task API response.
+     *
+     *     Extend the standard task-response surface with the restore destination facts
+     *     the API surfaces; the shared task identity, status, audit, anonymization, and
+     *     connectivity fields come from
+     *     :class:`~app.sep.apps.framework.responses.BaseTaskResponse`.
+     *
+     *     :param hostname: The target hostname for the task execution.
+     *     :param backup_type: The PBM backup type for this restore.
+     *     :param backup_source: The backup name or timestamp to restore from.
+     */
+    backup_mongo__RestoreTaskResponse: {
+      /** Alert On Fail */
+      alert_on_fail: boolean;
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Anonymized Entities
+       * @description Return sorted PII entity names decoded from ``anonymize_mask``.
+       */
+      readonly anonymized_entities: string[];
+      backend: components['schemas']['TaskBackendEnum'];
+      /** Backup Source */
+      backup_source: string;
+      /** Backup Type */
+      backup_type: string;
+      connectivity_warning?:
+        | components['schemas']['framework__ConnectivityWarning']
+        | null;
+      /** Created At */
+      created_at?: string | null;
+      /** Created By */
+      created_by?: string | null;
+      /** Data */
+      data: Record<string, never>;
+      /** Hostname */
+      hostname?: string | null;
+      /** Id */
+      id?: number | null;
+      /** Last Executed At */
+      last_executed_at?: string | null;
+      /** Last Updated By */
+      last_updated_by?: string | null;
+      /** Name */
+      name: string;
+      /** Protected */
+      protected: boolean;
+      status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * RestoreTaskWrite
+     * @description Represent a JSON request body for creating a restore task group.
+     *
+     *     Mirrors :class:`RestoreCreate` field-for-field with JSON-native types (notably
+     *     ``service_id: int | None``). Routes convert via
+     *     :func:`~app.sep.apps.backup_mongo.restore.deps.restore_create_from_write`
+     *     before building task payloads. See :class:`RestoreCreate` for why both models
+     *     remain.
+     *
+     *     POST always creates a parent config task plus restore, pbm-list, and optional
+     *     force-resync children.
+     *
+     *     :param task_name: The name of the task to be created.
+     *     :type task_name: NonEmptyStr
+     *     :param hostname: The target hostname for the task execution.
+     *     :type hostname: NonEmptyStr
+     *     :param service_id: Optional Inventory ID of the MongoDB service.
+     *     :type service_id: int | None
+     *     :param backup_type: Type of backup to restore from (logical or physical).
+     *     :type backup_type: BackupType
+     *     :param backup_source: Backup name or timestamp to restore from.
+     *     :type backup_source: NonEmptyStr
+     *     :param restore_namespace_filter: Optional database or collection namespace
+     *         filter for a logical restore.
+     *     :type restore_namespace_filter: str | None
+     *     :param restore_batch_size: Number of documents to buffer.
+     *     :type restore_batch_size: int | None
+     *     :param restore_num_insertion_workers: Insertion workers per collection.
+     *     :type restore_num_insertion_workers: int | None
+     *     :param restore_num_parallel_collections: Parallel collections for logical restore.
+     *     :type restore_num_parallel_collections: int | None
+     *     :param restore_num_download_workers: Download workers for physical restore.
+     *     :type restore_num_download_workers: int | None
+     *     :param restore_max_download_buffer_mb: Max S3 download buffer in MB.
+     *     :type restore_max_download_buffer_mb: int | None
+     *     :param restore_download_chunk_mb: S3 download chunk size in MB.
+     *     :type restore_download_chunk_mb: int | None
+     *     :param restore_mongod_location: Custom path to mongod binaries.
+     *     :type restore_mongod_location: str | None
+     *     :param restore_mongod_location_map: Per-node mongod paths as YAML.
+     *     :type restore_mongod_location_map: str | None
+     *     :param credentials_path: Path to MongoDB URI credentials on the Nomad node.
+     *     :type credentials_path: str | None
+     */
+    backup_mongo__RestoreTaskWrite: {
+      /** Backup Source */
+      backup_source: string;
+      backup_type: components['schemas']['backup_mongo__BackupType'];
+      /** Credentials Path */
+      credentials_path?: string | null;
+      /** Hostname */
+      hostname: string;
+      /** Restore Batch Size */
+      restore_batch_size?: number | null;
+      /** Restore Download Chunk Mb */
+      restore_download_chunk_mb?: number | null;
+      /** Restore Max Download Buffer Mb */
+      restore_max_download_buffer_mb?: number | null;
+      /** Restore Mongod Location */
+      restore_mongod_location?: string | null;
+      /** Restore Mongod Location Map */
+      restore_mongod_location_map?: string | null;
+      /** Restore Namespace Filter */
+      restore_namespace_filter?: string | null;
+      /** Restore Num Download Workers */
+      restore_num_download_workers?: number | null;
+      /** Restore Num Insertion Workers */
+      restore_num_insertion_workers?: number | null;
+      /** Restore Num Parallel Collections */
+      restore_num_parallel_collections?: number | null;
+      /** Service Id */
+      service_id?: number | null;
+      /** Task Name */
+      task_name: string;
+    };
+    /**
+     * BackupPgForm
+     * @description Define the model-first create/update body and schema source for backup_pg.
+     *
+     *     The single source of the JSON request body (the field types and defaults the
+     *     server validates) *and* the derived ``GET /schema`` form (driven by the
+     *     :class:`Ui` / reference / :class:`Choices` markers). Field set, types, and
+     *     model defaults match the JSON create contract; the form-display defaults that
+     *     differ from the model default (the pgBackRest tool paths, the default backup
+     *     type) are carried on ``Ui(default=...)`` so the runtime payload stays
+     *     unchanged while the schema renders those form defaults.
+     *
+     *     Field declaration order is load-bearing: it drives the derived form's
+     *     section and field order. ``backup_type`` is not a form field — the spec
+     *     builder injects :attr:`BackupType.PGBACKREST`. The ``task_name`` / ``hostname``
+     *     Task-section fields and the ``alert_on_fail`` capability control are inherited
+     *     from :class:`TaskFormModel` (``alert_on_fail`` is ``Hidden``, off-schema).
+     *     ``extra="forbid"`` rejects unknown fields (for example a stale FE submitting
+     *     ``host`` / ``port``, which the payload pins itself).
+     */
+    backup_pg__BackupPgForm: {
+      /**
+       * Alert On Fail
+       * @default false
+       */
+      alert_on_fail: boolean;
+      /** Backup Dir */
+      backup_dir: string;
+      /** Hostname */
+      hostname: string;
+      /** Logging Dir */
+      logging_dir?: string | null;
+      pgbackrest_backup_type?:
+        | components['schemas']['backup_pg__PgBackRestBackupType']
+        | null;
+      /** Pgbackrest Bin */
+      pgbackrest_bin?: string | null;
+      /** Pgbackrest Config File */
+      pgbackrest_config_file?: string | null;
+      /** Pgbackrest Datadir */
+      pgbackrest_datadir?: string | null;
+      /** Pgbackrest Incremental Cycle */
+      pgbackrest_incremental_cycle?: string | number | null;
+      /** Pgbackrest Retention Archive */
+      pgbackrest_retention_archive?: number | null;
+      /** Pgbackrest Retention Full */
+      pgbackrest_retention_full?: number | null;
+      /** Service Id */
+      service_id: number;
+      /** Stanza */
+      stanza: string;
+      /** Task Name */
+      task_name: string;
+    };
+    /**
+     * BackupTaskDetailResponse
+     * @description Represent a single pgBackRest backup task detail response.
+     *
+     *     Add the executor host and port resolved from the task's YAML config so the
+     *     FE detail view can render them alongside the parity Overview block; list
+     *     rows omit these to keep the table response compact.
+     *
+     *     :param host: The PostgreSQL host the task connects to.
+     *     :param port: The PostgreSQL port the task connects to.
+     */
+    backup_pg__BackupTaskDetailResponse: {
+      /** Alert On Fail */
+      alert_on_fail: boolean;
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Anonymized Entities
+       * @description Return sorted PII entity names decoded from ``anonymize_mask``.
+       */
+      readonly anonymized_entities: string[];
+      backend: components['schemas']['TaskBackendEnum'];
+      /** Backup Type */
+      backup_type: string;
+      connectivity_warning?:
+        | components['schemas']['framework__ConnectivityWarning']
+        | null;
+      /** Created At */
+      created_at?: string | null;
+      /** Created By */
+      created_by?: string | null;
+      /** Data */
+      data: Record<string, never>;
+      /** Host */
+      host?: string | null;
+      /** Hostname */
+      hostname?: string | null;
+      /** Id */
+      id?: number | null;
+      /** Last Executed At */
+      last_executed_at?: string | null;
+      /** Last Updated By */
+      last_updated_by?: string | null;
+      /** Name */
+      name: string;
+      /** Port */
+      port?: number | null;
+      /** Protected */
+      protected: boolean;
+      status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * BackupTaskResponse
+     * @description Represent a pgBackRest backup task API response.
+     *
+     *     :param backup_type: The ``backup_type`` discriminator stored on the task.
+     */
+    backup_pg__BackupTaskResponse: {
+      /** Alert On Fail */
+      alert_on_fail: boolean;
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Anonymized Entities
+       * @description Return sorted PII entity names decoded from ``anonymize_mask``.
+       */
+      readonly anonymized_entities: string[];
+      backend: components['schemas']['TaskBackendEnum'];
+      /** Backup Type */
+      backup_type: string;
+      connectivity_warning?:
+        | components['schemas']['framework__ConnectivityWarning']
+        | null;
+      /** Created At */
+      created_at?: string | null;
+      /** Created By */
+      created_by?: string | null;
+      /** Data */
+      data: Record<string, never>;
+      /** Hostname */
+      hostname?: string | null;
+      /** Id */
+      id?: number | null;
+      /** Last Executed At */
+      last_executed_at?: string | null;
+      /** Last Updated By */
+      last_updated_by?: string | null;
+      /** Name */
+      name: string;
+      /** Protected */
+      protected: boolean;
+      status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /** PaginatedResponse[BackupTaskResponse] */
+    backup_pg__PaginatedResponse_BackupTaskResponse_: {
+      /** Items */
+      items: components['schemas']['backup_pg__BackupTaskResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /**
+     * PgBackRestBackupType
+     * @description PgBackRest backup types.
+     * @enum {string}
+     */
+    backup_pg__PgBackRestBackupType: 'incr' | 'diff';
+    /**
+     * ChecksumsForm
+     * @description Define the model-first create/update body and schema source for Checksums.
+     *
+     *     The single source of the JSON request body (the field types and defaults the
+     *     server validates) *and* the derived ``GET /schema`` form (driven by the
+     *     :class:`Ui` / reference / :class:`Choices` markers). Field set, types, and
+     *     model defaults match the previous hand-written request body; the form-display
+     *     defaults that differ from the model default are carried on ``Ui(default=...)``.
+     *
+     *     Field declaration order is load-bearing. The spec builder assembles
+     *     ``--databases`` / ``--tables`` from the multi-value reference fields, then the
+     *     framework's ``build_command_args`` emits the remaining ``ArgFormat`` value args
+     *     (in field order) followed by all flag args (in field order). Section order
+     *     (Task, Data, Recursion, Flags, Advanced) follows each section's first field.
+     *     ``progress`` is declared last to land at the end of the value args, and
+     *     ``Ui(order=...)`` pins the Advanced section's display order where it diverges
+     *     from declaration order. The ``task_name`` / ``hostname`` Task-section fields
+     *     and the ``alert_on_fail`` capability control are inherited from
+     *     :class:`TaskFormModel` (``alert_on_fail`` is ``Hidden``, off-schema).
+     */
+    checksums__ChecksumsForm: {
+      /**
+       * Alert On Fail
+       * @default false
+       */
+      alert_on_fail: boolean;
+      /**
+       * Binary Index
+       * @default false
+       */
+      binary_index: boolean;
+      /**
+       * Chunk Time
+       * @default
+       */
+      chunk_time: string;
+      /** Databases */
+      databases?: (number | string)[];
+      /**
+       * Dsn Table
+       * @default
+       */
+      dsn_table: string;
+      /**
+       * Explain Arg
+       * @default false
+       */
+      explain_arg: boolean;
+      /**
+       * Fail On Stopped Replication
+       * @default false
+       */
+      fail_on_stopped_replication: boolean;
+      /** Hostname */
+      hostname: string;
+      /**
+       * Max Lag
+       * @default
+       */
+      max_lag: string;
+      /**
+       * Max Load
+       * @default
+       */
+      max_load: string;
+      /**
+       * Pause File
+       * @default
+       */
+      pause_file: string;
+      /**
+       * Progress
+       * @default
+       */
+      progress: string;
+      /**
+       * Recursion Method
+       * @default processlist
+       */
+      recursion_method: string;
+      /** Service Id */
+      service_id: number;
+      /**
+       * Set Vars
+       * @default
+       */
+      set_vars: string;
+      /** Tables */
+      tables?: (number | string)[];
+      /** Task Name */
+      task_name: string;
+      /**
+       * Truncate Replicate Table
+       * @default false
+       */
+      truncate_replicate_table: boolean;
+    };
+    /**
+     * CollectorTypeEnum
+     * @description Define enum for Dipper collector types.
+     * @enum {string}
+     */
+    dipper__CollectorTypeEnum: 'environment' | 'pmm';
+    /**
+     * DipperExecuteWrite
+     * @description Define the JSON body for ``POST /api/apps/dipper/``.
+     *
+     *     :param service_id: Inventory ID of the database service to collect data from.
+     *     :type service_id: int
+     *     :param collector_type: Which collector script to run (environment or pmm).
+     *     :type collector_type: CollectorTypeEnum
+     *     :param executor_host: Nomad client hostname that will run the script.
+     *     :type executor_host: NonEmptyStr
+     *     :param sudo: Whether to invoke the script with ``sudo``. ``None`` defers
+     *         to the script's own sudo policy (the default).
+     *     :type sudo: bool | None
+     *     :param args: Per-parameter arguments keyed by script parameter name. Validated
+     *         server-side against the script's dynamic execution model.
+     *     :type args: dict[str, Any]
+     */
+    dipper__DipperExecuteWrite: {
+      /** Args */
+      args?: {
+        [key: string]: unknown;
+      };
+      /** @default environment */
+      collector_type: components['schemas']['dipper__CollectorTypeEnum'];
+      /** Execution Host */
+      executor_host: string;
+      /** Service Id */
+      service_id: number;
+      /** Sudo */
+      sudo?: boolean | null;
+    };
+    /**
+     * DipperExecutionResponse
+     * @description Represent the response from ``POST /api/apps/dipper/``.
+     *
+     *     :param task_id: ID of the task-history row created by the tasks API.
+     *     :type task_id: int | None
+     *     :param task_name: The execution task name used to dispatch the script.
+     *     :type task_name: str
+     *     :param snippet_filename: Composite path used to correlate history rows.
+     *     :type snippet_filename: str
+     *     :param service_id: Inventory ID of the database service.
+     *     :type service_id: int
+     *     :param collector_type: Collector type that was executed.
+     *     :type collector_type: CollectorTypeEnum
+     */
+    dipper__DipperExecutionResponse: {
+      collector_type: components['schemas']['dipper__CollectorTypeEnum'];
+      /** Service Id */
+      service_id: number;
+      /** Snippet Filename */
+      snippet_filename: string;
+      /** Task Id */
+      task_id?: number | null;
+      /** Task Name */
+      task_name: string;
+    };
+    /**
+     * AltersTaskResponseCreate
+     * @description Represent the create response for an alters task group, carrying the post-creation connectivity warning.
+     */
+    framework__AltersTaskResponseCreate: {
+      /** Alert On Fail */
+      alert_on_fail: boolean;
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Anonymized Entities
+       * @description Return sorted PII entity names decoded from ``anonymize_mask``.
+       */
+      readonly anonymized_entities: string[];
+      backend: components['schemas']['TaskBackendEnum'];
+      connectivity_warning?:
+        | components['schemas']['framework__ConnectivityWarning']
+        | null;
+      /** Created At */
+      created_at?: string | null;
+      /** Created By */
+      created_by?: string | null;
+      /** Data */
+      data: Record<string, never>;
+      /** Id */
+      id?: number | null;
+      /** Last Executed At */
+      last_executed_at?: string | null;
+      /** Last Updated By */
+      last_updated_by?: string | null;
+      /** Name */
+      name: string;
+      /** Protected */
+      protected: boolean;
+      status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * AltersTaskResponseUpdate
+     * @description Represent the update response for an alters task group, carrying the post-update connectivity warning.
+     */
+    framework__AltersTaskResponseUpdate: {
+      /** Alert On Fail */
+      alert_on_fail: boolean;
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Anonymized Entities
+       * @description Return sorted PII entity names decoded from ``anonymize_mask``.
+       */
+      readonly anonymized_entities: string[];
+      backend: components['schemas']['TaskBackendEnum'];
+      connectivity_warning?:
+        | components['schemas']['framework__ConnectivityWarning']
+        | null;
+      /** Created At */
+      created_at?: string | null;
+      /** Created By */
+      created_by?: string | null;
+      /** Data */
+      data: Record<string, never>;
+      /** Id */
+      id?: number | null;
+      /** Last Executed At */
+      last_executed_at?: string | null;
+      /** Last Updated By */
+      last_updated_by?: string | null;
+      /** Name */
+      name: string;
+      /** Protected */
+      protected: boolean;
+      status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * AppEntitySchema
+     * @description Describe one CRUD entity for a multi-entity schema-driven plugin.
+     *
+     *     Used when a plugin exposes several independent resources (for example
+     *     inventory nodes, services, schemas, and tables), each with its own list
+     *     view and create/edit forms. Task-style plugins omit ``entities`` and use
+     *     the root ``forms`` / ``list_view`` instead.
+     *
+     *     :param name: URL segment and API key for the entity (for example ``nodes``).
+     *     :type name: NonEmptyStr
+     *     :param display_name: Human-readable title for this entity's screens.
+     *     :type display_name: NonEmptyStr
+     *     :param description: Optional helper text for this entity. Defaults to
+     *         ``None``.
+     *     :type description: NonEmptyStr | None
+     *     :param forms: Form sections for create (and edit when the UI supports it).
+     *     :type forms: list[FormSection]
+     *     :param list_view: Column configuration for this entity's list table.
+     *     :type list_view: ListView
+     *     :param detail_highlights: Optional per-field syntax highlighter hints for
+     *         detail pages. Keys are field names; values are highlighting languages.
+     *         Defaults to an empty mapping.
+     *     :type detail_highlights: dict[NonEmptyStr, DetailHighlightLanguage]
+     *     :param cardinality_rules: Optional entity-wide cross-field cardinality
+     *         constraints. Defaults to ``None``.
+     *     :type cardinality_rules: list[CardinalityRule] | None
+     *     :param fail_when: Optional entity-wide predicate-only invariants.
+     *         Defaults to ``None``.
+     *     :type fail_when: list[FailRule] | None
+     */
+    framework__AppEntitySchema: {
+      /** Cardinality Rules */
+      cardinality_rules?:
+        | components['schemas']['framework__CardinalityRule'][]
+        | null;
+      /** Description */
+      description?: string | null;
+      /** Detail Highlights */
+      detail_highlights?: {
+        [key: string]: components['schemas']['framework__DetailHighlightLanguage'];
+      };
+      /** Display Name */
+      display_name: string;
+      /** Fail When */
+      fail_when?: components['schemas']['framework__FailRule'][] | null;
+      /** Forms */
+      forms: components['schemas']['framework__FormSection'][];
+      list_view: components['schemas']['framework__ListView'];
+      /** Name */
+      name: string;
+    };
+    /**
+     * AppSchema
+     * @description Represent a plugin's complete schema: form sections, list view, capabilities.
+     *
+     *     :param name: The plugin identifier; must match Python identifier rules,
+     *         optionally with internal hyphens.
+     *     :type name: NonEmptyStr
+     *     :param display_name: The human-readable plugin title displayed in the UI.
+     *     :type display_name: NonEmptyStr
+     *     :param description: Optional helper text describing the plugin's
+     *         purpose. Defaults to ``None``.
+     *     :type description: NonEmptyStr | None
+     *     :param task_type: Optional task-type identifier used when creating tasks
+     *         via the shared task API. Defaults to ``None``.
+     *     :type task_type: NonEmptyStr | None
+     *     :param forms: Form sections for single-entity / task plugins. Defaults to
+     *         an empty list when ``entities`` is used instead.
+     *     :type forms: list[FormSection]
+     *     :param capabilities: Optional plugin-level feature flags. Defaults to
+     *         ``None``.
+     *     :type capabilities: Capabilities | None
+     *     :param list_view: List-view configuration when ``entities`` is unset
+     *         (single-entity / task plugins). Ignored when ``entities`` is set.
+     *     :type list_view: ListView | None
+     *     :param detail_view: Optional declarative layout for the task detail page's
+     *         section cards (task-style plugins only; ignored when ``entities`` is
+     *         set). Optional at the model layer for backwards compatibility. A
+     *         forward-looking guard refuses to load a plugin that sets
+     *         ``task_type`` without declaring ``detail_view``. Defaults to ``None``.
+     *     :type detail_view: DetailView | None
+     *     :param entities: Optional list of CRUD entities for multi-resource plugins.
+     *         When non-empty, the React shell renders one list/create/detail flow
+     *         per entity. Defaults to ``None`` (legacy single-entity mode).
+     *     :param cardinality_rules: Optional plugin-wide cross-field cardinality
+     *         constraints (task-style plugins only; ignored when ``entities`` is set).
+     *         Defaults to ``None``.
+     *     :type cardinality_rules: list[CardinalityRule] | None
+     *     :param fail_when: Optional plugin-wide predicate-only invariants (task-style
+     *         plugins only; ignored when ``entities`` is set). Defaults to ``None``.
+     *     :type fail_when: list[FailRule] | None
+     *     :param derived: Optional declarative specs for sibling tasks derived from
+     *         the parent task on cascade. Consumed by
+     *         :mod:`app.sep.apps.framework.cascade` to drive POST/PUT/DELETE
+     *         across the parent and N derived siblings. Defaults to ``None``.
+     *     :type derived: list[DerivedTask] | None
+     *     :param predecessors: Optional declarative specs for tasks that must run
+     *         before the parent. Consumed by
+     *         :mod:`app.sep.apps.framework.cascade` to drive POST/PUT/DELETE
+     *         across the predecessors and the parent, including the chain wiring
+     *         applied at execute time. Defaults to ``None``.
+     *     :type predecessors: list[ChainedPredecessor] | None
+     *     :param related_apps: Optional separately registered apps the React shell
+     *         surfaces as sibling tabs (for example a restore app nested under a
+     *         backups parent). Defaults to ``None``.
+     *     :type related_apps: list[RelatedApp] | None
+     */
+    framework__AppSchema: {
+      capabilities?: components['schemas']['framework__Capabilities'] | null;
+      /** Cardinality Rules */
+      cardinality_rules?:
+        | components['schemas']['framework__CardinalityRule'][]
+        | null;
+      /** Derived */
+      derived?: components['schemas']['framework__DerivedTask'][] | null;
+      /** Description */
+      description?: string | null;
+      detail_view?: components['schemas']['framework__DetailView'] | null;
+      /** Display Name */
+      display_name: string;
+      /** Entities */
+      entities?: components['schemas']['framework__AppEntitySchema'][] | null;
+      /** Fail When */
+      fail_when?: components['schemas']['framework__FailRule'][] | null;
+      /** Forms */
+      forms?: components['schemas']['framework__FormSection'][];
+      list_view?: components['schemas']['framework__ListView'] | null;
+      /** Name */
+      name: string;
+      /** Predecessors */
+      predecessors?:
+        | components['schemas']['framework__ChainedPredecessor'][]
+        | null;
+      /** Related Apps */
+      related_apps?: components['schemas']['framework__RelatedApp'][] | null;
+      /** Task Type */
+      task_type?: string | null;
+    };
+    /** BackupPgCreateResponse */
+    framework__BackupPgCreateResponse: {
+      /** Alert On Fail */
+      alert_on_fail: boolean;
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Anonymized Entities
+       * @description Return sorted PII entity names decoded from ``anonymize_mask``.
+       */
+      readonly anonymized_entities: string[];
+      backend: components['schemas']['TaskBackendEnum'];
+      /** Backup Type */
+      backup_type: string;
+      connectivity_warning?:
+        | components['schemas']['framework__ConnectivityWarning']
+        | null;
+      /** Created At */
+      created_at?: string | null;
+      /** Created By */
+      created_by?: string | null;
+      /** Data */
+      data: Record<string, never>;
+      /** Host */
+      host?: string | null;
+      /** Hostname */
+      hostname?: string | null;
+      /** Id */
+      id?: number | null;
+      /** Last Executed At */
+      last_executed_at?: string | null;
+      /** Last Updated By */
+      last_updated_by?: string | null;
+      /** Name */
+      name: string;
+      /** Port */
+      port?: number | null;
+      /** Protected */
+      protected: boolean;
+      status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * BaseTaskResponse
+     * @description Represent the universal task-response surface for standard task apps.
+     *
+     *     Carry the fields shared by every standard ``TaskExecutionApp`` response:
+     *     the task identity, the resolved execution status, the stored configuration,
+     *     and the audit/anonymization metadata. A standard app whose response has no
+     *     app-specific fields uses this model directly; an app with extras subclasses
+     *     it. The model is parametrized by the task ``owner``, which drives the
+     *     ``anonymized_entities`` default-entity lookup but is excluded from the
+     *     serialized detail/list payload (as is ``service_type``).
+     *
+     *     :param name: The task name.
+     *     :param owner: The task-category owner (for example ``BACKUPS``). Kept
+     *         as a model attribute for ``anonymized_entities`` and server-side
+     *         filtering; excluded from the serialized detail/list payload.
+     *     :param service_type: The database service type, stamped by the builder;
+     *         ``None`` for an app without a fixed service type. Excluded from the
+     *         serialized detail/list payload.
+     *     :param status: The latest known execution status; ``None`` until the task
+     *         runs.
+     *     :param last_executed_at: The most recent time the task finished executing
+     *         (``max`` ``finished_at`` across its history). Reported even while a
+     *         re-run is in progress (showing the prior completion); ``None`` until the
+     *         task has finished at least once.
+     *     :param id: The task's unique identifier.
+     *     :param backend: The backend worker/engine executing the task.
+     *     :param data: The raw configuration and parameters used for execution. Tasks
+     *         created through the JSON schema-driven path also carry a reserved additive
+     *         ``_form`` key holding the verbatim, validated create-form body for
+     *         prefilling an edit form; it is absent for tasks created through a legacy
+     *         form, so consumers must treat it as optional.
+     *     :param protected: Whether the task is protected from deletion or modification.
+     *     :param alert_on_fail: Whether a notification is sent on task failure.
+     *     :param anonymize_mask: Bitmask of PII entities to anonymize; ``None`` falls
+     *         back to the owner's configured defaults.
+     *     :param created_at: The timestamp when the task was first created.
+     *     :param updated_at: The timestamp of the last modification to the task.
+     *     :param created_by: Display name for the user who initiated the task (Casdoor
+     *         username when resolvable, otherwise the stored user id).
+     *     :param last_updated_by: Display name for the user who last modified the task
+     *         record (Casdoor username when resolvable, otherwise the stored user id).
+     *     :param connectivity_warning: A warning surfaced when the post-creation
+     *         database connectivity check fails. ``None`` when the check passes, is
+     *         opted out, or the task meta lacks the connectivity keys.
+     *     :param anonymized_entities: Sorted PII entity names derived from
+     *         ``anonymize_mask`` (or from the owner's configured defaults when the mask
+     *         is ``None``). Read-only; computed on serialisation.
+     */
+    framework__BaseTaskResponse: {
+      /** Alert On Fail */
+      alert_on_fail: boolean;
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Anonymized Entities
+       * @description Return sorted PII entity names decoded from ``anonymize_mask``.
+       */
+      readonly anonymized_entities: string[];
+      backend: components['schemas']['TaskBackendEnum'];
+      connectivity_warning?:
+        | components['schemas']['framework__ConnectivityWarning']
+        | null;
+      /** Created At */
+      created_at?: string | null;
+      /** Created By */
+      created_by?: string | null;
+      /** Data */
+      data: Record<string, never>;
+      /** Id */
+      id?: number | null;
+      /** Last Executed At */
+      last_executed_at?: string | null;
+      /** Last Updated By */
+      last_updated_by?: string | null;
+      /** Name */
+      name: string;
+      /** Protected */
+      protected: boolean;
+      status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * BoolField
+     * @description Represent a boolean toggle field.
+     *
+     *     :param field_type: The discriminator literal; always ``"bool"`` for this
+     *         class. Serialised as the JSON key ``"type"``.
+     *     :type field_type: Literal["bool"]
+     */
+    framework__BoolField: {
+      /** Default */
+      default?: unknown | null;
+      /** Description */
+      description?: string | null;
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /** Label */
+      label: string;
+      /** Name */
+      name: string;
+      /**
+       * Required
+       * @default false
+       */
+      required: boolean;
+      /** Requires */
+      requires?: components['schemas']['framework__FieldGate'][] | null;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'bool';
+    };
+    /**
+     * Capabilities
+     * @description Represent plugin-level feature flags.
+     *
+     *     :param chaining: Whether the plugin supports chaining tasks together.
+     *         Defaults to ``False``.
+     *     :type chaining: bool
+     *     :param alert_on_fail: Whether the plugin supports configuring a PMM
+     *         alert when a task fails. Defaults to ``False``.
+     *     :type alert_on_fail: bool
+     *     :param scheduling: Whether the plugin supports scheduling tasks on a
+     *         periodic interval. Defaults to ``False``.
+     *     :type scheduling: bool
+     *     :param stats: Whether the plugin supports rendering the aggregated
+     *         execution statistics card on its detail page. Defaults to
+     *         ``False``.
+     *     :type stats: bool
+     *     :param pii_anonymization: Whether the plugin wires ``anonymize_mask``
+     *         into task execution and the React detail page should surface which
+     *         PII entities are anonymized. This is a UI-rendering gate — the
+     *         anonymization always happens when configured; this flag controls
+     *         whether the detail view renders the "PII Anonymization" section.
+     *         Defaults to ``False``.
+     *     :type pii_anonymization: bool
+     */
+    framework__Capabilities: {
+      /**
+       * Alert On Fail
+       * @default false
+       */
+      alert_on_fail: boolean;
+      /**
+       * Chaining
+       * @default false
+       */
+      chaining: boolean;
+      /**
+       * Pii Anonymization
+       * @default false
+       */
+      pii_anonymization: boolean;
+      /**
+       * Scheduling
+       * @default false
+       */
+      scheduling: boolean;
+      /**
+       * Stats
+       * @default false
+       */
+      stats: boolean;
+    };
+    /**
+     * CardinalityRule
+     * @description Express a cardinality constraint over a list of fields.
+     *
+     *     When ``when`` matches (or unconditionally if ``when`` is ``None``), the
+     *     count of present fields in ``fields`` must lie in ``[min, max]`` with
+     *     ``None`` bounds treated as unbounded.
+     *
+     *     :param when: The predicate that gates the rule. ``None`` means
+     *         unconditional.
+     *     :type when: Predicate | None
+     *     :param fields: The non-empty list of target field names.
+     *     :type fields: list[str]
+     *     :param min: Optional lower bound on the count of present fields.
+     *         Defaults to ``None``.
+     *     :type min: int | None
+     *     :param max: Optional upper bound on the count of present fields.
+     *         Defaults to ``None``.
+     *     :type max: int | None
+     *     :param message: Optional failure message. Defaults to ``None``.
+     *     :type message: str | None
+     */
+    framework__CardinalityRule: {
+      /** Fields */
+      fields: string[];
+      /** Max */
+      max?: number | null;
+      /** Message */
+      message?: string | null;
+      /** Min */
+      min?: number | null;
+      /** When */
+      when?: {
+        [key: string]: unknown;
+      } | null;
+    };
+    /**
+     * ChainedPredecessor
+     * @description Represent a chained predecessor task that runs before the parent.
+     *
+     *     The cascade module (:mod:`app.sep.apps.framework.cascade`) consumes
+     *     this spec when POSTing, PUTting, or DELETEing a plugin's tasks: each
+     *     predecessor is created with ``data["parent"]`` linked to the parent's
+     *     name (when ``parent_link`` is true) and named
+     *     ``f"{parent_name}{name_suffix}"``. Create persists task records only;
+     *     when the user starts the chain, the consuming plugin fires
+     *     ``POST /execute/{first_predecessor_name}`` using
+     *     :func:`build_predecessor_chain_execute_body` for ``chain_task_names``
+     *     (remaining predecessors then parent) and ``chain_on_failure`` derived
+     *     from ``on_failure`` (``"halt"`` maps to ``False``, ``"continue"`` maps
+     *     to ``True``).
+     *
+     *     :param name_suffix: String appended to the parent's ``name`` to form
+     *         the predecessor's name (for example ``"-pre-checks"``).
+     *     :type name_suffix: NonEmptyStr
+     *     :param on_failure: Chain semantics when the predecessor terminates
+     *         non-successfully. ``"halt"`` (default) stops the chain;
+     *         ``"continue"`` lets the chain continue regardless. Translates to
+     *         the boolean ``chain_on_failure`` flag at execute time.
+     *     :type on_failure: Literal["halt", "continue"]
+     *     :param parent_link: When true, set ``data["parent"]`` on the
+     *         predecessor payload to the parent's ``name``. Defaults to ``True``.
+     *     :type parent_link: bool
+     */
+    framework__ChainedPredecessor: {
+      /** Name Suffix */
+      name_suffix: string;
+      /**
+       * On Failure
+       * @default halt
+       * @enum {string}
+       */
+      on_failure: 'halt' | 'continue';
+      /**
+       * Parent Link
+       * @default true
+       */
+      parent_link: boolean;
+    };
+    /**
+     * Choice
+     * @description Represent one option in a choice or multi-choice field.
+     *
+     *     :param label: The human-readable label displayed for the choice.
+     *     :type label: NonEmptyStr
+     *     :param value: The value submitted when the choice is selected.
+     *     :type value: NonEmptyStr
+     *     :param disabled: Whether the option is rendered non-selectable. Optional,
+     *         defaulting to ``None`` (selectable). Typed ``bool | None`` so the
+     *         discovery endpoint's ``exclude_none`` posture drops it from the wire
+     *         until a plugin opts in, keeping the addition byte-compatible with
+     *         existing schemas. UI hint only; enforcing rejection of a disabled
+     *         value is the consuming app's responsibility.
+     *     :type disabled: bool | None
+     *     :param disabled_reason: Optional explanatory text surfaced (for example,
+     *         in a tooltip) when the option is disabled. Defaults to ``None`` and
+     *         may only be set when ``disabled`` is ``True``.
+     *     :type disabled_reason: NonEmptyStr | None
+     */
+    framework__Choice: {
+      /** Disabled */
+      disabled?: boolean | null;
+      /** Disabled Reason */
+      disabled_reason?: string | null;
+      /** Label */
+      label: string;
+      /** Value */
+      value: string;
+    };
+    /**
+     * ChoiceField
+     * @description Represent a single-select dropdown field.
+     *
+     *     :param field_type: The discriminator literal; always ``"choice"`` for this
+     *         class. Serialised as the JSON key ``"type"``.
+     *     :type field_type: Literal["choice"]
+     *     :param choices: The non-empty list of options the user can choose from.
+     *     :type choices: list[Choice]
+     */
+    framework__ChoiceField: {
+      /** Choices */
+      choices: components['schemas']['framework__Choice'][];
+      /** Default */
+      default?: unknown | null;
+      /** Description */
+      description?: string | null;
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /** Label */
+      label: string;
+      /** Name */
+      name: string;
+      /**
+       * Required
+       * @default false
+       */
+      required: boolean;
+      /** Requires */
+      requires?: components['schemas']['framework__FieldGate'][] | null;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'choice';
+    };
+    /**
+     * Column
+     * @description Represent one column in a plugin list view.
+     *
+     *     :param key: The task attribute path this column displays (for example,
+     *         ``"status"`` or ``"target.service"``).
+     *     :type key: NonEmptyStr
+     *     :param label: The human-readable column header.
+     *     :type label: NonEmptyStr
+     *     :param sortable: Whether the column can be used to sort the list.
+     *         Defaults to ``False``.
+     *     :type sortable: bool
+     *     :param format: Optional formatting hint applied when rendering the
+     *         column values. Defaults to ``None``.
+     *     :type format: ColumnFormat | None
+     */
+    framework__Column: {
+      format?: components['schemas']['framework__ColumnFormat'] | null;
+      /** Key */
+      key: string;
+      /** Label */
+      label: string;
+      /**
+       * Sortable
+       * @default false
+       */
+      sortable: boolean;
+    };
+    /**
+     * ColumnFormat
+     * @description Enumerate the supported list-view column formatting hints.
+     *
+     *     :cvar TEXT: Render the column value as plain text.
+     *     :vartype TEXT: str
+     *     :cvar CHIP: Render the column value as a Material UI chip.
+     *     :vartype CHIP: str
+     *     :cvar STATUS: Render the column value as a colour-coded status badge.
+     *     :vartype STATUS: str
+     *     :cvar DATE: Render the column value as an absolute date.
+     *     :vartype DATE: str
+     *     :cvar RELATIVE: Render the column value as a relative time (for example,
+     *         "2 hours ago").
+     *     :vartype RELATIVE: str
+     *     :cvar CODE: Render the column value in a monospaced code font.
+     *     :vartype CODE: str
+     *     :cvar ACTIONS: Row actions (for example delete); not bound to row data.
+     *         Use with a synthetic column key such as ``_actions``.
+     *     :vartype ACTIONS: str
+     *     :cvar SCHEDULE: Render a generic schedule cell for the row's task. The
+     *         frontend joins the row to its periodic task by name and shows the next
+     *         run (relative, with the absolute timestamp on hover) plus a periodicity
+     *         popover, or a muted "Not scheduled" chip when the task has no schedule.
+     *         Not bound to the column's own cell value.
+     *     :vartype SCHEDULE: str
+     * @enum {string}
+     */
+    framework__ColumnFormat:
+      | 'text'
+      | 'chip'
+      | 'status'
+      | 'date'
+      | 'relative'
+      | 'code'
+      | 'actions'
+      | 'schedule';
+    /**
+     * ConnectivityWarning
+     * @description Represent a connectivity-check failure on a JSON API task-creation response.
+     *
+     *     :param target: The Nomad node the task targets.
+     *     :param service_type: The lowercase database service type (e.g. ``mysql``).
+     *     :param message: A human-readable description of the failure.
+     *     :param task_history_id: The run-script task-history id whose log explains
+     *         the failure, or ``None`` when no task was created (e.g. the Tasks API
+     *         was unreachable). Optional for backward compatibility with existing
+     *         plugin consumers.
+     */
+    framework__ConnectivityWarning: {
+      /** Message */
+      message: string;
+      /** Service Type */
+      service_type: string;
+      /** Target */
+      target: string;
+      /** Task History Id */
+      task_history_id?: number | null;
+    };
+    /**
+     * DateTimeField
+     * @description Represent a datetime picker field.
+     *
+     *     :param field_type: The discriminator literal; always ``"datetime"`` for
+     *         this class. Serialised as the JSON key ``"type"``.
+     *     :type field_type: Literal["datetime"]
+     */
+    framework__DateTimeField: {
+      /** Default */
+      default?: unknown | null;
+      /** Description */
+      description?: string | null;
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /** Label */
+      label: string;
+      /** Name */
+      name: string;
+      /**
+       * Required
+       * @default false
+       */
+      required: boolean;
+      /** Requires */
+      requires?: components['schemas']['framework__FieldGate'][] | null;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'datetime';
+    };
+    /**
+     * DerivedTask
+     * @description Represent a sibling task derived from a parent during cascade operations.
+     *
+     *     The cascade module (:mod:`app.sep.apps.framework.cascade`) consumes this
+     *     spec when POSTing, PUTting, or DELETEing a plugin's tasks: the parent task
+     *     is created first, then for each ``DerivedTask`` the parent payload is
+     *     deep-copied, ``name`` is suffixed with ``name_suffix``, ``arg_substitutions``
+     *     are applied to ``data["meta"]["args"]`` as literal :meth:`str.replace`
+     *     calls in dict insertion order, ``payload_substitutions`` are applied to
+     *     ``data["payload"]`` as literal :meth:`str.replace` calls in dict insertion
+     *     order, ``data_overrides`` entries are assigned directly onto ``data`` as
+     *     literal key/value pairs in iteration order, and ``data["parent"]`` is set
+     *     to the parent's name when ``parent_link`` is true.
+     *
+     *     :param name_suffix: String appended to the parent's ``name`` to form the
+     *         derived task's name (for example ``"-dry-run"``).
+     *     :type name_suffix: NonEmptyStr
+     *     :param arg_substitutions: Optional ordered mapping of literal substring
+     *         replacements applied to ``data["meta"]["args"]``. Each ``(old, new)``
+     *         pair is applied once via :meth:`str.replace` in dict insertion order.
+     *         Defaults to ``None`` (no substitutions).
+     *     :type arg_substitutions: dict[str, str] | None
+     *     :param payload_substitutions: Optional ordered mapping of literal substring
+     *         replacements applied to ``data["payload"]``. Each ``(old, new)``
+     *         pair is applied once via :meth:`str.replace` in dict insertion order.
+     *         Defaults to ``None`` (no substitutions).
+     *     :type payload_substitutions: dict[str, str] | None
+     *     :param data_overrides: Optional mapping of literal key→value pairs
+     *         assigned directly onto ``data`` after substitutions run. Each
+     *         pair becomes ``data[key] = value`` in iteration order. Use this
+     *         for plugin-specific identity fields (e.g. ``{"backup_type":
+     *         "pbm_logical"}``) that the framework should not name itself.
+     *         Defaults to ``None``.
+     *     :type data_overrides: dict[str, Any] | None
+     *     :param parent_link: When true, set ``data["parent"]`` on the derived
+     *         payload to the parent's ``name``. Defaults to ``True``.
+     *     :type parent_link: bool
+     */
+    framework__DerivedTask: {
+      /** Arg Substitutions */
+      arg_substitutions?: {
+        [key: string]: string;
+      } | null;
+      /** Data Overrides */
+      data_overrides?: Record<string, never> | null;
+      /** Name Suffix */
+      name_suffix: string;
+      /**
+       * Parent Link
+       * @default true
+       */
+      parent_link: boolean;
+      /** Payload Substitutions */
+      payload_substitutions?: {
+        [key: string]: string;
+      } | null;
+    };
+    /**
+     * DetailField
+     * @description Declare one labelled field rendered inside a :class:`DetailSection`.
+     *
+     *     :param path: Dotted path into the task record (for example
+     *         ``"data.meta.command"``). Each segment must be a Python identifier,
+     *         optionally followed by one or more ``[N]`` array indices.
+     *     :type path: DetailPath
+     *     :param label: Human-readable label rendered alongside the resolved value.
+     *     :type label: NonEmptyStr
+     *     :param highlight: Optional syntax-highlighter hint. Defaults to ``None``.
+     *     :type highlight: DetailHighlightLanguage | None
+     */
+    framework__DetailField: {
+      highlight?:
+        | components['schemas']['framework__DetailHighlightLanguage']
+        | null;
+      /** Label */
+      label: string;
+      /** Path */
+      path: string;
+    };
+    /**
+     * DetailHighlightLanguage
+     * @description Enumerate supported syntax highlighters for detail fields.
+     * @enum {string}
+     */
+    framework__DetailHighlightLanguage: 'sql' | 'json' | 'bash' | 'yaml';
+    /**
+     * DetailSection
+     * @description Declare one titled section inside a :class:`DetailView`.
+     *
+     *     :param title: Heading rendered above the section's fields.
+     *     :type title: NonEmptyStr
+     *     :param fields: Ordered list of fields rendered inside the section. An
+     *         empty list is valid; the frontend hides the section when every
+     *         field resolves to an empty value.
+     *     :type fields: list[DetailField]
+     */
+    framework__DetailSection: {
+      /** Fields */
+      fields: components['schemas']['framework__DetailField'][];
+      /** Title */
+      title: string;
+    };
+    /**
+     * DetailView
+     * @description Declare the per-section detail-page layout for a task-style plugin.
+     *
+     *     Mirrors the role of :attr:`AppSchema.list_view` for the list table:
+     *     the React framework reads ``detail_view`` to render the task detail
+     *     page's section cards instead of inferring structure from the runtime
+     *     ``task.data`` shape.
+     *
+     *     :param sections: Ordered list of sections rendered on the detail page.
+     *         An empty list is valid; the frontend renders no section cards.
+     *         Section titles must be unique within a view so the React key can
+     *         be derived from the title without positional disambiguation.
+     *     :type sections: list[DetailSection]
+     */
+    framework__DetailView: {
+      /** Sections */
+      sections: components['schemas']['framework__DetailSection'][];
+    };
+    /**
+     * FailRule
+     * @description Express a predicate-only invariant: rule fails iff predicate matches.
+     *
+     *     :param fail_when: The predicate whose match triggers a failure.
+     *     :type fail_when: Predicate
+     *     :param error_fields: The field names the FE renderer should attach the
+     *         error to (informational hint; the runtime evaluator ignores this
+     *         list). May be empty when no field is logically responsible.
+     *     :type error_fields: list[str]
+     *     :param message: Optional failure message. Defaults to ``None``.
+     *     :type message: str | None
+     */
+    framework__FailRule: {
+      /** Error Fields */
+      error_fields: string[];
+      /**
+       * Fail When
+       * @description Predicate wire shape — a single-key object whose key is the operator name (equals, truthy, all, any, xor, not, etc.). See the plan for the full operator catalogue.
+       */
+      fail_when: {
+        [key: string]: unknown;
+      };
+      /** Message */
+      message?: string | null;
+    };
+    /**
+     * FieldGate
+     * @description Express a binary self-cardinality gate at :class:`BaseField` scope.
+     *
+     *     Used by :attr:`BaseField.requires` and :attr:`BaseField.forbidden`. The
+     *     target field is the field carrying the rule (implicit self).
+     *
+     *     :param when: The predicate that gates the rule.
+     *     :type when: Predicate
+     *     :param message: Optional failure message surfaced when the rule fires.
+     *         Defaults to ``None``.
+     *     :type message: str | None
+     */
+    framework__FieldGate: {
+      /** Message */
+      message?: string | null;
+      /**
+       * When
+       * @description Predicate wire shape — a single-key object whose key is the operator name (equals, truthy, all, any, xor, not, etc.). See the plan for the full operator catalogue.
+       */
+      when: {
+        [key: string]: unknown;
+      };
+    };
+    /**
+     * FileField
+     * @description Represent a file upload field.
+     *
+     *     :param field_type: The discriminator literal; always ``"file"`` for this
+     *         class. Serialised as the JSON key ``"type"``.
+     *     :type field_type: Literal["file"]
+     *     :param accept: Optional list of accepted file types, using the same
+     *         syntax as the HTML ``accept`` attribute (for example, ``[".sql",
+     *         ".csv"]`` or ``["image/png"]``). Defaults to ``None``.
+     *     :type accept: list[str] | None
+     */
+    framework__FileField: {
+      /** Accept */
+      accept?: string[] | null;
+      /** Default */
+      default?: unknown | null;
+      /** Description */
+      description?: string | null;
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /** Label */
+      label: string;
+      /** Name */
+      name: string;
+      /**
+       * Required
+       * @default false
+       */
+      required: boolean;
+      /** Requires */
+      requires?: components['schemas']['framework__FieldGate'][] | null;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'file';
+    };
+    /**
+     * FloatField
+     * @description Represent a float numeric input field.
+     *
+     *     :param field_type: The discriminator literal; always ``"float"`` for this
+     *         class. Serialised as the JSON key ``"type"``.
+     *     :type field_type: Literal["float"]
+     *     :param ge: Optional lower bound (inclusive) for accepted values. Defaults
+     *         to ``None``.
+     *     :type ge: float | None
+     *     :param le: Optional upper bound (inclusive) for accepted values. Defaults
+     *         to ``None``.
+     *     :type le: float | None
+     *     :param step: Optional step size for the input control. Defaults to
+     *         ``None``.
+     *     :type step: float | None
+     */
+    framework__FloatField: {
+      /** Default */
+      default?: unknown | null;
+      /** Description */
+      description?: string | null;
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /** Ge */
+      ge?: number | null;
+      /** Label */
+      label: string;
+      /** Le */
+      le?: number | null;
+      /** Name */
+      name: string;
+      /**
+       * Required
+       * @default false
+       */
+      required: boolean;
+      /** Requires */
+      requires?: components['schemas']['framework__FieldGate'][] | null;
+      /** Step */
+      step?: number | null;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'float';
+    };
+    /**
+     * FormSection
+     * @description Represent a labelled group of related fields rendered as one fieldset.
+     *
+     *     :param title: The section heading displayed above the grouped fields.
+     *     :type title: NonEmptyStr
+     *     :param description: Optional helper text rendered beneath the section
+     *         heading. Defaults to ``None``.
+     *     :type description: NonEmptyStr | None
+     *     :param fields: The list of fields belonging to this section. May include
+     *         :class:`OneOfGroup` containers alongside leaf fields.
+     *     :type fields: list[AnyField]
+     *     :param cardinality_rules: Optional cross-field cardinality constraints
+     *         scoped to the fields in this section. Defaults to ``None``.
+     *     :type cardinality_rules: list[CardinalityRule] | None
+     *     :param fail_when: Optional predicate-only invariants scoped to this
+     *         section. Defaults to ``None``.
+     *     :type fail_when: list[FailRule] | None
+     *     :param collapsible: Whether the renderer may collapse this section behind
+     *         a toggle. Defaults to ``False``.
+     *     :type collapsible: bool
+     *     :param collapsed_by_default: Whether a collapsible section should start
+     *         collapsed. Ignored when ``collapsible`` is ``False``. Defaults to
+     *         ``False``.
+     *     :type collapsed_by_default: bool
+     *     :param render_after_submit: Whether this section should render after the
+     *         submit button instead of before it. Defaults to ``False``.
+     *     :type render_after_submit: bool
+     *     :param forbidden: Optional gates that hide the entire section when any
+     *         of them fires. The schema-driven React renderer skips the section
+     *         and unregisters every child field from the form so stale values
+     *         do not ship in the submission payload. Gates may reference any
+     *         field declared in the plugin schema (including fields in other
+     *         sections). Defaults to ``None`` — sections render unconditionally.
+     *         Backend ``fail_when`` and conditional-rule validation on hidden
+     *         sections still applies: hidden-section children arrive in the
+     *         submitted payload as **absent** (not zeroed or defaulted), so
+     *         ``truthy``/``present`` predicates silently pass while
+     *         ``falsy``/``absent`` predicates see the children as missing.
+     *         Author ``fail_when`` rules accordingly.
+     *     :type forbidden: list[FieldGate] | None
+     */
+    framework__FormSection: {
+      /** Cardinality Rules */
+      cardinality_rules?:
+        | components['schemas']['framework__CardinalityRule'][]
+        | null;
+      /**
+       * Collapsed By Default
+       * @default false
+       */
+      collapsed_by_default: boolean;
+      /**
+       * Collapsible
+       * @default false
+       */
+      collapsible: boolean;
+      /** Description */
+      description?: string | null;
+      /** Fail When */
+      fail_when?: components['schemas']['framework__FailRule'][] | null;
+      /** Fields */
+      fields: (
+        | components['schemas']['framework__BoolField']
+        | components['schemas']['framework__ChoiceField']
+        | components['schemas']['framework__DateTimeField']
+        | components['schemas']['framework__FileField']
+        | components['schemas']['framework__FloatField']
+        | components['schemas']['framework__HostField']
+        | components['schemas']['framework__IntegerField']
+        | components['schemas']['framework__MultiChoiceField']
+        | components['schemas']['framework__MultiHostField']
+        | components['schemas']['framework__MultiSchemaField']
+        | components['schemas']['framework__MultiServiceField']
+        | components['schemas']['framework__MultiTableField']
+        | components['schemas']['framework__RemoteChoiceField']
+        | components['schemas']['framework__SchemaField']
+        | components['schemas']['framework__ScriptPreviewField']
+        | components['schemas']['framework__ServiceField']
+        | components['schemas']['framework__StringField']
+        | components['schemas']['framework__TableField']
+        | components['schemas']['framework__TextAreaField']
+        | components['schemas']['framework__YamlField']
+        | components['schemas']['framework__OneOfGroup']
+      )[];
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /**
+       * Render After Submit
+       * @default false
+       */
+      render_after_submit: boolean;
+      /** Title */
+      title: string;
+    };
+    /**
+     * HostField
+     * @description Represent an executor-target (Nomad / Celery) selector field.
+     *
+     *     The React renderer loads options from ``GET /api/sep/hosts/`` (an SEP
+     *     proxy endpoint that internally calls Tasks ``/hosts/`` and merges
+     *     Inventory display names server-side). When ``depends_on`` is set (typically
+     *     a ``ServiceField``), the renderer may auto-select an executor from the
+     *     upstream service; when omitted every available executor is listed and no
+     *     cascade runs.
+     *
+     *     :param field_type: The discriminator literal; always ``"host"`` for this
+     *         class. Serialised as the JSON key ``"type"``.
+     *     :type field_type: Literal["host"]
+     *     :param depends_on: Optional name of the field whose value drives the
+     *         default executor selection. ``None`` (the default) omits the key from
+     *         the wire so plugins that do not opt in stay byte-identical.
+     *     :param allow_custom: When ``True``, the selector also accepts a free-typed
+     *         value alongside the inventory options. ``None`` (the default) omits the
+     *         key from the wire so plugins that do not opt in stay byte-identical.
+     */
+    framework__HostField: {
+      /** Allow Custom */
+      allow_custom?: boolean | null;
+      /** Default */
+      default?: unknown | null;
+      /** Depends On */
+      depends_on?: string | null;
+      /** Description */
+      description?: string | null;
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /** Label */
+      label: string;
+      /** Name */
+      name: string;
+      /**
+       * Required
+       * @default false
+       */
+      required: boolean;
+      /** Requires */
+      requires?: components['schemas']['framework__FieldGate'][] | null;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'host';
+    };
+    /**
+     * IntegerField
+     * @description Represent an integer numeric input field.
+     *
+     *     :param field_type: The discriminator literal; always ``"integer"`` for this
+     *         class. Serialised as the JSON key ``"type"``.
+     *     :type field_type: Literal["integer"]
+     *     :param ge: Optional lower bound (inclusive) for accepted values. Defaults
+     *         to ``None``.
+     *     :type ge: int | None
+     *     :param le: Optional upper bound (inclusive) for accepted values. Defaults
+     *         to ``None``.
+     *     :type le: int | None
+     *     :param step: Optional step size for the input control. Defaults to
+     *         ``None``.
+     *     :type step: int | None
+     */
+    framework__IntegerField: {
+      /** Default */
+      default?: unknown | null;
+      /** Description */
+      description?: string | null;
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /** Ge */
+      ge?: number | null;
+      /** Label */
+      label: string;
+      /** Le */
+      le?: number | null;
+      /** Name */
+      name: string;
+      /**
+       * Required
+       * @default false
+       */
+      required: boolean;
+      /** Requires */
+      requires?: components['schemas']['framework__FieldGate'][] | null;
+      /** Step */
+      step?: number | null;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'integer';
+    };
+    /**
+     * ListView
+     * @description Represent the list-view configuration for a plugin.
+     *
+     *     :param columns: The ordered list of columns displayed in the list view.
+     *     :type columns: list[Column]
+     *     :param default_sort: Optional key of the column to sort by on first
+     *         render. Prefix with ``-`` for descending order (for example,
+     *         ``"-lastRun"``). The unprefixed key must match one of the declared
+     *         column keys. Defaults to ``None``.
+     *     :type default_sort: NonEmptyStr | None
+     *     :param overview_hidden_fields: Additional task-level keys to suppress
+     *         from the auto-rendered "extras" loop on the plugin detail Overview
+     *         tab. The framework always hides a baseline set of internal fields
+     *         (``id``, ``backend``, ``protected``, ``data``, ``updated_at``,
+     *         ``last_updated_by``, ``connectivity_warning``); any keys listed here
+     *         are merged with that baseline. Defaults to ``[]``.
+     *     :type overview_hidden_fields: list[str]
+     */
+    framework__ListView: {
+      /** Columns */
+      columns: components['schemas']['framework__Column'][];
+      /** Default Sort */
+      default_sort?: string | null;
+      /** Overview Hidden Fields */
+      overview_hidden_fields?: string[];
+    };
+    /**
+     * MultiChoiceField
+     * @description Represent a multi-select dropdown field.
+     *
+     *     :param field_type: The discriminator literal; always ``"multi_choice"``
+     *         for this class. Serialised as the JSON key ``"type"``.
+     *     :type field_type: Literal["multi_choice"]
+     *     :param choices: The non-empty list of options the user can choose from.
+     *     :type choices: list[Choice]
+     */
+    framework__MultiChoiceField: {
+      /** Choices */
+      choices: components['schemas']['framework__Choice'][];
+      /** Default */
+      default?: unknown | null;
+      /** Description */
+      description?: string | null;
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /** Label */
+      label: string;
+      /** Name */
+      name: string;
+      /**
+       * Required
+       * @default false
+       */
+      required: boolean;
+      /** Requires */
+      requires?: components['schemas']['framework__FieldGate'][] | null;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'multi_choice';
+    };
+    /**
+     * MultiHostField
+     * @description Represent a multi-value executor-target selector field.
+     *
+     *     The multi-value counterpart of :class:`HostField`: the renderer commits a
+     *     list of executor targets instead of a single one. Derived from a
+     *     ``HostRef(multiple=True)`` marker on a ``list[...]`` / ``set[...]`` field.
+     *
+     *     Cascade auto-select is single-host only (:class:`HostField`). ``depends_on``
+     *     may still be emitted when ``Ui(depends_on=...)`` is set so derivation stays
+     *     uniform, but the multi-host renderer does not honour it today.
+     *
+     *     :param field_type: The discriminator literal; always ``"multi_host"`` for
+     *         this class. Serialised as the JSON key ``"type"``.
+     *     :param depends_on: Optional upstream field name mirrored from
+     *         ``Ui(depends_on=...)``. Emitted for wire uniformity with
+     *         :class:`HostField`; the current multi-host renderer ignores it (no
+     *         cascade). ``None`` (the default) omits the key from the wire.
+     *     :param allow_custom: When ``True``, the selector also accepts free-typed
+     *         values alongside the inventory options. ``None`` (the default) omits the
+     *         key from the wire so plugins that do not opt in stay byte-identical.
+     */
+    framework__MultiHostField: {
+      /** Allow Custom */
+      allow_custom?: boolean | null;
+      /** Default */
+      default?: unknown | null;
+      /** Depends On */
+      depends_on?: string | null;
+      /** Description */
+      description?: string | null;
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /** Label */
+      label: string;
+      /** Name */
+      name: string;
+      /**
+       * Required
+       * @default false
+       */
+      required: boolean;
+      /** Requires */
+      requires?: components['schemas']['framework__FieldGate'][] | null;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'multi_host';
+    };
+    /**
+     * MultiSchemaField
+     * @description Represent a multi-value inventory database-schema selector field.
+     *
+     *     The multi-value counterpart of :class:`SchemaField`: the renderer commits a
+     *     list of schemas instead of a single one. Derived from a
+     *     ``SchemaRef(multiple=True)`` marker on a ``list[...]`` / ``set[...]`` field.
+     *
+     *     :param field_type: The discriminator literal; always ``"multi_schema"`` for
+     *         this class. Serialised as the JSON key ``"type"``.
+     *     :param depends_on: The name of the field whose value drives the list of
+     *         available schemas.
+     *     :param allow_custom: Opt-in flag for free-text (free-solo) entry alongside
+     *         the cascaded options. ``None`` (the default) omits the key from the wire
+     *         so plugins that do not opt in stay byte-identical.
+     */
+    framework__MultiSchemaField: {
+      /** Allow Custom */
+      allow_custom?: boolean | null;
+      /** Default */
+      default?: unknown | null;
+      /** Depends On */
+      depends_on: string;
+      /** Description */
+      description?: string | null;
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /** Label */
+      label: string;
+      /** Name */
+      name: string;
+      /**
+       * Required
+       * @default false
+       */
+      required: boolean;
+      /** Requires */
+      requires?: components['schemas']['framework__FieldGate'][] | null;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'multi_schema';
+    };
+    /**
+     * MultiServiceField
+     * @description Represent a multi-value inventory service selector field.
+     *
+     *     The multi-value counterpart of :class:`ServiceField`: the renderer commits a
+     *     list of services instead of a single one. Derived from a
+     *     ``ServiceRef(multiple=True)`` marker on a ``list[...]`` / ``set[...]`` field.
+     *
+     *     :param field_type: The discriminator literal; always ``"multi_service"`` for
+     *         this class. Serialised as the JSON key ``"type"``.
+     *     :param service_types: The list of service types the selector should offer
+     *         (for example, ``[ServiceTypeEnum.MYSQL]``).
+     *     :param allow_custom: Opt-in flag for free-text (free-solo) entry alongside
+     *         the inventory options. ``None`` (the default) omits the key from the wire
+     *         so plugins that do not opt in stay byte-identical.
+     */
+    framework__MultiServiceField: {
+      /** Allow Custom */
+      allow_custom?: boolean | null;
+      /** Default */
+      default?: unknown | null;
+      /** Description */
+      description?: string | null;
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /** Label */
+      label: string;
+      /** Name */
+      name: string;
+      /**
+       * Required
+       * @default false
+       */
+      required: boolean;
+      /** Requires */
+      requires?: components['schemas']['framework__FieldGate'][] | null;
+      /** Service Types */
+      service_types: components['schemas']['ServiceTypeEnum'][];
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'multi_service';
+    };
+    /**
+     * MultiTableField
+     * @description Represent a multi-value inventory table selector field.
+     *
+     *     The multi-value counterpart of :class:`TableField`: the renderer commits a
+     *     list of tables instead of a single one. Derived from a
+     *     ``TableRef(multiple=True)`` marker on a ``list[...]`` / ``set[...]`` field.
+     *
+     *     :param field_type: The discriminator literal; always ``"multi_table"`` for
+     *         this class. Serialised as the JSON key ``"type"``.
+     *     :param depends_on: The name of the field whose value drives the list of
+     *         available tables.
+     *     :param allow_custom: Opt-in flag for free-text (free-solo) entry alongside
+     *         the cascaded options. ``None`` (the default) omits the key from the wire
+     *         so plugins that do not opt in stay byte-identical.
+     */
+    framework__MultiTableField: {
+      /** Allow Custom */
+      allow_custom?: boolean | null;
+      /** Default */
+      default?: unknown | null;
+      /** Depends On */
+      depends_on: string;
+      /** Description */
+      description?: string | null;
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /** Label */
+      label: string;
+      /** Name */
+      name: string;
+      /**
+       * Required
+       * @default false
+       */
+      required: boolean;
+      /** Requires */
+      requires?: components['schemas']['framework__FieldGate'][] | null;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'multi_table';
+    };
+    /** MysqlBackupsCreateResponse */
+    framework__MysqlBackupsCreateResponse: {
+      /** Alert On Fail */
+      alert_on_fail: boolean;
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Anonymized Entities
+       * @description Return sorted PII entity names decoded from ``anonymize_mask``.
+       */
+      readonly anonymized_entities: string[];
+      backend: components['schemas']['TaskBackendEnum'];
+      backup_type?: components['schemas']['mysql_backups__BackupType'] | null;
+      connectivity_warning?:
+        | components['schemas']['framework__ConnectivityWarning']
+        | null;
+      /** Created At */
+      created_at?: string | null;
+      /** Created By */
+      created_by?: string | null;
+      /** Data */
+      data: Record<string, never>;
+      /** Hostname */
+      hostname?: string | null;
+      /** Id */
+      id?: number | null;
+      /** Last Executed At */
+      last_executed_at?: string | null;
+      /** Last Updated By */
+      last_updated_by?: string | null;
+      /** Name */
+      name: string;
+      /** Protected */
+      protected: boolean;
+      status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * OneOfBranch
+     * @description Represent one mutually-exclusive branch inside a :class:`OneOfGroup`.
+     *
+     *     :param value: The discriminator value that selects this branch.
+     *     :param label: The human-readable label for the segmented-control option.
+     *     :param fields: The leaf fields revealed when this branch is active.
+     */
+    framework__OneOfBranch: {
+      /** Fields */
+      fields: (
+        | components['schemas']['framework__BoolField']
+        | components['schemas']['framework__ChoiceField']
+        | components['schemas']['framework__DateTimeField']
+        | components['schemas']['framework__FileField']
+        | components['schemas']['framework__FloatField']
+        | components['schemas']['framework__HostField']
+        | components['schemas']['framework__IntegerField']
+        | components['schemas']['framework__MultiChoiceField']
+        | components['schemas']['framework__MultiHostField']
+        | components['schemas']['framework__MultiSchemaField']
+        | components['schemas']['framework__MultiServiceField']
+        | components['schemas']['framework__MultiTableField']
+        | components['schemas']['framework__RemoteChoiceField']
+        | components['schemas']['framework__SchemaField']
+        | components['schemas']['framework__ScriptPreviewField']
+        | components['schemas']['framework__ServiceField']
+        | components['schemas']['framework__StringField']
+        | components['schemas']['framework__TableField']
+        | components['schemas']['framework__TextAreaField']
+        | components['schemas']['framework__YamlField']
+      )[];
+      /** Label */
+      label: string;
+      /** Value */
+      value: string;
+    };
+    /**
+     * OneOfGroup
+     * @description Represent a labelled either/or field group with a segmented mode switch.
+     *
+     *     The React renderer binds :attr:`discriminator` to a ``ToggleButtonGroup``,
+     *     shows :attr:`description` as helper text, and renders only the active
+     *     branch's :attr:`~OneOfBranch.fields`. Inactive-branch leaves are forbidden
+     *     at validation time via rules synthesised from the group's branch contract.
+     *
+     *     :param field_type: The discriminator literal; always ``"one_of"`` for this
+     *         class. Serialised as the JSON key ``"type"``.
+     *     :param name: Stable group identifier used as the React list key. Not a
+     *         separate form value — :attr:`discriminator` names the mode field.
+     *     :param label: The human-readable group heading above the segmented control.
+     *     :param description: Optional helper text rendered beneath the group label.
+     *         Defaults to ``None``.
+     *     :param discriminator: Dotted path to the mode field (for example,
+     *         ``"source.mode"``) whose value selects the active branch.
+     *     :param default: Optional default branch :attr:`~OneOfBranch.value`. Must
+     *         match one of the declared branches when set. Defaults to ``None``.
+     *     :param branches: Two or more named branches, each owning its own field list.
+     */
+    framework__OneOfGroup: {
+      /** Branches */
+      branches: components['schemas']['framework__OneOfBranch'][];
+      /** Default */
+      default?: string | null;
+      /** Description */
+      description?: string | null;
+      /** Discriminator */
+      discriminator: string;
+      /** Label */
+      label: string;
+      /** Name */
+      name: string;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'one_of';
+    };
+    /** PaginatedResponse[BaseTaskResponse] */
+    framework__PaginatedResponse_BaseTaskResponse_: {
+      /** Items */
+      items: components['schemas']['framework__BaseTaskResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /**
+     * RelatedApp
+     * @description Declare a separately registered app surfaced as a sibling tab in the UI.
+     *
+     *     Consumed by the React ``SchemaDrivenPlugin`` shell to mount a nested
+     *     schema-driven flow for the related registry entry (for example
+     *     ``mysql_backups/restore``) under ``{route_base}/{route_segment}`` without
+     *     re-merging the child app's API router into the parent.
+     *
+     *     :param app_key: The scoped registry key of the related app (for example
+     *         ``mysql_backups/restore``).
+     *     :type app_key: NonEmptyStr
+     *     :param label: The human-readable tab label (for example ``Restore``).
+     *     :type label: NonEmptyStr
+     *     :param route_segment: The React sub-path segment under the parent's
+     *         ``route_base`` (for example ``restores``). Must be a single URL path
+     *         segment — no slashes — and must not be a reserved single-entity route
+     *         keyword (``new``, ``schedule``, ``task``).
+     *     :type route_segment: NonEmptyStr
+     */
+    framework__RelatedApp: {
+      /** App Key */
+      app_key: string;
+      /** Label */
+      label: string;
+      /** Route Segment */
+      route_segment: string;
+    };
+    /**
+     * RemoteChoiceField
+     * @description Represent a field whose options are fetched at render from an app endpoint.
+     *
+     *     The renderer fetches ``endpoint_url`` and renders the returned
+     *     ``Choice``-compatible options (``value`` / ``label`` / optional ``disabled``
+     *     / ``disabled_reason``). When ``depends_on`` is set, the fetch is
+     *     parameterised by the dependency's value (appended as a query parameter named
+     *     after ``depends_on``) and the field stays disabled/empty until the
+     *     dependency has a value. When ``allow_custom`` is set, the renderer also
+     *     accepts a free-typed value. The endpoint response contract is a JSON array
+     *     of objects shaped like :class:`Choice`: ``{"value": str, "label": str,
+     *     "disabled"?: bool, "disabled_reason"?: str}``.
+     *
+     *     :param field_type: The discriminator literal; always ``"remote_choice"``.
+     *         Serialised as the JSON key ``"type"``.
+     *     :param endpoint_url: The fully-resolved URL the renderer fetches options
+     *         from, relative to the frontend ``apiClient`` base (``/api``).
+     *     :param depends_on: Optional name of the sibling field whose value drives
+     *         (and parameterises) the option fetch. ``None`` (the default) omits the
+     *         key from the wire so plugins that do not cascade stay byte-identical.
+     *     :param allow_custom: When ``True``, the selector also accepts a free-typed
+     *         value. ``None`` (the default) omits the key from the wire so plugins
+     *         that do not opt in stay byte-identical.
+     */
+    framework__RemoteChoiceField: {
+      /** Allow Custom */
+      allow_custom?: boolean | null;
+      /** Default */
+      default?: unknown | null;
+      /** Depends On */
+      depends_on?: string | null;
+      /** Description */
+      description?: string | null;
+      /** Endpoint Url */
+      endpoint_url: string;
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /** Label */
+      label: string;
+      /** Name */
+      name: string;
+      /**
+       * Required
+       * @default false
+       */
+      required: boolean;
+      /** Requires */
+      requires?: components['schemas']['framework__FieldGate'][] | null;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'remote_choice';
+    };
+    /**
+     * SchemaField
+     * @description Represent an inventory database-schema selector field.
+     *
+     *     ``depends_on`` is a forward reference to another field's ``name`` in the
+     *     same plugin schema (typically a ``ServiceField``); the React renderer
+     *     cascades schema options from the selected service. The referenced field
+     *     is not validated at the schema level.
+     *
+     *     :param field_type: The discriminator literal; always ``"schema"`` for
+     *         this class. Serialised as the JSON key ``"type"``.
+     *     :type field_type: Literal["schema"]
+     *     :param depends_on: The name of the field whose value drives the list of
+     *         available schemas.
+     *     :type depends_on: NonEmptyStr
+     *     :param allow_custom: Opt-in capability flag declaring that a consuming
+     *         renderer may offer free-text (free-solo) entry in addition to the
+     *         cascaded inventory options. Optional, defaulting to ``None`` (options
+     *         only). Typed ``bool | None`` so the discovery endpoint's
+     *         ``exclude_none`` posture drops it from the wire until a plugin opts
+     *         in, keeping the addition byte-compatible with existing schemas. The
+     *         built-in SchemaFormRenderer does not yet consume the flag; the
+     *         free-solo widget that reads it ships with the consuming plugin.
+     *     :type allow_custom: bool | None
+     */
+    framework__SchemaField: {
+      /** Allow Custom */
+      allow_custom?: boolean | null;
+      /** Default */
+      default?: unknown | null;
+      /** Depends On */
+      depends_on: string;
+      /** Description */
+      description?: string | null;
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /** Label */
+      label: string;
+      /** Name */
+      name: string;
+      /**
+       * Required
+       * @default false
+       */
+      required: boolean;
+      /** Requires */
+      requires?: components['schemas']['framework__FieldGate'][] | null;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'schema';
+    };
+    /**
+     * ScriptExecuteWrite
+     * @description Define the JSON body for ``POST .../snippet/execute``.
+     *
+     *     The per-script frontmatter arguments go in ``args`` and are validated against
+     *     the script's dynamic execution model, while ``executor_host`` and ``sudo`` are
+     *     execution-level inputs the consumer's ``build_execution_meta`` reads.
+     *
+     *     :param executor_host: The hostname of the executor that will run the script.
+     *     :param sudo: Whether to invoke the script with sudo. The consumer's
+     *         ``build_execution_meta`` decides whether the script honours it.
+     *     :param args: Per-parameter arguments keyed by parameter name, validated
+     *         against the script's dynamic execution model.
+     */
+    framework__ScriptExecuteWrite: {
+      /**
+       * Args
+       * @default {}
+       */
+      args: {
+        [key: string]: unknown;
+      };
+      /** Execution Host */
+      executor_host: string;
+      /**
+       * Sudo
+       * @default false
+       */
+      sudo: boolean;
+    };
+    /**
+     * ScriptExecutionResponse
+     * @description Represent the response from the script execute endpoint.
+     *
+     *     :param task_name: The Tasks-API task name the script executed under.
+     *     :param task_id: The id of the task-history row the Tasks API created, when the
+     *         upstream response carries one.
+     *     :param snippet_filename: The filename of the executed script.
+     */
+    framework__ScriptExecutionResponse: {
+      /** Snippet Filename */
+      snippet_filename: string;
+      /** Task Id */
+      task_id?: number | null;
+      /** Task Name */
+      task_name: string;
+    };
+    /**
+     * ScriptPreviewField
+     * @description Represent a read-only field that renders a backend-fetched script preview.
+     *
+     *     The renderer fetches ``endpoint_url`` on mount, and re-fetches whenever
+     *     any sibling field listed in ``depends_on`` changes value (debounced and
+     *     cancellation-safe). The response shape is
+     *     ``{content: str, language: str, is_truncated: bool}``.
+     *
+     *     :param field_type: The discriminator literal; always
+     *         ``"script_preview"`` for this class. Serialised as the JSON key
+     *         ``"type"``.
+     *     :type field_type: Literal["script_preview"]
+     *     :param endpoint_url: The fully-resolved URL the renderer fetches preview
+     *         content from, relative to the FE ``apiClient`` base (``/api``). Schema
+     *         synthesisers should bake any plugin-specific path segments (for
+     *         example, ``/apps/snippets/{filename}/preview``) here at
+     *         schema build time rather than templating client-side.
+     *     :type endpoint_url: NonEmptyStr
+     *     :param depends_on: Names of sibling fields whose values trigger a
+     *         re-fetch when changed. Empty (the default) means fetch once on
+     *         mount.
+     *     :type depends_on: list[NonEmptyStr]
+     *     :param language: Optional default highlighter language hint used when
+     *         the backend response omits ``language``. Defaults to ``None``.
+     *     :type language: NonEmptyStr | None
+     */
+    framework__ScriptPreviewField: {
+      /** Default */
+      default?: unknown | null;
+      /** Depends On */
+      depends_on?: string[];
+      /** Description */
+      description?: string | null;
+      /** Endpoint Url */
+      endpoint_url: string;
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /** Label */
+      label: string;
+      /** Language */
+      language?: string | null;
+      /** Name */
+      name: string;
+      /**
+       * Required
+       * @default false
+       */
+      required: boolean;
+      /** Requires */
+      requires?: components['schemas']['framework__FieldGate'][] | null;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'script_preview';
+    };
+    /**
+     * ScriptPreviewResponse
+     * @description Represent the backend response for the preview endpoint.
+     *
+     *     :param content: The full text content of the snippet file (preamble,
+     *         frontmatter, and body concatenated).
+     *     :param language: A JS syntax-highlighter language identifier derived
+     *         from the snippet's MIME type (for example, ``"bash"`` or
+     *         ``"plaintext"``).
+     *     :param is_truncated: Whether the preview was truncated to fit
+     *         within the configured per-file character or line limit.
+     */
+    framework__ScriptPreviewResponse: {
+      /** Content */
+      content: string;
+      /** Is Truncated */
+      is_truncated: boolean;
+      /** Language */
+      language: string;
+    };
+    /**
+     * ServiceField
+     * @description Represent an inventory service selector field.
+     *
+     *     :param field_type: The discriminator literal; always ``"service"`` for
+     *         this class. Serialised as the JSON key ``"type"``.
+     *     :type field_type: Literal["service"]
+     *     :param service_types: The list of service types the selector should offer
+     *         (for example, ``[ServiceTypeEnum.MYSQL]``).
+     *     :type service_types: list[ServiceTypeEnum]
+     *     :param allow_custom: Opt-in capability flag declaring that a consuming
+     *         renderer may offer free-text (free-solo) entry in addition to the
+     *         inventory options. Optional, defaulting to ``None`` (options only).
+     *         Typed ``bool | None`` so the discovery endpoint's ``exclude_none``
+     *         posture drops it from the wire until a plugin opts in, keeping the
+     *         addition byte-compatible with existing schemas. The built-in
+     *         SchemaFormRenderer does not yet consume the flag; the free-solo
+     *         widget that reads it ships with the consuming plugin.
+     *     :type allow_custom: bool | None
+     */
+    framework__ServiceField: {
+      /** Allow Custom */
+      allow_custom?: boolean | null;
+      /** Default */
+      default?: unknown | null;
+      /** Description */
+      description?: string | null;
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /** Label */
+      label: string;
+      /** Name */
+      name: string;
+      /**
+       * Required
+       * @default false
+       */
+      required: boolean;
+      /** Requires */
+      requires?: components['schemas']['framework__FieldGate'][] | null;
+      /** Service Types */
+      service_types: components['schemas']['ServiceTypeEnum'][];
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'service';
+    };
+    /**
+     * StringField
+     * @description Represent a single-line string input field.
+     *
+     *     :param field_type: The discriminator literal; always ``"string"`` for this
+     *         class. Serialised as the JSON key ``"type"``.
+     *     :type field_type: Literal["string"]
+     *     :param min_length: Optional minimum character length. Defaults to
+     *         ``None``.
+     *     :type min_length: int | None
+     *     :param max_length: Optional maximum character length. Defaults to
+     *         ``None``.
+     *     :type max_length: int | None
+     *     :param pattern: Optional regular expression the value must match.
+     *         Defaults to ``None``.
+     *     :type pattern: NonEmptyStr | None
+     *     :param placeholder: Optional placeholder text displayed when the field is
+     *         empty. Defaults to ``None``.
+     *     :type placeholder: NonEmptyStr | None
+     */
+    framework__StringField: {
+      /** Default */
+      default?: unknown | null;
+      /** Description */
+      description?: string | null;
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /** Label */
+      label: string;
+      /** Max Length */
+      max_length?: number | null;
+      /** Min Length */
+      min_length?: number | null;
+      /** Name */
+      name: string;
+      /** Pattern */
+      pattern?: string | null;
+      /** Placeholder */
+      placeholder?: string | null;
+      /**
+       * Required
+       * @default false
+       */
+      required: boolean;
+      /** Requires */
+      requires?: components['schemas']['framework__FieldGate'][] | null;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'string';
+    };
+    /**
+     * TableField
+     * @description Represent an inventory table selector field.
+     *
+     *     ``depends_on`` is a forward reference to another field's ``name`` in the
+     *     same plugin schema (typically a ``SchemaField``); the React renderer
+     *     cascades table options from the selected schema. The referenced field
+     *     is not validated at the schema level.
+     *
+     *     :param field_type: The discriminator literal; always ``"table"`` for this
+     *         class. Serialised as the JSON key ``"type"``.
+     *     :type field_type: Literal["table"]
+     *     :param depends_on: The name of the field whose value drives the list of
+     *         available tables.
+     *     :type depends_on: NonEmptyStr
+     *     :param allow_custom: Opt-in capability flag declaring that a consuming
+     *         renderer may offer free-text (free-solo) entry in addition to the
+     *         cascaded inventory options. Optional, defaulting to ``None`` (options
+     *         only). Typed ``bool | None`` so the discovery endpoint's
+     *         ``exclude_none`` posture drops it from the wire until a plugin opts
+     *         in, keeping the addition byte-compatible with existing schemas. The
+     *         built-in SchemaFormRenderer does not yet consume the flag; the
+     *         free-solo widget that reads it ships with the consuming plugin.
+     *     :type allow_custom: bool | None
+     */
+    framework__TableField: {
+      /** Allow Custom */
+      allow_custom?: boolean | null;
+      /** Default */
+      default?: unknown | null;
+      /** Depends On */
+      depends_on: string;
+      /** Description */
+      description?: string | null;
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /** Label */
+      label: string;
+      /** Name */
+      name: string;
+      /**
+       * Required
+       * @default false
+       */
+      required: boolean;
+      /** Requires */
+      requires?: components['schemas']['framework__FieldGate'][] | null;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'table';
+    };
+    /**
+     * TaskExecuteWrite
+     * @description Represent the default JSON request body for executing a task.
+     *
+     *     :param eta: Optional future datetime to schedule execution.
+     *     :param chain_task_names: Optional list of task names to chain after this one.
+     *     :param chain_on_failure: Whether to run chained tasks even on failure.
+     */
+    framework__TaskExecuteWrite: {
+      /** Chain On Failure */
+      chain_on_failure?: boolean | null;
+      /** Chain Task Names */
+      chain_task_names?: string[] | null;
+      /** Eta */
+      eta?: string | null;
+    };
+    /**
+     * TaskExecutionResponse
+     * @description Represent the default response from a task execute route.
+     *
+     *     :param task_name: The name of the task that was executed.
+     *     :param task_id: The id of the task-history row created by the tasks API.
+     */
+    framework__TaskExecutionResponse: {
+      /** Task Id */
+      task_id?: number | null;
+      /** Task Name */
+      task_name: string;
+    };
+    /**
+     * TextAreaField
+     * @description Represent a multi-line string input field.
+     *
+     *     :param field_type: The discriminator literal; always ``"textarea"`` for
+     *         this class. Serialised as the JSON key ``"type"``.
+     *     :type field_type: Literal["textarea"]
+     *     :param rows: Optional number of visible text rows. Defaults to ``None``.
+     *     :type rows: int | None
+     *     :param placeholder: Optional placeholder text displayed when the field is
+     *         empty. Defaults to ``None``.
+     *     :type placeholder: NonEmptyStr | None
+     */
+    framework__TextAreaField: {
+      /** Default */
+      default?: unknown | null;
+      /** Description */
+      description?: string | null;
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /** Label */
+      label: string;
+      /** Name */
+      name: string;
+      /** Placeholder */
+      placeholder?: string | null;
+      /**
+       * Required
+       * @default false
+       */
+      required: boolean;
+      /** Requires */
+      requires?: components['schemas']['framework__FieldGate'][] | null;
+      /** Rows */
+      rows?: number | null;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'textarea';
+    };
+    /**
+     * YamlField
+     * @description Represent a YAML-syntax multi-line text input field.
+     *
+     *     :param field_type: The discriminator literal; always ``"yaml"`` for this
+     *         class. Serialised as the JSON key ``"type"``.
+     *     :type field_type: Literal["yaml"]
+     *     :param rows: Optional number of visible text rows. Defaults to ``None``.
+     *     :type rows: int | None
+     *     :param placeholder: Optional placeholder text displayed when the field is
+     *         empty. Defaults to ``None``.
+     *     :type placeholder: NonEmptyStr | None
+     */
+    framework__YamlField: {
+      /** Default */
+      default?: unknown | null;
+      /** Description */
+      description?: string | null;
+      /** Forbidden */
+      forbidden?: components['schemas']['framework__FieldGate'][] | null;
+      /** Label */
+      label: string;
+      /** Name */
+      name: string;
+      /** Placeholder */
+      placeholder?: string | null;
+      /**
+       * Required
+       * @default false
+       */
+      required: boolean;
+      /** Requires */
+      requires?: components['schemas']['framework__FieldGate'][] | null;
+      /** Rows */
+      rows?: number | null;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'yaml';
+    };
+    /**
+     * AvailableSyncer
+     * @description Provide template-facing metadata for an available syncer.
+     *
+     *     :param name: The fully qualified ``"module.ClassName"`` identifier matching
+     *         ``BaseSyncer.get_name()`` and the value persisted in
+     *         ``SyncInstance.syncer``. Used as the wire identifier in form payloads.
+     *     :type name: str
+     *     :param display_name: The human-readable label rendered in the dropdown
+     *         (the syncer class's short name with any trailing ``Syncer`` suffix
+     *         stripped).
+     *     :type display_name: str
+     */
+    inventory__AvailableSyncer: {
+      /** Display Name */
+      display_name: string;
+      /** Name */
+      name: string;
+    };
+    /**
+     * InventorySyncStatusResponse
+     * @description Represent the inventory sync status response.
+     *
+     *     :param is_running: ``True`` when an inventory-wide sync is currently
+     *         in progress; ``False`` otherwise.
+     *     :type is_running: bool
+     */
+    inventory__InventorySyncStatusResponse: {
+      /** Is Running */
+      is_running: boolean;
+    };
+    /**
+     * InventorySyncTriggerWrite
+     * @description Carry the optional JSON body for the ad-hoc inventory sync trigger.
+     *
+     *     A ``None`` or empty ``syncer`` selects the sync-all path; a non-empty
+     *     string targets a single configured syncer by its fully qualified
+     *     ``"module.ClassName"`` identifier. Unknown fields are rejected with
+     *     HTTP 422 so a typo on the client never silently degrades to sync-all.
+     *
+     *     :param syncer: Fully qualified syncer name, or ``None`` for sync-all.
+     *     :type syncer: str | None
+     */
+    inventory__InventorySyncTriggerWrite: {
+      /** Syncer */
+      syncer?: string | null;
+    };
+    /**
+     * PluginTaskResponse
+     * @description Represent a single plugin task entry returned by ``GET /api/apps/inventory/``.
+     *
+     *     :param name: Machine-readable task identifier (e.g. ``"inventory-sync"``).
+     *     :type name: str
+     *     :param display_name: Human-readable label for the schedule UI.
+     *     :type display_name: str
+     */
+    inventory__PluginTaskResponse: {
+      /** Display Name */
+      display_name: string;
+      /** Name */
+      name: string;
+    };
+    /**
+     * BackupCreate
+     * @description Declare the model-first create/update body and ``GET /schema`` source for MySQL Backups.
+     *
+     *     Declares each form field once, in section order (Task, General, Mydumper,
+     *     XtraBackup, Binlog, Encryption, Upload), with the DSL markers driving the
+     *     derived schema. Field declaration order is load-bearing: the derived section
+     *     order follows each section's first field, and the within-section order follows
+     *     declaration order, so the order here reproduces the hand-written schema
+     *     byte-for-byte. The conditional gating that the legacy ``schema.py`` declared
+     *     (per-mode ``forbidden`` gates, the upload-provider ``Contains`` gates, the
+     *     encryption requires/forbidden pair, and the per-mode bool ``FailRule``s in
+     *     :attr:`__form_rules__`) now lives on the model; ``AppFormModel`` extracts it
+     *     into the conditional-rule plan at class definition, so no
+     *     ``@apply_conditional_rules`` decorator is needed. The config sub-models
+     *     (:class:`BackupConfigAll` and friends) stay the serialization target the
+     *     payload builder populates, not this model's base class.
+     *
+     *     :cvar __form_rules__: The per-mode bool fail rules — a truthy mode-owned bool
+     *         outside its mode fails validation with a per-field message.
+     */
+    mysql_backups__BackupCreate: {
+      /**
+       * Alert On Fail
+       * @default false
+       */
+      alert_on_fail: boolean;
+      /** Alias */
+      alias?: string | null;
+      /** Awscli S3 Upload Extra Args */
+      awscli_s3_upload_extra_args?: string | null;
+      /** Backup Dir */
+      backup_dir?: string | null;
+      backup_type: components['schemas']['mysql_backups__BackupType'];
+      /** Binlog Alternative Host */
+      binlog_alternative_host?: string | null;
+      /** Binlog Cmd */
+      binlog_cmd?: string | null;
+      /** Binlog Compress Cmd */
+      binlog_compress_cmd?: string | null;
+      /** Binlog Extra Args */
+      binlog_extra_args?: string | null;
+      /** Binlog Prefix */
+      binlog_prefix?: string | null;
+      /** Binlog Purge Days */
+      binlog_purge_days?: number | null;
+      /**
+       * Binlog Run All
+       * @default true
+       */
+      binlog_run_all: boolean;
+      /**
+       * Check Disk Space
+       * @default false
+       */
+      check_disk_space: boolean;
+      /**
+       * Compress
+       * @default false
+       */
+      compress: boolean;
+      /** Compression Algorithm */
+      compression_algorithm?:
+        | components['schemas']['mysql_backups__CompressionAlgorithm']
+        | null;
+      /** Defaults File */
+      defaults_file?: string | null;
+      /**
+       * Encrypt
+       * @default false
+       */
+      encrypt: boolean;
+      /**
+       * Encrypt Using Tmpdir
+       * @default false
+       */
+      encrypt_using_tmpdir: boolean;
+      /** Encryption Recipient */
+      encryption_recipient?: string | null;
+      /** Gs Bucket */
+      gs_bucket?: string | null;
+      /**
+       * Hardlink
+       * @default false
+       */
+      hardlink: boolean;
+      /** Hostname */
+      hostname: string;
+      /** Logging Dir */
+      logging_dir?: string | null;
+      /** Mydumper Daily Purge */
+      mydumper_daily_purge?: number | null;
+      /**
+       * Mydumper Desync Pxc
+       * @default false
+       */
+      mydumper_desync_pxc: boolean;
+      /**
+       * Mydumper Dump Triggers
+       * @default false
+       */
+      mydumper_dump_triggers: boolean;
+      /** Mydumper Extra Args */
+      mydumper_extra_args?: string | null;
+      /**
+       * Mydumper Use Numa
+       * @default false
+       */
+      mydumper_use_numa: boolean;
+      /** Mydumper Verbose */
+      mydumper_verbose?: number | null;
+      /** Mydumper Weekly Purge */
+      mydumper_weekly_purge?: number | null;
+      /**
+       * Only If Read Only
+       * @default false
+       */
+      only_if_read_only: boolean;
+      /**
+       * Only If Running Replica
+       * @default false
+       */
+      only_if_running_replica: boolean;
+      /**
+       * Post Run Encrypt
+       * @default false
+       */
+      post_run_encrypt: boolean;
+      /** Rsync Path */
+      rsync_path?: string | null;
+      /** S3 Bucket */
+      s3_bucket?: string | null;
+      /** S3 Storage Class */
+      s3_storage_class?: string | null;
+      /** Service Id */
+      service_id: number;
+      /**
+       * Skip S3 Safety Check
+       * @default false
+       */
+      skip_s3_safety_check: boolean;
+      /** Task Name */
+      task_name: string;
+      /** Upload */
+      upload?: components['schemas']['mysql_backups__UploadProvider'][];
+      /**
+       * Upload Quiet
+       * @default false
+       */
+      upload_quiet: boolean;
+      /**
+       * Use Ftwrl Guardian
+       * @default false
+       */
+      use_ftwrl_guardian: boolean;
+      /** Xtrabackup Aes256 Keyfile */
+      xtrabackup_aes256_keyfile?: string | null;
+      /** Xtrabackup Bin Cmd */
+      xtrabackup_bin_cmd?:
+        | ('xtrabackup' | 'mariadb-backup' | 'innobackupex')
+        | null;
+      /** Xtrabackup Copies */
+      xtrabackup_copies?: number | null;
+      /** Xtrabackup Defaults File */
+      xtrabackup_defaults_file?: string | null;
+      /**
+       * Xtrabackup Desync Pxc
+       * @default false
+       */
+      xtrabackup_desync_pxc: boolean;
+      /** Xtrabackup Extra Args */
+      xtrabackup_extra_args?: string | null;
+      /** Xtrabackup Incremental Cycle */
+      xtrabackup_incremental_cycle?:
+        | ('daily' | 'weekly' | '2' | '3' | '4' | '5' | '6' | '7')
+        | null;
+      /** Xtrabackup Incremental Method */
+      xtrabackup_incremental_method?: ('less_space' | 'fast_restore') | null;
+      /**
+       * Xtrabackup Kill Queries
+       * @default false
+       */
+      xtrabackup_kill_queries: boolean;
+      /** Xtrabackup Kill Queries Timeout */
+      xtrabackup_kill_queries_timeout?: number | null;
+      /** Xtrabackup Kill Query Type */
+      xtrabackup_kill_query_type?: ('select' | 'all') | null;
+      /** Xtrabackup Local Ssh Destination */
+      xtrabackup_local_ssh_destination?: string | null;
+      /**
+       * Xtrabackup Lock Ddl
+       * @default false
+       */
+      xtrabackup_lock_ddl: boolean;
+      /**
+       * Xtrabackup Prepare
+       * @default false
+       */
+      xtrabackup_prepare: boolean;
+      /** Xtrabackup Prepare Memory */
+      xtrabackup_prepare_memory?: string | null;
+      /**
+       * Xtrabackup Quiet
+       * @default false
+       */
+      xtrabackup_quiet: boolean;
+      /**
+       * Xtrabackup Replica Info
+       * @default false
+       */
+      xtrabackup_replica_info: boolean;
+      /**
+       * Xtrabackup Rsync
+       * @default false
+       */
+      xtrabackup_rsync: boolean;
+      /**
+       * Xtrabackup Stop Replica
+       * @default false
+       */
+      xtrabackup_stop_replica: boolean;
+      /**
+       * Xtrabackup Verify
+       * @default false
+       */
+      xtrabackup_verify: boolean;
+    };
+    /**
+     * BackupRunResponse
+     * @description Expose one catalog record over the per-service query path.
+     *
+     *     :param id: The record's primary key.
+     *     :param service_name: The inventory service the backup was taken from.
+     *     :param hostname: The backup target host.
+     *     :param backup_type: The backup tool, ``"M"`` (mydumper) or ``"X"`` (xtrabackup).
+     *         Narrower than :class:`BackupType`: binlog runs are never catalogued, so
+     *         ``"B"`` never appears here.
+     *     :param location: The resolved on-disk directory the run produced.
+     *     :param upload_destination: The upload destination when one was configured.
+     *     :param size_bytes: The backup size in bytes, when the run reported it.
+     *     :param started_at: When the run started.
+     *     :param finished_at: When the run finished.
+     */
+    mysql_backups__BackupRunResponse: {
+      /**
+       * Backup Type
+       * @enum {string}
+       */
+      backup_type: 'M' | 'X';
+      /** Finished At */
+      finished_at: string | null;
+      /** Hostname */
+      hostname: string | null;
+      /** Id */
+      id: number;
+      /** Location */
+      location: string | null;
+      /** Service Name */
+      service_name: string | null;
+      /** Size Bytes */
+      size_bytes: number | null;
+      /** Started At */
+      started_at: string | null;
+      /** Upload Destination */
+      upload_destination: string | null;
+    };
+    /**
+     * BackupTaskResponse
+     * @description Represent a backup task API response.
+     *
+     *     :param backup_type: The backup type recorded in task config.
+     */
+    mysql_backups__BackupTaskResponse: {
+      /** Alert On Fail */
+      alert_on_fail: boolean;
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Anonymized Entities
+       * @description Return sorted PII entity names decoded from ``anonymize_mask``.
+       */
+      readonly anonymized_entities: string[];
+      backend: components['schemas']['TaskBackendEnum'];
+      backup_type?: components['schemas']['mysql_backups__BackupType'] | null;
+      connectivity_warning?:
+        | components['schemas']['framework__ConnectivityWarning']
+        | null;
+      /** Created At */
+      created_at?: string | null;
+      /** Created By */
+      created_by?: string | null;
+      /** Data */
+      data: Record<string, never>;
+      /** Hostname */
+      hostname?: string | null;
+      /** Id */
+      id?: number | null;
+      /** Last Executed At */
+      last_executed_at?: string | null;
+      /** Last Updated By */
+      last_updated_by?: string | null;
+      /** Name */
+      name: string;
+      /** Protected */
+      protected: boolean;
+      status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * BackupType
+     * @description Backup types.
+     * @enum {string}
+     */
+    mysql_backups__BackupType: 'M' | 'X' | 'B';
+    /**
+     * CompressionAlgorithm
+     * @description Enumeration for Compression Algorithms.
+     * @enum {string}
+     */
+    mysql_backups__CompressionAlgorithm: 'zstd' | 'lz4' | 'gzip' | 'quicklz';
+    /** PaginatedResponse[BackupRunResponse] */
+    mysql_backups__PaginatedResponse_BackupRunResponse_: {
+      /** Items */
+      items: components['schemas']['mysql_backups__BackupRunResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /** PaginatedResponse[BackupTaskResponse] */
+    mysql_backups__PaginatedResponse_BackupTaskResponse_: {
+      /** Items */
+      items: components['schemas']['mysql_backups__BackupTaskResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /** PaginatedResponse[RestoresResponse] */
+    mysql_backups__PaginatedResponse_RestoresResponse_: {
+      /** Items */
+      items: components['schemas']['mysql_backups__RestoresResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /**
+     * RestoreCreate
+     * @description Declare the model-first create/update body and ``GET /schema`` source for Restores.
+     *
+     *     Declares every restore form field once, in section order (Task, General,
+     *     Mydumper, XtraBackup, Binlog), with the DSL markers driving the derived
+     *     schema. The previously-inherited config models (:class:`RestoreConfigAll` and
+     *     :class:`BaseRestoreConfigServer`) stay the YAML-serialization targets the
+     *     payload builder populates via ``extract_model_from_instance``; this model
+     *     re-declares their fields directly so it can also carry presentation metadata.
+     *
+     *     The per-``backup_type`` section visibility is expressed in the view layout
+     *     (``restore/views.py``), not as field-level gates: several mode-specific config
+     *     fields carry non-``None`` defaults (``myloader_threads``, ``xb_parallel``,
+     *     ``master_port``), so a field-level ``Forbidden`` gate would reject those
+     *     defaults on a cross-mode restore. Keeping the model permissive preserves the
+     *     legacy payload contract byte-for-byte.
+     *
+     *     ``service_id`` / ``schema_id`` keep their str-accepting annotation (carrying
+     *     the ``"-1"`` ``UNKNOWN_SERVICE_SENTINEL``); their ``ServiceRef`` / ``SchemaRef``
+     *     markers drive only the ``GET /schema`` widgets, while the conditional,
+     *     404-tolerant resolution lives in ``deps.resolve_restore_entities``.
+     */
+    mysql_backups__RestoreCreate: {
+      /**
+       * Alert On Fail
+       * @default false
+       */
+      alert_on_fail: boolean;
+      /** Backup Source */
+      backup_source: string;
+      backup_type: components['schemas']['mysql_backups__BackupType'];
+      /** Binlog Restore Extra Args */
+      binlog_restore_extra_args?: string | null;
+      /** Custom Mysql Init Command */
+      custom_mysql_init_command?: string | null;
+      /** Datadir */
+      datadir?: string | null;
+      /** Gpg Password File */
+      gpg_password_file?: string | null;
+      /** Hostname */
+      hostname: string;
+      /** Include Databases */
+      include_databases?: string | null;
+      /** Incremental Dest Path */
+      incremental_dest_path?: string | null;
+      /** Keyring File Data */
+      keyring_file_data?: string | null;
+      /**
+       * Kill Mysql
+       * @default false
+       */
+      kill_mysql: boolean;
+      /** Local Path */
+      local_path?: string | null;
+      /** Logging Dir */
+      logging_dir?: string | null;
+      /** Master Ip */
+      master_ip?: string | null;
+      /** Master Password */
+      master_password?: string | null;
+      /**
+       * Master Port
+       * @default 3306
+       */
+      master_port: number | null;
+      /** Master User */
+      master_user?: string | null;
+      /** Myloader Extra Args */
+      myloader_extra_args?: string | null;
+      /**
+       * Myloader Threads
+       * @default 4
+       */
+      myloader_threads: number | null;
+      /**
+       * Overwrite Tables
+       * @default false
+       */
+      overwrite_tables: boolean;
+      /** Port */
+      port?: number | null;
+      /** Post Script */
+      post_script?: string | null;
+      /** Pre Script */
+      pre_script?: string | null;
+      /**
+       * Restore Mycnf
+       * @default false
+       */
+      restore_mycnf: boolean;
+      /** @default s3cmd */
+      s3_tool: components['schemas']['mysql_backups__S3Tool'];
+      /** Schema Id */
+      schema_id?: string | null;
+      /** Service Id */
+      service_id?: string | null;
+      /** Skip Databases */
+      skip_databases?: string | null;
+      /**
+       * Skip Incrementals
+       * @default false
+       */
+      skip_incrementals: boolean;
+      /**
+       * Slave From Master
+       * @default false
+       */
+      slave_from_master: boolean;
+      /** Ssh Key */
+      ssh_key?: string | null;
+      /**
+       * Ssh Port
+       * @default 22
+       */
+      ssh_port: number | null;
+      /**
+       * Ssh User
+       * @default percona
+       */
+      ssh_user: string | null;
+      /** Start File */
+      start_file?: string | null;
+      /** Start Position */
+      start_position?: number | null;
+      /** Stop File */
+      stop_file?: string | null;
+      /** Stop Position */
+      stop_position?: number | null;
+      /** Task Name */
+      task_name: string;
+      /** Use Sql File */
+      use_sql_file?: string | null;
+      /**
+       * Wait For Catchup
+       * @default false
+       */
+      wait_for_catchup: boolean;
+      /**
+       * Xb Parallel
+       * @default 4
+       */
+      xb_parallel: number | null;
+      /** Xb Prepare Memory */
+      xb_prepare_memory?: string | null;
+      /** Xtrabackup Aes256 Keyfile */
+      xtrabackup_aes256_keyfile?: string | null;
+      /** Xtrabackup Bin Cmd */
+      xtrabackup_bin_cmd?:
+        | components['schemas']['mysql_backups__XtraBackupTool']
+        | null;
+      /** Xtrabackup Restore Args */
+      xtrabackup_restore_args?: string | null;
+    };
+    /**
+     * RestoresResponse
+     * @description Represent a restore task API response.
+     *
+     *     Extend the standard task-response surface with the restore-specific
+     *     destination facts the detail view renders; the shared task identity,
+     *     status, audit, and anonymization fields come from
+     *     :class:`~app.sep.apps.framework.responses.BaseTaskResponse`.
+     *
+     *     :param backup_type: The backup type recorded in task config.
+     *     :param hostname: The executor hostname target.
+     *     :param host: The destination host recorded in task config.
+     *     :param port: The destination port recorded in task config.
+     */
+    mysql_backups__RestoresResponse: {
+      /** Alert On Fail */
+      alert_on_fail: boolean;
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Anonymized Entities
+       * @description Return sorted PII entity names decoded from ``anonymize_mask``.
+       */
+      readonly anonymized_entities: string[];
+      backend: components['schemas']['TaskBackendEnum'];
+      backup_type?: components['schemas']['mysql_backups__BackupType'] | null;
+      connectivity_warning?:
+        | components['schemas']['framework__ConnectivityWarning']
+        | null;
+      /** Created At */
+      created_at?: string | null;
+      /** Created By */
+      created_by?: string | null;
+      /** Data */
+      data: Record<string, never>;
+      /** Host */
+      host?: string | null;
+      /** Hostname */
+      hostname?: string | null;
+      /** Id */
+      id?: number | null;
+      /** Last Executed At */
+      last_executed_at?: string | null;
+      /** Last Updated By */
+      last_updated_by?: string | null;
+      /** Name */
+      name: string;
+      /** Port */
+      port?: number | null;
+      /** Protected */
+      protected: boolean;
+      status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * S3Tool
+     * @description Allowed tools to interact with S3-compatible services.
+     * @enum {string}
+     */
+    mysql_backups__S3Tool: 's3cmd' | 'awscli';
+    /**
+     * UploadProvider
+     * @description Upload providers.
+     * @enum {string}
+     */
+    mysql_backups__UploadProvider: 'rsync' | 's3' | 'gsutil';
+    /**
+     * XtraBackupTool
+     * @description Allowed commands for XtraBackup-style restores.
+     * @enum {string}
+     */
+    mysql_backups__XtraBackupTool:
+      | 'innobackupex'
+      | 'xtrabackup'
+      | 'mariadb-backup';
+    /**
+     * NavIcon
+     * @description Enumerate the sidebar icon keys the React shell bundles.
+     * @enum {string}
+     */
+    nav_icons__NavIcon:
+      | 'assignment'
+      | 'code'
+      | 'support-agent'
+      | 'description'
+      | 'troubleshoot'
+      | 'table-chart'
+      | 'check-circle'
+      | 'mysql'
+      | 'mongo'
+      | 'postgresql'
+      | 'archive'
+      | 'science'
+      | 'bar-chart'
+      | 'account-tree';
+    /**
+     * AdvisorCheck
+     * @description A single advisor check definition (enabled only).
+     *
+     *     :param name: The unique check name.
+     *     :type name: str
+     *     :param description: Human-readable description of what the check tests.
+     *     :type description: str
+     *     :param summary: Short one-line summary of the check.
+     *     :type summary: str
+     *     :param family: The advisor family key this check belongs to, if any.
+     *     :type family: str | None
+     */
+    report__AdvisorCheck: {
+      /** Description */
+      description: string;
+      /** Family */
+      family?: string | null;
+      /** Name */
+      name: string;
+      /** Summary */
+      summary: string;
+    };
+    /**
+     * AdvisorFamily
+     * @description A group of advisor checks that share the same family.
+     *
+     *     :param family_key: Internal family key (e.g. ``"FAMILY_MYSQL"``).
+     *     :type family_key: str
+     *     :param display_name: Human-readable name shown in the report (e.g. ``"MySQL"``).
+     *     :type display_name: str
+     *     :param checks: All enabled checks belonging to this family.
+     *     :type checks: list[AdvisorCheck]
+     *     :param failed: Mapping of check name to its list of failed results.
+     *     :type failed: dict[str, list[FailedCheck]]
+     */
+    report__AdvisorFamily: {
+      /** Checks */
+      checks?: components['schemas']['report__AdvisorCheck'][];
+      /** Display Name */
+      display_name: string;
+      /** Failed */
+      failed?: {
+        [key: string]: components['schemas']['report__FailedCheck'][];
+      };
+      /** Family Key */
+      family_key: string;
+    };
+    /**
+     * AdvisorSection
+     * @description Aggregated advisor data for the report.
+     *
+     *     ``total_failed`` counts failed advisor results (rows), not distinct check names.
+     */
+    report__AdvisorSection: {
+      /** Families */
+      families?: components['schemas']['report__AdvisorFamily'][];
+      /** Refresh Issues */
+      refresh_issues?: string[];
+      /**
+       * Total Checks
+       * @default 0
+       */
+      total_checks: number;
+      /**
+       * Total Failed
+       * @default 0
+       */
+      total_failed: number;
+    };
+    /**
+     * AlertEntry
+     * @description A single alert annotation extracted from Grafana.
+     */
+    report__AlertEntry: {
+      /**
+       * Alertname
+       * @default
+       */
+      alertname: string;
+      /**
+       * Id
+       * @default 0
+       */
+      id: number;
+      /**
+       * Node Id
+       * @default
+       */
+      node_id: string;
+      /**
+       * Node Name
+       * @default
+       */
+      node_name: string;
+      /**
+       * Service
+       * @default
+       */
+      service: string;
+      /**
+       * Service Id
+       * @default
+       */
+      service_id: string;
+      /**
+       * Service Type
+       * @default
+       */
+      service_type: string;
+      /**
+       * Severity
+       * @default
+       */
+      severity: string;
+      /**
+       * Time
+       * @default 0
+       */
+      time: number;
+    } & {
+      [key: string]: unknown;
+    };
+    /**
+     * AlertSection
+     * @description Aggregated alert data for the report.
+     *
+     *     :param total_alerts: Total number of alert annotations in the period.
+     *     :type total_alerts: int
+     *     :param alerts_per_service: Alert count keyed by service name.
+     *     :type alerts_per_service: dict[str, int]
+     *     :param alerts_per_rule: Alert count keyed by alert rule name.
+     *     :type alerts_per_rule: dict[str, int]
+     *     :param alerts_per_host: Alert count keyed by node name.
+     *     :type alerts_per_host: dict[str, int]
+     *     :param alerts_daily: Alert count keyed by date string (``YYYY-MM-DD``).
+     *     :type alerts_daily: dict[str, int]
+     *     :param alerts_daily_per_host: Daily alert count per host, keyed by date then host.
+     *     :type alerts_daily_per_host: dict[str, dict[str, int]]
+     *     :param alert_history: Full list of individual alert entries.
+     *     :type alert_history: list[AlertEntry]
+     */
+    report__AlertSection: {
+      /** Alert History */
+      alert_history?: components['schemas']['report__AlertEntry'][];
+      /** Alerts Daily */
+      alerts_daily?: {
+        [key: string]: number;
+      };
+      /** Alerts Daily Per Host */
+      alerts_daily_per_host?: {
+        [key: string]: {
+          [key: string]: number;
+        };
+      };
+      /** Alerts Per Host */
+      alerts_per_host?: {
+        [key: string]: number;
+      };
+      /** Alerts Per Rule */
+      alerts_per_rule?: {
+        [key: string]: number;
+      };
+      /** Alerts Per Service */
+      alerts_per_service?: {
+        [key: string]: number;
+      };
+      /**
+       * Total Alerts
+       * @default 0
+       */
+      total_alerts: number;
+    };
+    /**
+     * BackupEntry
+     * @description A single backup record.
+     *
+     *     :param id: Unique identifier for this backup entry.
+     *     :type id: str
+     *     :param alias: Human-readable alias for the backup schedule.
+     *     :type alias: str
+     *     :param name: Node name where the backup was taken.
+     *     :type name: str
+     *     :param type: Backup type (e.g. ``"physical"``, ``"logical"``).
+     *     :type type: str
+     *     :param status: Result status of the backup.
+     *     :type status: BackupStatus
+     *     :param size: Raw backup size value from the metric label, or ``"0"`` if unknown.
+     *     :type size: str
+     *     :param estimated_data: ``True`` when the time period or size data is estimated.
+     *     :type estimated_data: bool
+     *     :param enabled: Whether the backup schedule is currently enabled, if available.
+     *     :type enabled: bool | None
+     *     :param encryption: Encryption state label reported by PMM.
+     *     :type encryption: str
+     *     :param period: Dictionary with ``start``, ``end``, and ``duration`` of the backup.
+     *     :type period: dict[str, Any]
+     */
+    report__BackupEntry: {
+      /**
+       * Alias
+       * @default
+       */
+      alias: string;
+      /** Enabled */
+      enabled?: boolean | null;
+      /**
+       * Encryption
+       * @default Unknown
+       */
+      encryption: string;
+      /**
+       * Estimated Data
+       * @default true
+       */
+      estimated_data: boolean;
+      /** Id */
+      id: string;
+      /**
+       * Name
+       * @default
+       */
+      name: string;
+      /** Period */
+      period?: Record<string, never>;
+      /**
+       * Size
+       * @default 0
+       */
+      size: string;
+      /** @default unknown */
+      status: components['schemas']['report__BackupStatus'];
+      /**
+       * Type
+       * @default
+       */
+      type: string;
+    } & {
+      [key: string]: unknown;
+    };
+    /**
+     * BackupSection
+     * @description Aggregated backup data for the report.
+     *
+     *     :param total_backups: Total number of backup entries collected.
+     *     :type total_backups: int
+     *     :param backups_by_host: Backup count keyed by node name.
+     *     :type backups_by_host: dict[str, int]
+     *     :param backups_by_status: Backup count keyed by status string.
+     *     :type backups_by_status: dict[str, int]
+     *     :param backups_by_type: Backup count keyed by backup type.
+     *     :type backups_by_type: dict[str, int]
+     *     :param failed_backups: Subset of backups with a ``fail`` status.
+     *     :type failed_backups: list[BackupEntry]
+     *     :param all_backups: Complete list of all backup entries.
+     *     :type all_backups: list[BackupEntry]
+     */
+    report__BackupSection: {
+      /** All Backups */
+      all_backups?: components['schemas']['report__BackupEntry'][];
+      /** Backups By Host */
+      backups_by_host?: {
+        [key: string]: number;
+      };
+      /** Backups By Status */
+      backups_by_status?: {
+        [key: string]: number;
+      };
+      /** Backups By Type */
+      backups_by_type?: {
+        [key: string]: number;
+      };
+      /** Failed Backups */
+      failed_backups?: components['schemas']['report__BackupEntry'][];
+      /**
+       * Total Backups
+       * @default 0
+       */
+      total_backups: number;
+    };
+    /**
+     * BackupStatus
+     * @description Status values for a backup entry.
+     * @enum {string}
+     */
+    report__BackupStatus: 'pass' | 'fail' | 'inactive' | 'unknown';
+    /**
+     * CheckSeverity
+     * @description Severity levels for advisor check results.
+     * @enum {string}
+     */
+    report__CheckSeverity:
+      | 'SEVERITY_EMERGENCY'
+      | 'SEVERITY_ALERT'
+      | 'SEVERITY_CRITICAL'
+      | 'SEVERITY_ERROR'
+      | 'SEVERITY_WARNING'
+      | 'SEVERITY_NOTICE'
+      | 'SEVERITY_INFO'
+      | 'SEVERITY_DEBUG';
+    /**
+     * DiskUsageEntry
+     * @description Disk usage for a single mountpoint on a node.
+     *
+     *     :param node_name: Human-readable node hostname.
+     *     :type node_name: str
+     *     :param mountpoint: Filesystem mountpoint path (e.g. ``"/"``, ``"/data"``).
+     *     :type mountpoint: str
+     *     :param capacity_bytes: Total filesystem capacity in bytes.
+     *     :type capacity_bytes: int
+     *     :param used_start_bytes: Used bytes at the start of the report period.
+     *     :type used_start_bytes: float
+     *     :param used_end_bytes: Used bytes at the end of the report period.
+     *     :type used_end_bytes: float
+     *     :param used_peak_bytes: Peak used bytes observed during the report period.
+     *     :type used_peak_bytes: float
+     *     :param usage_percentage: End-of-period usage as a percentage of total capacity.
+     *     :type usage_percentage: int
+     */
+    report__DiskUsageEntry: {
+      /**
+       * Capacity Bytes
+       * @default 0
+       */
+      capacity_bytes: number;
+      /** Mountpoint */
+      mountpoint: string;
+      /** Node Name */
+      node_name: string;
+      /**
+       * Usage Percentage
+       * @default 0
+       */
+      usage_percentage: number;
+      /**
+       * Used End Bytes
+       * @default 0
+       */
+      used_end_bytes: number;
+      /**
+       * Used Peak Bytes
+       * @default 0
+       */
+      used_peak_bytes: number;
+      /**
+       * Used Start Bytes
+       * @default 0
+       */
+      used_start_bytes: number;
+    };
+    /**
+     * FailedCheck
+     * @description A single failed advisor check result.
+     *
+     *     :param name: The check name that failed.
+     *     :type name: str
+     *     :param description: Human-readable description of what the check tests.
+     *     :type description: str
+     *     :param summary: Short one-line summary of the check.
+     *     :type summary: str
+     *     :param severity: Severity level of the failure.
+     *     :type severity: CheckSeverity
+     *     :param node_name: Name of the node affected, if applicable.
+     *     :type node_name: str | None
+     *     :param node_id: PMM node ID of the affected node, if applicable.
+     *     :type node_id: str | None
+     *     :param service_name: Name of the service affected, if applicable.
+     *     :type service_name: str | None
+     *     :param service_id: PMM service ID of the affected service, if applicable.
+     *     :type service_id: str | None
+     *     :param read_more_url: URL linking to documentation for this check.
+     *     :type read_more_url: str
+     */
+    report__FailedCheck: {
+      /** Description */
+      description: string;
+      /** Name */
+      name: string;
+      /** Node Id */
+      node_id?: string | null;
+      /** Node Name */
+      node_name?: string | null;
+      /**
+       * Read More Url
+       * @default
+       */
+      read_more_url: string;
+      /** Service Id */
+      service_id?: string | null;
+      /** Service Name */
+      service_name?: string | null;
+      severity: components['schemas']['report__CheckSeverity'];
+      /** Summary */
+      summary: string;
+    };
+    /**
+     * InventorySection
+     * @description Aggregated inventory data for the report.
+     */
+    report__InventorySection: {
+      /** Entries */
+      entries?: components['schemas']['report__InventoryServiceEntry'][];
+    };
+    /**
+     * InventoryServiceEntry
+     * @description A monitored service with its agent connectivity status.
+     */
+    report__InventoryServiceEntry: {
+      /**
+       * Node Name
+       * @default
+       */
+      node_name: string;
+      /** Service Name */
+      service_name: string;
+      /** Service Type */
+      service_type: string;
+      /** @default OK */
+      status: components['schemas']['report__ServiceStatus'];
+    };
+    /**
+     * MonitoredSummary
+     * @description Summary of monitored nodes and services by type.
+     */
+    report__MonitoredSummary: {
+      /** Services By Type */
+      services_by_type?: {
+        [key: string]: number;
+      };
+      /**
+       * Total Nodes
+       * @default 0
+       */
+      total_nodes: number;
+      /**
+       * Total Services
+       * @default 0
+       */
+      total_services: number;
+    };
+    /**
+     * ReportData
+     * @description Complete report payload ready for rendering.
+     *
+     *     :param full: When ``True``, all check results and full backup history are included.
+     *     :type full: bool
+     *     :param refresh: When ``True``, advisor checks were refreshed before data collection.
+     *     :type refresh: bool
+     *     :param metadata: Report title, generation timestamp, and period labels.
+     *     :type metadata: ReportMetadata
+     *     :param monitored: Summary counts of monitored nodes and services.
+     *     :type monitored: MonitoredSummary
+     *     :param advisors: Advisor check results grouped by family.
+     *     :type advisors: AdvisorSection
+     *     :param alerts: Alert annotation history and aggregations.
+     *     :type alerts: AlertSection
+     *     :param backups: Backup status entries and aggregations.
+     *     :type backups: BackupSection
+     *     :param storage: Disk usage entries per node mountpoint.
+     *     :type storage: StorageSection
+     *     :param uptime: Service uptime entries for the report period.
+     *     :type uptime: UptimeSection
+     *     :param inventory: Monitored service inventory with connectivity status.
+     *     :type inventory: InventorySection
+     */
+    report__ReportData: {
+      advisors?: components['schemas']['report__AdvisorSection'];
+      alerts?: components['schemas']['report__AlertSection'];
+      backups?: components['schemas']['report__BackupSection'];
+      /**
+       * Full
+       * @default true
+       */
+      full: boolean;
+      inventory?: components['schemas']['report__InventorySection'];
+      metadata: components['schemas']['report__ReportMetadata'];
+      monitored?: components['schemas']['report__MonitoredSummary'];
+      /**
+       * Refresh
+       * @default false
+       */
+      refresh: boolean;
+      storage?: components['schemas']['report__StorageSection'];
+      uptime?: components['schemas']['report__UptimeSection'];
+    };
+    /**
+     * ReportJobResponse
+     * @description Expose async report job state.
+     *
+     *     :param job_id: Celery task identifier.
+     *     :param status: Lowercase Celery task state.
+     *     :param pdf_ready: Whether the PDF result exists and is downloadable.
+     *     :param result: Successful job result payload, if available.
+     *     :param error: Failed job error text, if available.
+     */
+    report__ReportJobResponse: {
+      /** Error */
+      error?: string | null;
+      /** Job Id */
+      job_id: string;
+      /**
+       * Pdf Ready
+       * @default false
+       */
+      pdf_ready: boolean;
+      /** Result */
+      result?:
+        | {
+            [key: string]: unknown;
+          }
+        | Record<string, never>
+        | null;
+      /** Status */
+      status: string;
+    };
+    /**
+     * ReportMetadata
+     * @description Metadata about a generated report.
+     *
+     *     :param title: Report title string.
+     *     :type title: str
+     *     :param generated_at: Timestamp when the report was generated.
+     *     :type generated_at: datetime
+     *     :param report_week: ISO week label, e.g. ``"Report 2026 Week 15"``.
+     *     :type report_week: str
+     *     :param report_interval: Human-readable date range string for the report period.
+     *     :type report_interval: str
+     */
+    report__ReportMetadata: {
+      /**
+       * Generated At
+       * Format: date-time
+       */
+      generated_at: string;
+      /**
+       * Report Interval
+       * @default
+       */
+      report_interval: string;
+      /**
+       * Report Week
+       * @default
+       */
+      report_week: string;
+      /**
+       * Title
+       * @default
+       */
+      title: string;
+    };
+    /**
+     * ReportSnapshotWrite
+     * @description Define report snapshot body for PDF/upload jobs.
+     *
+     *     :param report: Generated report snapshot reused for PDF/upload work.
+     */
+    report__ReportSnapshotWrite: {
+      report: components['schemas']['report__ReportData'];
+    };
+    /**
+     * ServiceStatus
+     * @description Agent connectivity status for an inventory service.
+     * @enum {string}
+     */
+    report__ServiceStatus: 'OK' | 'Not OK';
+    /**
+     * StorageSection
+     * @description Aggregated storage data for the report.
+     *
+     *     :param entries: List of per-mountpoint disk usage entries, sorted by usage descending.
+     *     :type entries: list[DiskUsageEntry]
+     */
+    report__StorageSection: {
+      /** Entries */
+      entries?: components['schemas']['report__DiskUsageEntry'][];
+    };
+    /**
+     * UptimeEntry
+     * @description Uptime for a single monitored service.
+     */
+    report__UptimeEntry: {
+      /** Service Name */
+      service_name: string;
+      /**
+       * Since
+       * @default
+       */
+      since: string;
+      /**
+       * Uptime
+       * Format: duration
+       */
+      uptime: string;
+    };
+    /**
+     * UptimeSection
+     * @description Aggregated uptime data for the report.
+     */
+    report__UptimeSection: {
+      /** Entries */
+      entries?: components['schemas']['report__UptimeEntry'][];
+    };
+    /**
+     * ExecutorHostMetadata
+     * @description Represent one executor host option for display on the task detail page.
+     *
+     *     :param value: The executor host value submitted with task execution
+     *         requests (Nomad node name).
+     *     :type value: str
+     *     :param label: The human-readable label for the host (often an inventory
+     *         display name).
+     *     :type label: str
+     */
+    tasks__ExecutorHostMetadata: {
+      /** Label */
+      label: string;
+      /** Value */
+      value: string;
+    };
+    /** PaginatedResponse[TaskListResponse] */
+    tasks__PaginatedResponse_TaskListResponse_: {
+      /** Items */
+      items: components['schemas']['tasks__TaskListResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /**
+     * PeriodicTaskSummary
+     * @description Represent read-only periodic-schedule metadata for a single task.
+     *
+     *     :param id: The periodic task's database identifier.
+     *     :type id: int
+     *     :param name: The periodic task's display name.
+     *     :type name: str
+     *     :param enabled: Whether the periodic schedule is currently enabled.
+     *     :type enabled: bool
+     *     :param period: A human-readable schedule description (cron or interval),
+     *         or ``None`` when unavailable.
+     *     :type period: str | None
+     *     :param next_run_at: The next scheduled run time in ISO 8601 format, or
+     *         ``None`` when not scheduled.
+     *     :type next_run_at: UTCDatetime | None
+     *     :param last_run_at: The last run time in ISO 8601 format, or ``None`` if
+     *         the schedule has never run.
+     *     :type last_run_at: UTCDatetime | None
+     *     :param total_run_count: The total number of times the schedule has run,
+     *         or ``None`` when unavailable.
+     *     :type total_run_count: int | None
+     *     :param last_run_status: The result of this schedule's own most recent run,
+     *         or ``None`` when the schedule has never run.
+     *     :param chain_task_names: Ordered task names in the periodic execution
+     *         chain, if any.
+     *     :type chain_task_names: list[str]
+     */
+    tasks__PeriodicTaskSummary: {
+      /** Chain Task Names */
+      chain_task_names?: string[];
+      /** Enabled */
+      enabled: boolean;
+      /** Id */
+      id: number;
+      /** Last Run At */
+      last_run_at?: string | null;
+      last_run_status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      /** Name */
+      name: string;
+      /** Next Run At */
+      next_run_at?: string | null;
+      /** Period */
+      period?: string | null;
+      /** Total Run Count */
+      total_run_count?: number | null;
+    };
+    /**
+     * TaskDetailResponse
+     * @description Represent the aggregate payload for ``GET /api/apps/tasks/{task_name}``.
+     *
+     *     Bundle the task definition, execution history, periodic schedules, and
+     *     executor host metadata into a single response for the React detail page.
+     *
+     *     :param task: The task definition as returned by the tasks API.
+     *     :type task: TaskResponse
+     *     :param execution_history: Paginated task history from the tasks API
+     *         (``items``, ``total``, ``offset``, ``limit``).
+     *     :type execution_history: dict[str, Any]
+     *     :param periodic_summary: Read-only summaries of periodic schedules
+     *         attached to this task.
+     *     :type periodic_summary: list[PeriodicTaskSummary]
+     *     :param executor_hosts: Executor hosts available for display, with
+     *         inventory-resolved labels when possible.
+     *     :type executor_hosts: list[ExecutorHostMetadata]
+     */
+    tasks__TaskDetailResponse: {
+      /** Execution History */
+      execution_history?: Record<string, never>;
+      /** Executor Hosts */
+      executor_hosts?: components['schemas']['tasks__ExecutorHostMetadata'][];
+      /** Periodic Summary */
+      periodic_summary?: components['schemas']['tasks__PeriodicTaskSummary'][];
+      task: components['schemas']['TaskResponse'];
+    };
+    /**
+     * TaskListResponse
+     * @description Represent one task row in the read-only tasks plugin list API.
+     *
+     *     :param name: The unique name of the task.
+     *     :type name: str
+     *     :param backend: The backend system used for task execution.
+     *     :type backend: TaskBackendEnum
+     *     :param created_at: When the task was created, or ``None`` if unavailable.
+     *     :type created_at: UTCDatetime | None
+     *     :param created_by: Display name for the task creator (Casdoor username when
+     *         resolvable, otherwise the stored user id), or ``None`` if unknown.
+     *     :type created_by: str | None
+     *     :param last_updated_by: Display name for the user who last updated the
+     *         task (Casdoor username when resolvable, otherwise the stored user id),
+     *         or ``None`` if unknown.
+     *     :type last_updated_by: str | None
+     */
+    tasks__TaskListResponse: {
+      backend: components['schemas']['TaskBackendEnum'];
+      /** Created At */
+      created_at?: string | null;
+      /** Created By */
+      created_by?: string | null;
+      /** Last Updated By */
+      last_updated_by?: string | null;
+      /** Name */
+      name: string;
+    };
+    /**
+     * ClusterNode
+     * @description Represent a synthetic cluster-group node in the topology graph.
+     */
+    topology__ClusterNode: {
+      data: components['schemas']['topology__ClusterNodeData'];
+      /** Id */
+      id: string;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'cluster';
+    };
+    /**
+     * ClusterNodeData
+     * @description Represent the React-Flow ``data`` payload for a synthetic PXC cluster node.
+     */
+    topology__ClusterNodeData: {
+      /** Cluster Name */
+      cluster_name: string;
+      /** Members */
+      members?: string[];
+      /** Size */
+      size?: string | null;
+      /** Status */
+      status?: string | null;
+    };
+    /**
+     * DualPrimaryEdge
+     * @description Represent a dual-primary (mutually replicating) edge.
+     */
+    topology__DualPrimaryEdge: {
+      /** Data */
+      data?: Record<string, never>;
+      /** Id */
+      id: string;
+      /** Source */
+      source: string;
+      /** Target */
+      target: string;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'dual_primary';
+    };
+    /**
+     * MySQLClusterInfo
+     * @description Represent Percona XtraDB Cluster (wsrep) metadata for a host.
+     */
+    topology__MySQLClusterInfo: {
+      /** Cluster Name */
+      cluster_name: string;
+      /** Cluster Size */
+      cluster_size?: string | null;
+      /** Cluster Status */
+      cluster_status?: string | null;
+      /** Local State Comment */
+      local_state_comment?: string | null;
+    };
+    /**
+     * MySQLNode
+     * @description Represent a MySQL server node in the topology graph.
+     */
+    topology__MySQLNode: {
+      data: components['schemas']['topology__MySQLNodeData'];
+      /** Id */
+      id: string;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'mysql';
+    };
+    /**
+     * MySQLNodeData
+     * @description Represent the React-Flow ``data`` payload for a MySQL node.
+     */
+    topology__MySQLNodeData: {
+      /** Address */
+      address?: string | null;
+      cluster?: components['schemas']['topology__MySQLClusterInfo'] | null;
+      /** Error */
+      error?: string | null;
+      /** Gtid Mode */
+      gtid_mode?: string | null;
+      /** Host Entry */
+      host_entry: string;
+      /** Port */
+      port?: number | null;
+      replication?:
+        | components['schemas']['topology__MySQLReplicationInfo']
+        | null;
+      server?: components['schemas']['topology__MySQLServerInfo'] | null;
+      /**
+       * Status
+       * @enum {string}
+       */
+      status: 'ok' | 'error';
+    };
+    /**
+     * MySQLReplicationInfo
+     * @description Represent replication source/state for a replica host (``source_uuid`` stripped).
+     */
+    topology__MySQLReplicationInfo: {
+      /** Auto Position */
+      auto_position?: number | null;
+      /** Io Running */
+      io_running?: string | null;
+      /** Repl Filter */
+      repl_filter?: ('yes' | 'none') | null;
+      /** Repl Status */
+      repl_status?: ('ok' | 'err') | null;
+      /** Seconds Behind */
+      seconds_behind?: number | null;
+      /** Source Host */
+      source_host?: string | null;
+      /** Source Port */
+      source_port?: number | null;
+      /** Source Server Id */
+      source_server_id?: number | null;
+      /** Sql Running */
+      sql_running?: string | null;
+    };
+    /**
+     * MySQLServerInfo
+     * @description Represent MySQL server identity/mode collected per host.
+     */
+    topology__MySQLServerInfo: {
+      /** Hostname */
+      hostname?: string | null;
+      /** Log Bin */
+      log_bin?: ('ON' | 'OFF') | null;
+      /** Port */
+      port?: number | null;
+      /** Read Only */
+      read_only?: ('RW' | 'RO' | 'SR') | null;
+      /** Server Hash */
+      server_hash?: string | null;
+      /** Server Id */
+      server_id?: number | null;
+      /** Server Uuid */
+      server_uuid?: string | null;
+      /** Version */
+      version?: string | null;
+    };
+    /**
+     * ReplicationEdge
+     * @description Represent a primary -> replica replication edge.
+     */
+    topology__ReplicationEdge: {
+      data?: components['schemas']['topology__ReplicationEdgeData'] | null;
+      /** Id */
+      id: string;
+      /** Source */
+      source: string;
+      /** Target */
+      target: string;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'replication';
+    };
+    /**
+     * ReplicationEdgeData
+     * @description Represent the React-Flow ``data`` payload for a replication edge.
+     */
+    topology__ReplicationEdgeData: {
+      /** Auto Position */
+      auto_position?: number | null;
+      /** Filter */
+      filter?: string | null;
+      /** Gtid Mode */
+      gtid_mode?: string | null;
+      /** Io Running */
+      io_running?: string | null;
+      /** Seconds Behind */
+      seconds_behind?: number | null;
+      /** Sql Running */
+      sql_running?: string | null;
+      /** Status */
+      status?: ('ok' | 'err') | null;
+    };
+    /**
+     * TopologyCollectResponse
+     * @description Represent the response body for ``POST /collect``.
+     *
+     *     ``task_history_ids`` lists the dispatched ``run-python`` tasks the
+     *     frontend then polls (``/result``) to assemble the topology graph.
+     *     ``targets`` echoes the executor hosts the work was sharded across so
+     *     the UI can surface where the collection ran.
+     *
+     *     :param task_history_ids: Created task history ids, one per shard.
+     *     :param targets: Executor hosts selected for topology collection.
+     *     :param host_count: Number of MySQL hosts included in the collection.
+     *     :param shard_count: Number of dispatched topology shards.
+     */
+    topology__TopologyCollectResponse: {
+      /** Host Count */
+      host_count: number;
+      /** Shard Count */
+      shard_count: number;
+      /** Targets */
+      targets: string[];
+      /** Task History Ids */
+      task_history_ids: number[];
+    };
+    /**
+     * TopologyCollectWrite
+     * @description Describe the request body for ``POST /collect``.
+     *
+     *     :param shards: Number of executor hosts to dispatch in parallel. Hosts
+     *         are split round-robin across the chosen executors. Capped at
+     *         :data:`MAX_TOPOLOGY_SHARDS`.
+     *     :param executor_host: Optional explicit executor. Must be used with
+     *         ``shards=1`` because it selects a single-shard run.
+     *     :param connect_timeout: Per-host MySQL TCP connect timeout (seconds).
+     *     :param read_timeout: Per-host MySQL read/write timeout (seconds).
+     */
+    topology__TopologyCollectWrite: {
+      /**
+       * Connect Timeout
+       * @default 5
+       */
+      connect_timeout: number;
+      /** Executor Host */
+      executor_host?: string | null;
+      /**
+       * Read Timeout
+       * @default 10
+       */
+      read_timeout: number;
+      /**
+       * Shards
+       * @default 1
+       */
+      shards: number;
+    };
+    /**
+     * TopologyGraph
+     * @description Represent the merged React-Flow ``{nodes, edges, summary}`` graph.
+     */
+    topology__TopologyGraph: {
+      /** Edges */
+      edges?: (
+        | components['schemas']['topology__ReplicationEdge']
+        | components['schemas']['topology__DualPrimaryEdge']
+      )[];
+      /** Nodes */
+      nodes?: (
+        | components['schemas']['topology__MySQLNode']
+        | components['schemas']['topology__ClusterNode']
+        | components['schemas']['topology__UnknownSourceNode']
+      )[];
+      summary: components['schemas']['topology__TopologyGraphSummary'];
+    };
+    /**
+     * TopologyGraphSummary
+     * @description Aggregate counts for the topology graph.
+     */
+    topology__TopologyGraphSummary: {
+      /** Cluster Count */
+      cluster_count: number;
+      /** Edge Count */
+      edge_count: number;
+      /** Error Count */
+      error_count: number;
+      /** Host Count */
+      host_count: number;
+      /** Ok Count */
+      ok_count: number;
+    };
+    /**
+     * TopologyResultResponse
+     * @description Represent the response body for ``GET /result``.
+     *
+     *     ``status`` is ``running`` while any of the underlying tasks is
+     *     still pending, ``ok`` once every task has finished, and ``failed``
+     *     when at least one task failed and produced no usable output.
+     *     ``graph`` is the merged React-Flow graph; ``pending_task_ids``
+     *     lists the still-running tasks for the UI's progress chip, and
+     *     ``failed_task_ids`` lets the UI warn when only some shards failed.
+     *
+     *     :param status: Aggregate topology collection status.
+     *     :param graph: Merged React-Flow graph when collection output is ready.
+     *     :param pending_task_ids: Task ids still pending or running.
+     *     :param failed_task_ids: Terminal task ids that did not finish successfully.
+     */
+    topology__TopologyResultResponse: {
+      /** Failed Task Ids */
+      failed_task_ids?: number[];
+      graph?: components['schemas']['topology__TopologyGraph'] | null;
+      /** Pending Task Ids */
+      pending_task_ids?: number[];
+      /**
+       * Status
+       * @enum {string}
+       */
+      status: 'running' | 'ok' | 'failed';
+    };
+    /**
+     * UnknownSourceNode
+     * @description Represent a synthetic node for a replication source absent from inventory.
+     */
+    topology__UnknownSourceNode: {
+      data: components['schemas']['topology__UnknownSourceNodeData'];
+      /** Id */
+      id: string;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      type: 'unknown_source';
+    };
+    /**
+     * UnknownSourceNodeData
+     * @description Represent the React-Flow ``data`` payload for a replication source not in inventory.
+     */
+    topology__UnknownSourceNodeData: {
+      /** Address */
+      address?: string | null;
+      /** Port */
+      port?: number | null;
+      /** Reason */
+      reason?: string | null;
+    };
+  };
+  responses: never;
+  parameters: never;
+  requestBodies: never;
+  headers: never;
+  pathItems: never;
+}
+export type $defs = Record<string, never>;
+export interface operations {
+  admin_list_apps_api_admin_apps__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['AppInfoResponse'][];
+        };
+      };
+    };
+  };
+  admin_force_disable_app_api_admin_apps__app_key__force_disable_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        app_key: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['AppStateResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  admin_update_app_state_api_admin_apps__app_key__state_put: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        app_key: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['AppStateWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['AppStateResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  apps_list_apps_for_navigation_api_apps__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['AppKeyResponse'][];
+        };
+      };
+    };
+  };
+  alert_troubleshooting_alert_troubleshooting_api_list_api_apps_alert_troubleshooting__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['alert_troubleshooting__AlertGroup'][];
+        };
+      };
+    };
+  };
+  alert_troubleshooting_get_schema_api_apps_alert_troubleshooting_schema_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__AppSchema'];
+        };
+      };
+    };
+  };
+  alert_troubleshooting_alert_troubleshooting_api_detail_api_apps_alert_troubleshooting__service_type___alert_name__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        service_type: components['schemas']['AlertServiceType'];
+        alert_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['alert_troubleshooting__AlertDetailResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  alerts_alerts_api_index_api_apps_alerts__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['alerts__IndexResponse'];
+        };
+      };
+    };
+  };
+  alerts_alerts_api_list_backups_api_apps_alerts_backups_get: {
+    parameters: {
+      query?: {
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['alerts__PaginatedResponse_BackupSummary_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  alerts_alerts_api_get_backup_api_apps_alerts_backups__backup_id__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        backup_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['alerts__BackupDetail'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  alerts_alerts_api_pagerduty_save_api_apps_alerts_pagerduty_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['alerts__PagerDutyRequest'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['alerts__PagerDutyResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  alerts_alerts_api_pagerduty_delete_api_apps_alerts_pagerduty_delete_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['alerts__PagerDutyResponse'];
+        };
+      };
+    };
+  };
+  alerts_alerts_api_push_api_apps_alerts_push_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['alerts__PushRequest'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['alerts__PushResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  alerts_alerts_api_restore_api_apps_alerts_restore_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['alerts__RestoreRequest'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['alerts__RestoreResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  alters__list_paginated_api_apps_alters__get: {
+    parameters: {
+      query?: {
+        offset?: number;
+        limit?: number;
+        service_type?: components['schemas']['ServiceTypeEnum'] | null;
+        status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['alters__PaginatedResponse_AltersTaskResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  alters_alters_api_create_api_apps_alters__post: {
+    parameters: {
+      query?: {
+        check_connectivity?: boolean;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['alters__AltersCreate'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__AltersTaskResponseCreate'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  alters_get_schema_api_apps_alters_schema_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__AppSchema'];
+        };
+      };
+    };
+  };
+  alters_alters_api_detail_api_apps_alters__task_name__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['alters__AltersTaskResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  alters_alters_api_update_api_apps_alters__task_name__put: {
+    parameters: {
+      query?: {
+        check_connectivity?: boolean;
+      };
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['alters__AltersCreate'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__AltersTaskResponseUpdate'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  alters_alters_api_delete_api_apps_alters__task_name__delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  alters_alters_api_execute_api_apps_alters__task_name__execute_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['framework__TaskExecuteWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__TaskExecutionResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  archives__list_paginated_api_apps_archives__get: {
+    parameters: {
+      query?: {
+        offset?: number;
+        limit?: number;
+        status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__PaginatedResponse_BaseTaskResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  archives__create_api_apps_archives__post: {
+    parameters: {
+      query?: {
+        check_connectivity?: boolean;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['archives__ArchivesCreate'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__BaseTaskResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  archives_get_schema_api_apps_archives_schema_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__AppSchema'];
+        };
+      };
+    };
+  };
+  archives__detail_api_apps_archives__task_name__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__BaseTaskResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  archives__update_api_apps_archives__task_name__put: {
+    parameters: {
+      query?: {
+        check_connectivity?: boolean;
+      };
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['archives__ArchivesCreate'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__BaseTaskResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  archives__delete_api_apps_archives__task_name__delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  archives_archives_api_execute_api_apps_archives__task_name__execute_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['framework__TaskExecuteWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__TaskExecutionResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  atw_atw_api_list_api_apps_atw__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['atw__ATWCategoryListing'][];
+        };
+      };
+    };
+  };
+  atw_atw_config_api_apps_atw_config__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['atw__AtwConfigResponse'];
+        };
+      };
+    };
+  };
+  atw_atw_execution_schema_api_apps_atw_execution_schema__get: {
+    parameters: {
+      query: {
+        /** @description Snippet filenames to build a batch form for. */
+        snippet_filename: string[];
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['atw__ATWMergedSchemaResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  atw_atw_list_incidents_api_apps_atw_incidents__get: {
+    parameters: {
+      query?: {
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['atw__PaginatedResponse_AtwIncidentResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  atw_atw_create_incident_api_apps_atw_incidents__post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['atw__AtwIncidentWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['atw__AtwIncidentResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  atw_atw_get_incident_api_apps_atw_incidents__incident_id__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        incident_id: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['atw__AtwIncidentResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  atw_atw_delete_incident_api_apps_atw_incidents__incident_id__delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        incident_id: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  atw_atw_update_incident_api_apps_atw_incidents__incident_id__patch: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        incident_id: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['atw__AtwIncidentUpdate'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['atw__AtwIncidentResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  atw_atw_list_incident_executions_api_apps_atw_incidents__incident_id__executions__get: {
+    parameters: {
+      query?: {
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path: {
+        incident_id: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['atw__PaginatedResponse_ATWIncidentExecutionResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  atw_atw_batch_execute_api_apps_atw_incidents__incident_id__executions__post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        incident_id: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['atw__ATWBatchExecuteWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['atw__ATWBatchExecuteResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  atw_atw_list_send_jobs_api_apps_atw_incidents__incident_id__send_jobs__get: {
+    parameters: {
+      query?: {
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path: {
+        incident_id: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['atw__PaginatedResponse_AtwSendLogResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  atw_atw_start_send_job_api_apps_atw_incidents__incident_id__send_jobs__post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        incident_id: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['atw__AtwSendJobWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      202: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['atw__AtwSendLogResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  atw_atw_get_send_job_api_apps_atw_incidents__incident_id__send_jobs__send_job_id__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        send_job_id: string;
+        incident_id: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['atw__AtwSendLogResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  atw_get_schema_api_apps_atw_schema_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__AppSchema'];
+        };
+      };
+    };
+  };
+  backup_mongo__list_paginated_api_apps_backup_mongo__get: {
+    parameters: {
+      query?: {
+        offset?: number;
+        limit?: number;
+        status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['backup_mongo__PaginatedResponse_BackupTaskResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  backup_mongo_backup_mongo_api_create_api_apps_backup_mongo__post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['backup_mongo__BackupTaskWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['backup_mongo__BackupTaskDetailResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  backup_mongo_restore_restore_mongo_api_list_api_apps_backup_mongo_restore__get: {
+    parameters: {
+      query?: {
+        status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['backup_mongo__PaginatedResponse_RestoreTaskResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  backup_mongo_restore_restore_mongo_api_create_api_apps_backup_mongo_restore__post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['backup_mongo__RestoreTaskWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['backup_mongo__RestoreTaskDetailResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  backup_mongo_restore_get_schema_api_apps_backup_mongo_restore_schema_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__AppSchema'];
+        };
+      };
+    };
+  };
+  backup_mongo_restore_restore_mongo_api_detail_api_apps_backup_mongo_restore__task_name__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['backup_mongo__RestoreTaskDetailResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  backup_mongo_restore_restore_mongo_api_update_api_apps_backup_mongo_restore__task_name__put: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['backup_mongo__RestoreTaskWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['backup_mongo__RestoreTaskResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  backup_mongo_restore_restore_mongo_api_delete_api_apps_backup_mongo_restore__task_name__delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  backup_mongo_restore_backup_mongo_restores_api_execute_api_apps_backup_mongo_restore__task_name__execute_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['framework__TaskExecuteWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__TaskExecutionResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  backup_mongo_get_schema_api_apps_backup_mongo_schema_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__AppSchema'];
+        };
+      };
+    };
+  };
+  backup_mongo_backup_mongo_api_detail_api_apps_backup_mongo__task_name__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['backup_mongo__BackupTaskDetailResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  backup_mongo_backup_mongo_api_update_api_apps_backup_mongo__task_name__put: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['backup_mongo__BackupTaskWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['backup_mongo__BackupTaskDetailResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  backup_mongo_backup_mongo_api_delete_api_apps_backup_mongo__task_name__delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  backup_mongo_backup_mongo_api_execute_api_apps_backup_mongo__task_name__execute_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['framework__TaskExecuteWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__TaskExecutionResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  backup_pg__list_paginated_api_apps_backup_pg__get: {
+    parameters: {
+      query?: {
+        offset?: number;
+        limit?: number;
+        status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['backup_pg__PaginatedResponse_BackupTaskResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  backup_pg__create_api_apps_backup_pg__post: {
+    parameters: {
+      query?: {
+        check_connectivity?: boolean;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['backup_pg__BackupPgForm'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__BackupPgCreateResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  backup_pg_get_schema_api_apps_backup_pg_schema_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__AppSchema'];
+        };
+      };
+    };
+  };
+  backup_pg__detail_api_apps_backup_pg__task_name__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['backup_pg__BackupTaskDetailResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  backup_pg__update_api_apps_backup_pg__task_name__put: {
+    parameters: {
+      query?: {
+        check_connectivity?: boolean;
+      };
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['backup_pg__BackupPgForm'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__BackupPgCreateResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  backup_pg__delete_api_apps_backup_pg__task_name__delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  backup_pg_backup_pg_api_execute_api_apps_backup_pg__task_name__execute_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['framework__TaskExecuteWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__TaskExecutionResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  checksums__list_paginated_api_apps_checksums__get: {
+    parameters: {
+      query?: {
+        offset?: number;
+        limit?: number;
+        service_type?: components['schemas']['ServiceTypeEnum'] | null;
+        status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__PaginatedResponse_BaseTaskResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  checksums__create_api_apps_checksums__post: {
+    parameters: {
+      query?: {
+        check_connectivity?: boolean;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['checksums__ChecksumsForm'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__BaseTaskResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  checksums_get_schema_api_apps_checksums_schema_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__AppSchema'];
+        };
+      };
+    };
+  };
+  checksums__detail_api_apps_checksums__task_name__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__BaseTaskResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  checksums__update_api_apps_checksums__task_name__put: {
+    parameters: {
+      query?: {
+        check_connectivity?: boolean;
+      };
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['checksums__ChecksumsForm'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__BaseTaskResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  checksums__delete_api_apps_checksums__task_name__delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  checksums_checksums_api_execute_api_apps_checksums__task_name__execute_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['framework__TaskExecuteWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__TaskExecutionResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  dipper_dipper_api_list_api_apps_dipper__get: {
+    parameters: {
+      query?: {
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PaginatedResponse_dict_str__Any__'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  dipper_dipper_api_execute_api_apps_dipper__post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['dipper__DipperExecuteWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['dipper__DipperExecutionResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  dipper_dipper_api_form_schema_api_apps_dipper_form_schema_get: {
+    parameters: {
+      query: {
+        service_id: number;
+        collector_type: components['schemas']['dipper__CollectorTypeEnum'];
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__AppSchema'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  dipper_get_schema_api_apps_dipper_schema_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__AppSchema'];
+        };
+      };
+    };
+  };
+  dipper_dipper_api_script_preview_api_apps_dipper_script_preview_get: {
+    parameters: {
+      query: {
+        service_id: number;
+        collector_type: components['schemas']['dipper__CollectorTypeEnum'];
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__ScriptPreviewResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  inventory_inventory_plugin_tasks_api_apps_inventory__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['inventory__PluginTaskResponse'][];
+        };
+      };
+    };
+  };
+  inventory_inventory_available_syncers_api_apps_inventory_available_syncers__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['inventory__AvailableSyncer'][];
+        };
+      };
+    };
+  };
+  inventory_inventory_node_system_observation_api_apps_inventory_nodes__node_id__system_observation_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        node_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': unknown;
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  inventory_get_schema_api_apps_inventory_schema_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__AppSchema'];
+        };
+      };
+    };
+  };
+  inventory_inventory_service_check_connectivity_api_apps_inventory_services__service_id__check_connectivity__post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        service_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['ConnectivityCheckResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  inventory_inventory_service_system_observation_api_apps_inventory_services__service_id__system_observation_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        service_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': unknown;
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  inventory_inventory_sync_trigger_api_apps_inventory_sync__post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: {
+      content: {
+        'application/json':
+          | components['schemas']['inventory__InventorySyncTriggerWrite']
+          | null;
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      202: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  inventory_inventory_sync_status_api_apps_inventory_sync_status__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['inventory__InventorySyncStatusResponse'];
+        };
+      };
+    };
+  };
+  inventory_inventory_list_entity_api_apps_inventory__entity___get: {
+    parameters: {
+      query?: {
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path: {
+        entity: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PaginatedResponse_Any_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  inventory_inventory_create_entity_api_apps_inventory__entity___post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        entity: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': unknown;
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  inventory_inventory_get_entity_api_apps_inventory__entity___item_id__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        entity: string;
+        item_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': unknown;
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  inventory_inventory_update_entity_api_apps_inventory__entity___item_id__put: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        entity: string;
+        item_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': unknown;
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  inventory_inventory_delete_entity_api_apps_inventory__entity___item_id__delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        entity: string;
+        item_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': unknown;
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  mysql_backups__list_paginated_api_apps_mysql_backups__get: {
+    parameters: {
+      query?: {
+        offset?: number;
+        limit?: number;
+        status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['mysql_backups__PaginatedResponse_BackupTaskResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  mysql_backups__create_api_apps_mysql_backups__post: {
+    parameters: {
+      query?: {
+        check_connectivity?: boolean;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['mysql_backups__BackupCreate'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__MysqlBackupsCreateResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  mysql_backups_restore__list_paginated_api_apps_mysql_backups_restore__get: {
+    parameters: {
+      query?: {
+        offset?: number;
+        limit?: number;
+        status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['mysql_backups__PaginatedResponse_RestoresResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  mysql_backups_restore__create_api_apps_mysql_backups_restore__post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['mysql_backups__RestoreCreate'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['mysql_backups__RestoresResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  mysql_backups_restore_get_schema_api_apps_mysql_backups_restore_schema_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__AppSchema'];
+        };
+      };
+    };
+  };
+  mysql_backups_restore__detail_api_apps_mysql_backups_restore__task_name__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['mysql_backups__RestoresResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  mysql_backups_restore__update_api_apps_mysql_backups_restore__task_name__put: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['mysql_backups__RestoreCreate'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['mysql_backups__RestoresResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  mysql_backups_restore__delete_api_apps_mysql_backups_restore__task_name__delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  mysql_backups_restore_mysql_backups_restores_api_execute_api_apps_mysql_backups_restore__task_name__execute_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['framework__TaskExecuteWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__TaskExecutionResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  mysql_backups_get_schema_api_apps_mysql_backups_schema_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__AppSchema'];
+        };
+      };
+    };
+  };
+  mysql_backups_list_service_backups_api_apps_mysql_backups_services__service_id__backups_get: {
+    parameters: {
+      query?: {
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path: {
+        service_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['mysql_backups__PaginatedResponse_BackupRunResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  mysql_backups__detail_api_apps_mysql_backups__task_name__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['mysql_backups__BackupTaskResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  mysql_backups__update_api_apps_mysql_backups__task_name__put: {
+    parameters: {
+      query?: {
+        check_connectivity?: boolean;
+      };
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['mysql_backups__BackupCreate'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__MysqlBackupsCreateResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  mysql_backups__delete_api_apps_mysql_backups__task_name__delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  mysql_backups_mysql_backups_api_execute_api_apps_mysql_backups__task_name__execute_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['framework__TaskExecuteWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__TaskExecutionResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  report_report_config_api_apps_report_config_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': unknown;
+        };
+      };
+    };
+  };
+  report_report_generate_json_api_api_apps_report_generate_json_get: {
+    parameters: {
+      query?: {
+        since?: string;
+        until?: string;
+        full?: boolean;
+        refresh?: boolean;
+        sections?: string[] | null;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': unknown;
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  report_report_start_pdf_job_api_api_apps_report_pdf_jobs_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['report__ReportSnapshotWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['report__ReportJobResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  report_report_pdf_job_api_api_apps_report_pdf_jobs__job_id__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        job_id: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['report__ReportJobResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  report_report_download_pdf_api_api_apps_report_pdf_jobs__job_id__pdf_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        job_id: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': unknown;
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  report_report_start_upload_job_api_api_apps_report_upload_jobs_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['report__ReportSnapshotWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['report__ReportJobResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  report_report_upload_job_api_api_apps_report_upload_jobs__job_id__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        job_id: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['report__ReportJobResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  snippets_snippets_api_list_api_apps_snippets__get: {
+    parameters: {
+      query?: {
+        offset?: number;
+        limit?: number;
+        /** @description Case-insensitive search over filename, title, description. */
+        search?: string | null;
+        /** @description Sort key; one of the allowlisted public sort keys. */
+        sort?: components['schemas']['SnippetSortKey'];
+        /** @description Sort direction. */
+        order?: components['schemas']['SnippetSortDirection'];
+        /** @description Approval-status filter. */
+        approval?: components['schemas']['SnippetApprovalFilter'];
+        /** @description Service-type equality filter, or omitted for no filter. */
+        service_type?: string | null;
+        /** @description When true, keep only snippets with no (absent or blank) service type. A separate flag so a real service type can never collide with a reserved sentinel. Takes precedence over 'service_type'. */
+        uncategorized?: boolean;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PaginatedResponse_SnippetResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  snippets_snippets_api_batch_approve_api_apps_snippets_approvals_patch: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['SnippetBatchApproveRequest'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['BatchApprovalResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  snippets__snippets_capabilities_provider_api_apps_snippets_capabilities_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['SnippetsCapabilitiesResponse'];
+        };
+      };
+    };
+  };
+  snippets_snippets_api_refresh_api_apps_snippets_refresh_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['RefreshResponse'];
+        };
+      };
+    };
+  };
+  snippets_get_schema_api_apps_snippets_schema_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__AppSchema'];
+        };
+      };
+    };
+  };
+  snippets_snippets_api_service_types_api_apps_snippets_service_types_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['SnippetServiceTypesResponse'];
+        };
+      };
+    };
+  };
+  snippets_snippets_api_approve_api_apps_snippets_snippet_approval_put: {
+    parameters: {
+      query: {
+        /** @description Snippet filename (relative path under snippets root). */
+        snippet_filename: string;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['SnippetResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  snippets_snippets_api_remove_approval_api_apps_snippets_snippet_approval_delete: {
+    parameters: {
+      query: {
+        /** @description Snippet filename (relative path under snippets root). */
+        snippet_filename: string;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  snippets_snippets_api_download_api_apps_snippets_snippet_download_get: {
+    parameters: {
+      query: {
+        /** @description Snippet filename (relative path under snippets root). */
+        snippet_filename: string;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': unknown;
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  snippets_snippets_api_script_execute_api_apps_snippets_snippet_execute_post: {
+    parameters: {
+      query: {
+        /** @description Script filename (relative path under the script dir). */
+        snippet_filename: string;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['framework__ScriptExecuteWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__ScriptExecutionResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  snippets_snippets_api_script_history_api_apps_snippets_snippet_history_get: {
+    parameters: {
+      query: {
+        /** @description Script filename (relative path under the script dir). */
+        snippet_filename: string;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': Record<string, never>;
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  snippets_snippets_api_script_preview_api_apps_snippets_snippet_preview_get: {
+    parameters: {
+      query: {
+        /** @description Snippet filename (relative path under snippets root). */
+        snippet_filename: string;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__ScriptPreviewResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  snippets_snippets_api_script_schema_api_apps_snippets_snippet_schema_get: {
+    parameters: {
+      query: {
+        /** @description Script filename (relative path under the script dir). */
+        snippet_filename: string;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__AppSchema'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  task_manager_tasks_api_list_api_apps_tasks__get: {
+    parameters: {
+      query?: {
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['tasks__PaginatedResponse_TaskListResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  task_manager_get_schema_api_apps_tasks_schema_get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['framework__AppSchema'];
+        };
+      };
+    };
+  };
+  task_manager_tasks_api_detail_api_apps_tasks__task_name__get: {
+    parameters: {
+      query?: {
+        owner?: string | null;
+      };
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['tasks__TaskDetailResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  topology_topology_collect_api_apps_topology_collect_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['topology__TopologyCollectWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      202: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['topology__TopologyCollectResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  topology_topology_result_api_apps_topology_result_get: {
+    parameters: {
+      query: {
+        /** @description Comma-separated task history ids */
+        ids: string;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['topology__TopologyResultResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  sep_check_connectivity_api_sep_admin_connectivity_check__post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['ConnectivityCheckRequest'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['ConnectivityResult'][];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  sep_list_settings_api_sep_admin_settings__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['SettingsListResponse'];
+        };
+      };
+    };
+  };
+  sep_export_settings_api_sep_admin_settings_export_get: {
+    parameters: {
+      query?: {
+        keys?: string[] | null;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': unknown;
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+      /** @description Upstream Tasks API failure. */
+      502: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': {
+            detail: string;
+          };
+        };
+      };
+    };
+  };
+  sep_patch_settings_api_sep_admin_settings__setting_class__patch: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        setting_class: components['schemas']['SettingClassEnum'];
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['SettingsPatch'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['SettingResponse'][];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  sep_get_setting_api_sep_admin_settings__setting_class___key__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        setting_class: components['schemas']['SettingClassEnum'];
+        key: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['SettingResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  sep_delete_setting_api_sep_admin_settings__setting_class___key__delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        setting_class: components['schemas']['SettingClassEnum'];
+        key: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  sep_get_app_info_api_sep_app_info__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['AppInfo'];
+        };
+      };
+    };
+  };
+  sep_get_dashboard_stats_api_sep_dashboard__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['DashboardStatsResponse'];
+        };
+      };
+    };
+  };
+  sep_list_hosts_api_sep_hosts__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HostResponse'][];
+        };
+      };
+      /** @description Upstream Tasks API failure. */
+      502: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': {
+            detail: string;
+          };
+        };
+      };
+    };
+  };
+  tasks_list_periodic_tasks_api_sep_periodic_tasks__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': Record<string, never>[];
+        };
+      };
+      /** @description Upstream Tasks API failure. */
+      502: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': {
+            detail: string;
+          };
+        };
+      };
+    };
+  };
+  tasks_update_periodic_task_api_sep_periodic_tasks__periodic_task_id__put: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        periodic_task_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': Record<string, never>;
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': Record<string, never>;
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+      /** @description Upstream Tasks API failure. */
+      502: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': {
+            detail: string;
+          };
+        };
+      };
+    };
+  };
+  tasks_delete_periodic_task_api_sep_periodic_tasks__periodic_task_id__delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        periodic_task_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+      /** @description Upstream Tasks API failure. */
+      502: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': {
+            detail: string;
+          };
+        };
+      };
+    };
+  };
+  tasks_create_periodic_task_api_sep_periodic_tasks__task_name___post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': Record<string, never>;
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': Record<string, never>;
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+      /** @description Upstream Tasks API failure. */
+      502: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': {
+            detail: string;
+          };
+        };
+      };
+    };
+  };
+  sep_list_schema_tables_api_sep_schemas__schema_id__tables_get: {
+    parameters: {
+      query?: {
+        search?: string | null;
+      };
+      header?: never;
+      path: {
+        schema_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['InventorySelectorOption'][];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  sep_list_services_api_sep_services__get: {
+    parameters: {
+      query?: {
+        service_type?: components['schemas']['ServiceTypeEnum'] | null;
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PaginatedResponse_ServiceResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  sep_list_service_schemas_api_sep_services__service_id__schemas_get: {
+    parameters: {
+      query?: {
+        search?: string | null;
+      };
+      header?: never;
+      path: {
+        service_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['InventorySelectorOption'][];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_list_merged_task_history_api_sep_task_history__get: {
+    parameters: {
+      query?: {
+        task_names?: string[] | null;
+        status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+        exclude_internal?: boolean;
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PaginatedResponse_TaskHistoryResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+      /** @description Upstream Tasks API failure. */
+      502: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': {
+            detail: string;
+          };
+        };
+      };
+    };
+  };
+  tasks_stop_task_history_api_sep_task_history__task_history_id__stop__post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_history_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': Record<string, never>;
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+      /** @description Upstream Tasks API failure. */
+      502: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': {
+            detail: string;
+          };
+        };
+      };
+    };
+  };
+  tasks_get_task_stats_api_sep_task_stats__task_name__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': Record<string, never>;
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+      /** @description Upstream Tasks API failure. */
+      502: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': {
+            detail: string;
+          };
+        };
+      };
+    };
+  };
+  tasks_list_task_execution_events_execution_events__task_history_id__get: {
+    parameters: {
+      query?: {
+        owner?: string | null;
+      };
+      header?: never;
+      path: {
+        task_history_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['ExecutionEvent'][];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_list_task_history_files_files__task_history_id__get: {
+    parameters: {
+      query?: {
+        owner?: string | null;
+      };
+      header?: never;
+      path: {
+        task_history_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': {
+            [key: string]: components['schemas']['FileMetadata'];
+          };
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_download_task_history_file_files__task_history_id__download_get: {
+    parameters: {
+      query?: {
+        owner?: string | null;
+      };
+      header?: never;
+      path: {
+        task_history_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': unknown;
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_task_logs_event_stream_stream_logs__task_history_id__get: {
+    parameters: {
+      query?: {
+        owner?: string | null;
+      };
+      header?: never;
+      path: {
+        task_history_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': unknown;
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_task_execution_events_stream_stream_logs__task_history_id__execution_events_get: {
+    parameters: {
+      query?: {
+        owner?: string | null;
+      };
+      header?: never;
+      path: {
+        task_history_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': unknown;
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+}
diff --git a/ui/packages/sep/api/src/generated/tasks.ts b/ui/packages/sep/api/src/generated/tasks.ts
new file mode 100644
index 00000000000..8fc8cafec5b
--- /dev/null
+++ b/ui/packages/sep/api/src/generated/tasks.ts
@@ -0,0 +1,2770 @@
+/**
+ * This file is auto-generated by `pnpm --filter @sep/api codegen`.
+ * Do not edit by hand — regenerate from the source OpenAPI spec.
+ */
+export interface paths {
+  '/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Tasks
+     * @description List all active tasks.
+     */
+    get: operations['tasks_list_tasks__get'];
+    put?: never;
+    /**
+     * Create Task
+     * @description Create a new task.
+     */
+    post: operations['tasks_create_task__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/admin/settings/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Settings
+     * @description List every exposed settings class with current values and metadata.
+     *
+     *     Local classes are read from their config singletons; remote classes
+     *     (``remote_classes``) are fetched server-side from their owning sub-app
+     *     and appended in declaration order; app-owned classes follow remote
+     *     groups with per-group app metadata. A failed remote fetch fails the
+     *     whole request with ``502`` -- the LIST never silently drops a remote
+     *     group.
+     *
+     *     :param session: The sub-app's database session.
+     *     :param remote_api: The client for remote settings classes (``None`` when
+     *         the router wires none).
+     *     :return: Grouped responses, one group per configured settings class.
+     */
+    get: operations['settings_list_settings_admin_settings__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/admin/settings/{setting_class}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    /**
+     * Patch Settings
+     * @description Apply a batch of overrides for one settings class atomically.
+     *
+     *     For a remote class the batch is forwarded to the owning sub-app, which
+     *     owns the validation and persistence; the upstream's per-field ``422``
+     *     (and its ``detail``) is preserved so the UI can render inline messages.
+     *
+     *     For a local class: Phase A validates every key in ``body`` (existence on
+     *     the class, HOT classification, type/constraint coercion) and collects
+     *     per-key errors. If any key fails, the whole batch is rejected with a
+     *     structured 422 and nothing is written. Phase B persists every valid entry
+     *     in a single transaction, refreshes the proxy snapshot once, then fires
+     *     the rebind callbacks for any changed keys so a HOT target rebinds without
+     *     waiting for the next background refresh cycle.
+     *
+     *     :param request: The incoming request; its ``app.state`` carries the
+     *         sub-app's rebind-callback registry.
+     *     :param setting_class: The settings class the override targets.
+     *     :param body: The batch of ``{key: value, ...}`` overrides.
+     *     :param session: The sub-app's database session.
+     *     :param remote_api: The client for remote settings classes (``None`` when
+     *         the router wires none).
+     *     :return: One :class:`SettingResponse` per applied key, in input order.
+     *     :raises HTTPNotFoundException: If the class isn't exposed.
+     *     :raises HTTPUnprocessableEntityException: If any key fails validation;
+     *         no rows are written.
+     */
+    patch: operations['settings_patch_settings_admin_settings__setting_class__patch'];
+    trace?: never;
+  };
+  '/admin/settings/{setting_class}/{key}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Setting
+     * @description Return one field's metadata and current value.
+     *
+     *     :param setting_class: The settings class the field belongs to.
+     *     :param key: The field name on the settings class.
+     *     :param session: The sub-app's database session.
+     *     :param remote_api: The client for remote settings classes (``None`` when
+     *         the router wires none).
+     *     :return: The structured response for the field.
+     *     :raises HTTPNotFoundException: If the class isn't exposed or the key
+     *         doesn't exist on the class.
+     */
+    get: operations['settings_get_setting_admin_settings__setting_class___key__get'];
+    put?: never;
+    post?: never;
+    /**
+     * Delete Setting
+     * @description Revert one override row to the field's declared default.
+     *
+     *     For a remote class the DELETE is forwarded to the owning sub-app, which
+     *     owns the idempotency and ``NOT_OVERRIDABLE`` semantics; its status and
+     *     ``detail`` are preserved through the proxy.
+     *
+     *     For a local class the DELETE is idempotent: deleting a (class, key) pair
+     *     that has no override row succeeds with 204. Attempting to delete a field
+     *     the code declares NOT_OVERRIDABLE responds 409, since it cannot have an
+     *     override row in the first place and the operator's intent is
+     *     unsatisfiable. A field only ``SETTINGS_OVERRIDE_ALLOWED_KEYS`` withheld
+     *     may still carry a row written before the restriction applied, so that
+     *     row is deleted normally and only the no-row case answers 409.
+     *
+     *     After republishing the snapshot, fires the rebind callbacks for the
+     *     reverted key so a HOT target rebinds to its restored value without
+     *     waiting for the next background refresh cycle.
+     *
+     *     :param request: The incoming request; its ``app.state`` carries the
+     *         sub-app's rebind-callback registry.
+     *     :param setting_class: The settings class the field belongs to.
+     *     :param key: The field name on the settings class.
+     *     :param session: The sub-app's database session.
+     *     :param remote_api: The client for remote settings classes (``None`` when
+     *         the router wires none).
+     *     :raises HTTPNotFoundException: If the class isn't exposed or the key
+     *         doesn't exist on the class.
+     *     :raises HTTPConflictException: If the field is NOT_OVERRIDABLE and has
+     *         no row to delete.
+     *     :raises HTTPUnprocessableEntityException: If ``key`` names a
+     *         ``NESTED_ONLY`` parent (the whole parent cannot be overridden;
+     *         target an individual ``parent__leaf`` instead).
+     *     :raises HTTPBadGatewayException: For a remote class, when the owning
+     *         sub-app returns a server error (status >= 500) or is unreachable.
+     */
+    delete: operations['settings_delete_setting_admin_settings__setting_class___key__delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/connectivity-check/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Connectivity Check
+     * @description Check database connectivity via a Nomad task.
+     *
+     *     :param session: The async database session.
+     *     :type session: AsyncSession
+     *     :param request: The connectivity check request parameters.
+     *     :type request: ConnectivityCheckWrite
+     *     :return: The connectivity check result.
+     *     :rtype: ConnectivityCheckResponse
+     */
+    post: operations['connectivity_connectivity_check_connectivity_check__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/execute/{task_name}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Execute Task Name
+     * @description Send a task for execution.
+     *
+     *     When ``tasks_settings.PRE_EXECUTION_CONNECTIVITY_CHECK`` is enabled and the
+     *     task carries ``_connectivity_*`` meta fields, run a Nomad-side connectivity
+     *     check against the target before dispatch. In ``block`` mode, dispatch is
+     *     rejected with HTTP 400 on failure; in ``warn`` mode, a warning is logged
+     *     and dispatch proceeds. ETA-scheduled tasks always skip the check.
+     */
+    post: operations['tasks_execute_task_name_execute__task_name__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/history/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Task History
+     * @description List all task history records.
+     */
+    get: operations['tasks_list_task_history_history__get'];
+    put?: never;
+    /**
+     * Create Task History
+     * @description Create a new task history.
+     *
+     *     ``has_logs`` is not populated on this response -- a row that was just
+     *     created has no chunk-store entry or legacy tracking blob yet, so the
+     *     field defaults to ``False`` on serialization.
+     */
+    post: operations['tasks_create_task_history_history__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/history/latest': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Latest Task History
+     * @description Return the latest-history projection (status + finished_at) per task name.
+     */
+    post: operations['tasks_latest_task_history_history_latest_post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/history/{task_history_id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Retrieve Task History
+     * @description Retrieve a task history by id.
+     */
+    get: operations['tasks_retrieve_task_history_history__task_history_id__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/history/{task_history_id}/events': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Task History Events
+     * @description Return structured execution events from executor tracking (oldest first).
+     */
+    get: operations['tasks_list_task_history_events_history__task_history_id__events_get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/history/{task_history_id}/file/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Stream Task History File
+     * @description Stream a file from a task history.
+     */
+    get: operations['tasks_stream_task_history_file_history__task_history_id__file__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/history/{task_history_id}/files/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Task History Files
+     * @description List files from a task history.
+     */
+    get: operations['tasks_list_task_history_files_history__task_history_id__files__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/history/{task_history_id}/logs/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Stream Task History Logs
+     * @description Stream a task history's logs.
+     *
+     *     ``tail`` limits output to the last N lines per stream for finished histories
+     *     only. It is ignored while the task is ``RUNNING`` (live executor stream).
+     */
+    get: operations['tasks_stream_task_history_logs_history__task_history_id__logs__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/history/{task_history_id}/stop/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Stop Task History
+     * @description Stop a task history.
+     */
+    post: operations['tasks_stop_task_history_history__task_history_id__stop__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/history/{task_history_id}/sync/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Sync Task History
+     * @description Sync task history with the executor and persist the latest status.
+     *
+     *     Atomically claim the ``sync_in_progress_started_at`` lock before calling
+     *     the executor so the celery ``sync_running_tasks`` periodic and this route
+     *     never both progress past the executor call for the same row. When the
+     *     claim returns no rows — either because another syncer holds the lock or
+     *     because the status has already flipped to terminal — refresh the row
+     *     from the DB and return without re-syncing. The holder (or completed
+     *     syncer) is responsible for dispatching any chained task.
+     */
+    post: operations['tasks_sync_task_history_history__task_history_id__sync__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/hosts/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Executor Hosts
+     * @description Return the executor hosts from the executor.
+     *
+     *     Wrap the upstream executor call so connection failures or non-JSON
+     *     bodies surface as a 502 JSON response instead of leaking a default
+     *     500 + text/plain that masks the real failure on the dashboard banner.
+     *
+     *     :param executor: The task executor backend used to fetch host metadata.
+     *     :type executor: TaskExecutor
+     *     :return: A mapping of executor node name to network address.
+     *     :rtype: dict[str, str]
+     *     :raises HTTPBadGatewayException: If the executor backend raises a
+     *         ``requests.exceptions.RequestException`` (e.g. a non-JSON response
+     *         body or a connection failure outside the Nomad SDK's own wrapping).
+     */
+    get: operations['tasks_get_executor_hosts_hosts__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/periodic/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Periodic Tasks
+     * @description List all periodic tasks.
+     */
+    get: operations['periodic_list_periodic_tasks_periodic__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/periodic/{periodic_task_id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Retrieve Periodic Task
+     * @description Retrieve a periodic task by ID.
+     */
+    get: operations['periodic_retrieve_periodic_task_periodic__periodic_task_id__get'];
+    /**
+     * Update Periodic Task
+     * @description Update a periodic task.
+     */
+    put: operations['periodic_update_periodic_task_periodic__periodic_task_id__put'];
+    post?: never;
+    /**
+     * Delete Periodic Task
+     * @description Delete a periodic task.
+     */
+    delete: operations['periodic_delete_periodic_task_periodic__periodic_task_id__delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/stats/{task}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Task Stats
+     * @description Calculate the statistics for the task.
+     */
+    get: operations['tasks_get_task_stats_stats__task__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/transform/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Transform Payload
+     * @description Transform a payload string into a dictionary.
+     */
+    post: operations['tasks_transform_payload_transform__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/{task_name}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Task
+     * @description Retrieve a task by its name.
+     */
+    get: operations['tasks_get_task__task_name__get'];
+    /**
+     * Update Task
+     * @description Update an existing task.
+     */
+    put: operations['tasks_update_task__task_name__put'];
+    post?: never;
+    /**
+     * Delete Task
+     * @description Delete a task.
+     */
+    delete: operations['tasks_delete_task__task_name__delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/{task_name}/periodic/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Periodic Tasks By Task Name
+     * @description List periodic tasks by task name.
+     */
+    get: operations['tasks_list_periodic_tasks_by_task_name__task_name__periodic__get'];
+    put?: never;
+    /**
+     * Create Periodic Task For Task Name
+     * @description Create a new periodic task for the specified task name.
+     */
+    post: operations['tasks_create_periodic_task_for_task_name__task_name__periodic__post'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/{task}/history/': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get Task History
+     * @description Retrieve task history by task name.
+     */
+    get: operations['tasks_get_task_history__task__history__get'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+  schemas: {
+    /**
+     * ConnectivityCheckResponse
+     * @description Represent a connectivity check result.
+     *
+     *     :param success: Whether the connectivity check succeeded.
+     *     :param error: Error message if the check failed. Defaults to ``None``.
+     *     :param task_history_id: The ID of the task history record for this check.
+     */
+    ConnectivityCheckResponse: {
+      /** Error */
+      error?: string | null;
+      /** Success */
+      success: boolean;
+      /** Task History Id */
+      task_history_id: number;
+    };
+    /**
+     * ConnectivityCheckWrite
+     * @description Represent a connectivity check request payload.
+     *
+     *     :param target: The Nomad node name to run the check on.
+     *     :param host: The database host address.
+     *     :param port: The database port number.
+     *     :param service_type: The type of database service to check.
+     *     :param timeout: Connect-phase budget in seconds, counted only once the
+     *         ``run-script`` task starts. Total server wait is ``PROVISIONING_TIMEOUT``
+     *         (provisioning phase) plus this value. Defaults to 30.
+     */
+    ConnectivityCheckWrite: {
+      /** Host */
+      host: string;
+      /** Port */
+      port: number;
+      service_type: components['schemas']['ConnectivityServiceType'];
+      /** Target */
+      target: string;
+      /**
+       * Timeout
+       * @default 30
+       */
+      timeout: number;
+    };
+    /**
+     * ConnectivityServiceType
+     * @description Define supported database service types for connectivity checks.
+     *
+     *     :cvar MYSQL: MySQL database service.
+     *     :vartype MYSQL: str
+     *     :cvar POSTGRESQL: PostgreSQL database service.
+     *     :vartype POSTGRESQL: str
+     *     :cvar MONGODB: MongoDB database service.
+     *     :vartype MONGODB: str
+     * @enum {string}
+     */
+    ConnectivityServiceType: 'mysql' | 'postgresql' | 'mongodb';
+    /**
+     * CrontabSchedule
+     * @description Representing a crontab schedule.
+     *
+     *     :param minute: Represents the minute component in cron format. Defaults to `"*"`.
+     *     :type minute: str
+     *     :param hour: Represents the hour component in cron format. Defaults to `"*"`.
+     *     :type hour: str
+     *     :param day_of_week: Represents the day of the week component in cron format.
+     *         Defaults to `"*"`.
+     *     :type day_of_week: str
+     *     :param day_of_month: Represents the day of the month component in cron format.
+     *         Defaults to `"*"`.
+     *     :type day_of_month: str
+     *     :param month_of_year: Represents the month component in cron format.
+     *         Defaults to `"*"`.
+     *     :type month_of_year: str
+     *     :param timezone: The timezone for the cron schedule. Defaults to "UTC". Must be a
+     *         valid timezone as returned in `available_timezones()`
+     *     :type timezone: str
+     */
+    CrontabSchedule: {
+      /**
+       * Day Of Month
+       * @default *
+       */
+      day_of_month: string;
+      /**
+       * Day Of Week
+       * @default *
+       */
+      day_of_week: string;
+      /**
+       * Hour
+       * @default *
+       */
+      hour: string;
+      /**
+       * Minute
+       * @default *
+       */
+      minute: string;
+      /**
+       * Month Of Year
+       * @default *
+       */
+      month_of_year: string;
+      /**
+       * Timezone
+       * @default UTC
+       */
+      timezone: string;
+    };
+    /**
+     * ExecutionEvent
+     * @description A single lifecycle event from a task executor (executor-agnostic shape).
+     *
+     *     :param timestamp: When the event occurred (UTC).
+     *     :type timestamp: UTCDatetime
+     *     :param event_type: Executor-specific event category (e.g. Nomad task event type).
+     *     :type event_type: str
+     *     :param description: Human-readable message for the event (no step prefix).
+     *     :type description: str
+     *     :param step: Optional executor task/step name (e.g. Nomad task within the group).
+     *     :type step: str | None
+     */
+    ExecutionEvent: {
+      /** Description */
+      description: string;
+      /** Step */
+      step?: string | null;
+      /**
+       * Timestamp
+       * Format: date-time
+       */
+      timestamp: string;
+      /** Type */
+      type: string;
+    };
+    /**
+     * FileMetadata
+     * @description Represent file metadata for task artifacts.
+     */
+    FileMetadata: {
+      /**
+       * Is Dir
+       * @default false
+       */
+      is_dir: boolean;
+      /**
+       * Size
+       * @default 0
+       */
+      size: number;
+    };
+    /** HTTPValidationError */
+    HTTPValidationError: {
+      /** Detail */
+      detail?: components['schemas']['ValidationError'][];
+    };
+    /**
+     * IntervalSchedule
+     * @description Represent an interval schedule.
+     *
+     *     :param every: The number of periods between each execution.
+     *     :type every: PositiveInt
+     *     :param period: The period unit for the interval (e.g., hours, minutes).
+     *     :type period: Period
+     */
+    IntervalSchedule: {
+      /** Every */
+      every: number;
+      period: components['schemas']['Period'];
+    };
+    JsonValue: unknown;
+    /** PaginatedResponse[TaskHistoryResponse] */
+    PaginatedResponse_TaskHistoryResponse_: {
+      /** Items */
+      items: components['schemas']['TaskHistoryResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /** PaginatedResponse[TaskResponse] */
+    PaginatedResponse_TaskResponse_: {
+      /** Items */
+      items: components['schemas']['TaskResponse'][];
+      /** Limit */
+      limit: number;
+      /** Offset */
+      offset: number;
+      /** Total */
+      total: number;
+    };
+    /**
+     * Period
+     * @enum {string}
+     */
+    Period: 'days' | 'hours' | 'minutes' | 'seconds' | 'microseconds';
+    /**
+     * PeriodicTaskCreate
+     * @description Define the model for creating periodic tasks.
+     *
+     *     Extends `PeriodicTaskWrite` and includes additional fields required for creating
+     *     new periodic tasks.
+     *
+     *     :param task: The Celery task name.
+     *     :type task: str
+     *     :param execute_request: The execution request details for the task.
+     *     :type execute_request: PeriodicTaskExecuteRequest | None
+     *     :param interval: The interval schedule for the task. Defaults to None.
+     *     :type interval: IntervalSchedule | None
+     *     :param crontab: The crontab schedule for the task. Defaults to None.
+     *     :type crontab: CrontabSchedule | None
+     *     :param kwargs: A JSON string representing additional keyword arguments for the task.
+     *     :type kwargs: str
+     *     :param name: The name of the periodic task. Defaults to an empty string, meaning
+     *         the value will be automatically generated on create.
+     *     :type name: str
+     *     :param start_time: The start time for the task execution. Defaults to None.
+     *     :type start_time:  UTCDatetime | None
+     *     :param enabled: Whether the task is enabled. Defaults to True.
+     *     :type enabled: bool
+     *     :param description: A description of the task. Defaults to an empty string.
+     *     :type description: str
+     */
+    PeriodicTaskCreate: {
+      crontab?: components['schemas']['CrontabSchedule'] | null;
+      /**
+       * Description
+       * @default
+       */
+      description: string;
+      /**
+       * Enabled
+       * @default true
+       */
+      enabled: boolean;
+      execute_request?:
+        | components['schemas']['PeriodicTaskExecuteRequest']
+        | null;
+      interval?: components['schemas']['IntervalSchedule'] | null;
+      /** Kwargs */
+      kwargs: string;
+      /**
+       * Name
+       * @default
+       */
+      name: string;
+      /** Start Time */
+      start_time?: string | null;
+      /** Task */
+      task: string;
+    };
+    /**
+     * PeriodicTaskExecuteRequest
+     * @description Represent the execute request the periodic task will use for executions.
+     *
+     *     :param meta: A dictionary of meta variables for the task execution.
+     *         Defaults to an empty dictionary.
+     *     :type meta: dict[str, Any]
+     *     :param payload: Optional payload data or file path for the task execution.
+     *         Defaults to None.
+     *     :type payload: str | None
+     *     :param eta: The earliest time the task can be executed. Forced to None, as periodic
+     *         tasks are always executed on the defined schedule.
+     *     :type eta: datetime | None
+     */
+    PeriodicTaskExecuteRequest: {
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Chain On Failure
+       * @default false
+       */
+      chain_on_failure: boolean;
+      /** Chain Task Names */
+      chain_task_names?: string[] | null;
+      /** Eta */
+      eta?: string | null;
+      /**
+       * Meta
+       * @default {}
+       */
+      meta: Record<string, never>;
+      /** Payload */
+      payload?: string | null;
+    };
+    /**
+     * PeriodicTaskResponse
+     * @description Represent a response for a periodic task API call.
+     *
+     *     This model extends `BasePeriodicTask` and includes additional fields such as ID,
+     *     last run time, total run count, and date changed.
+     *
+     *     :param name: The name of the periodic task.
+     *     :type name: str
+     *     :param task: The SEP task name.
+     *     :type task: str
+     *     :param start_time: The start time for the task execution.
+     *     :type start_time: UTCDatetime | None
+     *     :param enabled: Whether the task is enabled.
+     *     :type enabled: bool
+     *     :param description: A description of the task.
+     *     :type description: str
+     *     :param execute_request: The execution request details for the task.
+     *     :type execute_request: PeriodicTaskExecuteRequest | None
+     *     :param id: The unique identifier of the periodic task.
+     *     :type id: int
+     *     :param last_run_at: The datetime of the last run.
+     *     :type last_run_at: UTCDatetime | None
+     *     :param total_run_count: The total number of times the task has run.
+     *     :type total_run_count: int
+     *     :param date_changed: The datetime when the task was last changed.
+     *     :type date_changed: UTCDatetime | None
+     *     :param last_run_status: The result of this schedule's own most recent
+     *         run, or ``None`` when the schedule has never run. Resolved as the
+     *         earliest system-triggered history for this task name at or after the
+     *         schedule's ``last_run_at``, so a later unrelated system run of the same
+     *         task name is not misattributed.
+     *     :param interval: The interval schedule for the task. Defaults to None. This field
+     *         is populated with the alias "model_intervalschedule".
+     *     :type interval: IntervalSchedule | None
+     *     :param crontab: The crontab schedule for the task. Defaults to None. This field
+     *         is populated with the alias "model_crontabschedule".
+     *     :type crontab: CrontabSchedule | None
+     */
+    PeriodicTaskResponse: {
+      crontab?: components['schemas']['CrontabSchedule'] | null;
+      /** Date Changed */
+      date_changed: string | null;
+      /** Description */
+      description: string;
+      /** Enabled */
+      enabled: boolean;
+      execute_request?:
+        | components['schemas']['PeriodicTaskExecuteRequest']
+        | null;
+      /** Id */
+      id: number;
+      interval?: components['schemas']['IntervalSchedule'] | null;
+      /** Last Run At */
+      last_run_at: string | null;
+      last_run_status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+      /** Name */
+      name: string;
+      /**
+       * Next Run At
+       * @description Compute the next scheduled execution time.
+       *
+       *     Return the next execution time based on the task's schedule. For crontab
+       *     schedules, use `croniter` to compute the next fire time from the cron
+       *     expression in the schedule's timezone, converted to UTC. For interval
+       *     schedules, add the interval duration to `last_run_at`, falling back to
+       *     `start_time`, then the current time.
+       *
+       *     :return: The next scheduled execution time in UTC, or `None` if the task
+       *         is disabled.
+       *     :rtype: UTCDatetime | None
+       */
+      readonly next_run_at: string | null;
+      /**
+       * Period
+       * @description Get the period string for the periodic task.
+       *
+       *     Returns a string representation of the task's schedule based on whether it uses
+       *     an interval or crontab schedule.
+       *
+       *     :return: A string representing the task's period.
+       *     :rtype: str
+       */
+      readonly period: string;
+      /** Start Time */
+      start_time: string | null;
+      /** Task */
+      task: string;
+      /**
+       * Total Run Count
+       * @default 0
+       */
+      total_run_count: number;
+    };
+    /**
+     * PeriodicTaskUpdate
+     * @description Define the model for updating periodic tasks.
+     *
+     *     Extends `PeriodicTaskWrite` and adds validations specific to updating tasks.
+     *
+     *     :param name: The name of the periodic task.
+     *     :type name: str
+     *     :param task: The Celery task name.
+     *     :type task: str
+     *     :param start_time: The start time for the task execution.
+     *     :type start_time: UTCDatetime | None
+     *     :param enabled: Whether the task is enabled.
+     *     :type enabled: bool
+     *     :param description: A description of the task.
+     *     :type description: str
+     *     :param execute_request: The execution request details for the task.
+     *     :type execute_request: PeriodicTaskExecuteRequest | None
+     *     :param interval: The interval schedule for the task. Defaults to None.
+     *     :type interval: IntervalSchedule | None
+     *     :param crontab: The crontab schedule for the task. Defaults to None.
+     *     :type crontab: CrontabSchedule | None
+     *     :param kwargs: A JSON string representing additional keyword arguments for the task.
+     *     :type kwargs: str
+     */
+    PeriodicTaskUpdate: {
+      crontab?: components['schemas']['CrontabSchedule'] | null;
+      /** Description */
+      description: string;
+      /** Enabled */
+      enabled: boolean;
+      execute_request?:
+        | components['schemas']['PeriodicTaskExecuteRequest']
+        | null;
+      interval?: components['schemas']['IntervalSchedule'] | null;
+      /** Kwargs */
+      kwargs: string;
+      /** Name */
+      name: string;
+      /** Start Time */
+      start_time: string | null;
+      /** Task */
+      task: string;
+    };
+    /**
+     * ReloadClassification
+     * @description Declare the reload behavior of an overridable settings field.
+     *
+     *     :cvar HOT: Field can be overridden via a DB row and the new value takes
+     *         effect on the next snapshot refresh, without restarting the service.
+     *         For a nested-model field, ``HOT`` permits both whole-object override
+     *         (``PATCH {parent: {...}}``) and per-child override (``parent__leaf``).
+     *     :vartype HOT: str
+     *     :cvar NESTED_ONLY: Nested-model field whose children may be overridden
+     *         (``parent__leaf``) while the parent itself rejects whole-object
+     *         override (``PATCH {parent: {...}}`` → 422). Children default to
+     *         HOT-inherit unless explicitly marked :func:`not_overridable_field`.
+     *     :vartype NESTED_ONLY: str
+     *     :cvar NOT_OVERRIDABLE: Field is not overridable from the database; YAML
+     *         and environment variables remain the only sources of truth.
+     *     :vartype NOT_OVERRIDABLE: str
+     * @enum {string}
+     */
+    ReloadClassification: 'hot' | 'nested_only' | 'not_overridable';
+    /**
+     * SettingClassEnum
+     * @description Enumerate settings classes that may have HOT override rows.
+     *
+     *     The wired classes are ``SEPSettings``, ``TasksSettings``,
+     *     ``SnippetsSettings``, ``MessagesSettings``, the global ``Settings``,
+     *     ``AlertSettings``, ``AlertsSettings``, ``AnonymizerSettings`` and
+     *     ``InventorySettings``.
+     *
+     *     To wire a new settings class:
+     *
+     *     1. Add a member here whose value matches the Pydantic class ``__name__``.
+     *     2. Generate an Alembic migration on every consumer track that extends the
+     *        ``CHECK`` constraint on ``settingoverride.setting_class``. The column
+     *        uses ``native_enum=False`` so the value list lives in a constraint,
+     *        not a PostgreSQL ``TYPE`` -- the migration ``ALTER``s the constraint.
+     *        Note that the column and ``CHECK`` constraint persist the enum member
+     *        *names* (e.g. ``SEP_SETTINGS``), which is distinct from the member
+     *        *value* (the Pydantic class name, e.g. ``SEPSettings``).
+     *     3. Wire a ``ProxyEntry`` for the new class in the relevant service's
+     *        lifespan (``app/sep/main.py`` or ``app/tasks/main.py``).
+     * @enum {string}
+     */
+    SettingClassEnum:
+      | 'SEPSettings'
+      | 'TasksSettings'
+      | 'SnippetsSettings'
+      | 'MessagesSettings'
+      | 'Settings'
+      | 'AlertSettings'
+      | 'AnonymizerSettings'
+      | 'AlertsSettings'
+      | 'InventorySettings';
+    /**
+     * SettingClassGroup
+     * @description One settings-class group in the LIST response.
+     *
+     *     :param setting_class: The settings class this group represents.
+     *     :type setting_class: SettingClassEnum
+     *     :param settings: The fields declared on the settings class, with their
+     *         current values and metadata.
+     *     :type settings: list[SettingResponse]
+     *     :param is_app_owned: Whether this group belongs to a SEP app under
+     *         ``app/sep/apps/`` rather than core SEP wiring.
+     *     :type is_app_owned: bool
+     *     :param app_id: The owning app's registry key when ``is_app_owned`` is
+     *         ``True``; ``None`` for core groups.
+     *     :type app_id: str | None
+     *     :param app_display_name: The owning app's human-facing label when
+     *         ``is_app_owned`` is ``True``; ``None`` for core groups.
+     *     :type app_display_name: str | None
+     *     :param app_enabled: Whether the owning app is currently enabled when
+     *         ``is_app_owned`` is ``True``; ``None`` for core groups. Disabled
+     *         apps remain listed so the frontend can hide them without a second
+     *         lookup.
+     *     :type app_enabled: bool | None
+     */
+    SettingClassGroup: {
+      /** App Display Name */
+      app_display_name?: string | null;
+      /** App Enabled */
+      app_enabled?: boolean | null;
+      /** App Id */
+      app_id?: string | null;
+      /**
+       * Is App Owned
+       * @default false
+       */
+      is_app_owned: boolean;
+      setting_class: components['schemas']['SettingClassEnum'];
+      /** Settings */
+      settings: components['schemas']['SettingResponse'][];
+    };
+    /**
+     * SettingResponse
+     * @description Represent a single setting's metadata and current value.
+     *
+     *     :param setting_class: The settings class the field belongs to.
+     *     :param key: The field name on the settings class.
+     *     :param key_path: Carry the canonical key segments for ``key`` such that
+     *         ``"__".join(key_path) == key``.
+     *     :param value: The current value visible through the proxy, dumped to a
+     *         JSON-safe shape via the field's annotation. ``SecretStr`` fields are
+     *         redacted to ``"**********"``.
+     *     :param default_value: The field's declared default value, dumped via the
+     *         same JSON serialiser. ``None`` when no default exists.
+     *     :param type: A human-readable representation of the field's declared
+     *         annotation (for operator visibility; validation uses the actual
+     *         ``FieldInfo``).
+     *     :param reload: The reload classification (HOT or NOT_OVERRIDABLE).
+     *     :param description: The field's free-text description, or ``None``.
+     *     :param is_secret: Whether the field's annotation contains a Pydantic secret
+     *         (``SecretStr`` / ``SecretBytes``) at any depth.
+     *     :param is_complex: Whether the field's annotation is or contains a Pydantic
+     *         ``BaseModel`` subclass (true for nested submodels).
+     *     :param has_override: Whether a row exists in the ``settingoverride`` table
+     *         for this ``(setting_class, key)`` pair, regardless of ``is_active``.
+     *     :param is_advanced: Whether the setting is flagged ``advanced`` so the UI can
+     *         present it separately from everyday settings. Display-only:
+     *         it does not affect PATCH/DELETE eligibility.
+     *     :param is_applicable: Whether the setting applies under current runtime state
+     *         (e.g. the active auth provider). ``False`` lets the UI present the field
+     *         as inert. Display-only, like ``is_advanced``: it does not block
+     *         PATCH/DELETE server-side; the runtime gate is the real enforcement.
+     */
+    SettingResponse: {
+      /** Default Value */
+      default_value: unknown;
+      /** Description */
+      description: string | null;
+      /** Has Override */
+      has_override: boolean;
+      /**
+       * Is Advanced
+       * @default false
+       */
+      is_advanced: boolean;
+      /**
+       * Is Applicable
+       * @default true
+       */
+      is_applicable: boolean;
+      /** Is Complex */
+      is_complex: boolean;
+      /** Is Secret */
+      is_secret: boolean;
+      /** Key */
+      key: string;
+      /** Key Path */
+      key_path?: string[];
+      reload: components['schemas']['ReloadClassification'];
+      setting_class: components['schemas']['SettingClassEnum'];
+      /** Type */
+      type: string;
+      /** Value */
+      value: unknown;
+    };
+    /**
+     * SettingsListResponse
+     * @description The LIST endpoint response, grouping settings by class.
+     *
+     *     :param groups: One :class:`SettingClassGroup` per settings class the
+     *         router was configured with.
+     *     :type groups: list[SettingClassGroup]
+     */
+    SettingsListResponse: {
+      /** Groups */
+      groups: components['schemas']['SettingClassGroup'][];
+    };
+    /**
+     * SettingsPatch
+     * @description Batch PATCH payload: a flat ``{field_name: new_value, ...}`` mapping.
+     *
+     *     An empty body is rejected as 422 because a no-op PATCH is a client bug, not
+     *     a valid request. The server coerces each value to the field's declared
+     *     type via :func:`coerce_field_value`; validation is all-or-nothing -- if any
+     *     key fails, nothing is written.
+     */
+    SettingsPatch: {
+      [key: string]: components['schemas']['JsonValue'];
+    };
+    /**
+     * TaskBackendEnum
+     * @description Control the choice of backends.
+     *
+     *     :cvar NOMAD: Enum value for Nomad backend.
+     *     :vartype NOMAD: str
+     *     :cvar PROXY: Enum value for Proxy backend.
+     *     :vartype PROXY: str
+     *     :cvar CELERY: Enum value for Celery backend.
+     *     :vartype CELERY: str
+     * @enum {string}
+     */
+    TaskBackendEnum: 'nomad' | 'proxy' | 'celery';
+    /**
+     * TaskExecuteRequest
+     * @description Represent a request to execute a task with additional metadata and payload.
+     *
+     *     :param meta: A dictionary of meta variables for the task execution.
+     *         Defaults to an empty dictionary.
+     *     :type meta: dict[str, Any]
+     *     :param payload: Optional payload data or file path for the task execution.
+     *         Defaults to None.
+     *     :type payload: str | None
+     *     :param eta: The earliest time the task can be executed. Defaults to None, meaning
+     *         it will be executed as soon as possible.
+     *     :type eta: datetime | None
+     *     :param anonymize_mask: Bitmask of PII entities to anonymize. Defaults to None.
+     *     :type anonymize_mask: int | None
+     *     :param chain_task_names: Ordered list of task names to execute sequentially after
+     *         this one completes. Defaults to None.
+     *     :type chain_task_names: list[str] | None
+     *     :param chain_on_failure: Whether the chain should continue when a task fails,
+     *         stops, or is lost. Defaults to False (chain only on success).
+     *     :type chain_on_failure: bool
+     */
+    TaskExecuteRequest: {
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Chain On Failure
+       * @default false
+       */
+      chain_on_failure: boolean;
+      /** Chain Task Names */
+      chain_task_names?: string[] | null;
+      /** Eta */
+      eta?: string | null;
+      /**
+       * Meta
+       * @default {}
+       */
+      meta: Record<string, never>;
+      /** Payload */
+      payload?: string | null;
+    };
+    /**
+     * TaskExecutionRequest
+     * @description Represent an execution request.
+     *
+     *     :param task: The task name.
+     *     :type task: str
+     *     :param target: The target system or environment.
+     *     :type target: str
+     *     :param meta: Additional metadata for the task. Defaults to an empty dictionary.
+     *     :type meta: dict | None
+     *     :param payload: Optional payload or file path for parameterizing the task.
+     *         Defaults to None.
+     *     :type payload: str | None
+     *     :param tracking: Tracking information for task execution. Defaults to a dictionary
+     *         with keys for allocation and evaluation IDs.
+     *     :type tracking: dict | None
+     */
+    TaskExecutionRequest: {
+      /** Eta */
+      eta?: string | null;
+      /**
+       * Meta
+       * @default {}
+       */
+      meta: Record<string, never> | null;
+      /** Payload */
+      payload?: string | null;
+      /** Target */
+      target: string;
+      /** Task */
+      task: string;
+      /**
+       * Tracking
+       * @default {}
+       */
+      tracking: Record<string, never> | null;
+    } & {
+      [key: string]: unknown;
+    };
+    /**
+     * TaskHistory
+     * @description Represent a task execution history.
+     *
+     *     :param execution_request: The request that triggered the task execution.
+     *     :type execution_request: TaskExecutionRequest
+     *     :param status: The status of the task execution. Defaults to pending.
+     *     :type status: TaskHistoryStatusEnum
+     *     :param started_at: The datetime when the task execution started.
+     *     :type started_at: UTCDatetime | None
+     *     :param finished_at: The datetime when the task execution finished.
+     *     :type finished_at: UTCDatetime | None
+     *     :param anonymize_mask: The bitmask representing PII entities to be anonymized in
+     *         logs and files generated by the execution. Defaults to None, meaning it uses
+     *         the value defined in the associated task's :attr:`Task.anonymize_mask`.
+     *     :type anonymize_mask: int | None
+     *     :param task_id: The ID of the task associated with the execution.
+     *     :type task_id: int
+     *     :param task: The task associated with this execution history.
+     *     :type task: Task
+     *     :param sync_in_progress_started_at: Timestamp lock for a sync currently in progress.
+     *     :type sync_in_progress_started_at: UTCDatetime | None
+     *     :param log_allocation_epoch: Task-level high-water mark of the current Nomad
+     *         allocation ``CreateIndex``, stamped whenever the log frontier is reset. The
+     *         log writer consults it on the first-insert path (before any per-stream
+     *         ``TaskHistoryLogState`` row exists) to discard writes from a superseded
+     *         allocation. ``0`` is the legacy/unknown sentinel that is trusted
+     *         unconditionally.
+     *     :param executed_by: The user ID of the user who executed the task.
+     *     :type executed_by: str | None
+     */
+    TaskHistory: {
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /** Executed By */
+      executed_by?: string | null;
+      execution_request: components['schemas']['TaskExecutionRequest'];
+      /** Finished At */
+      finished_at?: string | null;
+      /** Id */
+      id: number | null;
+      /** Log Allocation Epoch */
+      log_allocation_epoch: number;
+      /** Started At */
+      started_at?: string | null;
+      /** @default pending */
+      status: components['schemas']['TaskHistoryStatusEnum'];
+      /** Sync In Progress Started At */
+      sync_in_progress_started_at?: string | null;
+      /** Task Id */
+      task_id: number;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * TaskHistoryLatestStatus
+     * @description Represent the latest-history projection for a single task.
+     *
+     *     :param status: The latest known execution status, taken from the newest
+     *         history row; ``None`` only when the task has no history rows at all.
+     *     :param finished_at: The most recent ``finished_at`` across all of the task's
+     *         history rows (a ``max``), so a task with an in-progress re-run still
+     *         reports its prior completion; ``None`` when no run has ever finished.
+     */
+    TaskHistoryLatestStatus: {
+      /** Finished At */
+      finished_at?: string | null;
+      status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+    };
+    /**
+     * TaskHistoryLatestStatusRequest
+     * @description Define request body for batch latest-history status lookup.
+     *
+     *     :param names: Task names to resolve latest non-null history statuses for.
+     *     :type names: list[str]
+     */
+    TaskHistoryLatestStatusRequest: {
+      /** Names */
+      names?: string[];
+    };
+    /**
+     * TaskHistoryResponse
+     * @description Represent a task history API response.
+     *
+     *     :param execution_request: The request that triggered the task execution.
+     *     :type execution_request: TaskExecutionRequest
+     *     :param status: The status of the task execution.
+     *     :type status: TaskHistoryStatusEnum
+     *     :param started_at: The datetime when the task execution started.
+     *     :type started_at: UTCDatetime | None
+     *     :param finished_at: The datetime when the task execution finished.
+     *     :type finished_at: UTCDatetime | None
+     *     :param anonymize_mask: The bitmask representing PII entities to be anonymized in
+     *         logs and files generated by the execution. Defaults to None, meaning it uses
+     *         the value defined in the associated task's :attr:`Task.anonymize_mask`.
+     *     :type anonymize_mask: int | None
+     *     :param task: The task associated with this execution history.
+     *     :type task: TaskResponse
+     *     :param executed_by: The user ID of the user who executed the task.
+     *     :type executed_by: str | None
+     *     :param has_logs: Whether this task history has any readable log content --
+     *         either a chunk-store row or a legacy ``tracking["task_logs"]`` blob.
+     *         Populated by list/retrieve routes; defaults to ``False``.
+     *     :type has_logs: bool
+     *     :param display_name: A user-meaningful label derived from the task name or
+     *         execution-request metadata. Read-only; computed on serialisation.
+     */
+    TaskHistoryResponse: {
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /**
+       * Display Name
+       * @description Return a user-meaningful display label for this task history row.
+       *
+       *     For normal tasks, returns ``task.name``. For generic executor templates
+       *     (``run-python``, ``exec-artifact``, ``exec-python-artifact``), builds a
+       *     ``"<source>/<filename> on <target>"`` label so otherwise-identical rows
+       *     are distinguishable: the filename comes from the snippet metadata or the
+       *     ``file://`` payload basename, the source directory from whichever of those
+       *     carries one, and the target from the execution request. Falls back to
+       *     ``"<task> on <target>"`` when no filename is available.
+       *
+       *     :return: The display label for the task history entry.
+       */
+      readonly display_name: string;
+      /**
+       * Duration
+       * @description Return the duration of the task execution in seconds.
+       *
+       *     :return: The duration in seconds, or None if not available.
+       *     :rtype: float | None
+       */
+      readonly duration: number | null;
+      /** Executed By */
+      executed_by?: string | null;
+      execution_request: components['schemas']['TaskExecutionRequest'];
+      /** Finished At */
+      finished_at?: string | null;
+      /**
+       * Has Logs
+       * @default false
+       */
+      has_logs: boolean;
+      /** Id */
+      id: number | null;
+      /** Started At */
+      started_at?: string | null;
+      /** @default pending */
+      status: components['schemas']['TaskHistoryStatusEnum'];
+      task: components['schemas']['TaskResponse'];
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * TaskHistoryStatusEnum
+     * @description Define status codes for task executions.
+     *
+     *     :cvar FAILED: Enum value for failed tasks.
+     *     :vartype FAILED: str
+     *     :cvar PENDING: Enum value for pending tasks.
+     *     :vartype PENDING: str
+     *     :cvar RUNNING: Enum value for running tasks.
+     *     :vartype RUNNING: str
+     *     :cvar SUCCESS: Enum value for successfully completed tasks.
+     *     :vartype SUCCESS: str
+     *     :cvar STOPPED: Enum value for stopped tasks.
+     *     :vartype STOPPED: str
+     *     :cvar LOST: Enum value for tasks that are lost.
+     *     :vartype LOST: str
+     *     :cvar STALE: Enum value for tasks skipped because Nomad placement
+     *         exceeded the configured staleness threshold.
+     *     :vartype STALE: str
+     * @enum {string}
+     */
+    TaskHistoryStatusEnum:
+      | 'failed'
+      | 'pending'
+      | 'running'
+      | 'success'
+      | 'stopped'
+      | 'lost'
+      | 'stale';
+    /**
+     * TaskResponse
+     * @description Represent a task API response.
+     *
+     *     :param name: The name of the task.
+     *     :param data: The task data stored in JSON format.
+     *     :param backend: The backend used for task execution. Defaults to Nomad.
+     *     :param owner: The owner of the task. Defaults to ``"ANY"``.
+     *     :param is_template: Whether the task is a template. Defaults to False.
+     *     :param protected: Whether the task is protected from deletion. Defaults to False.
+     *     :param alert_on_fail: Whether to trigger an alert on task failure and
+     *         auto-resolve it on subsequent success. Defaults to False.
+     *     :param alert_detail_builder: The ``"module:function"`` path of a plugin
+     *         callable that enriches this task's failure alert, or None.
+     *     :param run_result_recorder: The ``"module:function"`` path of a plugin
+     *         callable that records this task's structured run result at terminal
+     *         status, or None.
+     *     :param output_files_path: The allocation-relative path where output files
+     *         generated by the task are expected, or None.
+     *     :param deleted_at: The deletion timestamp, if applicable.
+     *     :param anonymize_mask: The bitmask representing PII entities to be anonymized in
+     *         logs and files generated by the task. Defaults to 0 (no anonymization).
+     *     :param created_by: The user ID of the user who created the task.
+     *     :param last_updated_by: The user ID of the user who last modified the task.
+     *     :param anonymized_entities: Sorted list of PII entity names derived from
+     *         ``anonymize_mask`` (or from the owner's configured defaults when the
+     *         mask is ``None``). Each name is the raw ``PIIEntity`` member name
+     *         (e.g. ``"EMAIL_ADDRESS"``). Read-only; computed on serialisation.
+     */
+    TaskResponse: {
+      /** Alert Detail Builder */
+      alert_detail_builder?: string | null;
+      /**
+       * Alert On Fail
+       * @default false
+       */
+      alert_on_fail: boolean;
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /**
+       * Anonymized Entities
+       * @description Return sorted PII entity names decoded from ``anonymize_mask``.
+       */
+      readonly anonymized_entities: string[];
+      /** @default nomad */
+      backend: components['schemas']['TaskBackendEnum'];
+      /**
+       * Created At
+       * Format: date-time
+       */
+      created_at?: string;
+      /** Created By */
+      created_by: string | null;
+      /** Data */
+      data: Record<string, never>;
+      /** Deleted At */
+      deleted_at: string | null;
+      /** Id */
+      id: number | null;
+      /**
+       * Is Template
+       * @default false
+       */
+      is_template: boolean;
+      /** Last Updated By */
+      last_updated_by: string | null;
+      /** Name */
+      name: string;
+      /** Output Files Path */
+      output_files_path?: string | null;
+      /**
+       * Owner
+       * @default ANY
+       */
+      owner: string;
+      /**
+       * Protected
+       * @default false
+       */
+      protected: boolean;
+      /** Run Result Recorder */
+      run_result_recorder?: string | null;
+      /** Updated At */
+      updated_at?: string | null;
+    };
+    /**
+     * TaskStats
+     * @description Model for task statistics.
+     *
+     *     :param engine: The backend engine used for task execution. Defaults to "nomad".
+     *     :type engine: str
+     *     :param tasks: A list of task execution histories.
+     *     :type tasks: list[TaskHistory]
+     */
+    TaskStats: {
+      /**
+       * Duration
+       * @description Return the task duration summary.
+       *
+       *     :return: A dictionary summarizing average, last, and total task durations.
+       *     :rtype: dict[str, Any]
+       */
+      readonly duration: Record<string, never>;
+      /**
+       * Engine
+       * @default nomad
+       */
+      engine: string;
+      /**
+       * Last Finished At
+       * @description Return the last finished task timestamp.
+       *
+       *     :return: The timestamp of the last task finished, or None if not available.
+       *     :rtype: str | None
+       */
+      readonly last_finished_at: string | null;
+      /**
+       * Status
+       * @description Return the task status summary.
+       *
+       *     :return: A dictionary summarizing the number of passed and failed tasks.
+       *     :rtype: dict[str, int]
+       */
+      readonly status: Record<string, never>;
+      /**
+       * Total
+       * @description Return the total number of tasks.
+       *
+       *     :return: The total number of tasks.
+       *     :rtype: int
+       */
+      readonly total: number;
+    };
+    /**
+     * TaskWrite
+     * @description Define the model for creating new tasks.
+     *
+     *     :param name: The name of the task.
+     *     :param data: The task data stored in JSON format.
+     *     :param backend: The backend used for task execution. Defaults to Nomad.
+     *     :param owner: The owner of the task. Defaults to ``"ANY"``.
+     *     :param is_template: Whether the task is a template. Defaults to False.
+     *     :param protected: Whether the task is protected from deletion. Defaults to False.
+     *     :param alert_on_fail: Whether to trigger an alert on task failure and
+     *         auto-resolve it on subsequent success. Defaults to False.
+     *     :param alert_detail_builder: The ``"module:function"`` path of a plugin
+     *         callable that enriches this task's failure alert, or None.
+     *     :param run_result_recorder: The ``"module:function"`` path of a plugin
+     *         callable that records this task's structured run result at terminal
+     *         status, or None.
+     *     :param output_files_path: The allocation-relative path where output files
+     *         generated by the task are expected, or None.
+     *     :param anonymize_mask: The bitmask representing PII entities to be anonymized in
+     *         logs and files generated by the task. Defaults to 0 (no anonymization).
+     */
+    TaskWrite: {
+      /** Alert Detail Builder */
+      alert_detail_builder?: string | null;
+      /**
+       * Alert On Fail
+       * @default false
+       */
+      alert_on_fail: boolean;
+      /** Anonymize Mask */
+      anonymize_mask?: number | null;
+      /** @default nomad */
+      backend: components['schemas']['TaskBackendEnum'];
+      /** Data */
+      data: Record<string, never>;
+      /**
+       * Is Template
+       * @default false
+       */
+      is_template: boolean;
+      /** Name */
+      name: string;
+      /** Output Files Path */
+      output_files_path?: string | null;
+      /**
+       * Owner
+       * @default ANY
+       */
+      owner: string;
+      /**
+       * Protected
+       * @default false
+       */
+      protected: boolean;
+      /** Run Result Recorder */
+      run_result_recorder?: string | null;
+    };
+    /**
+     * TransformPayloadRequest
+     * @description Define the request body for the /transform/ API route.
+     *
+     *     :param payload: The job specification payload to be parsed.
+     *     :type payload: str | bytes
+     *     :param fmt: The format of the payload, which can be "hcl", "json", or "yaml".
+     *     :type fmt: Literal["hcl", "json", "yaml"]
+     */
+    TransformPayloadRequest: {
+      /**
+       * Fmt
+       * @enum {string}
+       */
+      fmt: 'hcl' | 'json' | 'yaml';
+      /** Payload */
+      payload: string;
+    };
+    /**
+     * TransformPayloadResponse
+     * @description Define the parsed job specification returned from ``POST /transform/``.
+     *
+     *     The concrete keys depend on the executor backend; clients should treat values as
+     *     untyped JSON except where they validate domain-specific job fields themselves.
+     */
+    TransformPayloadResponse: {
+      [key: string]: unknown;
+    };
+    /** ValidationError */
+    ValidationError: {
+      /** Context */
+      ctx?: Record<string, never>;
+      /** Input */
+      input?: unknown;
+      /** Location */
+      loc: (string | number)[];
+      /** Message */
+      msg: string;
+      /** Error Type */
+      type: string;
+    };
+  };
+  responses: never;
+  parameters: never;
+  requestBodies: never;
+  headers: never;
+  pathItems: never;
+}
+export type $defs = Record<string, never>;
+export interface operations {
+  tasks_list_tasks__get: {
+    parameters: {
+      query?: {
+        owner?: string | null;
+        target?: string | null;
+        parent_is_null?: boolean | null;
+        backup_type?: string | null;
+        self_parent?: boolean | null;
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PaginatedResponse_TaskResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_create_task__post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['TaskWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['TaskResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  settings_list_settings_admin_settings__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['SettingsListResponse'];
+        };
+      };
+    };
+  };
+  settings_patch_settings_admin_settings__setting_class__patch: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        setting_class: components['schemas']['SettingClassEnum'];
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['SettingsPatch'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['SettingResponse'][];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  settings_get_setting_admin_settings__setting_class___key__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        setting_class: components['schemas']['SettingClassEnum'];
+        key: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['SettingResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  settings_delete_setting_admin_settings__setting_class___key__delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        setting_class: components['schemas']['SettingClassEnum'];
+        key: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  connectivity_connectivity_check_connectivity_check__post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['ConnectivityCheckWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['ConnectivityCheckResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_execute_task_name_execute__task_name__post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: {
+      content: {
+        'application/json': components['schemas']['TaskExecuteRequest'] | null;
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['TaskHistoryResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_list_task_history_history__get: {
+    parameters: {
+      query?: {
+        status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+        exclude_internal?: boolean;
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PaginatedResponse_TaskHistoryResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_create_task_history_history__post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['TaskHistory'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['TaskHistoryResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_latest_task_history_history_latest_post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['TaskHistoryLatestStatusRequest'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': {
+            [key: string]:
+              | components['schemas']['TaskHistoryLatestStatus']
+              | null;
+          };
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_retrieve_task_history_history__task_history_id__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_history_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['TaskHistoryResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_list_task_history_events_history__task_history_id__events_get: {
+    parameters: {
+      query?: {
+        backend?: components['schemas']['TaskBackendEnum'];
+      };
+      header?: never;
+      path: {
+        task_history_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['ExecutionEvent'][];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_stream_task_history_file_history__task_history_id__file__get: {
+    parameters: {
+      query: {
+        path: string;
+        backend?: components['schemas']['TaskBackendEnum'];
+      };
+      header?: never;
+      path: {
+        task_history_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': unknown;
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_list_task_history_files_history__task_history_id__files__get: {
+    parameters: {
+      query?: {
+        backend?: components['schemas']['TaskBackendEnum'];
+      };
+      header?: never;
+      path: {
+        task_history_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': {
+            [key: string]: components['schemas']['FileMetadata'];
+          };
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_stream_task_history_logs_history__task_history_id__logs__get: {
+    parameters: {
+      query?: {
+        step?: string | null;
+        tail?: number | null;
+        backend?: components['schemas']['TaskBackendEnum'];
+      };
+      header?: never;
+      path: {
+        task_history_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': unknown;
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_stop_task_history_history__task_history_id__stop__post: {
+    parameters: {
+      query?: {
+        backend?: components['schemas']['TaskBackendEnum'];
+      };
+      header?: never;
+      path: {
+        task_history_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['TaskHistoryResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_sync_task_history_history__task_history_id__sync__post: {
+    parameters: {
+      query?: {
+        backend?: components['schemas']['TaskBackendEnum'];
+      };
+      header?: never;
+      path: {
+        task_history_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['TaskHistoryResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_get_executor_hosts_hosts__get: {
+    parameters: {
+      query?: {
+        backend?: components['schemas']['TaskBackendEnum'];
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': {
+            [key: string]: string;
+          };
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  periodic_list_periodic_tasks_periodic__get: {
+    parameters: {
+      query?: {
+        owner?: string | null;
+        enabled?: boolean | null;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PeriodicTaskResponse'][];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  periodic_retrieve_periodic_task_periodic__periodic_task_id__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        periodic_task_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PeriodicTaskResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  periodic_update_periodic_task_periodic__periodic_task_id__put: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        periodic_task_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['PeriodicTaskUpdate'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PeriodicTaskResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  periodic_delete_periodic_task_periodic__periodic_task_id__delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        periodic_task_id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_get_task_stats_stats__task__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['TaskStats'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_transform_payload_transform__post: {
+    parameters: {
+      query?: {
+        backend?: components['schemas']['TaskBackendEnum'];
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['TransformPayloadRequest'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['TransformPayloadResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_get_task__task_name__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['TaskResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_update_task__task_name__put: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['TaskWrite'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['TaskResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_delete_task__task_name__delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['TaskResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_list_periodic_tasks_by_task_name__task_name__periodic__get: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PeriodicTaskResponse'][];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_create_periodic_task_for_task_name__task_name__periodic__post: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        task_name: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['PeriodicTaskCreate'];
+      };
+    };
+    responses: {
+      /** @description Successful Response */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PeriodicTaskResponse'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+  tasks_get_task_history__task__history__get: {
+    parameters: {
+      query?: {
+        status?: components['schemas']['TaskHistoryStatusEnum'] | null;
+        snippet_filename?: string | null;
+        offset?: number;
+        limit?: number;
+      };
+      header?: never;
+      path: {
+        task: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Successful Response */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PaginatedResponse_TaskHistoryResponse_'];
+        };
+      };
+      /** @description Validation Error */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['HTTPValidationError'];
+        };
+      };
+    };
+  };
+}
diff --git a/ui/packages/sep/api/src/hooks/index.ts b/ui/packages/sep/api/src/hooks/index.ts
new file mode 100644
index 00000000000..c2f2141ac6a
--- /dev/null
+++ b/ui/packages/sep/api/src/hooks/index.ts
@@ -0,0 +1,87 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { useCurrentUser } from './useCurrentUser';
+export { usePluginSchema } from './usePluginSchema';
+export {
+  usePluginTasks,
+  usePluginTask,
+  useCreatePluginTask,
+  useUpdatePluginTask,
+  usePluginEntityList,
+  usePluginEntityDetail,
+  useCreatePluginEntity,
+  useUpdatePluginEntity,
+  useDeletePluginEntity,
+  useDeletePluginTask,
+  normalizePluginListResponse,
+  DEFAULT_PLUGIN_LIST_OFFSET,
+  DEFAULT_PLUGIN_LIST_LIMIT,
+  RUNNING_STATUSES,
+  isRunningStatus,
+} from './usePluginTasks';
+export type {
+  PluginListPagination,
+  PluginListQueryOptions,
+  PluginListResult,
+  PaginatedPluginList,
+  TaskHistoryStatus,
+} from './usePluginTasks';
+export { useAlertConfig, ALERT_CONFIG_QUERY_KEY } from './useAlertConfig';
+export type { AlertConfig } from './useAlertConfig';
+export { useDashboardStats } from './useDashboardStats';
+export type { DashboardStats } from './useDashboardStats';
+export {
+  useSettingsList,
+  usePatchSetting,
+  useResetSetting,
+  settingErrorMessage,
+  SETTINGS_QUERY_KEY,
+  REDACTED_SECRET,
+} from './useSettings';
+export type {
+  SettingClass,
+  ReloadClassification,
+  SettingResponse,
+  SettingClassGroup,
+  SettingsListResponse,
+  SettingsPatch,
+  PatchSettingVars,
+  ResetSettingVars,
+} from './useSettings';
+export { useEnabledApps, ENABLED_APPS_QUERY_KEY } from './useEnabledApps';
+export type { EnabledApp } from './useEnabledApps';
+export {
+  useAdminApps,
+  useSetAppState,
+  useForceDisableApp,
+  isTransitional,
+  appStateErrorMessage,
+  ADMIN_APPS_QUERY_KEY,
+  ADMIN_APP_MUTATION_KEY,
+} from './useAdminApps';
+export type {
+  AdminApp,
+  AppStateResult,
+  AppLifecycleState,
+  TransitionalState,
+  SetAppStateVars,
+  ForceDisableAppVars,
+} from './useAdminApps';
+export { useConfigExport } from './useConfigExport';
+export { useAppInfo, APP_INFO_QUERY_KEY } from './useAppInfo';
+export type { AppInfo } from './useAppInfo';
diff --git a/ui/packages/sep/api/src/hooks/useAdminApps.ts b/ui/packages/sep/api/src/hooks/useAdminApps.ts
new file mode 100644
index 00000000000..5247d744b88
--- /dev/null
+++ b/ui/packages/sep/api/src/hooks/useAdminApps.ts
@@ -0,0 +1,228 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/**
+ * React Query hooks for the runtime app enable/disable admin API (SEP-982).
+ *
+ * The admin listing (`GET /api/admin/apps/`) and the public navigation listing
+ * (`GET /api/apps/`, see {@link useEnabledApps}) are distinct queries with
+ * different shapes, so both are invalidated on a successful transition to keep
+ * the management page, the sidebar, and the disabled-app route guard consistent.
+ *
+ * Types here are hand-written (no OpenAPI codegen) to mirror the sibling
+ * `useEnabledApps` hook; keep them in sync with the backend `AppInfoResponse` /
+ * `AppStateResponse` models if those evolve.
+ */
+import {
+  keepPreviousData,
+  useMutation,
+  useQuery,
+  useQueryClient,
+  type QueryClient,
+} from '@tanstack/react-query';
+
+import { apiClient } from '../client';
+import type { ApiError } from '../errors';
+import { ENABLED_APPS_QUERY_KEY } from './useEnabledApps';
+
+/** The four-state app lifecycle. `ENABLING`/`DISABLING` are transitional. */
+export type AppLifecycleState =
+  | 'ENABLED'
+  | 'DISABLED'
+  | 'ENABLING'
+  | 'DISABLING';
+
+/** The transitional states a toggle may request; the backend rejects the
+ *  terminal `ENABLED`/`DISABLED` edges with 409. */
+export type TransitionalState = Extract<
+  AppLifecycleState,
+  'ENABLING' | 'DISABLING'
+>;
+
+/** Per-app entry returned by the admin `GET /api/admin/apps/` endpoint. */
+export interface AdminApp {
+  app_key: string;
+  name: string;
+  enabled: boolean;
+  lifecycle_state: AppLifecycleState;
+  toggleable: boolean;
+  uri_path: string;
+  css_class: string;
+  sidebar: boolean;
+  has_api_router: boolean;
+}
+
+/** Result of a state transition (`PUT .../state`, `POST .../force-disable`). */
+export interface AppStateResult {
+  app_key: string;
+  enabled: boolean;
+  lifecycle_state: AppLifecycleState;
+}
+
+export const ADMIN_APPS_QUERY_KEY = ['admin', 'apps'] as const;
+
+/**
+ * Shared `mutationKey` for every app-transition mutation. Lets the management
+ * page scope its `useMutationState` row-lock lookup to these mutations alone,
+ * rather than any pending mutation that happens to carry an `appKey` variable.
+ */
+export const ADMIN_APP_MUTATION_KEY = ['admin', 'apps', 'transition'] as const;
+
+/** Base path (relative to the axios client's `/api` baseURL). */
+const ADMIN_APPS_BASE = '/admin/apps';
+
+/** Poll cadence used while any app is mid-transition. */
+const TRANSITION_POLL_MS = 3000;
+
+/** True while an app sits in a transitional (in-progress) lifecycle state. */
+export function isTransitional(state: AppLifecycleState): boolean {
+  return state === 'ENABLING' || state === 'DISABLING';
+}
+
+/**
+ * Fetch every configured app with its lifecycle state for the management page.
+ *
+ * While any app is transitional the query polls every {@link TRANSITION_POLL_MS}
+ * so a cooperative drain that completes server-side is reflected without a
+ * manual reload; polling stops once every app has settled into a terminal
+ * state. Pass `enabled: false` to skip fetching entirely (e.g. non-admins).
+ */
+export function useAdminApps(options: { enabled?: boolean } = {}) {
+  return useQuery<AdminApp[], ApiError>({
+    queryKey: ADMIN_APPS_QUERY_KEY,
+    enabled: options.enabled ?? true,
+    queryFn: async () => {
+      const { data } = await apiClient.get<AdminApp[]>(`${ADMIN_APPS_BASE}/`);
+      return data;
+    },
+    // Keep the last good listing if a single poll errors mid-drain, so the
+    // refetchInterval keeps evaluating and the page does not freeze.
+    placeholderData: keepPreviousData,
+    refetchInterval: (query) => {
+      const apps = query.state.data;
+      return apps?.some((app) => isTransitional(app.lifecycle_state))
+        ? TRANSITION_POLL_MS
+        : false;
+    },
+  });
+}
+
+/**
+ * Apply a transition result to the cached admin listing immediately, then
+ * invalidate both apps queries so the management page reflects the new state
+ * without waiting for the next poll, and the sidebar / route guard re-filter.
+ */
+function applyTransition(
+  queryClient: QueryClient,
+  result: AppStateResult
+): void {
+  queryClient.setQueryData<AdminApp[]>(ADMIN_APPS_QUERY_KEY, (apps) =>
+    apps?.map((app) =>
+      app.app_key === result.app_key
+        ? {
+            ...app,
+            enabled: result.enabled,
+            lifecycle_state: result.lifecycle_state,
+          }
+        : app
+    )
+  );
+  queryClient.invalidateQueries({ queryKey: ADMIN_APPS_QUERY_KEY });
+  queryClient.invalidateQueries({ queryKey: ENABLED_APPS_QUERY_KEY });
+}
+
+export interface SetAppStateVars {
+  appKey: string;
+  /** Must be a transitional state; the backend rejects terminal edges with 409. */
+  lifecycleState: TransitionalState;
+}
+
+/**
+ * Initiate a lifecycle transition via `PUT /api/admin/apps/{app_key}/state`.
+ *
+ * Enabling a disabled app sends `ENABLING`; disabling an enabled app sends
+ * `DISABLING`. On success both the admin and public apps queries are
+ * invalidated. The rejected {@link ApiError} carries the backend `detail` for
+ * 404 (unknown key) / 409 (illegal transition or protected app).
+ */
+export function useSetAppState() {
+  const queryClient = useQueryClient();
+  return useMutation<AppStateResult, ApiError, SetAppStateVars>({
+    mutationKey: ADMIN_APP_MUTATION_KEY,
+    mutationFn: async ({ appKey, lifecycleState }) => {
+      const { data } = await apiClient.put<AppStateResult>(
+        `${ADMIN_APPS_BASE}/${encodeURIComponent(appKey)}/state`,
+        { lifecycle_state: lifecycleState }
+      );
+      return data;
+    },
+    onSuccess: (result) => applyTransition(queryClient, result),
+  });
+}
+
+export interface ForceDisableAppVars {
+  appKey: string;
+}
+
+/**
+ * Force-finalise a stuck drain via `POST /api/admin/apps/{app_key}/force-disable`.
+ *
+ * Only valid while the app is `DISABLING`; the backend returns 409 otherwise.
+ * Invalidates both apps queries on success.
+ */
+export function useForceDisableApp() {
+  const queryClient = useQueryClient();
+  return useMutation<AppStateResult, ApiError, ForceDisableAppVars>({
+    mutationKey: ADMIN_APP_MUTATION_KEY,
+    mutationFn: async ({ appKey }) => {
+      const { data } = await apiClient.post<AppStateResult>(
+        `${ADMIN_APPS_BASE}/${encodeURIComponent(appKey)}/force-disable`
+      );
+      return data;
+    },
+    onSuccess: (result) => applyTransition(queryClient, result),
+  });
+}
+
+/**
+ * Map an {@link ApiError} from the admin apps endpoints to a readable message.
+ *
+ * 404/409 responses carry a `{ detail }` body which is preferred verbatim; 401
+ * indicates a missing bearer token on a mutation (CSRF defense). Returns `null`
+ * for no error so callers can use it directly as a render guard.
+ */
+export function appStateErrorMessage(
+  error: ApiError | null | undefined
+): string | null {
+  if (!error) {
+    return null;
+  }
+  const detail = (error.data as { detail?: unknown } | undefined)?.detail;
+  const detailText = typeof detail === 'string' ? detail : null;
+  switch (error.status) {
+    case 401:
+      return 'Your session is missing credentials for this action. Try signing in again.';
+    case 403:
+      return detailText ?? 'You need administrator access to manage apps.';
+    case 404:
+      return detailText ?? 'That app no longer exists.';
+    case 409:
+      return detailText ?? 'That state change is not allowed right now.';
+    default:
+      return detailText ?? error.message ?? 'Something went wrong.';
+  }
+}
diff --git a/ui/packages/sep/api/src/hooks/useAlertConfig.ts b/ui/packages/sep/api/src/hooks/useAlertConfig.ts
new file mode 100644
index 00000000000..4f3d60c4483
--- /dev/null
+++ b/ui/packages/sep/api/src/hooks/useAlertConfig.ts
@@ -0,0 +1,44 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useQuery } from '@tanstack/react-query';
+import { apiClient } from '../client';
+
+/** Shape returned by `GET /api/config/alerts`. */
+export interface AlertConfig {
+  available: boolean;
+}
+
+export const ALERT_CONFIG_QUERY_KEY = ['config', 'alerts'] as const;
+
+/**
+ * Fetches whether at least one alert provider is configured on the backend
+ * (`bool(alert_settings.PROVIDERS)`). Used by `<AlertOnFailField>` to decide
+ * if the *Alert on failure* checkbox should be enabled.
+ *
+ * The result rarely changes within a session, so it's cached for 5 minutes.
+ */
+export function useAlertConfig() {
+  return useQuery<AlertConfig>({
+    queryKey: ALERT_CONFIG_QUERY_KEY,
+    queryFn: async () => {
+      const { data } = await apiClient.get<AlertConfig>('/config/alerts');
+      return data;
+    },
+    staleTime: 5 * 60 * 1000,
+  });
+}
diff --git a/ui/packages/sep/api/src/hooks/useAppInfo.ts b/ui/packages/sep/api/src/hooks/useAppInfo.ts
new file mode 100644
index 00000000000..08fe0fc29b6
--- /dev/null
+++ b/ui/packages/sep/api/src/hooks/useAppInfo.ts
@@ -0,0 +1,45 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useQuery } from '@tanstack/react-query';
+import { apiClient } from '../client';
+
+/** Shape returned by `GET /api/sep/app-info`. */
+export interface AppInfo {
+  /** Rendered sidebar footer text (application summary and version by default). */
+  footer_text: string;
+}
+
+export const APP_INFO_QUERY_KEY = ['sep', 'app-info'] as const;
+
+/**
+ * Fetches shell metadata for the sidebar footer (`footer_text`), mirroring the
+ * value the legacy Jinja interface renders from `SEP__FOOTER_TEMPLATE`.
+ *
+ * The footer reflects a deployment-specific override but changes rarely within
+ * a session, so the result is cached for 5 minutes.
+ */
+export function useAppInfo() {
+  return useQuery<AppInfo>({
+    queryKey: APP_INFO_QUERY_KEY,
+    queryFn: async () => {
+      const { data } = await apiClient.get<AppInfo>('/sep/app-info/');
+      return data;
+    },
+    staleTime: 5 * 60 * 1000,
+  });
+}
diff --git a/ui/packages/sep/api/src/hooks/useConfigExport.ts b/ui/packages/sep/api/src/hooks/useConfigExport.ts
new file mode 100644
index 00000000000..1c9c764e810
--- /dev/null
+++ b/ui/packages/sep/api/src/hooks/useConfigExport.ts
@@ -0,0 +1,74 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/**
+ * React Query hook for the admin config YAML export (SEP-984).
+ *
+ * Fetches ``GET /api/sep/admin/settings/export`` through ``apiClient`` so the
+ * Bearer interceptor attaches the in-memory access token, then triggers a
+ * browser download from the response blob and server-provided filename.
+ */
+import { useMutation } from '@tanstack/react-query';
+
+import { apiClient } from '../client';
+import type { ApiError } from '../errors';
+
+const CONFIG_EXPORT_PATH = '/sep/admin/settings/export';
+const DEFAULT_FILENAME = 'sep-config.yaml';
+
+function filenameFromContentDisposition(
+  header: string | undefined
+): string | null {
+  const match = /filename="([^"]+)"/.exec(header ?? '');
+  return match?.[1] ?? null;
+}
+
+/** Trigger a browser download for an in-memory blob (mirrors ``@sep/framework``). */
+function triggerBlobDownload(data: Blob, filename: string): void {
+  const url = URL.createObjectURL(data);
+  const anchor = document.createElement('a');
+  anchor.href = url;
+  anchor.download = filename;
+  anchor.style.display = 'none';
+  document.body.appendChild(anchor);
+  try {
+    anchor.click();
+  } finally {
+    anchor.remove();
+    setTimeout(() => URL.revokeObjectURL(url), 0);
+  }
+}
+
+/**
+ * Download the merged effective configuration as YAML.
+ *
+ * Admin-only on the backend; callers should gate the trigger button on
+ * ``useAuth().isAdmin``.
+ */
+export function useConfigExport() {
+  return useMutation<void, ApiError, void>({
+    mutationFn: async () => {
+      const response = await apiClient.get<Blob>(CONFIG_EXPORT_PATH, {
+        responseType: 'blob',
+      });
+      const header = response.headers['content-disposition'];
+      const filename =
+        filenameFromContentDisposition(header) ?? DEFAULT_FILENAME;
+      triggerBlobDownload(response.data, filename);
+    },
+  });
+}
diff --git a/ui/packages/sep/api/src/hooks/useCurrentUser.ts b/ui/packages/sep/api/src/hooks/useCurrentUser.ts
new file mode 100644
index 00000000000..50ee953ae22
--- /dev/null
+++ b/ui/packages/sep/api/src/hooks/useCurrentUser.ts
@@ -0,0 +1,37 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useQuery } from '@tanstack/react-query';
+import type { ApiError } from '../errors';
+import type { components } from '../generated/main';
+import { mainApi, throwOnApiError } from '../typed-client';
+
+/**
+ * Sample typed hook demonstrating the full codegen → openapi-fetch → React Query
+ * pattern. `data` is typed as `CasdoorUser` directly from the generated spec;
+ * `error` is an `ApiError` (thanks to `throwOnApiError`).
+ *
+ * Reference for new hooks: copy this structure when wrapping typed endpoints.
+ */
+type CurrentUser = components['schemas']['CasdoorUser'];
+
+export function useCurrentUser() {
+  return useQuery<CurrentUser, ApiError>({
+    queryKey: ['users', 'me'],
+    queryFn: () => throwOnApiError(mainApi.GET('/api/users/me')),
+  });
+}
diff --git a/ui/packages/sep/api/src/hooks/useDashboardStats.ts b/ui/packages/sep/api/src/hooks/useDashboardStats.ts
new file mode 100644
index 00000000000..3d62619796f
--- /dev/null
+++ b/ui/packages/sep/api/src/hooks/useDashboardStats.ts
@@ -0,0 +1,48 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useQuery } from '@tanstack/react-query';
+import { apiClient } from '../client';
+
+interface DashboardStatsRaw {
+  nodes: number;
+  tasks: number;
+  snippets: number;
+  targets: number;
+}
+
+export interface DashboardStats extends DashboardStatsRaw {
+  /** Source names that failed and returned 0. Mirrors ``X-Sep-Upstream-Error``. */
+  degraded?: string[];
+}
+
+export function useDashboardStats() {
+  return useQuery<DashboardStats>({
+    queryKey: ['sep', 'dashboard', 'stats'],
+    queryFn: async () => {
+      const response =
+        await apiClient.get<DashboardStatsRaw>('/sep/dashboard/');
+      const errorHeader = response.headers['x-sep-upstream-error'] as
+        | string
+        | undefined;
+      return {
+        ...response.data,
+        degraded: errorHeader ? errorHeader.split(',') : undefined,
+      };
+    },
+  });
+}
diff --git a/ui/packages/sep/api/src/hooks/useEnabledApps.ts b/ui/packages/sep/api/src/hooks/useEnabledApps.ts
new file mode 100644
index 00000000000..e4d9089d548
--- /dev/null
+++ b/ui/packages/sep/api/src/hooks/useEnabledApps.ts
@@ -0,0 +1,53 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useQuery } from '@tanstack/react-query';
+import { apiClient } from '../client';
+
+/** Per-app entry returned by the public ``GET /api/apps/`` endpoint. */
+export interface EnabledApp {
+  app_key: string;
+  enabled: boolean;
+  sidebar: boolean;
+  uri_path: string;
+  display_name: string;
+  custom_ui: boolean;
+  /** Nav group key this app nests under; ``null`` renders it top-level. */
+  group: string | null;
+  /** Sort position within the sidebar; ``null`` sorts last. */
+  nav_order: number | null;
+}
+
+export const ENABLED_APPS_QUERY_KEY = ['apps'] as const;
+
+/**
+ * Fetches per-app navigation metadata for the current user.
+ *
+ * Powers registry-driven sidebar labels (``display_name``), visibility
+ * (``enabled``, ``sidebar``), and routing hints. Cached for 30s — admins
+ * toggle apps infrequently and brief staleness is acceptable for navigation.
+ */
+export function useEnabledApps() {
+  return useQuery<EnabledApp[]>({
+    queryKey: ENABLED_APPS_QUERY_KEY,
+    queryFn: async () => {
+      const { data } = await apiClient.get<EnabledApp[]>('/apps/');
+      return data;
+    },
+    staleTime: 30_000,
+  });
+}
diff --git a/ui/packages/sep/api/src/hooks/usePluginSchema.ts b/ui/packages/sep/api/src/hooks/usePluginSchema.ts
new file mode 100644
index 00000000000..4be6f72d13d
--- /dev/null
+++ b/ui/packages/sep/api/src/hooks/usePluginSchema.ts
@@ -0,0 +1,52 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useQuery } from '@tanstack/react-query';
+import { apiClient } from '../client';
+import { ApiError } from '../errors';
+import type { PluginSchema } from '../types/plugin-schema';
+
+/**
+ * Fetches a plugin's schema from the backend.
+ *
+ * Accepts an optional `mockSchema` fallback for development when the
+ * backend doesn't yet serve schemas. When the real API is available,
+ * it takes precedence over the mock.
+ */
+export function usePluginSchema(pluginName: string, mockSchema?: PluginSchema) {
+  return useQuery<PluginSchema>({
+    queryKey: ['plugins', pluginName, 'schema'],
+    queryFn: async () => {
+      try {
+        const { data } = await apiClient.get<PluginSchema>(
+          `/apps/${pluginName}/schema`
+        );
+        return data;
+      } catch (error) {
+        // Fall back to mock schema on 404 (not yet served) or network error
+        if (mockSchema && error instanceof ApiError) {
+          if (error.status === 404 || error.kind === 'network') {
+            return mockSchema;
+          }
+        }
+        throw error;
+      }
+    },
+    ...(mockSchema && { placeholderData: mockSchema }),
+    staleTime: 5 * 60 * 1000, // schemas rarely change
+  });
+}
diff --git a/ui/packages/sep/api/src/hooks/usePluginTasks.ts b/ui/packages/sep/api/src/hooks/usePluginTasks.ts
new file mode 100644
index 00000000000..cf8eb6a9426
--- /dev/null
+++ b/ui/packages/sep/api/src/hooks/usePluginTasks.ts
@@ -0,0 +1,700 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/// <reference path="../vite-env.d.ts" />
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { apiClient } from '../client';
+import { ApiError } from '../errors';
+import type { components as TasksComponents } from '../generated/tasks';
+
+export type TaskHistoryStatus =
+  TasksComponents['schemas']['TaskHistoryStatusEnum'];
+
+/**
+ * Task-history statuses that count as "still executing".
+ *
+ * Canonical source of truth for the poll-while-running convention. It lives in
+ * the ``api`` package because ``api`` is the lowest layer — ``framework`` and
+ * the apps depend on it, never the other way round — so both the list-page
+ * poll predicate here and the framework's ``useTaskHistory`` reuse the same
+ * set instead of drifting apart. ``framework`` re-exports these for callers
+ * that import from ``@sep/framework``.
+ */
+export const RUNNING_STATUSES: ReadonlySet<TaskHistoryStatus> = new Set([
+  'running',
+  'pending',
+]);
+
+export function isRunningStatus(status: TaskHistoryStatus): boolean {
+  return RUNNING_STATUSES.has(status);
+}
+
+/** Default poll cadence (ms) while a running task is visible; mirrors ``useTaskHistory``. */
+const DEFAULT_TASK_POLLING_INTERVAL_MS = 5000;
+
+// Mock-fallback gate. Active in dev builds (`pnpm dev`) and in production
+// builds explicitly opted-in via `VITE_MOCK_API=true` (e.g. the Playwright
+// preview target). Vite statically replaces both expressions at build time,
+// so the fallback branches are dead-code-eliminated in real production.
+const MOCK_FALLBACKS_ENABLED =
+  import.meta.env.DEV || import.meta.env.VITE_MOCK_API === 'true';
+
+/**
+ * Predicate used by the mock-fallback gate: returns ``true`` only when the
+ * failure looks like the backend is unreachable, never for deterministic 4xx
+ * responses. Exported for tests; not part of the public hook surface.
+ *
+ * 502 is intentionally treated as "backend unavailable" here even though
+ * ``sepRetry`` short-circuits on it — the two predicates serve different
+ * goals: ``sepRetry`` wants to stop hammering a known-bad gateway, while this
+ * gate decides whether to substitute mock data in dev builds. A 502 from
+ * ``/api/sep/*`` means the upstream Tasks-API is unreachable, which is
+ * exactly the dev-without-backend scenario the mock fallback targets.
+ */
+export function isBackendUnavailable(error: unknown): boolean {
+  if (error instanceof ApiError) {
+    return (
+      error.kind === 'network' ||
+      (error.kind === 'http' && (error.status ?? 0) >= 500)
+    );
+  }
+  return false;
+}
+
+export type PaginatedPluginList<T> = {
+  items: T[];
+  total: number;
+  offset: number;
+  limit: number;
+};
+
+export type PluginListPagination = {
+  total: number;
+  offset: number;
+  limit: number;
+};
+
+export type PluginListResult<T> = {
+  items: T[];
+  /** ``null`` when the backend returned a bare array (``NO_PAGINATION``). */
+  pagination: PluginListPagination | null;
+  /**
+   * Set when ``fetchAllPages`` stopped at the page cap before reaching
+   * ``total``. Absent (or false) when the fetch completed or was not used.
+   */
+  truncated?: boolean;
+};
+
+function isPaginatedPluginListEnvelope<T>(
+  data: unknown
+): data is PaginatedPluginList<T> {
+  if (!data || typeof data !== 'object' || Array.isArray(data)) {
+    return false;
+  }
+  const candidate = data as PaginatedPluginList<T>;
+  return (
+    Array.isArray(candidate.items) &&
+    typeof candidate.total === 'number' &&
+    typeof candidate.offset === 'number' &&
+    typeof candidate.limit === 'number'
+  );
+}
+
+/**
+ * Normalize a plugin list response to items plus optional pagination metadata.
+ *
+ * Bare arrays (``NO_PAGINATION``) yield ``pagination: null``; full
+ * ``{ items, total, offset, limit }`` envelopes preserve all four fields.
+ * Partial ``{ items }`` envelopes (legacy migration shape) unwrap items only.
+ */
+export function normalizePluginListResponse<T>(
+  data: T[] | PaginatedPluginList<T> | { items: T[] | null } | null | undefined
+): PluginListResult<T> {
+  if (Array.isArray(data)) {
+    return { items: data, pagination: null };
+  }
+  if (isPaginatedPluginListEnvelope<T>(data)) {
+    return {
+      items: data.items,
+      pagination: {
+        total: data.total,
+        offset: data.offset,
+        limit: data.limit,
+      },
+    };
+  }
+  if (data && typeof data === 'object' && 'items' in data) {
+    const items = (data as { items: T[] | null }).items;
+    return { items: items ?? [], pagination: null };
+  }
+  return { items: [], pagination: null };
+}
+
+export const DEFAULT_PLUGIN_LIST_OFFSET = 0;
+/**
+ * Default page size for plugin list requests. Keep list UI page-size options at
+ * this value: some plugins (``DEFAULT_PAGINATION_LIMIT``) reject ``limit`` > 50
+ * with HTTP 422.
+ */
+export const DEFAULT_PLUGIN_LIST_LIMIT = 50;
+
+/** Soft cap on pages walked by ``fetchAllPages`` (~2500 rows at the default limit). */
+export const MAX_FETCH_ALL_PAGES = 50;
+
+export type PluginListQueryOptions = {
+  enabled?: boolean;
+  offset?: number;
+  limit?: number;
+  /**
+   * Walk paginated list pages for schedule joins (e.g. SchemaListView schedule
+   * columns). Caps at ``MAX_FETCH_ALL_PAGES`` × ``DEFAULT_PLUGIN_LIST_LIMIT``
+   * (2500 items); if ``total`` is larger the result sets ``truncated: true``
+   * and logs a warning. Issues up to that many sequential GETs.
+   */
+  fetchAllPages?: boolean;
+  /** Disable poll-while-running (stories, tests). */
+  disablePolling?: boolean;
+  /** Override poll cadence (ms) while a running task is visible. */
+  pollingIntervalMs?: number;
+};
+
+function mockItemsToResult<T>(mockItems: T[]): PluginListResult<T> {
+  return { items: mockItems, pagination: null };
+}
+
+function tasksQueryKey(
+  pluginName: string,
+  options: Pick<PluginListQueryOptions, 'offset' | 'limit' | 'fetchAllPages'>
+) {
+  return [
+    'plugins',
+    pluginName,
+    'tasks',
+    {
+      offset: options.offset ?? DEFAULT_PLUGIN_LIST_OFFSET,
+      limit: options.limit ?? DEFAULT_PLUGIN_LIST_LIMIT,
+      fetchAllPages: options.fetchAllPages ?? false,
+    },
+  ] as const;
+}
+
+/**
+ * Plugin list endpoint shape during the multi-plugin migration:
+ * - Legacy plugins return `T[]` directly.
+ * - Migrated plugins (e.g. mysql_backups) return `PaginatedResponse<T>`.
+ */
+type PluginListResponse<T> =
+  | T[]
+  | PaginatedPluginList<T>
+  | { items: T[] | null };
+
+async function fetchAllPluginListPages<T extends Record<string, unknown>>(
+  path: string
+): Promise<PluginListResult<T>> {
+  const out: T[] = [];
+  let offset = 0;
+  let lastTotal: number | null = null;
+  const limit = DEFAULT_PLUGIN_LIST_LIMIT;
+
+  for (let iter = 0; iter < MAX_FETCH_ALL_PAGES; iter++) {
+    const { data } = await apiClient.get<PluginListResponse<T>>(path, {
+      params: { offset, limit },
+    });
+    const page = normalizePluginListResponse(data);
+
+    if (page.pagination === null) {
+      return { items: page.items, pagination: null };
+    }
+
+    lastTotal = page.pagination.total;
+    out.push(...page.items);
+    offset += page.items.length;
+    if (offset >= page.pagination.total || page.items.length === 0) {
+      return { items: out, pagination: null };
+    }
+  }
+
+  // eslint-disable-next-line no-console -- surface silent schedule-join truncation
+  console.warn(
+    `[api] fetchAllPages truncated ${path} at ${out.length} of ${lastTotal ?? '?'} items ` +
+      `(cap ${MAX_FETCH_ALL_PAGES}×${limit})`
+  );
+  return { items: out, pagination: null, truncated: true };
+}
+
+async function fetchPluginList<T extends Record<string, unknown>>(
+  path: string,
+  options: Pick<
+    PluginListQueryOptions,
+    'offset' | 'limit' | 'fetchAllPages'
+  > = {}
+): Promise<PluginListResult<T>> {
+  if (options.fetchAllPages) {
+    return fetchAllPluginListPages<T>(path);
+  }
+  const offset = options.offset ?? DEFAULT_PLUGIN_LIST_OFFSET;
+  const limit = options.limit ?? DEFAULT_PLUGIN_LIST_LIMIT;
+  const { data } = await apiClient.get<PluginListResponse<T>>(path, {
+    params: { offset, limit },
+  });
+  return normalizePluginListResponse(data);
+}
+
+/** Fetch plugin task list rows, optionally across all pages. */
+export async function fetchPluginTasksList<T extends Record<string, unknown>>(
+  pluginName: string,
+  options: Pick<
+    PluginListQueryOptions,
+    'offset' | 'limit' | 'fetchAllPages'
+  > = {}
+): Promise<PluginListResult<T>> {
+  return fetchPluginList<T>(`/apps/${pluginName}/`, options);
+}
+
+/** Fetch rows for one entity of a multi-entity plugin, optionally across all pages. */
+export async function fetchPluginEntityList<T extends Record<string, unknown>>(
+  pluginName: string,
+  entityName: string,
+  options: Pick<
+    PluginListQueryOptions,
+    'offset' | 'limit' | 'fetchAllPages'
+  > = {}
+): Promise<PluginListResult<T>> {
+  return fetchPluginList<T>(`/apps/${pluginName}/${entityName}/`, options);
+}
+
+/**
+ * Poll while any fetched row is still running; otherwise stay idle.
+ *
+ * Exported for tests; not part of the public hook surface.
+ */
+export function taskListRefetchInterval<T extends Record<string, unknown>>(
+  data: T[] | undefined,
+  pollingMs: number,
+  disabled: boolean
+): number | false {
+  if (disabled || !data) {
+    return false;
+  }
+  const hasRunning = data.some((row) =>
+    RUNNING_STATUSES.has(row.status as TaskHistoryStatus)
+  );
+  return hasRunning ? pollingMs : false;
+}
+
+export function usePluginTasks<T extends Record<string, unknown>>(
+  pluginName: string,
+  mockTasks?: T[],
+  options?: PluginListQueryOptions
+) {
+  const offset = options?.offset ?? DEFAULT_PLUGIN_LIST_OFFSET;
+  const limit = options?.limit ?? DEFAULT_PLUGIN_LIST_LIMIT;
+  const fetchAllPages = options?.fetchAllPages ?? false;
+  const disablePolling = options?.disablePolling ?? false;
+  const pollingIntervalMs =
+    options?.pollingIntervalMs ?? DEFAULT_TASK_POLLING_INTERVAL_MS;
+
+  return useQuery<PluginListResult<T>>({
+    queryKey: tasksQueryKey(pluginName, { offset, limit, fetchAllPages }),
+    enabled: options?.enabled !== false,
+    queryFn: async () => {
+      try {
+        return await fetchPluginTasksList<T>(pluginName, {
+          offset,
+          limit,
+          fetchAllPages,
+        });
+      } catch (error) {
+        if (
+          MOCK_FALLBACKS_ENABLED &&
+          mockTasks &&
+          isBackendUnavailable(error)
+        ) {
+          return mockItemsToResult(mockTasks);
+        }
+        throw error;
+      }
+    },
+    // Keep the previous page while offset/limit changes, but not across a
+    // plugin switch that leaves the list mounted (would flash the wrong rows).
+    placeholderData: (previousData, previousQuery) =>
+      previousQuery?.queryKey[1] === pluginName ? previousData : undefined,
+    // Keep the list live while something is running; an idle list issues no
+    // repeat requests. Polling reflects the task's actual current state rather
+    // than its state at page load.
+    refetchInterval: (query) =>
+      taskListRefetchInterval(
+        query.state.data?.items,
+        pollingIntervalMs,
+        disablePolling
+      ),
+  });
+}
+
+export function usePluginTask<T extends Record<string, unknown>>(
+  pluginName: string,
+  taskId: string | undefined,
+  mockTasks?: T[],
+  options?: { enabled?: boolean }
+) {
+  return useQuery<T | undefined>({
+    queryKey: ['plugins', pluginName, 'tasks', taskId],
+    enabled: options?.enabled !== false && !!taskId,
+    queryFn: async () => {
+      try {
+        const { data } = await apiClient.get<T>(
+          `/apps/${pluginName}/${encodeURIComponent(taskId!)}`
+        );
+        return data;
+      } catch (error) {
+        if (
+          MOCK_FALLBACKS_ENABLED &&
+          mockTasks &&
+          isBackendUnavailable(error)
+        ) {
+          // Per-plugin detail/delete routes look up by `task_name`; mocks
+          // resolve by the same key so dev fallback matches prod semantics.
+          return mockTasks.find((t) => String(t.name ?? t.id) === taskId);
+        }
+        throw error;
+      }
+    },
+  });
+}
+
+export function useCreatePluginTask<T extends Record<string, unknown>>(
+  pluginName: string,
+  mockTasks?: T[]
+) {
+  const queryClient = useQueryClient();
+
+  return useMutation<T, Error, Record<string, unknown>>({
+    mutationFn: async (values) => {
+      try {
+        const { data } = await apiClient.post<T>(
+          `/apps/${pluginName}/`,
+          values
+        );
+        return data;
+      } catch (error) {
+        if (
+          MOCK_FALLBACKS_ENABLED &&
+          mockTasks &&
+          isBackendUnavailable(error)
+        ) {
+          return values as T;
+        }
+        throw error;
+      }
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({
+        queryKey: ['plugins', pluginName, 'tasks'],
+      });
+    },
+  });
+}
+
+export function useUpdatePluginTask<T extends Record<string, unknown>>(
+  pluginName: string,
+  mockTasks?: T[]
+) {
+  const queryClient = useQueryClient();
+
+  return useMutation<
+    T,
+    Error,
+    { taskId: string; values: Record<string, unknown> }
+  >({
+    mutationFn: async ({ taskId, values }) => {
+      try {
+        const { data } = await apiClient.put<T>(
+          `/apps/${pluginName}/${encodeURIComponent(taskId)}`,
+          values
+        );
+        return data;
+      } catch (error) {
+        if (
+          MOCK_FALLBACKS_ENABLED &&
+          mockTasks &&
+          isBackendUnavailable(error)
+        ) {
+          return { ...values, name: taskId } as unknown as T;
+        }
+        throw error;
+      }
+    },
+    onSuccess: (_data, { taskId }) => {
+      queryClient.invalidateQueries({
+        queryKey: ['plugins', pluginName, 'tasks'],
+      });
+      queryClient.invalidateQueries({
+        queryKey: ['plugins', pluginName, 'tasks', taskId],
+      });
+    },
+  });
+}
+
+function entityQueriesPrefix(pluginName: string, entityName: string) {
+  return ['plugins', pluginName, 'entity', entityName] as const;
+}
+
+function entityListQueryKey(
+  pluginName: string,
+  entityName: string,
+  options: Pick<PluginListQueryOptions, 'offset' | 'limit' | 'fetchAllPages'>
+) {
+  return [
+    ...entityQueriesPrefix(pluginName, entityName),
+    {
+      offset: options.offset ?? DEFAULT_PLUGIN_LIST_OFFSET,
+      limit: options.limit ?? DEFAULT_PLUGIN_LIST_LIMIT,
+      fetchAllPages: options.fetchAllPages ?? false,
+    },
+  ] as const;
+}
+
+function entityQueriesRootKey(pluginName: string) {
+  return ['plugins', pluginName, 'entity'] as const;
+}
+
+/**
+ * Build a per-item URL path for a multi-entity plugin endpoint.
+ *
+ * ``id`` segments are always URL-encoded so callers cannot smuggle path
+ * traversal (``"../foo"``) or sub-paths (``"a/b"``) into the request via a
+ * misbehaving backend or attacker-controlled JSON.
+ */
+export function buildEntityItemPath(
+  pluginName: string,
+  entityName: string,
+  id: string
+): string {
+  return `/apps/${pluginName}/${entityName}/${encodeURIComponent(id)}`;
+}
+
+/** List rows for one entity of a multi-entity plugin (GET ``/apps/{name}/{entity}/``). */
+export function usePluginEntityList<T extends Record<string, unknown>>(
+  pluginName: string,
+  entityName: string,
+  mockItems?: T[],
+  options?: PluginListQueryOptions
+) {
+  const offset = options?.offset ?? DEFAULT_PLUGIN_LIST_OFFSET;
+  const limit = options?.limit ?? DEFAULT_PLUGIN_LIST_LIMIT;
+  const fetchAllPages = options?.fetchAllPages ?? false;
+
+  return useQuery<PluginListResult<T>>({
+    queryKey: entityListQueryKey(pluginName, entityName, {
+      offset,
+      limit,
+      fetchAllPages,
+    }),
+    enabled: options?.enabled !== false,
+    queryFn: async () => {
+      try {
+        return await fetchPluginEntityList<T>(pluginName, entityName, {
+          offset,
+          limit,
+          fetchAllPages,
+        });
+      } catch (error) {
+        if (
+          MOCK_FALLBACKS_ENABLED &&
+          mockItems &&
+          isBackendUnavailable(error)
+        ) {
+          return mockItemsToResult(mockItems);
+        }
+        throw error;
+      }
+    },
+    // Keep the previous page while offset/limit changes, but not across an
+    // entity-tab (or plugin) switch that leaves PluginListPage mounted.
+    placeholderData: (previousData, previousQuery) =>
+      previousQuery?.queryKey[1] === pluginName &&
+      previousQuery?.queryKey[3] === entityName
+        ? previousData
+        : undefined,
+  });
+}
+
+export function usePluginEntityDetail<T extends Record<string, unknown>>(
+  pluginName: string,
+  entityName: string,
+  itemId: string | undefined,
+  mockItems?: T[],
+  options?: { enabled?: boolean }
+) {
+  return useQuery<T | undefined>({
+    queryKey: [...entityQueriesPrefix(pluginName, entityName), itemId],
+    enabled: options?.enabled !== false && !!itemId,
+    queryFn: async () => {
+      try {
+        const { data } = await apiClient.get<T>(
+          buildEntityItemPath(pluginName, entityName, itemId!)
+        );
+        return data;
+      } catch (error) {
+        if (
+          MOCK_FALLBACKS_ENABLED &&
+          mockItems &&
+          isBackendUnavailable(error)
+        ) {
+          return mockItems.find((t) => String(t.id) === itemId);
+        }
+        throw error;
+      }
+    },
+  });
+}
+
+export function useCreatePluginEntity<T extends Record<string, unknown>>(
+  pluginName: string,
+  entityName: string,
+  mockItems?: T[]
+) {
+  const queryClient = useQueryClient();
+
+  return useMutation<T, Error, Record<string, unknown>>({
+    mutationFn: async (values) => {
+      try {
+        const { data } = await apiClient.post<T>(
+          `/apps/${pluginName}/${entityName}/`,
+          values
+        );
+        return data;
+      } catch (error) {
+        if (
+          MOCK_FALLBACKS_ENABLED &&
+          mockItems &&
+          isBackendUnavailable(error)
+        ) {
+          return values as T;
+        }
+        throw error;
+      }
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({
+        queryKey: entityQueriesRootKey(pluginName),
+      });
+    },
+  });
+}
+
+export function useUpdatePluginEntity<T extends Record<string, unknown>>(
+  pluginName: string,
+  entityName: string,
+  mockItems?: T[]
+) {
+  const queryClient = useQueryClient();
+
+  return useMutation<T, Error, { id: string; values: Record<string, unknown> }>(
+    {
+      mutationFn: async ({ id, values }) => {
+        try {
+          const { data } = await apiClient.put<T>(
+            buildEntityItemPath(pluginName, entityName, id),
+            values
+          );
+          return data;
+        } catch (error) {
+          if (
+            MOCK_FALLBACKS_ENABLED &&
+            mockItems &&
+            isBackendUnavailable(error)
+          ) {
+            return { ...values, id } as unknown as T;
+          }
+          throw error;
+        }
+      },
+      onSuccess: () => {
+        queryClient.invalidateQueries({
+          queryKey: entityQueriesRootKey(pluginName),
+        });
+      },
+    }
+  );
+}
+
+export function useDeletePluginEntity(
+  pluginName: string,
+  entityName: string,
+  mockItems?: unknown[]
+) {
+  const queryClient = useQueryClient();
+
+  return useMutation<void, Error, string>({
+    mutationFn: async (id) => {
+      try {
+        await apiClient.delete(buildEntityItemPath(pluginName, entityName, id));
+      } catch (error) {
+        if (
+          MOCK_FALLBACKS_ENABLED &&
+          mockItems &&
+          isBackendUnavailable(error)
+        ) {
+          return;
+        }
+        throw error;
+      }
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({
+        queryKey: entityQueriesRootKey(pluginName),
+      });
+    },
+  });
+}
+
+export function useDeletePluginTask<T extends Record<string, unknown>>(
+  pluginName: string,
+  mockTasks?: T[]
+) {
+  const queryClient = useQueryClient();
+
+  return useMutation<void, Error, string>({
+    mutationFn: async (taskId) => {
+      try {
+        await apiClient.delete(
+          `/apps/${pluginName}/${encodeURIComponent(taskId)}`
+        );
+      } catch (error) {
+        if (
+          MOCK_FALLBACKS_ENABLED &&
+          mockTasks &&
+          isBackendUnavailable(error)
+        ) {
+          // Mock mode: pretend the delete succeeded so the UI flow can be
+          // exercised offline, matching the create/list/detail hooks.
+          return;
+        }
+        throw error;
+      }
+    },
+    onSuccess: (_data, taskId) => {
+      queryClient.invalidateQueries({
+        queryKey: ['plugins', pluginName, 'tasks'],
+      });
+      queryClient.removeQueries({
+        queryKey: ['plugins', pluginName, 'tasks', taskId],
+      });
+    },
+  });
+}
diff --git a/ui/packages/sep/api/src/hooks/useSettings.ts b/ui/packages/sep/api/src/hooks/useSettings.ts
new file mode 100644
index 00000000000..0b8cd95a21a
--- /dev/null
+++ b/ui/packages/sep/api/src/hooks/useSettings.ts
@@ -0,0 +1,159 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/**
+ * React Query hooks for the runtime Settings admin API.
+ *
+ * Every settings group is reached through the single SEP gateway endpoint
+ * `/api/sep/admin/settings`. SEP serves its own classes (SEPSettings,
+ * SnippetsSettings, MessagesSettings) locally and proxies `TasksSettings`
+ * server-side from the Tasks sub-app, so the frontend never calls
+ * `/api/tasks/admin/settings/*` directly (API-First Rule 1). The list response
+ * already carries all groups, so there is no client-side fan-out or merge, and
+ * PATCH/DELETE for any class — including `TasksSettings` — go to `/api/sep`.
+ *
+ * All request/response shapes come from the generated OpenAPI types — this file
+ * never hand-rolls an API model.
+ */
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+
+import { apiClient } from '../client';
+import type { ApiError } from '../errors';
+import type { components } from '../generated/sep';
+
+// The settings models are declared identically in both the `sep` and `tasks`
+// specs; we treat the `sep` copy as the canonical source for the shared shapes.
+export type SettingClass = components['schemas']['SettingClassEnum'];
+export type ReloadClassification =
+  components['schemas']['ReloadClassification'];
+export type SettingResponse = components['schemas']['SettingResponse'];
+export type SettingClassGroup = components['schemas']['SettingClassGroup'];
+export type SettingsListResponse =
+  components['schemas']['SettingsListResponse'];
+export type SettingsPatch = components['schemas']['SettingsPatch'];
+
+/** The redacted literal the API returns in place of a secret value. */
+export const REDACTED_SECRET = '**********';
+
+export const SETTINGS_QUERY_KEY = ['settings', 'list'] as const;
+
+/** Base path (relative to the axios client's `/api` baseURL) for every class. */
+const SETTINGS_BASE = '/sep/admin/settings';
+
+/**
+ * Fetch every overridable settings class from the SEP gateway as one request.
+ *
+ * SEP aggregates its local classes and the proxied `TasksSettings` group into a
+ * single `groups` list, so there is no client-side fan-out or merge. Pass
+ * `enabled: false` to skip fetching entirely (e.g. for non-admin viewers).
+ */
+export function useSettingsList(options: { enabled?: boolean } = {}) {
+  return useQuery<SettingClassGroup[], ApiError>({
+    queryKey: SETTINGS_QUERY_KEY,
+    enabled: options.enabled ?? true,
+    queryFn: async () => {
+      const { data } = await apiClient.get<SettingsListResponse>(
+        `${SETTINGS_BASE}/`
+      );
+      return data.groups;
+    },
+    staleTime: 30 * 1000,
+  });
+}
+
+interface ValidationErrorItem {
+  loc?: unknown[];
+  msg?: string;
+}
+
+/**
+ * Pull the Pydantic validation message(s) for a single field out of a 422
+ * {@link ApiError} body. Returns `null` when the error is not a 422, has no
+ * structured `detail`, or none of the entries reference `key`. FastAPI reports
+ * each failure as `{ loc: ['body', key, ...], msg }`, so we match on `loc`
+ * containing the field name and join all matching messages.
+ */
+export function settingErrorMessage(
+  error: ApiError | null | undefined,
+  key: string
+): string | null {
+  if (!error || error.status !== 422) {
+    return null;
+  }
+  const detail = (error.data as { detail?: unknown } | undefined)?.detail;
+  if (!Array.isArray(detail)) {
+    return null;
+  }
+  const messages = (detail as ValidationErrorItem[])
+    .filter((item) => Array.isArray(item.loc) && item.loc.includes(key))
+    .map((item) => item.msg)
+    .filter((msg): msg is string => typeof msg === 'string');
+  return messages.length > 0 ? messages.join('; ') : null;
+}
+
+export interface PatchSettingVars {
+  settingClass: SettingClass;
+  key: string;
+  value: unknown;
+}
+
+/**
+ * Persist a single setting override via PATCH to its owning sub-app.
+ *
+ * The endpoint accepts a multi-key payload, but this hook ships the per-setting
+ * shape `{ [key]: value }`. On success the list query is invalidated so the
+ * rendered value reflects what the backend stored (e.g. a re-redacted secret).
+ * On failure the rejected {@link ApiError} carries the raw response body, so a
+ * 422 caller can read `error.data.detail` for the per-field Pydantic message.
+ */
+export function usePatchSetting() {
+  const queryClient = useQueryClient();
+  return useMutation<SettingResponse[], ApiError, PatchSettingVars>({
+    mutationFn: async ({ settingClass, key, value }) => {
+      const body: SettingsPatch = { [key]: value as SettingsPatch[string] };
+      const { data } = await apiClient.patch<SettingResponse[]>(
+        `${SETTINGS_BASE}/${settingClass}`,
+        body
+      );
+      return data;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: SETTINGS_QUERY_KEY });
+    },
+  });
+}
+
+export interface ResetSettingVars {
+  settingClass: SettingClass;
+  key: string;
+}
+
+/**
+ * Remove a setting's override via DELETE, reverting it to its declared default.
+ * Idempotent on the backend; the list query is invalidated on success.
+ */
+export function useResetSetting() {
+  const queryClient = useQueryClient();
+  return useMutation<void, ApiError, ResetSettingVars>({
+    mutationFn: async ({ settingClass, key }) => {
+      await apiClient.delete(`${SETTINGS_BASE}/${settingClass}/${key}`);
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: SETTINGS_QUERY_KEY });
+    },
+  });
+}
diff --git a/ui/packages/sep/api/src/index.ts b/ui/packages/sep/api/src/index.ts
new file mode 100644
index 00000000000..7c6f340db65
--- /dev/null
+++ b/ui/packages/sep/api/src/index.ts
@@ -0,0 +1,190 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/// <reference path="./vite-env.d.ts" />
+
+// API client
+export {
+  apiClient,
+  emitUnauthorized,
+  getToken,
+  refreshAccessToken,
+  setTokenProvider,
+  setOnUnauthorized,
+  setOnRefreshed,
+} from './client';
+
+// Query client
+export { createQueryClient, defaultQueryClientConfig } from './queryClient';
+
+// Errors
+export { ApiError, normalizeAxiosError, parseFieldErrors } from './errors';
+export type {
+  ApiErrorDetails,
+  ApiErrorKind,
+  FieldValidationError,
+} from './errors';
+
+// Auth
+export {
+  postLogin,
+  postRefresh,
+  postSession,
+  postSessionExchange,
+  postLogout,
+  fetchCurrentUser,
+} from './auth';
+
+// Types (re-exported from generated OpenAPI schemas)
+export type {
+  OAuthTokenResponse,
+  SessionExchangeTokenResponse,
+  SPAOAuthTokenResponse,
+  User,
+} from './types/api';
+
+// Generated OpenAPI type surfaces — use for typed openapi-fetch clients
+// and for type-only imports in plugins and framework code.
+export type {
+  paths as MainPaths,
+  components as MainComponents,
+  operations as MainOperations,
+} from './generated/main';
+export type {
+  paths as InventoryPaths,
+  components as InventoryComponents,
+} from './generated/inventory';
+export type {
+  paths as TasksPaths,
+  components as TasksComponents,
+} from './generated/tasks';
+export type {
+  paths as SepPaths,
+  components as SepComponents,
+} from './generated/sep';
+
+// Typed request clients (openapi-fetch wrappers sharing interceptors with apiClient)
+export { mainApi, sepApi, throwOnApiError } from './typed-client';
+
+export type {
+  PluginSchema,
+  PluginEntitySchema,
+  PluginField,
+  SectionField,
+  OneOfBranch,
+  OneOfGroup,
+  FormSection,
+  ListColumn,
+  ListView,
+  DetailField,
+  DetailSection,
+  DetailView,
+  PluginCapabilities,
+  StringField,
+  IntegerField,
+  FloatField,
+  BoolField,
+  ChoiceField,
+  ChoiceOption,
+  MultiChoiceField,
+  TextAreaField,
+  DateTimeField,
+  FileField,
+  YamlField,
+  ServiceField,
+  SchemaField,
+  TableField,
+  HostField,
+  RemoteChoiceField,
+  ScriptPreviewField,
+  Predicate,
+  FieldGate,
+  CardinalityRule,
+  FailRule,
+  RelatedApp,
+} from './types/plugin-schema';
+
+// Hooks
+export {
+  useCurrentUser,
+  usePluginSchema,
+  usePluginTasks,
+  usePluginTask,
+  RUNNING_STATUSES,
+  isRunningStatus,
+  useCreatePluginTask,
+  useUpdatePluginTask,
+  usePluginEntityList,
+  usePluginEntityDetail,
+  normalizePluginListResponse,
+  DEFAULT_PLUGIN_LIST_OFFSET,
+  DEFAULT_PLUGIN_LIST_LIMIT,
+  useCreatePluginEntity,
+  useUpdatePluginEntity,
+  useDeletePluginEntity,
+  useDeletePluginTask,
+  useAlertConfig,
+  ALERT_CONFIG_QUERY_KEY,
+  useDashboardStats,
+  useSettingsList,
+  usePatchSetting,
+  useResetSetting,
+  settingErrorMessage,
+  SETTINGS_QUERY_KEY,
+  REDACTED_SECRET,
+  useEnabledApps,
+  ENABLED_APPS_QUERY_KEY,
+  useAdminApps,
+  useSetAppState,
+  useForceDisableApp,
+  isTransitional,
+  appStateErrorMessage,
+  ADMIN_APPS_QUERY_KEY,
+  ADMIN_APP_MUTATION_KEY,
+  useConfigExport,
+  useAppInfo,
+  APP_INFO_QUERY_KEY,
+} from './hooks';
+export type {
+  AlertConfig,
+  DashboardStats,
+  EnabledApp,
+  AppInfo,
+  PluginListPagination,
+  PluginListQueryOptions,
+  PluginListResult,
+  PaginatedPluginList,
+  TaskHistoryStatus,
+} from './hooks';
+export type {
+  AdminApp,
+  AppStateResult,
+  AppLifecycleState,
+  TransitionalState,
+  SetAppStateVars,
+  ForceDisableAppVars,
+} from './hooks';
+export type {
+  SettingClass,
+  ReloadClassification,
+  SettingResponse,
+  SettingClassGroup,
+  SettingsListResponse,
+  SettingsPatch,
+  PatchSettingVars,
+  ResetSettingVars,
+} from './hooks';
diff --git a/ui/packages/sep/api/src/queryClient.ts b/ui/packages/sep/api/src/queryClient.ts
new file mode 100644
index 00000000000..30ccbc187af
--- /dev/null
+++ b/ui/packages/sep/api/src/queryClient.ts
@@ -0,0 +1,90 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { QueryClient, type QueryClientConfig } from '@tanstack/react-query';
+import { AxiosError } from 'axios';
+import { ApiError } from './errors';
+
+const DEFAULT_STALE_TIME_MS = 30_000;
+const MAX_RETRIES = 3;
+const RETRY_BASE_DELAY_MS = 500;
+const RETRY_MAX_DELAY_MS = 30_000;
+
+function isClientError(error: unknown): boolean {
+  if (error instanceof ApiError) {
+    return (
+      error.kind === 'http' &&
+      (error.status ?? 0) >= 400 &&
+      (error.status ?? 0) < 500
+    );
+  }
+  if (error instanceof AxiosError) {
+    const status = error.response?.status;
+    return typeof status === 'number' && status >= 400 && status < 500;
+  }
+  return false;
+}
+
+function shouldRetry(failureCount: number, error: unknown): boolean {
+  if (failureCount >= MAX_RETRIES) {
+    return false;
+  }
+  if (isClientError(error)) {
+    return false;
+  }
+  return true;
+}
+
+function retryDelay(attemptIndex: number): number {
+  return Math.min(RETRY_BASE_DELAY_MS * 2 ** attemptIndex, RETRY_MAX_DELAY_MS);
+}
+
+export const defaultQueryClientConfig: QueryClientConfig = {
+  defaultOptions: {
+    queries: {
+      staleTime: DEFAULT_STALE_TIME_MS,
+      refetchOnWindowFocus: true,
+      retry: shouldRetry,
+      retryDelay,
+    },
+    mutations: {
+      retry: false,
+    },
+  },
+};
+
+export function createQueryClient(overrides?: QueryClientConfig): QueryClient {
+  if (!overrides) {
+    return new QueryClient(defaultQueryClientConfig);
+  }
+  return new QueryClient({
+    ...defaultQueryClientConfig,
+    ...overrides,
+    defaultOptions: {
+      ...defaultQueryClientConfig.defaultOptions,
+      ...overrides.defaultOptions,
+      queries: {
+        ...defaultQueryClientConfig.defaultOptions?.queries,
+        ...overrides.defaultOptions?.queries,
+      },
+      mutations: {
+        ...defaultQueryClientConfig.defaultOptions?.mutations,
+        ...overrides.defaultOptions?.mutations,
+      },
+    },
+  });
+}
diff --git a/ui/packages/sep/api/src/typed-client.ts b/ui/packages/sep/api/src/typed-client.ts
new file mode 100644
index 00000000000..33dbd0e1cd5
--- /dev/null
+++ b/ui/packages/sep/api/src/typed-client.ts
@@ -0,0 +1,196 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/// <reference path="./vite-env.d.ts" />
+/**
+ * Typed request clients built on `openapi-fetch` + generated `paths` types.
+ *
+ * One client per OpenAPI spec (see `scripts/codegen.ts`):
+ *   - `mainApi`      — core API (oauth, users)
+ *   - `sepApi`       — SEP app
+ *
+ * The generated `paths` keys include the mount prefix (e.g. `/api/users/me`),
+ * so every client uses `baseUrl: CLIENT_BASE_URL`, which resolves to the
+ * current origin in the browser and falls back to a `http://localhost`
+ * sentinel under Node/test environments — identical same-origin behaviour
+ * to the axios `apiClient` in the browser.
+ *
+ * We share auth state with `apiClient` via `getToken()`/`emitUnauthorized()`
+ * from `./client` — both the axios and fetch transports observe the same
+ * `setTokenProvider()`/`setOnUnauthorized()` registration. Errors are
+ * normalised to `ApiError` (via `throwOnApiError`) so callers see the same
+ * shape regardless of which client they use.
+ */
+import createClient, { type Client, type Middleware } from 'openapi-fetch';
+import { emitUnauthorized, getToken } from './client';
+import { ApiError } from './errors';
+import type { paths as MainPaths } from './generated/main';
+import type { paths as SepPaths } from './generated/sep';
+
+const IS_DEV = import.meta.env.DEV;
+
+const isRefreshRequest = (url: string) => url.includes('/oauth/refresh');
+
+/**
+ * A 200 HTML response (e.g. a follow of a login redirect) means the session
+ * is gone. The browser can't observe the 303, so content-type is the only
+ * signal. Synthesise a 401 so the normal error path runs.
+ */
+function isHtmlLoginResponse(response: Response): boolean {
+  const ct = response.headers.get('content-type') ?? '';
+  return response.ok && ct.includes('text/html');
+}
+
+const authMiddleware: Middleware = {
+  onRequest({ request }) {
+    const token = getToken();
+    if (token) {
+      request.headers.set('Authorization', `Bearer ${token}`);
+    }
+    if (IS_DEV) {
+      // eslint-disable-next-line no-console
+      console.debug(
+        `[api] → ${request.method} ${new URL(request.url).pathname}`
+      );
+    }
+    return request;
+  },
+  async onResponse({ request, response }) {
+    if (IS_DEV) {
+      // eslint-disable-next-line no-console
+      console.debug(
+        `[api] ← ${response.status} ${request.method} ${new URL(request.url).pathname}`
+      );
+    }
+
+    if (isHtmlLoginResponse(response) && !isRefreshRequest(request.url)) {
+      emitUnauthorized();
+      return new Response(null, {
+        status: 401,
+        statusText: 'Session expired (redirected to login page)',
+      });
+    }
+
+    if (
+      (response.status === 401 || response.status === 303) &&
+      !isRefreshRequest(request.url)
+    ) {
+      emitUnauthorized();
+    }
+
+    return response;
+  },
+};
+
+// openapi-fetch builds absolute URLs as `new URL(baseUrl + path)`, which
+// requires an absolute base — `baseUrl: ''` throws under Node because there
+// is no implicit document origin to resolve against. Read `location.origin`
+// when available (browser, jsdom-style tests), otherwise use a
+// `http://localhost` sentinel; MSW intercepts by URL in either case.
+const CLIENT_BASE_URL =
+  typeof globalThis !== 'undefined' &&
+  typeof (globalThis as { location?: Location }).location?.origin === 'string'
+    ? (globalThis as { location: Location }).location.origin
+    : 'http://localhost';
+
+// Resolve `fetch` lazily rather than capturing `globalThis.fetch` at module
+// load. Test harnesses (MSW, happy-dom) patch the global after this file is
+// imported, and openapi-fetch would otherwise call the pre-patch reference.
+const lazyFetch: typeof fetch = (...args) => globalThis.fetch(...args);
+
+function makeClient<Paths extends object>(): Client<Paths> {
+  const client = createClient<Paths>({
+    baseUrl: CLIENT_BASE_URL,
+    fetch: lazyFetch,
+  });
+  client.use(authMiddleware);
+  return client;
+}
+
+export const mainApi = makeClient<MainPaths>();
+export const sepApi = makeClient<SepPaths>();
+
+interface FetchResult<T> {
+  data?: T;
+  error?: unknown;
+  response: Response;
+}
+
+function detailFromBody(body: unknown): string | undefined {
+  if (body && typeof body === 'object' && 'detail' in body) {
+    const detail = (body as { detail: unknown }).detail;
+    if (typeof detail === 'string') {
+      return detail;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Raise `ApiError` on any failure instead of returning openapi-fetch's
+ * `{ data, error }` tuple. Covers three failure modes:
+ *   1. Resolved tuple with `response.ok === false` (server error body).
+ *   2. Resolved tuple with a synthesised 401 (HTML login redirect).
+ *   3. Rejected promise (network failure, JSON parse error).
+ *
+ * Use inside React Query `queryFn`s so errors propagate to `error` on the
+ * hook result and consumers can `instanceof ApiError` on them.
+ */
+export async function throwOnApiError<T>(
+  promise: Promise<FetchResult<T>>
+): Promise<T> {
+  let result: FetchResult<T>;
+  try {
+    result = await promise;
+  } catch (err) {
+    if (err instanceof ApiError) {
+      throw err;
+    }
+    if (err instanceof SyntaxError) {
+      throw new ApiError(
+        { kind: 'unknown', message: 'Malformed response body' },
+        err
+      );
+    }
+    // `TypeError` is the standard `fetch` rejection for network failures.
+    const message = err instanceof Error ? err.message : 'Network error';
+    throw new ApiError({ kind: 'network', message }, err);
+  }
+
+  const { data, error, response } = result;
+  if (response.ok && error === undefined) {
+    return data as T;
+  }
+
+  const url = (() => {
+    try {
+      return new URL(response.url).pathname;
+    } catch {
+      return undefined;
+    }
+  })();
+
+  const detail =
+    detailFromBody(error) ?? response.statusText ?? `HTTP ${response.status}`;
+  throw new ApiError({
+    kind: 'http',
+    status: response.status,
+    message: detail,
+    data: error,
+    url,
+  });
+}
diff --git a/ui/packages/sep/api/src/types/api.ts b/ui/packages/sep/api/src/types/api.ts
new file mode 100644
index 00000000000..79744bd3b22
--- /dev/null
+++ b/ui/packages/sep/api/src/types/api.ts
@@ -0,0 +1,48 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+// Common API types re-exported from the OpenAPI-generated schemas.
+// Hand-written types were removed after SEP-963 Phase 2 codegen landed.
+// The runtime ApiError class lives in ../errors.ts.
+
+import type { components } from '../generated/main';
+
+/** Authenticated user profile — `GET /api/users/me`. */
+export type User = components['schemas']['CasdoorUser'];
+
+/**
+ * Slim OAuth token returned to SPA clients by `POST /api/oauth/login` and
+ * `POST /api/oauth/refresh`. Only contains the access token and its TTL —
+ * the refresh token rides an `HttpOnly` cookie and is opaque to JS.
+ */
+export type SPAOAuthTokenResponse =
+  components['schemas']['SPAOAuthTokenResponse'];
+
+/**
+ * Short-lived bearer returned by `POST /api/oauth/session/exchange`. Carries no
+ * refresh token and rides no cookie — the holder keeps it in memory and
+ * exchanges the ambient session again before it expires.
+ */
+export type SessionExchangeTokenResponse =
+  components['schemas']['SessionExchangeTokenResponse'];
+
+/**
+ * @deprecated Use `SPAOAuthTokenResponse`. The full `OAuthToken` shape is
+ * only returned by the legacy `/oauth/token` endpoint; the SPA uses the
+ * cookie-based `/oauth/login` + `/oauth/refresh` flow.
+ */
+export type OAuthTokenResponse = SPAOAuthTokenResponse;
diff --git a/ui/packages/sep/api/src/types/plugin-schema.ts b/ui/packages/sep/api/src/types/plugin-schema.ts
new file mode 100644
index 00000000000..13d15ebf20b
--- /dev/null
+++ b/ui/packages/sep/api/src/types/plugin-schema.ts
@@ -0,0 +1,419 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/**
+ * Plugin Schema types — defines the contract for schema-driven plugins.
+ *
+ * These types mirror the backend PluginSchema Pydantic model.
+ * The backend serves schemas at GET /api/apps/{name}/schema as JSON.
+ * The SchemaFormRenderer auto-generates the UI from these definitions.
+ *
+ * Wire format is snake_case end-to-end. Uses a discriminated union on
+ * `type` for type-safe field rendering.
+ */
+
+// ── Conditional-rule primitives (SEP-1071) ──────────────────────────────
+
+/**
+ * Predicate JSON shape — a single-key object whose key is the operator
+ * name (`equals`, `truthy`, `all`, `any`, `xor`, `not`, etc.). The full
+ * operator catalogue lives alongside the BE DSL; we keep this open here
+ * because the FE counterpart (SEP-1077) consumes the wire format directly.
+ */
+export type Predicate = Record<string, unknown>;
+
+/**
+ * Binary self-cardinality gate at BaseField scope — when `when` matches,
+ * the field carrying the gate is required (for `requires`) or forbidden
+ * (for `forbidden`).
+ */
+export interface FieldGate {
+  when: Predicate;
+  message?: string;
+}
+
+/**
+ * Cross-field cardinality constraint at FormSection or PluginSchema scope.
+ * When `when` matches (omitted means always), the count of present fields
+ * in `fields` must satisfy `min` / `max` (omitted bound = unbounded). The
+ * backend strips `None`-valued keys from the wire payload, so optional
+ * properties may be absent rather than `null`.
+ */
+export interface CardinalityRule {
+  when?: Predicate;
+  fields: string[];
+  min?: number;
+  max?: number;
+  message?: string;
+}
+
+/**
+ * Predicate-only invariant: the rule fails iff `fail_when` matches.
+ * `error_fields` is an FE rendering hint pointing at the inputs to
+ * highlight when the rule fires.
+ */
+export interface FailRule {
+  fail_when: Predicate;
+  error_fields: string[];
+  message?: string;
+}
+
+// ── Base field ──────────────────────────────────────────────────────────
+
+interface BaseField {
+  name: string;
+  label: string;
+  required?: boolean;
+  description?: string;
+  default?: unknown;
+  /** Self-cardinality gates: when matched, the field is required. */
+  requires?: FieldGate[];
+  /** Self-cardinality gates: when matched, the field is forbidden. */
+  forbidden?: FieldGate[];
+}
+
+// ── Choice option ─────────────────────────────────────────────────────────
+
+/**
+ * One option in a choice / multi-choice field. `disabled` (and its optional
+ * `disabled_reason` tooltip text) are opt-in UI hints; the backend omits both
+ * from the wire while unset, so they arrive only for options that opt in.
+ */
+export interface ChoiceOption {
+  label: string;
+  value: string;
+  /** Render the option non-selectable. Omitted from the wire while unset. */
+  disabled?: boolean;
+  /** Explanatory text shown (e.g. in a tooltip) when the option is disabled. */
+  disabled_reason?: string;
+}
+
+// ── Concrete field types ────────────────────────────────────────────────
+
+export interface StringField extends BaseField {
+  type: 'string';
+  min_length?: number;
+  max_length?: number;
+  pattern?: string;
+  placeholder?: string;
+}
+
+export interface IntegerField extends BaseField {
+  type: 'integer';
+  ge?: number;
+  le?: number;
+  step?: number;
+}
+
+export interface FloatField extends BaseField {
+  type: 'float';
+  ge?: number;
+  le?: number;
+  step?: number;
+}
+
+export interface BoolField extends BaseField {
+  type: 'bool';
+}
+
+export interface ChoiceField extends BaseField {
+  type: 'choice';
+  choices: ChoiceOption[];
+}
+
+export interface MultiChoiceField extends BaseField {
+  type: 'multi_choice';
+  choices: ChoiceOption[];
+  min_items?: number;
+  max_items?: number;
+}
+
+export interface TextAreaField extends BaseField {
+  type: 'textarea';
+  rows?: number;
+  placeholder?: string;
+}
+
+export interface DateTimeField extends BaseField {
+  type: 'datetime';
+}
+
+export interface FileField extends BaseField {
+  type: 'file';
+  accept?: string[];
+}
+
+export interface YamlField extends BaseField {
+  type: 'yaml';
+  rows?: number;
+  placeholder?: string;
+}
+
+// ── Inventory-aware fields ──────────────────────────────────────────────
+
+export interface ServiceField extends BaseField {
+  type: 'service';
+  service_types: string[];
+  /** Offer free-text (free-solo) entry alongside the inventory options. */
+  allow_custom?: boolean;
+}
+
+export interface SchemaField extends BaseField {
+  type: 'schema';
+  depends_on: string;
+  /** Offer free-text (free-solo) entry alongside the cascaded options. */
+  allow_custom?: boolean;
+}
+
+export interface TableField extends BaseField {
+  type: 'table';
+  depends_on: string;
+  /** Offer free-text (free-solo) entry alongside the cascaded options. */
+  allow_custom?: boolean;
+}
+
+export interface HostField extends BaseField {
+  type: 'host';
+  /**
+   * Optional upstream field whose value drives the default executor
+   * selection (typically a service field). Omitted when the host list is
+   * not cascaded.
+   */
+  depends_on?: string;
+  /** Offer free-text (free-solo) entry alongside the inventory options. */
+  allow_custom?: boolean;
+}
+
+// ── Read-only preview ───────────────────────────────────────────────────
+
+export interface ScriptPreviewField extends BaseField {
+  type: 'script_preview';
+  /**
+   * Fully-resolved URL the renderer fetches preview content from. Schema
+   * synthesisers should bake plugin-specific path segments here at schema
+   * build time rather than templating client-side.
+   */
+  endpoint_url: string;
+  /**
+   * Names of sibling fields whose values trigger a debounced re-fetch.
+   * Empty (the default) means fetch once on mount.
+   */
+  depends_on: string[];
+  /** Optional default highlighter language hint. */
+  language?: string;
+}
+
+// ── Dynamic, API-backed option source ────────────────────────────────────
+
+export interface RemoteChoiceField extends BaseField {
+  type: 'remote_choice';
+  /**
+   * Fully-resolved URL the renderer fetches `Choice`-compatible options from,
+   * relative to the `apiClient` base (`/api`). Schema synthesisers bake any
+   * plugin-specific path segments here at schema build time.
+   */
+  endpoint_url: string;
+  /**
+   * Optional sibling field name whose value drives (and parameterises) the
+   * option fetch. Omitted from the wire while unset.
+   */
+  depends_on?: string;
+  /** Offer free-text (free-solo) entry alongside the fetched options. */
+  allow_custom?: boolean;
+}
+
+// ── Discriminated union ─────────────────────────────────────────────────
+
+export type PluginField =
+  | StringField
+  | IntegerField
+  | FloatField
+  | BoolField
+  | ChoiceField
+  | MultiChoiceField
+  | TextAreaField
+  | DateTimeField
+  | FileField
+  | YamlField
+  | ServiceField
+  | SchemaField
+  | TableField
+  | HostField
+  | RemoteChoiceField
+  | ScriptPreviewField;
+
+// ── One-of group ─────────────────────────────────────────────────────────
+
+/** One mutually-exclusive branch inside a {@link OneOfGroup}. */
+export interface OneOfBranch {
+  value: string;
+  label: string;
+  fields: PluginField[];
+}
+
+/**
+ * Labelled either/or field group rendered as a segmented control.
+ * Branch leaves use dotted paths when nested on the write model.
+ */
+export interface OneOfGroup {
+  type: 'one_of';
+  /** Stable group id for React keys; not a separate form value. */
+  name: string;
+  label: string;
+  description?: string;
+  /** Dotted path to the mode field (e.g. `source.mode`). */
+  discriminator: string;
+  default?: string;
+  branches: OneOfBranch[];
+}
+
+/** A section item: a leaf field or a one-of group container. */
+export type SectionField = PluginField | OneOfGroup;
+
+// ── Form structure ──────────────────────────────────────────────────────
+
+export interface FormSection {
+  title: string;
+  description?: string;
+  fields: SectionField[];
+  /** Whether the section is wrapped in an expandable/collapsible shell. */
+  collapsible?: boolean;
+  /** Initial expansion state when collapsible is enabled. */
+  collapsed_by_default?: boolean;
+  /** Whether to render the section after the submit button. */
+  render_after_submit?: boolean;
+  /** Cross-field cardinality constraints scoped to this section. */
+  cardinality_rules?: CardinalityRule[];
+  /** Predicate-only invariants scoped to this section. */
+  fail_when?: FailRule[];
+  /**
+   * Section-level visibility gates. When any gate fires the entire section
+   * is hidden and every child field is unregistered from react-hook-form
+   * so stale values do not ship in the submission payload.
+   * Gates may reference any field in the plugin schema.
+   */
+  forbidden?: FieldGate[];
+}
+
+// ── List view ───────────────────────────────────────────────────────────
+
+export interface ListColumn {
+  key: string;
+  label: string;
+  sortable?: boolean;
+  format?:
+    | 'text'
+    | 'chip'
+    | 'status'
+    | 'date'
+    | 'relative'
+    | 'code'
+    | 'actions'
+    | 'schedule';
+}
+
+export interface ListView {
+  columns: ListColumn[];
+  /** Column key to sort by. Prefix with '-' for descending (e.g. '-last_run'). */
+  default_sort?: string;
+  /** Extra record-level keys to hide from the detail Overview — both the list_view.columns rows and the extras loop, across single-task and multi-entity detail views — merged with the framework baseline. */
+  overview_hidden_fields?: string[];
+}
+
+// ── Capabilities ────────────────────────────────────────────────────────
+
+export interface PluginCapabilities {
+  chaining?: boolean;
+  alert_on_fail?: boolean;
+  scheduling?: boolean;
+  stats?: boolean;
+  pii_anonymization?: boolean;
+}
+
+// ── Detail view (task-style plugins) ────────────────────────────────────
+
+/** One labelled field rendered inside a DetailSection. */
+export interface DetailField {
+  /** Dotted path into the task record (e.g. ``"data.meta.command"``). */
+  path: string;
+  label: string;
+  /** Optional syntax-highlighter hint; mirrors the backend ``DetailHighlightLanguage`` enum. */
+  highlight?: 'sql' | 'json' | 'bash' | 'yaml';
+}
+
+/** One titled section rendered on the task detail page. */
+export interface DetailSection {
+  title: string;
+  fields: DetailField[];
+}
+
+/** Declarative layout for the task detail page's section cards. */
+export interface DetailView {
+  sections: DetailSection[];
+}
+
+// ── Multi-entity plugins (inventory) ────────────────────────────────────
+
+/** One CRUD resource when a plugin exposes several (nodes, services, …). */
+export interface PluginEntitySchema {
+  name: string;
+  display_name: string;
+  description?: string;
+  forms: FormSection[];
+  list_view: ListView;
+  /** Optional detail-view syntax hints keyed by field name; mirrors the backend
+   * ``DetailHighlightLanguage`` enum. */
+  detail_highlights?: Partial<Record<string, 'sql' | 'json' | 'bash' | 'yaml'>>;
+}
+
+// ── Related apps (sibling tabs) ─────────────────────────────────────────
+
+/**
+ * A separately registered app the parent plugin surfaces as a sibling tab
+ * (for example `mysql_backups/restore` nested under MySQL Backups).
+ */
+export interface RelatedApp {
+  /** Scoped registry key (for example `mysql_backups/restore`). */
+  app_key: string;
+  /** Tab label shown in the React shell (for example `Restore`). */
+  label: string;
+  /** Sub-path segment under the parent's `route_base` (for example `restores`). */
+  route_segment: string;
+}
+
+// ── Top-level schema ────────────────────────────────────────────────────
+
+export interface PluginSchema {
+  name: string;
+  display_name: string;
+  description?: string;
+  task_type?: string;
+  /** Task-style single entity: forms + list_view (omit or leave entities unset). */
+  forms?: FormSection[];
+  capabilities?: PluginCapabilities;
+  list_view?: ListView;
+  /** Declarative layout for the task detail page (task-style plugins). */
+  detail_view?: DetailView;
+  /** When set, the shell renders one list/create/detail flow per entity. */
+  entities?: PluginEntitySchema[];
+  /** Schema-wide cross-field cardinality constraints (task-style plugins). */
+  cardinality_rules?: CardinalityRule[];
+  /** Schema-wide predicate-only invariants (task-style plugins). */
+  fail_when?: FailRule[];
+  /** Separately registered apps rendered as sibling tabs in the React shell. */
+  related_apps?: RelatedApp[];
+}
diff --git a/ui/packages/sep/api/src/vite-env.d.ts b/ui/packages/sep/api/src/vite-env.d.ts
new file mode 100644
index 00000000000..a6ea88246a7
--- /dev/null
+++ b/ui/packages/sep/api/src/vite-env.d.ts
@@ -0,0 +1,37 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+// Minimal ImportMeta declaration so @sep/api can read `import.meta.env.DEV`
+// without depending on Vite directly. Consuming apps (e.g. @sep/shell) pull
+// in the full `vite/client` types via their own vite-env.d.ts.
+declare global {
+  interface ImportMetaEnv {
+    readonly DEV: boolean;
+    readonly PROD: boolean;
+    readonly MODE: string;
+    // Opt-in mock-fallback flag — set at build time (e.g. via
+    // `VITE_MOCK_API=true vite build`) to enable mock data fallbacks in
+    // production-mode bundles such as the Playwright preview target.
+    readonly VITE_MOCK_API?: string;
+  }
+
+  interface ImportMeta {
+    readonly env: ImportMetaEnv;
+  }
+}
+
+export {};
diff --git a/ui/packages/sep/api/tests/client.test.ts b/ui/packages/sep/api/tests/client.test.ts
new file mode 100644
index 00000000000..8aa43ab5f45
--- /dev/null
+++ b/ui/packages/sep/api/tests/client.test.ts
@@ -0,0 +1,359 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { http, HttpResponse } from 'msw';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import {
+  apiClient,
+  refreshAccessToken,
+  setOnRefreshed,
+  setOnUnauthorized,
+  setTokenProvider,
+} from '../src/client';
+import { ApiError } from '../src/errors';
+import { server } from './msw-server';
+
+const BASE = 'http://localhost';
+
+beforeEach(() => {
+  // Axios default baseURL is '/api' which has no origin under Node.
+  // Pin to a full URL so MSW can match requests predictably.
+  apiClient.defaults.baseURL = `${BASE}/api`;
+  setTokenProvider(() => null);
+  setOnUnauthorized(() => {});
+  setOnRefreshed(() => {});
+});
+
+afterEach(() => {
+  setTokenProvider(() => null);
+  setOnUnauthorized(() => {});
+  setOnRefreshed(() => {});
+});
+
+describe('apiClient — Bearer token injection', () => {
+  it('attaches Authorization header when provider returns a token', async () => {
+    setTokenProvider(() => 'abc123');
+    const seen = vi.fn();
+
+    server.use(
+      http.get(`${BASE}/api/ping`, ({ request }) => {
+        seen(request.headers.get('Authorization'));
+        return HttpResponse.json({ ok: true });
+      })
+    );
+
+    const res = await apiClient.get('/ping');
+
+    expect(res.status).toBe(200);
+    expect(seen).toHaveBeenCalledWith('Bearer abc123');
+  });
+
+  it('omits Authorization header when provider returns null', async () => {
+    setTokenProvider(() => null);
+    const seen = vi.fn();
+
+    server.use(
+      http.get(`${BASE}/api/ping`, ({ request }) => {
+        seen(request.headers.get('Authorization'));
+        return HttpResponse.json({ ok: true });
+      })
+    );
+
+    await apiClient.get('/ping');
+
+    expect(seen).toHaveBeenCalledWith(null);
+  });
+});
+
+describe('apiClient — payload pass-through (no case conversion)', () => {
+  it('sends snake_case request bodies verbatim', async () => {
+    const received = vi.fn();
+
+    server.use(
+      http.post(`${BASE}/api/widgets`, async ({ request }) => {
+        received(await request.json());
+        return HttpResponse.json({ ok: true });
+      })
+    );
+
+    await apiClient.post('/widgets', { chunk_size: 1, replicate_check: true });
+
+    expect(received).toHaveBeenCalledWith({
+      chunk_size: 1,
+      replicate_check: true,
+    });
+  });
+
+  it('returns snake_case response bodies verbatim', async () => {
+    server.use(
+      http.get(`${BASE}/api/token`, () =>
+        HttpResponse.json({
+          access_token: 'tok',
+          refresh_token: 'rtok',
+          expires_in: 3600,
+        })
+      )
+    );
+
+    const { data } = await apiClient.get('/token');
+
+    expect(data).toEqual({
+      access_token: 'tok',
+      refresh_token: 'rtok',
+      expires_in: 3600,
+    });
+  });
+});
+
+describe('apiClient — error normalization', () => {
+  it('maps a 404 response to ApiError with kind "http"', async () => {
+    server.use(
+      http.get(`${BASE}/api/missing`, () =>
+        HttpResponse.json({ detail: 'not found' }, { status: 404 })
+      )
+    );
+
+    await expect(apiClient.get('/missing')).rejects.toSatisfy((err) => {
+      if (!(err instanceof ApiError)) {
+        return false;
+      }
+      return (
+        err.kind === 'http' && err.status === 404 && err.message === 'not found'
+      );
+    });
+  });
+
+  it('maps a 500 response to ApiError with kind "http"', async () => {
+    server.use(
+      http.get(`${BASE}/api/boom`, () =>
+        HttpResponse.json({ detail: 'kaboom' }, { status: 500 })
+      )
+    );
+
+    await expect(apiClient.get('/boom')).rejects.toSatisfy((err) => {
+      if (!(err instanceof ApiError)) {
+        return false;
+      }
+      return (
+        err.kind === 'http' && err.status === 500 && err.message === 'kaboom'
+      );
+    });
+  });
+
+  it('maps a network error to ApiError with kind "network"', async () => {
+    server.use(http.get(`${BASE}/api/offline`, () => HttpResponse.error()));
+
+    await expect(apiClient.get('/offline')).rejects.toSatisfy((err) => {
+      if (!(err instanceof ApiError)) {
+        return false;
+      }
+      return err.kind === 'network';
+    });
+  });
+
+  it('skips the unauthorized handler on refresh-endpoint 401', async () => {
+    const onUnauth = vi.fn();
+    setOnUnauthorized(onUnauth);
+
+    server.use(
+      http.post(`${BASE}/api/oauth/refresh`, () =>
+        HttpResponse.json({ detail: 'bad refresh' }, { status: 401 })
+      )
+    );
+
+    await expect(apiClient.post('/oauth/refresh')).rejects.toBeInstanceOf(
+      ApiError
+    );
+    expect(onUnauth).not.toHaveBeenCalled();
+  });
+});
+
+describe('apiClient — 401 refresh-retry', () => {
+  it('retries the original request with the new token after a silent refresh', async () => {
+    let currentToken = 'old';
+    setTokenProvider(() => currentToken);
+    const onRefreshed = vi.fn((token: string, _ttl: number) => {
+      currentToken = token;
+    });
+    setOnRefreshed(onRefreshed);
+    const seenAuth: Array<string | null> = [];
+
+    server.use(
+      http.get(`${BASE}/api/protected`, ({ request }) => {
+        const auth = request.headers.get('Authorization');
+        seenAuth.push(auth);
+        if (auth === 'Bearer new') {
+          return HttpResponse.json({ ok: true });
+        }
+        return HttpResponse.json({ detail: 'expired' }, { status: 401 });
+      }),
+      http.post(`${BASE}/api/oauth/refresh`, () =>
+        HttpResponse.json({ access_token: 'new', expires_in: 300 })
+      )
+    );
+
+    const res = await apiClient.get('/protected');
+
+    expect(res.status).toBe(200);
+    expect(seenAuth).toEqual(['Bearer old', 'Bearer new']);
+    expect(onRefreshed).toHaveBeenCalledWith('new', 300);
+  });
+
+  it('invokes the unauthorized handler when refresh itself fails', async () => {
+    setTokenProvider(() => 'old');
+    const onUnauth = vi.fn();
+    setOnUnauthorized(onUnauth);
+
+    server.use(
+      http.get(`${BASE}/api/protected`, () =>
+        HttpResponse.json({ detail: 'expired' }, { status: 401 })
+      ),
+      http.post(`${BASE}/api/oauth/refresh`, () =>
+        HttpResponse.json({ detail: 'no cookie' }, { status: 401 })
+      )
+    );
+
+    await expect(apiClient.get('/protected')).rejects.toBeInstanceOf(ApiError);
+    expect(onUnauth).toHaveBeenCalledOnce();
+  });
+
+  it('single-flights concurrent 401s into a single refresh call', async () => {
+    let currentToken = 'old';
+    setTokenProvider(() => currentToken);
+    setOnRefreshed((token) => {
+      currentToken = token;
+    });
+
+    let refreshCalls = 0;
+
+    server.use(
+      http.get(`${BASE}/api/a`, ({ request }) => {
+        const auth = request.headers.get('Authorization');
+        if (auth === 'Bearer new') {
+          return HttpResponse.json({ r: 'a' });
+        }
+        return HttpResponse.json({ detail: 'expired' }, { status: 401 });
+      }),
+      http.get(`${BASE}/api/b`, ({ request }) => {
+        const auth = request.headers.get('Authorization');
+        if (auth === 'Bearer new') {
+          return HttpResponse.json({ r: 'b' });
+        }
+        return HttpResponse.json({ detail: 'expired' }, { status: 401 });
+      }),
+      http.post(`${BASE}/api/oauth/refresh`, async () => {
+        refreshCalls += 1;
+        // Delay so both 401s are in-flight before refresh resolves.
+        await new Promise((resolve) => setTimeout(resolve, 20));
+        return HttpResponse.json({ access_token: 'new', expires_in: 300 });
+      })
+    );
+
+    const [a, b] = await Promise.all([
+      apiClient.get('/a'),
+      apiClient.get('/b'),
+    ]);
+
+    expect(a.status).toBe(200);
+    expect(b.status).toBe(200);
+    expect(refreshCalls).toBe(1);
+  });
+
+  it('shares the single-flight coordinator between refreshAccessToken callers and 401 retries', async () => {
+    let currentToken = 'old';
+    setTokenProvider(() => currentToken);
+    setOnRefreshed((token) => {
+      currentToken = token;
+    });
+    let refreshCalls = 0;
+
+    server.use(
+      http.get(`${BASE}/api/protected`, ({ request }) => {
+        const auth = request.headers.get('Authorization');
+        if (auth === 'Bearer new') {
+          return HttpResponse.json({ ok: true });
+        }
+        return HttpResponse.json({ detail: 'expired' }, { status: 401 });
+      }),
+      http.post(`${BASE}/api/oauth/refresh`, async () => {
+        refreshCalls += 1;
+        await new Promise((resolve) => setTimeout(resolve, 20));
+        return HttpResponse.json({ access_token: 'new', expires_in: 300 });
+      })
+    );
+
+    // Simulates the timer and a concurrent protected request both needing
+    // a fresh token at the same instant. Only one /oauth/refresh must fire.
+    const [direct, retried] = await Promise.all([
+      refreshAccessToken(),
+      apiClient.get('/protected'),
+    ]);
+
+    expect(direct).toBe('new');
+    expect(retried.status).toBe(200);
+    expect(refreshCalls).toBe(1);
+  });
+
+  it('retries with the freshly-refreshed token even if the token provider was never updated', async () => {
+    // Simulate a consumer that forgot to wire setOnRefreshed — the token
+    // provider keeps returning the stale token. The retry must still
+    // carry the new Bearer because the interceptor sets it explicitly.
+    setTokenProvider(() => 'old');
+    // Deliberately NOT calling setOnRefreshed.
+    const seenAuth: Array<string | null> = [];
+
+    server.use(
+      http.get(`${BASE}/api/protected`, ({ request }) => {
+        const auth = request.headers.get('Authorization');
+        seenAuth.push(auth);
+        if (auth === 'Bearer new') {
+          return HttpResponse.json({ ok: true });
+        }
+        return HttpResponse.json({ detail: 'expired' }, { status: 401 });
+      }),
+      http.post(`${BASE}/api/oauth/refresh`, () =>
+        HttpResponse.json({ access_token: 'new', expires_in: 300 })
+      )
+    );
+
+    const res = await apiClient.get('/protected');
+
+    expect(res.status).toBe(200);
+    expect(seenAuth).toEqual(['Bearer old', 'Bearer new']);
+  });
+
+  it('does not retry after a second 401 on the retried request', async () => {
+    setTokenProvider(() => 'old');
+    const onUnauth = vi.fn();
+    setOnUnauthorized(onUnauth);
+    let refreshCalls = 0;
+
+    server.use(
+      http.get(`${BASE}/api/protected`, () =>
+        HttpResponse.json({ detail: 'expired' }, { status: 401 })
+      ),
+      http.post(`${BASE}/api/oauth/refresh`, () => {
+        refreshCalls += 1;
+        return HttpResponse.json({ access_token: 'new', expires_in: 300 });
+      })
+    );
+
+    await expect(apiClient.get('/protected')).rejects.toBeInstanceOf(ApiError);
+    expect(refreshCalls).toBe(1);
+    expect(onUnauth).toHaveBeenCalledOnce();
+  });
+});
diff --git a/ui/packages/sep/api/tests/errors.test.ts b/ui/packages/sep/api/tests/errors.test.ts
new file mode 100644
index 00000000000..34a12611203
--- /dev/null
+++ b/ui/packages/sep/api/tests/errors.test.ts
@@ -0,0 +1,107 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { ApiError, parseFieldErrors } from '../src/errors';
+
+function http422(detail: unknown): ApiError {
+  return new ApiError({
+    kind: 'http',
+    status: 422,
+    message: 'HTTP 422',
+    data: { detail },
+  });
+}
+
+describe('parseFieldErrors', () => {
+  it('strips a leading "body" segment from FastAPI request-body validation locs', () => {
+    const error = http422([
+      {
+        loc: ['body', 'limit'],
+        msg: 'ensure this value is greater than 0',
+        type: 'greater_than',
+      },
+    ]);
+    expect(parseFieldErrors(error)).toEqual([
+      { path: 'limit', message: 'ensure this value is greater than 0' },
+    ]);
+  });
+
+  it('keeps locs without a "body" prefix (manual model_validate paths)', () => {
+    const error = http422([
+      { loc: ['sleep'], msg: 'field required', type: 'missing' },
+    ]);
+    expect(parseFieldErrors(error)).toEqual([
+      { path: 'sleep', message: 'field required' },
+    ]);
+  });
+
+  it('joins nested object and array-index segments into a dot path', () => {
+    const error = http422([
+      {
+        loc: ['body', 'source', 'host'],
+        msg: 'invalid host',
+        type: 'value_error',
+      },
+      {
+        loc: ['body', 'items', 0, 'name'],
+        msg: 'too short',
+        type: 'string_too_short',
+      },
+    ]);
+    expect(parseFieldErrors(error)).toEqual([
+      { path: 'source.host', message: 'invalid host' },
+      { path: 'items.0.name', message: 'too short' },
+    ]);
+  });
+
+  it('yields an empty path for a body-level error so callers can surface it', () => {
+    const error = http422([
+      { loc: ['body'], msg: 'value is not a valid dict', type: 'dict_type' },
+    ]);
+    expect(parseFieldErrors(error)).toEqual([
+      { path: '', message: 'value is not a valid dict' },
+    ]);
+  });
+
+  it('falls back to a generic message when msg is missing or empty', () => {
+    const error = http422([
+      { loc: ['body', 'name'] },
+      { loc: ['body', 'age'], msg: '' },
+    ]);
+    expect(parseFieldErrors(error)).toEqual([
+      { path: 'name', message: 'Invalid value' },
+      { path: 'age', message: 'Invalid value' },
+    ]);
+  });
+
+  it('accepts a raw payload object as well as an ApiError', () => {
+    expect(
+      parseFieldErrors({ detail: [{ loc: ['body', 'x'], msg: 'bad' }] })
+    ).toEqual([{ path: 'x', message: 'bad' }]);
+  });
+
+  it('returns [] when there is no recognizable detail array', () => {
+    expect(parseFieldErrors(http422('Unprocessable Entity'))).toEqual([]);
+    expect(parseFieldErrors(http422(undefined))).toEqual([]);
+    expect(
+      parseFieldErrors(new ApiError({ kind: 'network', message: 'offline' }))
+    ).toEqual([]);
+    expect(parseFieldErrors(null)).toEqual([]);
+    expect(parseFieldErrors('boom')).toEqual([]);
+  });
+});
diff --git a/ui/packages/sep/api/tests/msw-server.ts b/ui/packages/sep/api/tests/msw-server.ts
new file mode 100644
index 00000000000..9c2eff63163
--- /dev/null
+++ b/ui/packages/sep/api/tests/msw-server.ts
@@ -0,0 +1,20 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { setupServer } from 'msw/node';
+
+export const server = setupServer();
diff --git a/ui/packages/sep/api/tests/queryClient.test.ts b/ui/packages/sep/api/tests/queryClient.test.ts
new file mode 100644
index 00000000000..bf22822375b
--- /dev/null
+++ b/ui/packages/sep/api/tests/queryClient.test.ts
@@ -0,0 +1,106 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { AxiosError, AxiosHeaders } from 'axios';
+import { describe, expect, it } from 'vitest';
+import { defaultQueryClientConfig } from '../src/queryClient';
+import { ApiError } from '../src/errors';
+
+function makeAxios4xx(status: number): AxiosError {
+  return new AxiosError(
+    `HTTP ${status}`,
+    'ERR_BAD_REQUEST',
+    { headers: new AxiosHeaders() },
+    undefined,
+    {
+      status,
+      data: {},
+      statusText: '',
+      headers: {},
+      config: { headers: new AxiosHeaders() },
+    }
+  );
+}
+
+function makeAxios5xx(status: number): AxiosError {
+  return new AxiosError(
+    `HTTP ${status}`,
+    'ERR_BAD_RESPONSE',
+    { headers: new AxiosHeaders() },
+    undefined,
+    {
+      status,
+      data: {},
+      statusText: '',
+      headers: {},
+      config: { headers: new AxiosHeaders() },
+    }
+  );
+}
+
+describe('defaultQueryClientConfig.retry', () => {
+  const retry = defaultQueryClientConfig.defaultOptions?.queries?.retry;
+
+  it('is a function predicate', () => {
+    expect(typeof retry).toBe('function');
+  });
+
+  it('does not retry 4xx errors (ApiError)', () => {
+    const err = new ApiError({ kind: 'http', status: 404, message: 'nope' });
+    expect((retry as (n: number, e: unknown) => boolean)(0, err)).toBe(false);
+  });
+
+  it('does not retry 4xx errors (AxiosError)', () => {
+    const err = makeAxios4xx(404);
+    expect((retry as (n: number, e: unknown) => boolean)(0, err)).toBe(false);
+  });
+
+  it('retries 5xx errors', () => {
+    const err = new ApiError({ kind: 'http', status: 503, message: 'svc' });
+    // AxiosError path too
+    const axErr = makeAxios5xx(503);
+    const fn = retry as (n: number, e: unknown) => boolean;
+    expect(fn(0, err)).toBe(true);
+    expect(fn(0, axErr)).toBe(true);
+  });
+
+  it('retries network errors', () => {
+    const err = new ApiError({ kind: 'network', message: 'offline' });
+    expect((retry as (n: number, e: unknown) => boolean)(0, err)).toBe(true);
+  });
+
+  it('gives up after 3 attempts', () => {
+    const err = new ApiError({ kind: 'network', message: 'offline' });
+    const fn = retry as (n: number, e: unknown) => boolean;
+    expect(fn(3, err)).toBe(false);
+  });
+});
+
+describe('defaultQueryClientConfig.retryDelay', () => {
+  const delay = defaultQueryClientConfig.defaultOptions?.queries
+    ?.retryDelay as (n: number) => number;
+
+  it('grows exponentially from 500ms', () => {
+    expect(delay(0)).toBe(500);
+    expect(delay(1)).toBe(1000);
+    expect(delay(2)).toBe(2000);
+  });
+
+  it('caps at 30s', () => {
+    expect(delay(20)).toBe(30_000);
+  });
+});
diff --git a/ui/packages/sep/api/tests/setup.ts b/ui/packages/sep/api/tests/setup.ts
new file mode 100644
index 00000000000..97001e2f13b
--- /dev/null
+++ b/ui/packages/sep/api/tests/setup.ts
@@ -0,0 +1,23 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { afterAll, afterEach, beforeAll } from 'vitest';
+import { server } from './msw-server';
+
+beforeAll(() => server.listen({ onUnhandledRequest: 'error' }));
+afterEach(() => server.resetHandlers());
+afterAll(() => server.close());
diff --git a/ui/packages/sep/api/tests/typed-client.test.ts b/ui/packages/sep/api/tests/typed-client.test.ts
new file mode 100644
index 00000000000..646bf610f24
--- /dev/null
+++ b/ui/packages/sep/api/tests/typed-client.test.ts
@@ -0,0 +1,187 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { http, HttpResponse } from 'msw';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { setOnUnauthorized, setTokenProvider } from '../src/client';
+import { ApiError } from '../src/errors';
+import { mainApi, throwOnApiError } from '../src/typed-client';
+import { server } from './msw-server';
+
+// openapi-fetch builds absolute URLs from a `baseUrl`. The generated paths
+// already include the `/api/...` prefix, and our typed clients set
+// `baseUrl` to an absolute origin. Under Node we stub `globalThis.location`
+// so the client's origin fallback resolves to `http://localhost` in these
+// tests — matching the MSW handler URLs below.
+//
+// `typed-client.ts` evaluates `CLIENT_BASE_URL` at module load (i.e. before
+// `beforeEach` runs), but the fallback path kicks in when `location` is
+// absent — which it is the first time the module is imported under Node —
+// so the computed base is already `http://localhost`. The stub here is
+// belt-and-braces in case another test suite has set `location` first.
+const ORIGINAL_LOCATION_DESCRIPTOR = Object.getOwnPropertyDescriptor(
+  globalThis,
+  'location'
+);
+
+beforeEach(() => {
+  Object.defineProperty(globalThis, 'location', {
+    configurable: true,
+    value: {
+      origin: 'http://localhost',
+      href: 'http://localhost/',
+    } as Location,
+  });
+  setTokenProvider(() => null);
+  setOnUnauthorized(() => {});
+});
+
+afterEach(() => {
+  setTokenProvider(() => null);
+  setOnUnauthorized(() => {});
+  if (ORIGINAL_LOCATION_DESCRIPTOR) {
+    Object.defineProperty(globalThis, 'location', ORIGINAL_LOCATION_DESCRIPTOR);
+  } else {
+    // Node default: no `location` property at all. Remove the stub so other
+    // test files observing `typeof location === 'undefined'` aren't fooled.
+    delete (globalThis as { location?: unknown }).location;
+  }
+});
+
+describe('typed-client — auth middleware', () => {
+  it('attaches Bearer token from the shared provider', async () => {
+    setTokenProvider(() => 'shared-token');
+    const seen = vi.fn();
+
+    server.use(
+      http.get('http://localhost/api/users/me', ({ request }) => {
+        seen(request.headers.get('Authorization'));
+        return HttpResponse.json({ id: 'x', username: 'u' });
+      })
+    );
+
+    await mainApi.GET('/api/users/me');
+
+    expect(seen).toHaveBeenCalledWith('Bearer shared-token');
+  });
+
+  it('calls the unauthorized handler on 401 (non-refresh endpoints)', async () => {
+    const onUnauth = vi.fn();
+    setOnUnauthorized(onUnauth);
+
+    server.use(
+      http.get('http://localhost/api/users/me', () =>
+        HttpResponse.json({ detail: 'nope' }, { status: 401 })
+      )
+    );
+
+    await mainApi.GET('/api/users/me');
+
+    expect(onUnauth).toHaveBeenCalledOnce();
+  });
+
+  it('skips the unauthorized handler on refresh-endpoint 401', async () => {
+    const onUnauth = vi.fn();
+    setOnUnauthorized(onUnauth);
+
+    server.use(
+      http.post('http://localhost/api/oauth/refresh', () =>
+        HttpResponse.json({ detail: 'bad' }, { status: 401 })
+      )
+    );
+
+    await mainApi.POST('/api/oauth/refresh');
+
+    expect(onUnauth).not.toHaveBeenCalled();
+  });
+
+  it('synthesises a 401 and notifies when the server returns HTML (session expired)', async () => {
+    const onUnauth = vi.fn();
+    setOnUnauthorized(onUnauth);
+
+    server.use(
+      http.get('http://localhost/api/users/me', () =>
+        HttpResponse.html('<html>login</html>', { status: 200 })
+      )
+    );
+
+    await expect(
+      throwOnApiError(mainApi.GET('/api/users/me'))
+    ).rejects.toSatisfy((err) => err instanceof ApiError && err.status === 401);
+    expect(onUnauth).toHaveBeenCalledOnce();
+  });
+});
+
+describe('throwOnApiError', () => {
+  it('returns typed data on 2xx', async () => {
+    server.use(
+      http.get('http://localhost/api/users/me', () =>
+        HttpResponse.json({ id: 'abc', username: 'u' })
+      )
+    );
+
+    const user = await throwOnApiError(mainApi.GET('/api/users/me'));
+
+    expect(user).toMatchObject({ id: 'abc', username: 'u' });
+  });
+
+  it('maps a JSON 4xx body to ApiError with status + detail', async () => {
+    server.use(
+      http.get('http://localhost/api/users/me', () =>
+        HttpResponse.json({ detail: 'not found' }, { status: 404 })
+      )
+    );
+
+    await expect(
+      throwOnApiError(mainApi.GET('/api/users/me'))
+    ).rejects.toSatisfy((err) => {
+      if (!(err instanceof ApiError)) {
+        return false;
+      }
+      return (
+        err.kind === 'http' && err.status === 404 && err.message === 'not found'
+      );
+    });
+  });
+
+  it('maps a network failure to ApiError with kind "network"', async () => {
+    server.use(
+      http.get('http://localhost/api/users/me', () => HttpResponse.error())
+    );
+
+    await expect(
+      throwOnApiError(mainApi.GET('/api/users/me'))
+    ).rejects.toSatisfy(
+      (err) => err instanceof ApiError && err.kind === 'network'
+    );
+  });
+
+  it('maps a malformed JSON body to ApiError (no raw SyntaxError leaks)', async () => {
+    server.use(
+      http.get('http://localhost/api/users/me', () =>
+        HttpResponse.text('not-json', {
+          status: 200,
+          headers: { 'content-type': 'application/json' },
+        })
+      )
+    );
+
+    await expect(
+      throwOnApiError(mainApi.GET('/api/users/me'))
+    ).rejects.toBeInstanceOf(ApiError);
+  });
+});
diff --git a/ui/packages/sep/api/tests/useAdminApps.test.ts b/ui/packages/sep/api/tests/useAdminApps.test.ts
new file mode 100644
index 00000000000..046ae4c75b5
--- /dev/null
+++ b/ui/packages/sep/api/tests/useAdminApps.test.ts
@@ -0,0 +1,97 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, expect, it } from 'vitest';
+
+import {
+  appStateErrorMessage,
+  isTransitional,
+} from '../src/hooks/useAdminApps';
+import { ApiError } from '../src/errors';
+
+describe('isTransitional', () => {
+  it('is true for ENABLING and DISABLING', () => {
+    expect(isTransitional('ENABLING')).toBe(true);
+    expect(isTransitional('DISABLING')).toBe(true);
+  });
+
+  it('is false for terminal states', () => {
+    expect(isTransitional('ENABLED')).toBe(false);
+    expect(isTransitional('DISABLED')).toBe(false);
+  });
+});
+
+describe('appStateErrorMessage', () => {
+  it('returns null when there is no error', () => {
+    expect(appStateErrorMessage(null)).toBeNull();
+    expect(appStateErrorMessage(undefined)).toBeNull();
+  });
+
+  it('prefers the backend detail for a 409 illegal/protected transition', () => {
+    const error = new ApiError({
+      kind: 'http',
+      status: 409,
+      message: "App 'inventory' is protected and cannot be disabled.",
+      data: { detail: "App 'inventory' is protected and cannot be disabled." },
+    });
+    expect(appStateErrorMessage(error)).toBe(
+      "App 'inventory' is protected and cannot be disabled."
+    );
+  });
+
+  it('prefers the backend detail for a 404 unknown app key', () => {
+    const error = new ApiError({
+      kind: 'http',
+      status: 404,
+      message: 'Not found',
+      data: { detail: "App 'ghost' not found." },
+    });
+    expect(appStateErrorMessage(error)).toBe("App 'ghost' not found.");
+  });
+
+  it('falls back to a generic message when 404 has no detail', () => {
+    const error = new ApiError({
+      kind: 'http',
+      status: 404,
+      message: 'HTTP 404',
+    });
+    expect(appStateErrorMessage(error)).toBe('That app no longer exists.');
+  });
+
+  it('reports an admin-access message for a 403', () => {
+    const error = new ApiError({
+      kind: 'http',
+      status: 403,
+      message: 'Forbidden',
+    });
+    expect(appStateErrorMessage(error)).toMatch(/administrator access/i);
+  });
+
+  it('reports a credentials hint for a 401 (missing bearer token)', () => {
+    const error = new ApiError({
+      kind: 'http',
+      status: 401,
+      message: 'Unauthorized',
+    });
+    expect(appStateErrorMessage(error)).toMatch(/credentials/i);
+  });
+
+  it('falls back to the error message for other statuses', () => {
+    const error = new ApiError({ kind: 'network', message: 'Network error' });
+    expect(appStateErrorMessage(error)).toBe('Network error');
+  });
+});
diff --git a/ui/packages/sep/api/tests/usePluginTasks.test.ts b/ui/packages/sep/api/tests/usePluginTasks.test.ts
new file mode 100644
index 00000000000..03220eac123
--- /dev/null
+++ b/ui/packages/sep/api/tests/usePluginTasks.test.ts
@@ -0,0 +1,407 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import {
+  buildEntityItemPath,
+  DEFAULT_PLUGIN_LIST_LIMIT,
+  DEFAULT_PLUGIN_LIST_OFFSET,
+  fetchPluginTasksList,
+  fetchPluginEntityList,
+  isBackendUnavailable,
+  isRunningStatus,
+  MAX_FETCH_ALL_PAGES,
+  normalizePluginListResponse,
+  RUNNING_STATUSES,
+  taskListRefetchInterval,
+} from '../src/hooks/usePluginTasks';
+import { ApiError } from '../src/errors';
+
+vi.mock('../src/client', () => ({
+  apiClient: {
+    get: vi.fn(),
+  },
+}));
+
+import { apiClient } from '../src/client';
+
+const getMock = vi.mocked(apiClient.get);
+
+beforeEach(() => {
+  getMock.mockReset();
+});
+
+describe('normalizePluginListResponse', () => {
+  it('returns items with pagination null for a bare array', () => {
+    const items = [{ name: 'a' }, { name: 'b' }];
+    expect(normalizePluginListResponse(items)).toEqual({
+      items,
+      pagination: null,
+    });
+  });
+
+  it('preserves pagination metadata for a full envelope', () => {
+    const items = [{ name: 'a' }];
+    expect(
+      normalizePluginListResponse({ items, total: 120, offset: 50, limit: 50 })
+    ).toEqual({
+      items,
+      pagination: { total: 120, offset: 50, limit: 50 },
+    });
+  });
+
+  it('unwraps a partial items-only envelope without pagination metadata', () => {
+    const items = [{ name: 'a' }];
+    expect(normalizePluginListResponse({ items })).toEqual({
+      items,
+      pagination: null,
+    });
+  });
+
+  it('returns empty items for null, undefined, or empty object', () => {
+    expect(normalizePluginListResponse(null)).toEqual({
+      items: [],
+      pagination: null,
+    });
+    expect(normalizePluginListResponse(undefined)).toEqual({
+      items: [],
+      pagination: null,
+    });
+    expect(normalizePluginListResponse({} as never)).toEqual({
+      items: [],
+      pagination: null,
+    });
+  });
+
+  it('returns empty items when items is null in a partial envelope', () => {
+    expect(normalizePluginListResponse({ items: null })).toEqual({
+      items: [],
+      pagination: null,
+    });
+  });
+});
+
+describe('fetchPluginTasksList', () => {
+  it('requests offset/limit query params for a single page', async () => {
+    getMock.mockResolvedValue({
+      data: { items: [{ name: 'a' }], total: 1, offset: 50, limit: 50 },
+    });
+
+    const result = await fetchPluginTasksList('mysql_backups', {
+      offset: 50,
+      limit: 50,
+    });
+
+    expect(getMock).toHaveBeenCalledWith('/apps/mysql_backups/', {
+      params: { offset: 50, limit: 50 },
+    });
+    expect(result).toEqual({
+      items: [{ name: 'a' }],
+      pagination: { total: 1, offset: 50, limit: 50 },
+    });
+  });
+
+  it('defaults offset/limit to backend defaults', async () => {
+    getMock.mockResolvedValue({ data: [] });
+
+    await fetchPluginTasksList('mysql_backups');
+
+    expect(getMock).toHaveBeenCalledWith('/apps/mysql_backups/', {
+      params: {
+        offset: DEFAULT_PLUGIN_LIST_OFFSET,
+        limit: DEFAULT_PLUGIN_LIST_LIMIT,
+      },
+    });
+  });
+
+  it('fetchAllPages loops until total is reached', async () => {
+    getMock
+      .mockResolvedValueOnce({
+        data: {
+          items: [{ name: 'a' }],
+          total: 2,
+          offset: 0,
+          limit: DEFAULT_PLUGIN_LIST_LIMIT,
+        },
+      })
+      .mockResolvedValueOnce({
+        data: {
+          items: [{ name: 'b' }],
+          total: 2,
+          offset: 1,
+          limit: DEFAULT_PLUGIN_LIST_LIMIT,
+        },
+      });
+
+    const result = await fetchPluginTasksList('mysql_backups', {
+      fetchAllPages: true,
+    });
+
+    expect(getMock).toHaveBeenCalledWith('/apps/mysql_backups/', {
+      params: { offset: 0, limit: DEFAULT_PLUGIN_LIST_LIMIT },
+    });
+    expect(getMock).toHaveBeenCalledTimes(2);
+    expect(result).toEqual({
+      items: [{ name: 'a' }, { name: 'b' }],
+      pagination: null,
+    });
+  });
+  it('fetchAllPages returns the bare array on NO_PAGINATION routes', async () => {
+    const items = [{ name: 'a' }, { name: 'b' }];
+    getMock.mockResolvedValue({ data: items });
+
+    const result = await fetchPluginTasksList('legacy_app', {
+      fetchAllPages: true,
+    });
+
+    expect(getMock).toHaveBeenCalledTimes(1);
+    expect(result).toEqual({ items, pagination: null });
+  });
+
+  it('fetchAllPages sets truncated and warns when the page cap is hit', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    getMock.mockImplementation(async (path, config) => {
+      const offset = Number(
+        (config as { params: { offset: number } }).params.offset
+      );
+      return {
+        data: {
+          items: Array.from({ length: DEFAULT_PLUGIN_LIST_LIMIT }, (_, i) => ({
+            name: `t${offset + i}`,
+          })),
+          total: 3000,
+          offset,
+          limit: DEFAULT_PLUGIN_LIST_LIMIT,
+        },
+      };
+    });
+
+    const result = await fetchPluginTasksList('mysql_backups', {
+      fetchAllPages: true,
+    });
+
+    expect(getMock).toHaveBeenCalledTimes(MAX_FETCH_ALL_PAGES);
+    expect(result.items).toHaveLength(
+      MAX_FETCH_ALL_PAGES * DEFAULT_PLUGIN_LIST_LIMIT
+    );
+    expect(result.truncated).toBe(true);
+    expect(warn).toHaveBeenCalledWith(
+      expect.stringContaining('fetchAllPages truncated')
+    );
+    warn.mockRestore();
+  });
+});
+
+describe('fetchPluginEntityList', () => {
+  it('requests the entity list path with offset/limit', async () => {
+    getMock.mockResolvedValue({
+      data: { items: [{ id: 1 }], total: 1, offset: 0, limit: 50 },
+    });
+
+    const result = await fetchPluginEntityList('inventory', 'nodes', {
+      offset: 0,
+      limit: 50,
+    });
+
+    expect(getMock).toHaveBeenCalledWith('/apps/inventory/nodes/', {
+      params: { offset: 0, limit: 50 },
+    });
+    expect(result).toEqual({
+      items: [{ id: 1 }],
+      pagination: { total: 1, offset: 0, limit: 50 },
+    });
+  });
+
+  it('returns a bare array for NO_PAGINATION entity routes', async () => {
+    const items = [{ id: 1 }, { id: 2 }];
+    getMock.mockResolvedValue({ data: items });
+
+    const result = await fetchPluginEntityList('legacy_app', 'items');
+
+    expect(result).toEqual({ items, pagination: null });
+  });
+
+  it('fetchAllPages loops entity pages until total is reached', async () => {
+    getMock
+      .mockResolvedValueOnce({
+        data: {
+          items: [{ id: 1 }],
+          total: 2,
+          offset: 0,
+          limit: DEFAULT_PLUGIN_LIST_LIMIT,
+        },
+      })
+      .mockResolvedValueOnce({
+        data: {
+          items: [{ id: 2 }],
+          total: 2,
+          offset: 1,
+          limit: DEFAULT_PLUGIN_LIST_LIMIT,
+        },
+      });
+
+    const result = await fetchPluginEntityList('inventory', 'nodes', {
+      fetchAllPages: true,
+    });
+
+    expect(getMock).toHaveBeenCalledWith('/apps/inventory/nodes/', {
+      params: { offset: 0, limit: DEFAULT_PLUGIN_LIST_LIMIT },
+    });
+    expect(getMock).toHaveBeenCalledTimes(2);
+    expect(result).toEqual({
+      items: [{ id: 1 }, { id: 2 }],
+      pagination: null,
+    });
+  });
+});
+
+describe('buildEntityItemPath', () => {
+  it('encodes the id segment to prevent path traversal', () => {
+    // A backend bug or attacker-controlled id with "/" or ".." would otherwise
+    // change which resource (or even which plugin) the request targets.
+    expect(buildEntityItemPath('mysql_backups', 'backups', '../secret')).toBe(
+      '/apps/mysql_backups/backups/..%2Fsecret'
+    );
+    expect(buildEntityItemPath('mysql_backups', 'backups', 'a/b')).toBe(
+      '/apps/mysql_backups/backups/a%2Fb'
+    );
+  });
+
+  it('encodes whitespace, unicode, and reserved characters', () => {
+    expect(buildEntityItemPath('p', 'e', 'a b')).toBe('/apps/p/e/a%20b');
+    expect(buildEntityItemPath('p', 'e', '#frag')).toBe('/apps/p/e/%23frag');
+    expect(buildEntityItemPath('p', 'e', '?q=1')).toBe('/apps/p/e/%3Fq%3D1');
+    expect(buildEntityItemPath('p', 'e', 'café')).toBe('/apps/p/e/caf%C3%A9');
+  });
+
+  it('passes bare alphanumeric / UUID ids through unchanged', () => {
+    expect(buildEntityItemPath('p', 'e', '42')).toBe('/apps/p/e/42');
+    expect(
+      buildEntityItemPath('p', 'e', '550e8400-e29b-41d4-a716-446655440000')
+    ).toBe('/apps/p/e/550e8400-e29b-41d4-a716-446655440000');
+  });
+});
+
+describe('isRunningStatus / RUNNING_STATUSES', () => {
+  it('treats running and pending as still-executing', () => {
+    expect(isRunningStatus('running')).toBe(true);
+    expect(isRunningStatus('pending')).toBe(true);
+  });
+
+  it('treats terminal statuses as not running', () => {
+    for (const status of ['success', 'failed', 'stopped'] as const) {
+      expect(isRunningStatus(status)).toBe(false);
+    }
+  });
+
+  it('RUNNING_STATUSES holds exactly running and pending', () => {
+    expect([...RUNNING_STATUSES].sort()).toEqual(['pending', 'running']);
+  });
+});
+
+describe('taskListRefetchInterval (poll-while-running)', () => {
+  const polling = 5000;
+
+  it('polls while any row is running', () => {
+    const rows = [{ status: 'success' }, { status: 'running' }];
+    expect(taskListRefetchInterval(rows, polling, false)).toBe(polling);
+  });
+
+  it('polls while any row is pending', () => {
+    expect(
+      taskListRefetchInterval([{ status: 'pending' }], polling, false)
+    ).toBe(polling);
+  });
+
+  it('stays idle when no row is running (no repeat requests)', () => {
+    const rows = [
+      { status: 'success' },
+      { status: 'failed' },
+      { status: 'stopped' },
+    ];
+    expect(taskListRefetchInterval(rows, polling, false)).toBe(false);
+  });
+
+  it('stays idle for an empty list', () => {
+    expect(taskListRefetchInterval([], polling, false)).toBe(false);
+  });
+
+  it('stays idle before the first fetch resolves', () => {
+    expect(taskListRefetchInterval(undefined, polling, false)).toBe(false);
+  });
+
+  it('never polls when disabled, even with a running row', () => {
+    expect(
+      taskListRefetchInterval([{ status: 'running' }], polling, true)
+    ).toBe(false);
+  });
+});
+
+describe('isBackendUnavailable (mock-fallback gate)', () => {
+  // The mock-fallback layer in usePluginTasks only swallows errors that look
+  // like the backend is unreachable. A 401/403/404 must always propagate so
+  // mock data never masks real auth or routing problems even in dev builds.
+  it.each([
+    ['network kind', new ApiError({ kind: 'network', message: 'net' })],
+    ['500', new ApiError({ kind: 'http', status: 500, message: '500' })],
+    ['502', new ApiError({ kind: 'http', status: 502, message: '502' })],
+    ['503', new ApiError({ kind: 'http', status: 503, message: '503' })],
+    ['504', new ApiError({ kind: 'http', status: 504, message: '504' })],
+  ])('treats %s as backend-unavailable', (_label, err) => {
+    expect(isBackendUnavailable(err)).toBe(true);
+  });
+
+  it.each([
+    ['400', new ApiError({ kind: 'http', status: 400, message: '400' })],
+    ['401', new ApiError({ kind: 'http', status: 401, message: '401' })],
+    ['403', new ApiError({ kind: 'http', status: 403, message: '403' })],
+    ['404', new ApiError({ kind: 'http', status: 404, message: '404' })],
+    ['422', new ApiError({ kind: 'http', status: 422, message: '422' })],
+    ['499', new ApiError({ kind: 'http', status: 499, message: '499' })],
+  ])('does NOT mask deterministic 4xx (%s) with mock data', (_label, err) => {
+    expect(isBackendUnavailable(err)).toBe(false);
+  });
+
+  it('does not mask timeout, canceled, or unknown kinds as backend-down', () => {
+    expect(
+      isBackendUnavailable(new ApiError({ kind: 'timeout', message: 't' }))
+    ).toBe(false);
+    expect(
+      isBackendUnavailable(new ApiError({ kind: 'canceled', message: 'c' }))
+    ).toBe(false);
+    expect(
+      isBackendUnavailable(new ApiError({ kind: 'unknown', message: '?' }))
+    ).toBe(false);
+  });
+
+  it('does not classify a plain Error as backend-unavailable', () => {
+    // Plain Errors aren't an axios surface — they shouldn't reach the gate,
+    // but if they do, the fallback must not engage.
+    expect(isBackendUnavailable(new Error('boom'))).toBe(false);
+    expect(isBackendUnavailable(undefined)).toBe(false);
+    expect(isBackendUnavailable(null)).toBe(false);
+    expect(isBackendUnavailable('string')).toBe(false);
+  });
+
+  it('does not treat http error with missing status as backend-down', () => {
+    // `kind === 'http'` but status undefined would otherwise compare
+    // `undefined >= 500 === false`, but pin the behaviour explicitly.
+    expect(
+      isBackendUnavailable(new ApiError({ kind: 'http', message: 'mystery' }))
+    ).toBe(false);
+  });
+});
diff --git a/ui/packages/sep/api/tsconfig.json b/ui/packages/sep/api/tsconfig.json
new file mode 100644
index 00000000000..ee18d6a7366
--- /dev/null
+++ b/ui/packages/sep/api/tsconfig.json
@@ -0,0 +1,9 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "rootDir": "src",
+    "outDir": "dist"
+  },
+  "include": ["src"]
+}
diff --git a/ui/packages/sep/api/vitest.config.ts b/ui/packages/sep/api/vitest.config.ts
new file mode 100644
index 00000000000..10a32bdf476
--- /dev/null
+++ b/ui/packages/sep/api/vitest.config.ts
@@ -0,0 +1,27 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    environment: 'node',
+    globals: false,
+    include: ['tests/**/*.test.ts'],
+    setupFiles: ['./tests/setup.ts'],
+  },
+});
diff --git a/ui/packages/sep/framework/package.json b/ui/packages/sep/framework/package.json
new file mode 100644
index 00000000000..781778a59be
--- /dev/null
+++ b/ui/packages/sep/framework/package.json
@@ -0,0 +1,68 @@
+{
+  "name": "@sep/framework",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "main": "./src/index.ts",
+  "types": "./src/index.ts",
+  "scripts": {
+    "type-check": "tsc --noEmit",
+    "check-types": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "oxlint --config ../../../oxlintrc.json src",
+    "format": "oxfmt --write src"
+  },
+  "dependencies": {
+    "@dnd-kit/core": "^6.3.1",
+    "@dnd-kit/sortable": "^10.0.0",
+    "@dnd-kit/utilities": "^3.2.2",
+    "@microsoft/fetch-event-source": "2.0.1",
+    "@sep/api": "workspace:*",
+    "@sep/shared": "workspace:*",
+    "@types/react-syntax-highlighter": "^15.5.13",
+    "cronstrue": "^3.14.0",
+    "material-react-table": "^1.15.1",
+    "prism-react-renderer": "^2.4.1",
+    "prismjs": "^1.30.0",
+    "react-syntax-highlighter": "^16.1.1",
+    "sql-formatter": "^15.7.4"
+  },
+  "devDependencies": {
+    "@emotion/react": "^11.11.4",
+    "@emotion/styled": "^11.11.5",
+    "@melloware/react-logviewer": "^6.5.0",
+    "@mui/icons-material": "^7.3.7",
+    "@mui/material": "^7.3.7",
+    "@percona/percona-ui": "1.0.22",
+    "@tanstack/react-query": "^5.100.7",
+    "@testing-library/jest-dom": "^6.6.3",
+    "@testing-library/react": "^16.3.0",
+    "@testing-library/user-event": "^14.6.1",
+    "@types/prismjs": "^1.26.5",
+    "@types/react": "^19.1.0",
+    "@vitejs/plugin-react-swc": "^4.3.1",
+    "jsdom": "^29.1.1",
+    "notistack": "^3.0.2",
+    "react": "^19.1.0",
+    "react-dom": "^19.1.0",
+    "react-hook-form": "^7.71.2",
+    "react-router-dom": "^7.14.0",
+    "typescript": "~6.0.3",
+    "vite": "^8.0.16",
+    "vitest": "^4.0.0"
+  },
+  "peerDependencies": {
+    "@emotion/react": "^11.0.0",
+    "@emotion/styled": "^11.0.0",
+    "@melloware/react-logviewer": "^6.5.0",
+    "@mui/icons-material": "^7.3.7",
+    "@mui/material": "^7.3.7",
+    "@percona/percona-ui": "^1.0.15",
+    "@tanstack/react-query": "^5.75.0",
+    "notistack": "^3.0.2",
+    "react": "^19.1.0",
+    "react-hook-form": "^7.71.0",
+    "react-router-dom": "^7.6.0"
+  }
+}
diff --git a/ui/packages/sep/framework/src/components/AlertOnFailField/AlertOnFailField.test.tsx b/ui/packages/sep/framework/src/components/AlertOnFailField/AlertOnFailField.test.tsx
new file mode 100644
index 00000000000..80295a8502a
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/AlertOnFailField/AlertOnFailField.test.tsx
@@ -0,0 +1,243 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import {
+  useForm,
+  FormProvider,
+  type FieldValues,
+  type UseFormGetValues,
+} from 'react-hook-form';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import type { ReactNode } from 'react';
+
+const useAlertConfigMock = vi.fn();
+
+vi.mock('@sep/api', () => ({
+  useAlertConfig: () => useAlertConfigMock(),
+}));
+
+import { AlertOnFailField, ALERT_ON_FAIL_FIELD_NAME } from './AlertOnFailField';
+
+type AlertConfigState = {
+  data?: { available: boolean };
+  isLoading: boolean;
+  isError?: boolean;
+};
+
+function setAlertConfig(state: AlertConfigState) {
+  useAlertConfigMock.mockReturnValue({ isError: false, ...state });
+}
+
+function makeQueryClient() {
+  return new QueryClient({
+    defaultOptions: { queries: { retry: false, gcTime: 0, staleTime: 0 } },
+  });
+}
+
+function Harness({
+  defaultValue,
+  onSubmit,
+  formSpy,
+}: {
+  defaultValue?: boolean;
+  onSubmit?: (values: Record<string, unknown>) => void;
+  formSpy?: (api: { getValues: UseFormGetValues<FieldValues> }) => void;
+}) {
+  const methods = useForm();
+  formSpy?.({ getValues: methods.getValues });
+  return (
+    <FormProvider {...methods}>
+      <form onSubmit={methods.handleSubmit((v) => onSubmit?.(v))}>
+        <AlertOnFailField defaultValue={defaultValue} />
+        <button type="submit">submit</button>
+      </form>
+    </FormProvider>
+  );
+}
+
+function renderHarness(ui: ReactNode) {
+  return render(
+    <QueryClientProvider client={makeQueryClient()}>{ui}</QueryClientProvider>
+  );
+}
+
+beforeEach(() => {
+  useAlertConfigMock.mockReset();
+});
+
+describe('AlertOnFailField', () => {
+  it('uses the snake_case form field name expected by the API', () => {
+    expect(ALERT_ON_FAIL_FIELD_NAME).toBe('alert_on_fail');
+  });
+
+  it('renders an enabled checkbox when providers are configured', () => {
+    setAlertConfig({ data: { available: true }, isLoading: false });
+    renderHarness(<Harness />);
+
+    const checkbox = screen.getByRole('checkbox', {
+      name: /Alert on failure/i,
+    });
+    expect(checkbox).not.toBeDisabled();
+    expect(checkbox).not.toBeChecked();
+  });
+
+  it('renders a disabled checkbox when no providers are configured', () => {
+    setAlertConfig({ data: { available: false }, isLoading: false });
+    renderHarness(<Harness />);
+
+    const checkbox = screen.getByRole('checkbox', {
+      name: /Alert on failure/i,
+    });
+    expect(checkbox).toBeDisabled();
+    expect(checkbox).not.toBeChecked();
+  });
+
+  it('keeps the checkbox disabled while the availability query is loading', () => {
+    setAlertConfig({ data: undefined, isLoading: true });
+    renderHarness(<Harness />);
+
+    const checkbox = screen.getByRole('checkbox', {
+      name: /Alert on failure/i,
+    });
+    expect(checkbox).toBeDisabled();
+  });
+
+  it('disables the checkbox when the availability query errors', () => {
+    setAlertConfig({ data: undefined, isLoading: false, isError: true });
+    renderHarness(<Harness />);
+
+    const checkbox = screen.getByRole('checkbox', {
+      name: /Alert on failure/i,
+    });
+    expect(checkbox).toBeDisabled();
+  });
+
+  it('honors defaultValue=true when providers are available', () => {
+    setAlertConfig({ data: { available: true }, isLoading: false });
+    renderHarness(<Harness defaultValue />);
+
+    const checkbox = screen.getByRole('checkbox', {
+      name: /Alert on failure/i,
+    });
+    expect(checkbox).toBeChecked();
+  });
+
+  it('clears defaultValue=true when providers are unavailable at mount', async () => {
+    setAlertConfig({ data: { available: false }, isLoading: false });
+    let getValues: UseFormGetValues<FieldValues> | undefined;
+    renderHarness(
+      <Harness
+        defaultValue
+        formSpy={({ getValues: gv }) => {
+          getValues = gv;
+        }}
+      />
+    );
+
+    const checkbox = screen.getByRole('checkbox', {
+      name: /Alert on failure/i,
+    });
+    expect(checkbox).toBeDisabled();
+    await waitFor(() => expect(checkbox).not.toBeChecked());
+    // Form state, not just rendered checkbox, must be cleared.
+    expect(getValues?.('alert_on_fail')).toBe(false);
+  });
+
+  it('clears the value when providers become unavailable mid-session', async () => {
+    setAlertConfig({ data: { available: true }, isLoading: false });
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    let getValues: UseFormGetValues<FieldValues> | undefined;
+    const captureSpy = ({
+      getValues: gv,
+    }: {
+      getValues: UseFormGetValues<FieldValues>;
+    }) => {
+      getValues = gv;
+    };
+    const { rerender } = renderHarness(
+      <Harness onSubmit={onSubmit} formSpy={captureSpy} />
+    );
+
+    const checkbox = screen.getByRole('checkbox', {
+      name: /Alert on failure/i,
+    });
+    await user.click(checkbox);
+    expect(checkbox).toBeChecked();
+
+    setAlertConfig({ data: { available: false }, isLoading: false });
+    rerender(
+      <QueryClientProvider client={makeQueryClient()}>
+        <Harness onSubmit={onSubmit} formSpy={captureSpy} />
+      </QueryClientProvider>
+    );
+
+    await waitFor(() => expect(checkbox).not.toBeChecked());
+    expect(checkbox).toBeDisabled();
+    expect(getValues?.('alert_on_fail')).toBe(false);
+
+    // Submitting also produces the cleared value — proves the reset is in
+    // form state, not just a render-time mask.
+    await user.click(screen.getByRole('button', { name: 'submit' }));
+    await waitFor(() => expect(onSubmit).toHaveBeenCalled());
+    expect(onSubmit).toHaveBeenLastCalledWith(
+      expect.objectContaining({ alert_on_fail: false })
+    );
+  });
+
+  it('keeps defaultValue=true after a delayed available=true query resolution', async () => {
+    setAlertConfig({ data: undefined, isLoading: true });
+    const { rerender } = renderHarness(<Harness defaultValue />);
+
+    const checkbox = screen.getByRole('checkbox', {
+      name: /Alert on failure/i,
+    });
+    // While loading, the field is disabled but the initial form value is preserved.
+    expect(checkbox).toBeDisabled();
+
+    setAlertConfig({ data: { available: true }, isLoading: false });
+    rerender(
+      <QueryClientProvider client={makeQueryClient()}>
+        <Harness defaultValue />
+      </QueryClientProvider>
+    );
+
+    await waitFor(() => expect(checkbox).not.toBeDisabled());
+    expect(checkbox).toBeChecked();
+  });
+
+  it('submits the toggled value under the alert_on_fail key', async () => {
+    setAlertConfig({ data: { available: true }, isLoading: false });
+    const onSubmit = vi.fn();
+    const user = userEvent.setup();
+    renderHarness(<Harness onSubmit={onSubmit} />);
+
+    const checkbox = screen.getByRole('checkbox', {
+      name: /Alert on failure/i,
+    });
+    await user.click(checkbox);
+    await user.click(screen.getByRole('button', { name: 'submit' }));
+
+    await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+    expect(onSubmit).toHaveBeenCalledWith(
+      expect.objectContaining({ alert_on_fail: true })
+    );
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/AlertOnFailField/AlertOnFailField.tsx b/ui/packages/sep/framework/src/components/AlertOnFailField/AlertOnFailField.tsx
new file mode 100644
index 00000000000..f00c2fd4a1d
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/AlertOnFailField/AlertOnFailField.tsx
@@ -0,0 +1,119 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useEffect } from 'react';
+import Checkbox from '@mui/material/Checkbox';
+import FormControlLabel from '@mui/material/FormControlLabel';
+import Tooltip from '@mui/material/Tooltip';
+import {
+  useController,
+  useFormContext,
+  type FieldValues,
+} from 'react-hook-form';
+import { useAlertConfig } from '@sep/api';
+
+/**
+ * Form field name submitted to the task-creation API. Matches the snake_case
+ * key the backend expects on `POST /tasks` (`alert_on_fail`) so plugin forms
+ * can simply spread the form values into the request payload.
+ */
+export const ALERT_ON_FAIL_FIELD_NAME = 'alert_on_fail';
+
+const TOOLTIP_AVAILABLE = 'Enable to trigger an alert if the task fails';
+const TOOLTIP_UNAVAILABLE = 'Configure an alert provider to use this feature';
+const TOOLTIP_ERROR = 'Could not load alert configuration';
+
+interface AlertOnFailFieldProps {
+  /**
+   * Initial value for the field. Mirrors the Jinja2 partial's
+   * `alert_on_fail_default`. The value is reset to `false` if the
+   * availability query later reports no configured providers, so a
+   * persisted `true` from an edit form can never round-trip to the
+   * backend when alerts are disabled.
+   */
+  defaultValue?: boolean;
+}
+
+/**
+ * Renders the *Alert on failure* checkbox shared by every task plugin's
+ * create/edit form. Replaces the
+ * `templates/tasks/partials/create-form-alert-on-failure-input.html.j2`
+ * partial: when the backend reports no configured alert providers the
+ * checkbox is disabled (not hidden) and a tooltip prompts the operator to
+ * configure a provider.
+ *
+ * Must be rendered inside a react-hook-form `<FormProvider>`.
+ */
+export function AlertOnFailField({
+  defaultValue = false,
+}: AlertOnFailFieldProps) {
+  const { control } = useFormContext<FieldValues>();
+  const { data, isLoading, isError } = useAlertConfig();
+  const available = data?.available ?? false;
+  // Stay disabled while the availability query is in flight or has errored
+  // so the field can't briefly appear actionable before resolving.
+  const disabled = isLoading || isError || !available;
+  const tooltip = isError
+    ? TOOLTIP_ERROR
+    : available
+      ? TOOLTIP_AVAILABLE
+      : TOOLTIP_UNAVAILABLE;
+
+  const {
+    field: { onChange, onBlur, value, ref, name },
+  } = useController({
+    name: ALERT_ON_FAIL_FIELD_NAME,
+    control,
+    defaultValue,
+  });
+
+  // Once we know providers are unavailable, force the form value to false so
+  // the UI (`checked`) and the submitted payload stay aligned. Covers two
+  // cases: (1) edit forms that mounted with `defaultValue=true` before the
+  // availability query resolved as `false`; (2) a user toggling the field on
+  // and then alert providers becoming unavailable mid-session.
+  const knownUnavailable = !isLoading && !isError && !available;
+  useEffect(() => {
+    if (knownUnavailable && value) {
+      onChange(false);
+    }
+  }, [knownUnavailable, value, onChange]);
+
+  return (
+    // `describeChild` keeps the checkbox's accessible name (the
+    // FormControlLabel text) intact; the tooltip is attached via
+    // aria-describedby instead of overriding aria-label. The Tooltip wraps
+    // FormControlLabel directly — only the inner Checkbox is disabled, so
+    // FormControlLabel itself stays hoverable and propagates the
+    // describedby relationship as close to the form control as possible.
+    <Tooltip title={tooltip} placement="top" describeChild>
+      <FormControlLabel
+        label="Alert on failure"
+        control={
+          <Checkbox
+            name={name}
+            inputRef={ref}
+            checked={!!value}
+            onChange={(_, checked) => onChange(checked)}
+            onBlur={onBlur}
+            disabled={disabled}
+          />
+        }
+      />
+    </Tooltip>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/AlertOnFailField/index.ts b/ui/packages/sep/framework/src/components/AlertOnFailField/index.ts
new file mode 100644
index 00000000000..3cd4417c8ff
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/AlertOnFailField/index.ts
@@ -0,0 +1,18 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { AlertOnFailField, ALERT_ON_FAIL_FIELD_NAME } from './AlertOnFailField';
diff --git a/ui/packages/sep/framework/src/components/ChainBuilder/ChainBuilder.test.tsx b/ui/packages/sep/framework/src/components/ChainBuilder/ChainBuilder.test.tsx
new file mode 100644
index 00000000000..fdfd37ebf3d
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ChainBuilder/ChainBuilder.test.tsx
@@ -0,0 +1,349 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useState } from 'react';
+import { describe, expect, it, vi } from 'vitest';
+import { render, screen, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { ChainBuilder, type ChainValue } from './ChainBuilder';
+
+const TASKS = [
+  { name: 'task-a' },
+  { name: 'task-b' },
+  { name: 'task-c' },
+  { name: 'task-self' },
+];
+
+interface HarnessProps {
+  initial?: ChainValue;
+  currentTaskName?: string;
+  availableTasks?: { name: string }[];
+  onChangeSpy?: (v: ChainValue) => void;
+  disabled?: boolean;
+}
+
+function Harness({
+  initial = { chain_task_names: [], chain_on_failure: false },
+  currentTaskName = 'task-self',
+  availableTasks = TASKS,
+  onChangeSpy,
+  disabled,
+}: HarnessProps) {
+  const [value, setValue] = useState<ChainValue>(initial);
+  return (
+    <ChainBuilder
+      availableTasks={availableTasks}
+      currentTaskName={currentTaskName}
+      value={value}
+      onChange={(next) => {
+        onChangeSpy?.(next);
+        setValue(next);
+      }}
+      disabled={disabled}
+    />
+  );
+}
+
+async function pickTaskFromDropdown(taskName: string) {
+  const user = userEvent.setup();
+  const combobox = screen.getByRole('combobox');
+  await user.click(combobox);
+  const option = await screen.findByRole('option', { name: taskName });
+  await user.click(option);
+}
+
+describe('ChainBuilder rendering', () => {
+  it('renders no chip sequence and no failure toggle when chain is empty', () => {
+    render(<Harness />);
+    expect(screen.queryByTestId('chain-sequence')).not.toBeInTheDocument();
+    expect(
+      screen.queryByTestId('chain-on-failure-checkbox')
+    ).not.toBeInTheDocument();
+    expect(screen.getByRole('combobox')).toBeInTheDocument();
+  });
+
+  it('exposes the widget as a labelled group', () => {
+    render(<Harness />);
+    const group = screen.getByRole('group', {
+      name: /chain tasks after execution/i,
+    });
+    expect(group).toBeInTheDocument();
+  });
+
+  it('renders chips and failure toggle when chain is non-empty', () => {
+    render(
+      <Harness
+        initial={{
+          chain_task_names: ['task-a', 'task-b'],
+          chain_on_failure: false,
+        }}
+      />
+    );
+    const sequence = screen.getByTestId('chain-sequence');
+    expect(within(sequence).getByText('task-a')).toBeInTheDocument();
+    expect(within(sequence).getByText('task-b')).toBeInTheDocument();
+    expect(screen.getByTestId('chain-on-failure-checkbox')).toBeInTheDocument();
+  });
+});
+
+describe('ChainBuilder add', () => {
+  it('appends the selected task and emits the new chain', async () => {
+    const onChange = vi.fn();
+    render(<Harness onChangeSpy={onChange} />);
+
+    await pickTaskFromDropdown('task-a');
+
+    expect(onChange).toHaveBeenCalledWith({
+      chain_task_names: ['task-a'],
+      chain_on_failure: false,
+    });
+    expect(
+      within(screen.getByTestId('chain-sequence')).getByText('task-a')
+    ).toBeInTheDocument();
+  });
+
+  it('disables the current task in the dropdown (cycle prevention)', async () => {
+    const user = userEvent.setup();
+    render(<Harness />);
+    await user.click(screen.getByRole('combobox'));
+    const option = await screen.findByRole('option', { name: 'task-self' });
+    expect(option).toHaveAttribute('aria-disabled', 'true');
+  });
+
+  it('disables already-chained tasks in the dropdown', async () => {
+    const user = userEvent.setup();
+    render(
+      <Harness
+        initial={{ chain_task_names: ['task-a'], chain_on_failure: false }}
+      />
+    );
+    await user.click(screen.getByRole('combobox'));
+    const option = await screen.findByRole('option', { name: 'task-a' });
+    expect(option).toHaveAttribute('aria-disabled', 'true');
+    const fresh = await screen.findByRole('option', { name: 'task-b' });
+    expect(fresh).not.toHaveAttribute('aria-disabled', 'true');
+  });
+
+  it('disables the dropdown entirely when no selectable tasks remain', () => {
+    render(
+      <Harness
+        availableTasks={[{ name: 'task-self' }]}
+        currentTaskName="task-self"
+      />
+    );
+    expect(screen.getByRole('combobox')).toHaveAttribute(
+      'aria-disabled',
+      'true'
+    );
+    expect(
+      screen.getByText(/no tasks available to chain/i)
+    ).toBeInTheDocument();
+  });
+});
+
+describe('ChainBuilder remove', () => {
+  it('removes a task when its remove button is clicked', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    render(
+      <Harness
+        initial={{
+          chain_task_names: ['task-a', 'task-b'],
+          chain_on_failure: true,
+        }}
+        onChangeSpy={onChange}
+      />
+    );
+
+    await user.click(screen.getByRole('button', { name: 'Remove task-a' }));
+
+    expect(onChange).toHaveBeenLastCalledWith({
+      chain_task_names: ['task-b'],
+      chain_on_failure: true,
+    });
+  });
+
+  it('removes only the clicked occurrence when names duplicate (stale data)', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    render(
+      <Harness
+        initial={{
+          chain_task_names: ['task-a', 'task-b', 'task-a'],
+          chain_on_failure: false,
+        }}
+        onChangeSpy={onChange}
+      />
+    );
+
+    // Two chips share the same accessible name "Remove task-a" — click the first.
+    const removeButtons = screen.getAllByRole('button', {
+      name: 'Remove task-a',
+    });
+    expect(removeButtons).toHaveLength(2);
+    await user.click(removeButtons[0]);
+
+    expect(onChange).toHaveBeenLastCalledWith({
+      chain_task_names: ['task-b', 'task-a'],
+      chain_on_failure: false,
+    });
+  });
+});
+
+describe('ChainBuilder reorder', () => {
+  it('reorders chips via keyboard drag (move first chip right)', async () => {
+    // jsdom returns zero rects, so dnd-kit's KeyboardSensor can't locate the
+    // adjacent sortable. Stub getBoundingClientRect so chips lay out left-to-right.
+    const order = ['task-a', 'task-b', 'task-c'];
+    const original = HTMLElement.prototype.getBoundingClientRect;
+    HTMLElement.prototype.getBoundingClientRect = function (): DOMRect {
+      const handles = this.querySelectorAll('[aria-label^="Drag "]');
+      if (handles.length === 1) {
+        const name = (handles[0].getAttribute('aria-label') ?? '').slice(
+          'Drag '.length
+        );
+        const i = order.indexOf(name);
+        if (i >= 0) {
+          const x = i * 100;
+          return {
+            x,
+            y: 0,
+            width: 80,
+            height: 32,
+            top: 0,
+            left: x,
+            right: x + 80,
+            bottom: 32,
+            toJSON: () => ({}),
+          } as DOMRect;
+        }
+      }
+      return {
+        x: 0,
+        y: 0,
+        width: 0,
+        height: 0,
+        top: 0,
+        left: 0,
+        right: 0,
+        bottom: 0,
+        toJSON: () => ({}),
+      } as DOMRect;
+    };
+
+    try {
+      const user = userEvent.setup();
+      const onChange = vi.fn();
+      render(
+        <Harness
+          initial={{
+            chain_task_names: ['task-a', 'task-b', 'task-c'],
+            chain_on_failure: false,
+          }}
+          onChangeSpy={onChange}
+        />
+      );
+
+      const handle = screen.getByRole('button', { name: 'Drag task-a' });
+      handle.focus();
+      await user.keyboard('[Space]');
+      await user.keyboard('[ArrowRight]');
+      await user.keyboard('[Space]');
+
+      expect(onChange).toHaveBeenLastCalledWith({
+        chain_task_names: ['task-b', 'task-a', 'task-c'],
+        chain_on_failure: false,
+      });
+    } finally {
+      HTMLElement.prototype.getBoundingClientRect = original;
+    }
+  });
+});
+
+describe('ChainBuilder chain_on_failure toggle', () => {
+  it('emits chain_on_failure=true when toggled on', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    render(
+      <Harness
+        initial={{ chain_task_names: ['task-a'], chain_on_failure: false }}
+        onChangeSpy={onChange}
+      />
+    );
+
+    await user.click(screen.getByTestId('chain-on-failure-checkbox'));
+
+    expect(onChange).toHaveBeenLastCalledWith({
+      chain_task_names: ['task-a'],
+      chain_on_failure: true,
+    });
+  });
+
+  it('emits chain_on_failure=false when toggled off', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    render(
+      <Harness
+        initial={{ chain_task_names: ['task-a'], chain_on_failure: true }}
+        onChangeSpy={onChange}
+      />
+    );
+
+    await user.click(screen.getByTestId('chain-on-failure-checkbox'));
+
+    expect(onChange).toHaveBeenLastCalledWith({
+      chain_task_names: ['task-a'],
+      chain_on_failure: false,
+    });
+  });
+
+  it('hides the toggle when the chain becomes empty after a remove', async () => {
+    const user = userEvent.setup();
+    render(
+      <Harness
+        initial={{ chain_task_names: ['task-a'], chain_on_failure: true }}
+      />
+    );
+    expect(screen.getByTestId('chain-on-failure-checkbox')).toBeInTheDocument();
+
+    await user.click(screen.getByRole('button', { name: 'Remove task-a' }));
+
+    expect(
+      screen.queryByTestId('chain-on-failure-checkbox')
+    ).not.toBeInTheDocument();
+  });
+});
+
+describe('ChainBuilder disabled', () => {
+  it('disables drag, remove, dropdown, and failure toggle when disabled', () => {
+    render(
+      <Harness
+        disabled
+        initial={{ chain_task_names: ['task-a'], chain_on_failure: false }}
+      />
+    );
+    expect(screen.getByRole('button', { name: 'Drag task-a' })).toBeDisabled();
+    expect(
+      screen.getByRole('button', { name: 'Remove task-a' })
+    ).toBeDisabled();
+    expect(screen.getByRole('combobox')).toHaveAttribute(
+      'aria-disabled',
+      'true'
+    );
+    expect(screen.getByTestId('chain-on-failure-checkbox')).toBeDisabled();
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/ChainBuilder/ChainBuilder.tsx b/ui/packages/sep/framework/src/components/ChainBuilder/ChainBuilder.tsx
new file mode 100644
index 00000000000..ed0fb2f2183
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ChainBuilder/ChainBuilder.tsx
@@ -0,0 +1,366 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useId, useMemo } from 'react';
+import Box from '@mui/material/Box';
+import Checkbox from '@mui/material/Checkbox';
+import Chip from '@mui/material/Chip';
+import FormControl from '@mui/material/FormControl';
+import FormControlLabel from '@mui/material/FormControlLabel';
+import IconButton from '@mui/material/IconButton';
+import InputLabel from '@mui/material/InputLabel';
+import MenuItem from '@mui/material/MenuItem';
+import Select, { type SelectChangeEvent } from '@mui/material/Select';
+import Tooltip from '@mui/material/Tooltip';
+import Typography from '@mui/material/Typography';
+import CloseIcon from '@mui/icons-material/Close';
+import DragIndicatorIcon from '@mui/icons-material/DragIndicator';
+import {
+  DndContext,
+  KeyboardSensor,
+  PointerSensor,
+  closestCenter,
+  useSensor,
+  useSensors,
+  type DragEndEvent,
+} from '@dnd-kit/core';
+import {
+  SortableContext,
+  arrayMove,
+  rectSortingStrategy,
+  sortableKeyboardCoordinates,
+  useSortable,
+} from '@dnd-kit/sortable';
+import { CSS } from '@dnd-kit/utilities';
+
+export interface ChainValue {
+  chain_task_names: string[];
+  chain_on_failure: boolean;
+}
+
+export interface AvailableTask {
+  name: string;
+}
+
+export interface ChainBuilderProps {
+  availableTasks: AvailableTask[];
+  currentTaskName: string;
+  value: ChainValue;
+  onChange: (next: ChainValue) => void;
+  label?: string;
+  disabled?: boolean;
+}
+
+const DEFAULT_LABEL = 'Chain tasks after execution (optional)';
+const FAILURE_TITLE =
+  'When enabled, the chain continues even if a task fails, stops, or is lost';
+
+// Compose dnd-kit ids that stay unique even if the chain contains duplicate
+// names (e.g. stale data). The leading index is the source of truth for
+// removal and reorder; the name suffix is just for debuggability.
+function chipId(index: number, name: string): string {
+  return `${index}:${name}`;
+}
+
+function indexFromChipId(id: string): number {
+  const colon = id.indexOf(':');
+  return colon === -1 ? -1 : Number.parseInt(id.slice(0, colon), 10);
+}
+
+function wouldCreateCycle(
+  name: string,
+  currentTaskName: string,
+  chain: readonly string[]
+): boolean {
+  return name === currentTaskName || chain.includes(name);
+}
+
+export function ChainBuilder({
+  availableTasks,
+  currentTaskName,
+  value,
+  onChange,
+  label = DEFAULT_LABEL,
+  disabled = false,
+}: ChainBuilderProps) {
+  const { chain_task_names: chain, chain_on_failure: chainOnFailure } = value;
+  const groupLabelId = useId();
+  const selectId = useId();
+  const helperId = useId();
+
+  const sensors = useSensors(
+    useSensor(PointerSensor, { activationConstraint: { distance: 4 } }),
+    useSensor(KeyboardSensor, { coordinateGetter: sortableKeyboardCoordinates })
+  );
+
+  const disabledOptions = useMemo(() => {
+    const set = new Set<string>(chain);
+    set.add(currentTaskName);
+    return set;
+  }, [chain, currentTaskName]);
+
+  const hasSelectableTask = useMemo(
+    () => availableTasks.some((t) => !disabledOptions.has(t.name)),
+    [availableTasks, disabledOptions]
+  );
+
+  const itemIds = useMemo(
+    () => chain.map((name, i) => chipId(i, name)),
+    [chain]
+  );
+
+  const handleAdd = (event: SelectChangeEvent<string>) => {
+    const name = event.target.value;
+    if (!name || wouldCreateCycle(name, currentTaskName, chain)) {
+      return;
+    }
+    onChange({ ...value, chain_task_names: [...chain, name] });
+  };
+
+  const handleRemoveAt = (index: number) => {
+    if (index < 0 || index >= chain.length) {
+      return;
+    }
+    const next = chain.slice();
+    next.splice(index, 1);
+    onChange({ ...value, chain_task_names: next });
+  };
+
+  const handleDragEnd = (event: DragEndEvent) => {
+    const { active, over } = event;
+    if (!over || active.id === over.id) {
+      return;
+    }
+    const from = indexFromChipId(String(active.id));
+    const to = indexFromChipId(String(over.id));
+    if (from < 0 || to < 0 || from === to) {
+      return;
+    }
+    onChange({
+      ...value,
+      chain_task_names: arrayMove(chain.slice(), from, to),
+    });
+  };
+
+  const handleFailureToggle = (_: unknown, checked: boolean) => {
+    onChange({ ...value, chain_on_failure: checked });
+  };
+
+  const hasChain = chain.length > 0;
+  const selectDisabled = disabled || !hasSelectableTask;
+  const selectHelper = !hasSelectableTask
+    ? 'No tasks available to chain'
+    : undefined;
+
+  return (
+    <Box
+      role="group"
+      aria-labelledby={groupLabelId}
+      data-testid="chain-builder"
+    >
+      <Typography
+        id={groupLabelId}
+        component="div"
+        variant="body2"
+        sx={{ display: 'block', mb: 1 }}
+      >
+        {label}
+      </Typography>
+
+      {hasChain && (
+        <DndContext
+          sensors={sensors}
+          collisionDetection={closestCenter}
+          onDragEnd={handleDragEnd}
+        >
+          <SortableContext items={itemIds} strategy={rectSortingStrategy}>
+            <Box
+              data-testid="chain-sequence"
+              sx={{
+                display: 'flex',
+                flexWrap: 'wrap',
+                alignItems: 'center',
+                gap: 0.5,
+                mb: 1.5,
+              }}
+            >
+              {chain.map((name, index) => (
+                <SortableChainItem
+                  key={itemIds[index]}
+                  id={itemIds[index]}
+                  name={name}
+                  index={index}
+                  isLast={index === chain.length - 1}
+                  disabled={disabled}
+                  onRemove={handleRemoveAt}
+                />
+              ))}
+            </Box>
+          </SortableContext>
+        </DndContext>
+      )}
+
+      <FormControl fullWidth size="small" disabled={selectDisabled}>
+        <InputLabel id={`${selectId}-label`}>Add task to chain…</InputLabel>
+        <Select
+          labelId={`${selectId}-label`}
+          id={selectId}
+          label="Add task to chain…"
+          value=""
+          displayEmpty={false}
+          onChange={handleAdd}
+          inputProps={
+            {
+              'data-testid': 'chain-add-select',
+              ...(selectHelper ? { 'aria-describedby': helperId } : {}),
+            } as React.InputHTMLAttributes<HTMLInputElement>
+          }
+        >
+          {availableTasks.map((t) => (
+            <MenuItem
+              key={t.name}
+              value={t.name}
+              disabled={disabledOptions.has(t.name)}
+            >
+              {t.name}
+            </MenuItem>
+          ))}
+        </Select>
+        {selectHelper && (
+          <Typography
+            id={helperId}
+            variant="caption"
+            color="text.secondary"
+            sx={{ mt: 0.5 }}
+          >
+            {selectHelper}
+          </Typography>
+        )}
+      </FormControl>
+
+      {hasChain && (
+        <Tooltip title={FAILURE_TITLE} placement="top-start">
+          <FormControlLabel
+            sx={{ mt: 1 }}
+            control={
+              <Checkbox
+                checked={chainOnFailure}
+                disabled={disabled}
+                onChange={handleFailureToggle}
+                inputProps={
+                  {
+                    'data-testid': 'chain-on-failure-checkbox',
+                  } as React.InputHTMLAttributes<HTMLInputElement>
+                }
+              />
+            }
+            label="Continue chain on failure"
+          />
+        </Tooltip>
+      )}
+    </Box>
+  );
+}
+
+interface SortableChainItemProps {
+  id: string;
+  name: string;
+  index: number;
+  isLast: boolean;
+  disabled: boolean;
+  onRemove: (index: number) => void;
+}
+
+function SortableChainItem({
+  id,
+  name,
+  index,
+  isLast,
+  disabled,
+  onRemove,
+}: SortableChainItemProps) {
+  const {
+    attributes,
+    listeners,
+    setNodeRef,
+    transform,
+    transition,
+    isDragging,
+  } = useSortable({
+    id,
+    disabled,
+  });
+
+  const style = {
+    transform: CSS.Translate.toString(transform),
+    transition,
+    opacity: isDragging ? 0.5 : 1,
+  };
+
+  return (
+    <Box
+      ref={setNodeRef}
+      style={style}
+      component="span"
+      sx={{ display: 'inline-flex', alignItems: 'center', gap: 0.5 }}
+    >
+      <Box
+        sx={{
+          display: 'inline-flex',
+          alignItems: 'center',
+          border: 1,
+          borderColor: 'divider',
+          borderRadius: 16,
+          pl: 0.25,
+          pr: 0.25,
+        }}
+      >
+        <IconButton
+          size="small"
+          aria-label={`Drag ${name}`}
+          disabled={disabled}
+          sx={{ cursor: disabled ? 'not-allowed' : 'grab', p: 0.25 }}
+          {...attributes}
+          {...listeners}
+        >
+          <DragIndicatorIcon fontSize="small" />
+        </IconButton>
+        <Chip
+          component="span"
+          size="small"
+          variant="outlined"
+          label={name}
+          sx={{ border: 'none' }}
+        />
+        <IconButton
+          size="small"
+          aria-label={`Remove ${name}`}
+          disabled={disabled}
+          onClick={() => onRemove(index)}
+          sx={{ p: 0.25 }}
+        >
+          <CloseIcon fontSize="small" />
+        </IconButton>
+      </Box>
+      {!isLast && (
+        <Typography component="span" variant="body2" aria-hidden>
+          →
+        </Typography>
+      )}
+    </Box>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/ChainBuilder/index.ts b/ui/packages/sep/framework/src/components/ChainBuilder/index.ts
new file mode 100644
index 00000000000..a55cdd73591
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ChainBuilder/index.ts
@@ -0,0 +1,23 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { ChainBuilder } from './ChainBuilder';
+export type {
+  ChainBuilderProps,
+  ChainValue,
+  AvailableTask,
+} from './ChainBuilder';
diff --git a/ui/packages/sep/framework/src/components/FreeSoloSelect/FreeSoloSelect.test.tsx b/ui/packages/sep/framework/src/components/FreeSoloSelect/FreeSoloSelect.test.tsx
new file mode 100644
index 00000000000..32d3d29bc37
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/FreeSoloSelect/FreeSoloSelect.test.tsx
@@ -0,0 +1,110 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { describe, expect, it } from 'vitest';
+import { FormProvider, useForm } from 'react-hook-form';
+import { FreeSoloSelect } from './FreeSoloSelect';
+import type { ReferenceOption } from './freeSoloValue';
+
+const OPTIONS: ReferenceOption[] = [
+  { id: 10, name: 'app_prod' },
+  { id: 11, name: 'analytics' },
+];
+
+const labelOf = (o: ReferenceOption) => o.name;
+
+function Harness({
+  defaultValue = '',
+  options = OPTIONS,
+}: {
+  defaultValue?: unknown;
+  options?: readonly ReferenceOption[];
+}) {
+  const methods = useForm({ defaultValues: { schema: defaultValue } });
+  return (
+    <FormProvider {...methods}>
+      <FreeSoloSelect<ReferenceOption>
+        name="schema"
+        label="Schema"
+        options={options}
+        getOptionLabel={labelOf}
+      />
+      <output data-testid="value">
+        {JSON.stringify(methods.watch('schema'))}
+      </output>
+    </FormProvider>
+  );
+}
+
+const value = () => screen.getByTestId('value').textContent;
+
+describe('FreeSoloSelect', () => {
+  it('commits the inventory id when an option is picked', async () => {
+    const user = userEvent.setup();
+    render(<Harness />);
+    await user.click(screen.getByLabelText('Schema'));
+    await user.click(await screen.findByText('app_prod'));
+    expect(value()).toBe('10');
+  });
+
+  it('commits a string when a novel value is typed', async () => {
+    const user = userEvent.setup();
+    render(<Harness />);
+    await user.type(screen.getByLabelText('Schema'), 'custom_db');
+    expect(value()).toBe('"custom_db"');
+  });
+
+  it('resolves a typed value matching an existing option to its id', async () => {
+    const user = userEvent.setup();
+    render(<Harness />);
+    await user.type(screen.getByLabelText('Schema'), 'analytics');
+    expect(value()).toBe('11');
+  });
+
+  it('yields an empty value when cleared', async () => {
+    const user = userEvent.setup();
+    render(<Harness defaultValue={10} />);
+    await user.click(screen.getByLabelText('Clear'));
+    expect(value()).toBe('null');
+  });
+
+  it('renders a typed (non-inventory) value distinctly in the dropdown', async () => {
+    const user = userEvent.setup();
+    render(<Harness />);
+    await user.type(screen.getByLabelText('Schema'), 'brand_new');
+    const suggestion = await screen.findByText('brand_new');
+    expect(suggestion.tagName).toBe('EM');
+  });
+
+  it('round-trips a prefilled inventory id to its option label', () => {
+    render(<Harness defaultValue={11} />);
+    expect(screen.getByLabelText('Schema')).toHaveValue('analytics');
+  });
+
+  it('re-resolves a value typed before options loaded to its id once they arrive', async () => {
+    const user = userEvent.setup();
+    const { rerender } = render(<Harness options={[]} />);
+    // Type an exact label while options are still empty → commits as a string.
+    await user.type(screen.getByLabelText('Schema'), 'analytics');
+    expect(value()).toBe('"analytics"');
+    // Options arrive → the stored string resolves to the matching id.
+    rerender(<Harness options={OPTIONS} />);
+    await waitFor(() => expect(value()).toBe('11'));
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/FreeSoloSelect/FreeSoloSelect.tsx b/ui/packages/sep/framework/src/components/FreeSoloSelect/FreeSoloSelect.tsx
new file mode 100644
index 00000000000..d34582bdb83
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/FreeSoloSelect/FreeSoloSelect.tsx
@@ -0,0 +1,236 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useEffect, useMemo } from 'react';
+import {
+  useFormContext,
+  Controller,
+  type ControllerRenderProps,
+  type FieldError,
+  type FieldValues,
+} from 'react-hook-form';
+import Autocomplete, { createFilterOptions } from '@mui/material/Autocomplete';
+import Box from '@mui/material/Box';
+import CircularProgress from '@mui/material/CircularProgress';
+import TextField from '@mui/material/TextField';
+import {
+  toDisplayValue,
+  normalizeChange,
+  type ReferenceOption,
+  type FreeSoloDisplayValue,
+} from './freeSoloValue';
+
+export interface FreeSoloSelectProps<T extends ReferenceOption> {
+  /** react-hook-form field name. Stores `number | string | null` (an inventory id, a free-typed value, or unset). */
+  name: string;
+  label: string;
+  options: readonly T[];
+  /** Label shown for an inventory option (e.g. `name`, or `name (type)`). */
+  getOptionLabel: (option: T) => string;
+  required?: boolean;
+  disabled?: boolean;
+  loading?: boolean;
+  helperText?: string;
+  error?: boolean;
+  noOptionsText?: string;
+  onOpen?: () => void;
+}
+
+const isOptionEqualToValue = <T extends ReferenceOption>(
+  option: T | string,
+  value: T | string
+): boolean =>
+  typeof option !== 'string' &&
+  typeof value !== 'string' &&
+  option.id === value.id;
+
+/**
+ * Inner Autocomplete, split out so it can hold hooks (`useEffect`/`useMemo`)
+ * driven by the Controller's `field`.
+ */
+function FreeSoloAutocomplete<T extends ReferenceOption>({
+  field,
+  fieldError,
+  label,
+  options,
+  getOptionLabel,
+  required,
+  disabled,
+  loading,
+  helperText,
+  error,
+  noOptionsText,
+  onOpen,
+}: Omit<FreeSoloSelectProps<T>, 'name'> & {
+  field: ControllerRenderProps<FieldValues, string>;
+  fieldError?: FieldError;
+}) {
+  const filter = useMemo(() => createFilterOptions<T | string>(), []);
+
+  const labelOf = (option: T | string): string =>
+    typeof option === 'string' ? option : getOptionLabel(option);
+
+  // Resolve a stored free string to the matching option id once the options
+  // arrive, so it renders as the option label rather than raw text — regardless
+  // of load timing. Two cases resolve:
+  //   - an exact label match (a value typed before options loaded);
+  //   - a string that matches an option id (stringified numeric inventory ids
+  //     like `"4"`, or string host ids like `"nomad-1"`).
+  const { value: fieldValue, onChange } = field;
+  useEffect(() => {
+    if (typeof fieldValue === 'string' && fieldValue.trim() !== '') {
+      const trimmed = fieldValue.trim();
+      const labelMatch = options.find((o) => getOptionLabel(o) === trimmed);
+      if (labelMatch) {
+        onChange(labelMatch.id);
+        return;
+      }
+      const idMatch = options.find(
+        (o) => o.id === trimmed || String(o.id) === trimmed
+      );
+      if (idMatch) {
+        onChange(idMatch.id);
+      }
+    }
+    // Intentionally keyed on `options` only: re-resolve a stored string when the
+    // option set changes, without re-running on every keystroke.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [options]);
+
+  const value = toDisplayValue<T>(fieldValue, options);
+  const isCustomValue = typeof value === 'string';
+  const commit = (next: FreeSoloDisplayValue<T>) =>
+    onChange(normalizeChange<T>(next, options, getOptionLabel));
+
+  return (
+    <Autocomplete<T | string, false, false, true>
+      freeSolo
+      options={options as (T | string)[]}
+      value={value}
+      disabled={disabled}
+      loading={loading}
+      forcePopupIcon
+      // Keep freshly-typed text after blur so a custom value survives.
+      clearOnBlur={false}
+      selectOnFocus
+      handleHomeEndKeys
+      getOptionLabel={labelOf}
+      isOptionEqualToValue={isOptionEqualToValue}
+      noOptionsText={noOptionsText}
+      onOpen={onOpen}
+      data-testid={`${field.name}-autocomplete`}
+      filterOptions={(opts, params) => {
+        const filtered = filter(opts, params);
+        const input = params.inputValue.trim();
+        // Offer the typed text as a "create" suggestion unless it already
+        // matches an inventory option's label.
+        const exists = options.some((o) => getOptionLabel(o) === input);
+        if (input !== '' && !exists) {
+          filtered.push(input);
+        }
+        return filtered;
+      }}
+      renderOption={(props, option) => {
+        const { key, ...rest } = props as {
+          key?: string;
+        } & React.HTMLAttributes<HTMLLIElement>;
+        return typeof option === 'string' ? (
+          <Box component="li" key={key} {...rest} sx={{ fontStyle: 'italic' }}>
+            <em>{option}</em>
+          </Box>
+        ) : (
+          <Box component="li" key={key} {...rest}>
+            {getOptionLabel(option)}
+          </Box>
+        );
+      }}
+      onChange={(_event, next) => commit(next)}
+      onInputChange={(_event, input, reason) => {
+        // Live typing → commit as a custom value (or resolve to an id when it
+        // matches an option). 'reset' / 'clear' are selection-driven and handled
+        // by onChange, so ignore them here.
+        if (reason === 'input') {
+          commit(input);
+        }
+      }}
+      renderInput={(params) => (
+        <TextField
+          {...params}
+          inputRef={field.ref}
+          onBlur={field.onBlur}
+          label={label}
+          required={required}
+          error={error || !!fieldError}
+          helperText={fieldError ? fieldError.message : helperText}
+          size="small"
+          inputProps={{
+            ...params.inputProps,
+            style: isCustomValue ? { fontStyle: 'italic' } : undefined,
+          }}
+          InputProps={{
+            ...params.InputProps,
+            endAdornment: (
+              <>
+                {loading ? (
+                  <CircularProgress color="inherit" size={20} />
+                ) : null}
+                {params.InputProps.endAdornment}
+              </>
+            ),
+          }}
+        />
+      )}
+    />
+  );
+}
+
+/**
+ * Free-solo (`allow_custom`) variant of a reference selector: a single
+ * MUI Autocomplete combo that lets the user pick an inventory option or type a
+ * new value. Picking an option (or typing an exact label match) commits the
+ * inventory **id**; typing a novel value commits the **string**; clearing
+ * commits `null`.
+ *
+ * The committed value round-trips through react-hook-form so the conditional
+ * and validation engines keep firing, and `coerceFormValues` passes the scalar
+ * through unchanged on submit. A typed (non-inventory) value is rendered in
+ * italics — both as the create suggestion in the dropdown and in the input —
+ * so it reads as distinct from inventory options.
+ */
+export function FreeSoloSelect<T extends ReferenceOption>({
+  name,
+  required,
+  ...rest
+}: FreeSoloSelectProps<T>) {
+  const { control } = useFormContext();
+
+  return (
+    <Controller
+      name={name}
+      control={control}
+      rules={required ? { required: `${rest.label} is required` } : undefined}
+      render={({ field, fieldState: { error: fieldError } }) => (
+        <FreeSoloAutocomplete<T>
+          field={field}
+          fieldError={fieldError}
+          required={required}
+          {...rest}
+        />
+      )}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/FreeSoloSelect/freeSoloValue.test.ts b/ui/packages/sep/framework/src/components/FreeSoloSelect/freeSoloValue.test.ts
new file mode 100644
index 00000000000..61275eef672
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/FreeSoloSelect/freeSoloValue.test.ts
@@ -0,0 +1,106 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, expect, it } from 'vitest';
+import {
+  normalizeChange,
+  toDisplayValue,
+  type ReferenceOption,
+} from './freeSoloValue';
+
+const OPTIONS: ReferenceOption[] = [
+  { id: 10, name: 'app_prod' },
+  { id: 11, name: 'analytics' },
+];
+
+const labelOf = (o: ReferenceOption) => o.name;
+
+describe('toDisplayValue', () => {
+  it('resolves a stored numeric id to its option', () => {
+    expect(toDisplayValue(10, OPTIONS)).toEqual({ id: 10, name: 'app_prod' });
+  });
+
+  it('shows nothing for an id whose option has not loaded yet', () => {
+    expect(toDisplayValue(99, OPTIONS)).toBeNull();
+    expect(toDisplayValue(10, [])).toBeNull();
+  });
+
+  it('shows a stored free string verbatim when it matches no option id', () => {
+    expect(toDisplayValue('custom_db', OPTIONS)).toBe('custom_db');
+  });
+
+  it('resolves a stored string that matches an option id to that option', () => {
+    expect(toDisplayValue('10', OPTIONS)).toEqual({ id: 10, name: 'app_prod' });
+  });
+
+  it('resolves a stored string host id to its option', () => {
+    const hosts: ReferenceOption[] = [
+      { id: 'nomad-1', name: 'db-mysql-prod-01' },
+      { id: 'nomad-2', name: 'db-mysql-prod-02' },
+    ];
+    expect(toDisplayValue('nomad-1', hosts)).toEqual({
+      id: 'nomad-1',
+      name: 'db-mysql-prod-01',
+    });
+  });
+
+  it('resolves a stored option object (back-compat) to the matching option', () => {
+    expect(toDisplayValue({ id: 11, name: 'analytics' }, OPTIONS)).toEqual({
+      id: 11,
+      name: 'analytics',
+    });
+  });
+
+  it('treats empty / null / undefined as no value', () => {
+    expect(toDisplayValue('', OPTIONS)).toBeNull();
+    expect(toDisplayValue(null, OPTIONS)).toBeNull();
+    expect(toDisplayValue(undefined, OPTIONS)).toBeNull();
+  });
+
+  it('keeps a numeric-looking custom string as a string when no option has that id', () => {
+    expect(toDisplayValue('123', OPTIONS)).toBe('123');
+  });
+});
+
+describe('normalizeChange', () => {
+  it('commits the id when an option object is picked', () => {
+    expect(
+      normalizeChange({ id: 10, name: 'app_prod' }, OPTIONS, labelOf)
+    ).toBe(10);
+  });
+
+  it('commits a string host id when a host option is picked', () => {
+    const hosts: ReferenceOption[] = [
+      { id: 'nomad-1', name: 'db-mysql-prod-01' },
+    ];
+    expect(normalizeChange(hosts[0], hosts, labelOf)).toBe('nomad-1');
+  });
+
+  it('commits a string for a typed value with no matching option', () => {
+    expect(normalizeChange('brand_new', OPTIONS, labelOf)).toBe('brand_new');
+  });
+
+  it('resolves a typed value that matches an option label to the id', () => {
+    expect(normalizeChange('analytics', OPTIONS, labelOf)).toBe(11);
+  });
+
+  it('commits null when cleared or blank', () => {
+    expect(normalizeChange(null, OPTIONS, labelOf)).toBeNull();
+    expect(normalizeChange('   ', OPTIONS, labelOf)).toBeNull();
+    expect(normalizeChange('', OPTIONS, labelOf)).toBeNull();
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/FreeSoloSelect/freeSoloValue.ts b/ui/packages/sep/framework/src/components/FreeSoloSelect/freeSoloValue.ts
new file mode 100644
index 00000000000..f972a30e0c8
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/FreeSoloSelect/freeSoloValue.ts
@@ -0,0 +1,118 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/**
+ * Value normalization shared by the free-solo (`allow_custom`) path of the
+ * reference selectors (`SchemaSelector`, `TableSelector`, `ServiceSelector`,
+ * `HostSelector`).
+ *
+ * A free-solo reference field collapses "pick from inventory" and "type a new
+ * value" into one control. The committed react-hook-form value is an
+ * `int | str` (mirroring the backend `SchemaRef` / `HostRef(allow_custom=True)`
+ * contracts):
+ *   - an inventory pick — or a typed value that exactly matches an inventory
+ *     option's label — commits the inventory **id** (`number` for service /
+ *     schema / table, `string` for host);
+ *   - a typed value with no matching option commits the raw **string**;
+ *   - clearing the field commits `null`.
+ *
+ * `coerceFormValues` then passes a scalar `number`/`string` straight through on
+ * submit, so no extra serialisation step is needed.
+ */
+
+/** Minimal shape every reference option satisfies. */
+export interface ReferenceOption {
+  /** Inventory id — numeric for service/schema/table, string for host. */
+  id: number | string;
+  name: string;
+}
+
+/** The value MUI Autocomplete renders: an option object, a free string, or empty. */
+export type FreeSoloDisplayValue<T extends ReferenceOption> = T | string | null;
+
+/** The value committed to react-hook-form. */
+export type FreeSoloCommittedValue = number | string | null;
+
+/**
+ * Resolve the react-hook-form value into the value MUI Autocomplete should
+ * display.
+ *
+ *   - a `number` (inventory id) resolves to its matching option once the
+ *     options have loaded; until then it shows empty rather than a bare numeric
+ *     id (which would also mismatch `options` and trip an MUI warning);
+ *   - a non-empty `string` that matches an option's `id` (string host ids, or
+ *     a stringified numeric id) resolves to that option; otherwise it is shown
+ *     as a free-typed value;
+ *   - an option object (a back-compat / persisted shape) resolves to the
+ *     matching option, falling back to the object itself;
+ *   - `''` / `null` / `undefined` show as empty.
+ */
+export function toDisplayValue<T extends ReferenceOption>(
+  stored: unknown,
+  options: readonly T[]
+): FreeSoloDisplayValue<T> {
+  if (stored === null || stored === undefined || stored === '') {
+    return null;
+  }
+  if (typeof stored === 'number') {
+    return options.find((o) => o.id === stored) ?? null;
+  }
+  if (typeof stored === 'string') {
+    const idMatch = options.find(
+      (o) => o.id === stored || String(o.id) === stored
+    );
+    return idMatch ?? stored;
+  }
+  if (
+    typeof stored === 'object' &&
+    'id' in (stored as Record<string, unknown>)
+  ) {
+    const id = (stored as { id: unknown }).id;
+    return options.find((o) => o.id === id) ?? (stored as T);
+  }
+  return null;
+}
+
+/**
+ * Normalize the value emitted by MUI Autocomplete's `onChange` /
+ * `onInputChange` into the `int | str | null` committed to react-hook-form.
+ *
+ *   - clearing yields `null`;
+ *   - an option object yields its `id`;
+ *   - a typed string that exactly matches an option's label resolves to that
+ *     option's `id` (not the string);
+ *   - any other non-empty string is kept verbatim;
+ *   - a whitespace-only / empty string yields `null`.
+ */
+export function normalizeChange<T extends ReferenceOption>(
+  next: FreeSoloDisplayValue<T>,
+  options: readonly T[],
+  getOptionLabel: (option: T) => string
+): FreeSoloCommittedValue {
+  if (next === null) {
+    return null;
+  }
+  if (typeof next === 'object') {
+    return next.id;
+  }
+  const trimmed = next.trim();
+  if (trimmed === '') {
+    return null;
+  }
+  const match = options.find((o) => getOptionLabel(o) === trimmed);
+  return match ? match.id : trimmed;
+}
diff --git a/ui/packages/sep/framework/src/components/FreeSoloSelect/index.ts b/ui/packages/sep/framework/src/components/FreeSoloSelect/index.ts
new file mode 100644
index 00000000000..2f7d7d7f795
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/FreeSoloSelect/index.ts
@@ -0,0 +1,26 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { FreeSoloSelect } from './FreeSoloSelect';
+export type { FreeSoloSelectProps } from './FreeSoloSelect';
+export {
+  toDisplayValue,
+  normalizeChange,
+  type ReferenceOption,
+  type FreeSoloDisplayValue,
+  type FreeSoloCommittedValue,
+} from './freeSoloValue';
diff --git a/ui/packages/sep/framework/src/components/HostSelector/HostSelector.test.tsx b/ui/packages/sep/framework/src/components/HostSelector/HostSelector.test.tsx
new file mode 100644
index 00000000000..522e0e0762f
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/HostSelector/HostSelector.test.tsx
@@ -0,0 +1,487 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { FormProvider, useForm } from 'react-hook-form';
+import { SnackbarProvider } from 'notistack';
+import type { PropsWithChildren } from 'react';
+import { HostSelector } from './HostSelector';
+import { SchemaFormRenderer } from '../SchemaFormRenderer';
+import type { FormSection } from '../SchemaFormRenderer/types';
+
+vi.mock('@sep/api', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@sep/api')>()),
+  apiClient: { get: vi.fn(), post: vi.fn() },
+}));
+import { ApiError, apiClient } from '@sep/api';
+const mocked = apiClient as unknown as { get: ReturnType<typeof vi.fn> };
+
+function makeResponse(
+  items: Array<{ id: string; name: string; address: string }>
+) {
+  return { data: items };
+}
+
+function makeClient() {
+  return new QueryClient({
+    defaultOptions: { queries: { retry: false, gcTime: 0, staleTime: 0 } },
+  });
+}
+
+function Harness() {
+  const methods = useForm({ defaultValues: { hostId: null } });
+  return (
+    <FormProvider {...methods}>
+      <HostSelector name="hostId" label="Host" />
+    </FormProvider>
+  );
+}
+
+function Wrapper({
+  children,
+  client,
+}: PropsWithChildren<{ client: QueryClient }>) {
+  return (
+    <QueryClientProvider client={client}>
+      <SnackbarProvider>{children}</SnackbarProvider>
+    </QueryClientProvider>
+  );
+}
+
+describe('HostSelector', () => {
+  beforeEach(() => {
+    mocked.get.mockReset();
+  });
+
+  it('fetches hosts via /api/sep/hosts/ and renders display names', async () => {
+    mocked.get.mockResolvedValueOnce(
+      makeResponse([
+        { id: 'nomad-1', name: 'db-mysql-prod-01', address: '10.0.0.1' },
+        { id: 'nomad-2', name: 'db-mysql-prod-02', address: '10.0.0.2' },
+      ])
+    );
+
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <Harness />
+      </Wrapper>
+    );
+
+    await waitFor(() => expect(mocked.get).toHaveBeenCalledWith('/sep/hosts/'));
+    expect(mocked.get).toHaveBeenCalledTimes(1);
+
+    const user = userEvent.setup();
+    await user.click(screen.getByLabelText('Host'));
+    expect(await screen.findByText('db-mysql-prod-01')).toBeInTheDocument();
+    expect(screen.getByText('db-mysql-prod-02')).toBeInTheDocument();
+  });
+
+  it('renders empty state when the endpoint returns no hosts', async () => {
+    mocked.get.mockResolvedValueOnce(makeResponse([]));
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <Harness />
+      </Wrapper>
+    );
+    // "No hosts available" appears in both the helperText and the
+    // dropdown's noOptionsText slot, so assert via findAllByText.
+    const matches = await screen.findAllByText('No hosts available');
+    expect(matches.length).toBeGreaterThanOrEqual(1);
+  });
+
+  it('renders error state but stays enabled when the endpoint rejects, so opening retries', async () => {
+    mocked.get.mockRejectedValueOnce(
+      new ApiError({ kind: 'http', status: 502, message: 'boom' })
+    );
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <Harness />
+      </Wrapper>
+    );
+    await screen.findByText('boom');
+    const input = screen.getByLabelText('Host');
+    // `onOpen` holds the only retry trigger, and a disabled Autocomplete never
+    // opens, so disabling here would wedge the field until the page remounts.
+    expect(input).not.toBeDisabled();
+
+    mocked.get.mockResolvedValueOnce(
+      makeResponse([
+        { id: 'nomad-1', name: 'db-mysql-prod-01', address: '10.0.0.1' },
+      ])
+    );
+    const user = userEvent.setup();
+    await user.click(input);
+
+    expect(await screen.findByText('db-mysql-prod-01')).toBeInTheDocument();
+  });
+
+  it('shows a loading message before the endpoint resolves', async () => {
+    let resolveFetch!: (value: unknown) => void;
+    mocked.get.mockReturnValueOnce(
+      new Promise((resolve) => {
+        resolveFetch = resolve;
+      })
+    );
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <Harness />
+      </Wrapper>
+    );
+
+    const user = userEvent.setup();
+    await user.click(screen.getByLabelText('Host'));
+    expect(await screen.findByText('Loading hosts…')).toBeInTheDocument();
+
+    resolveFetch(makeResponse([]));
+    // After resolution the empty-state text appears in both the helperText
+    // and the dropdown's noOptionsText slot — match either.
+    const matches = await screen.findAllByText('No hosts available');
+    expect(matches.length).toBeGreaterThanOrEqual(1);
+  });
+
+  it('unwraps the selected option to the scalar id when submitting through SchemaFormRenderer', async () => {
+    mocked.get.mockResolvedValue(
+      makeResponse([
+        { id: 'nomad-1', name: 'db-mysql-prod-01', address: '10.0.0.1' },
+      ])
+    );
+
+    const onSubmit = vi.fn();
+    const sections: FormSection[] = [
+      {
+        title: 'Target',
+        fields: [
+          { type: 'host', name: 'hostId', label: 'Host', required: true },
+        ],
+      },
+    ];
+
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <SchemaFormRenderer sections={sections} onSubmit={onSubmit} />
+      </Wrapper>
+    );
+
+    await waitFor(() => expect(mocked.get).toHaveBeenCalledWith('/sep/hosts/'));
+
+    const user = userEvent.setup();
+    // `required: true` adds a trailing "*" to the rendered MUI label, so match by prefix.
+    await user.click(screen.getByLabelText(/^Host\b/));
+    const option = await screen.findByRole('option', {
+      name: 'db-mysql-prod-01',
+    });
+    await user.click(option);
+
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+
+    await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+    expect(onSubmit).toHaveBeenCalledWith(
+      expect.objectContaining({ hostId: 'nomad-1' })
+    );
+  });
+
+  it('refetches /api/sep/hosts/ when the dropdown is opened', async () => {
+    const hosts = [
+      { id: 'nomad-1', name: 'db-mysql-prod-01', address: '10.0.0.1' },
+    ];
+    mocked.get.mockResolvedValue(makeResponse(hosts));
+
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <Harness />
+      </Wrapper>
+    );
+
+    await waitFor(() => expect(mocked.get).toHaveBeenCalledTimes(1));
+
+    const user = userEvent.setup();
+    await user.click(screen.getByLabelText('Host'));
+
+    await waitFor(() => expect(mocked.get).toHaveBeenCalledTimes(2));
+  });
+
+  it('raises a snackbar when the hosts query fails with an upstream error', async () => {
+    mocked.get.mockRejectedValueOnce(
+      new ApiError({ kind: 'http', status: 502, message: 'tasks unreachable' })
+    );
+
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <Harness />
+      </Wrapper>
+    );
+
+    expect(
+      await screen.findByText(
+        /Failed to load executor hosts: tasks unreachable/
+      )
+    ).toBeInTheDocument();
+  });
+
+  describe('allow_custom (free-solo)', () => {
+    function CustomProbe() {
+      const methods = useForm<{ host: unknown }>({
+        defaultValues: { host: null },
+      });
+      return (
+        <FormProvider {...methods}>
+          <HostSelector name="host" label="Host" allowCustom />
+          <output data-testid="host-value">
+            {JSON.stringify(methods.watch('host'))}
+          </output>
+        </FormProvider>
+      );
+    }
+
+    const value = () => screen.getByTestId('host-value').textContent;
+
+    it('commits the host id when a host is picked', async () => {
+      mocked.get.mockResolvedValueOnce(
+        makeResponse([
+          { id: 'nomad-1', name: 'db-mysql-prod-01', address: '10.0.0.1' },
+          { id: 'nomad-2', name: 'db-mysql-prod-02', address: '10.0.0.2' },
+        ])
+      );
+      const client = makeClient();
+      const user = userEvent.setup();
+      render(
+        <Wrapper client={client}>
+          <CustomProbe />
+        </Wrapper>
+      );
+      await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+      await user.click(screen.getByLabelText('Host'));
+      await user.click(await screen.findByText('db-mysql-prod-01'));
+      expect(value()).toBe('"nomad-1"');
+    });
+
+    it('commits a typed value as a string', async () => {
+      mocked.get.mockResolvedValueOnce(
+        makeResponse([
+          { id: 'nomad-1', name: 'db-mysql-prod-01', address: '10.0.0.1' },
+        ])
+      );
+      const client = makeClient();
+      const user = userEvent.setup();
+      render(
+        <Wrapper client={client}>
+          <CustomProbe />
+        </Wrapper>
+      );
+      await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+      await user.type(screen.getByLabelText('Host'), 'custom-executor');
+      expect(value()).toBe('"custom-executor"');
+    });
+
+    it('back-compat: without allowCustom a typed value is not committed', async () => {
+      mocked.get.mockResolvedValueOnce(
+        makeResponse([
+          { id: 'nomad-1', name: 'db-mysql-prod-01', address: '10.0.0.1' },
+        ])
+      );
+      const client = makeClient();
+      const user = userEvent.setup();
+      function Probe() {
+        const methods = useForm<{ host: unknown }>({
+          defaultValues: { host: null },
+        });
+        return (
+          <FormProvider {...methods}>
+            <HostSelector name="host" label="Host" />
+            <output data-testid="bc-value">
+              {JSON.stringify(methods.watch('host'))}
+            </output>
+          </FormProvider>
+        );
+      }
+      render(
+        <Wrapper client={client}>
+          <Probe />
+        </Wrapper>
+      );
+      await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+      await user.type(screen.getByLabelText('Host'), 'custom-executor');
+      expect(screen.getByTestId('bc-value').textContent).toBe('null');
+    });
+
+    it('unwraps a free-typed host through SchemaFormRenderer submit', async () => {
+      mocked.get.mockResolvedValue(
+        makeResponse([
+          { id: 'nomad-1', name: 'db-mysql-prod-01', address: '10.0.0.1' },
+        ])
+      );
+
+      const onSubmit = vi.fn();
+      const sections: FormSection[] = [
+        {
+          title: 'Target',
+          fields: [
+            {
+              type: 'host',
+              name: 'hostId',
+              label: 'Host',
+              required: true,
+              allow_custom: true,
+            },
+          ],
+        },
+      ];
+
+      const client = makeClient();
+      render(
+        <Wrapper client={client}>
+          <SchemaFormRenderer sections={sections} onSubmit={onSubmit} />
+        </Wrapper>
+      );
+
+      await waitFor(() =>
+        expect(mocked.get).toHaveBeenCalledWith('/sep/hosts/')
+      );
+
+      const user = userEvent.setup();
+      await user.type(screen.getByLabelText(/^Host\b/), 'custom-executor');
+      await user.click(screen.getByRole('button', { name: /Run/ }));
+
+      await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+      expect(onSubmit).toHaveBeenCalledWith(
+        expect.objectContaining({ hostId: 'custom-executor' })
+      );
+    });
+
+    it('cascade auto-select commits a scalar host id when allowCustom is set', async () => {
+      mocked.get.mockImplementation((url: string) => {
+        if (url === '/sep/hosts/') {
+          return Promise.resolve(
+            makeResponse([
+              { id: 'node-a', name: 'Display A', address: '10.0.0.1' },
+              { id: 'node-b', name: 'Display B', address: '10.0.0.2' },
+            ])
+          );
+        }
+        if (url === '/sep/services/') {
+          return Promise.resolve({
+            data: {
+              items: [
+                {
+                  id: 7,
+                  name: 'mongo-svc',
+                  type: 'mongodb',
+                  node: {
+                    name: 'node-b',
+                    address: '10.0.0.2',
+                    type: 'generic',
+                  },
+                  node_id: 1,
+                  schemas: [],
+                },
+              ],
+              total: 1,
+              offset: 0,
+              limit: 200,
+            },
+          });
+        }
+        return Promise.reject(new Error(`unexpected url ${url}`));
+      });
+
+      const onSubmit = vi.fn();
+      const sections: FormSection[] = [
+        {
+          title: 'Task',
+          fields: [
+            {
+              type: 'service',
+              name: 'service_id',
+              label: 'Database Service',
+              required: true,
+              service_types: ['mongodb'],
+            },
+            {
+              type: 'host',
+              name: 'hostname',
+              label: 'Execution Host',
+              required: true,
+              depends_on: 'service_id',
+              allow_custom: true,
+            },
+          ],
+        },
+      ];
+
+      const client = makeClient();
+      render(
+        <Wrapper client={client}>
+          <SchemaFormRenderer sections={sections} onSubmit={onSubmit} />
+        </Wrapper>
+      );
+
+      await waitFor(() =>
+        expect(mocked.get).toHaveBeenCalledWith('/sep/hosts/')
+      );
+
+      const user = userEvent.setup();
+      await user.click(screen.getByLabelText(/^Database Service\b/));
+      await user.click(
+        await screen.findByRole('option', { name: 'mongo-svc (mongodb)' })
+      );
+
+      await waitFor(() => {
+        expect(screen.getByLabelText(/^Execution Host\b/)).toHaveValue(
+          'Display B'
+        );
+      });
+
+      await user.click(screen.getByRole('button', { name: /Run/ }));
+      await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+      expect(onSubmit).toHaveBeenCalledWith(
+        expect.objectContaining({ hostname: 'node-b', service_id: 7 })
+      );
+    });
+
+    it('refetches /api/sep/hosts/ when the free-solo dropdown is opened', async () => {
+      mocked.get.mockResolvedValue(
+        makeResponse([
+          { id: 'nomad-1', name: 'db-mysql-prod-01', address: '10.0.0.1' },
+        ])
+      );
+
+      const client = makeClient();
+      render(
+        <Wrapper client={client}>
+          <CustomProbe />
+        </Wrapper>
+      );
+
+      await waitFor(() => expect(mocked.get).toHaveBeenCalledTimes(1));
+
+      const user = userEvent.setup();
+      await user.click(screen.getByLabelText('Host'));
+
+      await waitFor(() => expect(mocked.get).toHaveBeenCalledTimes(2));
+    });
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/HostSelector/HostSelector.tsx b/ui/packages/sep/framework/src/components/HostSelector/HostSelector.tsx
new file mode 100644
index 00000000000..069cbc056dd
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/HostSelector/HostSelector.tsx
@@ -0,0 +1,254 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useEffect, useRef } from 'react';
+import { get, useFormContext } from 'react-hook-form';
+import { AutoCompleteInput } from '@percona/percona-ui';
+import { useSnackbar } from 'notistack';
+import { useHosts, type HostOption } from '../../hooks/useHosts';
+import { useResolvedServiceField } from '../../hooks/useResolvedServiceField';
+import type { ServiceType } from '../../hooks/useServices';
+import { FreeSoloSelect } from '../FreeSoloSelect';
+import { resolveExecutorHostForService } from './resolveExecutorHostForService';
+
+const EMPTY_OPTIONS: HostOption[] = [];
+
+export interface HostSelectorProps {
+  /**
+   * react-hook-form field name. Without `allowCustom`, stores a
+   * `HostOption | null`; with `allowCustom`, stores the committed
+   * `string | null` (executor id, free-typed value, or unset).
+   */
+  name: string;
+  label: string;
+  required?: boolean;
+  disabled?: boolean;
+  helperText?: string;
+  /**
+   * Optional upstream service field. When set, the selector clears on service
+   * change and auto-selects an executor using the resolve order
+   * (node name → address → service name). The user may still override.
+   */
+  dependsOn?: string;
+  /**
+   * When resolving a scalar ``dependsOn`` id, bound the services fetch to these
+   * types (typically the parent ``ServiceField.service_types``). Omit only when
+   * the parent value is already a hydrated ``ServiceOption``; an unbound
+   * ``useServices()`` page-loop is intentionally not used here.
+   */
+  serviceTypes?: readonly ServiceType[];
+  /** Offer free-text (free-solo) entry alongside the inventory options. */
+  allowCustom?: boolean;
+}
+
+const getOptionLabel = (opt: HostOption | string) =>
+  typeof opt === 'string' ? opt : opt.name;
+
+const getHostOptionLabel = (opt: HostOption) => opt.name;
+
+const isOptionEqualToValue = (a: HostOption, b: HostOption) => a.id === b.id;
+
+function hostValueId(value: unknown): string | undefined {
+  if (value && typeof value === 'object' && 'id' in value) {
+    const id = (value as { id: unknown }).id;
+    return typeof id === 'string' || typeof id === 'number'
+      ? String(id)
+      : undefined;
+  }
+  if (typeof value === 'string' && value !== '') {
+    return value;
+  }
+  return undefined;
+}
+
+/**
+ * Cascade auto-select for a single host field. Mounted only when ``dependsOn``
+ * is set. Scalar parent ids rehydrate through {@link useResolvedServiceField}
+ * (same path as task-name suggestion and other service consumers).
+ *
+ * When ``allowCustom`` is set the free-solo path stores a scalar id/string, so
+ * cascade commits ``match.id``; otherwise it commits the hydrated
+ * ``HostOption`` expected by the closed ``AutoCompleteInput``.
+ */
+function HostServiceCascade({
+  name,
+  dependsOn,
+  hosts,
+  serviceTypes,
+  allowCustom,
+}: {
+  name: string;
+  dependsOn: string;
+  hosts: HostOption[];
+  serviceTypes?: readonly ServiceType[];
+  allowCustom: boolean;
+}) {
+  const { setValue, getValues } = useFormContext();
+  const { service, resetKey } = useResolvedServiceField(
+    dependsOn,
+    serviceTypes
+  );
+  const prevParentKeyRef = useRef<string | undefined>(undefined);
+  const autoHostIdRef = useRef<string | undefined>(undefined);
+
+  useEffect(() => {
+    if (prevParentKeyRef.current === undefined) {
+      prevParentKeyRef.current = resetKey;
+    } else if (prevParentKeyRef.current !== resetKey) {
+      prevParentKeyRef.current = resetKey;
+      setValue(name, null, { shouldDirty: false, shouldValidate: false });
+      autoHostIdRef.current = undefined;
+    }
+
+    if (!service || hosts.length === 0) {
+      return;
+    }
+
+    const match = resolveExecutorHostForService(hosts, service);
+    if (!match) {
+      return;
+    }
+
+    const currentId = hostValueId(getValues(name));
+    if (currentId === undefined || currentId === autoHostIdRef.current) {
+      setValue(name, allowCustom ? match.id : match, {
+        shouldDirty: false,
+        shouldValidate: false,
+      });
+      autoHostIdRef.current = match.id;
+    }
+  }, [resetKey, service, hosts, name, setValue, getValues, allowCustom]);
+
+  return null;
+}
+
+export function HostSelector({
+  name,
+  label,
+  required,
+  disabled,
+  helperText,
+  dependsOn,
+  serviceTypes,
+  allowCustom,
+}: HostSelectorProps) {
+  const {
+    control,
+    formState: { errors },
+  } = useFormContext();
+  const { enqueueSnackbar } = useSnackbar();
+
+  const { data, isLoading, isError, error, refetch } = useHosts();
+  const hosts = data ?? EMPTY_OPTIONS;
+
+  const empty = !isLoading && !isError && hosts.length === 0;
+
+  // Path-aware: a one-of branch field carries a dotted name (`source.host`),
+  // which `errors[name]` would never resolve.
+  const fieldError = get(errors, name)?.message as string | undefined;
+
+  // Surface a hosts-query failure (e.g. an upstream Tasks-API 502) via the
+  // shell's snackbar. React Query keeps the `error` object identity stable
+  // between renders until the next refetch, so de-dup on that identity to
+  // raise the snackbar once per failure rather than once per render.
+  const lastSurfacedRef = useRef<unknown>(null);
+  useEffect(() => {
+    if (isError && error && error !== lastSurfacedRef.current) {
+      enqueueSnackbar(`Failed to load executor hosts: ${error.message}`, {
+        variant: 'error',
+        autoHideDuration: 30_000,
+      });
+      lastSurfacedRef.current = error;
+    }
+  }, [isError, error, enqueueSnackbar]);
+
+  let text = helperText;
+  if (fieldError) {
+    text = fieldError;
+  } else if (isError) {
+    text = error?.message ?? 'Failed to load hosts';
+  } else if (empty) {
+    text = 'No hosts available';
+  }
+
+  const freeSolo = !!allowCustom;
+  const noOptionsText = isLoading ? 'Loading hosts…' : 'No hosts available';
+
+  // A failed hosts query does not disable either control below: `onOpen` holds
+  // the only `refetch()` trigger and a disabled Autocomplete never opens, so
+  // one failure would wedge the field until the page remounts. The error stays
+  // visible through `text` / the snackbar. Same reasoning as
+  // StandaloneHostSelector.
+
+  const cascade = dependsOn ? (
+    <HostServiceCascade
+      name={name}
+      dependsOn={dependsOn}
+      hosts={hosts}
+      serviceTypes={serviceTypes}
+      allowCustom={freeSolo}
+    />
+  ) : null;
+
+  if (freeSolo) {
+    return (
+      <>
+        {cascade}
+        <FreeSoloSelect<HostOption>
+          name={name}
+          label={label}
+          options={hosts}
+          getOptionLabel={getHostOptionLabel}
+          required={required}
+          disabled={disabled}
+          loading={isLoading}
+          helperText={text}
+          error={isError || !!fieldError}
+          noOptionsText={noOptionsText}
+          onOpen={() => {
+            void refetch();
+          }}
+        />
+      </>
+    );
+  }
+
+  return (
+    <>
+      {cascade}
+      <AutoCompleteInput<HostOption>
+        name={name}
+        label={label}
+        control={control}
+        isRequired={required}
+        loading={isLoading}
+        disabled={disabled}
+        options={hosts}
+        controllerProps={{
+          rules: required ? { required: `${label} is required` } : undefined,
+        }}
+        autoCompleteProps={{
+          getOptionLabel,
+          isOptionEqualToValue,
+          noOptionsText,
+          onOpen: () => refetch(),
+        }}
+        textFieldProps={{ helperText: text, error: isError || !!fieldError }}
+      />
+    </>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/HostSelector/StandaloneHostSelector.test.tsx b/ui/packages/sep/framework/src/components/HostSelector/StandaloneHostSelector.test.tsx
new file mode 100644
index 00000000000..7d116a56805
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/HostSelector/StandaloneHostSelector.test.tsx
@@ -0,0 +1,224 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { SnackbarProvider } from 'notistack';
+import type { PropsWithChildren } from 'react';
+import { StandaloneHostSelector } from './StandaloneHostSelector';
+
+vi.mock('@sep/api', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@sep/api')>()),
+  apiClient: { get: vi.fn(), post: vi.fn() },
+}));
+import { ApiError, apiClient } from '@sep/api';
+
+const mocked = apiClient as unknown as { get: ReturnType<typeof vi.fn> };
+
+function makeResponse(
+  items: Array<{ id: string; name: string; address: string }>
+) {
+  return { data: items };
+}
+
+function makeClient() {
+  return new QueryClient({
+    defaultOptions: { queries: { retry: false, gcTime: 0, staleTime: 0 } },
+  });
+}
+
+function Wrapper({
+  children,
+  client,
+}: PropsWithChildren<{ client: QueryClient }>) {
+  return (
+    <QueryClientProvider client={client}>
+      <SnackbarProvider>{children}</SnackbarProvider>
+    </QueryClientProvider>
+  );
+}
+
+describe('StandaloneHostSelector', () => {
+  beforeEach(() => {
+    mocked.get.mockReset();
+  });
+
+  it('renders the label and calls onChange with host id on selection', async () => {
+    mocked.get.mockResolvedValueOnce(
+      makeResponse([
+        { id: 'nomad-1', name: 'db-mysql-prod-01', address: '10.0.0.1' },
+        { id: 'nomad-2', name: 'db-mysql-prod-02', address: '10.0.0.2' },
+      ])
+    );
+
+    const handleChange = vi.fn();
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <StandaloneHostSelector value="" onChange={handleChange} />
+      </Wrapper>
+    );
+
+    const user = userEvent.setup();
+    await user.click(screen.getByLabelText('Execution Host'));
+    await user.click(
+      await screen.findByRole('option', { name: 'db-mysql-prod-01' })
+    );
+
+    expect(handleChange).toHaveBeenCalledWith('nomad-1');
+  });
+
+  it('clears the selection by calling onChange with empty string when cleared', async () => {
+    mocked.get.mockResolvedValueOnce(
+      makeResponse([
+        { id: 'nomad-1', name: 'db-mysql-prod-01', address: '10.0.0.1' },
+      ])
+    );
+
+    const handleChange = vi.fn();
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <StandaloneHostSelector value="nomad-1" onChange={handleChange} />
+      </Wrapper>
+    );
+
+    await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+
+    const user = userEvent.setup();
+    const clearButton = await screen.findByTitle('Clear');
+    await user.click(clearButton);
+
+    expect(handleChange).toHaveBeenCalledWith('');
+  });
+
+  it('shows error text but stays enabled when the endpoint rejects, so opening retries', async () => {
+    mocked.get.mockRejectedValueOnce(
+      new ApiError({ kind: 'http', status: 502, message: 'network error' })
+    );
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <StandaloneHostSelector value="" onChange={vi.fn()} />
+      </Wrapper>
+    );
+
+    await screen.findByText('network error');
+    const input = screen.getByLabelText('Execution Host');
+    // `onOpen` holds the only retry trigger, so a disabled input would wedge the
+    // control until the page remounts.
+    expect(input).not.toBeDisabled();
+
+    mocked.get.mockResolvedValueOnce(
+      makeResponse([
+        { id: 'nomad-1', name: 'db-mysql-prod-01', address: '10.0.0.1' },
+      ])
+    );
+    const user = userEvent.setup();
+    await user.click(input);
+
+    expect(
+      await screen.findByRole('option', { name: 'db-mysql-prod-01' })
+    ).toBeInTheDocument();
+  });
+
+  it('surfaces upstream Tasks-API failure via snackbar', async () => {
+    mocked.get.mockRejectedValueOnce(
+      new ApiError({ kind: 'http', status: 502, message: 'tasks unreachable' })
+    );
+
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <StandaloneHostSelector value="" onChange={vi.fn()} />
+      </Wrapper>
+    );
+
+    expect(
+      await screen.findByText(
+        /Failed to load executor hosts: tasks unreachable/
+      )
+    ).toBeInTheDocument();
+  });
+
+  it('accepts a custom label', async () => {
+    mocked.get.mockResolvedValueOnce(makeResponse([]));
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <StandaloneHostSelector
+          value=""
+          onChange={vi.fn()}
+          label="Target Host"
+        />
+      </Wrapper>
+    );
+
+    expect(screen.getByLabelText('Target Host')).toBeInTheDocument();
+  });
+
+  it('shows "No hosts available" when the host list is empty', async () => {
+    mocked.get.mockResolvedValueOnce(makeResponse([]));
+    const client = makeClient();
+    const user = userEvent.setup();
+    render(
+      <Wrapper client={client}>
+        <StandaloneHostSelector value="" onChange={vi.fn()} />
+      </Wrapper>
+    );
+
+    await user.click(screen.getByLabelText('Execution Host'));
+    expect(await screen.findByText('No hosts available')).toBeInTheDocument();
+  });
+
+  it('refetches /api/sep/hosts/ when the dropdown is opened', async () => {
+    const hosts = [
+      { id: 'nomad-1', name: 'db-mysql-prod-01', address: '10.0.0.1' },
+    ];
+    mocked.get.mockResolvedValue(makeResponse(hosts));
+
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <StandaloneHostSelector value="" onChange={vi.fn()} />
+      </Wrapper>
+    );
+
+    await waitFor(() => expect(mocked.get).toHaveBeenCalledTimes(1));
+
+    const user = userEvent.setup();
+    await user.click(screen.getByLabelText('Execution Host'));
+
+    await waitFor(() => expect(mocked.get).toHaveBeenCalledTimes(2));
+  });
+
+  it('shows "Loading hosts…" while the host list is loading', async () => {
+    mocked.get.mockReturnValueOnce(new Promise(() => {}));
+    const client = makeClient();
+    const user = userEvent.setup();
+    render(
+      <Wrapper client={client}>
+        <StandaloneHostSelector value="" onChange={vi.fn()} />
+      </Wrapper>
+    );
+
+    await user.click(screen.getByLabelText('Execution Host'));
+    expect(await screen.findByText('Loading hosts…')).toBeInTheDocument();
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/HostSelector/StandaloneHostSelector.tsx b/ui/packages/sep/framework/src/components/HostSelector/StandaloneHostSelector.tsx
new file mode 100644
index 00000000000..e277d6400d7
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/HostSelector/StandaloneHostSelector.tsx
@@ -0,0 +1,96 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useEffect, useRef } from 'react';
+import { Autocomplete, TextField } from '@mui/material';
+import type { SxProps } from '@mui/material/styles';
+import { useSnackbar } from 'notistack';
+import { useHosts, type HostOption } from '../../hooks/useHosts';
+
+const EMPTY_OPTIONS: HostOption[] = [];
+
+type HostIdOption = { id: string; label: string };
+
+export interface StandaloneHostSelectorProps {
+  value: string;
+  onChange: (hostId: string) => void;
+  label?: string;
+  disabled?: boolean;
+  sx?: SxProps;
+}
+
+export function StandaloneHostSelector({
+  value,
+  onChange,
+  label = 'Execution Host',
+  disabled,
+  sx,
+}: StandaloneHostSelectorProps) {
+  const { enqueueSnackbar } = useSnackbar();
+  const { data, isLoading, isError, error, refetch } = useHosts();
+  const hosts = data ?? EMPTY_OPTIONS;
+
+  // Surface a hosts-query failure (e.g. an upstream Tasks-API 502) via the
+  // shell's snackbar. De-dup on the `error` object identity (stable per
+  // failure) so the snackbar fires once per failure, not once per render.
+  const lastSurfacedRef = useRef<unknown>(null);
+  useEffect(() => {
+    if (isError && error && error !== lastSurfacedRef.current) {
+      enqueueSnackbar(`Failed to load executor hosts: ${error.message}`, {
+        variant: 'error',
+        autoHideDuration: 30_000,
+      });
+      lastSurfacedRef.current = error;
+    }
+  }, [isError, error, enqueueSnackbar]);
+
+  const options: HostIdOption[] = hosts.map((h) => ({
+    id: h.id,
+    label: h.name,
+  }));
+  const selected = options.find((o) => o.id === value) ?? null;
+
+  return (
+    <Autocomplete<HostIdOption>
+      data-testid="host-selector"
+      options={options}
+      value={selected}
+      onChange={(_, opt) => onChange(opt?.id ?? '')}
+      onOpen={() => refetch()}
+      getOptionLabel={(o) => o.label}
+      isOptionEqualToValue={(a, b) => a.id === b.id}
+      loading={isLoading}
+      loadingText="Loading hosts…"
+      noOptionsText="No hosts available"
+      // Stays enabled on a failed hosts query: `onOpen` holds the only retry
+      // trigger, and a disabled Autocomplete never opens — one failure would
+      // otherwise wedge the control until the page remounts.
+      disabled={disabled}
+      renderInput={(params) => (
+        <TextField
+          {...params}
+          label={label}
+          error={isError}
+          helperText={
+            isError ? (error?.message ?? 'Failed to load hosts') : undefined
+          }
+        />
+      )}
+      sx={sx}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/HostSelector/index.ts b/ui/packages/sep/framework/src/components/HostSelector/index.ts
new file mode 100644
index 00000000000..4766fb658f7
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/HostSelector/index.ts
@@ -0,0 +1,23 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { HostSelector } from './HostSelector';
+export type { HostSelectorProps } from './HostSelector';
+export { StandaloneHostSelector } from './StandaloneHostSelector';
+export type { StandaloneHostSelectorProps } from './StandaloneHostSelector';
+export { resolveExecutorHostForService } from './resolveExecutorHostForService';
+export type { ServiceHostResolveInput } from './resolveExecutorHostForService';
diff --git a/ui/packages/sep/framework/src/components/HostSelector/resolveExecutorHostForService.ts b/ui/packages/sep/framework/src/components/HostSelector/resolveExecutorHostForService.ts
new file mode 100644
index 00000000000..3a8fae1dac2
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/HostSelector/resolveExecutorHostForService.ts
@@ -0,0 +1,62 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type { HostOption } from '../../hooks/useHosts';
+
+/** Minimal service shape needed to resolve an executor host. */
+export interface ServiceHostResolveInput {
+  name: string;
+  node?: { name: string; address: string } | null;
+}
+
+/**
+ * Resolve an executor host for an inventory service.
+ *
+ * Mirrors the backend ``resolve_executor_host_for_service`` order:
+ * 1. ``service.node.name`` against host ids (Nomad node names)
+ * 2. ``service.node.address`` against host addresses
+ * 3. ``service.name`` against host ids
+ * 4. ``undefined`` when nothing matches (caller leaves the field empty)
+ */
+export function resolveExecutorHostForService(
+  hosts: readonly HostOption[],
+  service: ServiceHostResolveInput
+): HostOption | undefined {
+  const byId = new Map(hosts.map((host) => [host.id, host]));
+
+  if (service.node?.name) {
+    const byName = byId.get(service.node.name);
+    if (byName) {
+      return byName;
+    }
+  }
+
+  if (service.node?.address) {
+    const byAddress = hosts.find(
+      (host) => host.address === service.node!.address
+    );
+    if (byAddress) {
+      return byAddress;
+    }
+  }
+
+  if (service.name) {
+    return byId.get(service.name);
+  }
+
+  return undefined;
+}
diff --git a/ui/packages/sep/framework/src/components/RemoteChoiceSelector/RemoteChoiceSelector.test.tsx b/ui/packages/sep/framework/src/components/RemoteChoiceSelector/RemoteChoiceSelector.test.tsx
new file mode 100644
index 00000000000..26185c5bd8e
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/RemoteChoiceSelector/RemoteChoiceSelector.test.tsx
@@ -0,0 +1,438 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { FormProvider, useForm } from 'react-hook-form';
+import type { PropsWithChildren } from 'react';
+import { RemoteChoiceSelector } from './RemoteChoiceSelector';
+
+vi.mock('@sep/api', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@sep/api')>()),
+  apiClient: { get: vi.fn(), post: vi.fn() },
+}));
+import { apiClient } from '@sep/api';
+const mocked = apiClient as unknown as { get: ReturnType<typeof vi.fn> };
+
+const OPTIONS = [
+  { value: 'backup-1', label: 'Backup 1' },
+  {
+    value: 'backup-2',
+    label: 'Backup 2',
+    disabled: true,
+    disabled_reason: 'In progress',
+  },
+];
+
+function makeClient() {
+  return new QueryClient({
+    defaultOptions: {
+      queries: { retry: false, retryDelay: 0, gcTime: 0, staleTime: 0 },
+    },
+  });
+}
+
+function Wrapper({
+  children,
+  client,
+}: PropsWithChildren<{ client: QueryClient }>) {
+  return <QueryClientProvider client={client}>{children}</QueryClientProvider>;
+}
+
+interface HarnessProps {
+  allowCustom?: boolean;
+  dependsOn?: string;
+  initialParent?: string | null;
+  initialBackup?: string | null;
+  required?: boolean;
+}
+
+function Harness({
+  allowCustom,
+  dependsOn,
+  initialParent = null,
+  initialBackup = null,
+  required,
+}: HarnessProps) {
+  const methods = useForm<{ cluster: string | null; backup: string | null }>({
+    defaultValues: { cluster: initialParent, backup: initialBackup },
+  });
+  const backup = methods.watch('backup');
+  return (
+    <FormProvider {...methods}>
+      <RemoteChoiceSelector
+        name="backup"
+        label="Backup"
+        required={required}
+        endpointUrl="/apps/restore/backups"
+        dependsOn={dependsOn}
+        allowCustom={allowCustom}
+      />
+      <div data-testid="value">{JSON.stringify(backup ?? null)}</div>
+      <div data-testid="error">
+        {methods.formState.errors.backup?.message ?? ''}
+      </div>
+      <button
+        type="button"
+        onClick={() => methods.setValue('cluster', 'cluster-b')}
+      >
+        change-parent
+      </button>
+      <button
+        type="button"
+        onClick={() => methods.setValue('cluster', 'cluster-a')}
+      >
+        set-parent
+      </button>
+      <button type="button" onClick={() => void methods.trigger('backup')}>
+        validate
+      </button>
+    </FormProvider>
+  );
+}
+
+beforeEach(() => {
+  mocked.get.mockReset();
+  mocked.get.mockResolvedValue({ data: OPTIONS });
+});
+
+describe('RemoteChoiceSelector', () => {
+  it('fetches and renders the Choice options', async () => {
+    const user = userEvent.setup();
+    render(
+      <Wrapper client={makeClient()}>
+        <Harness />
+      </Wrapper>
+    );
+    await waitFor(() =>
+      expect(mocked.get).toHaveBeenCalledWith('/apps/restore/backups')
+    );
+
+    await user.click(screen.getByRole('combobox'));
+    expect(await screen.findByText('Backup 1')).toBeInTheDocument();
+    expect(screen.getByText('Backup 2')).toBeInTheDocument();
+  });
+
+  it('commits the selected option value (a string) to the form', async () => {
+    const user = userEvent.setup();
+    render(
+      <Wrapper client={makeClient()}>
+        <Harness />
+      </Wrapper>
+    );
+    await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+
+    await user.click(screen.getByRole('combobox'));
+    await user.click(await screen.findByText('Backup 1'));
+
+    expect(screen.getByTestId('value')).toHaveTextContent('"backup-1"');
+  });
+
+  it('renders a disabled option non-selectable with its reason tooltip', async () => {
+    const user = userEvent.setup();
+    render(
+      <Wrapper client={makeClient()}>
+        <Harness />
+      </Wrapper>
+    );
+    await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+
+    await user.click(screen.getByRole('combobox'));
+    const disabledLabel = await screen.findByText('Backup 2');
+    expect(disabledLabel.closest('[role="option"]')).toHaveAttribute(
+      'aria-disabled',
+      'true'
+    );
+
+    await user.hover(disabledLabel);
+    await waitFor(() => {
+      expect(screen.getByRole('tooltip')).toHaveTextContent('In progress');
+    });
+  });
+
+  it('renders empty-state helper text when the endpoint returns no options', async () => {
+    mocked.get.mockResolvedValue({ data: [] });
+    render(
+      <Wrapper client={makeClient()}>
+        <Harness />
+      </Wrapper>
+    );
+    await waitFor(() =>
+      expect(screen.getByText('No options available')).toBeInTheDocument()
+    );
+  });
+
+  it('renders defensively when the endpoint returns a malformed (non-Choice) item', async () => {
+    mocked.get.mockResolvedValue({
+      data: [{ foo: 1 } as unknown as (typeof OPTIONS)[number]],
+    });
+    const user = userEvent.setup();
+    render(
+      <Wrapper client={makeClient()}>
+        <Harness />
+      </Wrapper>
+    );
+    await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+    // Opening the dropdown must not crash on an item missing value/label.
+    await user.click(screen.getByRole('combobox'));
+    expect(screen.getByRole('combobox')).toBeInTheDocument();
+  });
+
+  it('collapses a stored value with no matching option to empty in select mode', async () => {
+    render(
+      <Wrapper client={makeClient()}>
+        <Harness initialBackup="ghost-value" />
+      </Wrapper>
+    );
+    await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+    // Non-freeSolo MUI would warn on a bare string value; the input resolves to
+    // empty rather than echoing the unmatched string.
+    expect(screen.getByRole('combobox')).toHaveValue('');
+  });
+
+  it('surfaces an error-state helper text when the fetch fails', async () => {
+    mocked.get.mockRejectedValue(new Error('boom'));
+    render(
+      <Wrapper client={makeClient()}>
+        <Harness />
+      </Wrapper>
+    );
+    await waitFor(() => expect(screen.getByText('boom')).toBeInTheDocument());
+  });
+
+  describe('cascade', () => {
+    it('is disabled and skips the fetch until the parent has a value', async () => {
+      render(
+        <Wrapper client={makeClient()}>
+          <Harness dependsOn="cluster" initialParent={null} />
+        </Wrapper>
+      );
+      expect(screen.getByLabelText('Backup')).toBeDisabled();
+      expect(screen.getByText('Select a value first')).toBeInTheDocument();
+      expect(mocked.get).not.toHaveBeenCalled();
+    });
+
+    it('fetches with the parent value as a query param once the parent is set', async () => {
+      render(
+        <Wrapper client={makeClient()}>
+          <Harness dependsOn="cluster" initialParent="cluster-a" />
+        </Wrapper>
+      );
+      await waitFor(() =>
+        expect(mocked.get).toHaveBeenCalledWith(
+          '/apps/restore/backups?cluster=cluster-a'
+        )
+      );
+      expect(screen.getByLabelText('Backup')).not.toBeDisabled();
+    });
+
+    it('treats a plain string-valued parent as present (not missing)', async () => {
+      render(
+        <Wrapper client={makeClient()}>
+          <Harness dependsOn="cluster" initialParent="cluster-a" />
+        </Wrapper>
+      );
+      // A string parent must not read as `isMissing`: the field enables and fetches.
+      await waitFor(() =>
+        expect(mocked.get).toHaveBeenCalledWith(
+          '/apps/restore/backups?cluster=cluster-a'
+        )
+      );
+      expect(
+        screen.queryByText('Select a value first')
+      ).not.toBeInTheDocument();
+    });
+
+    it('resets the child value when the parent value changes', async () => {
+      const user = userEvent.setup();
+      render(
+        <Wrapper client={makeClient()}>
+          <Harness
+            dependsOn="cluster"
+            initialParent="cluster-a"
+            initialBackup="backup-1"
+          />
+        </Wrapper>
+      );
+      await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+      expect(screen.getByTestId('value')).toHaveTextContent('"backup-1"');
+
+      await user.click(screen.getByRole('button', { name: 'change-parent' }));
+      await waitFor(() =>
+        expect(screen.getByTestId('value')).toHaveTextContent('null')
+      );
+    });
+
+    it('keeps a free-typed value when the cascade parent is set afterwards', async () => {
+      // Selecting the parent used to wipe backup_source, so Create submitted ""
+      // and the backend answered 422 NonEmptyStr even though the input still
+      // looked filled.
+      const user = userEvent.setup();
+      render(
+        <Wrapper client={makeClient()}>
+          <Harness dependsOn="cluster" initialParent={null} allowCustom />
+        </Wrapper>
+      );
+      await user.type(screen.getByLabelText('Backup'), '/');
+      await waitFor(() =>
+        expect(screen.getByTestId('value')).toHaveTextContent('"/"')
+      );
+
+      await user.click(screen.getByRole('button', { name: 'set-parent' }));
+      await waitFor(() =>
+        expect(mocked.get).toHaveBeenCalledWith(
+          '/apps/restore/backups?cluster=cluster-a'
+        )
+      );
+      expect(screen.getByTestId('value')).toHaveTextContent('"/"');
+    });
+
+    it('stays typable with free-text entry while the parent has no value', async () => {
+      // Options need the parent, but a free-typed value never does: disabling the
+      // input would make a required allow_custom field unfillable (and push the
+      // keystrokes into whichever field still holds focus).
+      const user = userEvent.setup();
+      render(
+        <Wrapper client={makeClient()}>
+          <Harness dependsOn="cluster" initialParent={null} allowCustom />
+        </Wrapper>
+      );
+      const input = screen.getByLabelText('Backup');
+      expect(input).not.toBeDisabled();
+      expect(mocked.get).not.toHaveBeenCalled();
+
+      await user.type(input, '/backups/mydumper/latest');
+      await waitFor(() =>
+        expect(screen.getByTestId('value')).toHaveTextContent(
+          '"/backups/mydumper/latest"'
+        )
+      );
+    });
+
+    it('stays typable with free-text entry when the options fetch fails', async () => {
+      mocked.get.mockRejectedValue(new Error('boom'));
+      const user = userEvent.setup();
+      render(
+        <Wrapper client={makeClient()}>
+          <Harness dependsOn="cluster" initialParent="cluster-a" allowCustom />
+        </Wrapper>
+      );
+      await waitFor(() => expect(screen.getByText('boom')).toBeInTheDocument());
+
+      const input = screen.getByLabelText('Backup');
+      expect(input).not.toBeDisabled();
+      await user.type(input, '/backups/mydumper/latest');
+      await waitFor(() =>
+        expect(screen.getByTestId('value')).toHaveTextContent(
+          '"/backups/mydumper/latest"'
+        )
+      );
+    });
+  });
+
+  describe('allow_custom', () => {
+    it('commits a free-typed value verbatim as a string', async () => {
+      const user = userEvent.setup();
+      render(
+        <Wrapper client={makeClient()}>
+          <Harness allowCustom />
+        </Wrapper>
+      );
+      await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+
+      await user.type(screen.getByRole('combobox'), 'my-custom-backup');
+      await waitFor(() =>
+        expect(screen.getByTestId('value')).toHaveTextContent(
+          '"my-custom-backup"'
+        )
+      );
+    });
+
+    it('displays a persisted custom value with no matching option', async () => {
+      render(
+        <Wrapper client={makeClient()}>
+          <Harness allowCustom initialBackup="ghost-value" />
+        </Wrapper>
+      );
+      await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+      // free-solo keeps the unmatched string (contrast with the select-mode case).
+      expect(screen.getByRole('combobox')).toHaveValue('ghost-value');
+    });
+
+    it('rejects typed whitespace-only input when required', async () => {
+      const user = userEvent.setup();
+      render(
+        <Wrapper client={makeClient()}>
+          <Harness allowCustom required />
+        </Wrapper>
+      );
+      await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+
+      await user.type(screen.getByRole('combobox'), '   ');
+      await user.click(screen.getByRole('button', { name: 'validate' }));
+      await waitFor(() =>
+        expect(screen.getByTestId('error')).toHaveTextContent(
+          'Backup is required'
+        )
+      );
+    });
+
+    it('rejects a whitespace-only value loaded into the field when required', async () => {
+      // normalizeChange collapses typed whitespace to null, so only a value
+      // arriving from defaultValues/setValue reaches the validator's trim check.
+      const user = userEvent.setup();
+      render(
+        <Wrapper client={makeClient()}>
+          <Harness allowCustom required initialBackup="   " />
+        </Wrapper>
+      );
+      await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+
+      await user.click(screen.getByRole('button', { name: 'validate' }));
+      await waitFor(() =>
+        expect(screen.getByTestId('error')).toHaveTextContent(
+          'Backup is required'
+        )
+      );
+    });
+
+    it('keeps a disabled option label as free text across a parent change', async () => {
+      // Typing a disabled option's label must not be classified as an option pick,
+      // or the next cascade-parent change would wipe a value normalizeChange left
+      // as verbatim free text.
+      const user = userEvent.setup();
+      render(
+        <Wrapper client={makeClient()}>
+          <Harness dependsOn="cluster" initialParent="cluster-a" allowCustom />
+        </Wrapper>
+      );
+      await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+
+      await user.type(screen.getByRole('combobox'), 'Backup 2');
+      await waitFor(() =>
+        expect(screen.getByTestId('value')).toHaveTextContent('"Backup 2"')
+      );
+
+      await user.click(screen.getByRole('button', { name: 'change-parent' }));
+      await waitFor(() =>
+        expect(screen.getByTestId('value')).toHaveTextContent('"Backup 2"')
+      );
+    });
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/RemoteChoiceSelector/RemoteChoiceSelector.tsx b/ui/packages/sep/framework/src/components/RemoteChoiceSelector/RemoteChoiceSelector.tsx
new file mode 100644
index 00000000000..33beaaafa40
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/RemoteChoiceSelector/RemoteChoiceSelector.tsx
@@ -0,0 +1,359 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useEffect, useMemo, useRef } from 'react';
+import {
+  Controller,
+  useFormContext,
+  useWatch,
+  type ControllerRenderProps,
+  type FieldError,
+  type FieldValues,
+} from 'react-hook-form';
+import Autocomplete, { createFilterOptions } from '@mui/material/Autocomplete';
+import Box from '@mui/material/Box';
+import CircularProgress from '@mui/material/CircularProgress';
+import TextField from '@mui/material/TextField';
+import type { ChoiceOption } from '@sep/api';
+import { useRemoteChoices } from '../../hooks/useRemoteChoices';
+import { renderChoiceLabel } from '../SchemaFormRenderer/fields/choiceLabel';
+import {
+  normalizeChange,
+  toDisplayValue,
+  type ChoiceFreeSoloDisplayValue,
+} from './choiceFreeSoloValue';
+
+const EMPTY_OPTIONS: ChoiceOption[] = [];
+const PARENT_MISSING_TEXT = 'Select a value first';
+const PARENT_MISSING_CUSTOM_TEXT =
+  'Select a value first to list options, or type one';
+
+export interface RemoteChoiceSelectorProps {
+  /** react-hook-form field name. Stores the committed `string | null` (option value, free-typed value, or unset). */
+  name: string;
+  label: string;
+  required?: boolean;
+  disabled?: boolean;
+  /** Fully-resolved fetch path (relative to the `/api` base) the options load from. */
+  endpointUrl: string;
+  /** Optional parent field name; when set, the field cascades and — unless `allowCustom` is set — stays disabled until the parent has a value. */
+  dependsOn?: string;
+  /** Offer free-text (free-solo) entry alongside the fetched options. */
+  allowCustom?: boolean;
+}
+
+/** Normalize a cascade parent's watched value to a scalar string (or `null` when unset). */
+function toScalarParent(value: unknown): string | null {
+  if (value === null || value === undefined || value === '') {
+    return null;
+  }
+  if (typeof value === 'string') {
+    return value;
+  }
+  if (typeof value === 'number') {
+    return String(value);
+  }
+  if (typeof value === 'object') {
+    const record = value as Record<string, unknown>;
+    const identifier = record.value ?? record.id ?? record.name;
+    return identifier === null || identifier === undefined
+      ? null
+      : String(identifier);
+  }
+  return null;
+}
+
+/**
+ * Inner Autocomplete, split out so it can hold hooks driven by the Controller's
+ * `field`. Renders `Choice`-compatible options (with disabled tooltips) and
+ * commits a string `value` — never an inventory id.
+ */
+function RemoteChoiceAutocomplete({
+  field,
+  fieldError,
+  label,
+  required,
+  disabled,
+  allowCustom,
+  options,
+  loading,
+  isError,
+  helperText,
+  noOptionsText,
+  onCommitKind,
+}: {
+  field: ControllerRenderProps<FieldValues, string>;
+  fieldError?: FieldError;
+  label: string;
+  required?: boolean;
+  disabled?: boolean;
+  allowCustom: boolean;
+  options: readonly ChoiceOption[];
+  loading: boolean;
+  isError: boolean;
+  helperText?: string;
+  noOptionsText: string;
+  /** Tell the cascade parent whether the latest commit was typed vs picked. */
+  onCommitKind?: (kind: 'custom' | 'option' | null) => void;
+}) {
+  const filter = useMemo(
+    () => createFilterOptions<ChoiceOption | string>(),
+    []
+  );
+  const { value: fieldValue, onChange } = field;
+  const resolved = toDisplayValue(fieldValue, options);
+  // In non-freeSolo mode MUI expects an option object or null; a bare string
+  // (an unloaded/unmatched persisted value) trips its "none of the options
+  // match" warning, so collapse it to null unless free-text entry is enabled.
+  const value = allowCustom || typeof resolved !== 'string' ? resolved : null;
+  const isCustomValue = typeof value === 'string';
+  const commit = (next: ChoiceFreeSoloDisplayValue) => {
+    const normalized = normalizeChange(next, options);
+    if (onCommitKind) {
+      if (normalized === null) {
+        onCommitKind(null);
+      } else if (typeof next === 'object' && next !== null) {
+        onCommitKind('option');
+      } else {
+        // Typed text or the free-solo "create" suggestion. Exact label matches
+        // normalize to an option value — still treat those as option picks so a
+        // parent change clears a catalog selection entered by typing its label.
+        const matched = options.some(
+          (o) =>
+            o.value === normalized ||
+            (o.label === String(next).trim() && !o.disabled)
+        );
+        onCommitKind(matched ? 'option' : 'custom');
+      }
+    }
+    onChange(normalized);
+  };
+
+  return (
+    <Autocomplete<ChoiceOption | string, false, false, boolean>
+      freeSolo={allowCustom}
+      options={options as (ChoiceOption | string)[]}
+      value={value}
+      disabled={disabled}
+      loading={loading}
+      forcePopupIcon
+      // Keep freshly-typed text after blur so a custom value survives; a closed
+      // select clears an unmatched entry instead.
+      clearOnBlur={!allowCustom}
+      selectOnFocus
+      handleHomeEndKeys
+      getOptionLabel={(option) =>
+        typeof option === 'string' ? option : (option.label ?? '')
+      }
+      getOptionDisabled={(option) =>
+        typeof option !== 'string' && Boolean(option.disabled)
+      }
+      isOptionEqualToValue={(a, b) =>
+        typeof a !== 'string' && typeof b !== 'string' && a.value === b.value
+      }
+      noOptionsText={noOptionsText}
+      data-testid={`${field.name}-autocomplete`}
+      filterOptions={
+        allowCustom
+          ? (opts, params) => {
+              const filtered = filter(opts, params);
+              const input = params.inputValue.trim();
+              const exists = options.some(
+                (o) => o.label === input || o.value === input
+              );
+              if (input !== '' && !exists) {
+                filtered.push(input);
+              }
+              return filtered;
+            }
+          : undefined
+      }
+      renderOption={(props, option) => {
+        const { key, ...rest } = props as {
+          key?: string;
+        } & React.HTMLAttributes<HTMLLIElement>;
+        return typeof option === 'string' ? (
+          <Box component="li" key={key} {...rest} sx={{ fontStyle: 'italic' }}>
+            <em>{option}</em>
+          </Box>
+        ) : (
+          <Box component="li" key={key} {...rest}>
+            {renderChoiceLabel(option)}
+          </Box>
+        );
+      }}
+      onChange={(_event, next) => commit(next)}
+      onInputChange={(_event, input, reason) => {
+        // Live typing → commit as a custom value (only meaningful in free-solo
+        // mode). 'reset' / 'clear' are selection-driven and handled by onChange.
+        if (allowCustom && reason === 'input') {
+          commit(input);
+        }
+      }}
+      renderInput={(params) => (
+        <TextField
+          {...params}
+          inputRef={field.ref}
+          onBlur={field.onBlur}
+          label={label}
+          required={required}
+          error={isError || !!fieldError}
+          helperText={fieldError ? fieldError.message : helperText}
+          size="small"
+          inputProps={{
+            ...params.inputProps,
+            style: isCustomValue ? { fontStyle: 'italic' } : undefined,
+          }}
+          InputProps={{
+            ...params.InputProps,
+            endAdornment: (
+              <>
+                {loading ? (
+                  <CircularProgress color="inherit" size={20} />
+                ) : null}
+                {params.InputProps.endAdornment}
+              </>
+            ),
+          }}
+        />
+      )}
+    />
+  );
+}
+
+/**
+ * Generic selector for a `RemoteChoices` field: fetches `Choice`-compatible
+ * options from the wire-declared `endpointUrl`, renders `value` / `label` /
+ * `disabled` / `disabled_reason` exactly like a static `ChoiceField`, and — when
+ * `allowCustom` is set — accepts a free-typed value. When `dependsOn` names a
+ * parent field the fetch is parameterised by that field's value (as a query
+ * parameter named after `dependsOn`) and, without `allowCustom`, the control
+ * stays disabled until the parent has a value; the child value resets whenever
+ * the parent value changes.
+ *
+ * The committed react-hook-form value is always a string (an option `value` or a
+ * free-typed value) or `null` — never an inventory id — so it flows to the task
+ * payload identically to a static choice.
+ */
+export function RemoteChoiceSelector({
+  name,
+  label,
+  required,
+  disabled,
+  endpointUrl,
+  dependsOn,
+  allowCustom,
+}: RemoteChoiceSelectorProps) {
+  const { control, setValue } = useFormContext();
+  const allowCustomEnabled = Boolean(allowCustom);
+  // Track whether the latest commit was free-typed so a cascade parent change
+  // does not wipe a path the user already entered before picking the parent.
+  const commitKindRef = useRef<'custom' | 'option' | null>(null);
+
+  const parentRaw = useWatch({
+    control,
+    name: dependsOn ?? '',
+    disabled: !dependsOn,
+  });
+  const parentScalar = dependsOn ? toScalarParent(parentRaw) : null;
+  const cascades = dependsOn !== undefined;
+  const parentMissing = cascades && parentScalar === null;
+
+  const {
+    data: options = EMPTY_OPTIONS,
+    isLoading,
+    isError,
+    error,
+  } = useRemoteChoices({
+    endpointUrl,
+    dependsOnName: dependsOn ?? null,
+    dependsOnValue: parentScalar,
+  });
+
+  const parentKey = String(parentScalar);
+  const prevParentKey = useRef(parentKey);
+  useEffect(() => {
+    if (!cascades || prevParentKey.current === parentKey) {
+      return;
+    }
+    prevParentKey.current = parentKey;
+    if (allowCustomEnabled && commitKindRef.current === 'custom') {
+      // Keep the free-typed value; options from the new parent still load.
+      return;
+    }
+    commitKindRef.current = null;
+    setValue(name, null, { shouldDirty: true, shouldValidate: false });
+  }, [cascades, parentKey, name, setValue, allowCustomEnabled]);
+
+  const empty =
+    !parentMissing && !isLoading && !isError && options.length === 0;
+  const parentMissingText = allowCustomEnabled
+    ? PARENT_MISSING_CUSTOM_TEXT
+    : PARENT_MISSING_TEXT;
+  const helperText = parentMissing
+    ? parentMissingText
+    : isError
+      ? (error?.message ?? 'Failed to load options')
+      : empty
+        ? 'No options available'
+        : undefined;
+  const noOptionsText = parentMissing
+    ? parentMissingText
+    : isLoading
+      ? 'Loading…'
+      : 'No options available';
+
+  return (
+    <Controller
+      name={name}
+      control={control}
+      rules={
+        required
+          ? {
+              validate: (value) =>
+                typeof value === 'string' && value.trim() !== ''
+                  ? true
+                  : `${label} is required`,
+            }
+          : undefined
+      }
+      render={({ field, fieldState: { error: fieldError } }) => (
+        <RemoteChoiceAutocomplete
+          field={field}
+          fieldError={fieldError}
+          label={label}
+          required={required}
+          // Only an options-only field goes dead without options: free-text entry
+          // never needs the parent or a successful fetch, and disabling it would
+          // leave a required field unfillable.
+          disabled={
+            disabled || (!allowCustomEnabled && (parentMissing || isError))
+          }
+          allowCustom={allowCustomEnabled}
+          options={options}
+          loading={isLoading}
+          isError={isError}
+          helperText={helperText}
+          noOptionsText={noOptionsText}
+          onCommitKind={(kind) => {
+            commitKindRef.current = kind;
+          }}
+        />
+      )}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/RemoteChoiceSelector/choiceFreeSoloValue.test.ts b/ui/packages/sep/framework/src/components/RemoteChoiceSelector/choiceFreeSoloValue.test.ts
new file mode 100644
index 00000000000..7e73e771745
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/RemoteChoiceSelector/choiceFreeSoloValue.test.ts
@@ -0,0 +1,91 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, expect, it } from 'vitest';
+import type { ChoiceOption } from '@sep/api';
+import { normalizeChange, toDisplayValue } from './choiceFreeSoloValue';
+
+const OPTIONS: ChoiceOption[] = [
+  { value: 'backup-1', label: 'Backup 1' },
+  {
+    value: 'backup-2',
+    label: 'Backup 2',
+    disabled: true,
+    disabled_reason: 'In progress',
+  },
+];
+
+describe('toDisplayValue', () => {
+  it('resolves a stored value string to its option', () => {
+    expect(toDisplayValue('backup-1', OPTIONS)).toEqual({
+      value: 'backup-1',
+      label: 'Backup 1',
+    });
+  });
+
+  it('shows a stored custom string verbatim when no option matches', () => {
+    expect(toDisplayValue('typed-custom', OPTIONS)).toBe('typed-custom');
+  });
+
+  it('resolves a stored option object (back-compat) to the matching option', () => {
+    expect(
+      toDisplayValue({ value: 'backup-2', label: 'Backup 2' }, OPTIONS)
+    ).toEqual(OPTIONS[1]);
+  });
+
+  it('treats empty / null / undefined as no value', () => {
+    expect(toDisplayValue('', OPTIONS)).toBeNull();
+    expect(toDisplayValue(null, OPTIONS)).toBeNull();
+    expect(toDisplayValue(undefined, OPTIONS)).toBeNull();
+  });
+
+  it('coerces a stored number to its string-value option', () => {
+    const numeric: ChoiceOption[] = [{ value: '7', label: 'Seven' }];
+    expect(toDisplayValue(7, numeric)).toEqual({ value: '7', label: 'Seven' });
+  });
+});
+
+describe('normalizeChange', () => {
+  it('commits the value string when an option is picked', () => {
+    expect(normalizeChange(OPTIONS[0], OPTIONS)).toBe('backup-1');
+  });
+
+  it('commits a typed custom value verbatim', () => {
+    expect(normalizeChange('brand-new', OPTIONS)).toBe('brand-new');
+  });
+
+  it('resolves a typed value matching an option label to that option value', () => {
+    expect(normalizeChange('Backup 1', OPTIONS)).toBe('backup-1');
+  });
+
+  it('keeps a typed value matching a disabled option label as a custom string', () => {
+    // Backup 2 is disabled; typing its label must not commit the disabled value.
+    expect(normalizeChange('Backup 2', OPTIONS)).toBe('Backup 2');
+  });
+
+  it('commits null when cleared or blank', () => {
+    expect(normalizeChange(null, OPTIONS)).toBeNull();
+    expect(normalizeChange('   ', OPTIONS)).toBeNull();
+    expect(normalizeChange('', OPTIONS)).toBeNull();
+  });
+
+  it('never commits an id — the committed value is always a string or null', () => {
+    const result = normalizeChange(OPTIONS[1], OPTIONS);
+    expect(typeof result).toBe('string');
+    expect(result).toBe('backup-2');
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/RemoteChoiceSelector/choiceFreeSoloValue.ts b/ui/packages/sep/framework/src/components/RemoteChoiceSelector/choiceFreeSoloValue.ts
new file mode 100644
index 00000000000..2d5aa175342
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/RemoteChoiceSelector/choiceFreeSoloValue.ts
@@ -0,0 +1,106 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/**
+ * Value normalization for the free-solo (`allow_custom`) path of the
+ * `RemoteChoiceSelector`.
+ *
+ * The value-shaped counterpart to `FreeSoloSelect`'s `freeSoloValue`: a
+ * `RemoteChoices` field commits a string (a fetched option's `value` or a
+ * free-typed value), never an inventory id. The committed react-hook-form value
+ * is a `string | null`:
+ *   - picking an option — or typing a value that exactly matches an option's
+ *     label — commits that option's `value`;
+ *   - a typed value with no matching option commits the trimmed string;
+ *   - clearing the field commits `null`.
+ */
+
+import type { ChoiceOption } from '@sep/api';
+
+/** The value MUI Autocomplete renders: an option object, a free string, or empty. */
+export type ChoiceFreeSoloDisplayValue = ChoiceOption | string | null;
+
+/** The value committed to react-hook-form. */
+export type ChoiceFreeSoloCommittedValue = string | null;
+
+/**
+ * Resolve the react-hook-form value into the value MUI Autocomplete should
+ * display.
+ *
+ *   - a stored `value` string resolves to its matching option once the options
+ *     have loaded, otherwise shows the raw string (a free-typed value, or a
+ *     value whose option has not loaded yet);
+ *   - a number is coerced to its string form before resolving (a numeric-string
+ *     `value` persisted in a stored body);
+ *   - an option object (a back-compat / persisted shape) resolves to the
+ *     matching option, falling back to the object itself;
+ *   - `''` / `null` / `undefined` show as empty.
+ */
+export function toDisplayValue(
+  stored: unknown,
+  options: readonly ChoiceOption[]
+): ChoiceFreeSoloDisplayValue {
+  if (stored === null || stored === undefined || stored === '') {
+    return null;
+  }
+  if (typeof stored === 'number') {
+    const asString = String(stored);
+    return options.find((o) => o.value === asString) ?? asString;
+  }
+  if (typeof stored === 'string') {
+    return options.find((o) => o.value === stored) ?? stored;
+  }
+  if (
+    typeof stored === 'object' &&
+    'value' in (stored as Record<string, unknown>)
+  ) {
+    const value = (stored as { value: unknown }).value;
+    return options.find((o) => o.value === value) ?? (stored as ChoiceOption);
+  }
+  return null;
+}
+
+/**
+ * Normalize the value emitted by MUI Autocomplete's `onChange` /
+ * `onInputChange` into the `string | null` committed to react-hook-form.
+ *
+ *   - clearing yields `null`;
+ *   - an option object yields its `value`;
+ *   - a typed string that exactly matches a non-disabled option's label
+ *     resolves to that option's `value` (not the label); a match against a
+ *     disabled option is kept verbatim, since the UI presents disabled options
+ *     as non-selectable;
+ *   - any other non-empty string is kept verbatim;
+ *   - a whitespace-only / empty string yields `null`.
+ */
+export function normalizeChange(
+  next: ChoiceFreeSoloDisplayValue,
+  options: readonly ChoiceOption[]
+): ChoiceFreeSoloCommittedValue {
+  if (next === null) {
+    return null;
+  }
+  if (typeof next === 'object') {
+    return next.value;
+  }
+  const trimmed = next.trim();
+  if (trimmed === '') {
+    return null;
+  }
+  const labelMatch = options.find((o) => o.label === trimmed && !o.disabled);
+  return labelMatch ? labelMatch.value : trimmed;
+}
diff --git a/ui/packages/sep/framework/src/components/RemoteChoiceSelector/index.ts b/ui/packages/sep/framework/src/components/RemoteChoiceSelector/index.ts
new file mode 100644
index 00000000000..61d98aa57bc
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/RemoteChoiceSelector/index.ts
@@ -0,0 +1,19 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { RemoteChoiceSelector } from './RemoteChoiceSelector';
+export type { RemoteChoiceSelectorProps } from './RemoteChoiceSelector';
diff --git a/ui/packages/sep/framework/src/components/ScheduleCell/ScheduleCell.test.tsx b/ui/packages/sep/framework/src/components/ScheduleCell/ScheduleCell.test.tsx
new file mode 100644
index 00000000000..e8e7fbda5c2
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ScheduleCell/ScheduleCell.test.tsx
@@ -0,0 +1,107 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { render, screen } from '@testing-library/react';
+import { ScheduleCell } from './ScheduleCell';
+import type { PeriodicTaskResponse } from '../ScheduledTasksPanel';
+
+const NOW = new Date('2026-06-18T12:00:00Z');
+
+function makePeriodic(
+  overrides: Partial<PeriodicTaskResponse> = {}
+): PeriodicTaskResponse {
+  return {
+    id: 1,
+    name: 'periodic-1',
+    task: 'plugin-task',
+    enabled: true,
+    description: '',
+    start_time: null,
+    last_run_at: null,
+    date_changed: null,
+    total_run_count: 0,
+    interval: { every: 1, period: 'hours' },
+    crontab: null,
+    execute_request: null,
+    period: 'every 1 hours',
+    next_run_at: '2026-06-18T14:00:00Z',
+    ...overrides,
+  };
+}
+
+beforeEach(() => {
+  vi.useFakeTimers();
+  vi.setSystemTime(NOW);
+});
+
+afterEach(() => {
+  vi.useRealTimers();
+});
+
+describe('ScheduleCell', () => {
+  it('renders a muted "Not scheduled" chip when the task has no schedule', () => {
+    render(<ScheduleCell task={null} />);
+
+    expect(screen.getByTestId('schedule-cell-unscheduled')).toHaveTextContent(
+      'Not scheduled'
+    );
+    expect(screen.queryByTestId('schedule-cell')).not.toBeInTheDocument();
+  });
+
+  it('renders the relative next run and a periodicity icon when scheduled', () => {
+    render(<ScheduleCell task={makePeriodic()} />);
+
+    expect(screen.getByTestId('schedule-cell-next-run')).toHaveTextContent(
+      'in 2 hours'
+    );
+    expect(screen.getByTestId('schedule-cell-periodicity')).toHaveAttribute(
+      'aria-label',
+      'Recurs every 1 hours'
+    );
+    expect(
+      screen.queryByTestId('schedule-cell-unscheduled')
+    ).not.toBeInTheDocument();
+  });
+
+  it('falls back to an em dash when a scheduled task has no next run', () => {
+    render(<ScheduleCell task={makePeriodic({ next_run_at: null })} />);
+
+    expect(screen.getByTestId('schedule-cell-next-run')).toHaveTextContent('—');
+    expect(screen.getByTestId('schedule-cell-periodicity')).toBeInTheDocument();
+  });
+
+  it('shows a loading placeholder instead of "Not scheduled" while the schedule list loads', () => {
+    render(<ScheduleCell task={null} isLoading />);
+
+    expect(screen.getByTestId('schedule-cell-loading')).toBeInTheDocument();
+    expect(
+      screen.queryByTestId('schedule-cell-unscheduled')
+    ).not.toBeInTheDocument();
+  });
+
+  it('still renders the schedule once matched even while the list reports loading', () => {
+    render(<ScheduleCell task={makePeriodic()} isLoading />);
+
+    expect(screen.getByTestId('schedule-cell-next-run')).toHaveTextContent(
+      'in 2 hours'
+    );
+    expect(
+      screen.queryByTestId('schedule-cell-loading')
+    ).not.toBeInTheDocument();
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/ScheduleCell/ScheduleCell.tsx b/ui/packages/sep/framework/src/components/ScheduleCell/ScheduleCell.tsx
new file mode 100644
index 00000000000..f076b6da3d2
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ScheduleCell/ScheduleCell.tsx
@@ -0,0 +1,127 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import RepeatIcon from '@mui/icons-material/Repeat';
+import Chip from '@mui/material/Chip';
+import Skeleton from '@mui/material/Skeleton';
+import Stack from '@mui/material/Stack';
+import Tooltip from '@mui/material/Tooltip';
+import Typography from '@mui/material/Typography';
+import {
+  describePeriod,
+  formatAbsoluteTime,
+  formatRelativeTime,
+  LastRunStatus,
+  type PeriodicTaskResponse,
+} from '../ScheduledTasksPanel';
+
+export interface ScheduleCellProps {
+  /**
+   * The periodic task matched to this row by name, or `null`/`undefined` when
+   * the row's task has no schedule.
+   */
+  task?: PeriodicTaskResponse | null;
+  /**
+   * Whether the schedule list is still loading. When loading and no task has
+   * matched yet, a placeholder is shown instead of the "Not scheduled" chip so
+   * rows do not flash unscheduled before the schedule data arrives.
+   */
+  isLoading?: boolean;
+}
+
+/**
+ * Generic list-view schedule cell.
+ *
+ * Shows the next run as relative time (with the absolute timestamp on hover)
+ * plus a periodicity icon whose tooltip describes the recurrence in plain
+ * language. Renders a muted "Not scheduled" chip when the row's task has no
+ * periodic schedule. Framework component shared by any plugin that declares a
+ * `schedule`-format column; it is not archives-specific.
+ */
+export function ScheduleCell({ task, isLoading = false }: ScheduleCellProps) {
+  if (!task) {
+    if (isLoading) {
+      return (
+        <Skeleton
+          variant="text"
+          width={72}
+          data-testid="schedule-cell-loading"
+        />
+      );
+    }
+    return (
+      <Chip
+        label="Not scheduled"
+        size="small"
+        variant="outlined"
+        data-testid="schedule-cell-unscheduled"
+        sx={{ color: 'text.disabled', borderColor: 'divider' }}
+      />
+    );
+  }
+
+  const period = describePeriod(task);
+  const nextRun = task.next_run_at;
+
+  return (
+    <Stack
+      direction="row"
+      spacing={0.5}
+      alignItems="center"
+      data-testid="schedule-cell"
+    >
+      {nextRun ? (
+        <Tooltip title={formatAbsoluteTime(nextRun)}>
+          <Typography
+            variant="body2"
+            component="span"
+            data-testid="schedule-cell-next-run"
+          >
+            {formatRelativeTime(nextRun)}
+          </Typography>
+        </Tooltip>
+      ) : (
+        <Typography
+          variant="body2"
+          component="span"
+          color="text.secondary"
+          data-testid="schedule-cell-next-run"
+        >
+          —
+        </Typography>
+      )}
+      <Tooltip
+        title={
+          period.tooltip
+            ? `${period.display} (${period.tooltip})`
+            : period.display
+        }
+      >
+        <RepeatIcon
+          fontSize="inherit"
+          aria-label={`Recurs ${period.display}`}
+          data-testid="schedule-cell-periodicity"
+          sx={{ color: 'text.secondary' }}
+        />
+      </Tooltip>
+      <LastRunStatus
+        status={task.last_run_status}
+        lastRunAt={task.last_run_at}
+      />
+    </Stack>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/ScheduleCell/index.ts b/ui/packages/sep/framework/src/components/ScheduleCell/index.ts
new file mode 100644
index 00000000000..ca61e07de7a
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ScheduleCell/index.ts
@@ -0,0 +1,19 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { ScheduleCell } from './ScheduleCell';
+export type { ScheduleCellProps } from './ScheduleCell';
diff --git a/ui/packages/sep/framework/src/components/ScheduleSummary/ScheduleSummary.test.tsx b/ui/packages/sep/framework/src/components/ScheduleSummary/ScheduleSummary.test.tsx
new file mode 100644
index 00000000000..a33e2d4fb51
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ScheduleSummary/ScheduleSummary.test.tsx
@@ -0,0 +1,153 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { render, screen } from '@testing-library/react';
+import { MemoryRouter } from 'react-router-dom';
+
+const { useScheduledTasksForPluginMock } = vi.hoisted(() => ({
+  useScheduledTasksForPluginMock: vi.fn(),
+}));
+
+// Mock only the schedule hook; pull the real period/time helpers from their
+// leaf module so wording stays accurate. Importing the leaf directly (instead
+// of `importOriginal` on the barrel) keeps the mock order-independent when the
+// whole suite runs.
+vi.mock('../ScheduledTasksPanel', async () => {
+  const periods = await import('../ScheduledTasksPanel/periods');
+  const lastRun = await import('../ScheduledTasksPanel/LastRunStatus');
+  return {
+    useScheduledTasksForPlugin: (...args: unknown[]) =>
+      useScheduledTasksForPluginMock(...args),
+    describePeriod: periods.describePeriod,
+    formatRelativeTime: periods.formatRelativeTime,
+    formatAbsoluteTime: periods.formatAbsoluteTime,
+    selectSchedule: periods.selectSchedule,
+    LastRunStatus: lastRun.LastRunStatus,
+  };
+});
+
+import { ScheduleSummary } from './ScheduleSummary';
+import type { PeriodicTaskResponse } from '../ScheduledTasksPanel';
+
+const NOW = new Date('2026-06-18T12:00:00Z');
+
+function makePeriodic(
+  overrides: Partial<PeriodicTaskResponse> = {}
+): PeriodicTaskResponse {
+  return {
+    id: 1,
+    name: 'periodic-1',
+    task: 'plugin-task',
+    enabled: true,
+    description: '',
+    start_time: null,
+    last_run_at: null,
+    date_changed: null,
+    total_run_count: 0,
+    interval: { every: 2, period: 'hours' },
+    crontab: null,
+    execute_request: null,
+    period: 'every 2 hours',
+    next_run_at: '2026-06-18T14:00:00Z',
+    ...overrides,
+  };
+}
+
+function setup(periodicTasks: PeriodicTaskResponse[], isLoading = false) {
+  useScheduledTasksForPluginMock.mockReturnValue({ periodicTasks, isLoading });
+}
+
+function renderSummary(taskName = 'plugin-task') {
+  return render(
+    <MemoryRouter>
+      <ScheduleSummary
+        pluginName="archives"
+        taskName={taskName}
+        scheduleHref="/apps/archives/schedule"
+        disablePolling
+      />
+    </MemoryRouter>
+  );
+}
+
+beforeEach(() => {
+  vi.useFakeTimers();
+  vi.setSystemTime(NOW);
+  useScheduledTasksForPluginMock.mockReset();
+});
+
+afterEach(() => {
+  vi.useRealTimers();
+});
+
+describe('ScheduleSummary', () => {
+  it('renders the next run and recurrence when the task is scheduled', () => {
+    setup([makePeriodic()]);
+    renderSummary();
+
+    const scheduled = screen.getByTestId('schedule-summary-scheduled');
+    expect(scheduled).toHaveTextContent('in 2 hours');
+    expect(scheduled).toHaveTextContent('every 2 hours');
+    expect(
+      screen.queryByTestId('schedule-summary-unscheduled')
+    ).not.toBeInTheDocument();
+  });
+
+  it('falls back to an em dash for the next run when a scheduled task has none', () => {
+    setup([makePeriodic({ next_run_at: null })]);
+    renderSummary();
+
+    const scheduled = screen.getByTestId('schedule-summary-scheduled');
+    expect(scheduled).toHaveTextContent('—');
+    expect(scheduled).toHaveTextContent('every 2 hours');
+  });
+
+  it('picks the soonest upcoming schedule when a task has several', () => {
+    setup([
+      makePeriodic({
+        id: 1,
+        next_run_at: '2026-06-18T20:00:00Z',
+        interval: { every: 1, period: 'days' },
+        period: 'every 1 days',
+      }),
+      makePeriodic({
+        id: 2,
+        next_run_at: '2026-06-18T13:00:00Z',
+        interval: { every: 1, period: 'hours' },
+        period: 'every 1 hours',
+      }),
+    ]);
+    renderSummary();
+
+    const scheduled = screen.getByTestId('schedule-summary-scheduled');
+    expect(scheduled).toHaveTextContent('in 1 hour');
+    expect(scheduled).toHaveTextContent('every 1 hours');
+  });
+
+  it('renders a not-scheduled state with an add-a-schedule link', () => {
+    setup([makePeriodic({ task: 'a-different-task' })]);
+    renderSummary();
+
+    expect(
+      screen.getByTestId('schedule-summary-unscheduled')
+    ).toHaveTextContent('Not scheduled');
+    const link = screen.getByTestId('schedule-summary-add-link');
+    expect(link).toHaveTextContent('Add a schedule');
+    expect(link).toHaveAttribute('href', '/apps/archives/schedule');
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/ScheduleSummary/ScheduleSummary.tsx b/ui/packages/sep/framework/src/components/ScheduleSummary/ScheduleSummary.tsx
new file mode 100644
index 00000000000..9b36a0ed7f6
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ScheduleSummary/ScheduleSummary.tsx
@@ -0,0 +1,152 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { Link as RouterLink } from 'react-router-dom';
+import ScheduleIcon from '@mui/icons-material/Schedule';
+import Box from '@mui/material/Box';
+import Button from '@mui/material/Button';
+import Paper from '@mui/material/Paper';
+import Stack from '@mui/material/Stack';
+import Tooltip from '@mui/material/Tooltip';
+import Typography from '@mui/material/Typography';
+import {
+  describePeriod,
+  formatAbsoluteTime,
+  formatRelativeTime,
+  LastRunStatus,
+  selectSchedule,
+  useScheduledTasksForPlugin,
+} from '../ScheduledTasksPanel';
+
+export interface ScheduleSummaryProps {
+  /** Plugin owning the task; used to scope the periodic-task lookup. */
+  pluginName: string;
+  /** The task's name; joined client-side against the periodic-task list. */
+  taskName: string;
+  /** Route to the plugin's Schedules screen (the add-a-schedule target). */
+  scheduleHref: string;
+  /** Disable list polling. Used by stories/tests. */
+  disablePolling?: boolean;
+}
+
+/**
+ * Generic detail-page schedule summary.
+ *
+ * Shows the next run (relative, with the absolute timestamp on hover) and the
+ * recurrence in plain language for a scheduled task, or a "Not scheduled" state
+ * with a link to the Schedules screen when the task has no periodic schedule.
+ * Framework component shared by any scheduling-capable plugin; it is not
+ * archives-specific. The task-to-schedule join is performed client-side by
+ * task name.
+ */
+export function ScheduleSummary({
+  pluginName,
+  taskName,
+  scheduleHref,
+  disablePolling = false,
+}: ScheduleSummaryProps) {
+  const { periodicTasks, isLoading } = useScheduledTasksForPlugin(pluginName, {
+    disablePolling,
+  });
+  const task = selectSchedule(periodicTasks.filter((p) => p.task === taskName));
+
+  return (
+    <Paper
+      variant="outlined"
+      sx={{ p: 3, mb: 3 }}
+      data-testid="schedule-summary"
+    >
+      <Stack direction="row" spacing={1} alignItems="center" sx={{ mb: 2 }}>
+        <ScheduleIcon fontSize="small" />
+        <Typography variant="h6">Schedule</Typography>
+      </Stack>
+
+      {isLoading ? (
+        <Typography variant="body2" color="text.secondary">
+          Loading schedule…
+        </Typography>
+      ) : task ? (
+        <Stack spacing={2} data-testid="schedule-summary-scheduled">
+          <Box>
+            <Typography
+              variant="caption"
+              color="text.secondary"
+              sx={{ display: 'block', mb: 0.5 }}
+            >
+              Next run
+            </Typography>
+            {task.next_run_at ? (
+              <Tooltip title={formatAbsoluteTime(task.next_run_at)}>
+                <Typography variant="body1" component="span">
+                  {formatRelativeTime(task.next_run_at)}
+                </Typography>
+              </Tooltip>
+            ) : (
+              <Typography variant="body1" color="text.secondary">
+                —
+              </Typography>
+            )}
+          </Box>
+          <Box>
+            <Typography
+              variant="caption"
+              color="text.secondary"
+              sx={{ display: 'block', mb: 0.5 }}
+            >
+              Recurrence
+            </Typography>
+            <Typography variant="body1">
+              {describePeriod(task).display}
+            </Typography>
+          </Box>
+          <Box data-testid="schedule-summary-last-run">
+            <Typography
+              variant="caption"
+              color="text.secondary"
+              sx={{ display: 'block', mb: 0.5 }}
+            >
+              Last run
+            </Typography>
+            <LastRunStatus
+              status={task.last_run_status}
+              lastRunAt={task.last_run_at}
+            />
+          </Box>
+        </Stack>
+      ) : (
+        <Stack
+          spacing={1.5}
+          alignItems="flex-start"
+          data-testid="schedule-summary-unscheduled"
+        >
+          <Typography variant="body2" color="text.secondary">
+            Not scheduled
+          </Typography>
+          <Button
+            component={RouterLink}
+            to={scheduleHref}
+            size="small"
+            startIcon={<ScheduleIcon />}
+            data-testid="schedule-summary-add-link"
+          >
+            Add a schedule
+          </Button>
+        </Stack>
+      )}
+    </Paper>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/ScheduleSummary/index.ts b/ui/packages/sep/framework/src/components/ScheduleSummary/index.ts
new file mode 100644
index 00000000000..ee90416b05b
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ScheduleSummary/index.ts
@@ -0,0 +1,19 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { ScheduleSummary } from './ScheduleSummary';
+export type { ScheduleSummaryProps } from './ScheduleSummary';
diff --git a/ui/packages/sep/framework/src/components/ScheduledTasksPanel/LastRunStatus.tsx b/ui/packages/sep/framework/src/components/ScheduledTasksPanel/LastRunStatus.tsx
new file mode 100644
index 00000000000..12914263143
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ScheduledTasksPanel/LastRunStatus.tsx
@@ -0,0 +1,83 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import Chip from '@mui/material/Chip';
+import {
+  TaskHistoryStatusBadge,
+  isTaskHistoryStatus,
+} from '../TaskHistoryTable';
+import type { PeriodicTaskResponse } from './hooks';
+
+export interface LastRunStatusProps {
+  /**
+   * The task's last-run result, as reported by the periodic-task API. See the
+   * note on {@link LastRunStatus} for how `null`/`undefined` is disambiguated.
+   */
+  status: PeriodicTaskResponse['last_run_status'];
+  /**
+   * The task's last-run timestamp. Used only to tell "never run" apart from
+   * "ran, but the result could not be resolved" when `status` is absent.
+   */
+  lastRunAt: PeriodicTaskResponse['last_run_at'];
+}
+
+const mutedChipSx = { color: 'text.disabled', borderColor: 'divider' } as const;
+
+/**
+ * Shared last-run outcome renderer for the schedule surfaces (list-view cell,
+ * detail summary, scheduled-tasks panel row).
+ *
+ * Renders the outcome with the app-wide {@link TaskHistoryStatusBadge} so
+ * colors and labels match execution history. The status enum has no "never
+ * run" member, so the empty state is rendered outside the badge.
+ *
+ * The backend leaves `last_run_status` null in two distinct situations: the
+ * schedule has genuinely never run (`last_run_at` is also null), or it ran but
+ * no matching execution-history point could be resolved (`last_run_at` is set).
+ * These are disambiguated with `lastRunAt` so a task that has run is never
+ * mislabeled "Not yet run" next to a real timestamp. A present-but-unrecognized
+ * status is shown verbatim rather than dropped, matching the fallback used by
+ * the list/detail status columns.
+ */
+export function LastRunStatus({ status, lastRunAt }: LastRunStatusProps) {
+  if (isTaskHistoryStatus(status)) {
+    return <TaskHistoryStatusBadge status={status} />;
+  }
+
+  if (status !== null && status !== undefined) {
+    return (
+      <Chip
+        label={String(status)}
+        size="small"
+        variant="outlined"
+        data-testid="last-run-unrecognized"
+        sx={mutedChipSx}
+      />
+    );
+  }
+
+  const neverRun = lastRunAt === null || lastRunAt === undefined;
+  return (
+    <Chip
+      label={neverRun ? 'Not yet run' : 'Unknown'}
+      size="small"
+      variant="outlined"
+      data-testid={neverRun ? 'last-run-never' : 'last-run-unknown'}
+      sx={mutedChipSx}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/ScheduledTasksPanel/ScheduledTaskForm.tsx b/ui/packages/sep/framework/src/components/ScheduledTasksPanel/ScheduledTaskForm.tsx
new file mode 100644
index 00000000000..7e82dfe14d3
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ScheduledTasksPanel/ScheduledTaskForm.tsx
@@ -0,0 +1,506 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useEffect, useMemo } from 'react';
+import Alert from '@mui/material/Alert';
+import Autocomplete from '@mui/material/Autocomplete';
+import Box from '@mui/material/Box';
+import Button from '@mui/material/Button';
+import FormControlLabel from '@mui/material/FormControlLabel';
+import Link from '@mui/material/Link';
+import MenuItem from '@mui/material/MenuItem';
+import Stack from '@mui/material/Stack';
+import Switch from '@mui/material/Switch';
+import TextField from '@mui/material/TextField';
+import Typography from '@mui/material/Typography';
+import { Controller, useForm, type SubmitHandler } from 'react-hook-form';
+import cronstrue from 'cronstrue';
+import {
+  ChainBuilder,
+  type AvailableTask,
+  type ChainValue,
+} from '../ChainBuilder';
+import type {
+  CrontabSchedule,
+  IntervalSchedule,
+  PeriodicTaskCreate,
+  PeriodicTaskResponse,
+  PeriodicTaskUpdate,
+} from './hooks';
+
+export type IntervalUnit = 'days' | 'hours' | 'minutes';
+
+export interface ScheduledTaskFormValues {
+  task: string;
+  scheduleMode: 'interval' | 'cron';
+  intervalEvery: number;
+  intervalPeriod: IntervalUnit;
+  cronExpression: string;
+  cronTimezone: string;
+  startTime: string;
+  enabled: boolean;
+  chain: ChainValue;
+}
+
+export interface ScheduledTaskFormProps {
+  mode: 'create' | 'edit';
+  initialValue?: PeriodicTaskResponse;
+  availableTasks: AvailableTask[];
+  defaultTaskName?: string;
+  onCancel: () => void;
+  onSubmit: (
+    body: PeriodicTaskCreate | PeriodicTaskUpdate,
+    taskName: string
+  ) => Promise<void>;
+  submitting?: boolean;
+  errorMessage?: string;
+}
+
+const CRON_PATTERN = /^\S+(?:\s+\S+){4}$/;
+
+const TIMEZONES = (() => {
+  type IntlWithTz = typeof Intl & {
+    supportedValuesOf?: (key: string) => string[];
+  };
+  const intl = Intl as IntlWithTz;
+  if (typeof intl.supportedValuesOf === 'function') {
+    try {
+      return intl.supportedValuesOf('timeZone');
+    } catch {
+      return ['UTC'];
+    }
+  }
+  return ['UTC'];
+})();
+
+function detectBrowserTimezone(): string {
+  try {
+    const tz = Intl.DateTimeFormat().resolvedOptions().timeZone;
+    return tz && TIMEZONES.includes(tz) ? tz : 'UTC';
+  } catch {
+    return 'UTC';
+  }
+}
+
+// `datetime-local` reads/writes as local wall-clock with no timezone.
+// Backend `start_time` is UTC ISO. Format the UTC instant in the browser's
+// local zone for display; parse the local input back through `Date` (which
+// interprets it as local) before serializing to UTC.
+function utcIsoToLocalInput(iso: string): string {
+  const d = new Date(iso);
+  if (Number.isNaN(d.getTime())) {
+    return '';
+  }
+  const pad = (n: number) => String(n).padStart(2, '0');
+  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}T${pad(d.getHours())}:${pad(d.getMinutes())}`;
+}
+
+function cronToExpression(c: CrontabSchedule): string {
+  return `${c.minute} ${c.hour} ${c.day_of_month} ${c.month_of_year} ${c.day_of_week}`;
+}
+
+function expressionToCron(
+  expr: string,
+  timezone: string
+): CrontabSchedule | null {
+  const parts = expr.trim().split(/\s+/);
+  if (parts.length !== 5) {
+    return null;
+  }
+  const [minute, hour, day_of_month, month_of_year, day_of_week] = parts;
+  return { minute, hour, day_of_month, month_of_year, day_of_week, timezone };
+}
+
+function humanize(expr: string): { text: string; valid: boolean } {
+  if (!CRON_PATTERN.test(expr.trim())) {
+    return { text: 'Invalid cron expression', valid: false };
+  }
+  try {
+    const text = cronstrue.toString(expr.trim());
+    return { text: text.charAt(0).toLowerCase() + text.slice(1), valid: true };
+  } catch {
+    return { text: 'Invalid cron expression', valid: false };
+  }
+}
+
+function buildDefaults(
+  initial: PeriodicTaskResponse | undefined,
+  defaultTaskName: string | undefined
+): ScheduledTaskFormValues {
+  if (initial) {
+    return {
+      task: initial.task,
+      scheduleMode: initial.crontab ? 'cron' : 'interval',
+      intervalEvery: initial.interval?.every ?? 1,
+      intervalPeriod: (initial.interval?.period as IntervalUnit) ?? 'hours',
+      cronExpression: initial.crontab ? cronToExpression(initial.crontab) : '',
+      cronTimezone: initial.crontab?.timezone ?? detectBrowserTimezone(),
+      startTime: initial.start_time
+        ? utcIsoToLocalInput(initial.start_time)
+        : '',
+      enabled: initial.enabled,
+      chain: {
+        chain_task_names: initial.execute_request?.chain_task_names ?? [],
+        chain_on_failure: initial.execute_request?.chain_on_failure ?? false,
+      },
+    };
+  }
+  return {
+    task: defaultTaskName ?? '',
+    scheduleMode: 'interval',
+    intervalEvery: 1,
+    intervalPeriod: 'hours',
+    cronExpression: '',
+    cronTimezone: detectBrowserTimezone(),
+    startTime: '',
+    enabled: true,
+    chain: { chain_task_names: [], chain_on_failure: false },
+  };
+}
+
+export function ScheduledTaskForm({
+  mode,
+  initialValue,
+  availableTasks,
+  defaultTaskName,
+  onCancel,
+  onSubmit,
+  submitting = false,
+  errorMessage,
+}: ScheduledTaskFormProps) {
+  const defaults = useMemo(
+    () => buildDefaults(initialValue, defaultTaskName),
+    [initialValue, defaultTaskName]
+  );
+
+  const {
+    control,
+    register,
+    handleSubmit,
+    watch,
+    setValue,
+    formState: { errors },
+  } = useForm<ScheduledTaskFormValues>({ defaultValues: defaults });
+
+  const scheduleMode = watch('scheduleMode');
+  const cronExpression = watch('cronExpression');
+  const taskName = watch('task');
+  const chain = watch('chain');
+
+  // When the user changes the task in create mode, prune the chain so it
+  // never contains the now-current task name (would form a self-cycle).
+  useEffect(() => {
+    if (!taskName) {
+      return;
+    }
+    if (chain.chain_task_names.includes(taskName)) {
+      setValue(
+        'chain',
+        {
+          ...chain,
+          chain_task_names: chain.chain_task_names.filter(
+            (n) => n !== taskName
+          ),
+        },
+        { shouldDirty: true }
+      );
+    }
+  }, [taskName, chain, setValue]);
+
+  const cronPreview = useMemo(() => {
+    if (scheduleMode !== 'cron' || !cronExpression) {
+      return null;
+    }
+    return humanize(cronExpression);
+  }, [scheduleMode, cronExpression]);
+
+  const toggleMode = () => {
+    setValue(
+      'scheduleMode',
+      scheduleMode === 'interval' ? 'cron' : 'interval',
+      {
+        shouldDirty: true,
+      }
+    );
+  };
+
+  const submit: SubmitHandler<ScheduledTaskFormValues> = async (values) => {
+    const isCron = values.scheduleMode === 'cron';
+    let crontab: CrontabSchedule | null = null;
+    if (isCron) {
+      const preview = humanize(values.cronExpression);
+      if (!preview.valid) {
+        return;
+      }
+      crontab = expressionToCron(values.cronExpression, values.cronTimezone);
+      if (!crontab) {
+        return;
+      }
+    }
+
+    const everyNum = Number(values.intervalEvery);
+    if (!isCron && (!Number.isFinite(everyNum) || everyNum < 1)) {
+      return;
+    }
+    const interval: IntervalSchedule | null = isCron
+      ? null
+      : { every: everyNum, period: values.intervalPeriod };
+
+    const start_time =
+      !isCron && values.startTime
+        ? new Date(values.startTime).toISOString()
+        : null;
+
+    const hasChain = values.chain.chain_task_names.length > 0;
+    const execute_request = hasChain
+      ? {
+          meta: {} as Record<string, never>,
+          chain_task_names: values.chain.chain_task_names,
+          chain_on_failure: values.chain.chain_on_failure,
+        }
+      : null;
+
+    const body: PeriodicTaskCreate | PeriodicTaskUpdate = {
+      name: initialValue?.name ?? '',
+      task: values.task,
+      enabled: values.enabled,
+      description: initialValue?.description ?? '',
+      kwargs: '{}',
+      start_time,
+      interval,
+      crontab,
+      execute_request,
+    };
+
+    await onSubmit(body, values.task);
+  };
+
+  const taskField =
+    mode === 'create' ? (
+      <TextField
+        select
+        size="small"
+        label="Task"
+        required
+        slotProps={{ htmlInput: { 'data-testid': 'sched-form-task' } }}
+        {...register('task', { required: true })}
+        defaultValue={defaults.task}
+        error={!!errors.task}
+        sx={{ minWidth: 180 }}
+      >
+        {availableTasks.map((t) => (
+          <MenuItem key={t.name} value={t.name}>
+            {t.name}
+          </MenuItem>
+        ))}
+      </TextField>
+    ) : (
+      <Typography variant="body2" sx={{ alignSelf: 'center' }}>
+        {taskName}
+      </Typography>
+    );
+
+  return (
+    <Box
+      component="form"
+      onSubmit={handleSubmit(submit)}
+      data-testid="scheduled-task-form"
+      sx={{ p: 2, bgcolor: 'action.hover' }}
+    >
+      {errorMessage && (
+        <Alert severity="error" sx={{ mb: 2 }}>
+          {errorMessage}
+        </Alert>
+      )}
+
+      <Stack
+        direction="row"
+        spacing={2}
+        flexWrap="wrap"
+        alignItems="flex-start"
+        sx={{ mb: 2 }}
+      >
+        {taskField}
+
+        {scheduleMode === 'interval' ? (
+          <Stack direction="row" spacing={1} alignItems="center">
+            <TextField
+              type="number"
+              size="small"
+              label="Every"
+              required
+              slotProps={{
+                htmlInput: {
+                  min: 1,
+                  'data-testid': 'sched-form-interval-every',
+                },
+              }}
+              {...register('intervalEvery', {
+                required: true,
+                valueAsNumber: true,
+                validate: (v) => Number.isFinite(v) && (v as number) >= 1,
+              })}
+              error={!!errors.intervalEvery}
+              sx={{ width: 100 }}
+            />
+            <TextField
+              select
+              size="small"
+              label="Period"
+              {...register('intervalPeriod')}
+              defaultValue={defaults.intervalPeriod}
+              sx={{ width: 120 }}
+            >
+              <MenuItem value="days">days</MenuItem>
+              <MenuItem value="hours">hours</MenuItem>
+              <MenuItem value="minutes">minutes</MenuItem>
+            </TextField>
+          </Stack>
+        ) : (
+          <Stack spacing={0.5} sx={{ minWidth: 320 }}>
+            <Stack direction="row" spacing={1}>
+              <TextField
+                size="small"
+                label="Cron expression"
+                placeholder="*/5 * * * *"
+                required
+                slotProps={{
+                  htmlInput: {
+                    pattern: '^\\S+(?:\\s+\\S+){4}$',
+                    'data-testid': 'sched-form-cron',
+                  },
+                }}
+                {...register('cronExpression', {
+                  required: true,
+                  validate: (v) =>
+                    humanize(v).valid || 'Invalid cron expression',
+                })}
+                error={!!errors.cronExpression}
+                sx={{ flex: 1 }}
+              />
+              <Controller
+                control={control}
+                name="cronTimezone"
+                render={({ field }) => (
+                  <Autocomplete
+                    size="small"
+                    options={TIMEZONES}
+                    value={field.value}
+                    onChange={(_, v) => field.onChange(v ?? 'UTC')}
+                    sx={{ width: 220 }}
+                    renderInput={(params) => (
+                      <TextField
+                        {...params}
+                        label="Timezone"
+                        slotProps={{
+                          htmlInput: {
+                            ...params.inputProps,
+                            'data-testid': 'sched-form-timezone',
+                          },
+                        }}
+                      />
+                    )}
+                  />
+                )}
+              />
+            </Stack>
+            {cronPreview && (
+              <Typography
+                variant="caption"
+                color={cronPreview.valid ? 'text.secondary' : 'error'}
+                data-testid="sched-form-cron-preview"
+              >
+                {cronPreview.text}
+              </Typography>
+            )}
+          </Stack>
+        )}
+
+        {scheduleMode === 'interval' && (
+          <TextField
+            type="datetime-local"
+            size="small"
+            label="Start time"
+            slotProps={{ inputLabel: { shrink: true } }}
+            {...register('startTime')}
+            sx={{ width: 220 }}
+          />
+        )}
+
+        <Controller
+          control={control}
+          name="enabled"
+          render={({ field }) => (
+            <FormControlLabel
+              sx={{ alignSelf: 'center' }}
+              control={
+                <Switch
+                  checked={field.value}
+                  onChange={(_, c) => field.onChange(c)}
+                  inputProps={
+                    {
+                      'data-testid': 'sched-form-enabled',
+                    } as React.InputHTMLAttributes<HTMLInputElement>
+                  }
+                />
+              }
+              label="Enabled"
+            />
+          )}
+        />
+      </Stack>
+
+      <Box sx={{ mb: 1 }}>
+        <Link
+          component="button"
+          type="button"
+          variant="caption"
+          onClick={toggleMode}
+          data-testid="sched-form-toggle-mode"
+        >
+          {scheduleMode === 'interval'
+            ? 'change to cron mode'
+            : 'change to interval mode'}
+        </Link>
+      </Box>
+
+      <Box sx={{ mb: 2 }}>
+        <Controller
+          control={control}
+          name="chain"
+          render={({ field }) => (
+            <ChainBuilder
+              availableTasks={availableTasks}
+              currentTaskName={taskName}
+              value={field.value}
+              onChange={field.onChange}
+            />
+          )}
+        />
+      </Box>
+
+      <Stack direction="row" spacing={1} justifyContent="flex-end">
+        <Button onClick={onCancel} disabled={submitting} type="button">
+          Cancel
+        </Button>
+        <Button type="submit" variant="contained" disabled={submitting}>
+          {mode === 'create' ? 'Create' : 'Save'}
+        </Button>
+      </Stack>
+    </Box>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/ScheduledTasksPanel/ScheduledTaskRow.tsx b/ui/packages/sep/framework/src/components/ScheduledTasksPanel/ScheduledTaskRow.tsx
new file mode 100644
index 00000000000..f91fece13a9
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ScheduledTasksPanel/ScheduledTaskRow.tsx
@@ -0,0 +1,203 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useState } from 'react';
+import DeleteOutlineIcon from '@mui/icons-material/DeleteOutline';
+import EditOutlinedIcon from '@mui/icons-material/EditOutlined';
+import Button from '@mui/material/Button';
+import Dialog from '@mui/material/Dialog';
+import DialogActions from '@mui/material/DialogActions';
+import DialogContent from '@mui/material/DialogContent';
+import DialogContentText from '@mui/material/DialogContentText';
+import DialogTitle from '@mui/material/DialogTitle';
+import IconButton from '@mui/material/IconButton';
+import Stack from '@mui/material/Stack';
+import Switch from '@mui/material/Switch';
+import TableCell from '@mui/material/TableCell';
+import TableRow from '@mui/material/TableRow';
+import Tooltip from '@mui/material/Tooltip';
+import Typography from '@mui/material/Typography';
+import { LastRunStatus } from './LastRunStatus';
+import { ScheduledTaskForm } from './ScheduledTaskForm';
+import { describePeriod, formatAbsoluteTime } from './periods';
+import type { AvailableTask } from '../ChainBuilder';
+import type {
+  PeriodicTaskCreate,
+  PeriodicTaskResponse,
+  PeriodicTaskUpdate,
+} from './hooks';
+
+const COLUMN_COUNT = 9;
+
+export interface ScheduledTaskRowProps {
+  task: PeriodicTaskResponse;
+  availableTasks: AvailableTask[];
+  isEditing: boolean;
+  onStartEdit: () => void;
+  onCancelEdit: () => void;
+  onToggleEnabled: (task: PeriodicTaskResponse, nextEnabled: boolean) => void;
+  onSubmitEdit: (
+    body: PeriodicTaskCreate | PeriodicTaskUpdate,
+    taskName: string
+  ) => Promise<void>;
+  onDelete: (task: PeriodicTaskResponse) => void;
+  submitting?: boolean;
+  toggling?: boolean;
+  errorMessage?: string;
+}
+
+export function ScheduledTaskRow({
+  task,
+  availableTasks,
+  isEditing,
+  onStartEdit,
+  onCancelEdit,
+  onToggleEnabled,
+  onSubmitEdit,
+  onDelete,
+  submitting,
+  toggling,
+  errorMessage,
+}: ScheduledTaskRowProps) {
+  const [confirmOpen, setConfirmOpen] = useState(false);
+  const period = describePeriod(task);
+  const chainNames = task.execute_request?.chain_task_names ?? [];
+
+  if (isEditing) {
+    return (
+      <TableRow>
+        <TableCell colSpan={COLUMN_COUNT} sx={{ p: 0 }}>
+          <ScheduledTaskForm
+            mode="edit"
+            initialValue={task}
+            availableTasks={availableTasks}
+            onCancel={onCancelEdit}
+            onSubmit={onSubmitEdit}
+            submitting={submitting}
+            errorMessage={errorMessage}
+          />
+        </TableCell>
+      </TableRow>
+    );
+  }
+
+  return (
+    <>
+      <TableRow data-testid={`scheduled-task-row-${task.id}`}>
+        <TableCell>{task.task}</TableCell>
+        <TableCell>
+          {period.tooltip ? (
+            <Tooltip title={period.tooltip}>
+              <span>{period.display}</span>
+            </Tooltip>
+          ) : (
+            period.display
+          )}
+        </TableCell>
+        <TableCell>{formatAbsoluteTime(task.start_time)}</TableCell>
+        <TableCell>
+          <Stack spacing={0.5} alignItems="flex-start">
+            <LastRunStatus
+              status={task.last_run_status}
+              lastRunAt={task.last_run_at}
+            />
+            {task.last_run_at && (
+              <Typography variant="body2" color="text.secondary">
+                {formatAbsoluteTime(task.last_run_at)}
+              </Typography>
+            )}
+          </Stack>
+        </TableCell>
+        <TableCell>{formatAbsoluteTime(task.next_run_at)}</TableCell>
+        <TableCell>{task.total_run_count}</TableCell>
+        <TableCell>
+          {chainNames.length > 0 ? (
+            <Typography variant="body2" sx={{ fontFamily: 'monospace' }}>
+              {chainNames.join(' → ')}
+            </Typography>
+          ) : (
+            '—'
+          )}
+        </TableCell>
+        <TableCell>
+          <Switch
+            checked={task.enabled}
+            disabled={toggling}
+            onChange={(_, checked) => onToggleEnabled(task, checked)}
+            slotProps={{
+              input: {
+                'aria-label': `Enable ${task.task}`,
+              },
+            }}
+          />
+        </TableCell>
+        <TableCell>
+          <Stack direction="row" spacing={0.5}>
+            <Tooltip title="Edit">
+              <IconButton
+                size="small"
+                onClick={onStartEdit}
+                aria-label={`Edit ${task.task}`}
+                data-testid={`scheduled-task-edit-${task.id}`}
+              >
+                <EditOutlinedIcon fontSize="small" />
+              </IconButton>
+            </Tooltip>
+            <Tooltip title="Delete">
+              <IconButton
+                size="small"
+                onClick={() => setConfirmOpen(true)}
+                aria-label={`Delete ${task.task}`}
+                data-testid={`scheduled-task-delete-${task.id}`}
+              >
+                <DeleteOutlineIcon fontSize="small" />
+              </IconButton>
+            </Tooltip>
+          </Stack>
+        </TableCell>
+      </TableRow>
+
+      <Dialog
+        open={confirmOpen}
+        onClose={() => setConfirmOpen(false)}
+        aria-labelledby={`scheduled-task-delete-title-${task.id}`}
+      >
+        <DialogTitle id={`scheduled-task-delete-title-${task.id}`}>
+          Delete periodic task
+        </DialogTitle>
+        <DialogContent>
+          <DialogContentText>
+            {`Delete the periodic task for "${task.task}" (${period.display})?`}
+          </DialogContentText>
+        </DialogContent>
+        <DialogActions>
+          <Button onClick={() => setConfirmOpen(false)}>Cancel</Button>
+          <Button
+            onClick={() => {
+              setConfirmOpen(false);
+              onDelete(task);
+            }}
+            variant="contained"
+            autoFocus
+          >
+            Delete
+          </Button>
+        </DialogActions>
+      </Dialog>
+    </>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/ScheduledTasksPanel/ScheduledTasksPanel.test.tsx b/ui/packages/sep/framework/src/components/ScheduledTasksPanel/ScheduledTasksPanel.test.tsx
new file mode 100644
index 00000000000..f4063bafe3c
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ScheduledTasksPanel/ScheduledTasksPanel.test.tsx
@@ -0,0 +1,405 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { render, screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import type { ReactNode } from 'react';
+
+const { apiMock, usePluginTasksMock } = vi.hoisted(() => ({
+  apiMock: {
+    get: vi.fn(),
+    post: vi.fn(),
+    put: vi.fn(),
+    delete: vi.fn(),
+  },
+  usePluginTasksMock: vi.fn(),
+}));
+
+vi.mock('@sep/api', () => ({
+  apiClient: apiMock,
+  usePluginTasks: (...args: unknown[]) => usePluginTasksMock(...args),
+}));
+
+import { ScheduledTasksPanel } from './ScheduledTasksPanel';
+import type { PeriodicTaskResponse } from './hooks';
+
+function makePeriodic(
+  overrides: Partial<PeriodicTaskResponse> = {}
+): PeriodicTaskResponse {
+  return {
+    id: 1,
+    name: 'periodic-1',
+    task: 'plugin-task',
+    enabled: true,
+    description: '',
+    start_time: null,
+    last_run_at: null,
+    date_changed: null,
+    total_run_count: 0,
+    interval: { every: 1, period: 'hours' },
+    crontab: null,
+    execute_request: null,
+    period: 'every 1 hours',
+    next_run_at: null,
+    ...overrides,
+  };
+}
+
+function makeClient() {
+  return new QueryClient({
+    defaultOptions: { queries: { retry: false, gcTime: 0, staleTime: 0 } },
+  });
+}
+
+function renderPanel(ui: ReactNode) {
+  return render(
+    <QueryClientProvider client={makeClient()}>{ui}</QueryClientProvider>
+  );
+}
+
+beforeEach(() => {
+  apiMock.get.mockReset();
+  apiMock.post.mockReset();
+  apiMock.put.mockReset();
+  apiMock.delete.mockReset();
+  usePluginTasksMock.mockReset();
+});
+
+function setup(periodic: PeriodicTaskResponse[]) {
+  usePluginTasksMock.mockReturnValue({
+    data: {
+      items: [{ name: 'plugin-task' }, { name: 'other-plugin-task' }],
+      pagination: null,
+    },
+    isLoading: false,
+    isError: false,
+  });
+  apiMock.get.mockResolvedValue({ data: periodic });
+}
+
+describe('ScheduledTasksPanel', () => {
+  it('shows empty state when there are no scheduled tasks for the plugin', async () => {
+    setup([]);
+    renderPanel(<ScheduledTasksPanel pluginName="myplugin" />);
+
+    await waitFor(() => {
+      expect(
+        screen.getByText(/No scheduled tasks for myplugin/i)
+      ).toBeInTheDocument();
+    });
+  });
+
+  it('renders each plugin task with period and run count', async () => {
+    setup([
+      makePeriodic({ id: 1, task: 'plugin-task', total_run_count: 3 }),
+      makePeriodic({ id: 2, task: 'foreign-task', total_run_count: 99 }),
+    ]);
+
+    renderPanel(<ScheduledTasksPanel pluginName="myplugin" />);
+
+    await waitFor(() => {
+      expect(screen.getByTestId('scheduled-task-row-1')).toBeInTheDocument();
+    });
+    expect(
+      screen.queryByTestId('scheduled-task-row-2')
+    ).not.toBeInTheDocument();
+    expect(screen.getByText('every 1 hours')).toBeInTheDocument();
+    expect(screen.getByText('3')).toBeInTheDocument();
+  });
+
+  it('toggles enabled via PUT when the switch is clicked', async () => {
+    setup([makePeriodic({ id: 7, enabled: true })]);
+    apiMock.put.mockResolvedValue({ data: { id: 7 } });
+
+    renderPanel(<ScheduledTasksPanel pluginName="myplugin" />);
+
+    const toggle = await screen.findByLabelText(/Enable plugin-task/i);
+    await userEvent.click(toggle);
+
+    await waitFor(() => expect(apiMock.put).toHaveBeenCalledTimes(1));
+    expect(apiMock.put).toHaveBeenCalledWith(
+      '/sep/periodic-tasks/7',
+      expect.objectContaining({ enabled: false })
+    );
+  });
+
+  it('opens delete confirmation and only fires DELETE on confirm', async () => {
+    setup([makePeriodic({ id: 9 })]);
+    apiMock.delete.mockResolvedValue({ data: null });
+
+    renderPanel(<ScheduledTasksPanel pluginName="myplugin" />);
+    const user = userEvent.setup();
+
+    const deleteBtn = await screen.findByTestId('scheduled-task-delete-9');
+    await user.click(deleteBtn);
+
+    expect(screen.getByRole('dialog')).toBeInTheDocument();
+    await user.click(screen.getByRole('button', { name: /Cancel/i }));
+    expect(apiMock.delete).not.toHaveBeenCalled();
+
+    await user.click(await screen.findByTestId('scheduled-task-delete-9'));
+    await user.click(screen.getByRole('button', { name: /^Delete$/ }));
+
+    await waitFor(() =>
+      expect(apiMock.delete).toHaveBeenCalledWith('/sep/periodic-tasks/9')
+    );
+  });
+
+  it('creates an interval task via POST when filling the create form', async () => {
+    setup([]);
+    apiMock.post.mockResolvedValue({ data: makePeriodic({ id: 42 }) });
+
+    renderPanel(<ScheduledTasksPanel pluginName="myplugin" />);
+    const user = userEvent.setup();
+
+    await user.click(await screen.findByTestId('scheduled-tasks-add'));
+    const form = await screen.findByTestId('scheduled-task-form');
+
+    const everyInput = within(form).getByTestId('sched-form-interval-every');
+    await user.clear(everyInput);
+    await user.type(everyInput, '5');
+
+    await user.click(within(form).getByRole('button', { name: /Create/i }));
+
+    await waitFor(() => expect(apiMock.post).toHaveBeenCalledTimes(1));
+    const [url, body] = apiMock.post.mock.calls[0];
+    expect(url).toBe('/sep/periodic-tasks/plugin-task/');
+    expect(body).toMatchObject({
+      task: 'plugin-task',
+      enabled: true,
+      interval: { every: 5, period: 'hours' },
+      crontab: null,
+    });
+  });
+
+  it('switches the create form to cron mode and submits a crontab body', async () => {
+    setup([]);
+    apiMock.post.mockResolvedValue({ data: makePeriodic({ id: 43 }) });
+
+    renderPanel(<ScheduledTasksPanel pluginName="myplugin" />);
+    const user = userEvent.setup();
+
+    await user.click(await screen.findByTestId('scheduled-tasks-add'));
+    const form = await screen.findByTestId('scheduled-task-form');
+
+    await user.click(within(form).getByTestId('sched-form-toggle-mode'));
+
+    const cronInput = within(form).getByTestId('sched-form-cron');
+    await user.type(cronInput, '*/5 * * * *');
+
+    expect(
+      within(form).getByTestId('sched-form-cron-preview')
+    ).toHaveTextContent(/every 5 minutes/i);
+
+    await user.click(within(form).getByRole('button', { name: /Create/i }));
+
+    await waitFor(() => expect(apiMock.post).toHaveBeenCalledTimes(1));
+    const [, body] = apiMock.post.mock.calls[0];
+    expect(body.interval).toBeNull();
+    expect(body.crontab).toMatchObject({
+      minute: '*/5',
+      hour: '*',
+      day_of_month: '*',
+      month_of_year: '*',
+      day_of_week: '*',
+    });
+    expect(body.start_time).toBeNull();
+  });
+
+  it('rejects an invalid cron expression and does not POST', async () => {
+    setup([]);
+    renderPanel(<ScheduledTasksPanel pluginName="myplugin" />);
+    const user = userEvent.setup();
+
+    await user.click(await screen.findByTestId('scheduled-tasks-add'));
+    const form = await screen.findByTestId('scheduled-task-form');
+
+    await user.click(within(form).getByTestId('sched-form-toggle-mode'));
+    await user.type(within(form).getByTestId('sched-form-cron'), 'not-a-cron');
+    await user.click(within(form).getByRole('button', { name: /Create/i }));
+
+    expect(apiMock.post).not.toHaveBeenCalled();
+  });
+
+  it('rejects an empty interval-every value and does not POST', async () => {
+    setup([]);
+    renderPanel(<ScheduledTasksPanel pluginName="myplugin" />);
+    const user = userEvent.setup();
+
+    await user.click(await screen.findByTestId('scheduled-tasks-add'));
+    const form = await screen.findByTestId('scheduled-task-form');
+
+    await user.clear(within(form).getByTestId('sched-form-interval-every'));
+    await user.click(within(form).getByRole('button', { name: /Create/i }));
+
+    expect(apiMock.post).not.toHaveBeenCalled();
+  });
+
+  it('disables the toggle while a previous toggle is in flight', async () => {
+    setup([makePeriodic({ id: 7, enabled: true })]);
+    let resolvePut: (v: unknown) => void = () => {};
+    apiMock.put.mockReturnValue(
+      new Promise((resolve) => {
+        resolvePut = resolve;
+      })
+    );
+
+    renderPanel(<ScheduledTasksPanel pluginName="myplugin" />);
+    const toggle = await screen.findByLabelText(/Enable plugin-task/i);
+    await userEvent.click(toggle);
+
+    await waitFor(() => expect(toggle).toBeDisabled());
+    resolvePut({ data: {} });
+  });
+
+  it('round-trips an existing cron task into the edit form and submits an updated crontab', async () => {
+    setup([
+      makePeriodic({
+        id: 21,
+        interval: null,
+        crontab: {
+          minute: '0',
+          hour: '6',
+          day_of_month: '*',
+          month_of_year: '*',
+          day_of_week: '*',
+          timezone: 'UTC',
+        },
+        period: '0 6 * * *',
+      }),
+    ]);
+    apiMock.put.mockResolvedValue({ data: { id: 21 } });
+
+    renderPanel(<ScheduledTasksPanel pluginName="myplugin" />);
+    const user = userEvent.setup();
+
+    await user.click(await screen.findByTestId('scheduled-task-edit-21'));
+    const form = await screen.findByTestId('scheduled-task-form');
+
+    const cronInput = within(form).getByTestId('sched-form-cron');
+    expect(cronInput).toHaveValue('0 6 * * *');
+
+    await user.clear(cronInput);
+    await user.type(cronInput, '*/15 * * * *');
+    await user.click(within(form).getByRole('button', { name: /Save/i }));
+
+    await waitFor(() => expect(apiMock.put).toHaveBeenCalledTimes(1));
+    const [url, body] = apiMock.put.mock.calls[0];
+    expect(url).toBe('/sep/periodic-tasks/21');
+    expect(body.interval).toBeNull();
+    expect(body.crontab).toMatchObject({
+      minute: '*/15',
+      hour: '*',
+      day_of_month: '*',
+      month_of_year: '*',
+      day_of_week: '*',
+    });
+  });
+
+  it('submits chain_task_names in execute_request when a chain is configured', async () => {
+    setup([]);
+    apiMock.post.mockResolvedValue({ data: makePeriodic({ id: 50 }) });
+
+    renderPanel(<ScheduledTasksPanel pluginName="myplugin" />);
+    const user = userEvent.setup();
+
+    await user.click(await screen.findByTestId('scheduled-tasks-add'));
+    const form = await screen.findByTestId('scheduled-task-form');
+
+    const chainBuilder = within(form).getByTestId('chain-builder');
+    await user.click(within(chainBuilder).getByRole('combobox'));
+    const option = await screen.findByRole('option', {
+      name: 'other-plugin-task',
+    });
+    await user.click(option);
+
+    await user.click(within(form).getByRole('button', { name: /Create/i }));
+
+    await waitFor(() => expect(apiMock.post).toHaveBeenCalledTimes(1));
+    const [, body] = apiMock.post.mock.calls[0];
+    expect(body.execute_request).toMatchObject({
+      chain_task_names: ['other-plugin-task'],
+      chain_on_failure: false,
+    });
+  });
+
+  it('shows a panel-level error when a toggle mutation fails', async () => {
+    setup([makePeriodic({ id: 60, enabled: true })]);
+    apiMock.put.mockRejectedValue(new Error('toggle blew up'));
+
+    renderPanel(<ScheduledTasksPanel pluginName="myplugin" />);
+
+    const toggle = await screen.findByLabelText(/Enable plugin-task/i);
+    await userEvent.click(toggle);
+
+    const alert = await screen.findByTestId('scheduled-tasks-action-error');
+    expect(alert).toHaveTextContent(/toggle blew up/i);
+  });
+
+  it('shows a panel-level error when a delete mutation fails', async () => {
+    setup([makePeriodic({ id: 61 })]);
+    apiMock.delete.mockRejectedValue(new Error('delete blew up'));
+
+    renderPanel(<ScheduledTasksPanel pluginName="myplugin" />);
+    const user = userEvent.setup();
+
+    await user.click(await screen.findByTestId('scheduled-task-delete-61'));
+    await user.click(screen.getByRole('button', { name: /^Delete$/ }));
+
+    const alert = await screen.findByTestId('scheduled-tasks-action-error');
+    expect(alert).toHaveTextContent(/delete blew up/i);
+  });
+
+  it('shows an inline form error when a create mutation fails', async () => {
+    setup([]);
+    apiMock.post.mockRejectedValue(new Error('create blew up'));
+
+    renderPanel(<ScheduledTasksPanel pluginName="myplugin" />);
+    const user = userEvent.setup();
+
+    await user.click(await screen.findByTestId('scheduled-tasks-add'));
+    const form = await screen.findByTestId('scheduled-task-form');
+    await user.click(within(form).getByRole('button', { name: /Create/i }));
+
+    await waitFor(() => {
+      expect(within(form).getByText(/create blew up/i)).toBeInTheDocument();
+    });
+  });
+
+  it('submits an edit via PUT with the updated schedule', async () => {
+    setup([makePeriodic({ id: 11 })]);
+    apiMock.put.mockResolvedValue({ data: makePeriodic({ id: 11 }) });
+
+    renderPanel(<ScheduledTasksPanel pluginName="myplugin" />);
+    const user = userEvent.setup();
+
+    await user.click(await screen.findByTestId('scheduled-task-edit-11'));
+    const form = await screen.findByTestId('scheduled-task-form');
+
+    const everyInput = within(form).getByTestId('sched-form-interval-every');
+    await user.clear(everyInput);
+    await user.type(everyInput, '10');
+    await user.click(within(form).getByRole('button', { name: /Save/i }));
+
+    await waitFor(() => expect(apiMock.put).toHaveBeenCalledTimes(1));
+    const [url, body] = apiMock.put.mock.calls[0];
+    expect(url).toBe('/sep/periodic-tasks/11');
+    expect(body.interval).toMatchObject({ every: 10, period: 'hours' });
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/ScheduledTasksPanel/ScheduledTasksPanel.tsx b/ui/packages/sep/framework/src/components/ScheduledTasksPanel/ScheduledTasksPanel.tsx
new file mode 100644
index 00000000000..158c9c1d5fc
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ScheduledTasksPanel/ScheduledTasksPanel.tsx
@@ -0,0 +1,293 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useMemo, useState } from 'react';
+import AddIcon from '@mui/icons-material/Add';
+import ScheduleIcon from '@mui/icons-material/Schedule';
+import Alert from '@mui/material/Alert';
+import Box from '@mui/material/Box';
+import Button from '@mui/material/Button';
+import CircularProgress from '@mui/material/CircularProgress';
+import Paper from '@mui/material/Paper';
+import Stack from '@mui/material/Stack';
+import Table from '@mui/material/Table';
+import TableBody from '@mui/material/TableBody';
+import TableCell from '@mui/material/TableCell';
+import TableContainer from '@mui/material/TableContainer';
+import TableHead from '@mui/material/TableHead';
+import TableRow from '@mui/material/TableRow';
+import Typography from '@mui/material/Typography';
+import { ScheduledTaskForm } from './ScheduledTaskForm';
+import { ScheduledTaskRow } from './ScheduledTaskRow';
+import {
+  useCreateScheduledTask,
+  useDeleteScheduledTask,
+  useScheduledTasksForPlugin,
+  useUpdateScheduledTask,
+  type PeriodicTaskCreate,
+  type PeriodicTaskResponse,
+  type PeriodicTaskUpdate,
+} from './hooks';
+
+interface ScheduledTasksPanelProps {
+  pluginName: string;
+  /** Disable list polling. Used by stories/tests. */
+  disablePolling?: boolean;
+}
+
+const COLUMN_HEADERS = [
+  'Task',
+  'Period',
+  'Start Time',
+  'Last Run',
+  'Next Run',
+  'Runs',
+  'Chain',
+  'Enabled',
+  'Actions',
+];
+
+export function ScheduledTasksPanel({
+  pluginName,
+  disablePolling = false,
+}: ScheduledTasksPanelProps) {
+  const { periodicTasks, pluginTasks, isLoading, isError, error } =
+    useScheduledTasksForPlugin(pluginName, { disablePolling });
+
+  const createMut = useCreateScheduledTask();
+  const updateMut = useUpdateScheduledTask();
+  const deleteMut = useDeleteScheduledTask();
+
+  const [creating, setCreating] = useState(false);
+  const [editingId, setEditingId] = useState<number | null>(null);
+  const [formError, setFormError] = useState<string | undefined>(undefined);
+  const [actionError, setActionError] = useState<string | undefined>(undefined);
+
+  const availableTasks = useMemo(
+    () => pluginTasks.map((t) => ({ name: t.name })),
+    [pluginTasks]
+  );
+
+  const handleToggleEnabled = async (
+    task: PeriodicTaskResponse,
+    nextEnabled: boolean
+  ) => {
+    // PeriodicTaskUpdate requires `kwargs` and `description`, but
+    // PeriodicTaskResponse declares only `description`. Preserve `kwargs` when
+    // the response happens to carry it so a plain enable/disable toggle does
+    // not silently wipe a task's arguments; '{}' stays the last-resort
+    // fallback. Tracked upstream as a backend schema gap.
+    const rawKwargs = (task as { kwargs?: unknown }).kwargs;
+    // The wire shape is unverified either way, so accept both: a JSON string
+    // passes through, a decoded object is re-serialised. Anything else (or a
+    // blank value) falls back to '{}' — the only case that still loses data.
+    let preservedKwargs = '{}';
+    if (typeof rawKwargs === 'string' && rawKwargs.trim() !== '') {
+      preservedKwargs = rawKwargs;
+    } else if (rawKwargs !== null && typeof rawKwargs === 'object') {
+      preservedKwargs = JSON.stringify(rawKwargs);
+    }
+    const body: PeriodicTaskUpdate = {
+      name: task.name,
+      task: task.task,
+      enabled: nextEnabled,
+      description: task.description,
+      kwargs: preservedKwargs,
+      start_time: task.start_time,
+      interval: task.interval ?? null,
+      crontab: task.crontab ?? null,
+      execute_request: task.execute_request ?? null,
+    };
+    setActionError(undefined);
+    try {
+      await updateMut.mutateAsync({ id: task.id, body });
+    } catch (e) {
+      setActionError(
+        e instanceof Error ? e.message : 'Failed to toggle scheduled task'
+      );
+    }
+  };
+
+  const handleDelete = async (task: PeriodicTaskResponse) => {
+    setActionError(undefined);
+    try {
+      await deleteMut.mutateAsync(task.id);
+    } catch (e) {
+      setActionError(
+        e instanceof Error ? e.message : 'Failed to delete scheduled task'
+      );
+    }
+  };
+
+  const handleCreate = async (
+    body: PeriodicTaskCreate | PeriodicTaskUpdate,
+    taskName: string
+  ) => {
+    setFormError(undefined);
+    try {
+      await createMut.mutateAsync({
+        taskName,
+        body: body as PeriodicTaskCreate,
+      });
+      setCreating(false);
+    } catch (e) {
+      setFormError(
+        e instanceof Error ? e.message : 'Failed to create scheduled task'
+      );
+    }
+  };
+
+  const handleEditSubmit = (task: PeriodicTaskResponse) => {
+    return async (body: PeriodicTaskCreate | PeriodicTaskUpdate) => {
+      setFormError(undefined);
+      try {
+        await updateMut.mutateAsync({
+          id: task.id,
+          body: body as PeriodicTaskUpdate,
+        });
+        setEditingId(null);
+      } catch (e) {
+        setFormError(
+          e instanceof Error ? e.message : 'Failed to update scheduled task'
+        );
+      }
+    };
+  };
+
+  const startCreate = () => {
+    setEditingId(null);
+    setFormError(undefined);
+    setCreating(true);
+  };
+
+  const startEdit = (id: number) => {
+    setCreating(false);
+    setFormError(undefined);
+    setEditingId(id);
+  };
+
+  const headerRow = (
+    <TableHead>
+      <TableRow>
+        {COLUMN_HEADERS.map((h) => (
+          <TableCell key={h}>{h}</TableCell>
+        ))}
+      </TableRow>
+    </TableHead>
+  );
+
+  if (isLoading) {
+    return (
+      <Paper variant="outlined" sx={{ p: 3, textAlign: 'center' }}>
+        <CircularProgress size={24} />
+      </Paper>
+    );
+  }
+
+  if (isError) {
+    return (
+      <Alert severity="error">
+        Failed to load scheduled tasks{error ? `: ${error.message}` : ''}
+      </Alert>
+    );
+  }
+
+  const isEmpty = periodicTasks.length === 0 && !creating;
+
+  return (
+    <Paper variant="outlined" data-testid="scheduled-tasks-panel">
+      <Box sx={{ p: 2, display: 'flex', alignItems: 'center', gap: 1 }}>
+        <ScheduleIcon fontSize="small" />
+        <Typography variant="h6">Scheduled Tasks</Typography>
+      </Box>
+
+      {actionError && (
+        <Alert
+          severity="error"
+          onClose={() => setActionError(undefined)}
+          sx={{ mx: 2, mb: 1 }}
+          data-testid="scheduled-tasks-action-error"
+        >
+          {actionError}
+        </Alert>
+      )}
+
+      {isEmpty ? (
+        <Box sx={{ p: 3, textAlign: 'center' }}>
+          <Typography variant="body2" color="text.secondary">
+            No scheduled tasks for {pluginName}.
+          </Typography>
+        </Box>
+      ) : (
+        <TableContainer>
+          <Table size="small">
+            {headerRow}
+            <TableBody>
+              {periodicTasks.map((task) => (
+                <ScheduledTaskRow
+                  key={task.id}
+                  task={task}
+                  availableTasks={availableTasks}
+                  isEditing={editingId === task.id}
+                  onStartEdit={() => startEdit(task.id)}
+                  onCancelEdit={() => setEditingId(null)}
+                  onToggleEnabled={handleToggleEnabled}
+                  onSubmitEdit={handleEditSubmit(task)}
+                  onDelete={handleDelete}
+                  submitting={updateMut.isPending}
+                  toggling={updateMut.isPending}
+                  errorMessage={editingId === task.id ? formError : undefined}
+                />
+              ))}
+            </TableBody>
+          </Table>
+        </TableContainer>
+      )}
+
+      {creating && (
+        <Box sx={{ borderTop: 1, borderColor: 'divider' }}>
+          <ScheduledTaskForm
+            mode="create"
+            availableTasks={availableTasks}
+            defaultTaskName={availableTasks[0]?.name}
+            onCancel={() => setCreating(false)}
+            onSubmit={handleCreate}
+            submitting={createMut.isPending}
+            errorMessage={formError}
+          />
+        </Box>
+      )}
+
+      {!creating && (
+        <Stack
+          direction="row"
+          justifyContent="flex-end"
+          sx={{ p: 1, borderTop: 1, borderColor: 'divider' }}
+        >
+          <Button
+            startIcon={<AddIcon />}
+            onClick={startCreate}
+            disabled={availableTasks.length === 0}
+            data-testid="scheduled-tasks-add"
+          >
+            Add new
+          </Button>
+        </Stack>
+      )}
+    </Paper>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/ScheduledTasksPanel/hooks.ts b/ui/packages/sep/framework/src/components/ScheduledTasksPanel/hooks.ts
new file mode 100644
index 00000000000..5b8561b080c
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ScheduledTasksPanel/hooks.ts
@@ -0,0 +1,173 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import {
+  apiClient,
+  usePluginTasks,
+  type TaskHistoryStatus,
+  type TasksComponents,
+} from '@sep/api';
+
+/**
+ * STUB (backend-assumed): `last_run_status` is served by the periodic-task API
+ * (SEP-1607) but is not yet in PMM's committed OpenAPI spec, so it is layered
+ * on here. Drop this intersection once `specs/tasks.json` is regenerated with
+ * the field.
+ */
+export type PeriodicTaskResponse =
+  TasksComponents['schemas']['PeriodicTaskResponse'] & {
+    /** Last-run outcome; null when never run or unresolved (see LastRunStatus). */
+    last_run_status?: TaskHistoryStatus | null;
+  };
+export type PeriodicTaskCreate =
+  TasksComponents['schemas']['PeriodicTaskCreate'];
+export type PeriodicTaskUpdate =
+  TasksComponents['schemas']['PeriodicTaskUpdate'];
+export type IntervalSchedule = TasksComponents['schemas']['IntervalSchedule'];
+export type CrontabSchedule = TasksComponents['schemas']['CrontabSchedule'];
+export type PeriodicTaskExecuteRequest =
+  TasksComponents['schemas']['PeriodicTaskExecuteRequest'];
+
+const PERIODIC_LIST_KEY = ['periodic'] as const;
+const POLL_INTERVAL_MS = 30_000;
+
+interface PluginTask extends Record<string, unknown> {
+  name: string;
+}
+
+/**
+ * Fetch all periodic tasks and filter to those whose `task` belongs to the
+ * given plugin (resolved via `usePluginTasks`). The two queries are kept
+ * independent so the periodic list can poll on its own cadence for
+ * `last_run_at` / `next_run_at` freshness.
+ */
+export interface UseScheduledTasksOptions {
+  /** Override polling interval (ms). Defaults to 30000. */
+  pollingIntervalMs?: number;
+  /** Disable polling (stories, tests). */
+  disablePolling?: boolean;
+}
+
+export function useScheduledTasksForPlugin(
+  pluginName: string,
+  options: UseScheduledTasksOptions = {}
+) {
+  const { pollingIntervalMs = POLL_INTERVAL_MS, disablePolling = false } =
+    options;
+  // Forward the escape hatch: `usePluginTasks` now polls while a task row is
+  // running, so without this a story/test that sets `disablePolling` would
+  // still spin up a live task-list refetch. The task-list poll keeps its own
+  // default cadence — the schedule `pollingIntervalMs` governs periodic-task
+  // freshness, a separate concern. `fetchAllPages` walks the paginated task
+  // list so schedule joins see every definition, not just the first page.
+  const tasksQuery = usePluginTasks<PluginTask>(pluginName, undefined, {
+    fetchAllPages: true,
+    disablePolling,
+  });
+  const pluginTaskNames = tasksQuery.data?.items.map((t) => t.name) ?? [];
+
+  const periodicQuery = useQuery<
+    PeriodicTaskResponse[],
+    Error,
+    PeriodicTaskResponse[]
+  >({
+    queryKey: PERIODIC_LIST_KEY,
+    queryFn: async () => {
+      const { data } = await apiClient.get<PeriodicTaskResponse[]>(
+        '/sep/periodic-tasks/'
+      );
+      return data;
+    },
+    refetchInterval: disablePolling ? false : pollingIntervalMs,
+  });
+
+  // Filter only after both queries have data, otherwise during the initial
+  // load the empty `pluginTaskNames` set would briefly hide every periodic
+  // task and the panel would flash an empty state before flipping populated.
+  const ready = !!tasksQuery.data && !!periodicQuery.data;
+  const allowed = new Set(pluginTaskNames);
+  const filtered = ready
+    ? (periodicQuery.data ?? []).filter((p) => allowed.has(p.task))
+    : [];
+
+  return {
+    periodicTasks: filtered,
+    pluginTasks: tasksQuery.data?.items ?? [],
+    isLoading: tasksQuery.isLoading || periodicQuery.isLoading,
+    isError: tasksQuery.isError || periodicQuery.isError,
+    error: tasksQuery.error ?? periodicQuery.error,
+    refetch: () => {
+      void tasksQuery.refetch();
+      return periodicQuery.refetch();
+    },
+  };
+}
+
+interface CreateVars {
+  taskName: string;
+  body: PeriodicTaskCreate;
+}
+
+export function useCreateScheduledTask() {
+  const queryClient = useQueryClient();
+  return useMutation<PeriodicTaskResponse, Error, CreateVars>({
+    mutationFn: async ({ taskName, body }) => {
+      const { data } = await apiClient.post<PeriodicTaskResponse>(
+        `/sep/periodic-tasks/${encodeURIComponent(taskName)}/`,
+        body
+      );
+      return data;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: PERIODIC_LIST_KEY });
+    },
+  });
+}
+
+interface UpdateVars {
+  id: number;
+  body: PeriodicTaskUpdate;
+}
+
+export function useUpdateScheduledTask() {
+  const queryClient = useQueryClient();
+  return useMutation<PeriodicTaskResponse, Error, UpdateVars>({
+    mutationFn: async ({ id, body }) => {
+      const { data } = await apiClient.put<PeriodicTaskResponse>(
+        `/sep/periodic-tasks/${id}`,
+        body
+      );
+      return data;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: PERIODIC_LIST_KEY });
+    },
+  });
+}
+
+export function useDeleteScheduledTask() {
+  const queryClient = useQueryClient();
+  return useMutation<void, Error, number>({
+    mutationFn: async (id) => {
+      await apiClient.delete(`/sep/periodic-tasks/${id}`);
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: PERIODIC_LIST_KEY });
+    },
+  });
+}
diff --git a/ui/packages/sep/framework/src/components/ScheduledTasksPanel/index.ts b/ui/packages/sep/framework/src/components/ScheduledTasksPanel/index.ts
new file mode 100644
index 00000000000..aabc13e4999
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ScheduledTasksPanel/index.ts
@@ -0,0 +1,29 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { ScheduledTasksPanel } from './ScheduledTasksPanel';
+export { LastRunStatus } from './LastRunStatus';
+export type { LastRunStatusProps } from './LastRunStatus';
+export { useScheduledTasksForPlugin } from './hooks';
+export type { UseScheduledTasksOptions, PeriodicTaskResponse } from './hooks';
+export {
+  describePeriod,
+  formatRelativeTime,
+  formatAbsoluteTime,
+  selectSchedule,
+} from './periods';
+export type { PeriodDescription } from './periods';
diff --git a/ui/packages/sep/framework/src/components/ScheduledTasksPanel/periods.test.ts b/ui/packages/sep/framework/src/components/ScheduledTasksPanel/periods.test.ts
new file mode 100644
index 00000000000..ea6b87537ea
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ScheduledTasksPanel/periods.test.ts
@@ -0,0 +1,105 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { describePeriod, formatRelativeTime, selectSchedule } from './periods';
+import type { PeriodicTaskResponse } from './hooks';
+
+const NOW = new Date('2026-06-18T12:00:00Z').getTime();
+
+function makePeriodic(
+  overrides: Partial<PeriodicTaskResponse> = {}
+): PeriodicTaskResponse {
+  return {
+    id: 1,
+    name: 'periodic-1',
+    task: 'plugin-task',
+    enabled: true,
+    description: '',
+    start_time: null,
+    last_run_at: null,
+    date_changed: null,
+    total_run_count: 0,
+    interval: { every: 1, period: 'hours' },
+    crontab: null,
+    execute_request: null,
+    period: 'every 1 hours',
+    next_run_at: null,
+    ...overrides,
+  };
+}
+
+describe('formatRelativeTime', () => {
+  it('formats a future timestamp', () => {
+    expect(formatRelativeTime('2026-06-18T14:00:00Z', NOW)).toBe('in 2 hours');
+  });
+
+  it('formats a past timestamp', () => {
+    expect(formatRelativeTime('2026-06-15T12:00:00Z', NOW)).toBe('3 days ago');
+  });
+
+  it('returns the raw value for an invalid date', () => {
+    expect(formatRelativeTime('not-a-date', NOW)).toBe('not-a-date');
+  });
+});
+
+describe('describePeriod', () => {
+  it('describes interval schedules', () => {
+    expect(describePeriod(makePeriodic()).display).toBe('every 1 hours');
+  });
+
+  it('humanises cron schedules and keeps the raw expression as a tooltip', () => {
+    const result = describePeriod(
+      makePeriodic({
+        interval: null,
+        crontab: {
+          minute: '0',
+          hour: '9',
+          day_of_month: '*',
+          month_of_year: '*',
+          day_of_week: '*',
+          timezone: 'UTC',
+        },
+      })
+    );
+    expect(result.display).toContain('9:00');
+    expect(result.tooltip).toBe('0 9 * * * (UTC)');
+  });
+});
+
+describe('selectSchedule', () => {
+  it('returns undefined when there are no candidates', () => {
+    expect(selectSchedule([])).toBeUndefined();
+  });
+
+  it('returns the only candidate', () => {
+    const only = makePeriodic({ id: 7 });
+    expect(selectSchedule([only])).toBe(only);
+  });
+
+  it('prefers the soonest upcoming run when several share a task', () => {
+    const later = makePeriodic({ id: 1, next_run_at: '2026-06-18T20:00:00Z' });
+    const sooner = makePeriodic({ id: 2, next_run_at: '2026-06-18T13:00:00Z' });
+    expect(selectSchedule([later, sooner])).toBe(sooner);
+  });
+
+  it('falls back to the first candidate when none have a next run', () => {
+    const a = makePeriodic({ id: 1, next_run_at: null });
+    const b = makePeriodic({ id: 2, next_run_at: null });
+    expect(selectSchedule([a, b])).toBe(a);
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/ScheduledTasksPanel/periods.ts b/ui/packages/sep/framework/src/components/ScheduledTasksPanel/periods.ts
new file mode 100644
index 00000000000..67b0f0c5db1
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ScheduledTasksPanel/periods.ts
@@ -0,0 +1,127 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import cronstrue from 'cronstrue';
+import type { PeriodicTaskResponse } from './hooks';
+
+/** Plain-language description of a periodic task's recurrence. */
+export interface PeriodDescription {
+  /** Human-readable recurrence (for example, "every 1 hours" or a cron phrase). */
+  display: string;
+  /** Optional raw detail (the cron expression, with timezone) shown on hover. */
+  tooltip?: string;
+}
+
+/**
+ * Describe a periodic task's recurrence in plain language.
+ *
+ * Crontab schedules are humanised via `cronstrue` with the raw expression (and
+ * timezone, when present) kept as the tooltip; interval schedules render as
+ * "every N period". Shared by the scheduled-tasks table, the list schedule
+ * cell, and the detail schedule summary so the wording stays consistent.
+ */
+export function describePeriod(task: PeriodicTaskResponse): PeriodDescription {
+  if (task.crontab) {
+    const expr = `${task.crontab.minute} ${task.crontab.hour} ${task.crontab.day_of_month} ${task.crontab.month_of_year} ${task.crontab.day_of_week}`;
+    try {
+      const human = cronstrue.toString(expr);
+      const text = human.charAt(0).toLowerCase() + human.slice(1);
+      const tz = task.crontab.timezone;
+      return {
+        display: text,
+        tooltip: tz ? `${expr} (${tz})` : expr,
+      };
+    } catch {
+      return { display: expr, tooltip: 'Invalid cron expression' };
+    }
+  }
+  if (task.interval) {
+    return { display: `every ${task.interval.every} ${task.interval.period}` };
+  }
+  return { display: task.period || '—' };
+}
+
+const RELATIVE_DIVISIONS: {
+  amount: number;
+  unit: Intl.RelativeTimeFormatUnit;
+}[] = [
+  { amount: 60, unit: 'seconds' },
+  { amount: 60, unit: 'minutes' },
+  { amount: 24, unit: 'hours' },
+  { amount: 7, unit: 'days' },
+  { amount: 4.34524, unit: 'weeks' },
+  { amount: 12, unit: 'months' },
+  { amount: Number.POSITIVE_INFINITY, unit: 'years' },
+];
+
+/**
+ * Format an ISO timestamp as a signed relative time (for example, "in 2 hours"
+ * or "3 days ago"). Returns the raw input unchanged when it is not a valid
+ * date. `now` is injectable so tests stay deterministic.
+ */
+export function formatRelativeTime(
+  value: string,
+  now: number = Date.now()
+): string {
+  const target = new Date(value).getTime();
+  if (Number.isNaN(target)) {
+    return value;
+  }
+  const rtf = new Intl.RelativeTimeFormat(undefined, { numeric: 'auto' });
+  let duration = (target - now) / 1000;
+  for (const division of RELATIVE_DIVISIONS) {
+    if (Math.abs(duration) < division.amount) {
+      return rtf.format(Math.round(duration), division.unit);
+    }
+    duration /= division.amount;
+  }
+  return value;
+}
+
+/** Format an ISO timestamp as a locale absolute date-time, or `—` when absent. */
+export function formatAbsoluteTime(value: string | null | undefined): string {
+  if (!value) {
+    return '—';
+  }
+  const d = new Date(value);
+  return Number.isNaN(d.getTime()) ? value : d.toLocaleString();
+}
+
+/**
+ * Pick the single schedule to surface for a task that may own several periodic
+ * schedules (the backend does not constrain a `task` to one schedule). Prefers
+ * the soonest upcoming run — the earliest `next_run_at` — and falls back to the
+ * first candidate so a disabled-only task (no `next_run_at`) still shows
+ * something. Shared by the list cell and the detail summary so both always
+ * select the same schedule for a given task.
+ */
+export function selectSchedule(
+  candidates: PeriodicTaskResponse[]
+): PeriodicTaskResponse | undefined {
+  if (candidates.length <= 1) {
+    return candidates[0];
+  }
+  const withNextRun = candidates.filter(
+    (t): t is PeriodicTaskResponse & { next_run_at: string } =>
+      Boolean(t.next_run_at)
+  );
+  const soonest = [...withNextRun].sort(
+    (a, b) =>
+      new Date(a.next_run_at).getTime() - new Date(b.next_run_at).getTime()
+  )[0];
+  return soonest ?? candidates[0];
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/DeleteConfirmDialog.tsx b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/DeleteConfirmDialog.tsx
new file mode 100644
index 00000000000..32dc6408ca3
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/DeleteConfirmDialog.tsx
@@ -0,0 +1,89 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useId } from 'react';
+import Button from '@mui/material/Button';
+import Dialog from '@mui/material/Dialog';
+import DialogActions from '@mui/material/DialogActions';
+import DialogContent from '@mui/material/DialogContent';
+import DialogContentText from '@mui/material/DialogContentText';
+import DialogTitle from '@mui/material/DialogTitle';
+
+export interface DeleteConfirmDialogProps {
+  open: boolean;
+  onClose: () => void;
+  onConfirm: () => void;
+  title: string;
+  description: string;
+  confirmLabel?: string;
+  cancelLabel?: string;
+  confirmDisabled?: boolean;
+}
+
+/** Accessible confirm dialog for destructive actions (replaces ``window.confirm``). */
+export function DeleteConfirmDialog({
+  open,
+  onClose,
+  onConfirm,
+  title,
+  description,
+  confirmLabel = 'Delete',
+  cancelLabel = 'Cancel',
+  confirmDisabled = false,
+}: DeleteConfirmDialogProps) {
+  const titleId = useId();
+  const descriptionId = useId();
+
+  return (
+    <Dialog
+      open={open}
+      aria-labelledby={titleId}
+      aria-describedby={descriptionId}
+      disableEscapeKeyDown={confirmDisabled}
+      onClose={() => {
+        if (!confirmDisabled) {
+          onClose();
+        }
+      }}
+    >
+      <DialogTitle id={titleId}>{title}</DialogTitle>
+      <DialogContent>
+        <DialogContentText id={descriptionId}>{description}</DialogContentText>
+      </DialogContent>
+      <DialogActions sx={{ px: 3, pb: 2, pt: 0, gap: 1 }}>
+        <Button
+          variant="outlined"
+          color="inherit"
+          onClick={onClose}
+          disabled={confirmDisabled}
+          sx={{ minWidth: 96 }}
+        >
+          {cancelLabel}
+        </Button>
+        <Button
+          variant="contained"
+          onClick={onConfirm}
+          disabled={confirmDisabled}
+          autoFocus
+          sx={{ minWidth: 96 }}
+        >
+          {confirmLabel}
+        </Button>
+      </DialogActions>
+    </Dialog>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/DetailSyntaxHighlighter.tsx b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/DetailSyntaxHighlighter.tsx
new file mode 100644
index 00000000000..1414882ab76
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/DetailSyntaxHighlighter.tsx
@@ -0,0 +1,117 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/** Chunk lazy-loaded from ``PluginDetailPage`` — keeps ``sql-formatter`` and ``prism-react-renderer`` out of the main framework bundle. */
+
+import { format as formatSql } from 'sql-formatter';
+import { Highlight, themes } from 'prism-react-renderer';
+import Box from '@mui/material/Box';
+import { useTheme } from '@mui/material/styles';
+import { detailPrism } from './detailPrism';
+import {
+  detailSyntaxBlockSx,
+  type DetailSyntaxLanguage,
+} from './detailSyntaxStyles';
+
+function formatCreateSql(raw: string): string {
+  const trimmed = raw.trim();
+  if (!trimmed) {
+    return raw;
+  }
+  try {
+    return formatSql(trimmed, { language: 'mysql', tabWidth: 2 });
+  } catch {
+    return raw;
+  }
+}
+
+function formatKeysForDisplay(value: unknown): string {
+  if (typeof value === 'string') {
+    const t = value.trim();
+    if (!t) {
+      return value;
+    }
+    try {
+      return JSON.stringify(JSON.parse(t), null, 2);
+    } catch {
+      return value;
+    }
+  }
+  if (value !== null && typeof value === 'object') {
+    return JSON.stringify(value, null, 2);
+  }
+  return String(value);
+}
+
+function formatDetailSyntaxCode(
+  value: unknown,
+  language: DetailSyntaxLanguage
+): string {
+  if (language === 'sql') {
+    return typeof value === 'string' ? formatCreateSql(value) : String(value);
+  }
+  if (language === 'yaml') {
+    // A non-string value can't be raw YAML; pretty-print it rather than
+    // rendering "[object Object]".
+    return typeof value === 'string' ? value : formatKeysForDisplay(value);
+  }
+  return formatKeysForDisplay(value);
+}
+
+interface DetailSyntaxHighlighterProps {
+  value: unknown;
+  language: DetailSyntaxLanguage;
+}
+
+export default function DetailSyntaxHighlighter({
+  value,
+  language,
+}: DetailSyntaxHighlighterProps) {
+  const muiTheme = useTheme();
+  const prismTheme =
+    muiTheme.palette.mode === 'dark' ? themes.vsDark : themes.vsLight;
+  const code = formatDetailSyntaxCode(value, language);
+
+  return (
+    <Highlight
+      prism={detailPrism}
+      theme={prismTheme}
+      code={code}
+      language={language}
+    >
+      {({ className, style, tokens, getLineProps, getTokenProps }) => (
+        <Box
+          component="pre"
+          className={className}
+          style={style}
+          sx={{
+            ...detailSyntaxBlockSx,
+            margin: 0,
+          }}
+        >
+          {tokens.map((line, i) => (
+            <div key={i} {...getLineProps({ line })}>
+              {line.map((token, key) => (
+                <span key={key} {...getTokenProps({ token })} />
+              ))}
+            </div>
+          ))}
+        </Box>
+      )}
+    </Highlight>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginCreatePage.test.tsx b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginCreatePage.test.tsx
new file mode 100644
index 00000000000..51ab2386827
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginCreatePage.test.tsx
@@ -0,0 +1,171 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { act, render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { MemoryRouter } from 'react-router-dom';
+import { SnackbarProvider } from 'notistack';
+import type { PluginSchema } from '@sep/api';
+import { PluginCreatePage } from './PluginCreatePage';
+import type { RenderFormSlot } from './types';
+
+const mockCreateTaskMutate = vi.fn();
+const mockNavigate = vi.fn();
+
+vi.mock('@sep/api', () => ({
+  useCreatePluginTask: () => ({
+    mutate: mockCreateTaskMutate,
+    isPending: false,
+  }),
+  useCreatePluginEntity: () => ({ mutate: vi.fn(), isPending: false }),
+}));
+
+vi.mock('react-router-dom', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('react-router-dom')>();
+  return { ...actual, useNavigate: () => mockNavigate };
+});
+
+beforeEach(() => {
+  mockCreateTaskMutate.mockReset();
+  mockNavigate.mockReset();
+});
+
+const schema: PluginSchema = {
+  pluginName: 'checksums',
+  display_name: 'Checksum',
+  description: 'Test',
+  capabilities: {},
+  list_view: { columns: [{ key: 'name', label: 'Name' }] },
+  forms: [
+    {
+      title: 'Main',
+      fields: [
+        { type: 'string', name: 'title', label: 'Title' },
+        { type: 'integer', name: 'count', label: 'Count' },
+      ],
+    },
+  ],
+} as unknown as PluginSchema;
+
+function renderPage(extra?: { renderCreateForm?: RenderFormSlot }) {
+  return render(
+    <SnackbarProvider>
+      <MemoryRouter initialEntries={['/apps/checksums/new']}>
+        <PluginCreatePage schema={schema} pluginName="checksums" {...extra} />
+      </MemoryRouter>
+    </SnackbarProvider>
+  );
+}
+
+describe('PluginCreatePage — renderCreateForm slot', () => {
+  it('renders the default SchemaFormRenderer when no slot is supplied', () => {
+    renderPage();
+    // Default form body: the schema field renders, with the framework chrome.
+    expect(screen.getByText('New Checksum')).toBeInTheDocument();
+    expect(screen.getByLabelText('Title')).toBeInTheDocument();
+    expect(screen.queryByTestId('custom-form')).toBeNull();
+  });
+
+  it('replaces only the form body with the slot, keeping the page chrome', () => {
+    const renderCreateForm: RenderFormSlot = () => (
+      <div data-testid="custom-form">custom body</div>
+    );
+    renderPage({ renderCreateForm });
+    // Chrome preserved (title); default form body replaced.
+    expect(screen.getByText('New Checksum')).toBeInTheDocument();
+    expect(screen.getByTestId('custom-form')).toBeInTheDocument();
+    expect(screen.queryByLabelText('Title')).toBeNull();
+  });
+
+  it('falls back to the default form when the slot returns a nullish value', () => {
+    const renderCreateForm: RenderFormSlot = () => null;
+    renderPage({ renderCreateForm });
+    // null slot → default SchemaFormRenderer renders the schema fields.
+    expect(screen.getByLabelText('Title')).toBeInTheDocument();
+    expect(screen.queryByTestId('custom-form')).toBeNull();
+  });
+
+  it('wires the framework submit handler into the slot and coerces the payload', async () => {
+    const user = userEvent.setup();
+    // A custom slot that bypasses SchemaFormRenderer submits raw string values;
+    // the page submit boundary must still coerce `count` to a number.
+    const renderCreateForm: RenderFormSlot = ({ onSubmit, loading }) => (
+      <button
+        type="button"
+        disabled={loading}
+        onClick={() => onSubmit({ title: 'from-slot', count: '7' })}
+      >
+        Submit slot
+      </button>
+    );
+    renderPage({ renderCreateForm });
+
+    await user.click(screen.getByRole('button', { name: 'Submit slot' }));
+    await waitFor(() => expect(mockCreateTaskMutate).toHaveBeenCalledTimes(1));
+    expect(mockCreateTaskMutate).toHaveBeenCalledWith(
+      { title: 'from-slot', count: 7 },
+      expect.objectContaining({
+        onSuccess: expect.any(Function),
+        onError: expect.any(Function),
+      })
+    );
+  });
+});
+
+describe('PluginCreatePage — post-create navigation', () => {
+  const submitSlot: RenderFormSlot = ({ onSubmit }) => (
+    <button type="button" onClick={() => onSubmit({ title: 'x' })}>
+      Submit slot
+    </button>
+  );
+
+  async function submitAndGetOnSuccess() {
+    const user = userEvent.setup();
+    renderPage({ renderCreateForm: submitSlot });
+    await user.click(screen.getByRole('button', { name: 'Submit slot' }));
+    await waitFor(() => expect(mockCreateTaskMutate).toHaveBeenCalledTimes(1));
+    return mockCreateTaskMutate.mock.calls[0][1].onSuccess as (
+      data: Record<string, unknown>
+    ) => void;
+  }
+
+  it('navigates to the new task detail with the warning in state when present', async () => {
+    const onSuccess = await submitAndGetOnSuccess();
+    const warning = {
+      target: 'node1',
+      service_type: 'mysql',
+      message: 'fail',
+      task_history_id: 7,
+    };
+
+    act(() => onSuccess({ name: 'my task', connectivity_warning: warning }));
+
+    expect(mockNavigate).toHaveBeenCalledWith('../task/my%20task', {
+      relative: 'path',
+      state: { connectivityWarning: warning },
+    });
+  });
+
+  it('navigates to the list (no state) when the create response carries no warning', async () => {
+    const onSuccess = await submitAndGetOnSuccess();
+
+    act(() => onSuccess({ name: 'my task' }));
+
+    expect(mockNavigate).toHaveBeenCalledWith('..', { relative: 'path' });
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginCreatePage.tsx b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginCreatePage.tsx
new file mode 100644
index 00000000000..ccf12e9a41d
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginCreatePage.tsx
@@ -0,0 +1,153 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useMemo, useState } from 'react';
+import { useNavigate, useParams } from 'react-router-dom';
+import Box from '@mui/material/Box';
+import Typography from '@mui/material/Typography';
+import IconButton from '@mui/material/IconButton';
+import ArrowBackIcon from '@mui/icons-material/ArrowBack';
+import { useSnackbar } from 'notistack';
+import {
+  useCreatePluginEntity,
+  useCreatePluginTask,
+  type PluginSchema,
+} from '@sep/api';
+import {
+  SchemaFormRenderer,
+  coerceFormValues,
+  flattenSectionFields,
+} from '../SchemaFormRenderer';
+import type { RenderFieldOverride } from '../SchemaFormRenderer/types';
+import type { RenderFormSlot } from './types';
+import {
+  EMPTY_SUBMIT_ERROR,
+  mapSubmitError,
+  type SubmitErrorState,
+} from './submitErrorMapping';
+
+interface PluginCreatePageProps {
+  schema: PluginSchema;
+  pluginName: string;
+  mockTasks?: Record<string, unknown>[];
+  mockEntityItems?: Record<string, Record<string, unknown>[]>;
+  /** Per-field widget override threaded to the form renderer. */
+  renderField?: RenderFieldOverride;
+  /** Whole-form slot replacing the form body while keeping chrome / mutation / snackbars. */
+  renderCreateForm?: RenderFormSlot;
+}
+
+export function PluginCreatePage({
+  schema,
+  pluginName,
+  mockTasks,
+  mockEntityItems,
+  renderField,
+  renderCreateForm,
+}: PluginCreatePageProps) {
+  const navigate = useNavigate();
+  const { entityName } = useParams<{ entityName?: string }>();
+  const entitySchema = useMemo(
+    () => schema.entities?.find((e) => e.name === entityName),
+    [schema.entities, entityName]
+  );
+  const multi = Boolean(schema.entities?.length && entityName && entitySchema);
+  const { enqueueSnackbar } = useSnackbar();
+  const createTask = useCreatePluginTask(pluginName, mockTasks);
+  const createEntity = useCreatePluginEntity(
+    pluginName,
+    entityName ?? '',
+    multi ? mockEntityItems?.[entityName!] : undefined
+  );
+
+  const create = multi ? createEntity : createTask;
+  const title = multi ? entitySchema!.display_name : schema.display_name;
+  const sections = multi ? entitySchema!.forms : schema.forms!;
+  const capabilities = multi ? undefined : schema.capabilities;
+
+  const [{ submitError, fieldErrors }, setSubmitErrorState] =
+    useState<SubmitErrorState>(EMPTY_SUBMIT_ERROR);
+
+  const handleSubmit = (data: Record<string, unknown>) => {
+    // Clear any prior failure so the banner / inline errors reset before the
+    // new attempt resolves.
+    setSubmitErrorState(EMPTY_SUBMIT_ERROR);
+    // Coerce at the submit boundary so whole-form slots that build their own
+    // form (bypassing SchemaFormRenderer's internal coercion) still send a
+    // backend-ready payload. Idempotent for the default SchemaFormRenderer
+    // path, which has already coerced.
+    create.mutate(coerceFormValues(data, flattenSectionFields(sections)), {
+      onSuccess: (created) => {
+        enqueueSnackbar(`${title} created`, { variant: 'success' });
+        // A post-create connectivity check only rides the create response; the
+        // detail/list model omits it. When present, land on the new task's
+        // detail page and carry the warning via navigation state so it surfaces
+        // there. Entities and warning-free creates go to the list.
+        const response = (created ?? {}) as Record<string, unknown>;
+        const warning = response.connectivity_warning;
+        const name =
+          typeof response.name === 'string' ? response.name : undefined;
+        if (!multi && warning && name) {
+          navigate(`../task/${encodeURIComponent(name)}`, {
+            relative: 'path',
+            state: { connectivityWarning: warning },
+          });
+          return;
+        }
+        navigate('..', { relative: 'path' });
+      },
+      onError: (error: unknown) => {
+        const message =
+          error instanceof Error ? error.message : 'Failed to create';
+        // Transient toast is unchanged; 422s additionally map to a persistent
+        // banner plus inline per-field errors.
+        enqueueSnackbar(message, { variant: 'error' });
+        setSubmitErrorState(mapSubmitError(error, sections, message));
+      },
+    });
+  };
+
+  return (
+    <Box>
+      <Box sx={{ display: 'flex', alignItems: 'center', gap: 1, mb: 3 }}>
+        <IconButton onClick={() => navigate('..', { relative: 'path' })}>
+          <ArrowBackIcon />
+        </IconButton>
+        <Typography variant="h4">New {title}</Typography>
+      </Box>
+
+      {renderCreateForm?.({
+        sections,
+        onSubmit: handleSubmit,
+        loading: create.isPending,
+        capabilities,
+        renderField,
+      }) ?? (
+        <SchemaFormRenderer
+          sections={sections}
+          onSubmit={handleSubmit}
+          loading={create.isPending}
+          submitLabel={`Create ${title}`}
+          submitError={submitError}
+          fieldErrors={fieldErrors}
+          capabilities={capabilities}
+          renderField={renderField}
+        />
+      )}
+    </Box>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginDetailPage.test.tsx b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginDetailPage.test.tsx
new file mode 100644
index 00000000000..e320cd08549
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginDetailPage.test.tsx
@@ -0,0 +1,1285 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { render, screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { MemoryRouter, Routes, Route } from 'react-router-dom';
+import { SnackbarProvider } from 'notistack';
+import type { PluginSchema } from '@sep/api';
+import { PluginDetailPage, resolveTabFromSplat } from './PluginDetailPage';
+
+const mockDeleteMutate = vi.fn();
+const mockExecuteMutate = vi.fn();
+const mockUsePluginTask = vi.fn();
+const mockUsePluginEntityDetail = vi.fn();
+const { stopMutate } = vi.hoisted(() => ({ stopMutate: vi.fn() }));
+interface MockStatsResult {
+  data: unknown;
+  isLoading: boolean;
+  isError: boolean;
+  error?: unknown;
+}
+const mockUseTaskStats = vi.fn<(...args: unknown[]) => MockStatsResult>(() => ({
+  data: undefined,
+  isLoading: false,
+  isError: false,
+}));
+
+// Manual factory keeps axios out of the resolution graph.
+vi.mock('@sep/api', () => ({
+  usePluginTask: (...args: unknown[]) => mockUsePluginTask(...args),
+  // Consumed transitively by the generic ScheduleSummary (gated on
+  // capabilities.scheduling) via useScheduledTasksForPlugin. No tasks ->
+  // the summary renders its "Not scheduled" state, leaving the execute/delete
+  // flows under test untouched.
+  usePluginTasks: () => ({
+    data: { items: [], pagination: null },
+    isLoading: false,
+    isError: false,
+    error: null,
+    refetch: vi.fn(),
+  }),
+  useDeletePluginTask: () => ({
+    mutateAsync: mockDeleteMutate,
+    isPending: false,
+  }),
+  useDeletePluginEntity: () => ({ mutateAsync: vi.fn(), isPending: false }),
+  usePluginEntityDetail: (...args: unknown[]) =>
+    mockUsePluginEntityDetail(...args),
+  // Needed by useTaskLogs / useExecutionEvents in the component tree
+  getToken: () => null,
+  refreshAccessToken: vi.fn(),
+  emitUnauthorized: vi.fn(),
+  apiClient: { get: vi.fn(), post: vi.fn(), defaults: {} },
+  setTokenProvider: vi.fn(),
+  ApiError: class ApiError extends Error {
+    status?: number;
+    constructor(details: { status?: number; message: string }) {
+      super(details.message);
+      this.status = details.status;
+    }
+  },
+}));
+
+vi.mock('../../hooks', () => ({
+  useTaskHistoryByName: () => ({
+    data: { items: [] },
+    isLoading: false,
+    error: null,
+  }),
+  useTaskHistoryByNames: () => ({
+    data: { items: [] },
+    isLoading: false,
+    error: null,
+  }),
+  useExecuteTask: () => ({
+    mutateAsync: mockExecuteMutate,
+    isPending: false,
+  }),
+  useStopTaskHistory: () => ({ mutate: stopMutate, isPending: false }),
+}));
+
+// Execution History tab renders the real TaskHistoryTable; stub it to capture
+// the wired onStopTask handler (no other test exercises the Execution History
+// tab / this component).
+vi.mock('../TaskHistoryTable', async (importOriginal) => ({
+  // Keep the real TaskHistoryStatusBadge + isTaskHistoryStatus (now used by the
+  // detail header/status chip); only stub the heavy TaskHistoryTable.
+  ...(await importOriginal<typeof import('../TaskHistoryTable')>()),
+  TaskHistoryTable: ({
+    onStopTask,
+  }: {
+    onStopTask?: (entry: { id: number }) => void;
+  }) =>
+    onStopTask ? (
+      <button type="button" onClick={() => onStopTask({ id: 7 })}>
+        Stop row
+      </button>
+    ) : (
+      <div data-testid="task-history-table" />
+    ),
+}));
+
+vi.mock('../../hooks/useTaskStats', () => ({
+  useTaskStats: (taskName?: string, enabled?: boolean) =>
+    mockUseTaskStats(taskName, enabled),
+}));
+
+vi.mock('./DetailSyntaxHighlighter', () => ({
+  default: ({ value, language }: { value: unknown; language: string }) => (
+    <pre data-testid="detail-syntax-highlighter" data-language={language}>
+      {String(value)}
+    </pre>
+  ),
+}));
+
+const schema: PluginSchema = {
+  pluginName: 'checksums',
+  display_name: 'Checksum',
+  description: 'Test',
+  capabilities: { scheduling: true },
+  list_view: {
+    columns: [
+      { key: 'name', label: 'Name' },
+      { key: 'status', label: 'Status', format: 'status' },
+    ],
+    default_sort: '-id',
+  },
+  formSchema: { sections: [] },
+} as unknown as PluginSchema;
+
+function makeClient() {
+  return new QueryClient({
+    defaultOptions: { queries: { retry: false, gcTime: 0, staleTime: 0 } },
+  });
+}
+
+function renderAt(path: string) {
+  return render(
+    <QueryClientProvider client={makeClient()}>
+      <SnackbarProvider>
+        <MemoryRouter initialEntries={[path]}>
+          <Routes>
+            <Route
+              path="/apps/:plugin/task/:id/*"
+              element={
+                <PluginDetailPage schema={schema} pluginName="checksums" />
+              }
+            />
+            <Route path="/apps/:plugin" element={<div>list page</div>} />
+          </Routes>
+        </MemoryRouter>
+      </SnackbarProvider>
+    </QueryClientProvider>
+  );
+}
+
+describe('PluginDetailPage — detail_view sections', () => {
+  function executionSchema(
+    overrides: Partial<PluginSchema> = {}
+  ): PluginSchema {
+    return {
+      pluginName: 'checksums',
+      display_name: 'Checksum',
+      description: 'Test',
+      capabilities: {},
+      list_view: {
+        columns: [
+          { key: 'name', label: 'Name' },
+          { key: 'status', label: 'Status', format: 'status' },
+        ],
+        default_sort: '-id',
+      },
+      formSchema: { sections: [] },
+      detail_view: {
+        sections: [
+          {
+            title: 'Execution',
+            fields: [
+              { path: 'data.meta.command', label: 'Command' },
+              { path: 'data.meta.args', label: 'Args' },
+              { path: 'data.meta.target', label: 'Target' },
+            ],
+          },
+        ],
+      },
+      ...overrides,
+    } as unknown as PluginSchema;
+  }
+
+  it('renders a section with each labelled field resolved from the task', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'FECHK',
+        status: 'completed',
+        data: {
+          meta: {
+            command: 'pt-table-checksum',
+            args: '--foo',
+            target: 'pmm',
+          },
+        },
+      },
+      isLoading: false,
+    });
+
+    renderWithSchema(executionSchema());
+
+    expect(
+      screen.getByRole('heading', { name: 'Execution' })
+    ).toBeInTheDocument();
+    expect(screen.getByText('pt-table-checksum')).toBeInTheDocument();
+    expect(screen.getByText('--foo')).toBeInTheDocument();
+    expect(screen.getByText('pmm')).toBeInTheDocument();
+  });
+
+  it('skips fields whose path resolves to undefined', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'FECHK',
+        status: 'completed',
+        data: { meta: { command: 'pt-table-checksum' } },
+      },
+      isLoading: false,
+    });
+
+    renderWithSchema(executionSchema());
+
+    expect(screen.getByText('Command')).toBeInTheDocument();
+    expect(screen.queryByText('Args')).toBeNull();
+    expect(screen.queryByText('Target')).toBeNull();
+  });
+
+  it('skips fields whose path resolves to an empty string', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'FECHK',
+        status: 'completed',
+        data: {
+          meta: { command: '', args: '--foo', target: 'pmm' },
+        },
+      },
+      isLoading: false,
+    });
+
+    renderWithSchema(executionSchema());
+
+    expect(screen.queryByText('Command')).toBeNull();
+    expect(screen.getByText('Args')).toBeInTheDocument();
+  });
+
+  it('hides the whole section when every field resolves empty', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, name: 'FECHK', status: 'completed', data: {} },
+      isLoading: false,
+    });
+
+    renderWithSchema(executionSchema());
+
+    expect(screen.queryByRole('heading', { name: 'Execution' })).toBeNull();
+  });
+
+  it('renders multiple sections in declared order', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'FECHK',
+        status: 'completed',
+        data: {
+          meta: { command: 'cmd', args: '--foo', target: 'pmm' },
+          parent: 'parent-task',
+        },
+      },
+      isLoading: false,
+    });
+
+    renderWithSchema(
+      executionSchema({
+        detail_view: {
+          sections: [
+            {
+              title: 'Execution',
+              fields: [{ path: 'data.meta.command', label: 'Command' }],
+            },
+            {
+              title: 'Chain',
+              fields: [{ path: 'data.parent', label: 'Parent' }],
+            },
+          ],
+        },
+      } as unknown as PluginSchema)
+    );
+
+    const headings = screen
+      .getAllByRole('heading', { level: 6 })
+      .map((h) => h.textContent);
+    const execIdx = headings.indexOf('Execution');
+    const chainIdx = headings.indexOf('Chain');
+    expect(execIdx).toBeGreaterThanOrEqual(0);
+    expect(chainIdx).toBeGreaterThanOrEqual(0);
+    expect(execIdx).toBeLessThan(chainIdx);
+  });
+
+  it('does not render any section cards when detail_view is undefined', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'FECHK',
+        status: 'completed',
+        data: { meta: { command: 'cmd' } },
+      },
+      isLoading: false,
+    });
+
+    renderWithSchema(
+      executionSchema({ detail_view: undefined } as PluginSchema)
+    );
+
+    expect(screen.queryByRole('heading', { name: 'Execution' })).toBeNull();
+  });
+
+  it('passes DetailField.highlight through to the syntax highlighter', async () => {
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'FECHK',
+        status: 'completed',
+        data: { meta: { command: 'SELECT 1' } },
+      },
+      isLoading: false,
+    });
+
+    renderWithSchema(
+      executionSchema({
+        detail_view: {
+          sections: [
+            {
+              title: 'Execution',
+              fields: [
+                {
+                  path: 'data.meta.command',
+                  label: 'Command',
+                  highlight: 'sql',
+                },
+              ],
+            },
+          ],
+        },
+      } as unknown as PluginSchema)
+    );
+
+    const hl = await screen.findByTestId('detail-syntax-highlighter');
+    expect(hl.getAttribute('data-language')).toBe('sql');
+    expect(hl.textContent).toBe('SELECT 1');
+  });
+
+  it('renders boolean false and numeric zero leaves', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'FECHK',
+        status: 'completed',
+        data: { meta: { command: false, args: 0 } },
+      },
+      isLoading: false,
+    });
+
+    renderWithSchema(executionSchema());
+
+    expect(screen.getByText('No')).toBeInTheDocument();
+    expect(screen.getByText('0')).toBeInTheDocument();
+  });
+});
+
+describe('resolveTabFromSplat', () => {
+  it('returns overview when splat is undefined', () => {
+    expect(resolveTabFromSplat(undefined)).toBe('overview');
+  });
+
+  it('returns overview when splat is empty', () => {
+    expect(resolveTabFromSplat('')).toBe('overview');
+  });
+
+  it('returns logs when splat is "logs"', () => {
+    expect(resolveTabFromSplat('logs')).toBe('logs');
+  });
+
+  it('returns logs when splat has trailing slash', () => {
+    expect(resolveTabFromSplat('logs/')).toBe('logs');
+  });
+
+  it('returns logs for nested logs sub-paths', () => {
+    expect(resolveTabFromSplat('logs/123')).toBe('logs');
+  });
+
+  it('returns overview for non-logs paths', () => {
+    expect(resolveTabFromSplat('overview')).toBe('overview');
+    expect(resolveTabFromSplat('something-else')).toBe('overview');
+  });
+});
+
+describe('PluginDetailPage execute flow', () => {
+  it('confirms then calls execute mutation on success', async () => {
+    mockExecuteMutate.mockReset();
+    mockExecuteMutate.mockResolvedValue({ id: 99 });
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, name: 'FECHK', status: 'completed' },
+      isLoading: false,
+    });
+
+    renderAt('/apps/checksums/task/FECHK');
+
+    await userEvent.click(screen.getByTestId('plugin-task-execute'));
+
+    const dialog = await screen.findByRole('dialog');
+    await userEvent.click(
+      within(dialog).getByTestId('plugin-task-execute-confirm')
+    );
+
+    await waitFor(() =>
+      expect(mockExecuteMutate).toHaveBeenCalledWith({ taskName: 'FECHK' })
+    );
+  });
+
+  it('shows error snackbar and closes dialog on execute failure', async () => {
+    mockExecuteMutate.mockReset();
+    mockExecuteMutate.mockRejectedValue(new Error('Execute failed'));
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, name: 'FECHK', status: 'completed' },
+      isLoading: false,
+    });
+
+    renderAt('/apps/checksums/task/FECHK');
+
+    await userEvent.click(screen.getByTestId('plugin-task-execute'));
+
+    const dialog = await screen.findByRole('dialog');
+    await userEvent.click(
+      within(dialog).getByTestId('plugin-task-execute-confirm')
+    );
+
+    await waitFor(() =>
+      expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+    );
+    await waitFor(() =>
+      expect(screen.getByText('Execute failed')).toBeInTheDocument()
+    );
+  });
+
+  it('closes dialog without calling execute when cancelled', async () => {
+    mockExecuteMutate.mockReset();
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, name: 'FECHK', status: 'completed' },
+      isLoading: false,
+    });
+
+    renderAt('/apps/checksums/task/FECHK');
+
+    await userEvent.click(screen.getByTestId('plugin-task-execute'));
+
+    const dialog = await screen.findByRole('dialog');
+    await userEvent.click(
+      within(dialog).getByRole('button', { name: 'Cancel' })
+    );
+
+    await waitFor(() =>
+      expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+    );
+    expect(mockExecuteMutate).not.toHaveBeenCalled();
+  });
+
+  it('executes a selected derived task when custom execute actions are provided', async () => {
+    mockExecuteMutate.mockReset();
+    mockExecuteMutate.mockResolvedValue({ id: 99 });
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'pbm-backup',
+        status: 'completed',
+        derived_tasks: [
+          {
+            name: 'pbm-backup-logical',
+            backup_type: 'pbm_logical',
+            status: null,
+          },
+        ],
+      },
+      isLoading: false,
+    });
+
+    render(
+      <QueryClientProvider client={makeClient()}>
+        <SnackbarProvider>
+          <MemoryRouter initialEntries={['/apps/backup_mongo/task/pbm-backup']}>
+            <Routes>
+              <Route
+                path="/apps/:plugin/task/:id/*"
+                element={
+                  <PluginDetailPage
+                    schema={schema}
+                    pluginName="backup_mongo"
+                    getTaskExecuteActions={(task) => [
+                      {
+                        label: 'Sync Config',
+                        taskName: String(task.name),
+                        testId: 'backup-mongo-sync-config',
+                      },
+                      {
+                        label: 'Run Logical Backup',
+                        taskName: 'pbm-backup-logical',
+                        testId: 'backup-mongo-logical-backup',
+                      },
+                    ]}
+                  />
+                }
+              />
+            </Routes>
+          </MemoryRouter>
+        </SnackbarProvider>
+      </QueryClientProvider>
+    );
+
+    await userEvent.click(screen.getByTestId('backup-mongo-logical-backup'));
+
+    const dialog = await screen.findByRole('dialog');
+    await userEvent.click(
+      within(dialog).getByTestId('plugin-task-execute-confirm')
+    );
+
+    await waitFor(() =>
+      expect(mockExecuteMutate).toHaveBeenCalledWith({
+        taskName: 'pbm-backup-logical',
+      })
+    );
+  });
+
+  it('forwards executeBody from custom execute actions to the mutation', async () => {
+    mockExecuteMutate.mockReset();
+    mockExecuteMutate.mockResolvedValue({ id: 99 });
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, name: 'my-alter', status: 'completed' },
+      isLoading: false,
+    });
+
+    const executeBody = {
+      chain_task_names: ['my-alter'],
+      chain_on_failure: false,
+    };
+
+    render(
+      <QueryClientProvider client={makeClient()}>
+        <SnackbarProvider>
+          <MemoryRouter initialEntries={['/apps/alters/task/my-alter']}>
+            <Routes>
+              <Route
+                path="/apps/:plugin/task/:id/*"
+                element={
+                  <PluginDetailPage
+                    schema={schema}
+                    pluginName="alters"
+                    getTaskExecuteActions={() => [
+                      {
+                        label: 'Pre-checks',
+                        taskName: 'my-alter-pre-checks',
+                        testId: 'alters-pre-checks-execute',
+                        executeBody,
+                      },
+                    ]}
+                  />
+                }
+              />
+            </Routes>
+          </MemoryRouter>
+        </SnackbarProvider>
+      </QueryClientProvider>
+    );
+
+    await userEvent.click(screen.getByTestId('alters-pre-checks-execute'));
+
+    const dialog = await screen.findByRole('dialog');
+    await userEvent.click(
+      within(dialog).getByTestId('plugin-task-execute-confirm')
+    );
+
+    await waitFor(() =>
+      expect(mockExecuteMutate).toHaveBeenCalledWith({
+        taskName: 'my-alter-pre-checks',
+        executeBody,
+      })
+    );
+  });
+});
+
+describe('PluginDetailPage — connectivity warning', () => {
+  it('renders the warning message', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'FECHK',
+        status: 'completed',
+        connectivity_warning: {
+          target: 'node1',
+          service_type: 'mysql',
+          message: 'Connectivity check timed out after 30s',
+          task_history_id: 555,
+        },
+      },
+      isLoading: false,
+    });
+
+    renderWithSchema(makeSchema({}));
+
+    expect(
+      screen.getByText('Connectivity check timed out after 30s')
+    ).toBeInTheDocument();
+  });
+
+  it('offers a log affordance and opens the log viewer when task_history_id is present', async () => {
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'FECHK',
+        status: 'completed',
+        connectivity_warning: {
+          target: 'node1',
+          service_type: 'mysql',
+          message: 'Connectivity check timed out after 30s',
+          task_history_id: 555,
+        },
+      },
+      isLoading: false,
+    });
+
+    renderWithSchema(makeSchema({}));
+
+    const logButton = screen.getByTestId('connectivity-log-button');
+    await userEvent.click(logButton);
+
+    const dialog = await screen.findByRole('dialog');
+    expect(within(dialog).getByText(/555/)).toBeInTheDocument();
+  });
+
+  it('does not offer a log affordance when task_history_id is absent', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'FECHK',
+        status: 'completed',
+        connectivity_warning: {
+          target: 'node1',
+          service_type: 'mysql',
+          message: 'Could not reach the Tasks API',
+        },
+      },
+      isLoading: false,
+    });
+
+    renderWithSchema(makeSchema({}));
+
+    expect(
+      screen.getByText('Could not reach the Tasks API')
+    ).toBeInTheDocument();
+    expect(screen.queryByTestId('connectivity-log-button')).toBeNull();
+  });
+
+  it('renders a warning carried via navigation state when the detail query omits it', async () => {
+    // detail/list response omits connectivity_warning; carried from create
+    // response via router location state.
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, name: 'FECHK', status: 'completed' },
+      isLoading: false,
+    });
+    const warning = {
+      target: 'node1',
+      service_type: 'mysql',
+      message: 'Connectivity check timed out after 30s',
+      task_history_id: 777,
+    };
+
+    render(
+      <QueryClientProvider client={makeClient()}>
+        <SnackbarProvider>
+          <MemoryRouter
+            initialEntries={[
+              {
+                pathname: '/apps/checksums/task/FECHK',
+                state: { connectivityWarning: warning },
+              },
+            ]}
+          >
+            <Routes>
+              <Route
+                path="/apps/:plugin/task/:id/*"
+                element={
+                  <PluginDetailPage
+                    schema={makeSchema({})}
+                    pluginName="checksums"
+                  />
+                }
+              />
+              <Route path="/apps/:plugin" element={<div>list page</div>} />
+            </Routes>
+          </MemoryRouter>
+        </SnackbarProvider>
+      </QueryClientProvider>
+    );
+
+    expect(
+      screen.getByText('Connectivity check timed out after 30s')
+    ).toBeInTheDocument();
+    await userEvent.click(screen.getByTestId('connectivity-log-button'));
+    const dialog = await screen.findByRole('dialog');
+    expect(within(dialog).getByText(/777/)).toBeInTheDocument();
+  });
+
+  it('shows no warning when neither the detail query nor navigation state has one', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, name: 'FECHK', status: 'completed' },
+      isLoading: false,
+    });
+
+    renderWithSchema(makeSchema({}));
+
+    expect(screen.queryByTestId('connectivity-log-button')).toBeNull();
+  });
+});
+
+function renderWithSchema(
+  customSchema: PluginSchema,
+  path = '/apps/checksums/task/FECHK'
+) {
+  return render(
+    <QueryClientProvider client={makeClient()}>
+      <SnackbarProvider>
+        <MemoryRouter initialEntries={[path]}>
+          <Routes>
+            <Route
+              path="/apps/:plugin/task/:id/*"
+              element={
+                <PluginDetailPage
+                  schema={customSchema}
+                  pluginName="checksums"
+                />
+              }
+            />
+            <Route path="/apps/:plugin" element={<div>list page</div>} />
+          </Routes>
+        </MemoryRouter>
+      </SnackbarProvider>
+    </QueryClientProvider>
+  );
+}
+
+function makeSchema(
+  capabilities: Record<string, boolean> | undefined
+): PluginSchema {
+  return {
+    pluginName: 'checksums',
+    display_name: 'Checksum',
+    description: 'Test',
+    capabilities,
+    list_view: {
+      columns: [
+        { key: 'name', label: 'Name' },
+        { key: 'status', label: 'Status', format: 'status' },
+      ],
+      default_sort: '-id',
+    },
+    formSchema: { sections: [] },
+  } as unknown as PluginSchema;
+}
+
+const POPULATED_STATS = {
+  engine: 'nomad',
+  total: 5,
+  status: { pass: 4, fail: 1 },
+  duration: {
+    average_seconds: 1.234,
+    last_seconds: 0.987,
+    total_seconds: 6.17,
+  },
+  last_finished_at: new Date(Date.now() - 60_000).toISOString(),
+};
+
+describe('PluginDetailPage — StatsCard integration', () => {
+  beforeEach(() => {
+    mockUseTaskStats.mockReset();
+    mockUseTaskStats.mockReturnValue({
+      data: undefined,
+      isLoading: false,
+      isError: false,
+    });
+  });
+
+  it('renders the StatsCard when capabilities.stats is true', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, name: 'FECHK', status: 'completed' },
+      isLoading: false,
+    });
+    mockUseTaskStats.mockReturnValue({
+      data: POPULATED_STATS,
+      isLoading: false,
+      isError: false,
+    });
+    renderWithSchema(makeSchema({ stats: true }));
+    expect(screen.getByText('Executions')).toBeInTheDocument();
+  });
+
+  it('forwards both taskName and enabled to useTaskStats', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, name: 'FECHK', status: 'completed' },
+      isLoading: false,
+    });
+    renderWithSchema(makeSchema({ stats: true }));
+    expect(mockUseTaskStats).toHaveBeenCalled();
+    const lastCall = mockUseTaskStats.mock.calls.at(-1) ?? [];
+    // Guard against the prior mock that dropped every arg after the first,
+    // which hid regressions around the ``enabled`` flag.
+    expect(lastCall[0]).toBe('FECHK');
+    expect(lastCall[1]).toBe(true);
+  });
+
+  it('does not render the StatsCard when capabilities.stats is false', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, name: 'FECHK', status: 'completed' },
+      isLoading: false,
+    });
+    renderWithSchema(makeSchema({ stats: false }));
+    expect(screen.queryByText('Executions')).toBeNull();
+    expect(mockUseTaskStats).not.toHaveBeenCalled();
+  });
+
+  it('does not render the StatsCard when capabilities.stats is absent', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, name: 'FECHK', status: 'completed' },
+      isLoading: false,
+    });
+    renderWithSchema(makeSchema({}));
+    expect(screen.queryByText('Executions')).toBeNull();
+    expect(mockUseTaskStats).not.toHaveBeenCalled();
+  });
+
+  it('does not render the StatsCard when capabilities is undefined', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, name: 'FECHK', status: 'completed' },
+      isLoading: false,
+    });
+    renderWithSchema(makeSchema(undefined));
+    expect(screen.queryByText('Executions')).toBeNull();
+    expect(mockUseTaskStats).not.toHaveBeenCalled();
+  });
+
+  it('does not render the StatsCard when task.name is missing', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, status: 'completed' },
+      isLoading: false,
+    });
+    renderWithSchema(makeSchema({ stats: true }));
+    // Hook is invoked but with undefined name, so it disables itself; the card
+    // returns null before rendering the section header.
+    expect(screen.queryByText('Executions')).toBeNull();
+    expect(screen.queryByRole('heading', { name: 'Stats' })).toBeNull();
+  });
+
+  it('does not render the StatsCard when task.name is numeric', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, name: 42, status: 'completed' },
+      isLoading: false,
+    });
+    renderWithSchema(makeSchema({ stats: true }));
+    expect(screen.queryByText('Executions')).toBeNull();
+    expect(screen.queryByRole('heading', { name: 'Stats' })).toBeNull();
+  });
+
+  it('renders empty state when stats.total === 0', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, name: 'FECHK', status: 'completed' },
+      isLoading: false,
+    });
+    mockUseTaskStats.mockReturnValue({
+      data: {
+        engine: 'nomad',
+        total: 0,
+        status: { pass: 0, fail: 0 },
+        duration: {
+          average_seconds: null,
+          last_seconds: null,
+          total_seconds: null,
+        },
+        last_finished_at: null,
+      },
+      isLoading: false,
+      isError: false,
+    });
+    renderWithSchema(makeSchema({ stats: true }));
+    expect(screen.getByText('No execution history yet')).toBeInTheDocument();
+    expect(screen.queryByText('Executions')).toBeNull();
+  });
+
+  it('keeps the Task information section when stats query errors', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, name: 'FECHK', status: 'completed' },
+      isLoading: false,
+    });
+    mockUseTaskStats.mockReturnValue({
+      data: undefined,
+      isLoading: false,
+      isError: true,
+      error: new Error('boom'),
+    });
+    renderWithSchema(makeSchema({ stats: true }));
+    expect(screen.getByText('Task information')).toBeInTheDocument();
+    expect(screen.getByRole('alert')).toHaveTextContent(
+      'Could not load execution stats'
+    );
+  });
+});
+
+describe('PluginDetailPage — tabs', () => {
+  it('labels the history tab Execution History', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, name: 'FECHK', status: 'completed' },
+      isLoading: false,
+    });
+
+    renderAt('/apps/checksums/task/FECHK');
+
+    expect(
+      screen.getByRole('tab', { name: 'Execution History' })
+    ).toBeInTheDocument();
+    expect(screen.queryByRole('tab', { name: 'Logs' })).toBeNull();
+  });
+});
+
+describe('PluginDetailPage — Execution History tab stop wiring', () => {
+  beforeEach(() => {
+    stopMutate.mockReset();
+  });
+
+  it('wires the Execution History tab table Stop action to the stop-task mutation with the row id', async () => {
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, name: 'FECHK', status: 'running' },
+      isLoading: false,
+    });
+
+    renderAt('/apps/checksums/task/FECHK/logs');
+
+    await userEvent.click(
+      await screen.findByRole('button', { name: 'Stop row' })
+    );
+
+    expect(stopMutate).toHaveBeenCalledWith(7);
+  });
+});
+
+describe('PluginDetailPage — PII Anonymization section', () => {
+  it('renders PII section with entity chips when capability is true and entities present', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'FECHK',
+        status: 'completed',
+        anonymized_entities: ['EMAIL_ADDRESS', 'IP_ADDRESS'],
+      },
+      isLoading: false,
+    });
+
+    renderWithSchema(makeSchema({ pii_anonymization: true }));
+
+    expect(
+      screen.getByRole('heading', { name: 'PII Anonymization' })
+    ).toBeInTheDocument();
+    const chips = screen.getAllByTestId('pii-entity-chip');
+    expect(chips).toHaveLength(2);
+    expect(chips[0]).toHaveTextContent('EMAIL ADDRESS');
+    expect(chips[1]).toHaveTextContent('IP ADDRESS');
+  });
+
+  it('renders empty state message when capability is true but entities list is empty', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'FECHK',
+        status: 'completed',
+        anonymized_entities: [],
+      },
+      isLoading: false,
+    });
+
+    renderWithSchema(makeSchema({ pii_anonymization: true }));
+
+    expect(
+      screen.getByRole('heading', { name: 'PII Anonymization' })
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText('No PII entities configured for anonymization.')
+    ).toBeInTheDocument();
+  });
+
+  it('does not render PII section when capability is false', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'FECHK',
+        status: 'completed',
+        anonymized_entities: ['EMAIL_ADDRESS'],
+      },
+      isLoading: false,
+    });
+
+    renderWithSchema(makeSchema({ pii_anonymization: false }));
+
+    expect(
+      screen.queryByRole('heading', { name: 'PII Anonymization' })
+    ).toBeNull();
+  });
+
+  it('does not render PII section when capability is absent', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'FECHK',
+        status: 'completed',
+        anonymized_entities: ['EMAIL_ADDRESS'],
+      },
+      isLoading: false,
+    });
+
+    renderWithSchema(makeSchema({}));
+
+    expect(
+      screen.queryByRole('heading', { name: 'PII Anonymization' })
+    ).toBeNull();
+  });
+
+  it('does not render PII section when capabilities is undefined', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'FECHK',
+        status: 'completed',
+        anonymized_entities: ['EMAIL_ADDRESS'],
+      },
+      isLoading: false,
+    });
+
+    renderWithSchema(makeSchema(undefined));
+
+    expect(
+      screen.queryByRole('heading', { name: 'PII Anonymization' })
+    ).toBeNull();
+  });
+
+  it('suppresses anonymize_mask and anonymized_entities from the Task information extras', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'FECHK',
+        status: 'completed',
+        anonymize_mask: 2,
+        anonymized_entities: ['EMAIL_ADDRESS'],
+      },
+      isLoading: false,
+    });
+
+    renderWithSchema(makeSchema({ pii_anonymization: true }));
+
+    expect(screen.queryByText('Anonymize Mask')).toBeNull();
+    expect(screen.queryByText('Anonymized Entities')).toBeNull();
+  });
+});
+
+describe('PluginDetailPage — overview_hidden_fields', () => {
+  function schemaWithHidden(overview_hidden_fields?: string[]): PluginSchema {
+    return {
+      pluginName: 'checksums',
+      display_name: 'Checksum',
+      description: 'Test',
+      capabilities: {},
+      list_view: {
+        columns: [
+          { key: 'name', label: 'Name' },
+          { key: 'status', label: 'Status', format: 'status' },
+        ],
+        default_sort: '-name',
+        ...(overview_hidden_fields !== undefined
+          ? { overview_hidden_fields }
+          : {}),
+      },
+      formSchema: { sections: [] },
+    } as unknown as PluginSchema;
+  }
+
+  it('hides baseline keys (id, backend, data, etc.) when overview_hidden_fields is absent', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'FECHK',
+        status: 'completed',
+        backend: 'nomad',
+        data: {},
+        extra_visible: 'hello',
+      },
+      isLoading: false,
+    });
+
+    renderWithSchema(schemaWithHidden());
+
+    expect(screen.queryByText('Id')).toBeNull();
+    expect(screen.queryByText('Backend')).toBeNull();
+    expect(screen.queryByText('Data')).toBeNull();
+    // A non-hidden extra still renders
+    expect(screen.getByText('Extra Visible')).toBeInTheDocument();
+  });
+
+  it('hides a schema-declared key in addition to the baseline', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'FECHK',
+        status: 'completed',
+        foo: 'secret',
+        extra_visible: 'hello',
+      },
+      isLoading: false,
+    });
+
+    renderWithSchema(schemaWithHidden(['foo']));
+
+    expect(screen.queryByText('Foo')).toBeNull();
+    // Unrelated extra field still renders
+    expect(screen.getByText('Extra Visible')).toBeInTheDocument();
+  });
+
+  it('hides entity-level overview_hidden_fields in multi-entity detail page', () => {
+    function multiEntitySchemaWithHidden(
+      overview_hidden_fields?: string[]
+    ): PluginSchema {
+      return {
+        pluginName: 'inventory',
+        display_name: 'Inventory',
+        description: 'Test',
+        capabilities: {},
+        entities: [
+          {
+            name: 'services',
+            display_name: 'Services',
+            description: 'Service entities',
+            forms: [],
+            list_view: {
+              columns: [
+                { key: 'name', label: 'Name' },
+                { key: 'status', label: 'Status', format: 'status' },
+              ],
+              default_sort: '-name',
+              ...(overview_hidden_fields !== undefined
+                ? { overview_hidden_fields }
+                : {}),
+            },
+          },
+        ],
+        list_view: {
+          columns: [{ key: 'name', label: 'Name' }],
+          default_sort: '-name',
+        },
+        formSchema: { sections: [] },
+      } as unknown as PluginSchema;
+    }
+
+    mockUsePluginEntityDetail.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'mysql-01',
+        status: 'active',
+        foo: 'secret',
+        extra_visible: 'hello',
+      },
+      isLoading: false,
+      error: null,
+    });
+
+    const customSchema = multiEntitySchemaWithHidden(['foo']);
+    render(
+      <QueryClientProvider client={makeClient()}>
+        <SnackbarProvider>
+          <MemoryRouter initialEntries={['/apps/inventory/services/1']}>
+            <Routes>
+              <Route
+                path="/apps/:plugin/:entityName/:id/*"
+                element={
+                  <PluginDetailPage
+                    schema={customSchema}
+                    pluginName="inventory"
+                  />
+                }
+              />
+            </Routes>
+          </MemoryRouter>
+        </SnackbarProvider>
+      </QueryClientProvider>
+    );
+
+    expect(screen.queryByText('Foo')).toBeNull();
+    expect(screen.queryByText('foo')).toBeNull();
+    // Unrelated extra field still renders
+    expect(screen.getByText('extra_visible')).toBeInTheDocument();
+    expect(screen.getByText('hello')).toBeInTheDocument();
+  });
+});
+
+describe('PluginDetailPage — Edit affordance', () => {
+  it('enables Edit and links to the edit route when the task has a stored form', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'FECHK',
+        status: 'completed',
+        data: { _form: { task_name: 'FECHK' } },
+      },
+      isLoading: false,
+    });
+
+    renderAt('/apps/checksums/task/FECHK');
+
+    const edit = screen.getByTestId('plugin-task-edit');
+    expect(edit).not.toBeDisabled();
+    expect(edit).toHaveAttribute('href', '/apps/checksums/task/FECHK/edit');
+  });
+
+  it('disables Edit for a task with no stored form (legacy or legacy-form-created)', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, name: 'FECHK', status: 'completed', data: { meta: {} } },
+      isLoading: false,
+    });
+
+    renderAt('/apps/checksums/task/FECHK');
+
+    expect(screen.getByTestId('plugin-task-edit')).toBeDisabled();
+  });
+});
+
+describe('PluginDetailPage delete flow', () => {
+  it('confirms then calls delete mutation and navigates to list on success', async () => {
+    mockDeleteMutate.mockReset();
+    mockDeleteMutate.mockResolvedValue(undefined);
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, name: 'check1', status: 'completed' },
+      isLoading: false,
+    });
+
+    renderAt('/apps/checksums/task/check1');
+
+    await userEvent.click(screen.getByTestId('plugin-task-delete'));
+
+    const dialog = await screen.findByRole('dialog');
+    await userEvent.click(
+      within(dialog).getByRole('button', { name: 'Delete' })
+    );
+
+    await waitFor(() =>
+      expect(mockDeleteMutate).toHaveBeenCalledWith('check1')
+    );
+    await waitFor(() =>
+      expect(screen.getByText('list page')).toBeInTheDocument()
+    );
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginDetailPage.tsx b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginDetailPage.tsx
new file mode 100644
index 00000000000..87373b5ee82
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginDetailPage.tsx
@@ -0,0 +1,1241 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { lazy, Suspense, useMemo, useState, type ReactNode } from 'react';
+import {
+  Routes,
+  Route,
+  useParams,
+  useNavigate,
+  useLocation,
+  Link,
+} from 'react-router-dom';
+import Alert from '@mui/material/Alert';
+import Box from '@mui/material/Box';
+import Button from '@mui/material/Button';
+import Chip from '@mui/material/Chip';
+import Dialog from '@mui/material/Dialog';
+import DialogActions from '@mui/material/DialogActions';
+import DialogContent from '@mui/material/DialogContent';
+import DialogContentText from '@mui/material/DialogContentText';
+import DialogTitle from '@mui/material/DialogTitle';
+import Grid from '@mui/material/Grid';
+import IconButton from '@mui/material/IconButton';
+import Paper from '@mui/material/Paper';
+import Skeleton from '@mui/material/Skeleton';
+import Stack from '@mui/material/Stack';
+import Tab from '@mui/material/Tab';
+import Tabs from '@mui/material/Tabs';
+import Tooltip from '@mui/material/Tooltip';
+import Typography from '@mui/material/Typography';
+import ArrowBackIcon from '@mui/icons-material/ArrowBack';
+import DeleteIcon from '@mui/icons-material/Delete';
+import EditIcon from '@mui/icons-material/Edit';
+import PlayArrowIcon from '@mui/icons-material/PlayArrow';
+import ScheduleIcon from '@mui/icons-material/Schedule';
+import { useSnackbar } from 'notistack';
+import {
+  useDeletePluginEntity,
+  useDeletePluginTask,
+  usePluginEntityDetail,
+  usePluginTask,
+  type DetailSection,
+  type ListView,
+  type PluginEntitySchema,
+  type PluginSchema,
+  type SepComponents,
+} from '@sep/api';
+import { resolvePath } from '../../utils/resolvePath';
+import {
+  TaskHistoryTable,
+  TaskHistoryStatusBadge,
+  isTaskHistoryStatus,
+  type TaskHistoryEntry,
+} from '../TaskHistoryTable';
+import { TaskLogViewer } from '../TaskLogViewer';
+import { ScheduleSummary } from '../ScheduleSummary';
+import {
+  useExecuteTask,
+  useStopTaskHistory,
+  useTaskHistoryByNames,
+  type TaskExecuteBody,
+} from '../../hooks';
+import { DeleteConfirmDialog } from './DeleteConfirmDialog';
+import {
+  detailSyntaxBlockSx,
+  type DetailSyntaxLanguage,
+} from './detailSyntaxStyles';
+import { resolvePluginRouteBase } from './routeBase';
+import { getStoredForm } from './storedForm';
+import { StatsCard } from './StatsCard';
+
+const DetailSyntaxHighlighter = lazy(() => import('./DetailSyntaxHighlighter'));
+
+export type { TaskExecuteBody };
+
+/** One executable target on a plugin task detail action bar. */
+export interface TaskExecuteAction {
+  label: string;
+  taskName: string;
+  testId?: string;
+  confirmMessage?: string;
+  executeBody?: TaskExecuteBody;
+}
+
+export interface PluginDetailPageProps {
+  schema: PluginSchema;
+  pluginName: string;
+  /** Absolute list route prefix when the plugin is not mounted under ``/apps/{name}``. */
+  routeBase?: string;
+  mockTasks?: Record<string, unknown>[];
+  mockEntityItems?: Record<string, Record<string, unknown>[]>;
+  /** Hide edit/delete (browse-only mode for multi-entity plugins). */
+  browseOnly?: boolean;
+  /** Omit these keys from the auto-rendered detail section (e.g. nested relations shown elsewhere). */
+  suppressDetailKeys?: string[];
+  /** Replace the default single Execute button with plugin-specific execute targets. */
+  getTaskExecuteActions?: (
+    task: Record<string, unknown>
+  ) => TaskExecuteAction[] | undefined;
+  /** Task names whose execution history should appear on the Execution History tab. */
+  getTaskHistoryNames?: (task: Record<string, unknown>) => string[] | undefined;
+  /** Extra content below the overview cards on single-task detail pages. */
+  renderTaskDetailChildren?: (args: {
+    task: Record<string, unknown>;
+    pluginName: string;
+    schema: PluginSchema;
+  }) => ReactNode;
+  /** Extra content under the main detail card (e.g. child entity tables). */
+  renderEntityDetailChildren?: (args: {
+    entityName: string;
+    record: Record<string, unknown>;
+    schema: PluginSchema;
+    pathname: string;
+    pluginName: string;
+    mockEntityItems?: Record<string, Record<string, unknown>[]>;
+    allowListEntityDelete?: boolean;
+  }) => ReactNode;
+  /** Nested inventory: resolve ``entityName`` / ``id`` from named params (e.g. ``nodeId``). */
+  detailEntityName?: string;
+  detailIdParam?: string;
+  /** Optional callback that resolves a custom back/delete target from current pathname. */
+  resolveParentPath?: (pathname: string) => string | null;
+  /** When true, omit the header row (back button, ``{title} #{id}``, status chip, edit/delete). */
+  hideDetailChrome?: boolean;
+  /** When true, nested list tables may show row delete (inventory ``actions`` column). */
+  allowListEntityDelete?: boolean;
+}
+
+/** Screen title when the back/status row is hidden (browse-only multi-entity plugins). */
+function detailScreenHeading(
+  entityName: string | undefined,
+  entityDisplayName: string | undefined
+): string | null {
+  if (!entityName) {
+    return null;
+  }
+  return `${entityDisplayName ?? entityName} detail`;
+}
+
+/** List URL for the current entity tab (path segment before ``:id``), e.g. ``/inventory/services``. */
+export function pathToEntityList(pathname: string, entityName: string): string {
+  const parts = pathname.split('/').filter(Boolean);
+  const idx = parts.lastIndexOf(entityName);
+  if (idx < 0) {
+    return '/';
+  }
+  return `/${parts.slice(0, idx + 1).join('/')}`;
+}
+
+/** Compact label/value cell size: 1 → 2 → 3 columns. Three columns only at ``lg``
+ * so mid-width layouts (sidebar + ~900px viewport) stay readable for long values. */
+const DETAIL_FIELD_GRID_SIZE = { xs: 12, sm: 6, lg: 4 } as const;
+
+/** Keep long unbroken strings (emails, hosts) inside their grid cell. */
+const detailFieldValueSx = {
+  overflowWrap: 'anywhere',
+  wordBreak: 'break-word',
+} as const;
+
+/** Suspense placeholder sized to match a rendered syntax block. */
+function SyntaxBlockFallback() {
+  return (
+    <Skeleton
+      variant="rectangular"
+      height={120}
+      sx={{ ...detailSyntaxBlockSx, mt: 0.5 }}
+    />
+  );
+}
+
+/**
+ * Lazy JSON highlight of an object value. Shared by the detail-field components
+ * so the un-hinted object branch renders identically wherever it appears.
+ */
+function JsonObjectPreview({ value }: { value: unknown }) {
+  return (
+    <Suspense fallback={<SyntaxBlockFallback />}>
+      <DetailSyntaxHighlighter value={value} language="json" />
+    </Suspense>
+  );
+}
+
+/** Compact label/value cell; wide content (JSON / syntax blocks) spans the full row. */
+function EntityDetailField({
+  label,
+  value,
+  highlightLanguage,
+}: {
+  label: string;
+  value: unknown;
+  highlightLanguage?: DetailSyntaxLanguage;
+}) {
+  if (value === null || value === undefined || value === '') {
+    return null;
+  }
+
+  const isWide = typeof value === 'object';
+
+  if (highlightLanguage) {
+    return (
+      <Grid size={12} sx={{ minWidth: 0 }}>
+        <Typography variant="caption" color="text.secondary">
+          {label}
+        </Typography>
+        <Suspense fallback={<SyntaxBlockFallback />}>
+          <DetailSyntaxHighlighter value={value} language={highlightLanguage} />
+        </Suspense>
+      </Grid>
+    );
+  }
+
+  let display: React.ReactNode;
+  if (typeof value === 'boolean') {
+    display = value ? 'Yes' : 'No';
+  } else if (typeof value === 'object') {
+    display = <JsonObjectPreview value={value} />;
+  } else {
+    display = String(value);
+  }
+
+  return (
+    <Grid size={isWide ? 12 : DETAIL_FIELD_GRID_SIZE} sx={{ minWidth: 0 }}>
+      <Typography variant="caption" color="text.secondary">
+        {label}
+      </Typography>
+      {typeof value === 'object' ? (
+        display
+      ) : (
+        <Typography variant="body1" sx={detailFieldValueSx}>
+          {display}
+        </Typography>
+      )}
+    </Grid>
+  );
+}
+
+// Framework baseline: numeric `id`, internal worker plumbing (`backend`, `protected`), and
+// timestamps already shown in list_view columns. The `data` payload is rendered via
+// schema-declared ``detail_view`` sections. Plugin schemas can extend this via
+// ``list_view.overview_hidden_fields``. The PII fields are handled by the dedicated
+// "PII Anonymization" capability-gated section.
+const BASELINE_OVERVIEW_HIDDEN_FIELDS = [
+  'id',
+  'backend',
+  'protected',
+  'data',
+  'updated_at',
+  'last_updated_by',
+  'connectivity_warning',
+  'anonymize_mask',
+  'anonymized_entities',
+] as const;
+
+/** Stable empty column set so a schema without a `list_view` never re-memoizes. */
+const EMPTY_LIST_COLUMNS: ListView['columns'] = [];
+
+function formatLabel(key: string): string {
+  return key.replace(/_/g, ' ').replace(/\b\w/g, (c) => c.toUpperCase());
+}
+
+function SectionCard({
+  title,
+  children,
+}: {
+  title: string;
+  children: React.ReactNode;
+}) {
+  return (
+    <Paper variant="outlined" sx={{ p: 2, mb: 2 }}>
+      <Typography variant="h6" sx={{ mb: 1.5 }}>
+        {title}
+      </Typography>
+      {children}
+    </Paper>
+  );
+}
+
+export function resolveTabFromSplat(
+  splat: string | undefined
+): 'overview' | 'logs' {
+  return splat?.replace(/\/+$/, '').startsWith('logs') ? 'logs' : 'overview';
+}
+
+function TaskOverviewDetailField({
+  label,
+  value,
+}: {
+  label: string;
+  value: unknown;
+}) {
+  if (value === null || value === undefined || value === '') {
+    return null;
+  }
+
+  const isWide = typeof value === 'object';
+  let display: React.ReactNode;
+  if (typeof value === 'boolean') {
+    display = value ? 'Yes' : 'No';
+  } else if (typeof value === 'object') {
+    // No schema highlight hint here — this component is fed from
+    // list_view.columns / extra task keys, not DetailField.
+    display = <JsonObjectPreview value={value} />;
+  } else {
+    display = String(value);
+  }
+
+  return (
+    <Grid size={isWide ? 12 : DETAIL_FIELD_GRID_SIZE} sx={{ minWidth: 0 }}>
+      <Typography
+        variant="caption"
+        color="text.secondary"
+        sx={{ display: 'block', mb: 0.5 }}
+      >
+        {label}
+      </Typography>
+      {typeof value === 'object' ? (
+        display
+      ) : (
+        <Typography variant="body1" sx={detailFieldValueSx}>
+          {display}
+        </Typography>
+      )}
+    </Grid>
+  );
+}
+
+interface OverviewTabProps {
+  schema: PluginSchema;
+  task: Record<string, unknown>;
+  hiddenFields?: string[];
+  /** Owning plugin name; enables the generic schedule summary. */
+  pluginName?: string;
+  /** Route to the plugin's Schedules screen (the add-a-schedule target). */
+  scheduleHref?: string;
+  children?: ReactNode;
+}
+
+function DetailViewSectionCard({
+  section,
+  task,
+}: {
+  section: DetailSection;
+  task: Record<string, unknown>;
+}) {
+  // Match EntityDetailField's own empty-value rule (undefined / null / '')
+  // so a section hides entirely when every field would have rendered blank,
+  // and so 0 / false still render as legitimate values.
+  const resolved = section.fields
+    .map((field) => ({ field, value: resolvePath(task, field.path) }))
+    .filter(
+      ({ value }) => value !== undefined && value !== null && value !== ''
+    );
+  if (resolved.length === 0) {
+    return null;
+  }
+  return (
+    <SectionCard title={section.title}>
+      <Grid container spacing={2}>
+        {resolved.map(({ field, value }, idx) => (
+          <EntityDetailField
+            key={`${field.path}:${field.label}:${idx}`}
+            label={field.label}
+            value={value}
+            highlightLanguage={field.highlight}
+          />
+        ))}
+      </Grid>
+    </SectionCard>
+  );
+}
+
+/**
+ * Render the post-creation connectivity-check warning, with an optional link
+ * to the run-script log when the check produced a task history. The link is
+ * omitted when no `task_history_id` is present (e.g. the Tasks API was
+ * unreachable, so no task ran).
+ */
+function ConnectivityWarningAlert({
+  warning,
+}: {
+  warning: SepComponents['schemas']['framework__ConnectivityWarning'];
+}) {
+  const [logOpen, setLogOpen] = useState(false);
+  const message =
+    warning.message || 'Connectivity check returned a warning for this task.';
+  const taskHistoryId = warning.task_history_id ?? null;
+
+  return (
+    <>
+      <Alert
+        severity="warning"
+        sx={{ mb: 3, whiteSpace: 'pre-wrap' }}
+        action={
+          taskHistoryId !== null ? (
+            <Button
+              color="inherit"
+              size="small"
+              data-testid="connectivity-log-button"
+              onClick={() => setLogOpen(true)}
+            >
+              View log
+            </Button>
+          ) : undefined
+        }
+      >
+        {message}
+      </Alert>
+      {taskHistoryId !== null && (
+        <Dialog
+          open={logOpen}
+          onClose={() => setLogOpen(false)}
+          fullWidth
+          maxWidth="lg"
+        >
+          <DialogTitle>Connectivity check log — #{taskHistoryId}</DialogTitle>
+          <DialogContent dividers sx={{ p: 0 }}>
+            <TaskLogViewer taskHistoryId={taskHistoryId} height={520} />
+          </DialogContent>
+        </Dialog>
+      )}
+    </>
+  );
+}
+
+function OverviewTab({
+  schema,
+  task,
+  hiddenFields = [],
+  pluginName,
+  scheduleHref,
+  children,
+}: OverviewTabProps) {
+  // The detail/list response model omits `connectivity_warning`; it rides only
+  // the create response. PluginCreatePage carries it here via navigation state
+  // so the warning surfaces once after a failing post-create check.
+  const location = useLocation();
+  const navState = (location.state ?? null) as {
+    connectivityWarning?: unknown;
+  } | null;
+  const connectivityWarning =
+    task.connectivity_warning ?? navState?.connectivityWarning;
+  const taskName =
+    typeof task.name === 'string' && task.name.trim()
+      ? task.name.trim()
+      : undefined;
+  // `list_view` is optional: an entity schema reached through an unresolved
+  // detail route has no top-level list view, so fall back to the task's own
+  // fields (rendered below as `extraEntries`) rather than crashing.
+  const columns = schema.list_view?.columns ?? EMPTY_LIST_COLUMNS;
+  const schemaHiddenFields = schema.list_view?.overview_hidden_fields;
+
+  const suppressedFields = useMemo(() => {
+    // Fields the single-task detail header already surfaces authoritatively:
+    // `name` (the h4 task title) and `status` (the header chip). Each is only
+    // suppressed under the exact condition the header renders it: the h4 shows
+    // `task.name` only when it's a string (otherwise it falls back to the route
+    // id), and the chip renders only for a string status. Matching those guards
+    // keeps a non-string value from being dropped from both the header and the
+    // card. They are the single source of truth for those values, so we
+    // de-duplicate them out of the Task information card rather than repeating
+    // them below the header.
+    const headerShownFields: string[] = [];
+    if (typeof task.name === 'string') {
+      headerShownFields.push('name');
+    }
+    if (typeof task.status === 'string') {
+      headerShownFields.push('status');
+    }
+    return new Set([
+      ...BASELINE_OVERVIEW_HIDDEN_FIELDS,
+      ...headerShownFields,
+      ...(schemaHiddenFields ?? []),
+      ...hiddenFields,
+    ]);
+  }, [task.name, task.status, schemaHiddenFields, hiddenFields]);
+
+  // `list_view.columns` targets the table view; in the detail Overview we drop
+  // any suppressed column (header/status-chip fields, baseline noise, or
+  // backend-curated `overview_hidden_fields`) so no field renders twice.
+  const visibleColumns = useMemo(
+    () => columns.filter((col) => !suppressedFields.has(col.key)),
+    [columns, suppressedFields]
+  );
+
+  // Extra fields beyond the schema's list_view columns, excluding internal
+  // noise. Lets future plugin schemas surface fields without listing them
+  // in `list_view.columns` (which is meant for the table view). Matched against
+  // the full column set so a suppressed column can't reappear here as an extra.
+  const extraEntries = Object.entries(task).filter(
+    ([key]) => !columns.some((c) => c.key === key) && !suppressedFields.has(key)
+  );
+
+  return (
+    <>
+      {connectivityWarning !== null &&
+        connectivityWarning !== undefined &&
+        typeof connectivityWarning === 'object' && (
+          <ConnectivityWarningAlert
+            warning={
+              connectivityWarning as SepComponents['schemas']['framework__ConnectivityWarning']
+            }
+          />
+        )}
+
+      {/* Schedule / next-run sits first so it is visible without scrolling
+          past the Task information card. Gate unchanged: plugins without the
+          scheduling capability render nothing here, so their Overview is
+          untouched. */}
+      {schema.capabilities?.scheduling &&
+        pluginName &&
+        taskName &&
+        scheduleHref && (
+          <ScheduleSummary
+            pluginName={pluginName}
+            taskName={taskName}
+            scheduleHref={scheduleHref}
+          />
+        )}
+
+      <SectionCard title="Task information">
+        <Grid container spacing={2}>
+          {visibleColumns.map((col) => (
+            <TaskOverviewDetailField
+              key={col.key}
+              label={col.label}
+              value={task[col.key]}
+            />
+          ))}
+          {extraEntries.map(([key, value]) => (
+            <TaskOverviewDetailField
+              key={key}
+              label={formatLabel(key)}
+              value={value}
+            />
+          ))}
+        </Grid>
+      </SectionCard>
+
+      {schema.capabilities?.stats && (
+        <StatsCard
+          taskName={
+            typeof task.name === 'string' && task.name.trim()
+              ? task.name.trim()
+              : undefined
+          }
+        />
+      )}
+
+      {schema.capabilities?.pii_anonymization && (
+        <SectionCard title="PII Anonymization">
+          {Array.isArray(task.anonymized_entities) &&
+          task.anonymized_entities.length > 0 ? (
+            <Stack
+              direction="row"
+              spacing={1}
+              sx={{ flexWrap: 'wrap', gap: 1 }}
+            >
+              {(task.anonymized_entities as string[]).map((entity) => (
+                <Chip
+                  key={entity}
+                  label={entity.replace(/_/g, ' ')}
+                  size="small"
+                  data-testid="pii-entity-chip"
+                />
+              ))}
+            </Stack>
+          ) : (
+            <Typography variant="body2" color="text.secondary">
+              No PII entities configured for anonymization.
+            </Typography>
+          )}
+        </SectionCard>
+      )}
+
+      {schema.detail_view?.sections.map((section, idx) => (
+        <DetailViewSectionCard
+          key={`${section.title}:${idx}`}
+          section={section}
+          task={task}
+        />
+      ))}
+
+      {children}
+    </>
+  );
+}
+
+interface LogsTabProps {
+  taskNames: string[];
+}
+
+function LogsTab({ taskNames }: LogsTabProps) {
+  const historyQuery = useTaskHistoryByNames(taskNames);
+  const stop = useStopTaskHistory();
+  const [logsEntry, setLogsEntry] = useState<TaskHistoryEntry | null>(null);
+  const logsTaskName = logsEntry?.task?.name ?? taskNames[0] ?? 'task';
+
+  return (
+    <>
+      {historyQuery.error ? (
+        <Alert severity="error" sx={{ mb: 3 }}>
+          Failed to load execution history: {historyQuery.error.message}
+        </Alert>
+      ) : (
+        <Paper variant="outlined" sx={{ p: 0, mb: 3 }}>
+          <TaskHistoryTable
+            data={historyQuery.data?.items ?? []}
+            isLoading={historyQuery.isLoading}
+            hideTaskNameColumn={taskNames.length <= 1}
+            onViewLogs={setLogsEntry}
+            onStopTask={(entry) => {
+              if (entry.id !== null && entry.id !== undefined) {
+                stop.mutate(entry.id);
+              }
+            }}
+            isStopping={stop.isPending}
+          />
+        </Paper>
+      )}
+
+      <Dialog
+        open={logsEntry !== null}
+        onClose={() => setLogsEntry(null)}
+        fullWidth
+        maxWidth="lg"
+      >
+        <DialogTitle>
+          Logs — {logsTaskName}
+          {logsEntry?.id !== null && logsEntry?.id !== undefined
+            ? ` #${logsEntry.id}`
+            : ''}
+        </DialogTitle>
+        <DialogContent dividers sx={{ p: 0 }}>
+          {logsEntry?.id !== null && logsEntry?.id !== undefined && (
+            <TaskLogViewer
+              taskHistoryId={logsEntry.id}
+              taskStatus={logsEntry.status}
+              height={520}
+            />
+          )}
+        </DialogContent>
+      </Dialog>
+    </>
+  );
+}
+
+interface ActionBarProps {
+  schema: PluginSchema;
+  pluginName: string;
+  routeBase: string;
+  taskName: string;
+  executeActions?: TaskExecuteAction[];
+  /** Whether the task carries a stored create-form body, enabling in-place edit. */
+  hasStoredForm: boolean;
+}
+
+function ActionBar({
+  schema,
+  pluginName,
+  routeBase,
+  taskName,
+  executeActions,
+  hasStoredForm,
+}: ActionBarProps) {
+  const navigate = useNavigate();
+  const { enqueueSnackbar } = useSnackbar();
+  const deleteTask = useDeletePluginTask(pluginName);
+  const executeTask = useExecuteTask(pluginName);
+  const [confirmOpen, setConfirmOpen] = useState(false);
+  const [pendingExecute, setPendingExecute] =
+    useState<TaskExecuteAction | null>(null);
+
+  const resolvedExecuteActions =
+    executeActions ??
+    ([
+      {
+        label: 'Execute',
+        taskName,
+        testId: 'plugin-task-execute',
+      },
+    ] satisfies TaskExecuteAction[]);
+
+  const handleExecute = async () => {
+    if (!pendingExecute) {
+      return;
+    }
+    try {
+      await executeTask.mutateAsync({
+        taskName: pendingExecute.taskName,
+        executeBody: pendingExecute.executeBody,
+      });
+      enqueueSnackbar(
+        `${schema.display_name} task "${pendingExecute.taskName}" started`,
+        {
+          variant: 'success',
+        }
+      );
+    } catch (e) {
+      enqueueSnackbar(
+        e instanceof Error ? e.message : 'Failed to execute task',
+        {
+          variant: 'error',
+        }
+      );
+    } finally {
+      setPendingExecute(null);
+    }
+  };
+
+  const handleDelete = async () => {
+    try {
+      await deleteTask.mutateAsync(taskName);
+      enqueueSnackbar(`${schema.display_name} task deleted`, {
+        variant: 'success',
+      });
+      // Anchor to the plugin root explicitly. Relative `..` chains depend
+      // on which tab the user is on (Overview vs. Execution History renders a deeper
+      // sub-route via nested `<Routes>`), so use an absolute path.
+      navigate(routeBase);
+    } catch (e) {
+      enqueueSnackbar(
+        e instanceof Error ? e.message : 'Failed to delete task',
+        {
+          variant: 'error',
+        }
+      );
+    } finally {
+      setConfirmOpen(false);
+    }
+  };
+
+  const editUnavailable =
+    "Editing isn't available for this task — it has no saved form input.";
+
+  return (
+    <>
+      <Stack direction="row" spacing={1} sx={{ mb: 3 }}>
+        {schema.capabilities?.scheduling && (
+          <Button
+            variant="outlined"
+            startIcon={<ScheduleIcon />}
+            onClick={() => navigate(`${routeBase}/schedule`)}
+            data-testid="plugin-task-schedule"
+          >
+            Schedule
+          </Button>
+        )}
+
+        {resolvedExecuteActions.map((action) => (
+          <Button
+            key={`${action.taskName}-${action.label}`}
+            variant="outlined"
+            startIcon={<PlayArrowIcon />}
+            onClick={() => setPendingExecute(action)}
+            disabled={executeTask.isPending}
+            data-testid={action.testId ?? 'plugin-task-execute'}
+          >
+            {action.label}
+          </Button>
+        ))}
+
+        {hasStoredForm ? (
+          <Button
+            variant="outlined"
+            component={Link}
+            to={`${routeBase}/task/${encodeURIComponent(taskName)}/edit`}
+            startIcon={<EditIcon />}
+            data-testid="plugin-task-edit"
+          >
+            Edit
+          </Button>
+        ) : (
+          <Tooltip title={editUnavailable}>
+            <span>
+              <Button
+                variant="outlined"
+                startIcon={<EditIcon />}
+                disabled
+                data-testid="plugin-task-edit"
+              >
+                Edit
+              </Button>
+            </span>
+          </Tooltip>
+        )}
+
+        <Box sx={{ flexGrow: 1 }} />
+
+        <Button
+          variant="outlined"
+          startIcon={<DeleteIcon />}
+          onClick={() => setConfirmOpen(true)}
+          disabled={deleteTask.isPending}
+          data-testid="plugin-task-delete"
+        >
+          Delete
+        </Button>
+      </Stack>
+
+      <Dialog
+        open={pendingExecute !== null}
+        onClose={() => setPendingExecute(null)}
+      >
+        <DialogTitle>
+          {pendingExecute?.label ?? 'Execute'} {schema.display_name} task?
+        </DialogTitle>
+        <DialogContent>
+          <DialogContentText>
+            {pendingExecute?.confirmMessage ??
+              `Are you sure you want to execute the task ${pendingExecute?.taskName ?? taskName} now?`}
+          </DialogContentText>
+        </DialogContent>
+        <DialogActions>
+          <Button
+            onClick={() => setPendingExecute(null)}
+            disabled={executeTask.isPending}
+          >
+            Cancel
+          </Button>
+          <Button
+            onClick={handleExecute}
+            variant="contained"
+            disabled={executeTask.isPending}
+            data-testid="plugin-task-execute-confirm"
+          >
+            {pendingExecute?.label ?? 'Execute'}
+          </Button>
+        </DialogActions>
+      </Dialog>
+
+      <Dialog open={confirmOpen} onClose={() => setConfirmOpen(false)}>
+        <DialogTitle>Delete {schema.display_name} task?</DialogTitle>
+        <DialogContent>
+          <DialogContentText>
+            This will permanently remove the task definition. Past run history
+            is unaffected.
+          </DialogContentText>
+        </DialogContent>
+        <DialogActions>
+          <Button
+            onClick={() => setConfirmOpen(false)}
+            disabled={deleteTask.isPending}
+          >
+            Cancel
+          </Button>
+          <Button
+            onClick={handleDelete}
+            variant="contained"
+            disabled={deleteTask.isPending}
+          >
+            Delete
+          </Button>
+        </DialogActions>
+      </Dialog>
+    </>
+  );
+}
+
+export function PluginDetailPage({
+  schema,
+  pluginName,
+  routeBase: routeBaseProp,
+  mockTasks,
+  mockEntityItems,
+  browseOnly = false,
+  suppressDetailKeys = [],
+  getTaskExecuteActions,
+  getTaskHistoryNames,
+  renderTaskDetailChildren,
+  renderEntityDetailChildren,
+  detailEntityName,
+  detailIdParam,
+  resolveParentPath,
+  hideDetailChrome = false,
+  allowListEntityDelete = false,
+}: PluginDetailPageProps) {
+  const routeBase = resolvePluginRouteBase(pluginName, routeBaseProp);
+  const params = useParams<Record<string, string | undefined>>();
+  const id = (detailIdParam && params[detailIdParam]) ?? params.id;
+  const entityName = detailEntityName ?? params.entityName;
+  const splat = params['*'];
+  const navigate = useNavigate();
+  const location = useLocation();
+  const entitySchema = useMemo(
+    () =>
+      schema.entities?.find((e: PluginEntitySchema) => e.name === entityName),
+    [schema.entities, entityName]
+  );
+  const multi = Boolean(schema.entities?.length && entityName && entitySchema);
+
+  const customParentPath = useMemo(() => {
+    if (!resolveParentPath) {
+      return null;
+    }
+    return resolveParentPath(location.pathname);
+  }, [location.pathname, resolveParentPath]);
+
+  const taskQuery = usePluginTask(pluginName, id, mockTasks, {
+    enabled: !multi && Boolean(id),
+  });
+  const entityQuery = usePluginEntityDetail(
+    pluginName,
+    entityName ?? '',
+    id,
+    multi ? mockEntityItems?.[entityName!] : undefined,
+    { enabled: multi && Boolean(id) }
+  );
+
+  const { data: task, isLoading } = multi ? entityQuery : taskQuery;
+  const listView = multi ? entitySchema!.list_view : schema.list_view!;
+  const title = multi ? entitySchema!.display_name : schema.display_name;
+  const headingWhenChromeHidden = useMemo(
+    () =>
+      hideDetailChrome && multi
+        ? detailScreenHeading(entityName, entitySchema?.display_name)
+        : null,
+    [hideDetailChrome, multi, entityName, entitySchema?.display_name]
+  );
+
+  const deleteEntity = useDeletePluginEntity(
+    pluginName,
+    entityName ?? '',
+    multi ? mockEntityItems?.[entityName!] : undefined
+  );
+
+  const [entityDeleteOpen, setEntityDeleteOpen] = useState(false);
+
+  const confirmEntityDelete = () => {
+    setEntityDeleteOpen(false);
+    if (!id || !multi) {
+      return;
+    }
+    deleteEntity.mutate(id, {
+      onSuccess: () =>
+        customParentPath
+          ? navigate(customParentPath)
+          : entityName
+            ? navigate(pathToEntityList(location.pathname, entityName))
+            : navigate('..', { relative: 'path' }),
+    });
+  };
+
+  if (multi) {
+    if (isLoading) {
+      return (
+        <Box>
+          {headingWhenChromeHidden ? (
+            <Typography
+              component="h1"
+              variant="h4"
+              sx={{ mb: 2, fontWeight: 600 }}
+            >
+              {headingWhenChromeHidden}
+            </Typography>
+          ) : (
+            <Skeleton variant="text" width={300} height={40} />
+          )}
+          <Skeleton variant="rectangular" height={200} sx={{ mt: 2 }} />
+        </Box>
+      );
+    }
+
+    if (!task) {
+      return (
+        <Box>
+          {headingWhenChromeHidden ? (
+            <Typography
+              component="h1"
+              variant="h4"
+              sx={{ mb: 2, fontWeight: 600 }}
+            >
+              {headingWhenChromeHidden}
+            </Typography>
+          ) : null}
+          <Typography variant="h5">Not found</Typography>
+        </Box>
+      );
+    }
+
+    const recordName =
+      typeof task.name === 'string' && task.name.trim()
+        ? task.name.trim()
+        : typeof task.name === 'number'
+          ? String(task.name)
+          : undefined;
+
+    return (
+      <Box>
+        <DeleteConfirmDialog
+          open={entityDeleteOpen}
+          onClose={() => setEntityDeleteOpen(false)}
+          onConfirm={confirmEntityDelete}
+          title={`Delete from ${schema.display_name}?`}
+          description={
+            recordName
+              ? `Permanently delete ${title} "${recordName}" (id ${id}) from ${schema.display_name}? This cannot be undone.`
+              : `Permanently delete ${title} (id ${id}) from ${schema.display_name}? This cannot be undone.`
+          }
+        />
+
+        {headingWhenChromeHidden ? (
+          <Typography
+            component="h1"
+            variant="h4"
+            sx={{ mb: 2, fontWeight: 600 }}
+          >
+            {headingWhenChromeHidden}
+          </Typography>
+        ) : null}
+        {!hideDetailChrome && (
+          <Box
+            sx={{
+              display: 'flex',
+              alignItems: 'center',
+              gap: 1,
+              mb: 3,
+              flexWrap: 'wrap',
+            }}
+          >
+            <IconButton
+              onClick={() =>
+                customParentPath
+                  ? navigate(customParentPath)
+                  : multi && entityName
+                    ? navigate(pathToEntityList(location.pathname, entityName))
+                    : navigate('..', { relative: 'path' })
+              }
+            >
+              <ArrowBackIcon />
+            </IconButton>
+            <Typography variant="h4">
+              {title} #{id}
+            </Typography>
+            {isTaskHistoryStatus(task.status) ? (
+              <TaskHistoryStatusBadge status={task.status} />
+            ) : typeof task.status === 'string' ? (
+              // Unrecognized string status (unexpected/older value): fall back to
+              // a plain chip so status never silently disappears, matching
+              // SchemaListView's status-cell fallback.
+              <Chip label={task.status} size="small" />
+            ) : null}
+            {multi && !browseOnly && (
+              <>
+                <Button
+                  component={Link}
+                  to="edit"
+                  relative="path"
+                  startIcon={<EditIcon />}
+                  variant="outlined"
+                  size="small"
+                >
+                  Edit
+                </Button>
+                <Button
+                  variant="outlined"
+                  size="small"
+                  onClick={() => setEntityDeleteOpen(true)}
+                  disabled={deleteEntity.isPending}
+                >
+                  Delete
+                </Button>
+              </>
+            )}
+          </Box>
+        )}
+
+        <Paper sx={{ p: 2 }}>
+          <Grid container spacing={2}>
+            {listView.columns
+              .filter(
+                (col) =>
+                  col.format !== 'actions' &&
+                  col.key !== '_actions' &&
+                  !(listView.overview_hidden_fields ?? []).includes(col.key)
+              )
+              .map((col) => (
+                <EntityDetailField
+                  key={col.key}
+                  highlightLanguage={entitySchema?.detail_highlights?.[col.key]}
+                  label={col.label}
+                  value={task[col.key]}
+                />
+              ))}
+
+            {Object.entries(task)
+              .filter(
+                ([key]) =>
+                  !listView.columns.some((c) => c.key === key) &&
+                  key !== 'id' &&
+                  key !== '_actions' &&
+                  !suppressDetailKeys.includes(key) &&
+                  !(listView.overview_hidden_fields ?? []).includes(key)
+              )
+              .map(([key, value]) => (
+                <EntityDetailField
+                  key={key}
+                  highlightLanguage={entitySchema?.detail_highlights?.[key]}
+                  label={key}
+                  value={value}
+                />
+              ))}
+          </Grid>
+        </Paper>
+
+        {multi &&
+          entityName &&
+          renderEntityDetailChildren &&
+          renderEntityDetailChildren({
+            entityName,
+            record: task as Record<string, unknown>,
+            schema,
+            pathname: location.pathname,
+            pluginName,
+            mockEntityItems,
+            allowListEntityDelete,
+          })}
+      </Box>
+    );
+  }
+
+  const tabValue = resolveTabFromSplat(splat);
+
+  if (isLoading) {
+    return (
+      <Box>
+        <Skeleton variant="text" width={300} height={40} />
+        <Skeleton variant="rectangular" height={200} sx={{ mt: 2 }} />
+      </Box>
+    );
+  }
+
+  if (!task || !id) {
+    return (
+      <Box>
+        <Typography variant="h5">Task not found</Typography>
+      </Box>
+    );
+  }
+
+  const taskName = typeof task.name === 'string' ? task.name : id;
+  const hasStoredForm = Boolean(getStoredForm(task as Record<string, unknown>));
+  const detailBase = `${routeBase}/task/${encodeURIComponent(id)}`;
+  const taskExecuteActions = getTaskExecuteActions?.(
+    task as Record<string, unknown>
+  );
+  const taskHistoryNames =
+    getTaskHistoryNames?.(task as Record<string, unknown>) ??
+    (taskName ? [taskName] : []);
+
+  return (
+    <Box>
+      <Box sx={{ display: 'flex', alignItems: 'center', gap: 1, mb: 0.5 }}>
+        <IconButton
+          onClick={() => navigate(routeBase)}
+          aria-label="Back to list"
+        >
+          <ArrowBackIcon />
+        </IconButton>
+        <Typography variant="overline" color="text.secondary">
+          {schema.display_name}
+        </Typography>
+      </Box>
+      <Box sx={{ display: 'flex', alignItems: 'center', gap: 1, mb: 3, ml: 5 }}>
+        <Typography variant="h4">{taskName}</Typography>
+        {isTaskHistoryStatus(task.status) ? (
+          <TaskHistoryStatusBadge status={task.status} />
+        ) : typeof task.status === 'string' ? (
+          // Unrecognized string status (unexpected/older value): fall back to a
+          // plain chip so status never silently disappears, matching
+          // SchemaListView's status-cell fallback.
+          <Chip label={task.status} size="small" />
+        ) : null}
+      </Box>
+
+      <ActionBar
+        schema={schema}
+        pluginName={pluginName}
+        routeBase={routeBase}
+        taskName={taskName}
+        executeActions={taskExecuteActions}
+        hasStoredForm={hasStoredForm}
+      />
+
+      <Tabs
+        value={tabValue}
+        sx={{ mb: 3, borderBottom: 1, borderColor: 'divider' }}
+      >
+        <Tab
+          label="Overview"
+          value="overview"
+          component={Link}
+          to={detailBase}
+          replace
+        />
+        <Tab
+          label="Execution History"
+          value="logs"
+          component={Link}
+          to={`${detailBase}/logs`}
+          replace
+        />
+      </Tabs>
+
+      <Routes>
+        <Route
+          index
+          element={
+            <OverviewTab
+              schema={schema}
+              task={task}
+              hiddenFields={suppressDetailKeys}
+              pluginName={pluginName}
+              scheduleHref={`${routeBase}/schedule`}
+            >
+              {renderTaskDetailChildren?.({
+                task: task as Record<string, unknown>,
+                pluginName,
+                schema,
+              })}
+            </OverviewTab>
+          }
+        />
+        <Route path="logs" element={<LogsTab taskNames={taskHistoryNames} />} />
+      </Routes>
+    </Box>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginListPage.test.tsx b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginListPage.test.tsx
new file mode 100644
index 00000000000..2c9e8bb2a43
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginListPage.test.tsx
@@ -0,0 +1,77 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { render, screen } from '@testing-library/react';
+import { describe, expect, it, vi } from 'vitest';
+import { MemoryRouter } from 'react-router-dom';
+import { SnackbarProvider } from 'notistack';
+import type { PluginSchema } from '@sep/api';
+import { PluginListPage } from './PluginListPage';
+
+vi.mock('../SchemaListView', () => ({
+  SchemaListView: () => <div>list</div>,
+}));
+
+vi.mock('@sep/api', () => ({
+  DEFAULT_PLUGIN_LIST_OFFSET: 0,
+  DEFAULT_PLUGIN_LIST_LIMIT: 50,
+  RUNNING_STATUSES: new Set(['running', 'pending']),
+  usePluginTasks: () => ({
+    data: { items: [], pagination: null },
+    isLoading: false,
+  }),
+  usePluginEntityList: () => ({
+    data: { items: [], pagination: null },
+    isLoading: false,
+  }),
+  useDeletePluginEntity: () => ({
+    mutate: vi.fn(),
+    isPending: false,
+    variables: undefined,
+  }),
+}));
+
+const schema: PluginSchema = {
+  name: 'sched',
+  display_name: 'Sched',
+  capabilities: { scheduling: true },
+  list_view: { columns: [{ key: 'name', label: 'Name' }] },
+};
+
+function renderPage(props: Partial<Parameters<typeof PluginListPage>[0]> = {}) {
+  return render(
+    <SnackbarProvider>
+      <MemoryRouter>
+        <PluginListPage schema={schema} pluginName="sched" {...props} />
+      </MemoryRouter>
+    </SnackbarProvider>
+  );
+}
+
+describe('PluginListPage — generic Schedules button', () => {
+  it('renders the generic Schedules button by default when scheduling is enabled', () => {
+    renderPage();
+    expect(screen.getByTestId('plugin-schedule-link')).toBeInTheDocument();
+  });
+
+  it('suppresses the generic Schedules button when hideScheduleButton is set', () => {
+    renderPage({ hideScheduleButton: true });
+    expect(
+      screen.queryByTestId('plugin-schedule-link')
+    ).not.toBeInTheDocument();
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginListPage.tsx b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginListPage.tsx
new file mode 100644
index 00000000000..25af2b7b3c9
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginListPage.tsx
@@ -0,0 +1,350 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useMemo, useState } from 'react';
+import { useNavigate, useParams } from 'react-router-dom';
+import Box from '@mui/material/Box';
+import Button from '@mui/material/Button';
+import Chip from '@mui/material/Chip';
+import Stack from '@mui/material/Stack';
+import Typography from '@mui/material/Typography';
+import Tab from '@mui/material/Tab';
+import Tabs from '@mui/material/Tabs';
+import AddIcon from '@mui/icons-material/Add';
+import ScheduleIcon from '@mui/icons-material/Schedule';
+import { useSnackbar } from 'notistack';
+import {
+  DEFAULT_PLUGIN_LIST_LIMIT,
+  DEFAULT_PLUGIN_LIST_OFFSET,
+  RUNNING_STATUSES,
+  useDeletePluginEntity,
+  usePluginEntityList,
+  usePluginTasks,
+  type PluginSchema,
+  type TaskHistoryStatus,
+} from '@sep/api';
+import {
+  SchemaListView,
+  type RenderListColumnOverride,
+} from '../SchemaListView';
+import { DeleteConfirmDialog } from './DeleteConfirmDialog';
+
+interface PluginListPageProps {
+  schema: PluginSchema;
+  pluginName: string;
+  mockTasks?: Record<string, unknown>[];
+  mockEntityItems?: Record<string, Record<string, unknown>[]>;
+  /** When true, hide the create action and row navigation to detail. */
+  listOnly?: boolean;
+  /** When true, hide only the create button (row navigation still enabled). */
+  hideCreate?: boolean;
+  /** When true, hide entity tabs (nodes / services / …). */
+  hideEntityTabs?: boolean;
+  /**
+   * When true, suppress the generic Schedules button. Opt-in for nested mounts
+   * (e.g. inventory) that render their own scheduling button with a correct
+   * relative target; the default still renders the button.
+   */
+  hideScheduleButton?: boolean;
+  /** When set, overrides ``useParams().entityName`` (nested routes that use a fixed segment like ``nodes``). */
+  entityNameOverride?: string;
+  /**
+   * When set, row clicks navigate to this absolute path (e.g. nested inventory:
+   * ``(row) => \`\${pathname}/\${row.id}\```).
+   */
+  rowClickHref?: (row: Record<string, unknown>) => string;
+  /** When true, list views that declare an ``actions`` column show row delete controls. */
+  allowListEntityDelete?: boolean;
+  /** Optional per-cell override for non-`actions` columns (falls back to `formatCellValue`). */
+  renderListColumn?: RenderListColumnOverride;
+  /**
+   * Disable the poll-while-running task-list refresh. Opt-in escape hatch for
+   * tests and stories so they issue no repeat requests, mirroring
+   * ``SchemaListView``'s ``disableSchedulePolling``.
+   */
+  disableTaskPolling?: boolean;
+}
+
+export function PluginListPage({
+  schema,
+  pluginName,
+  mockTasks,
+  mockEntityItems,
+  listOnly = false,
+  hideCreate = false,
+  hideEntityTabs = false,
+  hideScheduleButton = false,
+  entityNameOverride,
+  rowClickHref,
+  allowListEntityDelete = false,
+  renderListColumn,
+  disableTaskPolling = false,
+}: PluginListPageProps) {
+  const navigate = useNavigate();
+  const { enqueueSnackbar } = useSnackbar();
+  const [pendingDelete, setPendingDelete] = useState<{
+    id: string;
+    name?: string;
+  } | null>(null);
+  const { entityName: entityNameParam } = useParams<{ entityName?: string }>();
+  const entityName = entityNameOverride ?? entityNameParam;
+  const entitySchema = useMemo(
+    () => schema.entities?.find((e) => e.name === entityName),
+    [schema.entities, entityName]
+  );
+  const multi = Boolean(schema.entities?.length && entityName && entitySchema);
+
+  const paginationScope = `${pluginName}:${entityName ?? ''}`;
+  const [listPage, setListPage] = useState({
+    scope: paginationScope,
+    offset: DEFAULT_PLUGIN_LIST_OFFSET,
+    limit: DEFAULT_PLUGIN_LIST_LIMIT,
+  });
+
+  // Derive the active page from scope so a tab change uses offset 0 on the
+  // same render (a post-paint useEffect would still fire one stale-offset
+  // request and flash an empty page when the new entity has fewer rows).
+  const activeListPage =
+    listPage.scope === paginationScope
+      ? listPage
+      : {
+          scope: paginationScope,
+          offset: DEFAULT_PLUGIN_LIST_OFFSET,
+          limit: DEFAULT_PLUGIN_LIST_LIMIT,
+        };
+
+  if (listPage.scope !== paginationScope) {
+    setListPage(activeListPage);
+  }
+
+  const listQueryOptions = {
+    offset: activeListPage.offset,
+    limit: activeListPage.limit,
+  };
+
+  const singleQuery = usePluginTasks(pluginName, mockTasks, {
+    enabled: !multi,
+    disablePolling: disableTaskPolling,
+    ...listQueryOptions,
+  });
+  const entityQuery = usePluginEntityList(
+    pluginName,
+    entityName ?? '',
+    multi ? mockEntityItems?.[entityName!] : undefined,
+    { enabled: multi, ...listQueryOptions }
+  );
+
+  const { data: listResult, isLoading } = multi ? entityQuery : singleQuery;
+  const rows = listResult?.items ?? [];
+  const listPagination = listResult?.pagination ?? null;
+  // "Currently running" summarises the task list only. Entity lists are not
+  // task lists (they carry no running state and are not polled), so the count
+  // stays at zero there and the affordance never renders.
+  const runningCount = useMemo(
+    () =>
+      multi
+        ? 0
+        : rows.filter((row) =>
+            RUNNING_STATUSES.has(row.status as TaskHistoryStatus)
+          ).length,
+    [multi, rows]
+  );
+  // `list_view` is optional on the top-level schema, and an unresolved entity
+  // route (unknown `entityName` on an entity schema) falls back to it, so it can
+  // be absent here — guarded below once every hook has run.
+  const listView = multi ? entitySchema!.list_view : schema.list_view;
+  const title = multi ? entitySchema!.display_name : schema.display_name;
+  const description = multi ? entitySchema?.description : schema.description;
+
+  const hasActionsColumn =
+    listView?.columns.some((c) => c.format === 'actions') ?? false;
+  const deleteEntity = useDeletePluginEntity(
+    pluginName,
+    entityName ?? '',
+    multi ? mockEntityItems?.[entityName!] : undefined
+  );
+
+  const onDeleteRow =
+    allowListEntityDelete && multi && entityName && hasActionsColumn
+      ? (row: Record<string, unknown>) => {
+          const rid = row.id;
+          if (rid === undefined || rid === null) {
+            return;
+          }
+          const rawName = row.name;
+          const rowName =
+            typeof rawName === 'string' && rawName.trim()
+              ? rawName.trim()
+              : typeof rawName === 'number'
+                ? String(rawName)
+                : undefined;
+          setPendingDelete({ id: String(rid), name: rowName });
+        }
+      : undefined;
+
+  const confirmListDelete = () => {
+    const sid = pendingDelete?.id;
+    setPendingDelete(null);
+    if (!sid) {
+      return;
+    }
+    deleteEntity.mutate(sid, {
+      onSuccess: () => {
+        enqueueSnackbar(`${title} deleted`, { variant: 'success' });
+      },
+      onError: (err: Error) => {
+        enqueueSnackbar(err.message || 'Delete failed', { variant: 'error' });
+      },
+    });
+  };
+
+  if (!listView) {
+    return (
+      <Box sx={{ py: 2 }}>
+        <Typography variant="h5">Not found</Typography>
+      </Box>
+    );
+  }
+
+  return (
+    <Box>
+      {multi && schema.entities && !hideEntityTabs && (
+        <Tabs
+          sx={{ mb: 2 }}
+          value={entityName}
+          onChange={(_, value) => {
+            if (typeof value === 'string' && value !== entityName) {
+              navigate(`../${value}`, { relative: 'path' });
+            }
+          }}
+          variant="scrollable"
+          scrollButtons="auto"
+        >
+          {schema.entities.map((e) => (
+            <Tab key={e.name} label={e.display_name} value={e.name} />
+          ))}
+        </Tabs>
+      )}
+      <Box
+        sx={{
+          display: 'flex',
+          justifyContent: 'space-between',
+          alignItems: 'center',
+          mb: 3,
+          gap: 2,
+        }}
+      >
+        <Box>
+          <Stack direction="row" spacing={1.5} alignItems="center">
+            <Typography variant="h4">{title}</Typography>
+            {runningCount > 0 && (
+              <Chip
+                size="small"
+                color="info"
+                label={`Currently running (${runningCount})`}
+                data-testid="currently-running"
+              />
+            )}
+          </Stack>
+          {description && (
+            <Typography variant="body2" color="text.secondary" sx={{ mt: 0.5 }}>
+              {description}
+            </Typography>
+          )}
+        </Box>
+        {!listOnly && (
+          <Stack direction="row" spacing={1}>
+            {!hideScheduleButton && schema.capabilities?.scheduling && (
+              <Button
+                variant="outlined"
+                startIcon={<ScheduleIcon />}
+                onClick={() => navigate('schedule', { relative: 'path' })}
+                data-testid="plugin-schedule-link"
+              >
+                Schedules
+              </Button>
+            )}
+            {!hideCreate && (
+              <Button
+                variant="contained"
+                startIcon={<AddIcon />}
+                onClick={() => navigate('new', { relative: 'path' })}
+              >
+                New {multi ? title : schema.display_name}
+              </Button>
+            )}
+          </Stack>
+        )}
+      </Box>
+
+      <DeleteConfirmDialog
+        open={pendingDelete !== null}
+        onClose={() => setPendingDelete(null)}
+        onConfirm={confirmListDelete}
+        title={`Delete from ${schema.display_name}?`}
+        description={
+          pendingDelete
+            ? pendingDelete.name
+              ? `Permanently delete ${title} "${pendingDelete.name}" (id ${pendingDelete.id}) from ${schema.display_name}? This cannot be undone.`
+              : `Permanently delete ${title} (id ${pendingDelete.id}) from ${schema.display_name}? This cannot be undone.`
+            : ''
+        }
+      />
+
+      <SchemaListView
+        listView={listView}
+        data={rows}
+        isLoading={isLoading}
+        pluginName={pluginName}
+        pagination={
+          listPagination
+            ? {
+                total: listPagination.total,
+                offset: listPagination.offset,
+                limit: listPagination.limit,
+                onChange: ({ offset, limit }) =>
+                  setListPage({ scope: paginationScope, offset, limit }),
+              }
+            : null
+        }
+        onRowClick={
+          listOnly
+            ? undefined
+            : multi
+              ? (row) =>
+                  rowClickHref
+                    ? navigate(rowClickHref(row as Record<string, unknown>))
+                    : navigate(String(row.id), { relative: 'path' })
+              : (row) => {
+                  // Backend per-plugin detail/delete routes look up by `task_name`
+                  // (string), not numeric `id`. The first listView column is
+                  // typically `name`; fall back to id only if name is absent.
+                  const key = row.name ?? row.id;
+                  if (key !== undefined && key !== null) {
+                    navigate(`task/${encodeURIComponent(String(key))}`, {
+                      relative: 'path',
+                    });
+                  }
+                }
+        }
+        onDeleteRow={onDeleteRow}
+        deletingRowId={deleteEntity.isPending ? deleteEntity.variables : null}
+        renderListColumn={renderListColumn}
+      />
+    </Box>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginSchedulePage.tsx b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginSchedulePage.tsx
new file mode 100644
index 00000000000..947cddbd706
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginSchedulePage.tsx
@@ -0,0 +1,44 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import Box from '@mui/material/Box';
+import IconButton from '@mui/material/IconButton';
+import Typography from '@mui/material/Typography';
+import ArrowBackIcon from '@mui/icons-material/ArrowBack';
+import { useNavigate } from 'react-router-dom';
+import { ScheduledTasksPanel } from '../ScheduledTasksPanel';
+
+interface PluginSchedulePageProps {
+  pluginName: string;
+}
+
+export function PluginSchedulePage({ pluginName }: PluginSchedulePageProps) {
+  const navigate = useNavigate();
+
+  return (
+    <Box>
+      <Box sx={{ display: 'flex', alignItems: 'center', gap: 1, mb: 3 }}>
+        <IconButton onClick={() => navigate('..')} aria-label="Back to list">
+          <ArrowBackIcon />
+        </IconButton>
+        <Typography variant="h4">Schedules</Typography>
+      </Box>
+
+      <ScheduledTasksPanel pluginName={pluginName} />
+    </Box>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginTaskEditPage.test.tsx b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginTaskEditPage.test.tsx
new file mode 100644
index 00000000000..7685cf50788
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginTaskEditPage.test.tsx
@@ -0,0 +1,443 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { MemoryRouter, Route, Routes } from 'react-router-dom';
+import { SnackbarProvider } from 'notistack';
+import type { PluginSchema } from '@sep/api';
+import {
+  PluginTaskEditPage,
+  normalizeChoiceDefaults,
+} from './PluginTaskEditPage';
+import type { RenderFormSlot } from './types';
+
+const mockUpdateTaskMutate = vi.fn();
+const mockUsePluginTask = vi.fn();
+
+vi.mock('@sep/api', () => ({
+  useUpdatePluginTask: () => ({
+    mutate: mockUpdateTaskMutate,
+    isPending: false,
+    isError: false,
+    error: null,
+  }),
+  usePluginTask: (...args: unknown[]) => mockUsePluginTask(...args),
+  useAlertConfig: () => ({
+    data: { available: true },
+    isLoading: false,
+    isError: false,
+  }),
+}));
+
+const schema: PluginSchema = {
+  pluginName: 'checksums',
+  display_name: 'Checksum',
+  description: 'Test',
+  capabilities: {},
+  list_view: { columns: [{ key: 'name', label: 'Name' }] },
+  forms: [
+    {
+      title: 'Main',
+      fields: [
+        { type: 'string', name: 'task_name', label: 'Task Name' },
+        { type: 'string', name: 'title', label: 'Title' },
+        { type: 'integer', name: 'count', label: 'Count' },
+      ],
+    },
+  ],
+} as unknown as PluginSchema;
+
+const STORED_TASK = {
+  id: 1,
+  name: 'check1',
+  status: 'completed',
+  data: { _form: { task_name: 'check1', title: 'hello', count: 7 } },
+};
+
+function renderAt(
+  extra?: { renderEditForm?: RenderFormSlot },
+  path = '/apps/checksums/task/check1/edit'
+) {
+  return render(
+    <SnackbarProvider>
+      <MemoryRouter initialEntries={[path]}>
+        <Routes>
+          <Route
+            path="/apps/:plugin/task/:id/edit"
+            element={
+              <PluginTaskEditPage
+                schema={schema}
+                pluginName="checksums"
+                {...extra}
+              />
+            }
+          />
+          <Route
+            path="/apps/:plugin/task/:id"
+            element={<div>detail page</div>}
+          />
+        </Routes>
+      </MemoryRouter>
+    </SnackbarProvider>
+  );
+}
+
+beforeEach(() => {
+  mockUpdateTaskMutate.mockReset();
+  mockUsePluginTask.mockReset();
+});
+
+describe('PluginTaskEditPage', () => {
+  it('prefills the editable fields from the stored create-form body', () => {
+    mockUsePluginTask.mockReturnValue({ data: STORED_TASK, isLoading: false });
+
+    renderAt();
+
+    expect(screen.getByText('Edit Checksum: check1')).toBeInTheDocument();
+    expect(screen.getByLabelText('Title')).toHaveValue('hello');
+  });
+
+  it('renders the task name read-only (no editable task_name input)', () => {
+    mockUsePluginTask.mockReturnValue({ data: STORED_TASK, isLoading: false });
+
+    renderAt();
+
+    // The immutable identity is shown in the header, never as an editable field.
+    expect(screen.queryByLabelText('Task Name')).toBeNull();
+    expect(screen.getByText('Edit Checksum: check1')).toBeInTheDocument();
+  });
+
+  it('submits coerced values and pins task_name to the route id', async () => {
+    mockUsePluginTask.mockReturnValue({ data: STORED_TASK, isLoading: false });
+    // A slot bypassing SchemaFormRenderer submits raw string values and omits
+    // task_name; the page coerces `count` and re-asserts the original name.
+    const renderEditForm: RenderFormSlot = ({ onSubmit, loading }) => (
+      <button
+        type="button"
+        disabled={loading}
+        onClick={() => onSubmit({ title: 'changed', count: '9' })}
+      >
+        Submit slot
+      </button>
+    );
+
+    renderAt({ renderEditForm });
+    await userEvent.click(screen.getByRole('button', { name: 'Submit slot' }));
+
+    await waitFor(() => expect(mockUpdateTaskMutate).toHaveBeenCalledTimes(1));
+    expect(mockUpdateTaskMutate).toHaveBeenCalledWith(
+      {
+        taskId: 'check1',
+        values: { title: 'changed', count: 9, task_name: 'check1' },
+      },
+      expect.objectContaining({
+        onSuccess: expect.any(Function),
+        onError: expect.any(Function),
+      })
+    );
+  });
+
+  it('keeps task_name pinned even when the submitted body carries a different name', async () => {
+    mockUsePluginTask.mockReturnValue({ data: STORED_TASK, isLoading: false });
+    const renderEditForm: RenderFormSlot = ({ onSubmit }) => (
+      <button
+        type="button"
+        onClick={() => onSubmit({ task_name: 'renamed', title: 'x' })}
+      >
+        Submit slot
+      </button>
+    );
+
+    renderAt({ renderEditForm });
+    await userEvent.click(screen.getByRole('button', { name: 'Submit slot' }));
+
+    await waitFor(() => expect(mockUpdateTaskMutate).toHaveBeenCalledTimes(1));
+    const [{ values }] = mockUpdateTaskMutate.mock.calls[0];
+    expect(values.task_name).toBe('check1');
+  });
+
+  it('navigates back to the task detail on a successful update', async () => {
+    mockUsePluginTask.mockReturnValue({ data: STORED_TASK, isLoading: false });
+    mockUpdateTaskMutate.mockImplementation((_vars, opts) =>
+      opts.onSuccess?.()
+    );
+    const renderEditForm: RenderFormSlot = ({ onSubmit }) => (
+      <button type="button" onClick={() => onSubmit({ title: 'x' })}>
+        Submit slot
+      </button>
+    );
+
+    renderAt({ renderEditForm });
+    await userEvent.click(screen.getByRole('button', { name: 'Submit slot' }));
+
+    await waitFor(() =>
+      expect(screen.getByText('detail page')).toBeInTheDocument()
+    );
+  });
+
+  it('redirects to detail without crashing when the task has no stored form', () => {
+    mockUsePluginTask.mockReturnValue({
+      data: { id: 1, name: 'check1', status: 'completed', data: { meta: {} } },
+      isLoading: false,
+    });
+
+    renderAt();
+
+    expect(screen.getByText('detail page')).toBeInTheDocument();
+    expect(screen.queryByText('Edit Checksum: check1')).toBeNull();
+  });
+
+  it('threads capabilities so a stored alert_on_fail survives an edit', async () => {
+    // `alert_on_fail` is excluded from the schema sections and only rendered
+    // (and seeded) when the capability is passed through. Without it the field
+    // is dropped from the submission and the backend resets it to its default.
+    const alertSchema = {
+      ...schema,
+      capabilities: { alert_on_fail: true },
+    } as unknown as PluginSchema;
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'check1',
+        status: 'completed',
+        data: {
+          _form: {
+            task_name: 'check1',
+            title: 'hello',
+            count: 7,
+            alert_on_fail: true,
+          },
+        },
+      },
+      isLoading: false,
+    });
+
+    render(
+      <SnackbarProvider>
+        <MemoryRouter initialEntries={['/apps/checksums/task/check1/edit']}>
+          <Routes>
+            <Route
+              path="/apps/:plugin/task/:id/edit"
+              element={
+                <PluginTaskEditPage
+                  schema={alertSchema}
+                  pluginName="checksums"
+                />
+              }
+            />
+            <Route
+              path="/apps/:plugin/task/:id"
+              element={<div>detail page</div>}
+            />
+          </Routes>
+        </MemoryRouter>
+      </SnackbarProvider>
+    );
+
+    await userEvent.click(screen.getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(mockUpdateTaskMutate).toHaveBeenCalledTimes(1));
+    const [{ values }] = mockUpdateTaskMutate.mock.calls[0];
+    expect(values.alert_on_fail).toBe(true);
+  });
+
+  it('normalizes lowercase multi_choice stored values to match uppercase schema choices', async () => {
+    // Reproduces the mysql_backups 422: model_dump(mode="json") on a StrEnum
+    // with auto() stores lowercase values ("rsync") while schema choices use the
+    // member name ("RSYNC"). The mismatch left the multi-select empty on load,
+    // causing the form to submit upload:[] and the backend to return 422.
+    const uploadSchema: PluginSchema = {
+      pluginName: 'mysql_backups',
+      display_name: 'MySQL Backup',
+      description: 'Test',
+      capabilities: {},
+      list_view: { columns: [{ key: 'name', label: 'Name' }] },
+      forms: [
+        {
+          title: 'Main',
+          fields: [
+            { type: 'string', name: 'task_name', label: 'Task Name' },
+            {
+              type: 'multi_choice',
+              name: 'upload',
+              label: 'Upload',
+              required: true,
+              min_items: 1,
+              choices: [
+                { value: 'RSYNC', label: 'Rsync' },
+                { value: 'S3', label: 'S3' },
+              ],
+            },
+          ],
+        },
+      ],
+    } as unknown as PluginSchema;
+
+    mockUsePluginTask.mockReturnValue({
+      data: {
+        id: 1,
+        name: 'backup1',
+        status: 'completed',
+        // Stored with lowercase "rsync" (Python StrEnum auto() output).
+        data: { _form: { task_name: 'backup1', upload: ['rsync'] } },
+      },
+      isLoading: false,
+    });
+    mockUpdateTaskMutate.mockImplementation((_vars, opts) =>
+      opts.onSuccess?.()
+    );
+
+    render(
+      <SnackbarProvider>
+        <MemoryRouter
+          initialEntries={['/apps/mysql_backups/task/backup1/edit']}
+        >
+          <Routes>
+            <Route
+              path="/apps/:plugin/task/:id/edit"
+              element={
+                <PluginTaskEditPage
+                  schema={uploadSchema}
+                  pluginName="mysql_backups"
+                />
+              }
+            />
+            <Route
+              path="/apps/:plugin/task/:id"
+              element={<div>detail page</div>}
+            />
+          </Routes>
+        </MemoryRouter>
+      </SnackbarProvider>
+    );
+
+    await userEvent.click(screen.getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => expect(mockUpdateTaskMutate).toHaveBeenCalledTimes(1));
+    const [{ values }] = mockUpdateTaskMutate.mock.calls[0];
+    // After normalization, the submitted value must use the canonical "RSYNC",
+    // not the stored "rsync", so the backend accepts the request.
+    expect(values.upload).toEqual(['RSYNC']);
+  });
+});
+
+describe('normalizeChoiceDefaults', () => {
+  const sections = [
+    {
+      title: 'Main',
+      fields: [
+        {
+          type: 'multi_choice' as const,
+          name: 'upload',
+          label: 'Upload',
+          required: true,
+          choices: [
+            { value: 'RSYNC', label: 'Rsync' },
+            { value: 'S3', label: 'S3' },
+          ],
+        },
+        {
+          type: 'choice' as const,
+          name: 'mode',
+          label: 'Mode',
+          required: false,
+          choices: [
+            { value: 'FULL', label: 'Full' },
+            { value: 'INCREMENTAL', label: 'Incremental' },
+          ],
+        },
+        {
+          type: 'string' as const,
+          name: 'title',
+          label: 'Title',
+          required: false,
+        },
+      ],
+    },
+  ];
+
+  it('upcases lowercase multi_choice values to canonical schema values', () => {
+    const result = normalizeChoiceDefaults(
+      { upload: ['rsync', 's3'] },
+      sections
+    );
+    expect(result.upload).toEqual(['RSYNC', 'S3']);
+  });
+
+  it('normalizes a single choice field value', () => {
+    const result = normalizeChoiceDefaults({ mode: 'full' }, sections);
+    expect(result.mode).toBe('FULL');
+  });
+
+  it('leaves non-choice fields untouched', () => {
+    const result = normalizeChoiceDefaults({ title: 'hello' }, sections);
+    expect(result.title).toBe('hello');
+  });
+
+  it('preserves unrecognised values so validation can surface them', () => {
+    const result = normalizeChoiceDefaults({ upload: ['unknown'] }, sections);
+    expect(result.upload).toEqual(['unknown']);
+  });
+
+  it('handles already-canonical values without modification', () => {
+    const result = normalizeChoiceDefaults({ upload: ['RSYNC'] }, sections);
+    expect(result.upload).toEqual(['RSYNC']);
+  });
+
+  it('normalizes a one-of branch field stored at its dotted path', () => {
+    const oneOfSections = [
+      {
+        title: 'Source',
+        fields: [
+          {
+            type: 'one_of' as const,
+            name: 'source',
+            label: 'Source',
+            discriminator: 'source.mode',
+            branches: [
+              {
+                value: 'rsync',
+                label: 'Rsync',
+                fields: [
+                  {
+                    type: 'choice' as const,
+                    name: 'source.transport',
+                    label: 'Transport',
+                    required: false,
+                    choices: [
+                      { value: 'SSH', label: 'SSH' },
+                      { value: 'DAEMON', label: 'Daemon' },
+                    ],
+                  },
+                ],
+              },
+            ],
+          },
+        ],
+      },
+    ];
+    const form = { source: { mode: 'rsync', transport: 'ssh' } };
+
+    const result = normalizeChoiceDefaults(form, oneOfSections);
+
+    expect(result.source).toEqual({ mode: 'rsync', transport: 'SSH' });
+    // The input is not mutated: `setAtPath` clones the intermediates it walks.
+    expect(form.source.transport).toBe('ssh');
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginTaskEditPage.tsx b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginTaskEditPage.tsx
new file mode 100644
index 00000000000..38f26fc54ae
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/PluginTaskEditPage.tsx
@@ -0,0 +1,253 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useMemo, useState } from 'react';
+import { Navigate, useNavigate, useParams } from 'react-router-dom';
+import Box from '@mui/material/Box';
+import IconButton from '@mui/material/IconButton';
+import Skeleton from '@mui/material/Skeleton';
+import Typography from '@mui/material/Typography';
+import ArrowBackIcon from '@mui/icons-material/ArrowBack';
+import { useSnackbar } from 'notistack';
+import {
+  usePluginTask,
+  useUpdatePluginTask,
+  type PluginSchema,
+} from '@sep/api';
+import {
+  SchemaFormRenderer,
+  coerceFormValues,
+  flattenSectionFields,
+  getAtPath,
+  setAtPath,
+} from '../SchemaFormRenderer';
+import type {
+  FormSection,
+  RenderFieldOverride,
+} from '../SchemaFormRenderer/types';
+import type { RenderFormSlot } from './types';
+import { getStoredForm } from './storedForm';
+import {
+  EMPTY_SUBMIT_ERROR,
+  mapSubmitError,
+  type SubmitErrorState,
+} from './submitErrorMapping';
+
+/**
+ * Normalize choice and multi-choice default values so that case differences
+ * between stored enum values (e.g. ``"rsync"`` from Python's StrEnum auto())
+ * and schema choice values (e.g. ``"RSYNC"``) do not produce empty selections.
+ *
+ * For each ``choice`` / ``multi_choice`` field in ``sections``, look up the
+ * stored value(s) case-insensitively against the field's canonical choice
+ * values and replace them with the canonical form. Unrecognised values are
+ * left as-is so the form's own validation surfaces them rather than silently
+ * discarding them.
+ */
+export function normalizeChoiceDefaults(
+  form: Record<string, unknown>,
+  sections: FormSection[]
+): Record<string, unknown> {
+  const out = { ...form };
+  for (const field of flattenSectionFields(sections)) {
+    if (field.type !== 'choice' && field.type !== 'multi_choice') {
+      continue;
+    }
+    const choiceMap = new Map(
+      field.choices.map((c) => [c.value.toLowerCase(), c.value])
+    );
+    // Path-aware: `flattenSectionFields` also returns one-of branch fields,
+    // whose names are dotted paths (`source.mode`) stored nested in the form.
+    // `setAtPath` shallow-clones the intermediates it walks, so the shallow
+    // copy above is enough to leave `form` untouched.
+    const raw = getAtPath(out, field.name);
+    if (field.type === 'multi_choice' && Array.isArray(raw)) {
+      setAtPath(
+        out,
+        field.name,
+        raw.map((v) => {
+          const canonical =
+            typeof v === 'string' ? choiceMap.get(v.toLowerCase()) : undefined;
+          return canonical ?? v;
+        })
+      );
+    } else if (field.type === 'choice' && typeof raw === 'string') {
+      const canonical = choiceMap.get(raw.toLowerCase());
+      if (canonical !== undefined) {
+        setAtPath(out, field.name, canonical);
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * The create-form field that names the task. It is load-bearing identity — the
+ * ``PUT /{task_name}`` route key and the join key for schedules / periodic
+ * tasks — so generic edit renders it read-only and never submits a different
+ * value; renaming is a separate concern.
+ */
+const TASK_NAME_FIELD = 'task_name';
+
+/**
+ * Generic in-place edit page for a schema-driven task, prefilled from the task's
+ * stored create-form body (``data['_form']``) and submitting the already-derived
+ * ``PUT``. Serves every ``TaskExecutionApp`` with no per-app code; ``task_name``
+ * is immutable here (see {@link TASK_NAME_FIELD}).
+ */
+export function PluginTaskEditPage({
+  schema,
+  pluginName,
+  mockTasks,
+  renderField,
+  renderEditForm,
+}: {
+  schema: PluginSchema;
+  pluginName: string;
+  mockTasks?: Record<string, unknown>[];
+  renderField?: RenderFieldOverride;
+  renderEditForm?: RenderFormSlot;
+}) {
+  const navigate = useNavigate();
+  const { id } = useParams<{ id: string }>();
+  const { enqueueSnackbar } = useSnackbar();
+  const updateTask = useUpdatePluginTask(pluginName, mockTasks);
+  const { data: task, isLoading } = usePluginTask(pluginName, id, mockTasks);
+
+  const storedForm = getStoredForm(task);
+
+  const editableSections = useMemo(
+    () =>
+      (schema.forms ?? [])
+        .map((section) => ({
+          ...section,
+          fields: section.fields.filter(
+            (field) => field.name !== TASK_NAME_FIELD
+          ),
+        }))
+        .filter((section) => section.fields.length > 0),
+    [schema.forms]
+  );
+
+  const normalizedDefaults = useMemo(
+    () =>
+      storedForm
+        ? normalizeChoiceDefaults(storedForm, editableSections)
+        : storedForm,
+    [storedForm, editableSections]
+  );
+
+  const [{ submitError, fieldErrors }, setSubmitErrorState] =
+    useState<SubmitErrorState>(EMPTY_SUBMIT_ERROR);
+
+  const handleSubmit = (data: Record<string, unknown>) => {
+    if (!id) {
+      return;
+    }
+    // Clear any prior failure so the banner / inline errors reset before the
+    // new attempt resolves.
+    setSubmitErrorState(EMPTY_SUBMIT_ERROR);
+    updateTask.mutate(
+      {
+        taskId: id,
+        // Coerce at the submit boundary so whole-form slots that bypass
+        // SchemaFormRenderer's internal coercion still send a backend-ready
+        // payload, then pin ``task_name`` to the route id so it cannot change.
+        values: {
+          ...coerceFormValues(data, flattenSectionFields(editableSections)),
+          [TASK_NAME_FIELD]: id,
+        },
+      },
+      {
+        onSuccess: () => {
+          enqueueSnackbar(`${schema.display_name} task updated`, {
+            variant: 'success',
+          });
+          navigate('..', { relative: 'path' });
+        },
+        onError: (error: unknown) => {
+          const message =
+            error instanceof Error ? error.message : 'Failed to update';
+          // Transient toast is unchanged; 422s additionally map to a persistent
+          // banner plus inline per-field errors.
+          enqueueSnackbar(message, { variant: 'error' });
+          setSubmitErrorState(mapSubmitError(error, editableSections, message));
+        },
+      }
+    );
+  };
+
+  if (isLoading) {
+    return (
+      <Box>
+        <Skeleton variant="text" width={300} height={40} />
+        <Skeleton variant="rectangular" height={200} sx={{ mt: 2 }} />
+      </Box>
+    );
+  }
+
+  if (!task) {
+    return (
+      <Box sx={{ py: 2 }}>
+        <Typography variant="h5">Not found</Typography>
+      </Box>
+    );
+  }
+
+  // A task with no stored form input cannot be edited generically; the Edit
+  // entry point is only linked when the form is present, so this is defensive
+  // against direct navigation.
+  if (!storedForm) {
+    return <Navigate to=".." relative="path" replace />;
+  }
+
+  return (
+    <Box>
+      <Box sx={{ display: 'flex', alignItems: 'center', gap: 1, mb: 3 }}>
+        <IconButton onClick={() => navigate('..', { relative: 'path' })}>
+          <ArrowBackIcon />
+        </IconButton>
+        <Typography variant="h4">
+          Edit {schema.display_name}: {id}
+        </Typography>
+      </Box>
+
+      {renderEditForm?.({
+        sections: editableSections,
+        onSubmit: handleSubmit,
+        loading: updateTask.isPending,
+        defaultValues: normalizedDefaults,
+        capabilities: schema.capabilities,
+        renderField,
+        submitError,
+        fieldErrors,
+      }) ?? (
+        <SchemaFormRenderer
+          sections={editableSections}
+          onSubmit={handleSubmit}
+          loading={updateTask.isPending}
+          submitLabel="Save"
+          submitError={submitError}
+          fieldErrors={fieldErrors}
+          defaultValues={normalizedDefaults}
+          capabilities={schema.capabilities}
+          renderField={renderField}
+        />
+      )}
+    </Box>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/RelatedAppTabBar.test.tsx b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/RelatedAppTabBar.test.tsx
new file mode 100644
index 00000000000..92e96a8ff28
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/RelatedAppTabBar.test.tsx
@@ -0,0 +1,132 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { render, screen } from '@testing-library/react';
+import { describe, expect, it } from 'vitest';
+import { MemoryRouter } from 'react-router-dom';
+import type { RelatedApp } from '@sep/api';
+import {
+  RelatedAppTabBar,
+  resolveRelatedAppActiveSegment,
+} from './RelatedAppTabBar';
+
+const ROUTE_BASE = '/apps/mysql_backups';
+
+const RELATED_APPS: RelatedApp[] = [
+  {
+    app_key: 'mysql_backups/restore',
+    label: 'Restore',
+    route_segment: 'restores',
+  },
+];
+
+function renderTabBar(pathname: string, activeSegment?: string) {
+  const segment =
+    activeSegment ??
+    resolveRelatedAppActiveSegment(pathname, ROUTE_BASE, RELATED_APPS);
+
+  return render(
+    <MemoryRouter initialEntries={[pathname]}>
+      <RelatedAppTabBar
+        parentLabel="MySQL Backups"
+        routeBase={ROUTE_BASE}
+        relatedApps={RELATED_APPS}
+        activeSegment={segment}
+      />
+    </MemoryRouter>
+  );
+}
+
+describe('resolveRelatedAppActiveSegment', () => {
+  it('returns empty string on the parent list route', () => {
+    expect(
+      resolveRelatedAppActiveSegment(
+        '/apps/mysql_backups',
+        ROUTE_BASE,
+        RELATED_APPS
+      )
+    ).toBe('');
+  });
+
+  it('returns empty string on a parent task detail route', () => {
+    expect(
+      resolveRelatedAppActiveSegment(
+        '/apps/mysql_backups/task/backup-1/logs',
+        ROUTE_BASE,
+        RELATED_APPS
+      )
+    ).toBe('');
+  });
+
+  it('returns the related segment on the related list route', () => {
+    expect(
+      resolveRelatedAppActiveSegment(
+        '/apps/mysql_backups/restores',
+        ROUTE_BASE,
+        RELATED_APPS
+      )
+    ).toBe('restores');
+  });
+
+  it('returns the related segment on a nested related detail route', () => {
+    expect(
+      resolveRelatedAppActiveSegment(
+        '/apps/mysql_backups/restores/task/restore-1',
+        ROUTE_BASE,
+        RELATED_APPS
+      )
+    ).toBe('restores');
+  });
+});
+
+describe('RelatedAppTabBar', () => {
+  it('renders parent and related tab labels with navigation targets', () => {
+    renderTabBar('/apps/mysql_backups');
+
+    const backupsTab = screen.getByRole('tab', { name: 'MySQL Backups' });
+    const restoreTab = screen.getByRole('tab', { name: 'Restore' });
+
+    expect(backupsTab).toHaveAttribute('href', '/apps/mysql_backups');
+    expect(restoreTab).toHaveAttribute('href', '/apps/mysql_backups/restores');
+  });
+
+  it('selects the parent tab on parent routes', () => {
+    renderTabBar('/apps/mysql_backups/task/backup-1');
+
+    expect(screen.getByRole('tab', { name: 'MySQL Backups' })).toHaveAttribute(
+      'aria-selected',
+      'true'
+    );
+    expect(screen.getByRole('tab', { name: 'Restore' })).toHaveAttribute(
+      'aria-selected',
+      'false'
+    );
+  });
+
+  it('selects the related tab on related routes', () => {
+    renderTabBar('/apps/mysql_backups/restores/new');
+
+    expect(screen.getByRole('tab', { name: 'MySQL Backups' })).toHaveAttribute(
+      'aria-selected',
+      'false'
+    );
+    expect(screen.getByRole('tab', { name: 'Restore' })).toHaveAttribute(
+      'aria-selected',
+      'true'
+    );
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/RelatedAppTabBar.tsx b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/RelatedAppTabBar.tsx
new file mode 100644
index 00000000000..0804634028b
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/RelatedAppTabBar.tsx
@@ -0,0 +1,91 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import Tab from '@mui/material/Tab';
+import Tabs from '@mui/material/Tabs';
+import type { RelatedApp } from '@sep/api';
+import { Link } from 'react-router-dom';
+
+export interface RelatedAppTabBarProps {
+  /** Human-readable label for the parent app's default surface. */
+  parentLabel: string;
+  /** Absolute route prefix for the parent plugin (for example `/apps/mysql_backups`). */
+  routeBase: string;
+  relatedApps: RelatedApp[];
+  /**
+   * Active related-app segment, or `''` when the parent surface is selected.
+   * Derived from the current location via `resolveRelatedAppActiveSegment`.
+   */
+  activeSegment: string;
+}
+
+/**
+ * Return which related-app `route_segment` is active for `pathname`.
+ *
+ * The parent surface is represented by `''` when the path is under
+ * `routeBase` but not under any `{routeBase}/{route_segment}` prefix.
+ */
+export function resolveRelatedAppActiveSegment(
+  pathname: string,
+  routeBase: string,
+  relatedApps: RelatedApp[]
+): string {
+  const normalizedBase = routeBase.replace(/\/+$/, '');
+  for (const related of relatedApps) {
+    const prefix = `${normalizedBase}/${related.route_segment}`;
+    if (pathname === prefix || pathname.startsWith(`${prefix}/`)) {
+      return related.route_segment;
+    }
+  }
+  return '';
+}
+
+/** Sibling-app tab bar for schema-driven plugins that declare `related_apps`. */
+export function RelatedAppTabBar({
+  parentLabel,
+  routeBase,
+  relatedApps,
+  activeSegment,
+}: RelatedAppTabBarProps) {
+  const normalizedBase = routeBase.replace(/\/+$/, '');
+
+  return (
+    <Tabs
+      value={activeSegment}
+      aria-label={`${parentLabel} and related apps`}
+      sx={{ mb: 3, borderBottom: 1, borderColor: 'divider' }}
+    >
+      <Tab
+        label={parentLabel}
+        value=""
+        component={Link}
+        to={normalizedBase}
+        replace
+      />
+      {relatedApps.map((related) => (
+        <Tab
+          key={related.app_key}
+          label={related.label}
+          value={related.route_segment}
+          component={Link}
+          to={`${normalizedBase}/${related.route_segment}`}
+          replace
+        />
+      ))}
+    </Tabs>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/SchemaDrivenPlugin.test.tsx b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/SchemaDrivenPlugin.test.tsx
new file mode 100644
index 00000000000..f85b6909ed9
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/SchemaDrivenPlugin.test.tsx
@@ -0,0 +1,276 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { MemoryRouter, Route, Routes } from 'react-router-dom';
+import { SnackbarProvider } from 'notistack';
+import type { PluginSchema } from '@sep/api';
+import { SchemaDrivenPlugin } from './SchemaDrivenPlugin';
+import type { RenderFormSlot } from './types';
+
+const mockUpdateMutate = vi.fn();
+
+const schema: PluginSchema = {
+  pluginName: 'inventory',
+  display_name: 'Inventory',
+  entities: [
+    {
+      name: 'nodes',
+      display_name: 'Nodes',
+      forms: [
+        {
+          title: 'Main',
+          fields: [{ type: 'string', name: 'label', label: 'Label' }],
+        },
+      ],
+      list_view: { columns: [{ key: 'label', label: 'Label' }] },
+    },
+  ],
+} as unknown as PluginSchema;
+
+// Single-entity (task-style) schema for the task/:id/edit branch.
+const taskSchema: PluginSchema = {
+  pluginName: 'checksums',
+  display_name: 'Checksum',
+  forms: [
+    {
+      title: 'Main',
+      fields: [
+        { type: 'string', name: 'task_name', label: 'Task Name' },
+        { type: 'string', name: 'title', label: 'Title' },
+      ],
+    },
+  ],
+  list_view: { columns: [{ key: 'name', label: 'Name' }] },
+} as unknown as PluginSchema;
+
+const backupsSchema: PluginSchema = {
+  name: 'mysql_backups',
+  display_name: 'MySQL Backups',
+  forms: [
+    {
+      title: 'Main',
+      fields: [{ type: 'string', name: 'name', label: 'Name' }],
+    },
+  ],
+  list_view: { columns: [{ key: 'name', label: 'Name' }] },
+  related_apps: [
+    {
+      app_key: 'mysql_backups/restore',
+      label: 'Restore',
+      route_segment: 'restores',
+    },
+  ],
+} as unknown as PluginSchema;
+
+const restoreSchema: PluginSchema = {
+  name: 'mysql_backups_restore',
+  display_name: 'Restore',
+  forms: [
+    {
+      title: 'Main',
+      fields: [{ type: 'string', name: 'name', label: 'Name' }],
+    },
+  ],
+  list_view: { columns: [{ key: 'name', label: 'Name' }] },
+} as unknown as PluginSchema;
+
+const taskRecord = {
+  id: 1,
+  name: 'check1',
+  data: { _form: { task_name: 'check1', title: 'hello' } },
+};
+
+// Schema the mocked usePluginSchema serves; per-test override, reset after each.
+let activeSchema: PluginSchema = schema;
+
+// Stub sibling page modules so their @sep/api imports stay out of the graph;
+// this test exercises only the SchemaDrivenPlugin → edit-page threading.
+vi.mock('./PluginListPage', () => ({
+  PluginListPage: ({ pluginName }: { pluginName: string }) => (
+    <div>list:{pluginName}</div>
+  ),
+}));
+vi.mock('./PluginDetailPage', () => ({
+  PluginDetailPage: () => <div>detail</div>,
+  pathToEntityList: () => '',
+}));
+vi.mock('./PluginSchedulePage', () => ({
+  PluginSchedulePage: () => <div>schedule</div>,
+}));
+
+vi.mock('@sep/api', () => ({
+  usePluginSchema: (pluginName: string) => {
+    if (pluginName === 'mysql_backups/restore') {
+      return { data: restoreSchema, isLoading: false, error: null };
+    }
+    return { data: activeSchema, isLoading: false, error: null };
+  },
+  usePluginEntityDetail: () => ({
+    data: { id: 5, label: 'n1' },
+    isLoading: false,
+  }),
+  useUpdatePluginEntity: () => ({ mutate: mockUpdateMutate, isPending: false }),
+  useCreatePluginEntity: () => ({ mutate: vi.fn(), isPending: false }),
+  useCreatePluginTask: () => ({ mutate: vi.fn(), isPending: false }),
+  usePluginTask: () => ({ data: taskRecord, isLoading: false }),
+  useUpdatePluginTask: () => ({
+    mutate: vi.fn(),
+    isPending: false,
+    isError: false,
+    error: null,
+  }),
+}));
+
+afterEach(() => {
+  activeSchema = schema;
+});
+
+function renderEdit(renderEditForm?: RenderFormSlot) {
+  return render(
+    <SnackbarProvider>
+      <MemoryRouter initialEntries={['/nodes/5/edit']}>
+        <SchemaDrivenPlugin
+          pluginName="inventory"
+          renderEditForm={renderEditForm}
+        />
+      </MemoryRouter>
+    </SnackbarProvider>
+  );
+}
+
+describe('SchemaDrivenPlugin — renderEditForm slot', () => {
+  it('renders the default form body when no slot is supplied', () => {
+    renderEdit();
+    expect(screen.getByText('Edit Nodes #5')).toBeInTheDocument();
+    expect(screen.getByLabelText('Label')).toBeInTheDocument();
+    expect(screen.queryByTestId('custom-edit-form')).toBeNull();
+  });
+
+  it('replaces only the form body with the slot, keeping chrome and mutation wiring', async () => {
+    const user = userEvent.setup();
+    const renderEditForm: RenderFormSlot = ({ onSubmit, defaultValues }) => (
+      <button
+        type="button"
+        onClick={() => onSubmit({ ...defaultValues, label: 'edited' })}
+      >
+        Save slot
+      </button>
+    );
+    renderEdit(renderEditForm);
+
+    // Chrome preserved; default form body replaced by the slot.
+    expect(screen.getByText('Edit Nodes #5')).toBeInTheDocument();
+    expect(screen.queryByLabelText('Label')).toBeNull();
+
+    await user.click(screen.getByRole('button', { name: 'Save slot' }));
+    await waitFor(() => expect(mockUpdateMutate).toHaveBeenCalledTimes(1));
+    expect(mockUpdateMutate).toHaveBeenCalledWith(
+      { id: '5', values: expect.objectContaining({ label: 'edited' }) },
+      expect.objectContaining({
+        onSuccess: expect.any(Function),
+        onError: expect.any(Function),
+      })
+    );
+  });
+});
+
+describe('SchemaDrivenPlugin — single-entity task edit route', () => {
+  it('renders PluginTaskEditPage at task/:id/edit, prefilled from the stored form', () => {
+    activeSchema = taskSchema;
+    render(
+      <SnackbarProvider>
+        <MemoryRouter initialEntries={['/task/check1/edit']}>
+          <SchemaDrivenPlugin pluginName="checksums" />
+        </MemoryRouter>
+      </SnackbarProvider>
+    );
+
+    expect(screen.getByText('Edit Checksum: check1')).toBeInTheDocument();
+    expect(screen.getByLabelText('Title')).toHaveValue('hello');
+    // task_name stays immutable: no editable name input is rendered.
+    expect(screen.queryByLabelText('Task Name')).toBeNull();
+  });
+});
+
+describe('SchemaDrivenPlugin — related_apps routing', () => {
+  function renderBackupsPlugin(pathname: string) {
+    return render(
+      <SnackbarProvider>
+        <MemoryRouter initialEntries={[pathname]}>
+          <Routes>
+            <Route
+              path="/apps/mysql_backups/*"
+              element={
+                <SchemaDrivenPlugin
+                  pluginName="mysql_backups"
+                  routeBase="/apps/mysql_backups"
+                />
+              }
+            />
+          </Routes>
+        </MemoryRouter>
+      </SnackbarProvider>
+    );
+  }
+
+  it('does not render the related-app tab bar when related_apps is absent', () => {
+    activeSchema = taskSchema;
+    render(
+      <SnackbarProvider>
+        <MemoryRouter initialEntries={['/']}>
+          <SchemaDrivenPlugin
+            pluginName="checksums"
+            routeBase="/apps/checksums"
+          />
+        </MemoryRouter>
+      </SnackbarProvider>
+    );
+
+    expect(screen.getByText('list:checksums')).toBeInTheDocument();
+    expect(screen.queryByRole('tablist')).toBeNull();
+  });
+
+  it('renders the tab bar and parent list on the parent route', () => {
+    activeSchema = backupsSchema;
+    renderBackupsPlugin('/apps/mysql_backups');
+
+    expect(screen.getByRole('tab', { name: 'MySQL Backups' })).toHaveAttribute(
+      'aria-selected',
+      'true'
+    );
+    expect(screen.getByRole('tab', { name: 'Restore' })).toHaveAttribute(
+      'aria-selected',
+      'false'
+    );
+    expect(screen.getByText('list:mysql_backups')).toBeInTheDocument();
+  });
+
+  it('mounts a nested SchemaDrivenPlugin for a related route segment', () => {
+    activeSchema = backupsSchema;
+    renderBackupsPlugin('/apps/mysql_backups/restores');
+
+    expect(screen.getByRole('tab', { name: 'Restore' })).toHaveAttribute(
+      'aria-selected',
+      'true'
+    );
+    expect(screen.getByText('list:mysql_backups/restore')).toBeInTheDocument();
+    expect(screen.queryByText('list:mysql_backups')).toBeNull();
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/SchemaDrivenPlugin.tsx b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/SchemaDrivenPlugin.tsx
new file mode 100644
index 00000000000..06778730eff
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/SchemaDrivenPlugin.tsx
@@ -0,0 +1,525 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useMemo, useState, type ReactNode } from 'react';
+import {
+  Routes,
+  Route,
+  Navigate,
+  useLocation,
+  useNavigate,
+  useParams,
+} from 'react-router-dom';
+import Box from '@mui/material/Box';
+import CircularProgress from '@mui/material/CircularProgress';
+import Typography from '@mui/material/Typography';
+import IconButton from '@mui/material/IconButton';
+import Skeleton from '@mui/material/Skeleton';
+import ArrowBackIcon from '@mui/icons-material/ArrowBack';
+import { useSnackbar } from 'notistack';
+import {
+  usePluginSchema,
+  usePluginEntityDetail,
+  useUpdatePluginEntity,
+  type PluginEntitySchema,
+  type PluginSchema,
+} from '@sep/api';
+import {
+  SchemaFormRenderer,
+  coerceFormValues,
+  flattenSectionFields,
+} from '../SchemaFormRenderer';
+import type { RenderFieldOverride } from '../SchemaFormRenderer/types';
+import {
+  EMPTY_SUBMIT_ERROR,
+  mapSubmitError,
+  type SubmitErrorState,
+} from './submitErrorMapping';
+import { PluginListPage } from './PluginListPage';
+import { PluginCreatePage } from './PluginCreatePage';
+import { PluginTaskEditPage } from './PluginTaskEditPage';
+import { PluginDetailPage, type TaskExecuteAction } from './PluginDetailPage';
+import { PluginSchedulePage } from './PluginSchedulePage';
+import {
+  RelatedAppTabBar,
+  resolveRelatedAppActiveSegment,
+} from './RelatedAppTabBar';
+import { resolvePluginRouteBase } from './routeBase';
+import type { RenderFormSlot } from './types';
+import type { RenderListColumnOverride } from '../SchemaListView';
+
+interface SchemaDrivenPluginProps {
+  pluginName: string;
+  /** Absolute list route prefix when the plugin is not mounted under ``/apps/{name}``. */
+  routeBase?: string;
+  mockSchema?: PluginSchema;
+  mockTasks?: Record<string, unknown>[];
+  mockEntityItems?: Record<string, Record<string, unknown>[]>;
+  /** When true, only the list table is shown (no create, detail, or edit routes). */
+  listOnly?: boolean;
+  /**
+   * Browse mode: list + read-only detail (and optional ``renderEntityDetailChildren``),
+   * without create / edit / delete routes on detail chrome. List row delete is separate
+   * (see ``allowListEntityDelete``).
+   */
+  browseOnly?: boolean;
+  /** Keys to hide from the generic detail field dump (nested relations, etc.). */
+  suppressDetailKeys?: string[];
+  /** Replace the default Execute button on single-task detail pages. */
+  getTaskExecuteActions?: (
+    task: Record<string, unknown>
+  ) => TaskExecuteAction[] | undefined;
+  /** Task names whose execution history should appear on the Execution History tab. */
+  getTaskHistoryNames?: (task: Record<string, unknown>) => string[] | undefined;
+  /** Extra overview content on single-task detail pages. */
+  renderTaskDetailChildren?: (args: {
+    task: Record<string, unknown>;
+    pluginName: string;
+    schema: PluginSchema;
+  }) => ReactNode;
+  /** Hide multi-entity tab bar (e.g. inventory uses breadcrumbs instead). */
+  hideEntityTabs?: boolean;
+  /**
+   * When true, entity list tables that declare an ``actions`` column show a per-row delete
+   * control (inventory uses this with browse-only detail chrome).
+   */
+  allowListEntityDelete?: boolean;
+  renderEntityDetailChildren?: (args: {
+    entityName: string;
+    record: Record<string, unknown>;
+    schema: PluginSchema;
+    pathname: string;
+    pluginName: string;
+    mockEntityItems?: Record<string, Record<string, unknown>[]>;
+    allowListEntityDelete?: boolean;
+  }) => ReactNode;
+  /**
+   * Per-field widget override, threaded to the create and edit forms. Applied
+   * after conditional gating; overrides must write through react-hook-form.
+   */
+  renderField?: RenderFieldOverride;
+  /** Whole-form slot for the create page; framework keeps chrome / mutation / snackbars. */
+  renderCreateForm?: RenderFormSlot;
+  /** Whole-form slot for the edit page; framework keeps chrome / mutation / snackbars. */
+  renderEditForm?: RenderFormSlot;
+  /** Per-cell list column override (non-`actions` columns), threaded to the list page. */
+  renderListColumn?: RenderListColumnOverride;
+  /**
+   * Disable the poll-while-running task-list refresh on the single-task list
+   * page. Threaded to {@link PluginListPage} so stories/tests mounting a real
+   * list with a running row issue no repeat requests, mirroring
+   * `disableSchedulePolling`.
+   */
+  disableTaskPolling?: boolean;
+}
+
+function PluginEditPage({
+  schema,
+  pluginName,
+  mockEntityItems,
+  renderField,
+  renderEditForm,
+}: {
+  schema: PluginSchema;
+  pluginName: string;
+  mockEntityItems?: Record<string, Record<string, unknown>[]>;
+  renderField?: RenderFieldOverride;
+  renderEditForm?: RenderFormSlot;
+}) {
+  const navigate = useNavigate();
+  const { entityName, id } = useParams<{ entityName?: string; id: string }>();
+  const entitySchema = useMemo(
+    () =>
+      schema.entities?.find((e: PluginEntitySchema) => e.name === entityName),
+    [schema.entities, entityName]
+  );
+  const multi = Boolean(schema.entities?.length && entityName && entitySchema);
+
+  const { enqueueSnackbar } = useSnackbar();
+  const updateEntity = useUpdatePluginEntity(
+    pluginName,
+    entityName ?? '',
+    multi ? mockEntityItems?.[entityName!] : undefined
+  );
+
+  const { data: item, isLoading } = usePluginEntityDetail(
+    pluginName,
+    entityName ?? '',
+    id,
+    multi ? mockEntityItems?.[entityName!] : undefined,
+    { enabled: multi && Boolean(id) }
+  );
+
+  const title = entitySchema?.display_name ?? schema.display_name;
+  const sections = entitySchema?.forms ?? schema.forms!;
+
+  const [{ submitError, fieldErrors }, setSubmitErrorState] =
+    useState<SubmitErrorState>(EMPTY_SUBMIT_ERROR);
+
+  const handleSubmit = (data: Record<string, unknown>) => {
+    if (!id || !multi) {
+      return;
+    }
+    // Clear any prior failure so the banner / inline errors reset before the
+    // new attempt resolves.
+    setSubmitErrorState(EMPTY_SUBMIT_ERROR);
+    updateEntity.mutate(
+      // Coerce at the submit boundary so whole-form slots that bypass
+      // SchemaFormRenderer's internal coercion still send a backend-ready
+      // payload. Idempotent for the default (already-coerced) path.
+      {
+        id,
+        values: coerceFormValues(data, flattenSectionFields(sections)),
+      },
+      {
+        onSuccess: () => {
+          enqueueSnackbar(`${title} updated`, { variant: 'success' });
+          navigate('..', { relative: 'path' });
+        },
+        onError: (error: unknown) => {
+          const message =
+            error instanceof Error ? error.message : 'Failed to update';
+          // Transient toast is unchanged; 422s additionally map to a persistent
+          // banner plus inline per-field errors.
+          enqueueSnackbar(message, { variant: 'error' });
+          setSubmitErrorState(mapSubmitError(error, sections, message));
+        },
+      }
+    );
+  };
+
+  if (!multi || !entitySchema) {
+    return (
+      <Box sx={{ py: 2 }}>
+        <Typography color="text.secondary">
+          Edit is only available for multi-entity plugins.
+        </Typography>
+      </Box>
+    );
+  }
+
+  if (isLoading) {
+    return (
+      <Box>
+        <Skeleton variant="text" width={300} height={40} />
+        <Skeleton variant="rectangular" height={200} sx={{ mt: 2 }} />
+      </Box>
+    );
+  }
+
+  if (!item) {
+    return (
+      <Box sx={{ py: 2 }}>
+        <Typography variant="h5">Not found</Typography>
+      </Box>
+    );
+  }
+
+  const defaultValues = item as Record<string, unknown>;
+
+  return (
+    <Box>
+      <Box sx={{ display: 'flex', alignItems: 'center', gap: 1, mb: 3 }}>
+        <IconButton onClick={() => navigate('..', { relative: 'path' })}>
+          <ArrowBackIcon />
+        </IconButton>
+        <Typography variant="h4">
+          Edit {title} #{id}
+        </Typography>
+      </Box>
+
+      {renderEditForm?.({
+        sections,
+        onSubmit: handleSubmit,
+        loading: updateEntity.isPending,
+        defaultValues,
+        capabilities: schema.capabilities,
+        renderField,
+        submitError,
+        fieldErrors,
+      }) ?? (
+        <SchemaFormRenderer
+          sections={sections}
+          onSubmit={handleSubmit}
+          loading={updateEntity.isPending}
+          submitLabel={`Save ${title}`}
+          submitError={submitError}
+          fieldErrors={fieldErrors}
+          defaultValues={defaultValues}
+          renderField={renderField}
+        />
+      )}
+    </Box>
+  );
+}
+
+export function SchemaDrivenPlugin({
+  pluginName,
+  routeBase,
+  mockSchema,
+  mockTasks,
+  mockEntityItems,
+  listOnly = false,
+  browseOnly = false,
+  suppressDetailKeys,
+  getTaskExecuteActions,
+  getTaskHistoryNames,
+  renderTaskDetailChildren,
+  hideEntityTabs = false,
+  allowListEntityDelete = false,
+  renderEntityDetailChildren,
+  renderField,
+  renderCreateForm,
+  renderEditForm,
+  renderListColumn,
+  disableTaskPolling = false,
+}: SchemaDrivenPluginProps) {
+  const { pathname } = useLocation();
+  const {
+    data: schema,
+    isLoading,
+    error,
+  } = usePluginSchema(pluginName, mockSchema);
+  const showMutationRoutes = !listOnly && !browseOnly;
+  const showDetailRoutes = !listOnly;
+  const resolvedRouteBase = resolvePluginRouteBase(
+    pluginName,
+    routeBase
+  ).replace(/\/+$/, '');
+  const relatedApps = schema?.related_apps ?? [];
+  const hasRelatedApps = relatedApps.length > 0;
+
+  if (isLoading && !schema) {
+    return (
+      <Box sx={{ display: 'flex', justifyContent: 'center', py: 8 }}>
+        <CircularProgress />
+      </Box>
+    );
+  }
+
+  if (error && !schema) {
+    return (
+      <Box sx={{ py: 4 }}>
+        <Typography color="error">
+          Failed to load plugin schema: {error.message}
+        </Typography>
+      </Box>
+    );
+  }
+
+  if (!schema) {
+    return null;
+  }
+
+  if (schema.entities?.length) {
+    const first = schema.entities[0].name;
+    return (
+      <Routes>
+        <Route index element={<Navigate to={first} replace />} />
+        <Route
+          path=":entityName"
+          element={
+            <PluginListPage
+              schema={schema}
+              pluginName={pluginName}
+              mockEntityItems={mockEntityItems}
+              listOnly={listOnly}
+              hideCreate={browseOnly && !listOnly}
+              hideEntityTabs={hideEntityTabs}
+              allowListEntityDelete={allowListEntityDelete}
+              renderListColumn={renderListColumn}
+            />
+          }
+        />
+        {showMutationRoutes && (
+          <>
+            <Route
+              path=":entityName/new"
+              element={
+                <PluginCreatePage
+                  schema={schema}
+                  pluginName={pluginName}
+                  mockEntityItems={mockEntityItems}
+                  renderField={renderField}
+                  renderCreateForm={renderCreateForm}
+                />
+              }
+            />
+            <Route
+              path=":entityName/:id/edit"
+              element={
+                <PluginEditPage
+                  schema={schema}
+                  pluginName={pluginName}
+                  mockEntityItems={mockEntityItems}
+                  renderField={renderField}
+                  renderEditForm={renderEditForm}
+                />
+              }
+            />
+          </>
+        )}
+        {showDetailRoutes && (
+          <Route
+            path=":entityName/:id"
+            element={
+              <PluginDetailPage
+                schema={schema}
+                pluginName={pluginName}
+                mockEntityItems={mockEntityItems}
+                browseOnly={browseOnly}
+                suppressDetailKeys={suppressDetailKeys}
+                renderEntityDetailChildren={renderEntityDetailChildren}
+                allowListEntityDelete={allowListEntityDelete}
+              />
+            }
+          />
+        )}
+      </Routes>
+    );
+  }
+
+  const nestedPluginProps = {
+    mockTasks,
+    mockEntityItems,
+    listOnly,
+    browseOnly,
+    suppressDetailKeys,
+    getTaskExecuteActions,
+    getTaskHistoryNames,
+    renderTaskDetailChildren,
+    hideEntityTabs,
+    allowListEntityDelete,
+    renderEntityDetailChildren,
+    renderField,
+    renderCreateForm,
+    renderEditForm,
+    renderListColumn,
+  };
+
+  const singleTaskRoutes = (
+    <Routes>
+      <Route
+        index
+        element={
+          <PluginListPage
+            schema={schema}
+            pluginName={pluginName}
+            mockTasks={mockTasks}
+            mockEntityItems={mockEntityItems}
+            listOnly={listOnly}
+            hideCreate={browseOnly && !listOnly}
+            renderListColumn={renderListColumn}
+            disableTaskPolling={disableTaskPolling}
+          />
+        }
+      />
+      {showMutationRoutes && (
+        <>
+          <Route
+            path="new"
+            element={
+              <PluginCreatePage
+                schema={schema}
+                pluginName={pluginName}
+                mockTasks={mockTasks}
+                renderField={renderField}
+                renderCreateForm={renderCreateForm}
+              />
+            }
+          />
+          <Route
+            path="task/:id/edit"
+            element={
+              <PluginTaskEditPage
+                schema={schema}
+                pluginName={pluginName}
+                mockTasks={mockTasks}
+                renderField={renderField}
+                renderEditForm={renderEditForm}
+              />
+            }
+          />
+        </>
+      )}
+      {/* Schedule route is only registered when the plugin schema opts in;
+          otherwise direct navigation to `/apps/<name>/schedule` would
+          show the panel even though the entry-point buttons (which gate on
+          the same capability) are hidden. */}
+      {schema.capabilities?.scheduling && (
+        <Route
+          path="schedule"
+          element={<PluginSchedulePage pluginName={pluginName} />}
+        />
+      )}
+      {showDetailRoutes && (
+        <Route
+          path="task/:id/*"
+          element={
+            <PluginDetailPage
+              schema={schema}
+              pluginName={pluginName}
+              routeBase={routeBase}
+              mockTasks={mockTasks}
+              browseOnly={browseOnly}
+              suppressDetailKeys={suppressDetailKeys}
+              getTaskExecuteActions={getTaskExecuteActions}
+              getTaskHistoryNames={getTaskHistoryNames}
+              renderTaskDetailChildren={renderTaskDetailChildren}
+              renderEntityDetailChildren={renderEntityDetailChildren}
+              allowListEntityDelete={allowListEntityDelete}
+            />
+          }
+        />
+      )}
+      {hasRelatedApps &&
+        relatedApps.map((related) => (
+          <Route
+            key={related.app_key}
+            path={`${related.route_segment}/*`}
+            element={
+              <SchemaDrivenPlugin
+                pluginName={related.app_key}
+                routeBase={`${resolvedRouteBase}/${related.route_segment}`}
+                {...nestedPluginProps}
+              />
+            }
+          />
+        ))}
+    </Routes>
+  );
+
+  if (hasRelatedApps) {
+    return (
+      <Box>
+        <RelatedAppTabBar
+          parentLabel={schema.display_name}
+          routeBase={resolvedRouteBase}
+          relatedApps={relatedApps}
+          activeSegment={resolveRelatedAppActiveSegment(
+            pathname,
+            resolvedRouteBase,
+            relatedApps
+          )}
+        />
+        {singleTaskRoutes}
+      </Box>
+    );
+  }
+
+  return singleTaskRoutes;
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/StatsCard.test.tsx b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/StatsCard.test.tsx
new file mode 100644
index 00000000000..5316d69fd98
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/StatsCard.test.tsx
@@ -0,0 +1,290 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { render, screen } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+
+const { mockUseTaskStats } = vi.hoisted(() => ({
+  mockUseTaskStats: vi.fn(),
+}));
+
+vi.mock('../../hooks/useTaskStats', async () => {
+  const actual = await vi.importActual<
+    typeof import('../../hooks/useTaskStats')
+  >('../../hooks/useTaskStats');
+  return {
+    ...actual,
+    useTaskStats: (...args: unknown[]) => mockUseTaskStats(...args),
+  };
+});
+
+import { StatsCard } from './StatsCard';
+
+function makeClient() {
+  return new QueryClient({
+    defaultOptions: { queries: { retry: false, gcTime: 0, staleTime: 0 } },
+  });
+}
+
+function renderWithClient(ui: React.ReactElement) {
+  return render(
+    <QueryClientProvider client={makeClient()}>{ui}</QueryClientProvider>
+  );
+}
+
+const POPULATED = {
+  engine: 'nomad',
+  total: 5,
+  status: { pass: 4, fail: 1 },
+  duration: {
+    average_seconds: 1.234,
+    last_seconds: 0.987,
+    total_seconds: 6.17,
+  },
+  last_finished_at: new Date(Date.now() - 60_000).toISOString(),
+};
+
+beforeEach(() => {
+  mockUseTaskStats.mockReset();
+});
+
+describe('StatsCard — render states', () => {
+  it('renders a skeleton while loading', () => {
+    mockUseTaskStats.mockReturnValue({
+      data: undefined,
+      isLoading: true,
+      isError: false,
+    });
+    const { container } = renderWithClient(<StatsCard taskName="foo" />);
+    expect(screen.getByText('Stats')).toBeInTheDocument();
+    expect(container.querySelector('.MuiSkeleton-root')).not.toBeNull();
+    expect(screen.queryByText('No execution history yet')).toBeNull();
+    expect(screen.queryByText('Executions')).toBeNull();
+  });
+
+  it('renders the empty state when total === 0', () => {
+    mockUseTaskStats.mockReturnValue({
+      data: {
+        engine: 'nomad',
+        total: 0,
+        status: { pass: 0, fail: 0 },
+        duration: {
+          average_seconds: null,
+          last_seconds: null,
+          total_seconds: null,
+        },
+        last_finished_at: null,
+      },
+      isLoading: false,
+      isError: false,
+    });
+    renderWithClient(<StatsCard taskName="foo" />);
+    expect(screen.getByText('No execution history yet')).toBeInTheDocument();
+    expect(screen.queryByText('Executions')).toBeNull();
+  });
+
+  it('renders all six fields with formatted values when populated', () => {
+    mockUseTaskStats.mockReturnValue({
+      data: POPULATED,
+      isLoading: false,
+      isError: false,
+    });
+    renderWithClient(<StatsCard taskName="foo" />);
+    expect(screen.getByText('Executions')).toBeInTheDocument();
+    expect(screen.getByText('5')).toBeInTheDocument();
+    expect(screen.getByText('Succeeded')).toBeInTheDocument();
+    expect(screen.getByText('4')).toBeInTheDocument();
+    expect(screen.getByText('Failed')).toBeInTheDocument();
+    expect(screen.getByText('1')).toBeInTheDocument();
+    expect(screen.getByText('Avg Duration')).toBeInTheDocument();
+    expect(screen.getByText('1.234s')).toBeInTheDocument();
+    expect(screen.getByText('Last Duration')).toBeInTheDocument();
+    expect(screen.getByText('0.987s')).toBeInTheDocument();
+    expect(screen.getByText('Last Finished')).toBeInTheDocument();
+    // Relative time must not be the raw ISO string.
+    expect(screen.queryByText(POPULATED.last_finished_at)).toBeNull();
+  });
+
+  it('renders an inline error message on fetch failure', () => {
+    mockUseTaskStats.mockReturnValue({
+      data: undefined,
+      isLoading: false,
+      isError: true,
+      error: new Error('boom'),
+    });
+    renderWithClient(<StatsCard taskName="foo" />);
+    expect(screen.getByRole('alert')).toHaveTextContent(
+      'Could not load execution stats'
+    );
+  });
+
+  it('renders empty state for 404 error', async () => {
+    const { ApiError } = await import('@sep/api');
+    mockUseTaskStats.mockReturnValue({
+      data: undefined,
+      isLoading: false,
+      isError: true,
+      error: new ApiError({ kind: 'http', status: 404, message: 'Not found' }),
+    });
+    renderWithClient(<StatsCard taskName="foo" />);
+    expect(screen.getByText('No execution history yet')).toBeInTheDocument();
+    expect(screen.queryByRole('alert')).toBeNull();
+  });
+
+  it('renders inline error for 401 (does not redirect)', async () => {
+    const { ApiError } = await import('@sep/api');
+    mockUseTaskStats.mockReturnValue({
+      data: undefined,
+      isLoading: false,
+      isError: true,
+      error: new ApiError({
+        kind: 'http',
+        status: 401,
+        message: 'Unauthorized',
+      }),
+    });
+    renderWithClient(<StatsCard taskName="foo" />);
+    expect(screen.getByRole('alert')).toHaveTextContent(
+      'Could not load execution stats'
+    );
+  });
+
+  it('renders inline error for 502 upstream Tasks-API failure', async () => {
+    const { ApiError } = await import('@sep/api');
+    mockUseTaskStats.mockReturnValue({
+      data: undefined,
+      isLoading: false,
+      isError: true,
+      error: new ApiError({
+        kind: 'http',
+        status: 502,
+        message: 'tasks unreachable',
+      }),
+    });
+    renderWithClient(<StatsCard taskName="foo" />);
+    expect(screen.getByRole('alert')).toHaveTextContent(
+      'Could not load execution stats'
+    );
+  });
+});
+
+describe('StatsCard — taskName guards', () => {
+  it('renders nothing when taskName is undefined', () => {
+    mockUseTaskStats.mockReturnValue({
+      data: undefined,
+      isLoading: false,
+      isError: false,
+    });
+    const { container } = renderWithClient(<StatsCard taskName={undefined} />);
+    expect(container.firstChild).toBeNull();
+  });
+
+  it('renders nothing for empty-string taskName', () => {
+    mockUseTaskStats.mockReturnValue({
+      data: undefined,
+      isLoading: false,
+      isError: false,
+    });
+    const { container } = renderWithClient(<StatsCard taskName="" />);
+    expect(container.firstChild).toBeNull();
+  });
+
+  it('renders nothing for whitespace-only taskName', () => {
+    mockUseTaskStats.mockReturnValue({
+      data: undefined,
+      isLoading: false,
+      isError: false,
+    });
+    const { container } = renderWithClient(<StatsCard taskName="   " />);
+    expect(container.firstChild).toBeNull();
+  });
+});
+
+describe('StatsCard — defensive formatting', () => {
+  it('shows placeholder for null last_finished_at', () => {
+    mockUseTaskStats.mockReturnValue({
+      data: { ...POPULATED, last_finished_at: null },
+      isLoading: false,
+      isError: false,
+    });
+    renderWithClient(<StatsCard taskName="foo" />);
+    expect(screen.getByText('Last Finished')).toBeInTheDocument();
+    // The placeholder em-dash renders instead of throwing on new Date(null).
+    expect(screen.getAllByText('—').length).toBeGreaterThanOrEqual(1);
+  });
+
+  it('shows placeholder for malformed ISO timestamp', () => {
+    mockUseTaskStats.mockReturnValue({
+      data: { ...POPULATED, last_finished_at: 'not-a-date' },
+      isLoading: false,
+      isError: false,
+    });
+    renderWithClient(<StatsCard taskName="foo" />);
+    expect(screen.queryByText('Invalid Date')).toBeNull();
+    expect(screen.getAllByText('—').length).toBeGreaterThanOrEqual(1);
+  });
+
+  it('shows placeholder for missing average_seconds', () => {
+    mockUseTaskStats.mockReturnValue({
+      data: { ...POPULATED, duration: { last_seconds: 0.5 } },
+      isLoading: false,
+      isError: false,
+    });
+    renderWithClient(<StatsCard taskName="foo" />);
+    expect(screen.getByText('Avg Duration')).toBeInTheDocument();
+    expect(screen.getAllByText('—').length).toBeGreaterThanOrEqual(1);
+    expect(screen.getByText('0.500s')).toBeInTheDocument();
+  });
+
+  it('defaults missing pass/fail keys to 0', () => {
+    mockUseTaskStats.mockReturnValue({
+      data: { ...POPULATED, status: {} },
+      isLoading: false,
+      isError: false,
+    });
+    renderWithClient(<StatsCard taskName="foo" />);
+    expect(screen.getByText('Succeeded')).toBeInTheDocument();
+    expect(screen.getByText('Failed')).toBeInTheDocument();
+    const zeros = screen.getAllByText('0');
+    expect(zeros.length).toBeGreaterThanOrEqual(2);
+  });
+
+  it('formats absurdly large duration without crash', () => {
+    mockUseTaskStats.mockReturnValue({
+      data: {
+        ...POPULATED,
+        duration: { average_seconds: 9999999.999, last_seconds: -1 },
+      },
+      isLoading: false,
+      isError: false,
+    });
+    renderWithClient(<StatsCard taskName="foo" />);
+    expect(screen.getByText('9999999.999s')).toBeInTheDocument();
+    expect(screen.getByText('-1.000s')).toBeInTheDocument();
+  });
+
+  it('escapes XSS attempt in last_finished_at as text', () => {
+    mockUseTaskStats.mockReturnValue({
+      data: { ...POPULATED, last_finished_at: '<script>alert(1)</script>' },
+      isLoading: false,
+      isError: false,
+    });
+    const { container } = renderWithClient(<StatsCard taskName="foo" />);
+    expect(container.querySelector('script')).toBeNull();
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/StatsCard.tsx b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/StatsCard.tsx
new file mode 100644
index 00000000000..afd1f47f1df
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/StatsCard.tsx
@@ -0,0 +1,164 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { Alert, Box, Paper, Skeleton, Typography } from '@mui/material';
+import { ApiError } from '@sep/api';
+import { useTaskStats } from '../../hooks/useTaskStats';
+
+const PLACEHOLDER = '—';
+
+function formatSeconds(value: number | null | undefined): string {
+  if (value === null || value === undefined || !Number.isFinite(value)) {
+    return PLACEHOLDER;
+  }
+  return `${value.toFixed(3)}s`;
+}
+
+const RELATIVE_THRESHOLDS: Array<[number, Intl.RelativeTimeFormatUnit]> = [
+  [60, 'second'],
+  [60, 'minute'],
+  [24, 'hour'],
+  [7, 'day'],
+  [4.345, 'week'],
+  [12, 'month'],
+  [Number.POSITIVE_INFINITY, 'year'],
+];
+
+function formatRelative(iso: string | null | undefined): string {
+  if (!iso || typeof iso !== 'string') {
+    return PLACEHOLDER;
+  }
+  const date = new Date(iso);
+  const ms = date.getTime();
+  if (!Number.isFinite(ms)) {
+    return PLACEHOLDER;
+  }
+  let diff = (ms - Date.now()) / 1000;
+  const formatter = new Intl.RelativeTimeFormat(undefined, { numeric: 'auto' });
+  for (const [bound, unit] of RELATIVE_THRESHOLDS) {
+    if (Math.abs(diff) < bound) {
+      return formatter.format(Math.round(diff), unit);
+    }
+    diff /= bound;
+  }
+  return formatter.format(Math.round(diff), 'year');
+}
+
+function SectionShell({ children }: { children: React.ReactNode }) {
+  return (
+    <Paper variant="outlined" sx={{ p: 3, mb: 3 }}>
+      <Typography variant="h6" sx={{ mb: 2 }}>
+        Stats
+      </Typography>
+      {children}
+    </Paper>
+  );
+}
+
+function StatField({
+  label,
+  value,
+}: {
+  label: string;
+  value: React.ReactNode;
+}) {
+  return (
+    <Box sx={{ minWidth: 140 }}>
+      <Typography
+        variant="caption"
+        color="text.secondary"
+        sx={{ display: 'block', mb: 0.5 }}
+      >
+        {label}
+      </Typography>
+      <Typography variant="body1">{value}</Typography>
+    </Box>
+  );
+}
+
+interface StatsCardProps {
+  taskName: string | undefined;
+}
+
+export function StatsCard({ taskName }: StatsCardProps) {
+  const trimmed = taskName?.trim();
+  const enabled = Boolean(trimmed);
+  const { data, isLoading, isError, error } = useTaskStats(trimmed, enabled);
+
+  if (!enabled) {
+    return null;
+  }
+
+  if (isLoading) {
+    return (
+      <SectionShell>
+        <Skeleton variant="rectangular" height={80} />
+      </SectionShell>
+    );
+  }
+
+  if (isError) {
+    const status = error instanceof ApiError ? error.status : undefined;
+    if (status === 404) {
+      return (
+        <SectionShell>
+          <Typography color="text.secondary">
+            No execution history yet
+          </Typography>
+        </SectionShell>
+      );
+    }
+    return (
+      <SectionShell>
+        <Alert severity="info">Could not load execution stats</Alert>
+      </SectionShell>
+    );
+  }
+
+  if (!data || !data.total) {
+    return (
+      <SectionShell>
+        <Typography color="text.secondary">No execution history yet</Typography>
+      </SectionShell>
+    );
+  }
+
+  const succeeded = data.status?.pass ?? 0;
+  const failed = data.status?.fail ?? 0;
+
+  return (
+    <SectionShell>
+      <Box sx={{ display: 'flex', flexWrap: 'wrap', gap: 3 }}>
+        <StatField label="Executions" value={data.total} />
+        <StatField label="Succeeded" value={succeeded} />
+        <StatField label="Failed" value={failed} />
+        <StatField
+          label="Last Finished"
+          value={formatRelative(data.last_finished_at)}
+        />
+        <StatField
+          label="Avg Duration"
+          value={formatSeconds(data.duration?.average_seconds)}
+        />
+        <StatField
+          label="Last Duration"
+          value={formatSeconds(data.duration?.last_seconds)}
+        />
+      </Box>
+    </SectionShell>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/detailPrism.ts b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/detailPrism.ts
new file mode 100644
index 00000000000..d8ac77dd4fd
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/detailPrism.ts
@@ -0,0 +1,26 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import Prism from 'prismjs';
+import type { PrismLib } from 'prism-react-renderer';
+import 'prismjs/components/prism-sql.js';
+import 'prismjs/components/prism-json.js';
+import 'prismjs/components/prism-yaml.js';
+import 'prismjs/components/prism-bash.js';
+
+/** Prism instance with SQL, JSON, YAML, and Bash grammars for ``Highlight`` (``prism-react-renderer``). */
+export const detailPrism: PrismLib = Prism as unknown as PrismLib;
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/detailSyntaxStyles.ts b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/detailSyntaxStyles.ts
new file mode 100644
index 00000000000..99f2bd253ac
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/detailSyntaxStyles.ts
@@ -0,0 +1,37 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type { SxProps, Theme } from '@mui/material/styles';
+
+/** Matches the backend ``DetailHighlightLanguage`` enum. */
+export type DetailSyntaxLanguage = 'sql' | 'json' | 'yaml' | 'bash';
+
+/** Shared layout for syntax blocks and matching Suspense fallbacks (no prism/sql deps). */
+export const detailSyntaxBlockSx: SxProps<Theme> = {
+  fontFamily: "'Roboto Mono', ui-monospace, monospace",
+  fontSize: '0.8125rem',
+  lineHeight: 1.6,
+  whiteSpace: 'pre-wrap',
+  wordBreak: 'break-word',
+  p: 2,
+  mt: 0.5,
+  borderRadius: 1,
+  bgcolor: 'action.hover',
+  border: 1,
+  borderColor: 'divider',
+  overflowX: 'auto',
+};
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/index.ts b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/index.ts
new file mode 100644
index 00000000000..b68292d6ee5
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/index.ts
@@ -0,0 +1,27 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { SchemaDrivenPlugin } from './SchemaDrivenPlugin';
+export { DeleteConfirmDialog } from './DeleteConfirmDialog';
+export type { DeleteConfirmDialogProps } from './DeleteConfirmDialog';
+export { PluginCreatePage } from './PluginCreatePage';
+export { PluginTaskEditPage } from './PluginTaskEditPage';
+export { PluginDetailPage } from './PluginDetailPage';
+export { getStoredForm, STORED_FORM_KEY } from './storedForm';
+export { PluginListPage } from './PluginListPage';
+export { PluginSchedulePage } from './PluginSchedulePage';
+export type { PluginFormSlotProps, RenderFormSlot } from './types';
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/routeBase.ts b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/routeBase.ts
new file mode 100644
index 00000000000..0d8e3f78067
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/routeBase.ts
@@ -0,0 +1,24 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/** Resolve the absolute URL prefix for plugin list/detail/schedule navigation. */
+export function resolvePluginRouteBase(
+  pluginName: string,
+  routeBase?: string
+): string {
+  return routeBase ?? `/apps/${pluginName}`;
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/storedForm.test.ts b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/storedForm.test.ts
new file mode 100644
index 00000000000..0787a1be0bd
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/storedForm.test.ts
@@ -0,0 +1,63 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { getStoredForm, STORED_FORM_KEY } from './storedForm';
+
+describe('getStoredForm', () => {
+  it('returns the stored create-form body when data[_form] is present', () => {
+    const task = {
+      name: 't',
+      data: { [STORED_FORM_KEY]: { task_name: 't', foo: 1 } },
+    };
+    expect(getStoredForm(task)).toEqual({ task_name: 't', foo: 1 });
+  });
+
+  it('returns undefined for a null/undefined task', () => {
+    expect(getStoredForm(undefined)).toBeUndefined();
+    expect(getStoredForm(null)).toBeUndefined();
+  });
+
+  it('returns undefined when data is absent', () => {
+    expect(getStoredForm({ name: 't' })).toBeUndefined();
+  });
+
+  it('returns undefined for a legacy task whose data has no _form key', () => {
+    expect(getStoredForm({ name: 't', data: { meta: {} } })).toBeUndefined();
+  });
+
+  it('returns undefined when _form is not an object', () => {
+    expect(
+      getStoredForm({ name: 't', data: { [STORED_FORM_KEY]: 'nope' } })
+    ).toBeUndefined();
+    expect(
+      getStoredForm({ name: 't', data: { [STORED_FORM_KEY]: null } })
+    ).toBeUndefined();
+  });
+
+  it('returns undefined when _form is an array', () => {
+    expect(
+      getStoredForm({ name: 't', data: { [STORED_FORM_KEY]: [] } })
+    ).toBeUndefined();
+    expect(
+      getStoredForm({
+        name: 't',
+        data: { [STORED_FORM_KEY]: [{ task_name: 't' }] },
+      })
+    ).toBeUndefined();
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/storedForm.ts b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/storedForm.ts
new file mode 100644
index 00000000000..17dd58e7c2c
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/storedForm.ts
@@ -0,0 +1,47 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/**
+ * Reserved key under a task's ``data`` that holds the verbatim create-form body
+ * the backend stamps on the JSON create path. Mirrors the backend
+ * ``RESERVED_FORM_KEY`` in ``app/sep/plugins/framework/spec.py``.
+ */
+export const STORED_FORM_KEY = '_form';
+
+/**
+ * Read a task's stored create-form body from ``data[_form]``, centralising the
+ * cast and presence guard.
+ *
+ * The typed client exposes ``data`` as opaque (``Record<string, never>`` in
+ * codegen, ``unknown`` at the loose hook call site), so consumers route through
+ * this guard rather than indexing ``data`` directly. Returns ``undefined`` for a
+ * task with no stored form — a legacy task or one created through a still-live
+ * legacy form — so the Edit affordance can treat the key as optional.
+ */
+export function getStoredForm(
+  task: Record<string, unknown> | null | undefined
+): Record<string, unknown> | undefined {
+  const data = task?.data;
+  if (!data || typeof data !== 'object') {
+    return undefined;
+  }
+  const stored = (data as Record<string, unknown>)[STORED_FORM_KEY];
+  if (!stored || typeof stored !== 'object' || Array.isArray(stored)) {
+    return undefined;
+  }
+  return stored as Record<string, unknown>;
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/submitErrorMapping.test.ts b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/submitErrorMapping.test.ts
new file mode 100644
index 00000000000..adfb24d180d
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/submitErrorMapping.test.ts
@@ -0,0 +1,105 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { ApiError } from '@sep/api';
+import type { FormSection } from '../SchemaFormRenderer/types';
+import { EMPTY_SUBMIT_ERROR, mapSubmitError } from './submitErrorMapping';
+
+const SECTIONS: FormSection[] = [
+  {
+    title: 'Task',
+    fields: [
+      { type: 'string', name: 'task_name', label: 'Task Name', required: true },
+      { type: 'integer', name: 'limit', label: 'Row Limit' },
+    ],
+  },
+];
+
+function http(status: number, detail?: unknown): ApiError {
+  return new ApiError({
+    kind: 'http',
+    status,
+    message: `HTTP ${status}`,
+    data: { detail },
+  });
+}
+
+describe('mapSubmitError', () => {
+  it('returns the empty state for non-422 errors (toast-only path unchanged)', () => {
+    expect(mapSubmitError(http(500), SECTIONS, 'Failed')).toBe(
+      EMPTY_SUBMIT_ERROR
+    );
+    expect(
+      mapSubmitError(
+        new ApiError({ kind: 'network', message: 'x' }),
+        SECTIONS,
+        'Failed'
+      )
+    ).toBe(EMPTY_SUBMIT_ERROR);
+    expect(mapSubmitError(new Error('boom'), SECTIONS, 'Failed')).toBe(
+      EMPTY_SUBMIT_ERROR
+    );
+  });
+
+  it('maps a 422 to per-field errors and a banner labelled by field', () => {
+    const result = mapSubmitError(
+      http(422, [
+        { loc: ['body', 'limit'], msg: 'ensure this value is greater than 0' },
+        { loc: ['body', 'task_name'], msg: 'field required' },
+      ]),
+      SECTIONS,
+      'Failed to create'
+    );
+
+    expect(result.fieldErrors).toEqual([
+      { path: 'limit', message: 'ensure this value is greater than 0' },
+      { path: 'task_name', message: 'field required' },
+    ]);
+    expect(result.submitError).toBe(
+      [
+        'Failed to create',
+        '• Row Limit: ensure this value is greater than 0',
+        '• Task Name: field required',
+      ].join('\n')
+    );
+  });
+
+  it('surfaces an unmatched/unknown field error in the banner using its raw path', () => {
+    const result = mapSubmitError(
+      http(422, [{ loc: ['body', 'mystery'], msg: 'not allowed here' }]),
+      SECTIONS,
+      'Failed'
+    );
+    expect(result.fieldErrors).toEqual([
+      { path: 'mystery', message: 'not allowed here' },
+    ]);
+    expect(result.submitError).toBe(
+      ['Failed', '• mystery: not allowed here'].join('\n')
+    );
+  });
+
+  it('shows a generic banner for a 422 without a parseable detail array', () => {
+    const result = mapSubmitError(
+      http(422, 'Unprocessable Entity'),
+      SECTIONS,
+      'Server rejected it'
+    );
+    expect(result.fieldErrors).toEqual([]);
+    expect(result.submitError).toBe('Server rejected it');
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/submitErrorMapping.ts b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/submitErrorMapping.ts
new file mode 100644
index 00000000000..27550fd603d
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/submitErrorMapping.ts
@@ -0,0 +1,81 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import {
+  ApiError,
+  parseFieldErrors,
+  type FieldValidationError,
+} from '@sep/api';
+import { flattenSectionFields } from '../SchemaFormRenderer';
+import type { FormSection } from '../SchemaFormRenderer/types';
+
+/** Error state shared by the SchemaDrivenPlugin create and edit forms. */
+export interface SubmitErrorState {
+  /** Persistent in-form banner text, or `null` to hide the banner. */
+  submitError: string | null;
+  /** Per-field errors applied by SchemaFormRenderer via `setError`. */
+  fieldErrors: FieldValidationError[];
+}
+
+/** Empty state used to clear both banner and per-field errors before a submit. */
+export const EMPTY_SUBMIT_ERROR: SubmitErrorState = {
+  submitError: null,
+  fieldErrors: [],
+};
+
+/**
+ * Map a mutation error into the persistent banner + per-field error state.
+ *
+ * Only HTTP 422 responses produce a banner and per-field errors; every other
+ * failure (network, timeout, 5xx, other HTTP errors) returns the empty state so
+ * those paths keep their existing toast-only behavior.
+ *
+ * The banner lists every parsed message — labelling each by its form field when
+ * the path resolves to a schema field — so errors that do not map onto a
+ * rendered field (form-level, hidden conditional, or unknown) are still
+ * surfaced rather than silently dropped. A 422 without a parseable detail array
+ * still shows a generic banner.
+ */
+export function mapSubmitError(
+  error: unknown,
+  sections: FormSection[],
+  fallbackMessage: string
+): SubmitErrorState {
+  if (!(error instanceof ApiError) || error.status !== 422) {
+    return EMPTY_SUBMIT_ERROR;
+  }
+
+  const fieldErrors = parseFieldErrors(error);
+  if (fieldErrors.length === 0) {
+    return { submitError: fallbackMessage, fieldErrors: [] };
+  }
+
+  const labelByPath = new Map<string, string>();
+  for (const field of flattenSectionFields(sections)) {
+    labelByPath.set(field.name, field.label || field.name);
+  }
+
+  const lines = fieldErrors.map(({ path, message }) => {
+    const label = path ? (labelByPath.get(path) ?? path) : '';
+    return label ? `• ${label}: ${message}` : `• ${message}`;
+  });
+
+  return {
+    submitError: [fallbackMessage, ...lines].join('\n'),
+    fieldErrors,
+  };
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/types.ts b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/types.ts
new file mode 100644
index 00000000000..0cf730a1daa
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaDrivenPlugin/types.ts
@@ -0,0 +1,59 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type { ReactNode } from 'react';
+import type { PluginCapabilities, FieldValidationError } from '@sep/api';
+import type {
+  FormSection,
+  RenderFieldOverride,
+} from '../SchemaFormRenderer/types';
+
+/**
+ * Everything a whole-form slot needs to render and submit a plugin form. The
+ * framework still owns the route, page chrome (back navigation + title),
+ * mutation wiring, and success / error snackbars; only the form body is
+ * replaced. A slot composes {@link SchemaFormRenderer} internally with these
+ * props, or builds its own form.
+ *
+ * Submit contract: the slot MUST call `onSubmit` (the framework submit handler)
+ * rather than firing its own mutation, or the success / error snackbars and
+ * post-submit navigation desync.
+ */
+export interface PluginFormSlotProps {
+  /** Form sections to render (from the task / entity schema). */
+  sections: FormSection[];
+  /** Framework submit handler — wires the create / update mutation, snackbars, and navigation. */
+  onSubmit: (data: Record<string, unknown>) => void;
+  /** Whether the underlying mutation is in flight. */
+  loading: boolean;
+  /** Initial form values (populated for edit; undefined for create). */
+  defaultValues?: Record<string, unknown>;
+  /** Plugin capabilities (e.g. `alert_on_fail`) for the composed renderer. */
+  capabilities?: PluginCapabilities;
+  /** Per-field override threaded through, so a composed renderer can honour it. */
+  renderField?: RenderFieldOverride;
+  /** Form-level submit error banner (populated on a 422); pass to the composed renderer. */
+  submitError?: string | null;
+  /** Per-field validation errors (from a 422); pass to the composed renderer for inline display. */
+  fieldErrors?: FieldValidationError[];
+}
+
+/**
+ * Whole-form slot override for the create / edit pages. Return custom form UI;
+ * the framework keeps the surrounding chrome, mutation, and snackbars.
+ */
+export type RenderFormSlot = (props: PluginFormSlotProps) => ReactNode;
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/ConditionalFieldSlot.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/ConditionalFieldSlot.tsx
new file mode 100644
index 00000000000..f98c5497c28
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/ConditionalFieldSlot.tsx
@@ -0,0 +1,49 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { memo } from 'react';
+import Box from '@mui/material/Box';
+import { FieldRenderer } from './fields';
+import { useConditionalField } from './hooks/useConditionalField';
+import type { PluginField, RenderFieldOverride } from './types';
+
+export const ConditionalFieldSlot = memo(function ConditionalFieldSlot({
+  field,
+  renderField,
+}: {
+  field: PluginField;
+  renderField?: RenderFieldOverride;
+}) {
+  const { isHidden, isRequired } = useConditionalField(field);
+
+  if (isHidden) {
+    return null;
+  }
+
+  const resolvedField =
+    Boolean(field.required) !== isRequired
+      ? { ...field, required: isRequired }
+      : field;
+  const renderDefault = () => <FieldRenderer field={resolvedField} />;
+
+  return (
+    <Box sx={{ mb: 2 }}>
+      {renderField?.({ field: resolvedField, renderDefault }) ??
+        renderDefault()}
+    </Box>
+  );
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/FieldLabelWithHelp.test.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/FieldLabelWithHelp.test.tsx
new file mode 100644
index 00000000000..de46ff93935
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/FieldLabelWithHelp.test.tsx
@@ -0,0 +1,67 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { FieldHelpIcon, FieldLabelWithHelp } from './FieldLabelWithHelp';
+
+describe('FieldLabelWithHelp', () => {
+  it('returns the plain label string when description is missing', () => {
+    const { container } = render(<FieldLabelWithHelp label="Title" />);
+
+    expect(screen.getByText('Title')).toBeInTheDocument();
+    expect(screen.queryByLabelText('Help for Title')).not.toBeInTheDocument();
+    // Plain string path — no wrapper span around the label alone.
+    expect(container.querySelector('span')).toBeNull();
+  });
+
+  it('renders an info icon and tooltip when description is set', async () => {
+    const user = userEvent.setup();
+    render(<FieldLabelWithHelp label="Title" description="A title" />);
+
+    expect(screen.getByText('Title')).toBeInTheDocument();
+    const help = screen.getByLabelText('Help for Title');
+    expect(help).toHaveAttribute('data-help-for', 'Title');
+
+    await user.hover(help);
+    expect(await screen.findByRole('tooltip')).toHaveTextContent('A title');
+  });
+});
+
+describe('FieldHelpIcon', () => {
+  it('exposes the description via tooltip on hover', async () => {
+    const user = userEvent.setup();
+    render(<FieldHelpIcon label="Enabled" description="Turn this on" />);
+
+    await user.hover(screen.getByLabelText('Help for Enabled'));
+    expect(await screen.findByRole('tooltip')).toHaveTextContent(
+      'Turn this on'
+    );
+  });
+
+  it('is keyboard-focusable and describes the child with the tooltip title', () => {
+    render(<FieldHelpIcon label="Enabled" description="Turn this on" />);
+
+    const help = screen.getByLabelText('Help for Enabled');
+    expect(help).toHaveAttribute('tabindex', '0');
+    expect(help).toHaveAttribute('data-help-for', 'Enabled');
+    // describeChild keeps aria-label as the name; description via title /
+    // aria-describedby.
+    expect(help).toHaveAccessibleDescription('Turn this on');
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/FieldLabelWithHelp.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/FieldLabelWithHelp.tsx
new file mode 100644
index 00000000000..2fccee0013f
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/FieldLabelWithHelp.tsx
@@ -0,0 +1,90 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type { ReactNode } from 'react';
+import Box from '@mui/material/Box';
+import Tooltip from '@mui/material/Tooltip';
+import HelpOutlineIcon from '@mui/icons-material/HelpOutline';
+
+export interface FieldHelpIconProps {
+  /** Tooltip body shown on hover/focus; also the accessible description. */
+  description: string;
+  /**
+   * Field label for the accessible name (`Help for ${label}`) and for
+   * `data-help-for` (preferred for per-field test queries so label matchers
+   * do not also hit the icon).
+   */
+  label: string;
+}
+
+/**
+ * Info-icon tooltip for schema form field help. Non-button span so it can sit
+ * inside MUI floating labels; focusable, with a per-field accessible name and
+ * the description exposed via Tooltip describeChild. Omit when there is no
+ * description to show.
+ */
+export function FieldHelpIcon({ description, label }: FieldHelpIconProps) {
+  return (
+    <Tooltip title={description} describeChild>
+      <Box
+        component="span"
+        role="img"
+        tabIndex={0}
+        aria-label={`Help for ${label}`}
+        data-help-for={label}
+        sx={{
+          display: 'inline-flex',
+          alignItems: 'center',
+          ml: 0.5,
+          verticalAlign: 'middle',
+          cursor: 'help',
+          color: 'action.active',
+        }}
+        onClick={(event) => event.preventDefault()}
+      >
+        <HelpOutlineIcon sx={{ fontSize: 16 }} />
+      </Box>
+    </Tooltip>
+  );
+}
+
+export interface FieldLabelWithHelpProps {
+  /** Visible field label text. */
+  label: string;
+  /** Optional help text; when set, an info-icon tooltip is rendered next to the label. */
+  description?: string;
+}
+
+/**
+ * Field label with an optional info-icon tooltip from `description`.
+ * Returns a plain string when undescribed; otherwise a ReactNode for MUI
+ * label slots (e.g. TextInput `textFieldProps.label`).
+ */
+export function FieldLabelWithHelp({
+  label,
+  description,
+}: FieldLabelWithHelpProps): ReactNode {
+  if (!description) {
+    return label;
+  }
+  return (
+    <Box component="span" sx={{ display: 'inline-flex', alignItems: 'center' }}>
+      {label}
+      <FieldHelpIcon description={description} label={label} />
+    </Box>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/OneOfGroupSlot.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/OneOfGroupSlot.tsx
new file mode 100644
index 00000000000..2929c3a7320
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/OneOfGroupSlot.tsx
@@ -0,0 +1,121 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { memo, useEffect, useMemo, type MouseEvent } from 'react';
+import { useFormContext, useWatch } from 'react-hook-form';
+import Box from '@mui/material/Box';
+import ToggleButton from '@mui/material/ToggleButton';
+import ToggleButtonGroup from '@mui/material/ToggleButtonGroup';
+import Typography from '@mui/material/Typography';
+import type { OneOfGroup } from '@sep/api';
+import { ConditionalFieldSlot } from './ConditionalFieldSlot';
+import type { RenderFieldOverride } from './types';
+
+export interface OneOfGroupSlotProps {
+  group: OneOfGroup;
+  renderField?: RenderFieldOverride;
+}
+
+export const OneOfGroupSlot = memo(function OneOfGroupSlot({
+  group,
+  renderField,
+}: OneOfGroupSlotProps) {
+  const { control, setValue, unregister } =
+    useFormContext<Record<string, unknown>>();
+
+  const watchedMode = useWatch({
+    control,
+    name: group.discriminator,
+  });
+
+  const activeValue = String(
+    watchedMode ?? group.default ?? group.branches[0]?.value ?? ''
+  );
+
+  const activeBranch = useMemo(
+    () =>
+      group.branches.find((branch) => branch.value === activeValue) ??
+      group.branches[0],
+    [group.branches, activeValue]
+  );
+
+  useEffect(() => {
+    for (const branch of group.branches) {
+      if (branch.value === activeValue) {
+        continue;
+      }
+      for (const leaf of branch.fields) {
+        unregister(leaf.name);
+      }
+    }
+  }, [activeValue, group.branches, unregister]);
+
+  const handleModeChange = (
+    _event: MouseEvent<HTMLElement>,
+    next: string | null
+  ) => {
+    if (!next || next === activeValue) {
+      return;
+    }
+    setValue(group.discriminator, next, {
+      shouldDirty: true,
+      shouldTouch: true,
+    });
+  };
+
+  return (
+    <Box sx={{ mb: 2 }} data-testid={`one-of-${group.name}`}>
+      <Typography
+        component="div"
+        variant="subtitle2"
+        sx={{ fontWeight: 600, mb: 0.5 }}
+      >
+        {group.label}
+      </Typography>
+      {group.description ? (
+        <Typography variant="body2" color="text.secondary" sx={{ mb: 1 }}>
+          {group.description}
+        </Typography>
+      ) : null}
+      <ToggleButtonGroup
+        exclusive
+        value={activeValue}
+        onChange={handleModeChange}
+        aria-label={group.label}
+        sx={{ mb: 2, display: 'flex', flexWrap: 'wrap' }}
+      >
+        {group.branches.map((branch) => (
+          <ToggleButton
+            key={branch.value}
+            value={branch.value}
+            data-testid={`one-of-option-${branch.value}`}
+            sx={{ flex: '1 1 auto' }}
+          >
+            {branch.label}
+          </ToggleButton>
+        ))}
+      </ToggleButtonGroup>
+      {activeBranch.fields.map((field) => (
+        <ConditionalFieldSlot
+          key={field.name}
+          field={field}
+          renderField={renderField}
+        />
+      ))}
+    </Box>
+  );
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/SchemaFormRenderer.fieldErrors.test.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/SchemaFormRenderer.fieldErrors.test.tsx
new file mode 100644
index 00000000000..70f83fc9993
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/SchemaFormRenderer.fieldErrors.test.tsx
@@ -0,0 +1,206 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, expect, it, vi } from 'vitest';
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { useState, type ReactNode } from 'react';
+import type { FieldValidationError } from '@sep/api';
+import { SchemaFormRenderer } from './SchemaFormRenderer';
+import type { FormSection } from './types';
+
+function renderWithProviders(ui: ReactNode) {
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false, staleTime: Infinity } },
+  });
+  return render(
+    <QueryClientProvider client={queryClient}>{ui}</QueryClientProvider>
+  );
+}
+
+// One field per helperText-based component plus a choice field, to prove every
+// rendered field type surfaces its mapped error inline.
+const SECTIONS: FormSection[] = [
+  {
+    title: 'Task',
+    fields: [
+      { type: 'string', name: 'title', label: 'Title', description: 'A title' },
+      {
+        type: 'integer',
+        name: 'limit',
+        label: 'Row Limit',
+        description: 'Max rows',
+      },
+      {
+        type: 'choice',
+        name: 'mode',
+        label: 'Mode',
+        choices: [
+          { label: 'A', value: 'a' },
+          { label: 'B', value: 'b' },
+        ],
+      },
+    ],
+  },
+];
+
+describe('SchemaFormRenderer field errors', () => {
+  it('applies fieldErrors inline on helperText-based fields and shows the banner', async () => {
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={SECTIONS}
+        onSubmit={() => {}}
+        submitError={'Failed\n• Title: must not be blank'}
+        fieldErrors={[
+          { path: 'title', message: 'must not be blank' },
+          { path: 'limit', message: 'must be positive' },
+        ]}
+      />
+    );
+
+    await waitFor(() => {
+      expect(screen.getByText('must not be blank')).toBeInTheDocument();
+    });
+    // Inline error replaces the field description helperText on the string field.
+    expect(screen.queryByText('A title')).not.toBeInTheDocument();
+    // Integer (helperText) field also surfaces its mapped error.
+    expect(screen.getByText('must be positive')).toBeInTheDocument();
+    expect(screen.queryByText('Max rows')).not.toBeInTheDocument();
+    // Help icons remain while helperText shows the error; pin count + visible <label>.
+    expect(document.querySelectorAll('[data-help-for="Title"]')).toHaveLength(
+      2
+    );
+    expect(
+      document.querySelectorAll('label [data-help-for="Title"]')
+    ).toHaveLength(1);
+    expect(
+      document.querySelectorAll('[data-help-for="Row Limit"]')
+    ).toHaveLength(2);
+    expect(
+      document.querySelectorAll('label [data-help-for="Row Limit"]')
+    ).toHaveLength(1);
+    // The persistent banner is rendered.
+    expect(screen.getByText(/Failed/)).toBeInTheDocument();
+  });
+
+  it('clears a stale server error when a later submit no longer reports it', async () => {
+    function Wrapper() {
+      const [errors, setErrors] = useState<FieldValidationError[]>([
+        { path: 'title', message: 'title bad' },
+        { path: 'limit', message: 'limit bad' },
+      ]);
+      return (
+        <>
+          <button
+            type="button"
+            onClick={() => setErrors([{ path: 'limit', message: 'limit bad' }])}
+          >
+            resubmit
+          </button>
+          <SchemaFormRenderer
+            sections={SECTIONS}
+            onSubmit={() => {}}
+            fieldErrors={errors}
+          />
+        </>
+      );
+    }
+    renderWithProviders(<Wrapper />);
+
+    await waitFor(() =>
+      expect(screen.getByText('title bad')).toBeInTheDocument()
+    );
+
+    screen.getByText('resubmit').click();
+
+    await waitFor(() =>
+      expect(screen.queryByText('title bad')).not.toBeInTheDocument()
+    );
+    expect(screen.getByText('limit bad')).toBeInTheDocument();
+  });
+
+  it('keeps a rendered-field server error inline when a resubmit is blocked client-side', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    // `title` is required, so emptying it blocks the resubmit before onSubmit runs.
+    const sections: FormSection[] = [
+      {
+        title: 'Task',
+        fields: [
+          {
+            type: 'string',
+            name: 'title',
+            label: 'Title',
+            description: 'A title',
+            required: true,
+          },
+          {
+            type: 'integer',
+            name: 'limit',
+            label: 'Row Limit',
+            description: 'Max rows',
+          },
+        ],
+      },
+    ];
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={sections}
+        onSubmit={onSubmit}
+        submitLabel="Run"
+        fieldErrors={[{ path: 'limit', message: 'must be positive' }]}
+      />
+    );
+
+    await waitFor(() =>
+      expect(screen.getByText('must be positive')).toBeInTheDocument()
+    );
+
+    // Empty the required title field, then resubmit: the client-side gate blocks
+    // the submit, so the eager clear must not drop `limit`'s inline highlight.
+    // Prefer role+name: getByLabelText(/Title/) also matches "Help for Title".
+    await user.clear(screen.getByRole('textbox', { name: /Title/ }));
+    await user.click(screen.getByRole('button', { name: 'Run' }));
+
+    await waitFor(() =>
+      expect(screen.getByText('Title is required')).toBeInTheDocument()
+    );
+    expect(onSubmit).not.toHaveBeenCalled();
+    // `limit`'s server error survives the blocked resubmit, in sync with the banner.
+    expect(screen.getByText('must be positive')).toBeInTheDocument();
+  });
+
+  it('does not wedge resubmission when a fieldError lands on a non-rendered field', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={SECTIONS}
+        onSubmit={onSubmit}
+        submitLabel="Run"
+        // No 'ghost' field is rendered, so setError on it leaves an orphan in
+        // formState.errors that handleSubmit would otherwise refuse to step past.
+        fieldErrors={[{ path: 'ghost', message: 'rejected by server' }]}
+      />
+    );
+
+    await user.click(screen.getByRole('button', { name: 'Run' }));
+
+    await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/SchemaFormRenderer.spotCheck.test.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/SchemaFormRenderer.spotCheck.test.tsx
new file mode 100644
index 00000000000..a99a60074ad
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/SchemaFormRenderer.spotCheck.test.tsx
@@ -0,0 +1,292 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/**
+ * Spot-check: one representative form per SchemaFormRenderer consumer.
+ *
+ * Direct consumers: mysql_backups (via SchemaDrivenPlugin) and atw
+ * (CollectPane); SnippetExecutionAccordion covers the synthesised
+ * snippet-parameter path. Confirms help icons appear only on described fields
+ * and core inputs still mount — a regression guard for the framework-global
+ * label change.
+ */
+
+import { describe, expect, it, vi } from 'vitest';
+import { render, screen } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import type { ReactNode } from 'react';
+import { SchemaFormRenderer } from './SchemaFormRenderer';
+import type { FormSection } from './types';
+
+vi.mock('@sep/api', () => ({
+  apiClient: { get: vi.fn().mockResolvedValue({ data: [] }), post: vi.fn() },
+  useAlertConfig: () => ({ data: undefined, isLoading: false }),
+}));
+
+function renderWithProviders(ui: ReactNode) {
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false, staleTime: Infinity } },
+  });
+  return render(
+    <QueryClientProvider client={queryClient}>{ui}</QueryClientProvider>
+  );
+}
+
+function escapeAttrSelectorValue(value: string): string {
+  return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+
+function expectHelp(label: string, present: boolean) {
+  // Ignore the notched-outline legend clone so a legend-only render fails.
+  // Bool icons sit outside <label>, so we cannot scope to label alone.
+  const selector = `[data-help-for="${escapeAttrSelectorValue(label)}"]`;
+  const matches = [...document.querySelectorAll(selector)];
+  const visible = matches.filter(
+    (el) => !el.closest('.MuiOutlinedInput-notchedOutline')
+  );
+  if (present) {
+    expect(visible.length).toBeGreaterThan(0);
+  } else {
+    expect(matches).toHaveLength(0);
+  }
+}
+
+describe('SchemaFormRenderer — cross-plugin help-icon spot-check', () => {
+  it('mysql_backups-like create form: icons on described fields only', () => {
+    const sections: FormSection[] = [
+      {
+        title: 'Task',
+        fields: [
+          {
+            type: 'string',
+            name: 'db_host',
+            label: 'Database Host',
+            description: 'Host the backup connects to on the executor node.',
+          },
+          { type: 'string', name: 'server_alias', label: 'Server Alias' },
+        ],
+      },
+      {
+        title: 'General',
+        fields: [
+          {
+            type: 'choice',
+            name: 'storage_type',
+            label: 'Storage Type',
+            choices: [
+              { label: 'S3-compatible', value: 's3' },
+              { label: 'Filesystem', value: 'filesystem' },
+            ],
+          },
+          {
+            type: 'bool',
+            name: 'compress',
+            label: 'Compress backup data',
+            description: 'Compress the backup stream as it is written.',
+          },
+          { type: 'string', name: 'log_dir', label: 'Logging directory' },
+        ],
+      },
+      {
+        title: 'XtraBackup',
+        fields: [
+          {
+            type: 'bool',
+            name: 'xtrabackup_stop_replica',
+            label: 'Safe replica backup',
+            description:
+              'Passes --safe-slave-backup so xtrabackup pauses the replica SQL thread during the backup.',
+          },
+          {
+            type: 'integer',
+            name: 'xtrabackup_kill_queries_timeout',
+            label: 'Kill-queries timeout (s)',
+          },
+        ],
+      },
+    ];
+
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={() => {}} />
+    );
+
+    expect(screen.getByTestId('text-input-db_host')).toBeInTheDocument();
+    expect(screen.getByTestId('text-input-server_alias')).toBeInTheDocument();
+    expect(screen.getByTestId('switch-input-compress')).toBeInTheDocument();
+    expect(screen.getByTestId('text-input-log_dir')).toBeInTheDocument();
+    expect(
+      screen.getByTestId('switch-input-xtrabackup_stop_replica')
+    ).toBeInTheDocument();
+    expect(
+      screen.getByTestId('text-input-xtrabackup_kill_queries_timeout')
+    ).toBeInTheDocument();
+
+    expectHelp('Database Host', true);
+    expectHelp('Server Alias', false);
+    expectHelp('Compress backup data', true);
+    expectHelp('Logging directory', false);
+    expectHelp('Safe replica backup', true);
+    expectHelp('Kill-queries timeout (s)', false);
+  });
+
+  it('atw CollectPane-like form: shared section plus namespaced per-snippet overrides', () => {
+    // CollectPane shape: shared params, then namespaced per-snippet overrides.
+    const sections: FormSection[] = [
+      {
+        title: 'Shared parameters',
+        fields: [
+          {
+            type: 'host',
+            name: 'executor_host',
+            label: 'Execution Host',
+            required: true,
+          },
+          {
+            type: 'bool',
+            name: 'sudo',
+            label: 'Run with sudo',
+            description:
+              'Prepend sudo to the interpreter when the snippet is executed.',
+          },
+          {
+            type: 'integer',
+            name: 'minutes',
+            label: 'Lookback minutes',
+            description: 'Shared window applied to every selected snippet.',
+          },
+          { type: 'string', name: 'note', label: 'Operator note' },
+        ],
+      },
+      {
+        title: 'Disk usage check',
+        description: 'Reports free space on the executor host.',
+        collapsible: true,
+        fields: [
+          {
+            type: 'string',
+            name: 'overrides.snip0.path',
+            label: 'Path',
+            description: 'Filesystem path to inspect for this snippet only.',
+          },
+          {
+            type: 'integer',
+            name: 'overrides.snip0.threshold',
+            label: 'Threshold %',
+          },
+        ],
+      },
+    ];
+
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={() => {}} />
+    );
+
+    expect(screen.getByLabelText(/Execution Host/i)).toBeInTheDocument();
+    expect(screen.getByTestId('switch-input-sudo')).toBeInTheDocument();
+    expect(screen.getByTestId('text-input-minutes')).toBeInTheDocument();
+    expect(screen.getByTestId('text-input-note')).toBeInTheDocument();
+    expect(
+      screen.getByTestId('text-input-overrides.snip0.path')
+    ).toBeInTheDocument();
+    expect(
+      screen.getByTestId('text-input-overrides.snip0.threshold')
+    ).toBeInTheDocument();
+
+    expectHelp('Execution Host', false);
+    expectHelp('Run with sudo', true);
+    expectHelp('Lookback minutes', true);
+    expectHelp('Operator note', false);
+    expectHelp('Path', true);
+    expectHelp('Threshold %', false);
+  });
+
+  it('snippet-execution form: user-authored params drive help icons', () => {
+    // SnippetExecutionAccordion: user-authored params + Execution (sudo described, host not).
+    const sections: FormSection[] = [
+      {
+        title: 'Parameters',
+        fields: [
+          {
+            type: 'string',
+            name: 'table_name',
+            label: 'Table Name',
+            description: 'Table to inspect on the executor host.',
+          },
+          { type: 'string', name: 'database_name', label: 'Database Name' },
+          {
+            type: 'choice',
+            name: 'format',
+            label: 'Output format',
+            description: 'How to render the snippet result.',
+            // >3 choices use the select shell (help icon); ≤3 use radios + caption.
+            choices: [
+              { label: 'Plain text', value: 'text' },
+              { label: 'JSON', value: 'json' },
+              { label: 'CSV', value: 'csv' },
+              { label: 'YAML', value: 'yaml' },
+            ],
+          },
+          {
+            type: 'bool',
+            name: 'verbose',
+            label: 'Verbose',
+            description: 'Increase output verbosity.',
+          },
+          { type: 'integer', name: 'limit', label: 'Row limit' },
+        ],
+      },
+      {
+        title: 'Execution',
+        fields: [
+          {
+            type: 'host',
+            name: 'executor_host',
+            label: 'Execution Host',
+            required: true,
+          },
+          {
+            type: 'bool',
+            name: 'sudo',
+            label: 'Run with sudo',
+            description:
+              'Prepend sudo to the interpreter when the snippet is executed.',
+          },
+        ],
+      },
+    ];
+
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={() => {}} />
+    );
+
+    expect(screen.getByTestId('text-input-table_name')).toBeInTheDocument();
+    expect(screen.getByTestId('text-input-database_name')).toBeInTheDocument();
+    expect(screen.getByTestId('select-format-button')).toBeInTheDocument();
+    expect(screen.getByTestId('switch-input-verbose')).toBeInTheDocument();
+    expect(screen.getByTestId('text-input-limit')).toBeInTheDocument();
+    expect(screen.getByLabelText(/Execution Host/i)).toBeInTheDocument();
+    expect(screen.getByTestId('switch-input-sudo')).toBeInTheDocument();
+
+    expectHelp('Table Name', true);
+    expectHelp('Database Name', false);
+    expectHelp('Output format', true);
+    expectHelp('Verbose', true);
+    expectHelp('Row limit', false);
+    expectHelp('Execution Host', false);
+    expectHelp('Run with sudo', true);
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/SchemaFormRenderer.test.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/SchemaFormRenderer.test.tsx
new file mode 100644
index 00000000000..9eb57fdfeed
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/SchemaFormRenderer.test.tsx
@@ -0,0 +1,2727 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { beforeEach, describe, expect, it, onTestFinished, vi } from 'vitest';
+import { render, screen, waitFor, act } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { createMemoryRouter, RouterProvider } from 'react-router-dom';
+import { useState, type ReactNode } from 'react';
+import { useFormContext } from 'react-hook-form';
+import { SchemaFormRenderer } from './SchemaFormRenderer';
+import {
+  buildValidationRules,
+  coerceFormValues,
+} from './utils/validationMapper';
+import { evaluatePredicate, isPresent } from './utils/predicateEvaluator';
+import type { FormSection, RenderFieldOverride } from './types';
+
+const useAlertConfigMock = vi.fn();
+
+vi.mock('@sep/api', () => ({
+  apiClient: { get: vi.fn(), post: vi.fn() },
+  useAlertConfig: () => useAlertConfigMock(),
+}));
+import { apiClient } from '@sep/api';
+const mockedApi = apiClient as unknown as { get: ReturnType<typeof vi.fn> };
+
+function renderWithProviders(ui: ReactNode) {
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false, staleTime: Infinity } },
+  });
+  return render(
+    <QueryClientProvider client={queryClient}>{ui}</QueryClientProvider>
+  );
+}
+
+describe('buildValidationRules', () => {
+  it('emits required + minLength + maxLength + pattern for string fields', () => {
+    const rules = buildValidationRules({
+      type: 'string',
+      name: 'title',
+      label: 'Title',
+      required: true,
+      min_length: 3,
+      max_length: 10,
+      pattern: '^[a-z]+$',
+    });
+    expect(rules.required).toBe('Title is required');
+    expect(rules.minLength).toMatchObject({ value: 3 });
+    expect(rules.maxLength).toMatchObject({ value: 10 });
+    expect((rules.pattern as { value: RegExp }).value).toBeInstanceOf(RegExp);
+  });
+
+  it('emits min/max for integer ge/le', () => {
+    const rules = buildValidationRules({
+      type: 'integer',
+      name: 'n',
+      label: 'N',
+      ge: 1,
+      le: 5,
+    });
+    expect(rules.min).toMatchObject({ value: 1 });
+    expect(rules.max).toMatchObject({ value: 5 });
+  });
+
+  it('treats whitespace-only numeric input as empty', () => {
+    const optional = buildValidationRules({
+      type: 'integer',
+      name: 'n',
+      label: 'N',
+    }).validate as (value: unknown) => true | string;
+    expect(optional('   ')).toBe(true);
+
+    const required = buildValidationRules({
+      type: 'integer',
+      name: 'n',
+      label: 'N',
+      required: true,
+    }).validate as (value: unknown) => true | string;
+    expect(required('   ')).toBe('N is required');
+    expect(required(' 42 ')).toBe(true);
+    expect(required(' 4.2 ')).toBe('Enter a whole number');
+  });
+
+  it('emits a validate fn enforcing minItems/maxItems on multi_choice', () => {
+    const rules = buildValidationRules({
+      type: 'multi_choice',
+      name: 'tags',
+      label: 'Tags',
+      choices: [{ label: 'A', value: 'a' }],
+      min_items: 1,
+      max_items: 2,
+    });
+    const validate = rules.validate as (value: unknown) => true | string;
+    expect(validate([])).toMatch(/at least 1/);
+    expect(validate(['a'])).toBe(true);
+    expect(validate(['a', 'b', 'c'])).toMatch(/at most 2/);
+  });
+});
+
+describe('coerceFormValues', () => {
+  it('parses integer strings and coerces empty to undefined', () => {
+    const out = coerceFormValues({ age: '42', weight: '3.14', empty: '' }, [
+      { type: 'integer', name: 'age', label: 'Age' },
+      { type: 'float', name: 'weight', label: 'Weight' },
+      { type: 'integer', name: 'empty', label: 'Empty' },
+    ]);
+    expect(out.age).toBe(42);
+    expect(out.weight).toBeCloseTo(3.14);
+    expect(out.empty).toBeUndefined();
+  });
+
+  it('coerces whitespace-only numeric input to undefined instead of 0', () => {
+    const out = coerceFormValues({ age: '   ', weight: '\t\n' }, [
+      { type: 'integer', name: 'age', label: 'Age' },
+      { type: 'float', name: 'weight', label: 'Weight' },
+    ]);
+    expect(out.age).toBeUndefined();
+    expect(out.weight).toBeUndefined();
+  });
+
+  it('coerces padded numeric input to its numeric value', () => {
+    const out = coerceFormValues({ age: ' 42 ' }, [
+      { type: 'integer', name: 'age', label: 'Age' },
+    ]);
+    expect(out.age).toBe(42);
+  });
+
+  it('leaves non-numeric fields alone', () => {
+    const out = coerceFormValues({ title: 'hi', flag: true }, [
+      { type: 'string', name: 'title', label: 'Title' },
+      { type: 'bool', name: 'flag', label: 'Flag' },
+    ]);
+    expect(out).toEqual({ title: 'hi', flag: true });
+  });
+
+  it('passes through extra keys absent from fields (capability-injected fields)', () => {
+    const out = coerceFormValues({ title: 'x', alert_on_fail: true }, [
+      { type: 'string', name: 'title', label: 'Title' },
+    ]);
+    expect(out.alert_on_fail).toBe(true);
+  });
+
+  it('coerces nested dotted field paths', () => {
+    const out = coerceFormValues(
+      { source: { source_db_id: '42', source_query: '' } },
+      [
+        { type: 'integer', name: 'source.source_db_id', label: 'Schema' },
+        { type: 'string', name: 'source.source_query', label: 'Query' },
+      ]
+    );
+    expect(out).toEqual({ source: { source_db_id: 42, source_query: '' } });
+  });
+
+  it('unwraps option objects from service/schema/table/host fields to scalar ids', () => {
+    const out = coerceFormValues(
+      {
+        serviceId: { id: 7, name: 'svc', type: 'mysql' },
+        schemaName: { id: 11, name: 'app_prod' },
+        tbl: { id: 101, name: 'users' },
+        hostId: { id: 'nomad-1', name: 'db-mysql-01', address: '10.0.0.1' },
+        empty: '',
+      },
+      [
+        {
+          type: 'service',
+          name: 'serviceId',
+          label: 'Service',
+          service_types: [],
+        },
+        {
+          type: 'schema',
+          name: 'schemaName',
+          label: 'Schema',
+          depends_on: 'serviceId',
+        },
+        {
+          type: 'table',
+          name: 'tbl',
+          label: 'Table',
+          depends_on: 'schemaName',
+        },
+        { type: 'host', name: 'hostId', label: 'Host' },
+        { type: 'service', name: 'empty', label: 'Empty', service_types: [] },
+      ]
+    );
+    expect(out.serviceId).toBe(7);
+    expect(out.schemaName).toBe(11);
+    expect(out.tbl).toBe(101);
+    expect(out.hostId).toBe('nomad-1');
+    expect(out.empty).toBeUndefined();
+  });
+});
+
+describe('SchemaFormRenderer — field rendering', () => {
+  beforeEach(() => {
+    mockedApi.get.mockReset();
+    mockedApi.get.mockResolvedValue({ data: [] });
+  });
+
+  const sections: FormSection[] = [
+    {
+      title: 'Basics',
+      fields: [
+        {
+          type: 'string',
+          name: 'title',
+          label: 'Title',
+          required: true,
+          min_length: 3,
+        },
+        { type: 'integer', name: 'count', label: 'Count', ge: 1, le: 10 },
+        {
+          type: 'float',
+          name: 'rate',
+          label: 'Rate',
+          ge: 0,
+          le: 1,
+          step: 0.01,
+        },
+        { type: 'bool', name: 'active', label: 'Active' },
+        {
+          type: 'choice',
+          name: 'size',
+          label: 'Size',
+          choices: [
+            { label: 'Small', value: 's' },
+            { label: 'Medium', value: 'm' },
+            { label: 'Large', value: 'l' },
+            { label: 'Extra', value: 'xl' },
+          ],
+        },
+        {
+          type: 'multi_choice',
+          name: 'tags',
+          label: 'Tags',
+          choices: [
+            { label: 'Alpha', value: 'a' },
+            { label: 'Beta', value: 'b' },
+          ],
+        },
+        { type: 'textarea', name: 'notes', label: 'Notes' },
+        { type: 'datetime', name: 'when', label: 'When' },
+        { type: 'yaml', name: 'cfg', label: 'Config' },
+        { type: 'file', name: 'upload', label: 'Upload' },
+        {
+          type: 'table',
+          name: 'tbl',
+          label: 'Table',
+          depends_on: 'schemaName',
+        },
+        { type: 'host', name: 'hostId', label: 'Host' },
+      ],
+    },
+  ];
+
+  it('renders every declared field', () => {
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={() => {}} />
+    );
+    expect(screen.getByLabelText(/Title/)).toBeInTheDocument();
+    expect(screen.getByLabelText(/Count/)).toBeInTheDocument();
+    expect(screen.getByLabelText(/Rate/)).toBeInTheDocument();
+    expect(screen.getByLabelText(/Active/)).toBeInTheDocument();
+    // percona-ui's SelectInput does not expose the label as accessible name;
+    // identify by the stable MUI-generated id instead.
+    expect(document.getElementById('mui-component-select-size')).not.toBeNull();
+    expect(document.getElementById('mui-component-select-tags')).not.toBeNull();
+    expect(screen.getByLabelText(/Notes/)).toBeInTheDocument();
+    expect(screen.getByLabelText(/When/)).toBeInTheDocument();
+    expect(screen.getByLabelText(/Config/)).toBeInTheDocument();
+    // Exact match: the file picker button carries its own accessible name
+    // ("Select file for Upload"), which a /Upload/ pattern would also match.
+    expect(screen.getByLabelText('Upload')).toBeInTheDocument();
+    expect(
+      screen.getByRole('button', { name: 'Select file for Upload' })
+    ).toBeInTheDocument();
+    // ServiceSelector / SchemaSelector / TableSelector / HostSelector use
+    // percona-ui's AutoCompleteInput which renders a TextField — assert by label.
+    expect(screen.getByLabelText('Table')).toBeInTheDocument();
+    expect(screen.getByLabelText('Host')).toBeInTheDocument();
+  });
+
+  it('groups fields under section titles as fieldset legends', () => {
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={() => {}} />
+    );
+    const legend = screen.getByText('Basics');
+    expect(legend.tagName.toLowerCase()).toBe('legend');
+  });
+
+  it('shows a help icon only when a field has a description', () => {
+    const helpSections: FormSection[] = [
+      {
+        title: 'Basics',
+        fields: [
+          {
+            type: 'string',
+            name: 'title',
+            label: 'Title',
+            description: 'A title',
+          },
+          { type: 'string', name: 'code', label: 'Code' },
+        ],
+      },
+    ];
+    renderWithProviders(
+      <SchemaFormRenderer sections={helpSections} onSubmit={() => {}} />
+    );
+
+    // Notched-outline clone is aria-hidden; pin count + require a visible <label> hit.
+    expect(document.querySelectorAll('[data-help-for="Title"]')).toHaveLength(
+      2
+    );
+    expect(
+      document.querySelectorAll('label [data-help-for="Title"]')
+    ).toHaveLength(1);
+    expect(document.querySelectorAll('[data-help-for="Code"]')).toHaveLength(0);
+  });
+});
+
+describe('SchemaFormRenderer — section layout controls', () => {
+  const collapsedSections: FormSection[] = [
+    {
+      title: 'Script preview',
+      collapsible: true,
+      collapsed_by_default: true,
+      fields: [{ type: 'string', name: 'probe', label: 'Probe' }],
+    },
+  ];
+
+  it('renders render_after_submit sections after the submit button', () => {
+    const sections: FormSection[] = [
+      {
+        title: 'Before submit',
+        fields: [{ type: 'string', name: 'before', label: 'Before' }],
+      },
+      {
+        title: 'After submit',
+        render_after_submit: true,
+        fields: [{ type: 'string', name: 'after', label: 'After' }],
+      },
+    ];
+
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={() => {}} />
+    );
+
+    const beforeTitle = screen.getByText('Before submit');
+    const runButton = screen.getByRole('button', { name: 'Run' });
+    const afterTitle = screen.getByText('After submit');
+
+    expect(
+      beforeTitle.compareDocumentPosition(runButton) &
+        Node.DOCUMENT_POSITION_FOLLOWING
+    ).toBe(Node.DOCUMENT_POSITION_FOLLOWING);
+    expect(
+      runButton.compareDocumentPosition(afterTitle) &
+        Node.DOCUMENT_POSITION_FOLLOWING
+    ).toBe(Node.DOCUMENT_POSITION_FOLLOWING);
+  });
+
+  it('starts collapsed sections closed when collapsed_by_default is true', () => {
+    renderWithProviders(
+      <SchemaFormRenderer sections={collapsedSections} onSubmit={() => {}} />
+    );
+
+    expect(screen.queryByLabelText('Probe')).toBeNull();
+  });
+
+  it('mounts collapsible section content when expanded', async () => {
+    const user = userEvent.setup();
+
+    renderWithProviders(
+      <SchemaFormRenderer sections={collapsedSections} onSubmit={() => {}} />
+    );
+
+    await user.click(screen.getByRole('button', { name: 'Script preview' }));
+    expect(await screen.findByLabelText('Probe')).toBeInTheDocument();
+  });
+});
+
+describe('SchemaFormRenderer — validation + submission', () => {
+  it('blocks submission when a required field is empty and surfaces global banner', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    const sections: FormSection[] = [
+      {
+        title: 'Main',
+        fields: [
+          { type: 'string', name: 'title', label: 'Title', required: true },
+        ],
+      },
+    ];
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={onSubmit} />
+    );
+
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+    expect(onSubmit).not.toHaveBeenCalled();
+    expect(
+      await screen.findByText(/Fix the highlighted fields/)
+    ).toBeInTheDocument();
+    expect(screen.getByText(/Title is required/)).toBeInTheDocument();
+  });
+
+  it('submits coerced numeric values on valid input', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    const sections: FormSection[] = [
+      {
+        title: 'Main',
+        fields: [
+          { type: 'string', name: 'title', label: 'Title', required: true },
+          { type: 'integer', name: 'count', label: 'Count' },
+        ],
+      },
+    ];
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={onSubmit} />
+    );
+
+    await user.type(screen.getByLabelText(/Title/), 'hello');
+    await user.type(screen.getByLabelText(/Count/), '7');
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+
+    await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+    expect(onSubmit).toHaveBeenCalledWith(
+      expect.objectContaining({ title: 'hello', count: 7 })
+    );
+  });
+
+  it('renders the server submitError banner when provided', () => {
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={[
+          { title: 'x', fields: [{ type: 'string', name: 'a', label: 'A' }] },
+        ]}
+        onSubmit={() => {}}
+        submitError="Server exploded"
+      />
+    );
+    expect(screen.getByText('Server exploded')).toBeInTheDocument();
+  });
+});
+
+describe('SchemaFormRenderer — multi_choice minItems', () => {
+  it('blocks submission when selection count is below minItems', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    const sections: FormSection[] = [
+      {
+        title: 'Main',
+        fields: [
+          {
+            type: 'multi_choice',
+            name: 'tags',
+            label: 'Tags',
+            choices: [
+              { label: 'Alpha', value: 'a' },
+              { label: 'Beta', value: 'b' },
+            ],
+            min_items: 1,
+          },
+        ],
+      },
+    ];
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={onSubmit} />
+    );
+
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+    expect(onSubmit).not.toHaveBeenCalled();
+    expect(
+      await screen.findByText(/Fix the highlighted fields/)
+    ).toBeInTheDocument();
+    // percona-ui's SelectInput does not render the validate message visibly,
+    // but it does flip aria-invalid on the native input — use that as the
+    // end-to-end proof that the minItems validate fn ran and blocked submit.
+    await waitFor(() =>
+      expect(screen.getByTestId('select-input-tags')).toHaveAttribute(
+        'aria-invalid',
+        'true'
+      )
+    );
+  });
+});
+
+describe('SchemaFormRenderer — multi_choice required', () => {
+  it('blocks submission when a required multi_choice has the default empty array', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    const sections: FormSection[] = [
+      {
+        title: 'Upload',
+        fields: [
+          {
+            type: 'multi_choice',
+            name: 'upload',
+            label: 'Upload providers',
+            required: true,
+            choices: [
+              { label: 'S3', value: 'S3' },
+              { label: 'Rsync', value: 'RSYNC' },
+            ],
+          },
+        ],
+      },
+    ];
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={onSubmit} />
+    );
+
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+    expect(onSubmit).not.toHaveBeenCalled();
+    expect(
+      await screen.findByText(/Fix the highlighted fields/)
+    ).toBeInTheDocument();
+    await waitFor(() =>
+      expect(screen.getByTestId('select-input-upload')).toHaveAttribute(
+        'aria-invalid',
+        'true'
+      )
+    );
+  });
+});
+
+describe('SchemaFormRenderer — multi_choice empty-state placeholder', () => {
+  it('renders "Select…" placeholder when nothing is selected', () => {
+    const sections: FormSection[] = [
+      {
+        title: 'Upload',
+        fields: [
+          {
+            type: 'multi_choice',
+            name: 'upload',
+            label: 'Upload providers',
+            choices: [
+              { label: 'S3', value: 'S3' },
+              { label: 'Rsync', value: 'RSYNC' },
+            ],
+          },
+        ],
+      },
+    ];
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={vi.fn()} />
+    );
+    expect(screen.getByText('Select…')).toBeVisible();
+  });
+
+  it('does NOT render placeholder when at least one value is selected', () => {
+    const sections: FormSection[] = [
+      {
+        title: 'Upload',
+        fields: [
+          {
+            type: 'multi_choice',
+            name: 'upload',
+            label: 'Upload providers',
+            choices: [
+              { label: 'S3', value: 'S3' },
+              { label: 'Rsync', value: 'RSYNC' },
+            ],
+          },
+        ],
+      },
+    ];
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={sections}
+        onSubmit={vi.fn()}
+        defaultValues={{ upload: ['S3'] }}
+      />
+    );
+    expect(screen.queryByText('Select…')).toBeNull();
+    expect(screen.getByText('S3')).toBeVisible();
+  });
+});
+
+describe('SchemaFormRenderer — choice (select mode) empty-state placeholder', () => {
+  it('renders "Select…" when >3 choices and no value is chosen', () => {
+    const sections: FormSection[] = [
+      {
+        title: 'Main',
+        fields: [
+          {
+            type: 'choice',
+            name: 'region',
+            label: 'Region',
+            choices: [
+              { label: 'us-east-1', value: 'us-east-1' },
+              { label: 'us-west-2', value: 'us-west-2' },
+              { label: 'eu-west-1', value: 'eu-west-1' },
+              { label: 'ap-south-1', value: 'ap-south-1' },
+            ],
+          },
+        ],
+      },
+    ];
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={vi.fn()} />
+    );
+    expect(screen.getByText('Select…')).toBeVisible();
+  });
+
+  it('radio-mode branch (≤3 choices) does NOT add a placeholder', () => {
+    const sections: FormSection[] = [
+      {
+        title: 'Main',
+        fields: [
+          {
+            type: 'choice',
+            name: 'mode',
+            label: 'Mode',
+            choices: [
+              { label: 'Fast', value: 'fast' },
+              { label: 'Slow', value: 'slow' },
+            ],
+          },
+        ],
+      },
+    ];
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={vi.fn()} />
+    );
+    expect(screen.queryByText('Select…')).toBeNull();
+  });
+});
+
+describe('SchemaFormRenderer — multi_choice empty-state label shrink', () => {
+  it('floats the label above when nothing is selected (no overlap with placeholder)', () => {
+    const sections: FormSection[] = [
+      {
+        title: 'Upload',
+        fields: [
+          {
+            type: 'multi_choice',
+            name: 'upload',
+            label: 'Upload providers',
+            choices: [
+              { label: 'S3', value: 'S3' },
+              { label: 'Rsync', value: 'RSYNC' },
+            ],
+          },
+        ],
+      },
+    ];
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={vi.fn()} />
+    );
+    // MUI renders the label text in both <label> and the notched <legend>; pick the <label>.
+    const labelRoot = screen
+      .getAllByText('Upload providers')[0]
+      .closest('label');
+    expect(labelRoot).toHaveAttribute('data-shrink', 'true');
+    expect(labelRoot).toHaveClass('MuiInputLabel-shrink');
+  });
+});
+
+describe('SchemaFormRenderer — choice (select mode) empty-state label shrink', () => {
+  it('floats the label above on empty >3-choice select', () => {
+    const sections: FormSection[] = [
+      {
+        title: 'Main',
+        fields: [
+          {
+            type: 'choice',
+            name: 'region',
+            label: 'Region',
+            choices: [
+              { label: 'us-east-1', value: 'us-east-1' },
+              { label: 'us-west-2', value: 'us-west-2' },
+              { label: 'eu-west-1', value: 'eu-west-1' },
+              { label: 'ap-south-1', value: 'ap-south-1' },
+            ],
+          },
+        ],
+      },
+    ];
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={vi.fn()} />
+    );
+    const labelRoot = screen.getAllByText('Region')[0].closest('label');
+    expect(labelRoot).toHaveAttribute('data-shrink', 'true');
+    expect(labelRoot).toHaveClass('MuiInputLabel-shrink');
+  });
+});
+
+describe('SchemaFormRenderer — file required', () => {
+  it('blocks submission when a required file field is empty', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    const sections: FormSection[] = [
+      {
+        title: 'Main',
+        fields: [
+          { type: 'file', name: 'upload', label: 'Upload', required: true },
+        ],
+      },
+    ];
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={onSubmit} />
+    );
+
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+    expect(onSubmit).not.toHaveBeenCalled();
+    expect(
+      await screen.findByText(/Fix the highlighted fields/)
+    ).toBeInTheDocument();
+    expect(screen.getByText(/Upload is required/)).toBeInTheDocument();
+  });
+});
+
+describe('SchemaFormRenderer — cascade behaviour', () => {
+  beforeEach(() => {
+    mockedApi.get.mockReset();
+  });
+
+  it('clears downstream schema value when the upstream service changes', async () => {
+    mockedApi.get.mockImplementation((url: string) => {
+      if (url === '/sep/services/') {
+        return Promise.resolve({
+          data: {
+            items: [
+              { id: 1, name: 'mysql-prod-1', type: 'mysql' },
+              { id: 2, name: 'mysql-staging-1', type: 'mysql' },
+            ],
+            total: 2,
+            offset: 0,
+            limit: 200,
+          },
+        });
+      }
+      if (url === '/sep/services/1/schemas') {
+        return Promise.resolve({ data: [{ id: 11, name: 'app_production' }] });
+      }
+      if (url === '/sep/services/2/schemas') {
+        return Promise.resolve({ data: [{ id: 21, name: 'app_staging' }] });
+      }
+      return Promise.resolve({ data: [] });
+    });
+
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    const sections: FormSection[] = [
+      {
+        title: 'Target',
+        fields: [
+          {
+            type: 'service',
+            name: 'serviceId',
+            label: 'Service',
+            service_types: ['mysql'],
+          },
+          {
+            type: 'schema',
+            name: 'schemaName',
+            label: 'Schema',
+            depends_on: 'serviceId',
+          },
+        ],
+      },
+    ];
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={onSubmit} />
+    );
+
+    const serviceCombo = screen.getByLabelText('Service');
+    const schemaCombo = screen.getByLabelText('Schema');
+
+    // Wait for services to load.
+    await waitFor(() =>
+      expect(mockedApi.get).toHaveBeenCalledWith(
+        '/sep/services/',
+        expect.anything()
+      )
+    );
+
+    // Pick first service.
+    await user.click(serviceCombo);
+    const svcOption = await screen.findByRole('option', {
+      name: /mysql-prod-1/,
+    });
+    await user.click(svcOption);
+
+    // Schema fetch fires, dropdown becomes enabled.
+    await waitFor(() => expect(schemaCombo).not.toBeDisabled());
+
+    await user.click(schemaCombo);
+    const schemaOption = await screen.findByRole('option', {
+      name: 'app_production',
+    });
+    await user.click(schemaOption);
+    expect((schemaCombo as HTMLInputElement).value).toBe('app_production');
+
+    // Switch to another service — schema should be cleared by the cascade reset.
+    await user.click(serviceCombo);
+    const svc2 = await screen.findByRole('option', { name: /mysql-staging-1/ });
+    await user.click(svc2);
+
+    await waitFor(() => {
+      expect((schemaCombo as HTMLInputElement).value).toBe('');
+    });
+  });
+});
+
+// ── evaluatePredicate ──────────────────────────────────────────────────────
+
+describe('evaluatePredicate', () => {
+  const v = (overrides: Record<string, unknown>) => overrides;
+
+  it('truthy / falsy', () => {
+    expect(evaluatePredicate({ truthy: 'x' }, v({ x: 'yes' }))).toBe(true);
+    expect(evaluatePredicate({ truthy: 'x' }, v({ x: '' }))).toBe(false);
+    expect(evaluatePredicate({ falsy: 'x' }, v({ x: '' }))).toBe(true);
+    expect(evaluatePredicate({ falsy: 'x' }, v({ x: 1 }))).toBe(false);
+    expect(evaluatePredicate({ truthy: 'arr' }, v({ arr: ['a'] }))).toBe(true);
+    expect(evaluatePredicate({ truthy: 'arr' }, v({ arr: [] }))).toBe(false);
+    // empty plain objects are falsy — mirrors Python bool({}) = False
+    expect(evaluatePredicate({ truthy: 'obj' }, v({ obj: {} }))).toBe(false);
+    expect(evaluatePredicate({ truthy: 'obj' }, v({ obj: { k: 1 } }))).toBe(
+      true
+    );
+    expect(evaluatePredicate({ falsy: 'obj' }, v({ obj: {} }))).toBe(true);
+  });
+
+  it('equals / not_equals', () => {
+    expect(
+      evaluatePredicate(
+        { equals: { mode: 'advanced' } },
+        v({ mode: 'advanced' })
+      )
+    ).toBe(true);
+    expect(
+      evaluatePredicate({ equals: { mode: 'basic' } }, v({ mode: 'advanced' }))
+    ).toBe(false);
+    expect(
+      evaluatePredicate(
+        { not_equals: { mode: 'basic' } },
+        v({ mode: 'advanced' })
+      )
+    ).toBe(true);
+  });
+
+  it('equals with $field ref', () => {
+    expect(
+      evaluatePredicate(
+        { equals: { a: { $field: 'b' } } },
+        v({ a: 'x', b: 'x' })
+      )
+    ).toBe(true);
+    expect(
+      evaluatePredicate(
+        { equals: { a: { $field: 'b' } } },
+        v({ a: 'x', b: 'y' })
+      )
+    ).toBe(false);
+  });
+
+  it('equals / not_equals coerce numeric literals (RHF stores int inputs as strings)', () => {
+    // BE emits integer literals as JSON numbers; RHF stores text inputs as strings
+    expect(
+      evaluatePredicate({ equals: { swap_drop: 1 } }, v({ swap_drop: '1' }))
+    ).toBe(true);
+    expect(
+      evaluatePredicate({ equals: { swap_drop: 1 } }, v({ swap_drop: '0' }))
+    ).toBe(false);
+    expect(
+      evaluatePredicate({ not_equals: { swap_drop: 1 } }, v({ swap_drop: '0' }))
+    ).toBe(true);
+    expect(
+      evaluatePredicate({ not_equals: { swap_drop: 1 } }, v({ swap_drop: '1' }))
+    ).toBe(false);
+    // string literals still use strict equality (no coercion)
+    expect(
+      evaluatePredicate({ equals: { mode: 'dsn' } }, v({ mode: 'dsn' }))
+    ).toBe(true);
+    expect(
+      evaluatePredicate({ equals: { mode: 'dsn' } }, v({ mode: 'none' }))
+    ).toBe(false);
+  });
+
+  it('gt / gte / lt / lte', () => {
+    expect(evaluatePredicate({ gt: { n: 5 } }, v({ n: 6 }))).toBe(true);
+    expect(evaluatePredicate({ gt: { n: 5 } }, v({ n: 5 }))).toBe(false);
+    expect(evaluatePredicate({ gte: { n: 5 } }, v({ n: 5 }))).toBe(true);
+    expect(evaluatePredicate({ lt: { n: 5 } }, v({ n: 4 }))).toBe(true);
+    expect(evaluatePredicate({ lte: { n: 5 } }, v({ n: 5 }))).toBe(true);
+    // RHF stores text-input values as strings — coerce before comparing
+    expect(evaluatePredicate({ gt: { n: 5 } }, v({ n: '6' }))).toBe(true);
+    expect(evaluatePredicate({ gt: { n: 5 } }, v({ n: '10' }))).toBe(true); // would be false lexicographically
+    expect(evaluatePredicate({ lt: { n: 10 } }, v({ n: '9' }))).toBe(true); // "9" < "10" is false lexicographically
+  });
+
+  it('gt / gte / lt / lte with $field ref', () => {
+    expect(
+      evaluatePredicate({ gt: { a: { $field: 'b' } } }, v({ a: 6, b: 5 }))
+    ).toBe(true);
+    expect(
+      evaluatePredicate({ gt: { a: { $field: 'b' } } }, v({ a: 5, b: 5 }))
+    ).toBe(false);
+    expect(
+      evaluatePredicate({ gte: { a: { $field: 'b' } } }, v({ a: 5, b: 5 }))
+    ).toBe(true);
+    expect(
+      evaluatePredicate({ lt: { a: { $field: 'b' } } }, v({ a: 4, b: 5 }))
+    ).toBe(true);
+    expect(
+      evaluatePredicate({ lte: { a: { $field: 'b' } } }, v({ a: 5, b: 5 }))
+    ).toBe(true);
+  });
+
+  it('any_present / all_present / none_present', () => {
+    expect(
+      evaluatePredicate({ any_present: ['a', 'b'] }, v({ a: '', b: 'x' }))
+    ).toBe(true);
+    expect(
+      evaluatePredicate({ any_present: ['a', 'b'] }, v({ a: '', b: '' }))
+    ).toBe(false);
+    expect(
+      evaluatePredicate({ all_present: ['a', 'b'] }, v({ a: '1', b: '2' }))
+    ).toBe(true);
+    expect(
+      evaluatePredicate({ all_present: ['a', 'b'] }, v({ a: '1', b: '' }))
+    ).toBe(false);
+    expect(
+      evaluatePredicate({ none_present: ['a', 'b'] }, v({ a: '', b: '' }))
+    ).toBe(true);
+    expect(
+      evaluatePredicate({ none_present: ['a', 'b'] }, v({ a: 'x', b: '' }))
+    ).toBe(false);
+    // empty arrays are absent (mirrors BE behaviour for multiselect/list fields)
+    expect(evaluatePredicate({ any_present: ['tags'] }, v({ tags: [] }))).toBe(
+      false
+    );
+    expect(evaluatePredicate({ all_present: ['tags'] }, v({ tags: [] }))).toBe(
+      false
+    );
+    expect(evaluatePredicate({ none_present: ['tags'] }, v({ tags: [] }))).toBe(
+      true
+    );
+    expect(
+      evaluatePredicate({ any_present: ['tags'] }, v({ tags: ['x'] }))
+    ).toBe(true);
+    // empty plain objects are absent — mirrors BE _field_is_present({}) = False
+    expect(evaluatePredicate({ any_present: ['obj'] }, v({ obj: {} }))).toBe(
+      false
+    );
+    expect(
+      evaluatePredicate({ any_present: ['obj'] }, v({ obj: { k: 1 } }))
+    ).toBe(true);
+    // empty operand list → false (no vacuous truth)
+    expect(evaluatePredicate({ all_present: [] }, v({}))).toBe(false);
+    expect(evaluatePredicate({ none_present: [] }, v({}))).toBe(false);
+  });
+
+  it('all_truthy / any_truthy / all_falsy / any_falsy', () => {
+    expect(
+      evaluatePredicate({ all_truthy: ['a', 'b'] }, v({ a: 1, b: 2 }))
+    ).toBe(true);
+    expect(
+      evaluatePredicate({ all_truthy: ['a', 'b'] }, v({ a: 1, b: 0 }))
+    ).toBe(false);
+    expect(
+      evaluatePredicate({ any_truthy: ['a', 'b'] }, v({ a: 0, b: 1 }))
+    ).toBe(true);
+    expect(
+      evaluatePredicate({ all_falsy: ['a', 'b'] }, v({ a: 0, b: '' }))
+    ).toBe(true);
+    expect(
+      evaluatePredicate({ any_falsy: ['a', 'b'] }, v({ a: 1, b: 0 }))
+    ).toBe(true);
+    // empty operand list → false (no vacuous truth)
+    expect(evaluatePredicate({ all_truthy: [] }, v({}))).toBe(false);
+    expect(evaluatePredicate({ all_falsy: [] }, v({}))).toBe(false);
+  });
+
+  it('all_equal', () => {
+    expect(
+      evaluatePredicate(
+        { all_equal: ['a', 'b', 'c'] },
+        v({ a: 'x', b: 'x', c: 'x' })
+      )
+    ).toBe(true);
+    expect(
+      evaluatePredicate({ all_equal: ['a', 'b'] }, v({ a: 'x', b: 'y' }))
+    ).toBe(false);
+    // requires at least 2 fields — fewer returns false
+    expect(evaluatePredicate({ all_equal: [] }, v({}))).toBe(false);
+    expect(evaluatePredicate({ all_equal: ['a'] }, v({ a: 'x' }))).toBe(false);
+  });
+
+  it('all / any (logical combinators)', () => {
+    expect(
+      evaluatePredicate(
+        { all: [{ truthy: 'a' }, { truthy: 'b' }] },
+        v({ a: 1, b: 1 })
+      )
+    ).toBe(true);
+    expect(
+      evaluatePredicate(
+        { all: [{ truthy: 'a' }, { truthy: 'b' }] },
+        v({ a: 1, b: 0 })
+      )
+    ).toBe(false);
+    expect(
+      evaluatePredicate(
+        { any: [{ truthy: 'a' }, { truthy: 'b' }] },
+        v({ a: 0, b: 1 })
+      )
+    ).toBe(true);
+    // empty all combinator → false (no vacuous truth)
+    expect(evaluatePredicate({ all: [] }, v({}))).toBe(false);
+  });
+
+  it('xor — binary and n-ary (exactly one truthy)', () => {
+    // binary cases
+    expect(
+      evaluatePredicate(
+        { xor: [{ truthy: 'a' }, { truthy: 'b' }] },
+        v({ a: 1, b: 0 })
+      )
+    ).toBe(true);
+    expect(
+      evaluatePredicate(
+        { xor: [{ truthy: 'a' }, { truthy: 'b' }] },
+        v({ a: 1, b: 1 })
+      )
+    ).toBe(false);
+    expect(
+      evaluatePredicate(
+        { xor: [{ truthy: 'a' }, { truthy: 'b' }] },
+        v({ a: 0, b: 0 })
+      )
+    ).toBe(false);
+    // n-ary: exactly one of three
+    expect(
+      evaluatePredicate(
+        { xor: [{ truthy: 'a' }, { truthy: 'b' }, { truthy: 'c' }] },
+        v({ a: 1, b: 0, c: 0 })
+      )
+    ).toBe(true);
+    expect(
+      evaluatePredicate(
+        { xor: [{ truthy: 'a' }, { truthy: 'b' }, { truthy: 'c' }] },
+        v({ a: 1, b: 1, c: 0 })
+      )
+    ).toBe(false);
+    // empty → false
+    expect(evaluatePredicate({ xor: [] }, v({}))).toBe(false);
+  });
+
+  it('not', () => {
+    expect(evaluatePredicate({ not: { truthy: 'x' } }, v({ x: '' }))).toBe(
+      true
+    );
+    expect(evaluatePredicate({ not: { truthy: 'x' } }, v({ x: 'yes' }))).toBe(
+      false
+    );
+  });
+
+  it('returns false for unknown operator', () => {
+    expect(
+      evaluatePredicate({ unknown_op: 'x' } as Record<string, unknown>, v({}))
+    ).toBe(false);
+  });
+});
+
+// ── Conditional visibility (forbidden gates) ───────────────────────────────
+
+describe('SchemaFormRenderer — conditional visibility', () => {
+  const sections: FormSection[] = [
+    {
+      title: 'Main',
+      fields: [
+        { type: 'bool', name: 'advanced', label: 'Advanced mode' },
+        {
+          type: 'string',
+          name: 'advancedOption',
+          label: 'Advanced option',
+          forbidden: [{ when: { falsy: 'advanced' } }],
+        },
+      ],
+    },
+  ];
+
+  it('hides a field when its forbidden gate fires', () => {
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={() => {}} />
+    );
+    // advanced = false (default) → forbidden gate fires → advancedOption hidden
+    expect(screen.queryByLabelText('Advanced option')).toBeNull();
+  });
+
+  it('shows a field when its forbidden gate no longer fires', async () => {
+    const user = userEvent.setup();
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={() => {}} />
+    );
+
+    // Flip the bool — advanced becomes true → falsy('advanced') = false → gate doesn't fire
+    await user.click(screen.getByLabelText('Advanced mode'));
+    expect(await screen.findByLabelText('Advanced option')).toBeInTheDocument();
+  });
+
+  it('excludes hidden field from submission', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={onSubmit} />
+    );
+
+    // advanced=false → advancedOption hidden → submit without it
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+    await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+    expect(onSubmit).toHaveBeenCalledWith(
+      expect.not.objectContaining({ advancedOption: expect.anything() })
+    );
+  });
+
+  it('includes revealed field in submission', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={onSubmit} />
+    );
+
+    await user.click(screen.getByLabelText('Advanced mode'));
+    const input = await screen.findByLabelText('Advanced option');
+    await user.type(input, 'secret');
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+
+    await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+    expect(onSubmit).toHaveBeenCalledWith(
+      expect.objectContaining({ advancedOption: 'secret' })
+    );
+  });
+
+  // ── BoolField with a forbidden gate ──────────────────────────────────────
+  // Mirrors the SEP-1061 ``skip_s3_safety_check`` scenario: a bool field is
+  // visible only when the ``upload`` MultiChoice contains ``"S3"``. Locks in
+  // that ``isPresent(false) === false`` so the default does not trip the
+  // forbidden gate, and that the field is unregistered (omitted from the
+  // submit payload) when hidden.
+  const boolGateSections: FormSection[] = [
+    {
+      title: 'Upload',
+      fields: [
+        {
+          type: 'multi_choice',
+          name: 'upload',
+          label: 'Upload providers',
+          choices: [
+            { label: 'Rsync', value: 'RSYNC' },
+            { label: 'S3', value: 'S3' },
+          ],
+        },
+        {
+          type: 'bool',
+          name: 'skip_s3_safety_check',
+          label: 'Skip S3 safety check',
+          forbidden: [{ when: { not: { contains: { upload: 'S3' } } } }],
+        },
+      ],
+    },
+  ];
+
+  it('hides a BoolField when its upload-membership gate fires', () => {
+    renderWithProviders(
+      <SchemaFormRenderer sections={boolGateSections} onSubmit={() => {}} />
+    );
+    // upload defaults to [] → not contains "S3" → gate fires → checkbox hidden
+    expect(screen.queryByLabelText('Skip S3 safety check')).toBeNull();
+  });
+
+  it('omits a hidden BoolField from the submit payload (RHF unregister)', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={boolGateSections}
+        onSubmit={onSubmit}
+        defaultValues={{ upload: ['RSYNC'], skip_s3_safety_check: true }}
+      />
+    );
+
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+    await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+    expect(onSubmit).toHaveBeenCalledWith(
+      expect.not.objectContaining({ skip_s3_safety_check: expect.anything() })
+    );
+  });
+});
+
+describe('SchemaFormRenderer — storage type visibility', () => {
+  const sections: FormSection[] = [
+    {
+      title: 'Storage',
+      fields: [
+        {
+          type: 'choice',
+          name: 'storage_type',
+          label: 'Storage Type',
+          default: 's3',
+          choices: [
+            { label: 'S3-compatible', value: 's3' },
+            { label: 'Filesystem', value: 'filesystem' },
+          ],
+        },
+        {
+          type: 'string',
+          name: 'storage_s3_bucket',
+          label: 'S3 Bucket',
+          forbidden: [{ when: { not_equals: { storage_type: 's3' } } }],
+        },
+        {
+          type: 'string',
+          name: 'storage_filesystem_path',
+          label: 'Filesystem Path',
+          required: true,
+          forbidden: [{ when: { not_equals: { storage_type: 'filesystem' } } }],
+        },
+      ],
+    },
+  ];
+
+  it('shows S3 fields and hides filesystem when storage_type defaults to s3', () => {
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={() => {}} />
+    );
+    expect(
+      screen.getByTestId('text-input-storage_s3_bucket')
+    ).toBeInTheDocument();
+    expect(
+      screen.queryByTestId('text-input-storage_filesystem_path')
+    ).toBeNull();
+  });
+
+  it('shows filesystem and hides S3 when storage_type is filesystem', async () => {
+    const user = userEvent.setup();
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={() => {}} />
+    );
+
+    await user.click(screen.getByTestId('radio-option-filesystem'));
+    expect(
+      await screen.findByTestId('text-input-storage_filesystem_path')
+    ).toBeInTheDocument();
+    expect(screen.queryByTestId('text-input-storage_s3_bucket')).toBeNull();
+  });
+});
+
+// ── isPresent unit tests ───────────────────────────────────────────────────
+
+describe('isPresent', () => {
+  it('treats null / undefined / empty string as absent', () => {
+    expect(isPresent(null)).toBe(false);
+    expect(isPresent(undefined)).toBe(false);
+    expect(isPresent('')).toBe(false);
+  });
+
+  it('treats empty array as absent', () => {
+    expect(isPresent([])).toBe(false);
+    expect(isPresent(['x'])).toBe(true);
+  });
+
+  it('treats empty plain object as absent', () => {
+    expect(isPresent({})).toBe(false);
+    expect(isPresent({ k: 1 })).toBe(true);
+  });
+
+  it('treats non-empty scalars as present', () => {
+    expect(isPresent(0)).toBe(true);
+    expect(isPresent('x')).toBe(true);
+  });
+
+  it('treats false as absent so BoolField defaults do not trip forbidden gates', () => {
+    // Matches the backend convention: only an explicit `true` toggle counts
+    // as present. `0` stays present because numeric zero is a real value.
+    expect(isPresent(false)).toBe(false);
+    expect(isPresent(true)).toBe(true);
+  });
+});
+
+// ── Cardinality rules ──────────────────────────────────────────────────────
+
+describe('SchemaFormRenderer — cardinality_rules', () => {
+  it('shows a violation banner when neither required field is filled', async () => {
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={[
+          {
+            title: 'Source',
+            cardinality_rules: [
+              {
+                fields: ['source_db_id', 'source_table_id'],
+                min: 1,
+                max: 1,
+                message:
+                  'Specify exactly one source: either DB or Table, not both.',
+              },
+            ],
+            fields: [
+              { type: 'string', name: 'source_db_id', label: 'Source DB' },
+              {
+                type: 'string',
+                name: 'source_table_id',
+                label: 'Source Table',
+              },
+            ],
+          },
+        ]}
+        onSubmit={() => {}}
+      />
+    );
+
+    // Both fields empty at mount → violation fires immediately
+    expect(
+      await screen.findByText(
+        'Specify exactly one source: either DB or Table, not both.'
+      )
+    ).toBeInTheDocument();
+  });
+
+  it('clears the violation when exactly one field is filled', async () => {
+    const user = userEvent.setup();
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={[
+          {
+            title: 'Source',
+            cardinality_rules: [
+              {
+                fields: ['source_db_id', 'source_table_id'],
+                min: 1,
+                max: 1,
+                message: 'Specify exactly one source.',
+              },
+            ],
+            fields: [
+              { type: 'string', name: 'source_db_id', label: 'Source DB' },
+              {
+                type: 'string',
+                name: 'source_table_id',
+                label: 'Source Table',
+              },
+            ],
+          },
+        ]}
+        onSubmit={() => {}}
+      />
+    );
+
+    await user.type(screen.getByLabelText('Source DB'), 'mydb');
+    await waitFor(() =>
+      expect(
+        screen.queryByText('Specify exactly one source.')
+      ).not.toBeInTheDocument()
+    );
+  });
+
+  it('re-shows the violation when both fields are filled (exceeds max)', async () => {
+    const user = userEvent.setup();
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={[
+          {
+            title: 'Source',
+            cardinality_rules: [
+              {
+                fields: ['source_db_id', 'source_table_id'],
+                min: 1,
+                max: 1,
+                message: 'Specify exactly one source.',
+              },
+            ],
+            fields: [
+              { type: 'string', name: 'source_db_id', label: 'Source DB' },
+              {
+                type: 'string',
+                name: 'source_table_id',
+                label: 'Source Table',
+              },
+            ],
+          },
+        ]}
+        onSubmit={() => {}}
+      />
+    );
+
+    await user.type(screen.getByLabelText('Source DB'), 'db');
+    await user.type(screen.getByLabelText('Source Table'), 'tbl');
+    expect(
+      await screen.findByText('Specify exactly one source.')
+    ).toBeInTheDocument();
+  });
+
+  it('blocks submission when a cardinality violation is active', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={[
+          {
+            title: 'Source',
+            cardinality_rules: [
+              { fields: ['a', 'b'], min: 1, max: 1, message: 'Exactly one.' },
+            ],
+            fields: [
+              { type: 'string', name: 'a', label: 'A' },
+              { type: 'string', name: 'b', label: 'B' },
+            ],
+          },
+        ]}
+        onSubmit={onSubmit}
+      />
+    );
+
+    // Both empty → violation active → submit blocked
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+    expect(onSubmit).not.toHaveBeenCalled();
+  });
+
+  it('keeps the unsaved-changes guard armed when a violation blocks submission', async () => {
+    const user = userEvent.setup();
+    const removeEventListener = vi.spyOn(window, 'removeEventListener');
+    // Restored in teardown, not inline: a failing assertion below would
+    // otherwise leave the spy installed for the rest of the file.
+    onTestFinished(() => removeEventListener.mockRestore());
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={[
+          {
+            title: 'Source',
+            cardinality_rules: [
+              { fields: ['a', 'b'], min: 1, max: 1, message: 'Exactly one.' },
+            ],
+            fields: [
+              { type: 'string', name: 'a', label: 'A' },
+              { type: 'string', name: 'b', label: 'B' },
+            ],
+          },
+        ]}
+        onSubmit={vi.fn()}
+      />
+    );
+
+    // Dirty the form, then trip the max=1 violation so the submit is blocked.
+    await user.type(screen.getByLabelText('A'), 'one');
+    await user.type(screen.getByLabelText('B'), 'two');
+    removeEventListener.mockClear();
+
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+
+    // A blocked submit must not read as a successful one: react-hook-form would
+    // set isSubmitSuccessful, `useUnsavedChangesGuard` would go false, and its
+    // cleanup would drop the beforeunload listener while the form is still dirty.
+    expect(removeEventListener).not.toHaveBeenCalledWith(
+      'beforeunload',
+      expect.any(Function)
+    );
+  });
+
+  it('allows submission when cardinality is satisfied', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={[
+          {
+            title: 'Source',
+            cardinality_rules: [
+              { fields: ['a', 'b'], min: 1, max: 1, message: 'Exactly one.' },
+            ],
+            fields: [
+              { type: 'string', name: 'a', label: 'A' },
+              { type: 'string', name: 'b', label: 'B' },
+            ],
+          },
+        ]}
+        onSubmit={onSubmit}
+      />
+    );
+
+    await user.type(screen.getByLabelText('A'), 'hello');
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+    await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+  });
+
+  it('respects the when predicate — skips rule when guard is inactive', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={[
+          {
+            title: 'Conditional',
+            cardinality_rules: [
+              {
+                when: { truthy: 'enable' },
+                fields: ['a', 'b'],
+                min: 1,
+                max: 1,
+                message: 'Exactly one when enabled.',
+              },
+            ],
+            fields: [
+              { type: 'bool', name: 'enable', label: 'Enable' },
+              { type: 'string', name: 'a', label: 'A' },
+              { type: 'string', name: 'b', label: 'B' },
+            ],
+          },
+        ]}
+        onSubmit={onSubmit}
+      />
+    );
+
+    // enable=false → guard inactive → no violation → submit succeeds
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+    await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+  });
+
+  it('uses a default message when none is provided', async () => {
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={[
+          {
+            title: 'S',
+            cardinality_rules: [{ fields: ['a', 'b'], min: 1 }],
+            fields: [
+              { type: 'string', name: 'a', label: 'A' },
+              { type: 'string', name: 'b', label: 'B' },
+            ],
+          },
+        ]}
+        onSubmit={() => {}}
+      />
+    );
+
+    // Both empty → min=1 violation → default message rendered
+    expect(
+      await screen.findByText(/At least 1 of these 2 fields/)
+    ).toBeInTheDocument();
+  });
+});
+
+// ── fail_when rules ───────────────────────────────────────────────────────
+
+describe('SchemaFormRenderer — fail_when', () => {
+  it('shows a violation banner when the fail_when predicate fires', async () => {
+    const user = userEvent.setup();
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={[
+          {
+            title: 'S',
+            fail_when: [
+              {
+                fail_when: { truthy: 'flag' },
+                error_fields: ['flag'],
+                message: 'Flag must not be set.',
+              },
+            ],
+            fields: [{ type: 'bool', name: 'flag', label: 'Flag' }],
+          },
+        ]}
+        onSubmit={() => {}}
+      />
+    );
+
+    // flag=false at mount → predicate inactive → no banner
+    expect(screen.queryByText('Flag must not be set.')).toBeNull();
+
+    // flip flag → predicate fires → banner appears
+    await user.click(screen.getByLabelText('Flag'));
+    expect(
+      await screen.findByText('Flag must not be set.')
+    ).toBeInTheDocument();
+  });
+
+  it('clears the banner when the predicate stops firing', async () => {
+    const user = userEvent.setup();
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={[
+          {
+            title: 'S',
+            fail_when: [
+              {
+                fail_when: { truthy: 'flag' },
+                error_fields: ['flag'],
+                message: 'Flag must not be set.',
+              },
+            ],
+            fields: [{ type: 'bool', name: 'flag', label: 'Flag' }],
+          },
+        ]}
+        onSubmit={() => {}}
+      />
+    );
+
+    await user.click(screen.getByLabelText('Flag'));
+    expect(
+      await screen.findByText('Flag must not be set.')
+    ).toBeInTheDocument();
+
+    // flip back → predicate inactive → banner gone
+    await user.click(screen.getByLabelText('Flag'));
+    await waitFor(() =>
+      expect(
+        screen.queryByText('Flag must not be set.')
+      ).not.toBeInTheDocument()
+    );
+  });
+
+  it('blocks submission when a fail_when rule is active', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={[
+          {
+            title: 'S',
+            fail_when: [
+              {
+                fail_when: { truthy: 'flag' },
+                error_fields: ['flag'],
+                message: 'Blocked.',
+              },
+            ],
+            fields: [{ type: 'bool', name: 'flag', label: 'Flag' }],
+          },
+        ]}
+        onSubmit={onSubmit}
+      />
+    );
+
+    await user.click(screen.getByLabelText('Flag'));
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+    expect(onSubmit).not.toHaveBeenCalled();
+  });
+
+  it('uses a default message when none is provided', async () => {
+    const user = userEvent.setup();
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={[
+          {
+            title: 'S',
+            fail_when: [{ fail_when: { truthy: 'x' }, error_fields: [] }],
+            fields: [{ type: 'bool', name: 'x', label: 'X' }],
+          },
+        ]}
+        onSubmit={() => {}}
+      />
+    );
+
+    await user.click(screen.getByLabelText('X'));
+    expect(
+      await screen.findByText('This combination of values is not allowed.')
+    ).toBeInTheDocument();
+  });
+
+  it('shows both cardinality and fail_when violations together', async () => {
+    const user = userEvent.setup();
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={[
+          {
+            title: 'S',
+            cardinality_rules: [
+              { fields: ['a', 'b'], min: 1, message: 'Need at least one.' },
+            ],
+            fail_when: [
+              {
+                fail_when: { all_present: ['a', 'b'] },
+                error_fields: ['a', 'b'],
+                message: 'Cannot have both.',
+              },
+            ],
+            fields: [
+              { type: 'string', name: 'a', label: 'A' },
+              { type: 'string', name: 'b', label: 'B' },
+            ],
+          },
+        ]}
+        onSubmit={() => {}}
+      />
+    );
+
+    // Both empty → cardinality fires, fail_when inactive
+    expect(await screen.findByText('Need at least one.')).toBeInTheDocument();
+    expect(screen.queryByText('Cannot have both.')).toBeNull();
+
+    // Fill both → cardinality satisfied, fail_when fires
+    await user.type(screen.getByLabelText('A'), 'x');
+    await user.type(screen.getByLabelText('B'), 'y');
+    await waitFor(() =>
+      expect(screen.queryByText('Need at least one.')).not.toBeInTheDocument()
+    );
+    expect(await screen.findByText('Cannot have both.')).toBeInTheDocument();
+  });
+});
+
+// ── Conditional required (requires gates) ─────────────────────────────────
+
+describe('SchemaFormRenderer — conditional required', () => {
+  const sections: FormSection[] = [
+    {
+      title: 'Main',
+      fields: [
+        { type: 'bool', name: 'needsReason', label: 'Needs reason' },
+        {
+          type: 'string',
+          name: 'reason',
+          label: 'Reason',
+          requires: [{ when: { truthy: 'needsReason' } }],
+        },
+      ],
+    },
+  ];
+
+  it('does not block submission when gate is inactive', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={onSubmit} />
+    );
+
+    // needsReason=false → requires gate inactive → reason not required
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+    await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+  });
+
+  it('blocks submission and shows required error when gate fires and field is empty', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={onSubmit} />
+    );
+
+    await user.click(screen.getByLabelText('Needs reason'));
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+
+    expect(onSubmit).not.toHaveBeenCalled();
+    expect(await screen.findByText(/Reason is required/)).toBeInTheDocument();
+  });
+
+  it('submits when gate fires and field is filled', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={onSubmit} />
+    );
+
+    await user.click(screen.getByLabelText('Needs reason'));
+    // Use data-testid (set by percona-ui's TextInput) to find the input directly,
+    // since the label-for association is briefly stale while isRequired flips.
+    await user.type(screen.getByTestId('text-input-reason'), 'because');
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+
+    await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+    expect(onSubmit).toHaveBeenCalledWith(
+      expect.objectContaining({ reason: 'because', needsReason: true })
+    );
+  });
+});
+
+// ── capabilities.alert_on_fail ────────────────────────────────────────────
+
+describe('SchemaFormRenderer — capabilities.alert_on_fail', () => {
+  const sections: FormSection[] = [
+    {
+      title: 'Main',
+      fields: [{ type: 'string', name: 'title', label: 'Title' }],
+    },
+  ];
+
+  beforeEach(() => {
+    useAlertConfigMock.mockReset();
+  });
+
+  it('renders AlertOnFailField when capabilities.alert_on_fail is true', () => {
+    useAlertConfigMock.mockReturnValue({
+      data: { available: true },
+      isLoading: false,
+      isError: false,
+    });
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={sections}
+        onSubmit={() => {}}
+        capabilities={{ alert_on_fail: true }}
+      />
+    );
+    expect(
+      screen.getByRole('checkbox', { name: /Alert on failure/i })
+    ).toBeInTheDocument();
+  });
+
+  it('does not render AlertOnFailField when capabilities.alert_on_fail is false', () => {
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={sections}
+        onSubmit={() => {}}
+        capabilities={{ alert_on_fail: false }}
+      />
+    );
+    expect(
+      screen.queryByRole('checkbox', { name: /Alert on failure/i })
+    ).toBeNull();
+  });
+
+  it('does not render AlertOnFailField when capabilities is undefined', () => {
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={() => {}} />
+    );
+    expect(
+      screen.queryByRole('checkbox', { name: /Alert on failure/i })
+    ).toBeNull();
+  });
+
+  it('renders the field disabled when no alert provider is configured', () => {
+    useAlertConfigMock.mockReturnValue({
+      data: { available: false },
+      isLoading: false,
+      isError: false,
+    });
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={sections}
+        onSubmit={() => {}}
+        capabilities={{ alert_on_fail: true }}
+      />
+    );
+    expect(
+      screen.getByRole('checkbox', { name: /Alert on failure/i })
+    ).toBeDisabled();
+  });
+
+  it('submits alert_on_fail: false by default', async () => {
+    useAlertConfigMock.mockReturnValue({
+      data: { available: true },
+      isLoading: false,
+      isError: false,
+    });
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={sections}
+        onSubmit={onSubmit}
+        capabilities={{ alert_on_fail: true }}
+      />
+    );
+
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+    await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+    expect(onSubmit).toHaveBeenCalledWith(
+      expect.objectContaining({ alert_on_fail: false })
+    );
+  });
+
+  it('submits alert_on_fail: true when user checks the field', async () => {
+    useAlertConfigMock.mockReturnValue({
+      data: { available: true },
+      isLoading: false,
+      isError: false,
+    });
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={sections}
+        onSubmit={onSubmit}
+        capabilities={{ alert_on_fail: true }}
+      />
+    );
+
+    await user.click(
+      screen.getByRole('checkbox', { name: /Alert on failure/i })
+    );
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+    await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+    expect(onSubmit).toHaveBeenCalledWith(
+      expect.objectContaining({ alert_on_fail: true })
+    );
+  });
+});
+
+// ── Unsaved changes guard (integration) ──────────────────────────────────────
+
+const GUARD_SECTIONS: FormSection[] = [
+  {
+    title: 'Main',
+    fields: [{ type: 'string', name: 'title', label: 'Title' }],
+  },
+];
+
+/**
+ * Renders SchemaFormRenderer inside a createMemoryRouter so that useBlocker
+ * (and therefore the in-app navigation guard) is active.
+ */
+function renderWithRouter(
+  ui: ReactNode,
+  { initialPath = '/form' }: { initialPath?: string } = {}
+) {
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false, staleTime: Infinity } },
+  });
+  const router = createMemoryRouter(
+    [
+      { path: '/form', element: ui },
+      { path: '/other', element: <div>Other page</div> },
+    ],
+    { initialEntries: [initialPath] }
+  );
+  return {
+    router,
+    ...render(
+      <QueryClientProvider client={queryClient}>
+        <RouterProvider router={router} />
+      </QueryClientProvider>
+    ),
+  };
+}
+
+describe('SchemaFormRenderer — unsaved changes guard', () => {
+  beforeEach(() => {
+    useAlertConfigMock.mockReset();
+    useAlertConfigMock.mockReturnValue({
+      data: { available: false },
+      isLoading: false,
+    });
+  });
+
+  it('AC#6 — renders without crash outside a Data Router', () => {
+    // When SchemaFormRenderer is mounted without a router context (e.g. inside
+    // a unit test that uses renderWithProviders) the in-app blocker is skipped
+    // but the component should still mount and render normally.
+    renderWithProviders(
+      <SchemaFormRenderer sections={GUARD_SECTIONS} onSubmit={() => {}} />
+    );
+    expect(screen.getByLabelText('Title')).toBeInTheDocument();
+    expect(screen.queryByRole('dialog')).toBeNull();
+  });
+
+  it('AC#3 — does not block navigation when form is clean', async () => {
+    const { router } = renderWithRouter(
+      <SchemaFormRenderer sections={GUARD_SECTIONS} onSubmit={() => {}} />
+    );
+
+    act(() => {
+      router.navigate('/other');
+    });
+
+    expect(await screen.findByText('Other page')).toBeInTheDocument();
+  });
+
+  it('AC#1 — shows confirmation dialog when dirty form navigates away', async () => {
+    const user = userEvent.setup();
+    const { router } = renderWithRouter(
+      <SchemaFormRenderer sections={GUARD_SECTIONS} onSubmit={() => {}} />
+    );
+
+    await user.type(screen.getByLabelText('Title'), 'hello');
+    act(() => {
+      router.navigate('/other');
+    });
+
+    expect(await screen.findByRole('dialog')).toBeInTheDocument();
+    expect(
+      screen.getByRole('heading', { name: /unsaved changes/i })
+    ).toBeInTheDocument();
+    expect(screen.queryByText('Other page')).toBeNull();
+  });
+
+  it('AC#1 — Stay button cancels navigation and keeps form state intact', async () => {
+    const user = userEvent.setup();
+    const { router } = renderWithRouter(
+      <SchemaFormRenderer sections={GUARD_SECTIONS} onSubmit={() => {}} />
+    );
+
+    await user.type(screen.getByLabelText('Title'), 'hello');
+    act(() => {
+      router.navigate('/other');
+    });
+
+    await screen.findByRole('dialog');
+    await user.click(screen.getByRole('button', { name: /stay/i }));
+
+    await waitFor(() => expect(screen.queryByRole('dialog')).toBeNull());
+    expect(screen.queryByText('Other page')).toBeNull();
+    expect((screen.getByLabelText('Title') as HTMLInputElement).value).toBe(
+      'hello'
+    );
+  });
+
+  it('AC#1 — Discard changes button proceeds with navigation', async () => {
+    const user = userEvent.setup();
+    const { router } = renderWithRouter(
+      <SchemaFormRenderer sections={GUARD_SECTIONS} onSubmit={() => {}} />
+    );
+
+    await user.type(screen.getByLabelText('Title'), 'hello');
+    act(() => {
+      router.navigate('/other');
+    });
+
+    await screen.findByRole('dialog');
+    await user.click(screen.getByRole('button', { name: /discard/i }));
+
+    expect(await screen.findByText('Other page')).toBeInTheDocument();
+  });
+
+  it('AC#4 — does not block navigation after successful submit', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    const { router } = renderWithRouter(
+      <SchemaFormRenderer
+        sections={GUARD_SECTIONS}
+        onSubmit={onSubmit}
+        submitLabel="Save"
+      />
+    );
+
+    await user.type(screen.getByLabelText('Title'), 'hello');
+    await user.click(screen.getByRole('button', { name: /save/i }));
+    await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+
+    act(() => {
+      router.navigate('/other');
+    });
+
+    expect(await screen.findByText('Other page')).toBeInTheDocument();
+  });
+
+  it('AC#5 — re-arms guard after failed async mutation (submitError set after submit)', async () => {
+    const user = userEvent.setup();
+
+    // FormWithMutationError simulates a parent that sets submitError after its
+    // async mutation rejects. onSubmit returns synchronously (no throw), so
+    // RHF marks isSubmitSuccessful=true — then submitError is set to re-arm.
+    function FormWithMutationError() {
+      const [submitError, setSubmitError] = useState<string | null>(null);
+      return (
+        <SchemaFormRenderer
+          sections={GUARD_SECTIONS}
+          onSubmit={() => {
+            setSubmitError('Mutation failed');
+          }}
+          submitError={submitError}
+          submitLabel="Save"
+        />
+      );
+    }
+
+    const { router } = renderWithRouter(<FormWithMutationError />);
+
+    await user.type(screen.getByLabelText('Title'), 'hello');
+    await user.click(screen.getByRole('button', { name: /save/i }));
+    await waitFor(() =>
+      expect(screen.getByText('Mutation failed')).toBeInTheDocument()
+    );
+    // Flush effects from reset() so the blocker re-registers on the router
+    await act(async () => {});
+
+    // Guard must be re-armed: navigation should now prompt.
+    act(() => {
+      router.navigate('/other');
+    });
+    expect(await screen.findByRole('dialog')).toBeInTheDocument();
+  });
+});
+
+// ── Section-level visibility gates (SEP-1276) ────────────────────────────
+//
+// Mirrors the MySQL Backups Mydumper/XtraBackup/Binlog regression: a
+// FormSection declares a ``forbidden`` gate keyed off a controller field
+// elsewhere in the form (in production, ``backup_type``). The section,
+// its header, and every child field must disappear from the DOM when the
+// gate fires, and the children must be unregistered from RHF so stale
+// defaults do not ship in the submission payload.
+//
+// Mode-owned bool fields are intentionally not field-gated in the
+// MySQL Backups schema (module docstring): ``_field_is_present(False)``
+// is ``True``, so a per-field ``forbidden=[when != mode]`` would reject
+// the legitimate default-False. The whole point of section-level gating
+// is to cover those bool fields too — the tests below pin that behaviour
+// by hiding a section whose child is a bool with default ``false``.
+
+describe('SchemaFormRenderer — section-level visibility', () => {
+  const sections: FormSection[] = [
+    {
+      title: 'Mode',
+      fields: [
+        {
+          type: 'choice',
+          name: 'backup_type',
+          label: 'Backup Type',
+          choices: [
+            { label: 'Mydumper backup', value: 'M' },
+            { label: 'XtraBackup backup', value: 'X' },
+          ],
+        },
+      ],
+    },
+    {
+      title: 'Mydumper',
+      forbidden: [{ when: { not_equals: { backup_type: 'M' } } }],
+      fields: [
+        {
+          type: 'string',
+          name: 'mydumper_extra_args',
+          label: 'Mydumper extra args',
+        },
+        // Mode-owned bool — has no field-level forbidden gate by design.
+        {
+          type: 'bool',
+          name: 'mydumper_dump_triggers',
+          label: 'Dump triggers',
+          default: false,
+        },
+      ],
+    },
+    {
+      title: 'XtraBackup',
+      forbidden: [{ when: { not_equals: { backup_type: 'X' } } }],
+      fields: [
+        {
+          type: 'string',
+          name: 'xtrabackup_extra_args',
+          label: 'XtraBackup extra args',
+        },
+        {
+          type: 'bool',
+          name: 'xtrabackup_kill_queries',
+          label: 'Kill blocking queries',
+          default: false,
+        },
+      ],
+    },
+  ];
+
+  it('hides every mode section when the controller is unset (initial form load)', () => {
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={() => {}} />
+    );
+    expect(screen.queryByText('Mydumper')).toBeNull();
+    expect(screen.queryByText('XtraBackup')).toBeNull();
+    expect(screen.queryByLabelText('Mydumper extra args')).toBeNull();
+    expect(screen.queryByLabelText('Dump triggers')).toBeNull();
+    expect(screen.queryByLabelText('XtraBackup extra args')).toBeNull();
+    expect(screen.queryByLabelText('Kill blocking queries')).toBeNull();
+  });
+
+  it('shows only the matching mode section after picking a backup type', async () => {
+    const user = userEvent.setup();
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={() => {}} />
+    );
+
+    await user.click(screen.getByTestId('radio-option-M'));
+
+    expect(await screen.findByText('Mydumper')).toBeInTheDocument();
+    expect(
+      await screen.findByLabelText('Mydumper extra args')
+    ).toBeInTheDocument();
+    expect(await screen.findByLabelText('Dump triggers')).toBeInTheDocument();
+    expect(screen.queryByText('XtraBackup')).toBeNull();
+    expect(screen.queryByLabelText('XtraBackup extra args')).toBeNull();
+    expect(screen.queryByLabelText('Kill blocking queries')).toBeNull();
+  });
+
+  it('excludes hidden-section children (incl. mode-owned bools) from the submit payload', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={sections}
+        onSubmit={onSubmit}
+        defaultValues={{
+          backup_type: 'M',
+          mydumper_extra_args: 'preserved',
+          xtrabackup_extra_args: 'should-not-ship',
+          xtrabackup_kill_queries: true,
+        }}
+      />
+    );
+
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+    await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+
+    const payload = onSubmit.mock.calls[0]?.[0];
+    expect(payload).toMatchObject({
+      backup_type: 'M',
+      mydumper_extra_args: 'preserved',
+    });
+    expect(payload).not.toHaveProperty('xtrabackup_extra_args');
+    expect(payload).not.toHaveProperty('xtrabackup_kill_queries');
+  });
+
+  it('drops stale values when the user toggles mode then submits immediately', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={onSubmit} />
+    );
+
+    // Pick XtraBackup, type a value, then flip to Mydumper before submitting.
+    await user.click(screen.getByTestId('radio-option-X'));
+    const xtraInput = await screen.findByLabelText('XtraBackup extra args');
+    await user.type(xtraInput, 'leaked');
+    await user.click(screen.getByTestId('radio-option-M'));
+
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+    await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+
+    const payload = onSubmit.mock.calls[0]?.[0];
+    expect(payload).toMatchObject({ backup_type: 'M' });
+    expect(payload).not.toHaveProperty('xtrabackup_extra_args');
+    expect(payload).not.toHaveProperty('xtrabackup_kill_queries');
+  });
+
+  it('re-mounts a section with schema defaults after toggling away and back', async () => {
+    const user = userEvent.setup();
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={() => {}} />
+    );
+
+    // Show Mydumper, type a value, hide via XtraBackup, then re-show Mydumper.
+    await user.click(screen.getByTestId('radio-option-M'));
+    const mydumperInput = await screen.findByLabelText('Mydumper extra args');
+    await user.type(mydumperInput, 'old-value');
+    await user.click(screen.getByTestId('radio-option-X'));
+    expect(screen.queryByLabelText('Mydumper extra args')).toBeNull();
+    await user.click(screen.getByTestId('radio-option-M'));
+
+    const reshown = await screen.findByLabelText('Mydumper extra args');
+    expect((reshown as HTMLInputElement).value).toBe('');
+  });
+});
+
+// ── multi_choice discriminator regression (SEP-1293) ─────────────────────────
+//
+// Guards against future drift between the hand-maintained `MultiChoiceField.type`
+// literal in plugin-schema.ts and the switch branches that consume it. A wrong
+// literal silently falls through to `default: return null` — these tests make
+// that failure loud.
+
+describe('SchemaFormRenderer — multi_choice discriminator regression (SEP-1293)', () => {
+  it('renders the multi-select control for type: multi_choice', () => {
+    const sections: FormSection[] = [
+      {
+        title: 'Upload',
+        fields: [
+          {
+            type: 'multi_choice',
+            name: 'upload',
+            label: 'Upload providers',
+            choices: [{ label: 'S3', value: 'S3' }],
+          },
+        ],
+      },
+    ];
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={vi.fn()} />
+    );
+    expect(
+      document.getElementById('mui-component-select-upload')
+    ).not.toBeNull();
+  });
+
+  it('renders nothing for the stale "multichoice" literal (old wrong discriminator)', () => {
+    // Cast bypasses TypeScript: simulates an outdated API response before clients update.
+    const sections = [
+      {
+        title: 'Upload',
+        fields: [
+          {
+            type: 'multichoice',
+            name: 'upload',
+            label: 'Upload providers',
+            choices: [],
+          },
+        ],
+      },
+    ] as unknown as FormSection[];
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={vi.fn()} />
+    );
+    expect(document.getElementById('mui-component-select-upload')).toBeNull();
+  });
+});
+
+describe('SchemaFormRenderer — multi_choice maxItems', () => {
+  it('blocks submission when selection count exceeds maxItems', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    const sections: FormSection[] = [
+      {
+        title: 'Upload',
+        fields: [
+          {
+            type: 'multi_choice',
+            name: 'upload',
+            label: 'Upload providers',
+            choices: [
+              { label: 'S3', value: 'S3' },
+              { label: 'Rsync', value: 'RSYNC' },
+              { label: 'GCS', value: 'GSUTIL' },
+            ],
+            max_items: 2,
+          },
+        ],
+      },
+    ];
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={sections}
+        onSubmit={onSubmit}
+        defaultValues={{ upload: ['S3', 'RSYNC', 'GSUTIL'] }}
+      />
+    );
+
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+    expect(onSubmit).not.toHaveBeenCalled();
+    expect(
+      await screen.findByText(/Fix the highlighted fields/)
+    ).toBeInTheDocument();
+    await waitFor(() =>
+      expect(screen.getByTestId('select-input-upload')).toHaveAttribute(
+        'aria-invalid',
+        'true'
+      )
+    );
+  });
+});
+
+describe('SchemaFormRenderer — multi_choice default value', () => {
+  it('pre-selects a value from the field default', () => {
+    const sections: FormSection[] = [
+      {
+        title: 'Upload',
+        fields: [
+          {
+            type: 'multi_choice',
+            name: 'upload',
+            label: 'Upload providers',
+            default: ['S3'],
+            choices: [
+              { label: 'S3', value: 'S3' },
+              { label: 'Rsync', value: 'RSYNC' },
+            ],
+          },
+        ],
+      },
+    ];
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={vi.fn()} />
+    );
+    expect(screen.queryByText('Select…')).toBeNull();
+    expect(screen.getByText('S3')).toBeVisible();
+  });
+});
+
+// ── renderField override hook (SEP-1355) ──────────────────────────────────
+//
+// A renderField override that writes its value through react-hook-form so the
+// value participates in the rule engines and submission. This is the documented
+// write-through contract.
+function CustomTextWidget({ name }: { name: string }) {
+  const { register } = useFormContext();
+  return <input aria-label={`custom-${name}`} {...register(name)} />;
+}
+
+describe('SchemaFormRenderer — renderField override', () => {
+  const sections: FormSection[] = [
+    {
+      title: 'Main',
+      fields: [
+        { type: 'string', name: 'mode', label: 'Mode' },
+        { type: 'string', name: 'title', label: 'Title' },
+      ],
+    },
+  ];
+
+  // Only customizes `mode`; every other field falls back to renderDefault().
+  const renderField: RenderFieldOverride = ({ field, renderDefault }) =>
+    field.name === 'mode' ? (
+      <CustomTextWidget name={field.name} />
+    ) : (
+      renderDefault()
+    );
+
+  it('renders the override widget for a matching field', () => {
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={sections}
+        onSubmit={vi.fn()}
+        renderField={renderField}
+      />
+    );
+    // Override widget present; the default Mode widget is replaced.
+    expect(screen.getByLabelText('custom-mode')).toBeInTheDocument();
+    expect(screen.queryByLabelText('Mode')).toBeNull();
+  });
+
+  it('falls back to the default widget for a non-matching field', () => {
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={sections}
+        onSubmit={vi.fn()}
+        renderField={renderField}
+      />
+    );
+    // `title` is not customized → framework default widget renders.
+    expect(screen.getByLabelText('Title')).toBeInTheDocument();
+  });
+
+  it('does not call the override for a field hidden by its gate', () => {
+    const gatedSections: FormSection[] = [
+      {
+        title: 'Main',
+        fields: [
+          { type: 'bool', name: 'advanced', label: 'Advanced mode' },
+          {
+            type: 'string',
+            name: 'mode',
+            label: 'Mode',
+            forbidden: [{ when: { falsy: 'advanced' } }],
+          },
+        ],
+      },
+    ];
+    const override = vi.fn(renderField);
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={gatedSections}
+        onSubmit={vi.fn()}
+        renderField={override}
+      />
+    );
+    // advanced=false (default) → forbidden gate fires → mode hidden → override
+    // never invoked for it, and the override widget is absent.
+    expect(screen.queryByLabelText('custom-mode')).toBeNull();
+    expect(override).not.toHaveBeenCalledWith(
+      expect.objectContaining({
+        field: expect.objectContaining({ name: 'mode' }),
+      })
+    );
+  });
+
+  it('passes the gate-resolved required flag to the override', async () => {
+    const user = userEvent.setup();
+    const seenRequired: boolean[] = [];
+    const captureOverride: RenderFieldOverride = ({ field, renderDefault }) => {
+      if (field.name === 'mode') {
+        seenRequired.push(Boolean(field.required));
+        return <CustomTextWidget name={field.name} />;
+      }
+      return renderDefault();
+    };
+    const gatedSections: FormSection[] = [
+      {
+        title: 'Main',
+        fields: [
+          { type: 'bool', name: 'advanced', label: 'Advanced mode' },
+          {
+            type: 'string',
+            name: 'mode',
+            label: 'Mode',
+            // becomes required only when `advanced` is truthy
+            requires: [{ when: { truthy: 'advanced' } }],
+          },
+        ],
+      },
+    ];
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={gatedSections}
+        onSubmit={vi.fn()}
+        renderField={captureOverride}
+      />
+    );
+    // advanced=false at mount → resolved required=false
+    expect(seenRequired.at(-1)).toBe(false);
+    // flip advanced → requires gate fires → resolved required=true reaches override
+    await user.click(screen.getByLabelText('Advanced mode'));
+    await waitFor(() => expect(seenRequired.at(-1)).toBe(true));
+  });
+
+  it('write-through: overridden value participates in the fail_when engine', async () => {
+    const user = userEvent.setup();
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={[
+          {
+            title: 'Main',
+            fail_when: [
+              {
+                fail_when: { truthy: 'mode' },
+                error_fields: ['mode'],
+                message: 'Mode must be empty.',
+              },
+            ],
+            fields: [{ type: 'string', name: 'mode', label: 'Mode' }],
+          },
+        ]}
+        onSubmit={vi.fn()}
+        renderField={renderField}
+      />
+    );
+    // mode empty at mount → predicate inactive
+    expect(screen.queryByText('Mode must be empty.')).toBeNull();
+    // type into the OVERRIDDEN widget → value reaches RHF watch state → fail_when fires
+    await user.type(screen.getByLabelText('custom-mode'), 'danger');
+    expect(await screen.findByText('Mode must be empty.')).toBeInTheDocument();
+  });
+
+  it('write-through: overridden value is included in the submit payload', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={sections}
+        onSubmit={onSubmit}
+        renderField={renderField}
+      />
+    );
+    await user.type(screen.getByLabelText('custom-mode'), 'fast');
+    await user.click(screen.getByRole('button', { name: /Run/ }));
+    await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+    expect(onSubmit).toHaveBeenCalledWith(
+      expect.objectContaining({ mode: 'fast' })
+    );
+  });
+
+  it('falls back to the default widget when the override returns a nullish value', () => {
+    // Override opts out of every field by returning undefined → defaults render.
+    const optOut: RenderFieldOverride = () => undefined;
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={sections}
+        onSubmit={vi.fn()}
+        renderField={optOut}
+      />
+    );
+    expect(screen.getByLabelText('Mode')).toBeInTheDocument();
+    expect(screen.getByLabelText('Title')).toBeInTheDocument();
+    expect(screen.queryByLabelText('custom-mode')).toBeNull();
+  });
+
+  it('renders identically when no override is supplied (no regression)', () => {
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={vi.fn()} />
+    );
+    // Default widgets for both fields; no custom widget.
+    expect(screen.getByLabelText('Mode')).toBeInTheDocument();
+    expect(screen.getByLabelText('Title')).toBeInTheDocument();
+    expect(screen.queryByLabelText('custom-mode')).toBeNull();
+  });
+});
+
+describe('SchemaFormRenderer — one_of groups', () => {
+  const sections: FormSection[] = [
+    {
+      title: 'Source',
+      fields: [
+        {
+          type: 'one_of',
+          name: 'source',
+          label: 'Source',
+          description: 'Choose how to specify source rows.',
+          discriminator: 'source.mode',
+          default: 'schema',
+          branches: [
+            {
+              value: 'schema',
+              label: 'Schema & Table',
+              fields: [
+                {
+                  type: 'string',
+                  name: 'source.source_db_id',
+                  label: 'Source Schema',
+                },
+              ],
+            },
+            {
+              value: 'query',
+              label: 'Custom Query',
+              fields: [
+                {
+                  type: 'string',
+                  name: 'source.source_query',
+                  label: 'Source Query',
+                },
+              ],
+            },
+          ],
+        },
+      ],
+    },
+  ];
+
+  it('renders segmented control, helper text, and the default branch fields', () => {
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={() => {}} />
+    );
+    expect(screen.getByTestId('one-of-source')).toBeInTheDocument();
+    expect(
+      screen.getByText('Choose how to specify source rows.')
+    ).toBeInTheDocument();
+    expect(
+      screen.getByTestId('text-input-source.source_db_id')
+    ).toBeInTheDocument();
+    expect(screen.queryByTestId('text-input-source.source_query')).toBeNull();
+  });
+
+  it('swaps visible branch fields and omits inactive values on submit', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    renderWithProviders(
+      <SchemaFormRenderer sections={sections} onSubmit={onSubmit} />
+    );
+
+    await user.click(screen.getByTestId('one-of-option-query'));
+    expect(
+      await screen.findByTestId('text-input-source.source_query')
+    ).toBeInTheDocument();
+    expect(screen.queryByTestId('text-input-source.source_db_id')).toBeNull();
+
+    await user.type(
+      screen.getByTestId('text-input-source.source_query'),
+      'SELECT 1'
+    );
+    await user.click(screen.getByRole('button', { name: 'Run' }));
+
+    await waitFor(() => expect(onSubmit).toHaveBeenCalled());
+    expect(onSubmit).toHaveBeenCalledWith({
+      source: { mode: 'query', source_query: 'SELECT 1' },
+    });
+  });
+
+  it('unregisters one_of discriminator and leaf values when a section becomes hidden', async () => {
+    const user = userEvent.setup();
+    const onSubmit = vi.fn();
+    const gatedSections: FormSection[] = [
+      {
+        title: 'Options',
+        fields: [
+          {
+            type: 'bool',
+            name: 'include_target',
+            label: 'Include Target',
+            default: true,
+          },
+        ],
+      },
+      {
+        title: 'Target',
+        forbidden: [{ when: { not_equals: { include_target: true } } }],
+        fields: [
+          {
+            type: 'one_of',
+            name: 'target',
+            label: 'Target',
+            discriminator: 'target_mode',
+            default: 'service',
+            branches: [
+              {
+                value: 'service',
+                label: 'Service',
+                fields: [
+                  { type: 'string', name: 'target', label: 'Service Target' },
+                ],
+              },
+              {
+                value: 'schema',
+                label: 'Schema',
+                fields: [
+                  { type: 'string', name: 'target', label: 'Schema Target' },
+                ],
+              },
+            ],
+          },
+        ],
+      },
+    ];
+    renderWithProviders(
+      <SchemaFormRenderer
+        sections={gatedSections}
+        onSubmit={onSubmit}
+        defaultValues={{
+          include_target: true,
+          target_mode: 'schema',
+          target: 'inventory',
+        }}
+      />
+    );
+
+    await user.click(screen.getByLabelText('Include Target'));
+    await waitFor(() => expect(screen.queryByText('Target')).toBeNull());
+
+    await user.click(screen.getByRole('button', { name: 'Run' }));
+    await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+    const payload = onSubmit.mock.calls[0]?.[0];
+    expect(payload).toMatchObject({ include_target: false });
+    expect(payload).not.toHaveProperty('target');
+    expect(payload).not.toHaveProperty('target_mode');
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/SchemaFormRenderer.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/SchemaFormRenderer.tsx
new file mode 100644
index 00000000000..de8332cd6ea
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/SchemaFormRenderer.tsx
@@ -0,0 +1,490 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import {
+  memo,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  type FormEvent,
+} from 'react';
+import {
+  FormProvider,
+  useForm,
+  useFormContext,
+  type SubmitHandler,
+} from 'react-hook-form';
+import { FormFieldsProvider } from './formFieldsContext';
+// UNSAFE_DataRouterContext is an unstable react-router API — pinned to react-router-dom ^7.6.0; review on version bumps.
+import { UNSAFE_DataRouterContext, useBlocker } from 'react-router-dom';
+import Accordion from '@mui/material/Accordion';
+import AccordionDetails from '@mui/material/AccordionDetails';
+import AccordionSummary from '@mui/material/AccordionSummary';
+import Alert from '@mui/material/Alert';
+import Box from '@mui/material/Box';
+import Button from '@mui/material/Button';
+import Dialog from '@mui/material/Dialog';
+import DialogActions from '@mui/material/DialogActions';
+import DialogContent from '@mui/material/DialogContent';
+import DialogContentText from '@mui/material/DialogContentText';
+import DialogTitle from '@mui/material/DialogTitle';
+import Divider from '@mui/material/Divider';
+import Typography from '@mui/material/Typography';
+import ExpandMoreIcon from '@mui/icons-material/ExpandMore';
+import type { FieldValidationError, PluginCapabilities } from '@sep/api';
+import {
+  AlertOnFailField,
+  ALERT_ON_FAIL_FIELD_NAME,
+} from '../AlertOnFailField';
+import { ConditionalFieldSlot } from './ConditionalFieldSlot';
+import { OneOfGroupSlot } from './OneOfGroupSlot';
+import { useConditionalSection } from './hooks/useConditionalSection';
+import { useCardinalityRules } from './hooks/useCardinalityRules';
+import { useFailRules } from './hooks/useFailRules';
+import { useUnsavedChangesGuard } from './hooks/useUnsavedChangesGuard';
+import { coerceFormValues } from './utils/validationMapper';
+import { getAtPath, setAtPath } from './utils/fieldPath';
+import {
+  collectOneOfGroups,
+  flattenSectionFields,
+  isOneOfGroup,
+} from './utils/flattenSectionFields';
+import type { FormSection, PluginField, RenderFieldOverride } from './types';
+
+function fieldDefault(field: PluginField): unknown {
+  switch (field.type) {
+    case 'bool':
+      return field.default ?? false;
+    case 'integer':
+    case 'float':
+      return field.default ?? '';
+    case 'multi_choice':
+      return field.default ?? [];
+    case 'file':
+      return undefined;
+    case 'service':
+    case 'schema':
+    case 'table':
+    case 'host':
+      return field.default ?? '';
+    case 'remote_choice':
+      // Mirror the selector's empty commit (`null`), not `''` — an empty string
+      // passes some client checks yet fails the backend NonEmptyStr with
+      // "String should have at least 1 character".
+      return field.default ?? null;
+    default:
+      return field.default ?? '';
+  }
+}
+
+function flattenFields(sections: FormSection[]): PluginField[] {
+  return flattenSectionFields(sections);
+}
+
+function buildFormDefaults(
+  sections: FormSection[],
+  allFields: PluginField[],
+  defaultValues: Record<string, unknown> | undefined,
+  capabilities: PluginCapabilities | undefined
+): Record<string, unknown> {
+  const defaults: Record<string, unknown> = {};
+  for (const field of allFields) {
+    const seed = defaultValues
+      ? getAtPath(defaultValues, field.name)
+      : undefined;
+    setAtPath(defaults, field.name, seed ?? fieldDefault(field));
+  }
+  for (const group of collectOneOfGroups(sections)) {
+    const seed = defaultValues
+      ? getAtPath(defaultValues, group.discriminator)
+      : undefined;
+    setAtPath(
+      defaults,
+      group.discriminator,
+      seed ?? group.default ?? group.branches[0]?.value ?? ''
+    );
+  }
+  if (capabilities?.alert_on_fail) {
+    defaults[ALERT_ON_FAIL_FIELD_NAME] =
+      defaultValues?.[ALERT_ON_FAIL_FIELD_NAME] ?? false;
+  }
+  return defaults;
+}
+
+interface SectionRendererProps {
+  section: FormSection;
+  idx: number;
+  violations: Array<{ message: string }>;
+  renderField?: RenderFieldOverride;
+}
+
+const SectionRenderer = memo(function SectionRenderer({
+  section,
+  idx,
+  violations,
+  renderField,
+}: SectionRendererProps) {
+  const { isHidden } = useConditionalSection(section);
+
+  if (isHidden) {
+    return null;
+  }
+
+  const sectionContent = (
+    <>
+      {section.description && (
+        <Typography variant="body2" color="text.secondary" sx={{ mb: 1 }}>
+          {section.description}
+        </Typography>
+      )}
+      {violations.map((v, i) => (
+        <Alert key={i} severity="error" sx={{ mb: 1 }}>
+          {v.message}
+        </Alert>
+      ))}
+      {section.fields.map((field) =>
+        isOneOfGroup(field) ? (
+          <OneOfGroupSlot
+            key={field.name}
+            group={field}
+            renderField={renderField}
+          />
+        ) : (
+          <ConditionalFieldSlot
+            key={field.name}
+            field={field}
+            renderField={renderField}
+          />
+        )
+      )}
+    </>
+  );
+
+  return (
+    <Box component="fieldset" sx={{ border: 0, p: 0, mb: 3 }}>
+      {idx > 0 && <Divider sx={{ mb: 2 }} />}
+      {section.collapsible ? (
+        <Accordion
+          defaultExpanded={!section.collapsed_by_default}
+          disableGutters
+          slotProps={{ transition: { unmountOnExit: true } }}
+        >
+          <AccordionSummary
+            expandIcon={<ExpandMoreIcon />}
+            sx={{
+              pl: 2,
+              pr: 1,
+              minHeight: 48,
+              '& .MuiAccordionSummary-content': { my: 1 },
+            }}
+          >
+            <Typography
+              component="legend"
+              variant="subtitle1"
+              sx={{ fontWeight: 600 }}
+            >
+              {section.title}
+            </Typography>
+          </AccordionSummary>
+          <AccordionDetails sx={{ px: 0, pl: 2 }}>
+            {sectionContent}
+          </AccordionDetails>
+        </Accordion>
+      ) : (
+        <>
+          <Typography component="legend" variant="h6" sx={{ mb: 1, px: 0 }}>
+            {section.title}
+          </Typography>
+          {sectionContent}
+        </>
+      )}
+    </Box>
+  );
+});
+
+export interface SchemaFormRendererProps {
+  sections: FormSection[];
+  onSubmit: (data: Record<string, unknown>) => void;
+  submitLabel?: string;
+  loading?: boolean;
+  defaultValues?: Record<string, unknown>;
+  /** Server-side error to show above the form (e.g. API failure from the caller's mutation). */
+  submitError?: string | null;
+  /**
+   * Backend per-field validation errors (e.g. parsed from a 422) applied to the
+   * form this renderer owns via react-hook-form `setError`. Each entry's `path`
+   * is a react-hook-form field name; entries with an empty `path` are skipped
+   * here (callers surface those through {@link submitError}). Pass a fresh array
+   * on each submit failure — changing the array identity re-runs setError, and
+   * previously applied errors are cleared before the new set is applied.
+   */
+  fieldErrors?: FieldValidationError[];
+  /** Plugin capabilities. When `alert_on_fail` is true, renders <AlertOnFailField> below the sections. */
+  capabilities?: PluginCapabilities;
+  /**
+   * Optional per-field widget override. Applied after the conditional gate
+   * decides visibility / required-ness; receives the gate-resolved field and a
+   * `renderDefault()` callback. Overrides must write through react-hook-form.
+   * See {@link RenderFieldOverride}.
+   */
+  renderField?: RenderFieldOverride;
+}
+
+/**
+ * Blocks in-app navigation while `isGuarded` is true.
+ * Rendered only when the component tree is inside a Data Router, so `useBlocker`
+ * never runs in contexts where it would throw (legacy MemoryRouter, test renders
+ * without createMemoryRouter, etc.).
+ */
+function UnsavedChangesBlocker({ isGuarded }: { isGuarded: boolean }) {
+  const shouldBlock = useCallback(
+    ({
+      currentLocation,
+      nextLocation,
+    }: {
+      currentLocation: { pathname: string };
+      nextLocation: { pathname: string };
+    }) => isGuarded && currentLocation.pathname !== nextLocation.pathname,
+    [isGuarded]
+  );
+  const blocker = useBlocker(shouldBlock);
+
+  return (
+    <Dialog
+      open={blocker.state === 'blocked'}
+      onClose={() => blocker.reset?.()}
+      aria-labelledby="unsaved-dialog-title"
+    >
+      <DialogTitle id="unsaved-dialog-title">Unsaved changes</DialogTitle>
+      <DialogContent>
+        <DialogContentText>
+          You have unsaved changes. If you leave this page your changes will be
+          lost.
+        </DialogContentText>
+      </DialogContent>
+      <DialogActions>
+        <Button onClick={() => blocker.reset?.()}>Stay</Button>
+        <Button onClick={() => blocker.proceed?.()} variant="contained">
+          Discard changes
+        </Button>
+      </DialogActions>
+    </Dialog>
+  );
+}
+
+/** Inner form body — lives inside FormProvider so it can call useFormContext / useCardinalityRules. */
+function SchemaFormBody({
+  sections,
+  onSubmit,
+  submitLabel = 'Run',
+  loading = false,
+  submitError,
+  fieldErrors,
+  capabilities,
+  renderField,
+}: SchemaFormRendererProps) {
+  const { handleSubmit, formState, setError, clearErrors, getFieldState } =
+    useFormContext<Record<string, unknown>>();
+
+  // Apply backend per-field errors to the form. Clear the paths set by the
+  // previous failure first so a resubmit that fixes some fields does not leave
+  // stale server errors on the corrected ones. Empty paths are form-level and
+  // surfaced only through the submitError banner.
+  const appliedServerErrorPaths = useRef<string[]>([]);
+  useEffect(() => {
+    if (appliedServerErrorPaths.current.length > 0) {
+      clearErrors(appliedServerErrorPaths.current);
+      appliedServerErrorPaths.current = [];
+    }
+    if (!fieldErrors?.length) {
+      return;
+    }
+    const applied: string[] = [];
+    for (const { path, message } of fieldErrors) {
+      if (!path) {
+        continue;
+      }
+      setError(path, { type: 'server', message });
+      applied.push(path);
+    }
+    appliedServerErrorPaths.current = applied;
+  }, [fieldErrors, setError, clearErrors]);
+
+  const isGuarded = useUnsavedChangesGuard(submitError);
+  const inDataRouter = Boolean(useContext(UNSAFE_DataRouterContext));
+  const allFields = useMemo(() => flattenFields(sections), [sections]);
+  const beforeSubmitSections = useMemo(
+    () => sections.filter((section) => !section.render_after_submit),
+    [sections]
+  );
+  const afterSubmitSections = useMemo(
+    () => sections.filter((section) => section.render_after_submit),
+    [sections]
+  );
+  const cardinalityViolations = useCardinalityRules(sections);
+  const failViolations = useFailRules(sections);
+
+  // Merge cardinality and fail violations per section into a flat list for SectionRenderer.
+  const violationsBySection = useMemo(() => {
+    const map = new Map<FormSection, Array<{ message: string }>>();
+    sections.forEach((section, i) => {
+      map.set(section, [
+        ...(cardinalityViolations[i] ?? []),
+        ...(failViolations[i] ?? []),
+      ]);
+    });
+    return map;
+  }, [sections, cardinalityViolations, failViolations]);
+
+  const hasSectionViolations = useMemo(
+    () => [...violationsBySection.values()].some((vs) => vs.length > 0),
+    [violationsBySection]
+  );
+  const hasInlineErrors = Object.keys(formState.errors).length > 0;
+
+  const handleFormSubmit: SubmitHandler<Record<string, unknown>> = (values) => {
+    onSubmit(coerceFormValues(values, allFields));
+  };
+
+  // Clear the server errors from the previous failure before react-hook-form's
+  // validation gate runs. A 422 whose loc lands on a field with no mounted
+  // input (unknown field, hidden conditional section, or array/nested path)
+  // gets a setError entry that no input can ever clear; handleSubmit refuses to
+  // call onValid while any error remains, which would wedge resubmission.
+  // Those errors stay visible in the persistent banner regardless. Defined
+  // inline (not memoized) so it always sees the current cardinality /
+  // fail_when violation state and the latest handleFormSubmit.
+  const handleSubmitEvent = (event: FormEvent<HTMLFormElement>) => {
+    if (hasSectionViolations) {
+      // Section-level rules render their own inline Alerts. Stop before
+      // react-hook-form runs, so it never flags the submit as successful —
+      // that would disarm `useUnsavedChangesGuard` (isDirty && !isSubmitSuccessful)
+      // for good on this path, since no submitError ever arrives to re-arm it.
+      event.preventDefault();
+      return;
+    }
+    if (appliedServerErrorPaths.current.length > 0) {
+      clearErrors(appliedServerErrorPaths.current);
+      appliedServerErrorPaths.current = [];
+    }
+    void handleSubmit(handleFormSubmit, () => {
+      // Resubmit was blocked by a client-side validation error on some field, so
+      // handleFormSubmit never fired: the parent won't re-send fieldErrors and the
+      // effect won't re-run. Re-apply the server errors we cleared above (skipping
+      // any field that now has its own client-side error) so their inline highlight
+      // stays in sync with the still-visible persistent banner. Cleared again at the
+      // top of the next submit, so this never re-introduces the resubmission wedge.
+      if (!fieldErrors?.length) {
+        return;
+      }
+      const reapplied: string[] = [];
+      for (const { path, message } of fieldErrors) {
+        if (path && !getFieldState(path).error) {
+          setError(path, { type: 'server', message });
+          reapplied.push(path);
+        }
+      }
+      appliedServerErrorPaths.current = reapplied;
+    })(event);
+  };
+
+  return (
+    <FormFieldsProvider value={allFields}>
+      {inDataRouter && <UnsavedChangesBlocker isGuarded={isGuarded} />}
+      <Box
+        component="form"
+        onSubmit={handleSubmitEvent}
+        noValidate
+        sx={{ maxWidth: 800 }}
+      >
+        {submitError && (
+          <Alert severity="error" sx={{ mb: 2, whiteSpace: 'pre-line' }}>
+            {submitError}
+          </Alert>
+        )}
+        {hasInlineErrors && formState.isSubmitted && !submitError && (
+          <Alert severity="error" sx={{ mb: 2 }}>
+            Fix the highlighted fields before submitting.
+          </Alert>
+        )}
+
+        {beforeSubmitSections.map((section, idx) => (
+          <SectionRenderer
+            key={`${section.title}-${idx}`}
+            section={section}
+            idx={idx}
+            violations={violationsBySection.get(section) ?? []}
+            renderField={renderField}
+          />
+        ))}
+
+        {capabilities?.alert_on_fail && (
+          <Box sx={{ mb: 2 }}>
+            <AlertOnFailField />
+          </Box>
+        )}
+
+        <Button
+          type="submit"
+          variant="contained"
+          size="large"
+          loading={loading}
+          loadingPosition="start"
+          sx={{ mt: 1 }}
+        >
+          {submitLabel}
+        </Button>
+
+        {afterSubmitSections.length > 0 ? (
+          <Box sx={{ mt: 3 }}>
+            {afterSubmitSections.map((section, idx) => (
+              <SectionRenderer
+                key={`${section.title}-after-${idx}`}
+                section={section}
+                idx={idx}
+                violations={violationsBySection.get(section) ?? []}
+                renderField={renderField}
+              />
+            ))}
+          </Box>
+        ) : null}
+      </Box>
+    </FormFieldsProvider>
+  );
+}
+
+export function SchemaFormRenderer(props: SchemaFormRendererProps) {
+  const { sections, defaultValues, capabilities } = props;
+  const allFields = useMemo(() => flattenFields(sections), [sections]);
+
+  const formDefaults = useMemo(
+    () => buildFormDefaults(sections, allFields, defaultValues, capabilities),
+    [sections, allFields, defaultValues, capabilities]
+  );
+
+  const methods = useForm<Record<string, unknown>>({
+    defaultValues: formDefaults,
+  });
+
+  return (
+    <FormProvider {...methods}>
+      <SchemaFormBody {...props} />
+    </FormProvider>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/SchemaSelectShell.test.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/SchemaSelectShell.test.tsx
new file mode 100644
index 00000000000..19ff4514c33
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/SchemaSelectShell.test.tsx
@@ -0,0 +1,162 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, expect, it, vi } from 'vitest';
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import MenuItem from '@mui/material/MenuItem';
+import type {
+  ControllerRenderProps,
+  FieldError,
+  FieldValues,
+} from 'react-hook-form';
+import { SchemaSelectShell } from './SchemaSelectShell';
+
+const choices = [
+  { value: 'apple', label: 'Apple' },
+  { value: 'pear', label: 'Pear' },
+];
+
+function makeField(
+  overrides: Partial<ControllerRenderProps> = {}
+): ControllerRenderProps<FieldValues, string> {
+  return {
+    name: 'fruit',
+    value: '',
+    onChange: vi.fn(),
+    onBlur: vi.fn(),
+    ref: vi.fn(),
+    ...overrides,
+  } as ControllerRenderProps<FieldValues, string>;
+}
+
+function renderShell(
+  opts: {
+    field?: Partial<ControllerRenderProps>;
+    required?: boolean;
+    error?: FieldError;
+    description?: string;
+  } = {}
+) {
+  return render(
+    <SchemaSelectShell
+      field={makeField(opts.field)}
+      labelId="fruit-label"
+      label="Fruit"
+      required={opts.required}
+      error={opts.error}
+      description={opts.description}
+      renderValue={(value) =>
+        value === undefined || value === null || value === ''
+          ? 'Select…'
+          : (choices.find((c) => c.value === value)?.label ?? String(value))
+      }
+    >
+      {choices.map((c) => (
+        <MenuItem key={c.value} value={c.value}>
+          {c.label}
+        </MenuItem>
+      ))}
+    </SchemaSelectShell>
+  );
+}
+
+describe('SchemaSelectShell', () => {
+  it('renders the placeholder branch and preserves the test ids when empty', () => {
+    renderShell();
+
+    expect(screen.getByText('Select…')).toBeInTheDocument();
+    expect(screen.getByTestId('select-fruit-button')).toBeInTheDocument();
+    expect(screen.getByTestId('select-input-fruit')).toBeInTheDocument();
+    // a11y: the visible combobox is labelled by the InputLabel.
+    expect(
+      screen.getByRole('combobox').getAttribute('aria-labelledby')
+    ).toContain('fruit-label');
+  });
+
+  it('renders the populated value via renderValue', () => {
+    renderShell({ field: { value: 'apple' } });
+
+    expect(screen.getByText('Apple')).toBeInTheDocument();
+    expect(screen.queryByText('Select…')).not.toBeInTheDocument();
+  });
+
+  it('flips aria-invalid and shows the error message on error', () => {
+    renderShell({ error: { type: 'required', message: 'Fruit is required' } });
+
+    expect(screen.getByTestId('select-input-fruit')).toHaveAttribute(
+      'aria-invalid',
+      'true'
+    );
+    expect(screen.getByText('Fruit is required')).toBeInTheDocument();
+  });
+
+  it('shows the description as helper text when there is no error', () => {
+    renderShell({ description: 'Pick one' });
+
+    expect(screen.getByTestId('select-input-fruit')).toHaveAttribute(
+      'aria-invalid',
+      'false'
+    );
+    expect(screen.getByText('Pick one')).toBeInTheDocument();
+  });
+
+  it('shows an info-icon tooltip when description is set', async () => {
+    const user = userEvent.setup();
+    renderShell({ description: 'Pick one' });
+
+    const help = screen.getByLabelText('Help for Fruit');
+    expect(help).toHaveAttribute('data-help-for', 'Fruit');
+    await user.hover(help);
+    expect(await screen.findByRole('tooltip')).toHaveTextContent('Pick one');
+  });
+
+  it('omits the info icon when description is missing', () => {
+    renderShell();
+
+    expect(screen.queryByLabelText('Help for Fruit')).not.toBeInTheDocument();
+  });
+
+  it('keeps the info icon when an error replaces the helper text', () => {
+    renderShell({
+      description: 'Pick one',
+      error: { type: 'required', message: 'Fruit is required' },
+    });
+
+    expect(screen.getByText('Fruit is required')).toBeInTheDocument();
+    expect(screen.getByLabelText('Help for Fruit')).toHaveAttribute(
+      'data-help-for',
+      'Fruit'
+    );
+  });
+
+  it('renders a required asterisk in the label', () => {
+    const { container } = renderShell({ required: true });
+
+    expect(
+      container.querySelector('.MuiFormLabel-asterisk')
+    ).toBeInTheDocument();
+  });
+
+  it('omits the required asterisk when not required', () => {
+    const { container } = renderShell();
+
+    expect(
+      container.querySelector('.MuiFormLabel-asterisk')
+    ).not.toBeInTheDocument();
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/SchemaSelectShell.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/SchemaSelectShell.tsx
new file mode 100644
index 00000000000..8a5d943c329
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/SchemaSelectShell.tsx
@@ -0,0 +1,98 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type { ReactNode } from 'react';
+import FormControl from '@mui/material/FormControl';
+import FormHelperText from '@mui/material/FormHelperText';
+import InputLabel from '@mui/material/InputLabel';
+import Select, { type SelectProps } from '@mui/material/Select';
+import type {
+  ControllerRenderProps,
+  FieldError,
+  FieldValues,
+} from 'react-hook-form';
+import { FieldLabelWithHelp } from './FieldLabelWithHelp';
+
+export interface SchemaSelectShellProps {
+  /**
+   * react-hook-form Controller field props, spread onto the `<Select>`. This
+   * drives value/onChange and — because `name` flows through to the native
+   * input — yields the MUI-derived `mui-component-select-${name}` test id.
+   */
+  field: ControllerRenderProps<FieldValues, string>;
+  /** Id linking `<InputLabel>` to `<Select>` for `aria-labelledby`. */
+  labelId: string;
+  label: string;
+  required?: boolean;
+  /** rhf field error; presence flips `aria-invalid` and the outline color. */
+  error?: FieldError;
+  /** Helper text shown when there is no error message. */
+  description?: ReactNode;
+  /** Render a multi-select (value is an array). */
+  multiple?: boolean;
+  /** Owns the empty-placeholder vs populated branch — differs per field. */
+  renderValue: SelectProps<unknown>['renderValue'];
+  /** MenuItem children. */
+  children: ReactNode;
+}
+
+/**
+ * Shared scaffold for the schema-driven select fields (MultiChoiceField and
+ * ChoiceField's select-mode branch). Owns the
+ * FormControl → InputLabel → Select → FormHelperText composition with the
+ * fixed-state knobs (`shrink`, `notched`, `displayEmpty`, `fullWidth`,
+ * `size="small"`) established in SEP-1278. The per-field `renderValue` and
+ * MenuItem content stay at the call site.
+ */
+export function SchemaSelectShell({
+  field,
+  labelId,
+  label,
+  required,
+  error,
+  description,
+  multiple,
+  renderValue,
+  children,
+}: SchemaSelectShellProps) {
+  const helpDescription =
+    typeof description === 'string' ? description : undefined;
+
+  return (
+    <FormControl fullWidth size="small" error={!!error}>
+      <InputLabel id={labelId} shrink required={required}>
+        <FieldLabelWithHelp label={label} description={helpDescription} />
+      </InputLabel>
+      <Select
+        {...field}
+        labelId={labelId}
+        label={label}
+        multiple={multiple}
+        displayEmpty
+        notched
+        data-testid={`select-${field.name}-button`}
+        inputProps={{ 'data-testid': `select-input-${field.name}` }}
+        renderValue={renderValue}
+      >
+        {children}
+      </Select>
+      {(error?.message || description) && (
+        <FormHelperText>{error?.message ?? description}</FormHelperText>
+      )}
+    </FormControl>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/BoolField.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/BoolField.tsx
new file mode 100644
index 00000000000..6854e7c2421
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/BoolField.tsx
@@ -0,0 +1,45 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useFormContext } from 'react-hook-form';
+import Box from '@mui/material/Box';
+import { SwitchInput } from '@percona/percona-ui';
+import { FieldHelpIcon } from '../FieldLabelWithHelp';
+import type { BoolField as BoolFieldType } from '../types';
+
+interface BoolFieldProps {
+  field: BoolFieldType;
+}
+
+export function BoolField({ field }: BoolFieldProps) {
+  const { control } = useFormContext();
+  return (
+    <Box sx={{ display: 'flex', alignItems: 'flex-start', gap: 0.5 }}>
+      <Box sx={{ minWidth: 0 }}>
+        <SwitchInput
+          name={field.name}
+          label={field.label}
+          labelCaption={field.description}
+          control={control}
+        />
+      </Box>
+      {field.description ? (
+        <FieldHelpIcon description={field.description} label={field.label} />
+      ) : null}
+    </Box>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/ChoiceField.test.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/ChoiceField.test.tsx
new file mode 100644
index 00000000000..23580cbbda8
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/ChoiceField.test.tsx
@@ -0,0 +1,152 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { FormProvider, useForm } from 'react-hook-form';
+import { ChoiceField } from './ChoiceField';
+import type { ChoiceField as ChoiceFieldType, ChoiceOption } from '../types';
+
+function Harness({ field }: { field: ChoiceFieldType }) {
+  const methods = useForm();
+  return (
+    <FormProvider {...methods}>
+      <ChoiceField field={field} />
+    </FormProvider>
+  );
+}
+
+function SubmitHarness({ field }: { field: ChoiceFieldType }) {
+  const methods = useForm();
+  return (
+    <FormProvider {...methods}>
+      <form onSubmit={methods.handleSubmit(() => {})}>
+        <ChoiceField field={field} />
+        <button type="submit">Submit</button>
+      </form>
+    </FormProvider>
+  );
+}
+
+function renderField(
+  choices: ChoiceOption[],
+  overrides: Partial<ChoiceFieldType> = {}
+) {
+  const field: ChoiceFieldType = {
+    type: 'choice',
+    name: 'archive_type',
+    label: 'Archive Type',
+    choices,
+    ...overrides,
+  };
+  return render(<Harness field={field} />);
+}
+
+// Three or fewer options render as radios; more render as a select.
+const RADIO_CHOICES: ChoiceOption[] = [
+  { value: '0', label: 'Purge Only' },
+  {
+    value: '1',
+    label: 'Swap & Drop',
+    disabled: true,
+    disabled_reason: 'Not available in the current scope.',
+  },
+];
+
+const SELECT_CHOICES: ChoiceOption[] = [
+  { value: 'a', label: 'Alpha' },
+  { value: 'b', label: 'Beta' },
+  { value: 'c', label: 'Gamma' },
+  {
+    value: 'd',
+    label: 'Delta',
+    disabled: true,
+    disabled_reason: 'Delta is retired.',
+  },
+];
+
+describe('ChoiceField — radio branch', () => {
+  it('disables the option and surfaces its reason via a tooltip on hover', async () => {
+    const user = userEvent.setup();
+    renderField(RADIO_CHOICES);
+
+    const radioByValue = (value: string) =>
+      screen
+        .getAllByRole('radio')
+        .find((radio) => (radio as HTMLInputElement).value === value);
+    expect(radioByValue('1')).toBeDisabled();
+    expect(radioByValue('0')).not.toBeDisabled();
+
+    await user.hover(screen.getByText('Swap & Drop'));
+    await waitFor(() => {
+      expect(screen.getByRole('tooltip')).toHaveTextContent(
+        'Not available in the current scope.'
+      );
+    });
+  });
+
+  it('does not render a tooltip for an enabled option', async () => {
+    const user = userEvent.setup();
+    renderField(RADIO_CHOICES);
+
+    await user.hover(screen.getByText('Purge Only'));
+    // Give any (unexpected) tooltip a chance to appear before asserting absence.
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    expect(screen.queryByRole('tooltip')).not.toBeInTheDocument();
+  });
+
+  it('surfaces the required-validation error on submit', async () => {
+    const user = userEvent.setup();
+    const field: ChoiceFieldType = {
+      type: 'choice',
+      name: 'archive_type',
+      label: 'Archive Type',
+      choices: RADIO_CHOICES,
+      required: true,
+    };
+    render(<SubmitHarness field={field} />);
+
+    await user.click(screen.getByRole('button', { name: 'Submit' }));
+
+    await waitFor(() => {
+      expect(screen.getByText('Archive Type is required')).toBeInTheDocument();
+    });
+  });
+});
+
+describe('ChoiceField — select branch', () => {
+  it('disables the matching MenuItem and shows its reason on hover', async () => {
+    const user = userEvent.setup();
+    renderField(SELECT_CHOICES);
+
+    await user.click(screen.getByRole('combobox'));
+
+    const deltaLabel = await screen.findByText('Delta');
+    expect(deltaLabel.closest('[role="option"]')).toHaveAttribute(
+      'aria-disabled',
+      'true'
+    );
+
+    await user.hover(deltaLabel);
+    await waitFor(() => {
+      expect(screen.getByRole('tooltip')).toHaveTextContent(
+        'Delta is retired.'
+      );
+    });
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/ChoiceField.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/ChoiceField.tsx
new file mode 100644
index 00000000000..39320b2e8da
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/ChoiceField.tsx
@@ -0,0 +1,140 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { Controller, useFormContext } from 'react-hook-form';
+import Box from '@mui/material/Box';
+import FormControl from '@mui/material/FormControl';
+import FormControlLabel from '@mui/material/FormControlLabel';
+import FormHelperText from '@mui/material/FormHelperText';
+import MenuItem from '@mui/material/MenuItem';
+import MuiRadioGroup from '@mui/material/RadioGroup';
+import Radio from '@mui/material/Radio';
+import { LabeledContent, RadioGroup } from '@percona/percona-ui';
+import { SchemaSelectShell } from '../SchemaSelectShell';
+import type { ChoiceField as ChoiceFieldType } from '../types';
+import { buildValidationRules } from '../utils/validationMapper';
+import { renderChoiceLabel } from './choiceLabel';
+
+interface ChoiceFieldProps {
+  field: ChoiceFieldType;
+}
+
+// Small option sets render better as radios; larger as a select.
+const RADIO_THRESHOLD = 3;
+
+export function ChoiceField({ field }: ChoiceFieldProps) {
+  const { control } = useFormContext();
+  const rules = buildValidationRules(field);
+  const hasDisabledChoice = field.choices.some((choice) => choice.disabled);
+
+  if (field.choices.length > 0 && field.choices.length <= RADIO_THRESHOLD) {
+    // The percona-ui RadioGroup keys its options by `label`, so a
+    // Tooltip-wrapped (ReactNode) label would collide to the same React key
+    // across multiple disabled options. Only the disabled-aware path needs
+    // ReactNode labels, so render that branch with MUI primitives keyed by
+    // `value`; the common path stays on the shared percona-ui RadioGroup
+    // unchanged.
+    if (hasDisabledChoice) {
+      return (
+        <LabeledContent
+          label={field.label}
+          isRequired={field.required}
+          caption={field.description}
+        >
+          <Controller
+            name={field.name}
+            control={control}
+            rules={rules}
+            render={({ field: rhfField, fieldState: { error } }) => (
+              <FormControl error={!!error} component="fieldset">
+                <MuiRadioGroup row aria-label={field.label} {...rhfField}>
+                  {field.choices.map((choice) => (
+                    <FormControlLabel
+                      key={choice.value}
+                      value={choice.value}
+                      disabled={choice.disabled}
+                      control={<Radio />}
+                      label={renderChoiceLabel(choice)}
+                    />
+                  ))}
+                </MuiRadioGroup>
+                {error?.message && (
+                  <FormHelperText>{error.message}</FormHelperText>
+                )}
+              </FormControl>
+            )}
+          />
+        </LabeledContent>
+      );
+    }
+
+    return (
+      <RadioGroup
+        name={field.name}
+        label={field.label}
+        isRequired={field.required}
+        control={control}
+        labelProps={{ caption: field.description }}
+        options={field.choices}
+        controllerProps={{ rules }}
+      />
+    );
+  }
+
+  const labelId = `${field.name}-label`;
+
+  return (
+    <Controller
+      name={field.name}
+      control={control}
+      rules={rules}
+      render={({ field: rhfField, fieldState: { error } }) => (
+        <SchemaSelectShell
+          field={rhfField}
+          labelId={labelId}
+          label={field.label}
+          required={field.required}
+          error={error}
+          description={field.description}
+          renderValue={(value) => {
+            if (value === undefined || value === null || value === '') {
+              return (
+                <Box component="span" sx={{ color: 'text.disabled' }}>
+                  Select…
+                </Box>
+              );
+            }
+            return (
+              field.choices.find((c) => c.value === value)?.label ??
+              String(value)
+            );
+          }}
+        >
+          {field.choices.map((choice) => (
+            <MenuItem
+              key={choice.value}
+              value={choice.value}
+              disabled={choice.disabled}
+            >
+              {renderChoiceLabel(choice)}
+            </MenuItem>
+          ))}
+        </SchemaSelectShell>
+      )}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/DateTimeField.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/DateTimeField.tsx
new file mode 100644
index 00000000000..defb9e0c647
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/DateTimeField.tsx
@@ -0,0 +1,51 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useFormContext } from 'react-hook-form';
+import { TextInput } from '@percona/percona-ui';
+import { FieldLabelWithHelp } from '../FieldLabelWithHelp';
+import type { DateTimeField as DateTimeFieldType } from '../types';
+import { buildValidationRules } from '../utils/validationMapper';
+
+interface DateTimeFieldProps {
+  field: DateTimeFieldType;
+}
+
+export function DateTimeField({ field }: DateTimeFieldProps) {
+  const { control } = useFormContext();
+  return (
+    <TextInput
+      name={field.name}
+      label={field.label}
+      isRequired={field.required}
+      control={control}
+      textFieldProps={{
+        label: (
+          <FieldLabelWithHelp
+            label={field.label}
+            description={field.description}
+          />
+        ),
+        type: 'datetime-local',
+        helperText: field.description,
+        fullWidth: true,
+        InputLabelProps: { shrink: true },
+      }}
+      controllerProps={{ rules: buildValidationRules(field) }}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/FileField.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/FileField.tsx
new file mode 100644
index 00000000000..27e140caa1d
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/FileField.tsx
@@ -0,0 +1,90 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { Controller, useFormContext } from 'react-hook-form';
+import { IconButton, InputAdornment, TextField } from '@mui/material';
+import AttachFileIcon from '@mui/icons-material/AttachFile';
+import { FieldLabelWithHelp } from '../FieldLabelWithHelp';
+import type { FileField as FileFieldType } from '../types';
+import { buildValidationRules } from '../utils/validationMapper';
+
+interface FileFieldProps {
+  field: FileFieldType;
+}
+
+// percona-ui's FileInput owns its own internal Controller and exposes no
+// controllerProps, so we cannot attach react-hook-form rules to it. The form
+// also sets noValidate, which suppresses the native required attribute. To
+// make required (and any future file rules) actually block submission, we
+// render the Controller ourselves here.
+export function FileField({ field }: FileFieldProps) {
+  const { control } = useFormContext();
+  const rules = buildValidationRules(field);
+  const inputId = `file-input-${field.name}`;
+
+  return (
+    <Controller
+      name={field.name}
+      control={control}
+      rules={rules}
+      render={({ field: rhf, fieldState: { error } }) => (
+        <TextField
+          label={
+            <FieldLabelWithHelp
+              label={field.label}
+              description={field.description}
+            />
+          }
+          required={field.required}
+          fullWidth
+          size="small"
+          value={rhf.value instanceof File ? rhf.value.name : ''}
+          error={!!error}
+          helperText={error ? error.message : field.description}
+          slotProps={{
+            input: {
+              readOnly: true,
+              endAdornment: (
+                <InputAdornment position="end">
+                  <IconButton
+                    aria-label={`Select file for ${field.label}`}
+                    component="label"
+                    htmlFor={inputId}
+                    edge="end"
+                  >
+                    <AttachFileIcon fontSize="small" />
+                    <input
+                      id={inputId}
+                      type="file"
+                      hidden
+                      accept={field.accept?.join(',')}
+                      onChange={(e) => {
+                        const file = e.target.files?.[0];
+                        rhf.onChange(file ?? undefined);
+                      }}
+                      onBlur={rhf.onBlur}
+                    />
+                  </IconButton>
+                </InputAdornment>
+              ),
+            },
+          }}
+        />
+      )}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/FloatField.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/FloatField.tsx
new file mode 100644
index 00000000000..9fca2721a46
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/FloatField.tsx
@@ -0,0 +1,55 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useFormContext } from 'react-hook-form';
+import { TextInput } from '@percona/percona-ui';
+import { FieldLabelWithHelp } from '../FieldLabelWithHelp';
+import type { FloatField as FloatFieldType } from '../types';
+import { buildValidationRules } from '../utils/validationMapper';
+
+interface FloatFieldProps {
+  field: FloatFieldType;
+}
+
+export function FloatField({ field }: FloatFieldProps) {
+  const { control } = useFormContext();
+  return (
+    <TextInput
+      name={field.name}
+      label={field.label}
+      isRequired={field.required}
+      control={control}
+      textFieldProps={{
+        label: (
+          <FieldLabelWithHelp
+            label={field.label}
+            description={field.description}
+          />
+        ),
+        type: 'number',
+        helperText: field.description,
+        fullWidth: true,
+        inputProps: {
+          min: field.ge,
+          max: field.le,
+          step: field.step ?? 'any',
+        },
+      }}
+      controllerProps={{ rules: buildValidationRules(field) }}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/HostField.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/HostField.tsx
new file mode 100644
index 00000000000..c3a86bb361e
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/HostField.tsx
@@ -0,0 +1,40 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { HostSelector } from '../../HostSelector';
+import { serviceTypesForDependsOn, useFormFields } from '../formFieldsContext';
+import type { HostField as HostFieldType } from '../types';
+
+interface HostFieldProps {
+  field: HostFieldType;
+}
+
+export function HostField({ field }: HostFieldProps) {
+  const fields = useFormFields();
+  const serviceTypes = serviceTypesForDependsOn(fields, field.depends_on);
+
+  return (
+    <HostSelector
+      name={field.name}
+      label={field.label}
+      required={field.required}
+      dependsOn={field.depends_on}
+      serviceTypes={serviceTypes}
+      allowCustom={field.allow_custom}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/IntegerField.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/IntegerField.tsx
new file mode 100644
index 00000000000..08ccd9e3d9b
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/IntegerField.tsx
@@ -0,0 +1,55 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useFormContext } from 'react-hook-form';
+import { TextInput } from '@percona/percona-ui';
+import { FieldLabelWithHelp } from '../FieldLabelWithHelp';
+import type { IntegerField as IntegerFieldType } from '../types';
+import { buildValidationRules } from '../utils/validationMapper';
+
+interface IntegerFieldProps {
+  field: IntegerFieldType;
+}
+
+export function IntegerField({ field }: IntegerFieldProps) {
+  const { control } = useFormContext();
+  return (
+    <TextInput
+      name={field.name}
+      label={field.label}
+      isRequired={field.required}
+      control={control}
+      textFieldProps={{
+        label: (
+          <FieldLabelWithHelp
+            label={field.label}
+            description={field.description}
+          />
+        ),
+        type: 'number',
+        helperText: field.description,
+        fullWidth: true,
+        inputProps: {
+          min: field.ge,
+          max: field.le,
+          step: field.step ?? 1,
+        },
+      }}
+      controllerProps={{ rules: buildValidationRules(field) }}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/MultiChoiceField.test.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/MultiChoiceField.test.tsx
new file mode 100644
index 00000000000..21d0f117e32
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/MultiChoiceField.test.tsx
@@ -0,0 +1,96 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { render, screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { FormProvider, useForm } from 'react-hook-form';
+import { MultiChoiceField } from './MultiChoiceField';
+import type {
+  MultiChoiceField as MultiChoiceFieldType,
+  ChoiceOption,
+} from '../types';
+
+function Harness({
+  field,
+  defaultSelected = [],
+}: {
+  field: MultiChoiceFieldType;
+  defaultSelected?: string[];
+}) {
+  const methods = useForm({ defaultValues: { [field.name]: defaultSelected } });
+  return (
+    <FormProvider {...methods}>
+      <MultiChoiceField field={field} />
+    </FormProvider>
+  );
+}
+
+const CHOICES: ChoiceOption[] = [
+  { value: 'a', label: 'Alpha' },
+  {
+    value: 'b',
+    label: 'Beta',
+    disabled: true,
+    disabled_reason: 'Beta is retired.',
+  },
+];
+
+describe('MultiChoiceField', () => {
+  it('disables the matching option and shows its reason on hover', async () => {
+    const user = userEvent.setup();
+    const field: MultiChoiceFieldType = {
+      type: 'multi_choice',
+      name: 'flags',
+      label: 'Flags',
+      choices: CHOICES,
+    };
+    render(<Harness field={field} />);
+
+    await user.click(screen.getByRole('combobox'));
+
+    const betaLabel = await screen.findByText('Beta');
+    expect(betaLabel.closest('[role="option"]')).toHaveAttribute(
+      'aria-disabled',
+      'true'
+    );
+
+    await user.hover(betaLabel);
+    await waitFor(() => {
+      expect(screen.getByRole('tooltip')).toHaveTextContent('Beta is retired.');
+    });
+  });
+
+  it('keeps an already-selected disabled option de-selectable', async () => {
+    const user = userEvent.setup();
+    const field: MultiChoiceFieldType = {
+      type: 'multi_choice',
+      name: 'flags',
+      label: 'Flags',
+      choices: CHOICES,
+    };
+    render(<Harness field={field} defaultSelected={['b']} />);
+
+    await user.click(screen.getByRole('combobox'));
+
+    // A disabled value that is already selected must stay interactive so the
+    // user can clear it; only unselected disabled options are blocked.
+    const listbox = await screen.findByRole('listbox');
+    const betaOption = within(listbox).getByRole('option', { name: /Beta/ });
+    expect(betaOption).not.toHaveAttribute('aria-disabled', 'true');
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/MultiChoiceField.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/MultiChoiceField.tsx
new file mode 100644
index 00000000000..7e773d55cd3
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/MultiChoiceField.tsx
@@ -0,0 +1,84 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { Controller, useFormContext, useWatch } from 'react-hook-form';
+import Box from '@mui/material/Box';
+import Checkbox from '@mui/material/Checkbox';
+import ListItemText from '@mui/material/ListItemText';
+import MenuItem from '@mui/material/MenuItem';
+import { SchemaSelectShell } from '../SchemaSelectShell';
+import type { MultiChoiceField as MultiChoiceFieldType } from '../types';
+import { buildValidationRules } from '../utils/validationMapper';
+import { renderChoiceLabel } from './choiceLabel';
+
+interface MultiChoiceFieldProps {
+  field: MultiChoiceFieldType;
+}
+
+export function MultiChoiceField({ field }: MultiChoiceFieldProps) {
+  const { control } = useFormContext();
+  const selected =
+    (useWatch({ control, name: field.name }) as string[] | undefined) ?? [];
+  const labelId = `${field.name}-label`;
+
+  return (
+    <Controller
+      name={field.name}
+      control={control}
+      rules={buildValidationRules(field)}
+      render={({ field: rhfField, fieldState: { error } }) => (
+        <SchemaSelectShell
+          field={rhfField}
+          labelId={labelId}
+          label={field.label}
+          required={field.required}
+          error={error}
+          description={field.description}
+          multiple
+          renderValue={(value) => {
+            const values = (value as string[] | undefined) ?? [];
+            if (values.length === 0) {
+              return (
+                <Box component="span" sx={{ color: 'text.disabled' }}>
+                  Select…
+                </Box>
+              );
+            }
+            return field.choices
+              .filter((c) => values.includes(c.value))
+              .map((c) => c.label)
+              .join(', ');
+          }}
+        >
+          {field.choices.map((choice) => (
+            <MenuItem
+              key={choice.value}
+              value={choice.value}
+              // Only block disabled options that are not already selected, so a
+              // value that was selected before becoming disabled can still be
+              // de-selected (a fully disabled MenuItem swallows the toggle).
+              disabled={choice.disabled && !selected.includes(choice.value)}
+            >
+              <Checkbox checked={selected.includes(choice.value)} />
+              <ListItemText primary={renderChoiceLabel(choice)} />
+            </MenuItem>
+          ))}
+        </SchemaSelectShell>
+      )}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/RemoteChoiceField.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/RemoteChoiceField.tsx
new file mode 100644
index 00000000000..54bcf2828b3
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/RemoteChoiceField.tsx
@@ -0,0 +1,36 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { RemoteChoiceSelector } from '../../RemoteChoiceSelector';
+import type { RemoteChoiceField as RemoteChoiceFieldType } from '../types';
+
+interface RemoteChoiceFieldProps {
+  field: RemoteChoiceFieldType;
+}
+
+export function RemoteChoiceField({ field }: RemoteChoiceFieldProps) {
+  return (
+    <RemoteChoiceSelector
+      name={field.name}
+      label={field.label}
+      required={field.required}
+      endpointUrl={field.endpoint_url}
+      dependsOn={field.depends_on}
+      allowCustom={field.allow_custom}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/SchemaField.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/SchemaField.tsx
new file mode 100644
index 00000000000..52dd137692f
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/SchemaField.tsx
@@ -0,0 +1,35 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { SchemaSelector } from '../../SchemaSelector';
+import type { SchemaField as SchemaFieldType } from '../types';
+
+interface SchemaFieldProps {
+  field: SchemaFieldType;
+}
+
+export function SchemaField({ field }: SchemaFieldProps) {
+  return (
+    <SchemaSelector
+      name={field.name}
+      label={field.label}
+      required={field.required}
+      dependsOn={field.depends_on}
+      allowCustom={field.allow_custom}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/ScriptPreviewField.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/ScriptPreviewField.tsx
new file mode 100644
index 00000000000..16175be7fa2
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/ScriptPreviewField.tsx
@@ -0,0 +1,180 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useEffect, useMemo, useRef, useState } from 'react';
+import { Alert, Box, CircularProgress, Typography } from '@mui/material';
+import { useTheme } from '@mui/material/styles';
+import { useFormContext, useWatch } from 'react-hook-form';
+import { PrismLight as SyntaxHighlighter } from 'react-syntax-highlighter';
+import bash from 'react-syntax-highlighter/dist/esm/languages/prism/bash';
+import python from 'react-syntax-highlighter/dist/esm/languages/prism/python';
+import {
+  vs,
+  vscDarkPlus,
+} from 'react-syntax-highlighter/dist/esm/styles/prism';
+import { apiClient } from '@sep/api';
+import type { ScriptPreviewField as ScriptPreviewFieldType } from '../types';
+
+SyntaxHighlighter.registerLanguage('bash', bash);
+SyntaxHighlighter.registerLanguage('python', python);
+
+interface ScriptPreviewFieldProps {
+  field: ScriptPreviewFieldType;
+}
+
+interface ScriptPreviewResponse {
+  content: string;
+  language: string;
+  is_truncated: boolean;
+}
+
+interface PreviewState {
+  status: 'idle' | 'loading' | 'success' | 'error';
+  data: ScriptPreviewResponse | null;
+  error: string | null;
+}
+
+const DEBOUNCE_MS = 300;
+
+/**
+ * Read-only field that renders a backend-fetched script preview.
+ *
+ * Fetches `endpointUrl` on mount and re-fetches whenever any sibling field
+ * listed in `dependsOn` changes value — debounced and cancellation-safe via
+ * an AbortController. Renders the response's `content` with Prism-based
+ * syntax highlighting (bash and python registered; unknown languages fall
+ * back to no-color rendering). The rendered `<pre>` keeps `tabIndex={0}`
+ * and a `data-language` attribute so the scrollable region remains
+ * keyboard-focusable.
+ */
+export function ScriptPreviewField({ field }: ScriptPreviewFieldProps) {
+  const { control } = useFormContext();
+  const theme = useTheme();
+  const dependsOnValues = useWatch({
+    control,
+    name: field.depends_on,
+  });
+  const dependsOnKey = useMemo(
+    () => JSON.stringify(dependsOnValues ?? []),
+    [dependsOnValues]
+  );
+  const dependsOnSchema = useMemo(
+    () => JSON.stringify(field.depends_on),
+    [field.depends_on]
+  );
+
+  const [state, setState] = useState<PreviewState>({
+    status: 'idle',
+    data: null,
+    error: null,
+  });
+  const abortRef = useRef<AbortController | null>(null);
+
+  useEffect(() => {
+    abortRef.current?.abort();
+    const controller = new AbortController();
+    abortRef.current = controller;
+
+    const handle = setTimeout(
+      () => {
+        setState((prev) => ({ ...prev, status: 'loading', error: null }));
+        apiClient
+          .get<ScriptPreviewResponse>(field.endpoint_url, {
+            signal: controller.signal,
+          })
+          .then((response) => {
+            setState({ status: 'success', data: response.data, error: null });
+          })
+          .catch((error: unknown) => {
+            if (controller.signal.aborted) {
+              return;
+            }
+            const message =
+              error instanceof Error ? error.message : 'Preview unavailable';
+            setState({ status: 'error', data: null, error: message });
+          });
+      },
+      field.depends_on.length > 0 ? DEBOUNCE_MS : 0
+    );
+
+    return () => {
+      clearTimeout(handle);
+      controller.abort();
+    };
+  }, [field.endpoint_url, dependsOnSchema, dependsOnKey]);
+
+  return (
+    <Box
+      sx={{
+        border: 1,
+        borderColor: 'divider',
+        borderRadius: 1,
+        p: 1,
+        backgroundColor: (theme) =>
+          theme.palette.mode === 'light'
+            ? theme.palette.grey[50]
+            : theme.palette.grey[900],
+      }}
+    >
+      <Typography variant="subtitle2" sx={{ mb: 1 }}>
+        {field.label}
+      </Typography>
+      {state.status === 'loading' && (
+        <Box sx={{ display: 'flex', justifyContent: 'center', py: 2 }}>
+          <CircularProgress size={20} aria-label="Loading preview" />
+        </Box>
+      )}
+      {state.status === 'error' && (
+        <Alert severity="error" variant="outlined">
+          {state.error ?? 'Preview unavailable'}
+        </Alert>
+      )}
+      {state.status === 'success' &&
+        state.data &&
+        (() => {
+          const language = state.data.language || field.language || 'plaintext';
+          const highlighterStyle =
+            theme.palette.mode === 'dark' ? vscDarkPlus : vs;
+          return (
+            <>
+              {state.data.is_truncated && (
+                <Typography variant="caption" color="text.secondary">
+                  Preview truncated.
+                </Typography>
+              )}
+              <SyntaxHighlighter
+                language={language}
+                style={highlighterStyle}
+                customStyle={{
+                  margin: 0,
+                  maxHeight: 400,
+                  overflow: 'auto',
+                  fontSize: '0.85rem',
+                  borderRadius: 4,
+                }}
+                PreTag={(props) => (
+                  <pre tabIndex={0} data-language={language} {...props} />
+                )}
+              >
+                {state.data.content}
+              </SyntaxHighlighter>
+            </>
+          );
+        })()}
+    </Box>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/ServiceField.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/ServiceField.tsx
new file mode 100644
index 00000000000..727be318181
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/ServiceField.tsx
@@ -0,0 +1,36 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { ServiceSelector } from '../../ServiceSelector';
+import type { ServiceType } from '../../../hooks/useServices';
+import type { ServiceField as ServiceFieldType } from '../types';
+
+interface ServiceFieldProps {
+  field: ServiceFieldType;
+}
+
+export function ServiceField({ field }: ServiceFieldProps) {
+  return (
+    <ServiceSelector
+      name={field.name}
+      label={field.label}
+      required={field.required}
+      serviceTypes={field.service_types as readonly ServiceType[]}
+      allowCustom={field.allow_custom}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/StringField.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/StringField.tsx
new file mode 100644
index 00000000000..8d858e9993c
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/StringField.tsx
@@ -0,0 +1,50 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useFormContext } from 'react-hook-form';
+import { TextInput } from '@percona/percona-ui';
+import { FieldLabelWithHelp } from '../FieldLabelWithHelp';
+import type { StringField as StringFieldType } from '../types';
+import { buildValidationRules } from '../utils/validationMapper';
+
+interface StringFieldProps {
+  field: StringFieldType;
+}
+
+export function StringField({ field }: StringFieldProps) {
+  const { control } = useFormContext();
+  return (
+    <TextInput
+      name={field.name}
+      label={field.label}
+      isRequired={field.required}
+      control={control}
+      textFieldProps={{
+        label: (
+          <FieldLabelWithHelp
+            label={field.label}
+            description={field.description}
+          />
+        ),
+        placeholder: field.placeholder,
+        helperText: field.description,
+        fullWidth: true,
+      }}
+      controllerProps={{ rules: buildValidationRules(field) }}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/TableField.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/TableField.tsx
new file mode 100644
index 00000000000..1b0dd336669
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/TableField.tsx
@@ -0,0 +1,35 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { TableSelector } from '../../TableSelector';
+import type { TableField as TableFieldType } from '../types';
+
+interface TableFieldProps {
+  field: TableFieldType;
+}
+
+export function TableField({ field }: TableFieldProps) {
+  return (
+    <TableSelector
+      name={field.name}
+      label={field.label}
+      required={field.required}
+      dependsOn={field.depends_on}
+      allowCustom={field.allow_custom}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/TextAreaField.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/TextAreaField.tsx
new file mode 100644
index 00000000000..b8e7a79fae9
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/TextAreaField.tsx
@@ -0,0 +1,52 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useFormContext } from 'react-hook-form';
+import { TextInput } from '@percona/percona-ui';
+import { FieldLabelWithHelp } from '../FieldLabelWithHelp';
+import type { TextAreaField as TextAreaFieldType } from '../types';
+import { buildValidationRules } from '../utils/validationMapper';
+
+interface TextAreaFieldProps {
+  field: TextAreaFieldType;
+}
+
+export function TextAreaField({ field }: TextAreaFieldProps) {
+  const { control } = useFormContext();
+  return (
+    <TextInput
+      name={field.name}
+      label={field.label}
+      isRequired={field.required}
+      control={control}
+      textFieldProps={{
+        label: (
+          <FieldLabelWithHelp
+            label={field.label}
+            description={field.description}
+          />
+        ),
+        multiline: true,
+        rows: field.rows ?? 4,
+        placeholder: field.placeholder,
+        helperText: field.description,
+        fullWidth: true,
+      }}
+      controllerProps={{ rules: buildValidationRules(field) }}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/YamlField.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/YamlField.tsx
new file mode 100644
index 00000000000..25fcc149b43
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/YamlField.tsx
@@ -0,0 +1,56 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useFormContext } from 'react-hook-form';
+import { TextInput } from '@percona/percona-ui';
+import { FieldLabelWithHelp } from '../FieldLabelWithHelp';
+import type { YamlField as YamlFieldType } from '../types';
+import { buildValidationRules } from '../utils/validationMapper';
+
+interface YamlFieldProps {
+  field: YamlFieldType;
+}
+
+export function YamlField({ field }: YamlFieldProps) {
+  const { control } = useFormContext();
+  return (
+    <TextInput
+      name={field.name}
+      label={field.label}
+      isRequired={field.required}
+      control={control}
+      textFieldProps={{
+        label: (
+          <FieldLabelWithHelp
+            label={field.label}
+            description={field.description}
+          />
+        ),
+        multiline: true,
+        rows: field.rows ?? 8,
+        placeholder: field.placeholder,
+        helperText: field.description,
+        fullWidth: true,
+        inputProps: {
+          style: { fontFamily: "'Roboto Mono', monospace", fontSize: 13 },
+          spellCheck: false,
+        },
+      }}
+      controllerProps={{ rules: buildValidationRules(field) }}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/choiceLabel.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/choiceLabel.tsx
new file mode 100644
index 00000000000..1b9854ba5b1
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/choiceLabel.tsx
@@ -0,0 +1,42 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type { ReactNode } from 'react';
+import Box from '@mui/material/Box';
+import Tooltip from '@mui/material/Tooltip';
+import type { ChoiceOption } from '../types';
+
+/**
+ * Render a choice's label, wrapping it in a Tooltip + span when the option is
+ * disabled and carries a reason. MUI tooltips never fire on a disabled element
+ * directly, so the span is the hover target; `pointerEvents: 'auto'` re-enables
+ * hover inside a disabled `<MenuItem>` (whose root sets `pointer-events: none`)
+ * and is harmless elsewhere. Enabled options (or disabled ones with no reason)
+ * render the plain label string.
+ */
+export function renderChoiceLabel(choice: ChoiceOption): ReactNode {
+  if (choice.disabled && choice.disabled_reason) {
+    return (
+      <Tooltip title={choice.disabled_reason}>
+        <Box component="span" sx={{ pointerEvents: 'auto' }}>
+          {choice.label}
+        </Box>
+      </Tooltip>
+    );
+  }
+  return choice.label;
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/index.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/index.tsx
new file mode 100644
index 00000000000..8b3ca53943f
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/fields/index.tsx
@@ -0,0 +1,105 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type { PluginField } from '../types';
+import { StringField } from './StringField';
+import { IntegerField } from './IntegerField';
+import { FloatField } from './FloatField';
+import { BoolField } from './BoolField';
+import { ChoiceField } from './ChoiceField';
+import { MultiChoiceField } from './MultiChoiceField';
+import { TextAreaField } from './TextAreaField';
+import { DateTimeField } from './DateTimeField';
+import { FileField } from './FileField';
+import { YamlField } from './YamlField';
+import { ServiceField } from './ServiceField';
+import { SchemaField } from './SchemaField';
+import { TableField } from './TableField';
+import { HostField } from './HostField';
+import { RemoteChoiceField } from './RemoteChoiceField';
+import { ScriptPreviewField } from './ScriptPreviewField';
+
+export {
+  StringField,
+  IntegerField,
+  FloatField,
+  BoolField,
+  ChoiceField,
+  MultiChoiceField,
+  TextAreaField,
+  DateTimeField,
+  FileField,
+  YamlField,
+  ServiceField,
+  SchemaField,
+  TableField,
+  HostField,
+  RemoteChoiceField,
+  ScriptPreviewField,
+};
+
+interface FieldRendererProps {
+  field: PluginField;
+}
+
+/**
+ * Dispatches a PluginField to the concrete component for its `type` discriminator.
+ *
+ * The switch is exhaustive on the discriminated union — adding a new field type
+ * to `PluginField` will surface a TypeScript error here until the case is added.
+ */
+export function FieldRenderer({ field }: FieldRendererProps) {
+  switch (field.type) {
+    case 'string':
+      return <StringField field={field} />;
+    case 'integer':
+      return <IntegerField field={field} />;
+    case 'float':
+      return <FloatField field={field} />;
+    case 'bool':
+      return <BoolField field={field} />;
+    case 'choice':
+      return <ChoiceField field={field} />;
+    case 'multi_choice':
+      return <MultiChoiceField field={field} />;
+    case 'textarea':
+      return <TextAreaField field={field} />;
+    case 'datetime':
+      return <DateTimeField field={field} />;
+    case 'file':
+      return <FileField field={field} />;
+    case 'yaml':
+      return <YamlField field={field} />;
+    case 'service':
+      return <ServiceField field={field} />;
+    case 'schema':
+      return <SchemaField field={field} />;
+    case 'table':
+      return <TableField field={field} />;
+    case 'host':
+      return <HostField field={field} />;
+    case 'script_preview':
+      return <ScriptPreviewField field={field} />;
+    case 'remote_choice':
+      return <RemoteChoiceField field={field} />;
+    default: {
+      const exhaustive: never = field;
+      void exhaustive;
+      return null;
+    }
+  }
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/formFieldsContext.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/formFieldsContext.tsx
new file mode 100644
index 00000000000..c6c7046d92e
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/formFieldsContext.tsx
@@ -0,0 +1,54 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { createContext, useContext } from 'react';
+import type { ServiceType } from '../../hooks/useServices';
+import type { PluginField } from './types';
+
+const EMPTY_FIELDS: readonly PluginField[] = Object.freeze([]);
+
+/**
+ * Flat leaf fields for the active {@link SchemaFormRenderer} form. Used by
+ * cascaded widgets (e.g. host ← service) to read sibling field metadata such as
+ * ``service_types`` without threading the full section tree through every slot.
+ */
+const FormFieldsContext = createContext<readonly PluginField[]>(EMPTY_FIELDS);
+
+export const FormFieldsProvider = FormFieldsContext.Provider;
+
+export function useFormFields(): readonly PluginField[] {
+  return useContext(FormFieldsContext);
+}
+
+/**
+ * Return the ``service_types`` declared on the upstream service field named
+ * ``dependsOn``, if any. Used to bound host-cascade ``useServices`` fetches to
+ * the same type filter as the parent selector (and to share its query cache).
+ */
+export function serviceTypesForDependsOn(
+  fields: readonly PluginField[],
+  dependsOn: string | undefined
+): readonly ServiceType[] | undefined {
+  if (!dependsOn) {
+    return undefined;
+  }
+  const parent = fields.find((field) => field.name === dependsOn);
+  if (parent?.type === 'service') {
+    return parent.service_types as readonly ServiceType[];
+  }
+  return undefined;
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useCardinalityRules.ts b/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useCardinalityRules.ts
new file mode 100644
index 00000000000..7e34155d39c
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useCardinalityRules.ts
@@ -0,0 +1,115 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useMemo } from 'react';
+import { useFormContext, useWatch } from 'react-hook-form';
+import type { CardinalityRule, FormSection } from '../types';
+import {
+  evaluatePredicate,
+  getGateFieldNames,
+  isPresent,
+} from '../utils/predicateEvaluator';
+import { watchValuesByName } from '../utils/watchValuesByName';
+
+export interface CardinalityViolation {
+  message: string;
+}
+
+function defaultMessage(fields: string[], min: number, max: number): string {
+  const n = fields.length;
+  if (min === max) {
+    return `Exactly ${min} of these ${n} fields must be filled: ${fields.join(', ')}.`;
+  }
+  if (max === Infinity) {
+    return `At least ${min} of these ${n} fields must be filled: ${fields.join(', ')}.`;
+  }
+  if (min === 0) {
+    return `At most ${max} of these ${n} fields may be filled: ${fields.join(', ')}.`;
+  }
+  return `Between ${min} and ${max} of these ${n} fields must be filled: ${fields.join(', ')}.`;
+}
+
+function checkRule(
+  rule: CardinalityRule,
+  map: Record<string, unknown>
+): CardinalityViolation | null {
+  if (rule.when && !evaluatePredicate(rule.when, map)) {
+    return null;
+  }
+  const presentCount = rule.fields.filter((f) => isPresent(map[f])).length;
+  const min = rule.min ?? 0;
+  const max = rule.max ?? Infinity;
+  if (presentCount < min || presentCount > max) {
+    return { message: rule.message ?? defaultMessage(rule.fields, min, max) };
+  }
+  return null;
+}
+
+/**
+ * Evaluates cardinality_rules for all sections against current form values.
+ *
+ * Returns a parallel array of violations per section — index i corresponds to
+ * sections[i]. Uses a single useWatch subscription over all referenced fields
+ * so there is only one React subscription per form regardless of rule count.
+ */
+export function useCardinalityRules(
+  sections: FormSection[]
+): CardinalityViolation[][] {
+  const { control } = useFormContext();
+
+  const allRules = useMemo(
+    () => sections.map((s) => s.cardinality_rules ?? []),
+    [sections]
+  );
+
+  const watchedNames = useMemo(() => {
+    const names = new Set<string>();
+    for (const rules of allRules) {
+      for (const rule of rules) {
+        for (const f of rule.fields) {
+          names.add(f);
+        }
+        if (rule.when) {
+          for (const f of getGateFieldNames([{ when: rule.when }])) {
+            names.add(f);
+          }
+        }
+      }
+    }
+    return [...names];
+  }, [allRules]);
+
+  const rawValues = useWatch({
+    control,
+    name: watchedNames,
+    disabled: watchedNames.length === 0,
+  }) as unknown[];
+
+  return useMemo(() => {
+    const map = watchValuesByName(watchedNames, rawValues);
+    return allRules.map((rules) => {
+      const violations: CardinalityViolation[] = [];
+      for (const rule of rules) {
+        const v = checkRule(rule, map);
+        if (v) {
+          violations.push(v);
+        }
+      }
+      return violations;
+    });
+  }, [rawValues, allRules, watchedNames]);
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useCascadingField.ts b/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useCascadingField.ts
new file mode 100644
index 00000000000..f78a67c6a53
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useCascadingField.ts
@@ -0,0 +1,89 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useEffect, useRef } from 'react';
+import { useFormContext, useWatch } from 'react-hook-form';
+
+interface UseCascadingFieldArgs {
+  /** Name of the field owning the cascade (the downstream field). */
+  fieldName: string;
+  /** Name of the upstream field to observe, or undefined if this field has no dependency. */
+  dependsOn?: string;
+}
+
+interface UseCascadingFieldResult<T> {
+  /** Current value of the upstream field, or undefined if no dependency is declared. */
+  upstreamValue: T | undefined;
+  /**
+   * True once the upstream value is set (or if there is no dependency). An
+   * upstream selector with nothing selected holds `''`, which is not ready.
+   */
+  ready: boolean;
+}
+
+/**
+ * Observe an upstream field and reset this field when the upstream changes.
+ *
+ * Domain selectors (schema -> service, table -> schema) need to clear their
+ * current value when the parent changes so stale selections cannot submit.
+ * Consumers still own option fetching; the hook only tracks the dependency.
+ */
+export function useCascadingField<T = unknown>({
+  fieldName,
+  dependsOn,
+}: UseCascadingFieldArgs): UseCascadingFieldResult<T> {
+  const { control, setValue } = useFormContext();
+  const upstreamValue = useWatch({
+    control,
+    name: dependsOn ?? '',
+    disabled: !dependsOn,
+  }) as T | undefined;
+  const previousRef = useRef<T | undefined>(
+    dependsOn ? upstreamValue : undefined
+  );
+  const didMountRef = useRef(false);
+
+  useEffect(() => {
+    if (!dependsOn) {
+      return;
+    }
+    if (!didMountRef.current) {
+      didMountRef.current = true;
+      previousRef.current = upstreamValue;
+      return;
+    }
+    if (previousRef.current !== upstreamValue) {
+      // `''` is the form's empty-value sentinel for these selector types (see
+      // `buildFormDefaults`). `undefined` would also flip a bound MUI input
+      // from controlled to uncontrolled and keep the stale selection visible.
+      setValue(fieldName, '', {
+        shouldValidate: false,
+        shouldDirty: false,
+      });
+      previousRef.current = upstreamValue;
+    }
+  }, [upstreamValue, fieldName, dependsOn, setValue]);
+
+  const upstream = upstreamValue as unknown;
+
+  return {
+    upstreamValue: dependsOn ? upstreamValue : undefined,
+    ready: dependsOn
+      ? upstream !== undefined && upstream !== null && upstream !== ''
+      : true,
+  };
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useConditionalField.ts b/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useConditionalField.ts
new file mode 100644
index 00000000000..b3b17a1453e
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useConditionalField.ts
@@ -0,0 +1,88 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useEffect, useMemo } from 'react';
+import { useFormContext, useWatch } from 'react-hook-form';
+import type { PluginField } from '../types';
+import {
+  evaluatePredicate,
+  getGateFieldNames,
+} from '../utils/predicateEvaluator';
+import { watchValuesByName } from '../utils/watchValuesByName';
+
+export interface ConditionalFieldState {
+  isHidden: boolean;
+  isRequired: boolean;
+}
+
+/**
+ * Evaluate a field's `requires` and `forbidden` gates against current form
+ * values and return the resolved visibility + required state.
+ *
+ * When `isHidden` becomes true the hook unregisters the field from
+ * react-hook-form so its stale value is excluded from submission.
+ */
+export function useConditionalField(field: PluginField): ConditionalFieldState {
+  const { control, unregister } = useFormContext();
+
+  const watchedNames = useMemo<string[]>(() => {
+    const requires = field.requires ?? [];
+    const forbidden = field.forbidden ?? [];
+    return getGateFieldNames([...requires, ...forbidden]);
+    // field schema is static for the form's lifetime; dep on field is safe.
+  }, [field]);
+
+  // disabled=true when there are no gate fields — avoids subscribing to the
+  // whole form when useWatch receives an empty name array.
+  const rawValues = useWatch({
+    control,
+    name: watchedNames,
+    disabled: watchedNames.length === 0,
+  }) as unknown[];
+
+  const isHidden = useMemo(() => {
+    if (!field.forbidden?.length) {
+      return false;
+    }
+    const map = watchValuesByName(watchedNames, rawValues);
+    return field.forbidden.some((gate) => evaluatePredicate(gate.when, map));
+  }, [rawValues, field, watchedNames]);
+
+  const isRequired = useMemo(() => {
+    if (field.required) {
+      return true;
+    }
+    if (!field.requires?.length) {
+      return false;
+    }
+    const map = watchValuesByName(watchedNames, rawValues);
+    return field.requires.some((gate) => evaluatePredicate(gate.when, map));
+  }, [rawValues, field, watchedNames]);
+
+  // When a field becomes hidden its value must not appear in the submission
+  // payload. Unregistering removes it from RHF state immediately.
+  // On re-show, ConditionalFieldSlot remounts FieldRenderer, which re-calls
+  // register() and the field starts fresh — intentional: the hidden value
+  // is stale and should not silently resubmit.
+  useEffect(() => {
+    if (isHidden) {
+      unregister(field.name);
+    }
+  }, [isHidden, field.name, unregister]);
+
+  return { isHidden, isRequired };
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useConditionalSection.ts b/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useConditionalSection.ts
new file mode 100644
index 00000000000..6db17f1a639
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useConditionalSection.ts
@@ -0,0 +1,99 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useEffect, useMemo } from 'react';
+import { useFormContext, useWatch } from 'react-hook-form';
+import type { FormSection } from '../types';
+import { isOneOfGroup } from '../utils/flattenSectionFields';
+import {
+  evaluatePredicate,
+  getGateFieldNames,
+} from '../utils/predicateEvaluator';
+import { watchValuesByName } from '../utils/watchValuesByName';
+
+export interface ConditionalSectionState {
+  isHidden: boolean;
+}
+
+/**
+ * Evaluate a FormSection's ``forbidden`` gates against current form values.
+ * When any gate fires the section becomes hidden and every child field is
+ * unregistered from react-hook-form so stale values do not ship in the
+ * submission payload.
+ *
+ * Cardinality (repeated) sections are out of scope for this hook — none
+ * of the current schema-driven plugins gate a cardinality_rules-driven
+ * section. Revisit if a future plugin needs the combination.
+ */
+export function useConditionalSection(
+  section: FormSection
+): ConditionalSectionState {
+  const { control, unregister } = useFormContext();
+
+  const watchedNames = useMemo<string[]>(() => {
+    const forbidden = section.forbidden ?? [];
+    return getGateFieldNames(forbidden);
+    // section schema is static for the form's lifetime; dep on section is safe.
+  }, [section]);
+
+  const rawValues = useWatch({
+    control,
+    name: watchedNames,
+    disabled: watchedNames.length === 0,
+  }) as unknown[];
+
+  const isHidden = useMemo(() => {
+    if (!section.forbidden?.length) {
+      return false;
+    }
+    const map = watchValuesByName(watchedNames, rawValues);
+    return section.forbidden.some((gate) => evaluatePredicate(gate.when, map));
+  }, [rawValues, section, watchedNames]);
+
+  const sectionFieldNames = useMemo<string[]>(() => {
+    const names = new Set<string>();
+    for (const field of section.fields) {
+      if (isOneOfGroup(field)) {
+        names.add(field.name);
+        names.add(field.discriminator);
+        for (const branch of field.branches) {
+          for (const leaf of branch.fields) {
+            names.add(leaf.name);
+          }
+        }
+        continue;
+      }
+      names.add(field.name);
+    }
+    return [...names];
+  }, [section.fields]);
+
+  // When the section becomes hidden every child field must drop out of
+  // RHF state so its (possibly default) value does not ship. On re-show,
+  // SectionRenderer re-mounts the children which re-call register() and
+  // start fresh — intentional: stale user input from the prior session
+  // would otherwise ship in the payload and fail backend cross-mode validation.
+  useEffect(() => {
+    if (isHidden) {
+      for (const name of sectionFieldNames) {
+        unregister(name);
+      }
+    }
+  }, [isHidden, sectionFieldNames, unregister]);
+
+  return { isHidden };
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useFailRules.ts b/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useFailRules.ts
new file mode 100644
index 00000000000..af0d571d517
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useFailRules.ts
@@ -0,0 +1,89 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useMemo } from 'react';
+import { useFormContext, useWatch } from 'react-hook-form';
+import type { FormSection } from '../types';
+import {
+  evaluatePredicate,
+  getGateFieldNames,
+} from '../utils/predicateEvaluator';
+import { watchValuesByName } from '../utils/watchValuesByName';
+
+export interface FailViolation {
+  message: string;
+  /** Field names to highlight in the UI — rendering hint from the schema. */
+  error_fields: string[];
+}
+
+function defaultFailMessage(): string {
+  return 'This combination of values is not allowed.';
+}
+
+/**
+ * Evaluates fail_when rules for all sections against current form values.
+ *
+ * A fail_when rule fires when its predicate evaluates to true — the inverse of
+ * cardinality_rules (which fire when a count constraint is violated). Mirrors
+ * the BE ConditionalRulesModel.apply_conditional_rules fail_when evaluation.
+ *
+ * Returns a parallel array of violations per section — index i corresponds to
+ * sections[i]. Uses a single useWatch subscription over all referenced fields.
+ */
+export function useFailRules(sections: FormSection[]): FailViolation[][] {
+  const { control } = useFormContext();
+
+  const allRules = useMemo(
+    () => sections.map((s) => s.fail_when ?? []),
+    [sections]
+  );
+
+  const watchedNames = useMemo(() => {
+    const names = new Set<string>();
+    for (const rules of allRules) {
+      for (const rule of rules) {
+        // Watch all fields referenced in the predicate expression.
+        for (const f of getGateFieldNames([{ when: rule.fail_when }])) {
+          names.add(f);
+        }
+      }
+    }
+    return [...names];
+  }, [allRules]);
+
+  const rawValues = useWatch({
+    control,
+    name: watchedNames,
+    disabled: watchedNames.length === 0,
+  }) as unknown[];
+
+  return useMemo(() => {
+    const map = watchValuesByName(watchedNames, rawValues);
+    return allRules.map((rules) => {
+      const violations: FailViolation[] = [];
+      for (const rule of rules) {
+        if (evaluatePredicate(rule.fail_when, map)) {
+          violations.push({
+            message: rule.message ?? defaultFailMessage(),
+            error_fields: rule.error_fields,
+          });
+        }
+      }
+      return violations;
+    });
+  }, [rawValues, allRules, watchedNames]);
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useUnsavedChangesGuard.test.tsx b/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useUnsavedChangesGuard.test.tsx
new file mode 100644
index 00000000000..5feb80013ae
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useUnsavedChangesGuard.test.tsx
@@ -0,0 +1,218 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { renderHook, act } from '@testing-library/react';
+import { useUnsavedChangesGuard } from './useUnsavedChangesGuard';
+
+// ── Mock setup ────────────────────────────────────────────────────────────────
+
+const mockReset = vi.hoisted(() => vi.fn());
+const mockUseFormContext = vi.hoisted(() => vi.fn());
+
+vi.mock('react-hook-form', async (importOriginal) => {
+  const actual = (await importOriginal()) as Record<string, unknown>;
+  return {
+    ...actual,
+    useFormContext: mockUseFormContext,
+  };
+});
+
+function setFormState({
+  isDirty = false,
+  isSubmitSuccessful = false,
+}: {
+  isDirty?: boolean;
+  isSubmitSuccessful?: boolean;
+}) {
+  mockUseFormContext.mockReturnValue({
+    formState: { isDirty, isSubmitSuccessful },
+    reset: mockReset,
+  });
+}
+
+// ── Predicate tests ───────────────────────────────────────────────────────────
+
+describe('useUnsavedChangesGuard — isGuarded predicate', () => {
+  beforeEach(() => {
+    mockReset.mockReset();
+    setFormState({});
+  });
+
+  it('returns false when form is clean', () => {
+    setFormState({ isDirty: false, isSubmitSuccessful: false });
+    const { result } = renderHook(() => useUnsavedChangesGuard());
+    expect(result.current).toBe(false);
+  });
+
+  it('returns true when form is dirty', () => {
+    setFormState({ isDirty: true, isSubmitSuccessful: false });
+    const { result } = renderHook(() => useUnsavedChangesGuard());
+    expect(result.current).toBe(true);
+  });
+
+  it('returns false when dirty but submit was successful (post-submit navigation must not be blocked)', () => {
+    setFormState({ isDirty: true, isSubmitSuccessful: true });
+    const { result } = renderHook(() => useUnsavedChangesGuard());
+    expect(result.current).toBe(false);
+  });
+
+  it('returns false when both clean and submit successful', () => {
+    setFormState({ isDirty: false, isSubmitSuccessful: true });
+    const { result } = renderHook(() => useUnsavedChangesGuard());
+    expect(result.current).toBe(false);
+  });
+});
+
+// ── beforeunload listener lifecycle ──────────────────────────────────────────
+
+describe('useUnsavedChangesGuard — beforeunload listener', () => {
+  let addSpy: ReturnType<typeof vi.spyOn>;
+  let removeSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    mockReset.mockReset();
+    addSpy = vi.spyOn(window, 'addEventListener');
+    removeSpy = vi.spyOn(window, 'removeEventListener');
+  });
+
+  afterEach(() => {
+    addSpy.mockRestore();
+    removeSpy.mockRestore();
+  });
+
+  it('registers beforeunload listener when guarded', () => {
+    setFormState({ isDirty: true, isSubmitSuccessful: false });
+    renderHook(() => useUnsavedChangesGuard());
+    expect(addSpy).toHaveBeenCalledWith('beforeunload', expect.any(Function));
+  });
+
+  it('does not register beforeunload listener when not guarded', () => {
+    setFormState({ isDirty: false, isSubmitSuccessful: false });
+    renderHook(() => useUnsavedChangesGuard());
+    const beforeunloadCalls = addSpy.mock.calls.filter(
+      ([event]: [string]) => event === 'beforeunload'
+    );
+    expect(beforeunloadCalls).toHaveLength(0);
+  });
+
+  it('removes beforeunload listener when form becomes clean', () => {
+    setFormState({ isDirty: true, isSubmitSuccessful: false });
+    const { rerender } = renderHook(() => useUnsavedChangesGuard());
+
+    setFormState({ isDirty: false, isSubmitSuccessful: false });
+    act(() => rerender());
+
+    expect(removeSpy).toHaveBeenCalledWith(
+      'beforeunload',
+      expect.any(Function)
+    );
+  });
+
+  it('removes beforeunload listener when submit succeeds', () => {
+    setFormState({ isDirty: true, isSubmitSuccessful: false });
+    const { rerender } = renderHook(() => useUnsavedChangesGuard());
+
+    setFormState({ isDirty: true, isSubmitSuccessful: true });
+    act(() => rerender());
+
+    expect(removeSpy).toHaveBeenCalledWith(
+      'beforeunload',
+      expect.any(Function)
+    );
+  });
+
+  it('removes beforeunload listener on unmount', () => {
+    setFormState({ isDirty: true, isSubmitSuccessful: false });
+    const { unmount } = renderHook(() => useUnsavedChangesGuard());
+    unmount();
+    expect(removeSpy).toHaveBeenCalledWith(
+      'beforeunload',
+      expect.any(Function)
+    );
+  });
+});
+
+// ── Re-arm behaviour ──────────────────────────────────────────────────────────
+
+describe('useUnsavedChangesGuard — re-arm after failed async mutation', () => {
+  beforeEach(() => {
+    mockReset.mockReset();
+  });
+
+  it('calls reset() when submitError becomes truthy after a successful sync submit', () => {
+    setFormState({ isDirty: true, isSubmitSuccessful: true });
+
+    const { rerender } = renderHook(
+      (props: { submitError?: string | null }) =>
+        useUnsavedChangesGuard(props.submitError),
+      { initialProps: { submitError: null as string | null } }
+    );
+
+    act(() => rerender({ submitError: 'Server rejected the request' }));
+
+    expect(mockReset).toHaveBeenCalledWith(undefined, {
+      keepValues: true,
+      keepDirty: true,
+      keepIsSubmitted: false,
+    });
+  });
+
+  it('does not call reset() when submitError is set but submit was not yet successful', () => {
+    setFormState({ isDirty: true, isSubmitSuccessful: false });
+
+    const { rerender } = renderHook(
+      (props: { submitError?: string | null }) =>
+        useUnsavedChangesGuard(props.submitError),
+      { initialProps: { submitError: null as string | null } }
+    );
+
+    act(() => rerender({ submitError: 'Unrelated error from a prior render' }));
+
+    expect(mockReset).not.toHaveBeenCalled();
+  });
+
+  it('re-arms guard on each consecutive submit failure even when submitError string is unchanged', () => {
+    // After first re-arm reset() clears isSubmitSuccessful→false. A second
+    // submit flips it back to true while submitError stays the same string.
+    // The effect must fire again because isSubmitSuccessful changed.
+    setFormState({ isDirty: true, isSubmitSuccessful: false });
+
+    const { rerender } = renderHook(
+      (props: { submitError?: string | null }) =>
+        useUnsavedChangesGuard(props.submitError),
+      { initialProps: { submitError: null as string | null } }
+    );
+
+    // First failure: isSubmitSuccessful flips to true, submitError arrives
+    setFormState({ isDirty: true, isSubmitSuccessful: true });
+    act(() => rerender({ submitError: 'Server error' }));
+    expect(mockReset).toHaveBeenCalledTimes(1);
+
+    // Simulate the reset() having cleared isSubmitSuccessful — must rerender so
+    // the effect sees the intermediate false value before the next true flip.
+    mockReset.mockReset();
+    setFormState({ isDirty: true, isSubmitSuccessful: false });
+    act(() => rerender({ submitError: 'Server error' }));
+    expect(mockReset).not.toHaveBeenCalled();
+
+    // Second submit: isSubmitSuccessful flips to true again, same error string
+    setFormState({ isDirty: true, isSubmitSuccessful: true });
+    act(() => rerender({ submitError: 'Server error' }));
+    expect(mockReset).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useUnsavedChangesGuard.ts b/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useUnsavedChangesGuard.ts
new file mode 100644
index 00000000000..7a55f833f13
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/hooks/useUnsavedChangesGuard.ts
@@ -0,0 +1,68 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useEffect } from 'react';
+import { useFormContext } from 'react-hook-form';
+
+/**
+ * Computes the "dirty and not yet successfully submitted" guard predicate,
+ * registers a beforeunload listener while guarded, and re-arms the guard
+ * (clears isSubmitSuccessful) when the parent reports a server error after a
+ * prior successful synchronous submit.
+ *
+ * Returns `isGuarded` so the caller can pass it to an in-app navigation blocker.
+ * Must be called inside a `<FormProvider>`.
+ */
+export function useUnsavedChangesGuard(submitError?: string | null): boolean {
+  const { formState, reset } = useFormContext<Record<string, unknown>>();
+  const { isDirty, isSubmitSuccessful } = formState;
+  const isGuarded = isDirty && !isSubmitSuccessful;
+
+  // Re-arm: clear isSubmitSuccessful each time the parent's async mutation fails
+  // after the synchronous onSubmit returned without throwing (RHF flips
+  // isSubmitSuccessful=true before the async leg resolves). This fires whenever
+  // isSubmitSuccessful transitions back to true while an error is present —
+  // covering both the first failure and subsequent failures with the same error
+  // string, since the dep on isSubmitSuccessful ensures re-execution.
+  // Note: useForm always initialises isSubmitSuccessful=false, so this effect
+  // cannot fire spuriously on mount.
+  useEffect(() => {
+    if (submitError && isSubmitSuccessful) {
+      reset(undefined, {
+        keepValues: true,
+        keepDirty: true,
+        keepIsSubmitted: false,
+      });
+    }
+  }, [submitError, isSubmitSuccessful, reset]);
+
+  // Native browser prompt for tab-close / window-close / refresh.
+  // Registered while guarded and removed immediately when predicate goes false.
+  useEffect(() => {
+    if (!isGuarded) {
+      return;
+    }
+    const handler = (e: BeforeUnloadEvent) => {
+      e.preventDefault();
+      e.returnValue = ''; // Safari + older Chromium still require returnValue
+    };
+    window.addEventListener('beforeunload', handler);
+    return () => window.removeEventListener('beforeunload', handler);
+  }, [isGuarded]);
+
+  return isGuarded;
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/index.ts b/ui/packages/sep/framework/src/components/SchemaFormRenderer/index.ts
new file mode 100644
index 00000000000..9f498ddff3c
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/index.ts
@@ -0,0 +1,43 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { SchemaFormRenderer } from './SchemaFormRenderer';
+export type { SchemaFormRendererProps } from './SchemaFormRenderer';
+export type { RenderFieldArgs, RenderFieldOverride } from './types';
+export { FieldRenderer } from './fields';
+export { useCascadingField } from './hooks/useCascadingField';
+export { useConditionalField } from './hooks/useConditionalField';
+export { useUnsavedChangesGuard } from './hooks/useUnsavedChangesGuard';
+export type { ConditionalFieldState } from './hooks/useConditionalField';
+export { useCardinalityRules } from './hooks/useCardinalityRules';
+export type { CardinalityViolation } from './hooks/useCardinalityRules';
+export { useFailRules } from './hooks/useFailRules';
+export type { FailViolation } from './hooks/useFailRules';
+export {
+  buildValidationRules,
+  coerceFormValues,
+} from './utils/validationMapper';
+export {
+  flattenSectionFields,
+  flattenSectionItem,
+  isOneOfGroup,
+  collectOneOfGroups,
+} from './utils/flattenSectionFields';
+export { getAtPath, setAtPath } from './utils/fieldPath';
+export { OneOfGroupSlot } from './OneOfGroupSlot';
+export { ConditionalFieldSlot } from './ConditionalFieldSlot';
+export { evaluatePredicate } from './utils/predicateEvaluator';
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/types.ts b/ui/packages/sep/framework/src/components/SchemaFormRenderer/types.ts
new file mode 100644
index 00000000000..682533c9e84
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/types.ts
@@ -0,0 +1,88 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/**
+ * Local type aliases for the plugin schema shape.
+ *
+ * Re-exports from `@sep/api` so field components and tests have a single
+ * import surface. If the backend schema shape ever diverges from the api
+ * package's contract, adapt here without touching every field file.
+ */
+
+import type { ReactNode } from 'react';
+import type { PluginField as PluginFieldType } from '@sep/api';
+
+/** Argument bag handed to a {@link RenderFieldOverride}. */
+export interface RenderFieldArgs {
+  /**
+   * The gate-resolved field: visibility and the `required` flag have already
+   * been decided by the conditional engine, so an override sees the same field
+   * the framework would render.
+   */
+  field: PluginFieldType;
+  /** Render the framework default widget (the existing `FieldRenderer`) for this field. */
+  renderDefault: () => ReactNode;
+}
+
+/**
+ * Per-field widget override for {@link SchemaFormRenderer}.
+ *
+ * Return custom UI for the field, call `renderDefault()`, or return a nullish
+ * value (`undefined` / `null`) to fall back to the framework widget — so an
+ * override keyed by field name can handle some fields and defer the rest. The
+ * override changes the widget, not the rules: a field
+ * hidden by its gate never reaches the override, and the resolved `required`
+ * flag is already applied to `args.field`.
+ *
+ * Write-through contract: an override MUST persist its value through
+ * react-hook-form (`useFormContext` / `Controller` / `register`). The
+ * `fail_when` and cardinality rule engines read react-hook-form `watch` state,
+ * as does form submission; an override that keeps its own local state instead
+ * silently breaks both. Memoize expensive overrides — the slot is wrapped in
+ * `memo`, so an unstable override identity re-renders it on every parent render.
+ */
+export type RenderFieldOverride = (args: RenderFieldArgs) => ReactNode;
+
+export type {
+  PluginSchema,
+  PluginField,
+  SectionField,
+  OneOfBranch,
+  OneOfGroup,
+  FormSection,
+  StringField,
+  IntegerField,
+  FloatField,
+  BoolField,
+  ChoiceField,
+  ChoiceOption,
+  MultiChoiceField,
+  TextAreaField,
+  DateTimeField,
+  FileField,
+  YamlField,
+  ServiceField,
+  SchemaField,
+  TableField,
+  HostField,
+  RemoteChoiceField,
+  ScriptPreviewField,
+  Predicate,
+  FieldGate,
+  CardinalityRule,
+  FailRule,
+} from '@sep/api';
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/fieldPath.test.ts b/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/fieldPath.test.ts
new file mode 100644
index 00000000000..62296ddb990
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/fieldPath.test.ts
@@ -0,0 +1,82 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ */
+
+import { describe, expect, it } from 'vitest';
+
+import { getAtPath, setAtPath } from './fieldPath';
+
+describe('fieldPath', () => {
+  it('reads and writes nested dotted paths', () => {
+    const values: Record<string, unknown> = {};
+    setAtPath(values, 'source.mode', 'schema');
+    setAtPath(values, 'source.source_db_id', 'inventory');
+
+    expect(getAtPath(values, 'source.mode')).toBe('schema');
+    expect(getAtPath(values, 'source.source_db_id')).toBe('inventory');
+    expect(values).toEqual({
+      source: { mode: 'schema', source_db_id: 'inventory' },
+    });
+  });
+
+  it('reads nested values from caller default payloads', () => {
+    const values = {
+      source: { mode: 'query', source_query: 'SELECT 1' },
+    };
+    expect(getAtPath(values, 'source.source_query')).toBe('SELECT 1');
+  });
+
+  it('refuses prototype-pollution path segments on read', () => {
+    const polluted = Object.create(null) as Record<string, unknown>;
+    polluted.source = { mode: 'schema' };
+    expect(getAtPath(polluted, '__proto__')).toBeUndefined();
+    expect(getAtPath(polluted, 'constructor')).toBeUndefined();
+    expect(getAtPath(polluted, 'source.__proto__.polluted')).toBeUndefined();
+    expect(getAtPath(polluted, 'source.prototype.toString')).toBeUndefined();
+  });
+
+  it('refuses prototype-pollution path segments on write', () => {
+    const values: Record<string, unknown> = {};
+    setAtPath(values, '__proto__.polluted', true);
+    setAtPath(values, 'source.constructor', 'bad');
+    setAtPath(values, 'source.prototype.x', 1);
+    expect(values).toEqual({});
+    expect(
+      (Object.prototype as { polluted?: boolean }).polluted
+    ).toBeUndefined();
+  });
+
+  it('clones existing intermediate objects so writes do not mutate the source tree', () => {
+    const nested = { mode: 'schema', source_db_id: 'inventory' };
+    const values = { source: nested };
+    const out: Record<string, unknown> = { ...values };
+
+    setAtPath(out, 'source.mode', 'query');
+
+    expect(nested.mode).toBe('schema');
+    expect(nested.source_db_id).toBe('inventory');
+    expect(out).toEqual({
+      source: { mode: 'query', source_db_id: 'inventory' },
+    });
+    expect(out.source).not.toBe(nested);
+  });
+
+  it('clones intermediates along the path for deeper nested writes', () => {
+    const inner = { leaf: 1 };
+    const middle = { inner };
+    const values = { outer: middle };
+
+    const out: Record<string, unknown> = { ...values };
+    setAtPath(out, 'outer.inner.leaf', 2);
+
+    expect(inner.leaf).toBe(1);
+    expect(getAtPath(out, 'outer.inner.leaf')).toBe(2);
+    expect((out.outer as typeof middle).inner).not.toBe(inner);
+    expect((out.outer as typeof middle).inner.leaf).toBe(2);
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/fieldPath.ts b/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/fieldPath.ts
new file mode 100644
index 00000000000..2828a5c7640
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/fieldPath.ts
@@ -0,0 +1,102 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+const FORBIDDEN_SEGMENTS = new Set([
+  '__proto__',
+  'constructor',
+  'prototype',
+  '__class__',
+]);
+
+function pathHasForbiddenSegment(path: string): boolean {
+  return path
+    .split('.')
+    .some((segment) => segment === '' || FORBIDDEN_SEGMENTS.has(segment));
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const proto = Object.getPrototypeOf(value) as unknown;
+  return proto === Object.prototype || proto === null;
+}
+
+/** Read a value at ``path``, supporting dotted nested keys on plain objects. */
+export function getAtPath(
+  values: Record<string, unknown>,
+  path: string
+): unknown {
+  if (pathHasForbiddenSegment(path)) {
+    return undefined;
+  }
+  if (Object.prototype.hasOwnProperty.call(values, path)) {
+    return values[path];
+  }
+  if (!path.includes('.')) {
+    return undefined;
+  }
+  const segments = path.split('.');
+  let current: unknown = values;
+  for (const segment of segments) {
+    if (
+      !isPlainObject(current) ||
+      !Object.prototype.hasOwnProperty.call(current, segment)
+    ) {
+      return undefined;
+    }
+    current = current[segment];
+  }
+  return current;
+}
+
+/** Write ``value`` at ``path``, creating intermediate plain objects as needed.
+
+Shallow-clones existing plain-object intermediates along the path so callers
+that shallow-copy the root (for example ``coerceFormValues``) do not mutate
+nested objects still referenced from the input.
+*/
+export function setAtPath(
+  target: Record<string, unknown>,
+  path: string,
+  value: unknown
+): void {
+  if (pathHasForbiddenSegment(path)) {
+    return;
+  }
+  const segments = path.split('.');
+  let current = target;
+  for (let index = 0; index < segments.length - 1; index += 1) {
+    const segment = segments[index];
+    const next = current[segment];
+    if (isPlainObject(next)) {
+      const cloned: Record<string, unknown> = { ...next };
+      current[segment] = cloned;
+      current = cloned;
+    } else {
+      const created: Record<string, unknown> = {};
+      current[segment] = created;
+      current = created;
+    }
+  }
+  const leaf = segments[segments.length - 1];
+  if (value === undefined) {
+    delete current[leaf];
+    return;
+  }
+  current[leaf] = value;
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/flattenSectionFields.test.ts b/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/flattenSectionFields.test.ts
new file mode 100644
index 00000000000..59ff7678d96
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/flattenSectionFields.test.ts
@@ -0,0 +1,81 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ */
+
+import { describe, expect, it } from 'vitest';
+
+import type { FormSection } from '@sep/api';
+
+import {
+  flattenSectionFields,
+  flattenSectionItem,
+  isOneOfGroup,
+} from './flattenSectionFields';
+
+const ONE_OF_SECTION: FormSection[] = [
+  {
+    title: 'Source',
+    fields: [
+      {
+        type: 'one_of',
+        name: 'source',
+        label: 'Source',
+        discriminator: 'source.mode',
+        default: 'schema',
+        branches: [
+          {
+            value: 'schema',
+            label: 'Schema',
+            fields: [
+              { type: 'string', name: 'source.source_db_id', label: 'Schema' },
+            ],
+          },
+          {
+            value: 'query',
+            label: 'Query',
+            fields: [
+              { type: 'string', name: 'source.source_query', label: 'Query' },
+            ],
+          },
+        ],
+      },
+    ],
+  },
+];
+
+describe('isOneOfGroup', () => {
+  it('detects one_of containers', () => {
+    const field = ONE_OF_SECTION[0].fields[0];
+    expect(isOneOfGroup(field)).toBe(true);
+  });
+
+  it('returns false for leaf fields', () => {
+    expect(isOneOfGroup({ type: 'string', name: 'x', label: 'X' })).toBe(false);
+  });
+});
+
+describe('flattenSectionFields', () => {
+  it('expands one-of branches into leaf fields', () => {
+    const names = flattenSectionFields(ONE_OF_SECTION).map(
+      (field) => field.name
+    );
+    expect(names).toEqual(['source.source_db_id', 'source.source_query']);
+  });
+
+  it('passes through plain leaf sections unchanged', () => {
+    const sections: FormSection[] = [
+      {
+        title: 'T',
+        fields: [{ type: 'string', name: 'title', label: 'Title' }],
+      },
+    ];
+    expect(flattenSectionItem(sections[0].fields[0])).toEqual([
+      { type: 'string', name: 'title', label: 'Title' },
+    ]);
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/flattenSectionFields.ts b/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/flattenSectionFields.ts
new file mode 100644
index 00000000000..0193be1b269
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/flattenSectionFields.ts
@@ -0,0 +1,48 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type {
+  FormSection,
+  OneOfGroup,
+  PluginField,
+  SectionField,
+} from '@sep/api';
+
+/** Type guard for the `one_of` section container. */
+export function isOneOfGroup(field: SectionField): field is OneOfGroup {
+  return field.type === 'one_of';
+}
+
+/** Collect every {@link OneOfGroup} container across ``sections``. */
+export function collectOneOfGroups(sections: FormSection[]): OneOfGroup[] {
+  return sections.flatMap((section) => section.fields.filter(isOneOfGroup));
+}
+
+/** Expand one section item to its leaf fields (pass-through or branch flatten). */
+export function flattenSectionItem(field: SectionField): PluginField[] {
+  if (isOneOfGroup(field)) {
+    return field.branches.flatMap((branch) => branch.fields);
+  }
+  return [field];
+}
+
+/** Return every leaf {@link PluginField} across ``sections``, expanding one-of groups. */
+export function flattenSectionFields(sections: FormSection[]): PluginField[] {
+  return sections.flatMap((section) =>
+    section.fields.flatMap(flattenSectionItem)
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/predicateEvaluator.test.ts b/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/predicateEvaluator.test.ts
new file mode 100644
index 00000000000..e9ba585a0f8
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/predicateEvaluator.test.ts
@@ -0,0 +1,280 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ */
+
+import { describe, expect, it } from 'vitest';
+
+import { evaluatePredicate, getGateFieldNames } from './predicateEvaluator';
+
+describe('evaluatePredicate – contains', () => {
+  it('returns true when the value is in the array', () => {
+    expect(
+      evaluatePredicate(
+        { contains: { upload: 's3' } },
+        { upload: ['s3', 'rsync'] }
+      )
+    ).toBe(true);
+  });
+
+  it('returns false when the value is not in the array', () => {
+    expect(
+      evaluatePredicate({ contains: { upload: 's3' } }, { upload: ['rsync'] })
+    ).toBe(false);
+  });
+
+  it('returns false when the container is undefined / null', () => {
+    expect(evaluatePredicate({ contains: { upload: 's3' } }, {})).toBe(false);
+    expect(
+      evaluatePredicate({ contains: { upload: 's3' } }, { upload: null })
+    ).toBe(false);
+  });
+
+  it('returns false when the container is empty', () => {
+    expect(
+      evaluatePredicate({ contains: { upload: 's3' } }, { upload: [] })
+    ).toBe(false);
+  });
+
+  it('returns false when the container is not an array', () => {
+    expect(
+      evaluatePredicate({ contains: { upload: 's3' } }, { upload: 's3' })
+    ).toBe(false);
+    expect(evaluatePredicate({ contains: { upload: 1 } }, { upload: 42 })).toBe(
+      false
+    );
+  });
+
+  it('supports a $field reference on the right-hand side', () => {
+    expect(
+      evaluatePredicate(
+        { contains: { upload: { $field: 'wanted' } } },
+        { upload: ['s3', 'rsync'], wanted: 'rsync' }
+      )
+    ).toBe(true);
+    expect(
+      evaluatePredicate(
+        { contains: { upload: { $field: 'wanted' } } },
+        { upload: ['s3'], wanted: 'rsync' }
+      )
+    ).toBe(false);
+  });
+
+  it('contributes its field name to getGateFieldNames', () => {
+    expect(
+      getGateFieldNames([{ when: { contains: { upload: 's3' } } }])
+    ).toEqual(['upload']);
+  });
+});
+
+describe('evaluatePredicate – prototype-chain safety', () => {
+  // Untrusted schema JSON could name a field `constructor`, `__proto__`, or
+  // `toString`. Bracket access on a plain object resolves those to inherited
+  // members on Object.prototype — `values.constructor` is the Object function
+  // (truthy), `values.toString` is a function (truthy). The predicate must
+  // treat absent own-properties as absent regardless of prototype chain.
+  it('truthy: returns false for inherited members not present as own keys', () => {
+    expect(evaluatePredicate({ truthy: 'constructor' }, {})).toBe(false);
+    expect(evaluatePredicate({ truthy: 'toString' }, {})).toBe(false);
+    expect(evaluatePredicate({ truthy: 'hasOwnProperty' }, {})).toBe(false);
+    expect(evaluatePredicate({ truthy: '__proto__' }, {})).toBe(false);
+  });
+
+  it('falsy: returns true for inherited members not present as own keys', () => {
+    expect(evaluatePredicate({ falsy: 'constructor' }, {})).toBe(true);
+    expect(evaluatePredicate({ falsy: 'toString' }, {})).toBe(true);
+  });
+
+  it('all_present / none_present respect own-property semantics', () => {
+    expect(evaluatePredicate({ all_present: ['constructor'] }, {})).toBe(false);
+    expect(
+      evaluatePredicate({ none_present: ['constructor', 'toString'] }, {})
+    ).toBe(true);
+  });
+
+  it('still honours an own-property named like an inherited member', () => {
+    // If the form genuinely binds a field called `constructor`, its own value
+    // wins over the prototype chain.
+    expect(
+      evaluatePredicate({ truthy: 'constructor' }, { constructor: 'yes' })
+    ).toBe(true);
+    expect(
+      evaluatePredicate({ truthy: 'constructor' }, { constructor: '' })
+    ).toBe(false);
+  });
+});
+
+describe('evaluatePredicate – $field reference to missing key', () => {
+  it('equals: both sides absent collapses to true (undefined === undefined)', () => {
+    // Documents existing behaviour — exposing it as an explicit case so
+    // future changes have to consider it.
+    expect(evaluatePredicate({ equals: { a: { $field: 'b' } } }, {})).toBe(
+      true
+    );
+  });
+
+  it('equals: only one side present is false', () => {
+    expect(
+      evaluatePredicate({ equals: { a: { $field: 'b' } } }, { a: 'x' })
+    ).toBe(false);
+  });
+
+  it('contains: $field referencing missing key with present list is false', () => {
+    // Container is array, needle is undefined — must not match.
+    expect(
+      evaluatePredicate(
+        { contains: { upload: { $field: 'missing' } } },
+        { upload: ['s3', 'rsync'] }
+      )
+    ).toBe(false);
+  });
+});
+
+describe('evaluatePredicate – xor arity', () => {
+  it('returns false for empty operand', () => {
+    expect(evaluatePredicate({ xor: [] }, {})).toBe(false);
+  });
+
+  it('returns true for exactly one truthy child', () => {
+    expect(
+      evaluatePredicate(
+        { xor: [{ truthy: 'a' }, { truthy: 'b' }] },
+        { a: true, b: false }
+      )
+    ).toBe(true);
+  });
+
+  it('returns false when all children are truthy', () => {
+    expect(
+      evaluatePredicate(
+        { xor: [{ truthy: 'a' }, { truthy: 'b' }] },
+        { a: true, b: true }
+      )
+    ).toBe(false);
+  });
+
+  it('with 3 children uses exactly-one semantics', () => {
+    expect(
+      evaluatePredicate(
+        { xor: [{ truthy: 'a' }, { truthy: 'b' }, { truthy: 'c' }] },
+        { a: true, b: true, c: false }
+      )
+    ).toBe(false);
+    expect(
+      evaluatePredicate(
+        { xor: [{ truthy: 'a' }, { truthy: 'b' }, { truthy: 'c' }] },
+        { a: true, b: false, c: false }
+      )
+    ).toBe(true);
+  });
+});
+
+describe('evaluatePredicate – empty / unknown / nested', () => {
+  it('returns false for empty predicate object', () => {
+    expect(evaluatePredicate({} as never, {})).toBe(false);
+  });
+
+  it('returns false for unknown operator', () => {
+    expect(evaluatePredicate({ frobnicate: 'a' } as never, { a: true })).toBe(
+      false
+    );
+  });
+
+  it('all with empty operand is false (vacuous-truth guard)', () => {
+    expect(evaluatePredicate({ all: [] }, {})).toBe(false);
+  });
+
+  it('all_truthy / all_falsy / all_present / none_present with empty operand are false', () => {
+    expect(evaluatePredicate({ all_truthy: [] }, {})).toBe(false);
+    expect(evaluatePredicate({ all_falsy: [] }, {})).toBe(false);
+    expect(evaluatePredicate({ all_present: [] }, {})).toBe(false);
+    expect(evaluatePredicate({ none_present: [] }, {})).toBe(false);
+  });
+
+  it('any with empty operand is false', () => {
+    expect(evaluatePredicate({ any: [] }, {})).toBe(false);
+  });
+
+  it('three-level nested not/any/all evaluates correctly', () => {
+    const pred = {
+      not: {
+        any: [{ all: [{ truthy: 'a' }, { truthy: 'b' }] }, { truthy: 'c' }],
+      },
+    };
+    expect(evaluatePredicate(pred, { a: true, b: true, c: false })).toBe(false);
+    expect(evaluatePredicate(pred, { a: true, b: false, c: false })).toBe(true);
+    expect(evaluatePredicate(pred, { a: false, b: false, c: true })).toBe(
+      false
+    );
+  });
+});
+
+describe('getGateFieldNames – nested predicates', () => {
+  it('dedupes the same field referenced across nested branches', () => {
+    expect(
+      getGateFieldNames([
+        {
+          when: {
+            any: [
+              { truthy: 'upload' },
+              { contains: { upload: 'S3' } },
+              { all: [{ truthy: 'upload' }, { equals: { upload: 'S3' } }] },
+            ],
+          },
+        },
+      ])
+    ).toEqual(['upload']);
+  });
+
+  it('collects $field reference targets in equals/contains', () => {
+    expect(
+      getGateFieldNames([{ when: { equals: { a: { $field: 'b' } } } }])
+    ).toEqual(['a', 'b']);
+  });
+});
+
+describe('evaluatePredicate – dotted field paths', () => {
+  it('equals walks nested objects for dotted discriminator paths', () => {
+    const values = {
+      source: { mode: 'schema', source_db_id: 'inventory' },
+    };
+    expect(
+      evaluatePredicate({ equals: { 'source.mode': 'schema' } }, values)
+    ).toBe(true);
+    expect(
+      evaluatePredicate({ equals: { 'source.mode': 'query' } }, values)
+    ).toBe(false);
+  });
+
+  it('not_equals forbids inactive one-of branch leaves via dotted paths', () => {
+    const values = {
+      source: { mode: 'schema', source_db_id: 'x', source_query: 'SELECT 1' },
+    };
+    expect(
+      evaluatePredicate({ not_equals: { 'source.mode': 'query' } }, values)
+    ).toBe(true);
+  });
+
+  it('truthy resolves nested segments without prototype-chain leakage', () => {
+    expect(
+      evaluatePredicate(
+        { truthy: 'source.mode' },
+        { source: { mode: 'schema' } }
+      )
+    ).toBe(true);
+    expect(evaluatePredicate({ truthy: 'source.mode' }, {})).toBe(false);
+  });
+
+  it('prefers an own-property key when the full dotted path is stored flat', () => {
+    expect(
+      evaluatePredicate(
+        { equals: { 'source.mode': 'flat' } },
+        { 'source.mode': 'flat', source: { mode: 'nested' } }
+      )
+    ).toBe(true);
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/predicateEvaluator.ts b/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/predicateEvaluator.ts
new file mode 100644
index 00000000000..6fc066b78dd
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/predicateEvaluator.ts
@@ -0,0 +1,323 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type { FieldGate, Predicate } from '../types';
+
+type FormValues = Record<string, unknown>;
+
+/**
+ * Read a field by name from form values, ignoring inherited members.
+ *
+ * Supports dotted paths (for example ``source.mode``) by walking nested plain
+ * objects when no own-property exists for the full path string. Field names
+ * come from JSON schema and are not fully trusted: a schema that names a field
+ * ``constructor`` / ``toString`` / ``__proto__`` would otherwise resolve via
+ * the prototype chain to truthy built-ins (e.g. the ``Object`` function),
+ * making gate predicates evaluate against engine internals instead of
+ * user-supplied state. Always go through this helper.
+ */
+function readField(values: FormValues, name: string): unknown {
+  if (Object.prototype.hasOwnProperty.call(values, name)) {
+    return values[name];
+  }
+  if (!name.includes('.')) {
+    return undefined;
+  }
+  const segments = name.split('.');
+  let current: unknown = values;
+  for (const segment of segments) {
+    if (
+      !isPlainObject(current) ||
+      !Object.prototype.hasOwnProperty.call(current, segment)
+    ) {
+      return undefined;
+    }
+    current = current[segment];
+  }
+  return current;
+}
+
+function isPlainObject(v: unknown): v is Record<string, unknown> {
+  if (typeof v !== 'object' || v === null || Array.isArray(v)) {
+    return false;
+  }
+  const proto = Object.getPrototypeOf(v) as unknown;
+  return proto === Object.prototype || proto === null;
+}
+
+function isTruthy(value: unknown): boolean {
+  if (Array.isArray(value)) {
+    return value.length > 0;
+  }
+  // mirror Python bool({}): empty plain objects are falsy
+  if (isPlainObject(value)) {
+    return Object.keys(value).length > 0;
+  }
+  return Boolean(value);
+}
+
+export function isPresent(value: unknown): boolean {
+  if (Array.isArray(value)) {
+    return value.length > 0;
+  }
+  // mirror Python _field_is_present: empty plain objects are absent
+  if (isPlainObject(value)) {
+    return Object.keys(value).length > 0;
+  }
+  // ``false`` is the unset bool default and counts as absent so a
+  // BoolField's ``forbidden=`` gate only fires on an explicit ``true``
+  // toggle. Matches the Python convention introduced for ``BoolField``
+  // gating; ``0`` stays present because numeric zero is a real value.
+  if (value === false) {
+    return false;
+  }
+  return value !== null && value !== undefined && value !== '';
+}
+
+function isFieldRef(v: unknown): v is { $field: string } {
+  return typeof v === 'object' && v !== null && '$field' in v;
+}
+
+function resolveValue(raw: unknown, values: FormValues): unknown {
+  return isFieldRef(raw)
+    ? readField(values, (raw as { $field: string }).$field)
+    : raw;
+}
+
+/**
+ * Coerces a value to number for numeric comparisons.
+ * Intentional divergence from Python (which raises TypeError on "10" > 5):
+ * RHF stores text-input values as strings until coerceFormValues runs at submit,
+ * so predicate evaluation must handle string representations of numbers.
+ * Used for ordered comparisons (gt/gte/lt/lte) and equality against numeric
+ * literals, because the BE wire format serialises IntEnum and int values as
+ * JSON numbers (e.g. { equals: { swap_drop: 1 } }).
+ */
+function toNum(v: unknown): number {
+  return typeof v === 'number' ? v : Number(v);
+}
+
+/**
+ * Evaluate a predicate wire-format object against the current form values.
+ *
+ * Mirrors the backend DSL operators from `app/sep/plugins/framework/rules.py`.
+ * Each predicate is a single-key object `{ <operator>: <operand> }` — the BE
+ * schema validator enforces this; multi-key predicates are not valid wire format
+ * and only the first entry would be evaluated.
+ * Unknown operators return false so malformed schemas degrade gracefully.
+ */
+export function evaluatePredicate(
+  predicate: Predicate,
+  values: FormValues
+): boolean {
+  const entries = Object.entries(predicate);
+  if (entries.length === 0) {
+    return false;
+  }
+  const [op, operand] = entries[0];
+
+  switch (op) {
+    case 'truthy':
+      return isTruthy(readField(values, operand as string));
+    case 'falsy':
+      return !isTruthy(readField(values, operand as string));
+
+    case 'equals': {
+      const entry = Object.entries(operand as Record<string, unknown>)[0];
+      if (!entry) {
+        return false;
+      }
+      const [field, raw] = entry;
+      const rhs = resolveValue(raw, values);
+      // Coerce field value when the literal is numeric: BE emits int/IntEnum
+      // values as JSON numbers, but RHF stores text inputs as strings.
+      const fieldValue = readField(values, field);
+      const lhs = typeof rhs === 'number' ? toNum(fieldValue) : fieldValue;
+      return lhs === rhs;
+    }
+    case 'not_equals': {
+      const entry = Object.entries(operand as Record<string, unknown>)[0];
+      if (!entry) {
+        return false;
+      }
+      const [field, raw] = entry;
+      const rhs = resolveValue(raw, values);
+      const fieldValue = readField(values, field);
+      const lhs = typeof rhs === 'number' ? toNum(fieldValue) : fieldValue;
+      return lhs !== rhs;
+    }
+    case 'gt': {
+      const entry = Object.entries(operand as Record<string, unknown>)[0];
+      if (!entry) {
+        return false;
+      }
+      const [field, raw] = entry;
+      return toNum(readField(values, field)) > toNum(resolveValue(raw, values));
+    }
+    case 'gte': {
+      const entry = Object.entries(operand as Record<string, unknown>)[0];
+      if (!entry) {
+        return false;
+      }
+      const [field, raw] = entry;
+      return (
+        toNum(readField(values, field)) >= toNum(resolveValue(raw, values))
+      );
+    }
+    case 'lt': {
+      const entry = Object.entries(operand as Record<string, unknown>)[0];
+      if (!entry) {
+        return false;
+      }
+      const [field, raw] = entry;
+      return toNum(readField(values, field)) < toNum(resolveValue(raw, values));
+    }
+    case 'lte': {
+      const entry = Object.entries(operand as Record<string, unknown>)[0];
+      if (!entry) {
+        return false;
+      }
+      const [field, raw] = entry;
+      return (
+        toNum(readField(values, field)) <= toNum(resolveValue(raw, values))
+      );
+    }
+
+    case 'contains': {
+      const entry = Object.entries(operand as Record<string, unknown>)[0];
+      if (!entry) {
+        return false;
+      }
+      const [field, raw] = entry;
+      const container = readField(values, field);
+      if (!Array.isArray(container)) {
+        return false;
+      }
+      const needle = resolveValue(raw, values);
+      return container.includes(needle);
+    }
+
+    case 'all_truthy': {
+      const fs = operand as string[];
+      return fs.length > 0 && fs.every((f) => isTruthy(readField(values, f)));
+    }
+    case 'all_falsy': {
+      const fs = operand as string[];
+      return fs.length > 0 && fs.every((f) => !isTruthy(readField(values, f)));
+    }
+    case 'any_truthy':
+      return (operand as string[]).some((f) => isTruthy(readField(values, f)));
+    case 'any_falsy':
+      return (operand as string[]).some((f) => !isTruthy(readField(values, f)));
+    case 'any_present':
+      return (operand as string[]).some((f) => isPresent(readField(values, f)));
+    case 'all_present': {
+      const fs = operand as string[];
+      return fs.length > 0 && fs.every((f) => isPresent(readField(values, f)));
+    }
+    case 'none_present': {
+      const fs = operand as string[];
+      return fs.length > 0 && fs.every((f) => !isPresent(readField(values, f)));
+    }
+    case 'all_equal': {
+      const fields = operand as string[];
+      if (fields.length < 2) {
+        return false;
+      }
+      const first = readField(values, fields[0]);
+      return fields.slice(1).every((f) => readField(values, f) === first);
+    }
+
+    case 'all': {
+      const ps = operand as Predicate[];
+      return ps.length > 0 && ps.every((p) => evaluatePredicate(p, values));
+    }
+    case 'any':
+      return (operand as Predicate[]).some((p) => evaluatePredicate(p, values));
+    case 'xor': {
+      // BE Xor is binary-only by design (rules.py always emits exactly 2 children).
+      // The "exactly one truthy" check is equivalent to binary parity for arity 2.
+      // For arity >= 3 these diverge: binary parity = odd count truthy, exactly-one
+      // = count === 1. If BE ever extends xor to n-ary it would use parity semantics,
+      // so a new `exactly_one_of` operator should be introduced instead of reusing xor.
+      const preds = operand as Predicate[];
+      if (preds.length === 0) {
+        return false;
+      }
+      return preds.filter((p) => evaluatePredicate(p, values)).length === 1;
+    }
+    case 'not':
+      return !evaluatePredicate(operand as Predicate, values);
+
+    default:
+      return false;
+  }
+}
+
+function getPredicateFieldNames(predicate: Predicate): string[] {
+  const entries = Object.entries(predicate);
+  if (entries.length === 0) {
+    return [];
+  }
+  const [op, operand] = entries[0];
+
+  switch (op) {
+    case 'truthy':
+    case 'falsy':
+      return [operand as string];
+    case 'equals':
+    case 'not_equals':
+    case 'gt':
+    case 'gte':
+    case 'lt':
+    case 'lte':
+    case 'contains': {
+      const entry = Object.entries(operand as Record<string, unknown>)[0];
+      if (!entry) {
+        return [];
+      }
+      const [field, raw] = entry;
+      const names: string[] = [field];
+      if (isFieldRef(raw)) {
+        names.push((raw as { $field: string }).$field);
+      }
+      return names;
+    }
+    case 'all_truthy':
+    case 'all_falsy':
+    case 'any_truthy':
+    case 'any_falsy':
+    case 'any_present':
+    case 'all_present':
+    case 'none_present':
+    case 'all_equal':
+      return operand as string[];
+    case 'all':
+    case 'any':
+    case 'xor':
+      return (operand as Predicate[]).flatMap((p) => getPredicateFieldNames(p));
+    case 'not':
+      return getPredicateFieldNames(operand as Predicate);
+    default:
+      return [];
+  }
+}
+
+/** Returns the deduplicated set of field names referenced by a list of gates. */
+export function getGateFieldNames(gates: FieldGate[]): string[] {
+  return [...new Set(gates.flatMap((g) => getPredicateFieldNames(g.when)))];
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/validationMapper.ts b/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/validationMapper.ts
new file mode 100644
index 00000000000..8a478047dfc
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/validationMapper.ts
@@ -0,0 +1,182 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type { RegisterOptions } from 'react-hook-form';
+import type { PluginField } from '../types';
+import { getAtPath, setAtPath } from './fieldPath';
+
+export function buildValidationRules(field: PluginField): RegisterOptions {
+  const rules: RegisterOptions = {};
+
+  if (field.required) {
+    rules.required = `${field.label} is required`;
+  }
+
+  switch (field.type) {
+    case 'string': {
+      if (field.min_length !== undefined) {
+        rules.minLength = {
+          value: field.min_length,
+          message: `Minimum ${field.min_length} characters`,
+        };
+      }
+      if (field.max_length !== undefined) {
+        rules.maxLength = {
+          value: field.max_length,
+          message: `Maximum ${field.max_length} characters`,
+        };
+      }
+      if (field.pattern) {
+        try {
+          const compiled = new RegExp(field.pattern);
+          rules.pattern = {
+            value: compiled,
+            message: `${field.label} does not match the required format`,
+          };
+        } catch {
+          // Invalid regex from schema. Surface as a validate fn so the field
+          // shows an error instead of the whole form crashing on render.
+          rules.validate = () =>
+            `${field.label} has an invalid pattern in its schema`;
+        }
+      }
+      break;
+    }
+    case 'integer':
+    case 'float': {
+      // Reject non-numeric and (for integers) fractional input before
+      // coercion: `coerceFormValues` used to truncate '2.5' to 2 and '3.14abc'
+      // to 3.14, sending a value the user never typed.
+      rules.validate = (value: unknown) => {
+        // Trim first: `Number('   ')` is 0, so a whitespace-only entry would
+        // otherwise pass here and submit as 0. RHF's own `required` rule does
+        // not fire on it either (the string is non-empty), so enforce it here.
+        const normalized = typeof value === 'string' ? value.trim() : value;
+        if (
+          normalized === '' ||
+          normalized === null ||
+          normalized === undefined
+        ) {
+          return field.required ? `${field.label} is required` : true;
+        }
+        const numericValue = Number(normalized);
+        if (!Number.isFinite(numericValue)) {
+          return 'Enter a valid number';
+        }
+        if (field.type === 'integer' && !Number.isInteger(numericValue)) {
+          return 'Enter a whole number';
+        }
+        return true;
+      };
+      if (field.ge !== undefined) {
+        rules.min = {
+          value: field.ge,
+          message: `Minimum value is ${field.ge}`,
+        };
+      }
+      if (field.le !== undefined) {
+        rules.max = {
+          value: field.le,
+          message: `Maximum value is ${field.le}`,
+        };
+      }
+      break;
+    }
+    case 'textarea':
+    case 'yaml': {
+      if (field.type === 'textarea' || field.type === 'yaml') {
+        // textarea/yaml share required-only rules today. Add length/pattern here if added later.
+      }
+      break;
+    }
+    case 'multi_choice': {
+      const { min_items: minItems, max_items: maxItems, label } = field;
+      if (minItems !== undefined || maxItems !== undefined) {
+        rules.validate = (value: unknown) => {
+          const len = Array.isArray(value) ? value.length : 0;
+          if (minItems !== undefined && len < minItems) {
+            return `Select at least ${minItems} ${label.toLowerCase()}`;
+          }
+          if (maxItems !== undefined && len > maxItems) {
+            return `Select at most ${maxItems} ${label.toLowerCase()}`;
+          }
+          return true;
+        };
+      }
+      break;
+    }
+    default:
+      break;
+  }
+
+  return rules;
+}
+
+/**
+ * Coerce raw form values into the types the backend expects.
+ *
+ * react-hook-form's Controller does not expose setValueAs, so integer/float
+ * fields reach the submit handler as strings. This walks the schema and
+ * converts values based on their declared type. Empty strings become
+ * undefined so optional numeric fields serialise cleanly.
+ */
+export function coerceFormValues(
+  values: Record<string, unknown>,
+  fields: PluginField[]
+): Record<string, unknown> {
+  const out: Record<string, unknown> = { ...values };
+  for (const field of fields) {
+    const raw = getAtPath(out, field.name);
+    if (field.type === 'integer' || field.type === 'float') {
+      // Trimmed-empty counts as empty: `Number('   ')` is 0, which would submit
+      // a value the user never typed. The validate rule rejects it for required
+      // fields; optional ones serialise as absent.
+      const trimmed = typeof raw === 'string' ? raw.trim() : raw;
+      if (trimmed === '' || trimmed === undefined || trimmed === null) {
+        setAtPath(out, field.name, undefined);
+        continue;
+      }
+      // `Number` (not parseInt/parseFloat) so partly-numeric input stays raw
+      // instead of being silently truncated; the field's validate rule rejects
+      // it before submit.
+      const num = Number(trimmed);
+      const valid =
+        Number.isFinite(num) &&
+        (field.type !== 'integer' || Number.isInteger(num));
+      setAtPath(out, field.name, valid ? num : raw);
+      continue;
+    }
+    if (
+      field.type === 'service' ||
+      field.type === 'schema' ||
+      field.type === 'table' ||
+      field.type === 'host'
+    ) {
+      if (
+        raw &&
+        typeof raw === 'object' &&
+        'id' in (raw as Record<string, unknown>)
+      ) {
+        const id = (raw as { id: unknown }).id;
+        setAtPath(out, field.name, id ?? undefined);
+      } else if (raw === '' || raw === null) {
+        setAtPath(out, field.name, undefined);
+      }
+    }
+  }
+  return out;
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/watchValuesByName.ts b/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/watchValuesByName.ts
new file mode 100644
index 00000000000..3fef52626e6
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaFormRenderer/utils/watchValuesByName.ts
@@ -0,0 +1,40 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/**
+ * Map react-hook-form `useWatch({ name: [...] })` output to field names.
+ *
+ * RHF returns an array when `name` is an array, but may return a bare scalar
+ * when exactly one name is watched depending on version/config.
+ */
+export function watchValuesByName(
+  names: string[],
+  raw: unknown
+): Record<string, unknown> {
+  if (names.length === 0) {
+    return {};
+  }
+  if (names.length === 1) {
+    const name = names[0];
+    if (Array.isArray(raw)) {
+      return { [name]: raw[0] };
+    }
+    return { [name]: raw };
+  }
+  const values = Array.isArray(raw) ? raw : [];
+  return Object.fromEntries(names.map((n, i) => [n, values[i]]));
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaListView/SchemaListView.test.tsx b/ui/packages/sep/framework/src/components/SchemaListView/SchemaListView.test.tsx
new file mode 100644
index 00000000000..a0dcc13fe3e
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaListView/SchemaListView.test.tsx
@@ -0,0 +1,273 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { render, screen } from '@testing-library/react';
+import type { ListView } from '@sep/api';
+
+const { useScheduledTasksForPluginMock } = vi.hoisted(() => ({
+  useScheduledTasksForPluginMock: vi.fn(),
+}));
+
+// Mock only the schedule hook; pull the real period/select helpers from their
+// leaf module so the by-name grouping and pick mirror production. Importing the
+// leaf directly (instead of `importOriginal` on the barrel) keeps the mock
+// order-independent when the whole suite runs.
+vi.mock('../ScheduledTasksPanel', async () => {
+  const periods = await import('../ScheduledTasksPanel/periods');
+  const lastRun = await import('../ScheduledTasksPanel/LastRunStatus');
+  return {
+    useScheduledTasksForPlugin: (...args: unknown[]) =>
+      useScheduledTasksForPluginMock(...args),
+    describePeriod: periods.describePeriod,
+    formatRelativeTime: periods.formatRelativeTime,
+    formatAbsoluteTime: periods.formatAbsoluteTime,
+    selectSchedule: periods.selectSchedule,
+    LastRunStatus: lastRun.LastRunStatus,
+  };
+});
+
+import {
+  SchemaListView,
+  type RenderListColumnOverride,
+} from './SchemaListView';
+import type { PeriodicTaskResponse } from '../ScheduledTasksPanel';
+
+const listView: ListView = {
+  columns: [
+    { key: 'name', label: 'Name' },
+    { key: 'status', label: 'Status', format: 'status' },
+  ],
+};
+
+const rows = [
+  { id: 1, name: 'alpha', status: 'completed' },
+  { id: 2, name: 'beta', status: 'failed' },
+];
+
+describe('SchemaListView — renderListColumn override', () => {
+  it('renders the override for a matching column and falls back to formatCellValue otherwise', () => {
+    const renderListColumn: RenderListColumnOverride = ({
+      columnKey,
+      value,
+      row,
+    }) =>
+      columnKey === 'status' ? (
+        <span data-testid={`custom-status-${row.id}`}>
+          custom:{String(value)}
+        </span>
+      ) : undefined;
+
+    render(
+      <SchemaListView
+        listView={listView}
+        data={rows}
+        renderListColumn={renderListColumn}
+      />
+    );
+
+    // status column → override
+    expect(screen.getByTestId('custom-status-1')).toHaveTextContent(
+      'custom:completed'
+    );
+    expect(screen.getByTestId('custom-status-2')).toHaveTextContent(
+      'custom:failed'
+    );
+    // name column → no override returned (undefined) → default formatCellValue (plain text)
+    expect(screen.getByText('alpha')).toBeInTheDocument();
+    expect(screen.getByText('beta')).toBeInTheDocument();
+  });
+
+  it('renders default formatCellValue for every column when no override is supplied', () => {
+    render(<SchemaListView listView={listView} data={rows} />);
+    expect(screen.getByText('alpha')).toBeInTheDocument();
+    // status format renders a chip with the raw label text
+    expect(screen.getByText('completed')).toBeInTheDocument();
+    expect(screen.queryByTestId('custom-status-1')).toBeNull();
+  });
+
+  it('never routes the actions column through the override', () => {
+    const actionsListView: ListView = {
+      columns: [
+        { key: 'name', label: 'Name' },
+        { key: 'actions', label: '', format: 'actions' },
+      ],
+    };
+    const renderListColumn = vi.fn<RenderListColumnOverride>(() => (
+      <span>x</span>
+    ));
+    render(
+      <SchemaListView
+        listView={actionsListView}
+        data={rows}
+        onDeleteRow={() => {}}
+        renderListColumn={renderListColumn}
+      />
+    );
+    // override invoked only for the non-actions `name` column, never `actions`
+    expect(renderListColumn).not.toHaveBeenCalledWith(
+      expect.objectContaining({ columnKey: 'actions' })
+    );
+    // delete control still rendered by the bespoke actions branch
+    expect(screen.getAllByLabelText('Delete').length).toBe(rows.length);
+  });
+
+  it('renders the em dash for a row missing a declared column key', () => {
+    const datedListView: ListView = {
+      columns: [
+        { key: 'name', label: 'Name' },
+        { key: 'created_at', label: 'Created', format: 'date' },
+        { key: 'seen_at', label: 'Seen', format: 'relative' },
+        { key: 'kind', label: 'Kind', format: 'chip' },
+      ],
+    };
+    // A server-supplied schema can declare a column the row omits, which used
+    // to render as the literal 'undefined' / 'Invalid Date' / 'NaNd ago'.
+    render(<SchemaListView listView={datedListView} data={[{ id: 1 }]} />);
+
+    expect(screen.queryByText('undefined')).toBeNull();
+    expect(screen.queryByText('Invalid Date')).toBeNull();
+    // Em dash for the plain and chip columns; the two time-based columns stay
+    // empty rather than showing a placeholder for a time that never happened.
+    expect(screen.getAllByText('—').length).toBe(2);
+  });
+});
+
+const NOW = new Date('2026-06-18T12:00:00Z');
+
+function makePeriodic(
+  overrides: Partial<PeriodicTaskResponse> = {}
+): PeriodicTaskResponse {
+  return {
+    id: 1,
+    name: 'periodic-1',
+    task: 'plugin-task',
+    enabled: true,
+    description: '',
+    start_time: null,
+    last_run_at: null,
+    date_changed: null,
+    total_run_count: 0,
+    interval: { every: 2, period: 'hours' },
+    crontab: null,
+    execute_request: null,
+    period: 'every 2 hours',
+    next_run_at: '2026-06-18T14:00:00Z',
+    ...overrides,
+  };
+}
+
+const scheduleListView: ListView = {
+  columns: [
+    { key: 'name', label: 'Name' },
+    { key: 'schedule', label: 'Schedule', format: 'schedule' },
+  ],
+};
+
+describe('SchemaListView — schedule-column glue', () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+    vi.setSystemTime(NOW);
+    useScheduledTasksForPluginMock.mockReset();
+    useScheduledTasksForPluginMock.mockReturnValue({
+      periodicTasks: [],
+      isLoading: false,
+    });
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it('fetches the plugin schedule and joins it by trimmed task name into the cell', () => {
+    useScheduledTasksForPluginMock.mockReturnValue({
+      periodicTasks: [makePeriodic({ task: 'alpha' })],
+      isLoading: false,
+    });
+
+    render(
+      <SchemaListView
+        listView={scheduleListView}
+        // Stray whitespace on the row name must still join: the cell trims
+        // before looking up, matching how the detail summary derives its key.
+        data={[
+          { id: 1, name: ' alpha ' },
+          { id: 2, name: 'beta' },
+        ]}
+        pluginName="archives"
+        disableSchedulePolling
+      />
+    );
+
+    // fetch is scoped to the owning plugin
+    expect(useScheduledTasksForPluginMock).toHaveBeenCalledWith('archives', {
+      disablePolling: true,
+    });
+    // alpha row matched its schedule; beta row has none → unscheduled chip
+    expect(screen.getByTestId('schedule-cell')).toBeInTheDocument();
+    expect(screen.getByTestId('schedule-cell-unscheduled')).toBeInTheDocument();
+  });
+
+  it('groups several schedules per task name and renders the selected one', () => {
+    useScheduledTasksForPluginMock.mockReturnValue({
+      periodicTasks: [
+        makePeriodic({
+          id: 1,
+          task: 'alpha',
+          next_run_at: '2026-06-18T20:00:00Z',
+          interval: { every: 1, period: 'days' },
+          period: 'every 1 days',
+        }),
+        makePeriodic({
+          id: 2,
+          task: 'alpha',
+          next_run_at: '2026-06-18T13:00:00Z',
+          interval: { every: 1, period: 'hours' },
+          period: 'every 1 hours',
+        }),
+      ],
+      isLoading: false,
+    });
+
+    render(
+      <SchemaListView
+        listView={scheduleListView}
+        data={[{ id: 1, name: 'alpha' }]}
+        pluginName="archives"
+        disableSchedulePolling
+      />
+    );
+
+    // selectSchedule picks the soonest upcoming run for the grouped task
+    expect(screen.getByTestId('schedule-cell-next-run')).toHaveTextContent(
+      'in 1 hour'
+    );
+    expect(screen.getByLabelText('Recurs every 1 hours')).toBeInTheDocument();
+  });
+
+  it('issues no schedule fetch when the list view has no schedule column', () => {
+    render(
+      <SchemaListView listView={listView} data={rows} pluginName="archives" />
+    );
+    expect(useScheduledTasksForPluginMock).not.toHaveBeenCalled();
+  });
+
+  it('issues no schedule fetch when a schedule column exists but no plugin name is given', () => {
+    render(<SchemaListView listView={scheduleListView} data={rows} />);
+    expect(useScheduledTasksForPluginMock).not.toHaveBeenCalled();
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaListView/SchemaListView.tsx b/ui/packages/sep/framework/src/components/SchemaListView/SchemaListView.tsx
new file mode 100644
index 00000000000..a87877ef2d2
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaListView/SchemaListView.tsx
@@ -0,0 +1,426 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useMemo, type ReactNode } from 'react';
+import Typography from '@mui/material/Typography';
+import type { Theme } from '@mui/material/styles';
+import Chip from '@mui/material/Chip';
+import IconButton from '@mui/material/IconButton';
+import DeleteOutlineIcon from '@mui/icons-material/DeleteOutline';
+import {
+  MaterialReactTable,
+  type MRT_ColumnDef,
+  type MRT_PaginationState,
+} from 'material-react-table';
+import {
+  DEFAULT_PLUGIN_LIST_LIMIT,
+  type ListColumn,
+  type ListView,
+} from '@sep/api';
+import { SEP_TABLE_CLASS } from '../../constants';
+import {
+  TaskHistoryStatusBadge,
+  isTaskHistoryStatus,
+} from '../TaskHistoryTable';
+import { ScheduleCell } from '../ScheduleCell';
+import {
+  selectSchedule,
+  useScheduledTasksForPlugin,
+  type PeriodicTaskResponse,
+} from '../ScheduledTasksPanel';
+
+/** Argument bag handed to a {@link RenderListColumnOverride}. */
+export interface RenderListColumnArgs {
+  /** The matched column's `key`. */
+  columnKey: string;
+  /** The raw cell value for this column. */
+  value: unknown;
+  /** The full row record. */
+  row: Record<string, unknown>;
+}
+
+/**
+ * Per-cell list column override for {@link SchemaListView}.
+ *
+ * Called for every non-`actions` cell. Return custom UI to render that cell, or
+ * return `undefined` to fall back to the framework's `formatCellValue`. Keying
+ * is the override's own concern: branch on `args.columnKey` and return
+ * `undefined` for columns it does not handle. The `actions` column (bespoke
+ * row-delete control) is never routed through this override.
+ */
+export type RenderListColumnOverride = (
+  args: RenderListColumnArgs
+) => ReactNode;
+
+/** Server-driven pagination metadata wired into MaterialReactTable manual pagination. */
+export interface SchemaListServerPagination {
+  total: number;
+  offset: number;
+  limit: number;
+  onChange: (next: { offset: number; limit: number }) => void;
+}
+
+interface SchemaListViewProps {
+  listView: ListView;
+  data: Record<string, unknown>[];
+  isLoading?: boolean;
+  /**
+   * Owning plugin name. Required for `schedule`-format columns: the schedule
+   * fetch and the client-side task-name join only run when this is set and the
+   * list view declares a schedule column, so plugins without one issue no
+   * periodic-tasks request.
+   */
+  pluginName?: string;
+  /** Disable schedule-list polling. Used by stories/tests. */
+  disableSchedulePolling?: boolean;
+  onRowClick?: (row: Record<string, unknown>) => void;
+  /** When set, ``format: 'actions'`` columns render a delete control for that row. */
+  onDeleteRow?: (row: Record<string, unknown>) => void;
+  /** Row id currently being deleted (disables that row's button). */
+  deletingRowId?: string | null;
+  /**
+   * Optional per-cell override for non-`actions` columns. Returns custom UI for
+   * a cell or `undefined` to fall back to `formatCellValue`. See
+   * {@link RenderListColumnOverride}.
+   */
+  renderListColumn?: RenderListColumnOverride;
+  /**
+   * When set, enables server-driven manual pagination over the current page in
+   * ``data``. Omit or pass ``null`` for legacy bare-array lists (client-side
+   * pagination over the full ``data`` prop).
+   */
+  pagination?: SchemaListServerPagination | null;
+}
+
+function formatCellValue(
+  value: unknown,
+  format: ListColumn['format']
+): ReactNode {
+  // Columns come from a server-supplied schema, so a row can omit a declared
+  // key entirely: `undefined` must be handled here too, or it renders as the
+  // literal 'undefined' (and as 'Invalid Date' / 'NaNd ago' below).
+  if (value === null || value === undefined) {
+    // Time-based columns render an absent value as an empty cell — a
+    // never-executed task has no Last Executed time, and an em-dash there would
+    // read as a misleading placeholder. Other formats keep the em-dash to
+    // signal "no value".
+    return format === 'relative' || format === 'date' ? null : '—';
+  }
+  const str = String(value);
+
+  switch (format) {
+    case 'chip':
+      return <Chip label={str} size="small" />;
+    case 'status':
+      // Unrecognized values (no live backend producer) fall back to a plain
+      // chip rather than indexing StatusBadge's STATUS_MAP with an unknown key.
+      return isTaskHistoryStatus(str) ? (
+        <TaskHistoryStatusBadge status={str} />
+      ) : (
+        <Chip label={str} size="small" />
+      );
+    case 'date':
+      return new Date(str).toLocaleDateString();
+    case 'relative': {
+      const diff = Date.now() - new Date(str).getTime();
+      const mins = Math.floor(diff / 60000);
+      if (mins < 1) {
+        return 'just now';
+      }
+      if (mins < 60) {
+        return `${mins}m ago`;
+      }
+      const hours = Math.floor(mins / 60);
+      if (hours < 24) {
+        return `${hours}h ago`;
+      }
+      const days = Math.floor(hours / 24);
+      return `${days}d ago`;
+    }
+    case 'code':
+      return (
+        <Typography
+          variant="body2"
+          sx={{ fontFamily: "'Roboto Mono', monospace" }}
+        >
+          {str}
+        </Typography>
+      );
+    default:
+      return str;
+  }
+}
+
+/**
+ * Opaque table surface. The Percona theme's `background.paper` doesn't always
+ * resolve to an opaque colour, leaving the table looking transparent against
+ * tinted page backgrounds, so pick the mode's own opaque surface instead of
+ * pinning `common.white` (which renders a white table in dark mode).
+ */
+const opaqueTableSurface = (theme: Theme) => ({
+  bgcolor:
+    theme.palette.mode === 'dark'
+      ? theme.palette.background.default
+      : theme.palette.common.white,
+});
+
+/** Stable empty lookup so plugins without a schedule column never re-key. */
+const EMPTY_SCHEDULE = new Map<string, PeriodicTaskResponse>();
+
+/**
+ * SchemaListView entry point.
+ *
+ * The schedule fetch and the client-side task-name join only happen when the
+ * list view declares a `schedule`-format column and a plugin name is provided.
+ * In that case rendering is delegated to {@link ScheduleJoinedListView}, which
+ * is the only place that mounts `useScheduledTasksForPlugin` — so plugins
+ * without a schedule column issue no periodic-tasks request (and need no
+ * QueryClient).
+ */
+export function SchemaListView(props: SchemaListViewProps) {
+  const { listView, pluginName } = props;
+  const hasScheduleColumn = listView.columns.some(
+    (c) => c.format === 'schedule'
+  );
+  if (hasScheduleColumn && pluginName) {
+    return <ScheduleJoinedListView {...props} pluginName={pluginName} />;
+  }
+  return <SchemaListViewCore {...props} scheduleByTask={EMPTY_SCHEDULE} />;
+}
+
+/**
+ * Fetches the plugin's periodic tasks, builds the by-name lookup, and renders
+ * the table. Isolated from {@link SchemaListView} so the schedule hook is only
+ * mounted when a schedule column is actually present.
+ */
+function ScheduleJoinedListView(
+  props: SchemaListViewProps & { pluginName: string }
+) {
+  const { pluginName, disableSchedulePolling = false } = props;
+  const { periodicTasks, isLoading: scheduleLoading } =
+    useScheduledTasksForPlugin(pluginName, {
+      disablePolling: disableSchedulePolling,
+    });
+
+  const scheduleByTask = useMemo(() => {
+    // A task may own several periodic schedules; group by task name and pick a
+    // single one with the same rule the detail summary uses, so the list cell
+    // and the summary never disagree.
+    const grouped = new Map<string, PeriodicTaskResponse[]>();
+    for (const task of periodicTasks) {
+      const existing = grouped.get(task.task);
+      if (existing) {
+        existing.push(task);
+      } else {
+        grouped.set(task.task, [task]);
+      }
+    }
+    const selected = new Map<string, PeriodicTaskResponse>();
+    for (const [name, candidates] of grouped) {
+      const pick = selectSchedule(candidates);
+      if (pick) {
+        selected.set(name, pick);
+      }
+    }
+    return selected;
+  }, [periodicTasks]);
+
+  return (
+    <SchemaListViewCore
+      {...props}
+      scheduleByTask={scheduleByTask}
+      scheduleLoading={scheduleLoading}
+    />
+  );
+}
+
+function SchemaListViewCore({
+  listView,
+  data,
+  isLoading = false,
+  onRowClick,
+  onDeleteRow,
+  deletingRowId,
+  renderListColumn,
+  pagination,
+  scheduleByTask,
+  scheduleLoading = false,
+}: SchemaListViewProps & {
+  scheduleByTask: Map<string, PeriodicTaskResponse>;
+  scheduleLoading?: boolean;
+}) {
+  const serverPagination = pagination ?? null;
+  const manualPagination = serverPagination !== null;
+  const pageIndex =
+    manualPagination && serverPagination.limit > 0
+      ? Math.floor(serverPagination.offset / serverPagination.limit)
+      : 0;
+  const pageSize = manualPagination ? serverPagination.limit : 10;
+
+  const columns = useMemo<MRT_ColumnDef<Record<string, unknown>>[]>(
+    () =>
+      listView.columns.map((col) => {
+        if (col.format === 'schedule') {
+          return {
+            id: col.key,
+            accessorKey: col.key,
+            header: col.label,
+            enableSorting: col.sortable ?? false,
+            Cell: ({ row }) => {
+              const name = row.original.name;
+              // Trim to match how the detail summary derives its lookup key
+              // (PluginDetailPage trims `task.name`), so the list cell and the
+              // summary join to the same schedule even with stray whitespace.
+              const matched =
+                name === undefined || name === null
+                  ? undefined
+                  : scheduleByTask.get(String(name).trim());
+              return (
+                <ScheduleCell task={matched} isLoading={scheduleLoading} />
+              );
+            },
+          };
+        }
+        if (col.format === 'actions') {
+          return {
+            id: col.key,
+            accessorKey: col.key,
+            header: col.label,
+            enableSorting: false,
+            size: 72,
+            Cell: ({ row }) => {
+              const id = row.original.id;
+              if (id === undefined || id === null || !onDeleteRow) {
+                return null;
+              }
+              const sid = String(id);
+              return (
+                <IconButton
+                  size="small"
+                  color="error"
+                  aria-label="Delete"
+                  disabled={deletingRowId === sid}
+                  onClick={(e) => {
+                    e.stopPropagation();
+                    onDeleteRow(row.original);
+                  }}
+                >
+                  <DeleteOutlineIcon fontSize="small" />
+                </IconButton>
+              );
+            },
+          };
+        }
+        return {
+          accessorKey: col.key,
+          header: col.label,
+          enableSorting: col.sortable ?? true,
+          Cell: ({ cell, row }) => {
+            const value = cell.getValue();
+            const overridden = renderListColumn?.({
+              columnKey: col.key,
+              value,
+              row: row.original,
+            });
+            // `undefined` is the "no override" sentinel (override absent, or it
+            // declined this column); `null` is honored so an override can
+            // intentionally render an empty cell.
+            return overridden === undefined
+              ? formatCellValue(value, col.format)
+              : overridden;
+          },
+        };
+      }),
+    [
+      deletingRowId,
+      listView.columns,
+      onDeleteRow,
+      renderListColumn,
+      scheduleByTask,
+      scheduleLoading,
+    ]
+  );
+
+  return (
+    <MaterialReactTable
+      columns={columns}
+      data={data}
+      state={{
+        isLoading,
+        ...(manualPagination && { pagination: { pageIndex, pageSize } }),
+      }}
+      enableColumnActions={false}
+      enableDensityToggle={false}
+      enableFullScreenToggle={false}
+      enablePagination
+      manualPagination={manualPagination}
+      rowCount={manualPagination ? serverPagination.total : undefined}
+      onPaginationChange={
+        manualPagination
+          ? (updater) => {
+              const prev: MRT_PaginationState = { pageIndex, pageSize };
+              const next =
+                typeof updater === 'function' ? updater(prev) : updater;
+              serverPagination.onChange({
+                offset: next.pageIndex * next.pageSize,
+                limit: next.pageSize,
+              });
+            }
+          : undefined
+      }
+      muiTablePaginationProps={
+        manualPagination
+          ? {
+              // Single option: MUI hides the select; see DEFAULT_PLUGIN_LIST_LIMIT.
+              rowsPerPageOptions: [DEFAULT_PLUGIN_LIST_LIMIT],
+            }
+          : undefined
+      }
+      initialState={{
+        sorting: listView.default_sort
+          ? [
+              {
+                id: listView.default_sort.replace(/^-/, ''),
+                desc: listView.default_sort.startsWith('-'),
+              },
+            ]
+          : [],
+        density: 'compact',
+        ...(!manualPagination && {
+          pagination: { pageIndex: 0, pageSize: 10 },
+        }),
+      }}
+      muiTablePaperProps={{
+        className: SEP_TABLE_CLASS,
+        elevation: 0,
+        variant: 'outlined',
+        sx: opaqueTableSurface,
+      }}
+      muiTableContainerProps={{
+        sx: opaqueTableSurface,
+      }}
+      muiTableBodyRowProps={
+        onRowClick
+          ? ({ row }) => ({
+              onClick: () => onRowClick(row.original),
+              sx: { cursor: 'pointer' },
+            })
+          : undefined
+      }
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaListView/index.ts b/ui/packages/sep/framework/src/components/SchemaListView/index.ts
new file mode 100644
index 00000000000..5f23d2aa33a
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaListView/index.ts
@@ -0,0 +1,23 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { SchemaListView } from './SchemaListView';
+export type {
+  RenderListColumnArgs,
+  RenderListColumnOverride,
+  SchemaListServerPagination,
+} from './SchemaListView';
diff --git a/ui/packages/sep/framework/src/components/SchemaSelector/SchemaSelector.test.tsx b/ui/packages/sep/framework/src/components/SchemaSelector/SchemaSelector.test.tsx
new file mode 100644
index 00000000000..ffd0c36b17b
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaSelector/SchemaSelector.test.tsx
@@ -0,0 +1,384 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { act, render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { FormProvider, useForm } from 'react-hook-form';
+import type { PropsWithChildren } from 'react';
+import { SchemaSelector } from './SchemaSelector';
+import type { ServiceOption } from '../../hooks/useServices';
+import type { SchemaOption } from '../../hooks/useSchemas';
+
+vi.mock('@sep/api', () => ({
+  apiClient: { get: vi.fn(), post: vi.fn() },
+}));
+import { apiClient } from '@sep/api';
+const mocked = apiClient as unknown as { get: ReturnType<typeof vi.fn> };
+
+function makeClient() {
+  return new QueryClient({
+    defaultOptions: { queries: { retry: false, gcTime: 0, staleTime: 0 } },
+  });
+}
+
+interface FormShape {
+  service: ServiceOption | null;
+  schema: SchemaOption | null;
+}
+
+function Harness({
+  initialService,
+  onMount,
+}: {
+  initialService: ServiceOption | null;
+  onMount?: (api: { setService: (s: ServiceOption | null) => void }) => void;
+}) {
+  const methods = useForm<FormShape>({
+    defaultValues: { service: initialService, schema: null },
+  });
+  if (onMount) {
+    onMount({ setService: (s) => methods.setValue('service', s) });
+  }
+  return (
+    <FormProvider {...methods}>
+      <SchemaSelector name="schema" label="Schema" dependsOn="service" />
+    </FormProvider>
+  );
+}
+
+function Wrapper({
+  children,
+  client,
+}: PropsWithChildren<{ client: QueryClient }>) {
+  return <QueryClientProvider client={client}>{children}</QueryClientProvider>;
+}
+
+describe('SchemaSelector', () => {
+  beforeEach(() => {
+    mocked.get.mockReset();
+  });
+
+  it('is disabled and skips fetch when no service selected', async () => {
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <Harness initialService={null} />
+      </Wrapper>
+    );
+    expect(screen.getByLabelText('Schema')).toBeDisabled();
+    expect(screen.getByText('Select a service first')).toBeInTheDocument();
+    expect(mocked.get).not.toHaveBeenCalled();
+  });
+
+  it('fetches schemas when service is set', async () => {
+    mocked.get.mockResolvedValueOnce({
+      data: [
+        { id: 10, name: 'app_prod' },
+        { id: 11, name: 'analytics' },
+      ],
+    });
+
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <Harness initialService={{ id: 7, name: 'svc', type: 'mysql' }} />
+      </Wrapper>
+    );
+
+    await waitFor(() =>
+      expect(mocked.get).toHaveBeenCalledWith('/sep/services/7/schemas')
+    );
+  });
+
+  it('resets value when parent service changes', async () => {
+    mocked.get.mockResolvedValue({ data: [{ id: 1, name: 'a' }] });
+    const client = makeClient();
+    const apiRef: { current: ((s: ServiceOption | null) => void) | null } = {
+      current: null,
+    };
+    const initial: ServiceOption = { id: 1, name: 's1', type: 'mysql' };
+
+    function Probe() {
+      const methods = useForm<FormShape>({
+        defaultValues: {
+          service: initial,
+          schema: { id: 99, name: 'pre-existing' },
+        },
+      });
+      apiRef.current = (s) => methods.setValue('service', s);
+      return (
+        <FormProvider {...methods}>
+          <SchemaSelector name="schema" label="Schema" dependsOn="service" />
+          <output data-testid="schema-value">
+            {JSON.stringify(methods.watch('schema'))}
+          </output>
+        </FormProvider>
+      );
+    }
+
+    render(
+      <Wrapper client={client}>
+        <Probe />
+      </Wrapper>
+    );
+
+    expect(screen.getByTestId('schema-value').textContent).toContain(
+      'pre-existing'
+    );
+
+    await act(async () => {
+      apiRef.current?.({ id: 2, name: 's2', type: 'mysql' });
+    });
+
+    await waitFor(() => {
+      expect(screen.getByTestId('schema-value').textContent).toBe('null');
+    });
+  });
+
+  it('renders error state', async () => {
+    mocked.get.mockRejectedValueOnce(new Error('schemas down'));
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <Harness initialService={{ id: 1, name: 's', type: 'mysql' }} />
+      </Wrapper>
+    );
+    await screen.findByText('schemas down');
+  });
+
+  it('renders empty state', async () => {
+    mocked.get.mockResolvedValueOnce({ data: [] });
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <Harness initialService={{ id: 1, name: 's', type: 'mysql' }} />
+      </Wrapper>
+    );
+    await screen.findByText('No schemas in this service');
+  });
+
+  describe('allow_custom (free-solo)', () => {
+    // The allow_custom path commits `number | string | null`, not a `SchemaOption`.
+    interface CustomFormShape {
+      service: ServiceOption | null;
+      schema: number | string | null;
+    }
+
+    function CustomProbe() {
+      const methods = useForm<CustomFormShape>({
+        defaultValues: {
+          service: { id: 7, name: 'svc', type: 'mysql' },
+          schema: null,
+        },
+      });
+      return (
+        <FormProvider {...methods}>
+          <SchemaSelector
+            name="schema"
+            label="Schema"
+            dependsOn="service"
+            allowCustom
+          />
+          <output data-testid="schema-value">
+            {JSON.stringify(methods.watch('schema'))}
+          </output>
+        </FormProvider>
+      );
+    }
+
+    const value = () => screen.getByTestId('schema-value').textContent;
+
+    it('commits the inventory id when a schema is picked', async () => {
+      mocked.get.mockResolvedValue({
+        data: [
+          { id: 10, name: 'app_prod' },
+          { id: 11, name: 'analytics' },
+        ],
+      });
+      const client = makeClient();
+      const user = userEvent.setup();
+      render(
+        <Wrapper client={client}>
+          <CustomProbe />
+        </Wrapper>
+      );
+      await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+      await user.click(screen.getByLabelText('Schema'));
+      await user.click(await screen.findByText('app_prod'));
+      expect(value()).toBe('10');
+    });
+
+    it('commits a typed value as a string', async () => {
+      mocked.get.mockResolvedValue({ data: [{ id: 10, name: 'app_prod' }] });
+      const client = makeClient();
+      const user = userEvent.setup();
+      render(
+        <Wrapper client={client}>
+          <CustomProbe />
+        </Wrapper>
+      );
+      await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+      await user.type(screen.getByLabelText('Schema'), 'manual_db');
+      expect(value()).toBe('"manual_db"');
+    });
+
+    it('stays enabled and accepts a typed value when the parent service is custom', async () => {
+      const client = makeClient();
+      const user = userEvent.setup();
+      function CascadeProbe() {
+        // Parent service holds a free-typed (custom) string, not an inventory id.
+        const methods = useForm<{ service: unknown; schema: unknown }>({
+          defaultValues: { service: 'custom-svc', schema: null },
+        });
+        return (
+          <FormProvider {...methods}>
+            <SchemaSelector
+              name="schema"
+              label="Schema"
+              dependsOn="service"
+              allowCustom
+            />
+            <output data-testid="schema-value">
+              {JSON.stringify(methods.watch('schema'))}
+            </output>
+          </FormProvider>
+        );
+      }
+      render(
+        <Wrapper client={client}>
+          <CascadeProbe />
+        </Wrapper>
+      );
+      const input = screen.getByLabelText('Schema');
+      expect(input).not.toBeDisabled();
+      // No service id means no schema fetch is issued.
+      expect(mocked.get).not.toHaveBeenCalled();
+      await user.type(input, 'custom_schema');
+      expect(screen.getByTestId('schema-value').textContent).toBe(
+        '"custom_schema"'
+      );
+    });
+
+    it('treats a numeric custom parent string as custom (not an inventory id)', async () => {
+      const client = makeClient();
+      const user = userEvent.setup();
+      function NumericCustomParentProbe() {
+        const methods = useForm<{ service: unknown; schema: unknown }>({
+          defaultValues: { service: '42', schema: null },
+        });
+        return (
+          <FormProvider {...methods}>
+            <SchemaSelector
+              name="schema"
+              label="Schema"
+              dependsOn="service"
+              allowCustom
+            />
+            <output data-testid="schema-value">
+              {JSON.stringify(methods.watch('schema'))}
+            </output>
+          </FormProvider>
+        );
+      }
+      render(
+        <Wrapper client={client}>
+          <NumericCustomParentProbe />
+        </Wrapper>
+      );
+      const input = screen.getByLabelText('Schema');
+      expect(input).not.toBeDisabled();
+      expect(mocked.get).not.toHaveBeenCalled();
+      await user.type(input, 'custom_schema');
+      expect(screen.getByTestId('schema-value').textContent).toBe(
+        '"custom_schema"'
+      );
+    });
+
+    it('clears child value when parent custom value changes', async () => {
+      const client = makeClient();
+      const setServiceRef: { current: ((value: unknown) => void) | null } = {
+        current: null,
+      };
+      function CustomParentChangeProbe() {
+        const methods = useForm<{ service: unknown; schema: unknown }>({
+          defaultValues: { service: 'custom-svc-a', schema: 'child-schema' },
+        });
+        setServiceRef.current = (value) => methods.setValue('service', value);
+        return (
+          <FormProvider {...methods}>
+            <SchemaSelector
+              name="schema"
+              label="Schema"
+              dependsOn="service"
+              allowCustom
+            />
+            <output data-testid="schema-value">
+              {JSON.stringify(methods.watch('schema'))}
+            </output>
+          </FormProvider>
+        );
+      }
+      render(
+        <Wrapper client={client}>
+          <CustomParentChangeProbe />
+        </Wrapper>
+      );
+      expect(screen.getByTestId('schema-value').textContent).toBe(
+        '"child-schema"'
+      );
+      await act(async () => {
+        setServiceRef.current?.('custom-svc-b');
+      });
+      await waitFor(() => {
+        expect(screen.getByTestId('schema-value').textContent).toBe('null');
+      });
+      expect(mocked.get).not.toHaveBeenCalled();
+    });
+  });
+
+  it('back-compat: without allowCustom a typed value is not committed', async () => {
+    mocked.get.mockResolvedValue({ data: [{ id: 10, name: 'app_prod' }] });
+    const client = makeClient();
+    const user = userEvent.setup();
+    function Probe() {
+      const methods = useForm<FormShape>({
+        defaultValues: {
+          service: { id: 7, name: 'svc', type: 'mysql' },
+          schema: null,
+        },
+      });
+      return (
+        <FormProvider {...methods}>
+          <SchemaSelector name="schema" label="Schema" dependsOn="service" />
+          <output data-testid="bc-value">
+            {JSON.stringify(methods.watch('schema'))}
+          </output>
+        </FormProvider>
+      );
+    }
+    render(
+      <Wrapper client={client}>
+        <Probe />
+      </Wrapper>
+    );
+    await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+    await user.type(screen.getByLabelText('Schema'), 'manual_db');
+    expect(screen.getByTestId('bc-value').textContent).toBe('null');
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SchemaSelector/SchemaSelector.tsx b/ui/packages/sep/framework/src/components/SchemaSelector/SchemaSelector.tsx
new file mode 100644
index 00000000000..9ba5486acf2
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaSelector/SchemaSelector.tsx
@@ -0,0 +1,164 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useEffect, useRef } from 'react';
+import { useFormContext, useWatch } from 'react-hook-form';
+import { AutoCompleteInput } from '@percona/percona-ui';
+import { useSchemas, type SchemaOption } from '../../hooks/useSchemas';
+import type { ServiceOption } from '../../hooks/useServices';
+import { extractId } from '../../utils/extractId';
+import { FreeSoloSelect } from '../FreeSoloSelect';
+
+const EMPTY_OPTIONS: SchemaOption[] = [];
+
+export interface SchemaSelectorProps {
+  /**
+   * react-hook-form field name. Without `allowCustom`, stores a
+   * `SchemaOption | null`; with `allowCustom`, stores the committed
+   * `number | string | null` (inventory id, free-typed value, or unset).
+   */
+  name: string;
+  label: string;
+  required?: boolean;
+  /**
+   * Form field name of the parent `ServiceSelector`. The watched value is
+   * either a `ServiceOption` (from `<ServiceSelector>`) or a raw service id.
+   */
+  dependsOn: string;
+  disabled?: boolean;
+  /** Offer free-text (free-solo) entry alongside the inventory options. */
+  allowCustom?: boolean;
+}
+
+const getOptionLabel = (opt: SchemaOption | string) =>
+  typeof opt === 'string' ? opt : opt.name;
+const getOptionName = (opt: SchemaOption) => opt.name;
+
+const isOptionEqualToValue = (a: SchemaOption, b: SchemaOption) =>
+  a.id === b.id;
+
+export function SchemaSelector({
+  name,
+  label,
+  required,
+  dependsOn,
+  disabled,
+  allowCustom,
+}: SchemaSelectorProps) {
+  const { control, setValue } = useFormContext();
+
+  const parent = useWatch({ control, name: dependsOn }) as
+    | ServiceOption
+    | number
+    | string
+    | null
+    | undefined;
+  const parentText = typeof parent === 'string' ? parent.trim() : '';
+  const parentIsCustom = Boolean(allowCustom) && parentText !== '';
+  const serviceId = parentIsCustom ? null : extractId(parent);
+  // A parent that resolves to no inventory id but holds a non-empty string is a
+  // free-typed (custom) parent value, not an absent one. A free-solo child can
+  // still accept a typed value in that case (it just has no options to offer).
+  const parentResetKey = parentIsCustom
+    ? `custom:${parentText}`
+    : `id:${serviceId ?? 'none'}`;
+
+  const prevParentKeyRef = useRef(parentResetKey);
+  useEffect(() => {
+    if (prevParentKeyRef.current !== parentResetKey) {
+      prevParentKeyRef.current = parentResetKey;
+      setValue(name, null, { shouldDirty: true, shouldValidate: false });
+    }
+  }, [parentResetKey, name, setValue]);
+
+  const {
+    data: schemas = EMPTY_OPTIONS,
+    isLoading,
+    isError,
+    error,
+  } = useSchemas({ serviceId });
+
+  const noService = serviceId === null || serviceId === undefined;
+  const empty = !noService && !isLoading && !isError && schemas.length === 0;
+
+  const helperText = noService
+    ? 'Select a service first'
+    : isError
+      ? (error?.message ?? 'Failed to load schemas')
+      : empty
+        ? 'No schemas in this service'
+        : undefined;
+
+  if (allowCustom) {
+    // Only a truly absent parent disables the control; a custom (free-typed)
+    // parent keeps it enabled so the user can type a custom schema too.
+    const parentMissing = noService && !parentIsCustom;
+    return (
+      <FreeSoloSelect<SchemaOption>
+        name={name}
+        label={label}
+        options={schemas}
+        getOptionLabel={getOptionName}
+        required={required}
+        disabled={disabled || parentMissing || isError}
+        loading={isLoading}
+        helperText={
+          parentMissing
+            ? 'Select a service first'
+            : isError
+              ? helperText
+              : undefined
+        }
+        error={isError}
+        noOptionsText={
+          parentMissing
+            ? 'Select a service first'
+            : parentIsCustom
+              ? 'Custom service — type a schema name'
+              : isLoading
+                ? 'Loading schemas…'
+                : 'No schemas in this service'
+        }
+      />
+    );
+  }
+
+  return (
+    <AutoCompleteInput<SchemaOption>
+      name={name}
+      label={label}
+      control={control}
+      isRequired={required}
+      loading={isLoading}
+      disabled={disabled || noService || isError}
+      options={schemas}
+      controllerProps={{
+        rules: required ? { required: `${label} is required` } : undefined,
+      }}
+      autoCompleteProps={{
+        getOptionLabel,
+        isOptionEqualToValue,
+        noOptionsText: noService
+          ? 'Select a service first'
+          : isLoading
+            ? 'Loading schemas…'
+            : 'No schemas in this service',
+      }}
+      textFieldProps={{ helperText, error: isError }}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SchemaSelector/index.ts b/ui/packages/sep/framework/src/components/SchemaSelector/index.ts
new file mode 100644
index 00000000000..3c0574cd4f3
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SchemaSelector/index.ts
@@ -0,0 +1,19 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { SchemaSelector } from './SchemaSelector';
+export type { SchemaSelectorProps } from './SchemaSelector';
diff --git a/ui/packages/sep/framework/src/components/ServiceSelector/ServiceSelector.test.tsx b/ui/packages/sep/framework/src/components/ServiceSelector/ServiceSelector.test.tsx
new file mode 100644
index 00000000000..c5305175597
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ServiceSelector/ServiceSelector.test.tsx
@@ -0,0 +1,263 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { FormProvider, useForm } from 'react-hook-form';
+import type { PropsWithChildren } from 'react';
+import { ServiceSelector } from './ServiceSelector';
+
+vi.mock('@sep/api', async (importOriginal) => ({
+  // Keep real exports (notably ``ApiError``) so ``sepRetry``'s
+  // ``err instanceof ApiError`` check inside ``useServices`` resolves
+  // when this test exercises the error path.
+  ...(await importOriginal<typeof import('@sep/api')>()),
+  apiClient: { get: vi.fn(), post: vi.fn() },
+}));
+import { apiClient } from '@sep/api';
+const mocked = apiClient as unknown as { get: ReturnType<typeof vi.fn> };
+
+function makePage(items: Array<{ id: number; name: string; type: string }>) {
+  return { data: { items, total: items.length, offset: 0, limit: 200 } };
+}
+
+function makeClient() {
+  // ``useServices`` sets ``retry: sepRetry`` at the query level, which
+  // overrides the client-level ``retry: false`` default. ``retryDelay: 0``
+  // collapses the exponential backoff so error-path tests finish promptly
+  // regardless of the retry policy.
+  return new QueryClient({
+    defaultOptions: {
+      queries: { retry: false, retryDelay: 0, gcTime: 0, staleTime: 0 },
+    },
+  });
+}
+
+function Harness({ serviceTypes }: { serviceTypes?: readonly string[] }) {
+  const methods = useForm({ defaultValues: { service: null } });
+  return (
+    <FormProvider {...methods}>
+      <ServiceSelector
+        name="service"
+        label="Service"
+        serviceTypes={serviceTypes as never}
+      />
+    </FormProvider>
+  );
+}
+
+function Wrapper({
+  children,
+  client,
+}: PropsWithChildren<{ client: QueryClient }>) {
+  return <QueryClientProvider client={client}>{children}</QueryClientProvider>;
+}
+
+describe('ServiceSelector', () => {
+  beforeEach(() => {
+    mocked.get.mockReset();
+  });
+
+  it('fetches services and renders options', async () => {
+    mocked.get.mockResolvedValueOnce(
+      makePage([
+        { id: 1, name: 'mysql-prod', type: 'mysql' },
+        { id: 2, name: 'pg-prod', type: 'postgresql' },
+      ])
+    );
+
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <Harness />
+      </Wrapper>
+    );
+
+    await waitFor(() =>
+      expect(mocked.get).toHaveBeenCalledWith('/sep/services/', {
+        params: { offset: 0, limit: 200 },
+      })
+    );
+
+    const user = userEvent.setup();
+    await user.click(screen.getByLabelText('Service'));
+    expect(await screen.findByText('mysql-prod (mysql)')).toBeInTheDocument();
+    expect(screen.getByText('pg-prod (postgresql)')).toBeInTheDocument();
+  });
+
+  it('passes serviceTypes filter as query param', async () => {
+    mocked.get.mockResolvedValueOnce(
+      makePage([{ id: 1, name: 'mysql-prod', type: 'mysql' }])
+    );
+
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <Harness serviceTypes={['mysql']} />
+      </Wrapper>
+    );
+
+    await waitFor(() =>
+      expect(mocked.get).toHaveBeenCalledWith('/sep/services/', {
+        params: { offset: 0, limit: 200, service_type: 'mysql' },
+      })
+    );
+  });
+
+  it('renders error state', async () => {
+    // Reject every attempt — sepRetry retries plain Errors up to 2 times.
+    mocked.get.mockRejectedValue(new Error('boom'));
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <Harness />
+      </Wrapper>
+    );
+    await screen.findByText('boom');
+  });
+
+  it('renders empty state', async () => {
+    mocked.get.mockResolvedValueOnce(makePage([]));
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <Harness />
+      </Wrapper>
+    );
+    await screen.findByText('No services available');
+  });
+
+  it('hydrates a persisted scalar service id into the matching inventory option', async () => {
+    mocked.get.mockResolvedValueOnce(
+      makePage([{ id: 7, name: 'mysql-prod', type: 'mysql' }])
+    );
+    const client = makeClient();
+    function Probe() {
+      const methods = useForm<{ service: unknown }>({
+        defaultValues: { service: 7 },
+      });
+      return (
+        <FormProvider {...methods}>
+          <ServiceSelector
+            name="service"
+            label="Service"
+            serviceTypes={['mysql']}
+          />
+          <output data-testid="hydrated-value">
+            {JSON.stringify(methods.watch('service'))}
+          </output>
+        </FormProvider>
+      );
+    }
+    render(
+      <Wrapper client={client}>
+        <Probe />
+      </Wrapper>
+    );
+    await waitFor(() =>
+      expect(screen.getByTestId('hydrated-value').textContent).toContain(
+        '"id":7'
+      )
+    );
+    expect(screen.getByLabelText('Service')).toHaveValue('mysql-prod (mysql)');
+  });
+
+  describe('allow_custom (free-solo)', () => {
+    function CustomProbe() {
+      const methods = useForm<{ service: unknown }>({
+        defaultValues: { service: null },
+      });
+      return (
+        <FormProvider {...methods}>
+          <ServiceSelector name="service" label="Service" allowCustom />
+          <output data-testid="service-value">
+            {JSON.stringify(methods.watch('service'))}
+          </output>
+        </FormProvider>
+      );
+    }
+
+    const value = () => screen.getByTestId('service-value').textContent;
+
+    it('commits the inventory id when a service is picked', async () => {
+      mocked.get.mockResolvedValueOnce(
+        makePage([
+          { id: 1, name: 'mysql-prod', type: 'mysql' },
+          { id: 2, name: 'pg-prod', type: 'postgresql' },
+        ])
+      );
+      const client = makeClient();
+      const user = userEvent.setup();
+      render(
+        <Wrapper client={client}>
+          <CustomProbe />
+        </Wrapper>
+      );
+      await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+      await user.click(screen.getByLabelText('Service'));
+      await user.click(await screen.findByText('mysql-prod (mysql)'));
+      expect(value()).toBe('1');
+    });
+
+    it('commits a typed value as a string', async () => {
+      mocked.get.mockResolvedValueOnce(
+        makePage([{ id: 1, name: 'mysql-prod', type: 'mysql' }])
+      );
+      const client = makeClient();
+      const user = userEvent.setup();
+      render(
+        <Wrapper client={client}>
+          <CustomProbe />
+        </Wrapper>
+      );
+      await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+      await user.type(screen.getByLabelText('Service'), 'external-svc');
+      expect(value()).toBe('"external-svc"');
+    });
+
+    it('back-compat: without allowCustom a typed value is not committed', async () => {
+      mocked.get.mockResolvedValueOnce(
+        makePage([{ id: 1, name: 'mysql-prod', type: 'mysql' }])
+      );
+      const client = makeClient();
+      const user = userEvent.setup();
+      function Probe() {
+        const methods = useForm<{ service: unknown }>({
+          defaultValues: { service: null },
+        });
+        return (
+          <FormProvider {...methods}>
+            <ServiceSelector name="service" label="Service" />
+            <output data-testid="bc-value">
+              {JSON.stringify(methods.watch('service'))}
+            </output>
+          </FormProvider>
+        );
+      }
+      render(
+        <Wrapper client={client}>
+          <Probe />
+        </Wrapper>
+      );
+      await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+      await user.type(screen.getByLabelText('Service'), 'external-svc');
+      expect(screen.getByTestId('bc-value').textContent).toBe('null');
+    });
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/ServiceSelector/ServiceSelector.tsx b/ui/packages/sep/framework/src/components/ServiceSelector/ServiceSelector.tsx
new file mode 100644
index 00000000000..47de64f2f77
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ServiceSelector/ServiceSelector.tsx
@@ -0,0 +1,147 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useEffect } from 'react';
+import { useFormContext } from 'react-hook-form';
+import { AutoCompleteInput } from '@percona/percona-ui';
+import {
+  useServices,
+  type ServiceOption,
+  type ServiceType,
+} from '../../hooks/useServices';
+import { extractId } from '../../utils/extractId';
+import {
+  isHydratedReferenceOption,
+  resolveReferenceOption,
+} from '../../utils/referenceOption';
+import { FreeSoloSelect } from '../FreeSoloSelect';
+
+const EMPTY_OPTIONS: ServiceOption[] = [];
+
+export interface ServiceSelectorProps {
+  /**
+   * react-hook-form field name. Without `allowCustom`, stores a
+   * `ServiceOption | null`; with `allowCustom`, stores the committed
+   * `number | string | null` (inventory id, free-typed value, or unset).
+   */
+  name: string;
+  label: string;
+  required?: boolean;
+  /** Optional filter — only services whose `type` is in this list are shown. */
+  serviceTypes?: readonly ServiceType[];
+  disabled?: boolean;
+  helperText?: string;
+  /** Offer free-text (free-solo) entry alongside the inventory options. */
+  allowCustom?: boolean;
+}
+
+const getOptionLabel = (opt: ServiceOption | string) =>
+  typeof opt === 'string' ? opt : `${opt.name} (${opt.type})`;
+// Used by the free-solo path. Because the label is `name (type)`, the
+// typed-text-to-id resolution only fires if the user types that exact form;
+// in practice a free-typed service almost always commits as a custom string,
+// while inventory picks resolve to an id through the option-click path.
+const getServiceOptionLabel = (opt: ServiceOption) =>
+  `${opt.name} (${opt.type})`;
+
+const isOptionEqualToValue = (a: ServiceOption, b: ServiceOption) =>
+  a.id === b.id;
+
+export function ServiceSelector({
+  name,
+  label,
+  required,
+  serviceTypes,
+  disabled,
+  helperText,
+  allowCustom,
+}: ServiceSelectorProps) {
+  const { control, setValue, watch } = useFormContext();
+  const storedValue = watch(name);
+
+  const {
+    data: services = EMPTY_OPTIONS,
+    isLoading,
+    isError,
+    error,
+  } = useServices({ serviceTypes });
+
+  const empty = !isLoading && !isError && services.length === 0;
+
+  const text = isError
+    ? (error?.message ?? 'Failed to load services')
+    : empty
+      ? 'No services available'
+      : helperText;
+
+  useEffect(() => {
+    if (allowCustom || isHydratedReferenceOption(storedValue)) {
+      return;
+    }
+    const id = extractId(storedValue);
+    if (id === null) {
+      return;
+    }
+    const match = services.find((service) => service.id === id);
+    if (match) {
+      setValue(name, match, { shouldDirty: false, shouldValidate: false });
+    }
+  }, [allowCustom, storedValue, services, name, setValue]);
+
+  if (allowCustom) {
+    return (
+      <FreeSoloSelect<ServiceOption>
+        name={name}
+        label={label}
+        options={services}
+        getOptionLabel={getServiceOptionLabel}
+        required={required}
+        disabled={disabled || isError}
+        loading={isLoading}
+        helperText={text}
+        error={isError}
+        noOptionsText={
+          isLoading ? 'Loading services…' : 'No services available'
+        }
+      />
+    );
+  }
+
+  return (
+    <AutoCompleteInput<ServiceOption>
+      name={name}
+      label={label}
+      control={control}
+      isRequired={required}
+      loading={isLoading}
+      disabled={disabled || isError}
+      options={services}
+      controllerProps={{
+        rules: required ? { required: `${label} is required` } : undefined,
+      }}
+      autoCompleteProps={{
+        getOptionLabel,
+        isOptionEqualToValue,
+        noOptionsText: isLoading
+          ? 'Loading services…'
+          : 'No services available',
+        value: resolveReferenceOption(storedValue, services),
+      }}
+      textFieldProps={{ helperText: text, error: isError }}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/ServiceSelector/index.ts b/ui/packages/sep/framework/src/components/ServiceSelector/index.ts
new file mode 100644
index 00000000000..ac8741f8bae
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/ServiceSelector/index.ts
@@ -0,0 +1,19 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { ServiceSelector } from './ServiceSelector';
+export type { ServiceSelectorProps } from './ServiceSelector';
diff --git a/ui/packages/sep/framework/src/components/SnippetExecutionAccordion/SnippetExecutionAccordion.test.tsx b/ui/packages/sep/framework/src/components/SnippetExecutionAccordion/SnippetExecutionAccordion.test.tsx
new file mode 100644
index 00000000000..3a30672fef8
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SnippetExecutionAccordion/SnippetExecutionAccordion.test.tsx
@@ -0,0 +1,567 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import type { ReactNode } from 'react';
+import { SnippetExecutionAccordion } from './SnippetExecutionAccordion';
+import { apiClient, type PluginSchema } from '@sep/api';
+import type { TaskHistoryEntry } from '../TaskHistoryTable';
+
+vi.mock('@sep/api', () => ({
+  apiClient: { get: vi.fn(), post: vi.fn() },
+}));
+
+vi.mock('../TaskLogViewer', () => ({
+  TaskLogViewer: ({ taskHistoryId }: { taskHistoryId: number }) => (
+    <div data-testid="task-log-viewer" data-task-id={taskHistoryId} />
+  ),
+}));
+
+vi.mock('../TaskHistoryTable', () => ({
+  TaskHistoryTable: ({
+    data,
+    onStopTask,
+  }: {
+    data?: TaskHistoryEntry[];
+    onStopTask?: (entry: TaskHistoryEntry) => void;
+  }) => (
+    <div data-testid="task-history-table" data-row-count={data?.length ?? 0}>
+      {data?.[0] && onStopTask ? (
+        <button type="button" onClick={() => onStopTask(data[0])}>
+          Stop {String(data[0].id)}
+        </button>
+      ) : null}
+    </div>
+  ),
+}));
+
+const mockedApi = apiClient as unknown as {
+  get: ReturnType<typeof vi.fn>;
+  post: ReturnType<typeof vi.fn>;
+};
+
+type FormSection = NonNullable<PluginSchema['forms']>[number];
+
+function makeSchema(extraFields: FormSection['fields'] = []): PluginSchema {
+  return {
+    name: 'snippets',
+    display_name: 'Test Snippet',
+    forms: [
+      {
+        title: 'Execution',
+        fields: [
+          {
+            type: 'host',
+            name: 'executor_host',
+            label: 'Executor Host',
+            required: true,
+          },
+          {
+            type: 'string',
+            name: 'table_name',
+            label: 'Table Name',
+            required: false,
+          },
+          ...extraFields,
+        ],
+      },
+    ],
+  };
+}
+
+/** Schema shaped like the backend's synthesised snippet schema: a dedicated
+ * collapsible "Script preview" section whose only field is the read-only
+ * `script_preview` ScriptPreviewField (see app/sep/snippets/schema.py). */
+function makeSchemaWithPreview(): PluginSchema {
+  const base = makeSchema();
+  return {
+    ...base,
+    forms: [
+      ...(base.forms ?? []),
+      {
+        title: 'Script preview',
+        collapsible: true,
+        collapsed_by_default: false,
+        render_after_submit: true,
+        fields: [
+          {
+            type: 'script_preview',
+            name: 'script_preview',
+            label: 'Snippet file',
+            required: false,
+            endpoint_url:
+              '/apps/snippets/snippet/preview?snippet_filename=check.sh',
+            depends_on: [],
+          },
+        ],
+      },
+    ],
+  };
+}
+
+function renderWithProviders(ui: ReactNode) {
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false, staleTime: Infinity } },
+  });
+  return render(
+    <QueryClientProvider client={queryClient}>{ui}</QueryClientProvider>
+  );
+}
+
+describe('SnippetExecutionAccordion', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('renders title in collapsed state without fetching schema', () => {
+    renderWithProviders(
+      <SnippetExecutionAccordion
+        snippetFilename="check.sh"
+        executorHost="db1"
+        title="Check Script"
+      />
+    );
+
+    expect(screen.getByText('Check Script')).toBeInTheDocument();
+    expect(mockedApi.get).not.toHaveBeenCalled();
+  });
+
+  it('uses filename as fallback title', () => {
+    renderWithProviders(
+      <SnippetExecutionAccordion
+        snippetFilename="check.sh"
+        executorHost="db1"
+      />
+    );
+
+    expect(screen.getByText('check.sh')).toBeInTheDocument();
+  });
+
+  it('fetches schema and renders form fields when expanded', async () => {
+    mockedApi.get.mockResolvedValue({ data: makeSchema() });
+
+    renderWithProviders(
+      <SnippetExecutionAccordion
+        snippetFilename="check.sh"
+        executorHost="db1"
+        title="Check Script"
+        defaultExpanded
+      />
+    );
+
+    await waitFor(() => {
+      expect(screen.getByLabelText(/Table Name/i)).toBeInTheDocument();
+    });
+  });
+
+  it('omits executor_host field when executorHost prop provided', async () => {
+    mockedApi.get.mockResolvedValue({ data: makeSchema() });
+
+    renderWithProviders(
+      <SnippetExecutionAccordion
+        snippetFilename="check.sh"
+        executorHost="db1"
+        title="Check Script"
+        defaultExpanded
+      />
+    );
+
+    await waitFor(() => {
+      expect(screen.getByLabelText(/Table Name/i)).toBeInTheDocument();
+    });
+
+    expect(screen.queryByLabelText(/Executor Host/i)).not.toBeInTheDocument();
+  });
+
+  it('posts to snippets execute endpoint on submit with executorHost injected', async () => {
+    const user = userEvent.setup();
+    mockedApi.get.mockResolvedValue({ data: makeSchema() });
+    mockedApi.post.mockResolvedValue({ data: { task_id: 7 } });
+
+    renderWithProviders(
+      <SnippetExecutionAccordion
+        snippetFilename="check.sh"
+        executorHost="db1"
+        title="Check Script"
+        defaultExpanded
+      />
+    );
+
+    await waitFor(() => {
+      expect(screen.getByLabelText(/Table Name/i)).toBeInTheDocument();
+    });
+
+    await user.click(screen.getByRole('button', { name: /execute/i }));
+
+    await waitFor(() => {
+      expect(mockedApi.post).toHaveBeenCalledWith(
+        expect.stringContaining('check.sh'),
+        {
+          executor_host: 'db1',
+          sudo: false,
+          args: {},
+        }
+      );
+    });
+  });
+
+  it('posts executor_host from rendered form when executorHost is not provided', async () => {
+    const user = userEvent.setup();
+    mockedApi.get.mockImplementation((url: string) =>
+      Promise.resolve({
+        data:
+          url === '/sep/hosts/'
+            ? [{ id: 'db2', name: 'db2', address: '10.0.0.2' }]
+            : makeSchema(),
+        headers: {},
+      })
+    );
+    mockedApi.post.mockResolvedValue({ data: { task_id: 7 } });
+
+    renderWithProviders(
+      <SnippetExecutionAccordion snippetFilename="check.sh" defaultExpanded />
+    );
+
+    await waitFor(() => {
+      expect(screen.getByLabelText(/Executor Host/i)).toBeInTheDocument();
+    });
+
+    await user.click(screen.getByLabelText(/Executor Host/i));
+    await user.click(await screen.findByRole('option', { name: 'db2' }));
+    await user.click(screen.getByRole('button', { name: /execute/i }));
+
+    await waitFor(() => {
+      expect(mockedApi.post).toHaveBeenCalledWith(
+        expect.stringContaining('check.sh'),
+        {
+          executor_host: 'db2',
+          sudo: false,
+          args: {},
+        }
+      );
+    });
+  });
+
+  it('shows TaskLogViewer after successful execution', async () => {
+    const user = userEvent.setup();
+    mockedApi.get.mockResolvedValue({ data: makeSchema() });
+    mockedApi.post.mockResolvedValue({ data: { task_id: 42 } });
+
+    renderWithProviders(
+      <SnippetExecutionAccordion
+        snippetFilename="check.sh"
+        executorHost="db1"
+        title="Check Script"
+        defaultExpanded
+      />
+    );
+
+    await waitFor(() => {
+      expect(
+        screen.getByRole('button', { name: /execute/i })
+      ).toBeInTheDocument();
+    });
+
+    await user.click(screen.getByRole('button', { name: /execute/i }));
+
+    await waitFor(() => {
+      const viewer = screen.getByTestId('task-log-viewer');
+      expect(viewer).toBeInTheDocument();
+      expect(viewer).toHaveAttribute('data-task-id', '42');
+    });
+  });
+
+  it('renders TaskHistoryTable when showHistory is true', async () => {
+    mockedApi.get.mockImplementation((url: string) =>
+      Promise.resolve({
+        data: url.endsWith('/history') ? { items: [] } : makeSchema(),
+      })
+    );
+
+    renderWithProviders(
+      <SnippetExecutionAccordion
+        snippetFilename="check.sh"
+        executorHost="db1"
+        title="Check Script"
+        defaultExpanded
+        showHistory
+      />
+    );
+
+    await waitFor(() => {
+      expect(screen.getByTestId('task-history-table')).toBeInTheDocument();
+    });
+    expect(mockedApi.get).toHaveBeenCalledWith(
+      '/apps/snippets/snippet/history?snippet_filename=check.sh'
+    );
+  });
+
+  it('wires the Stop button to the stop-task endpoint with the row id', async () => {
+    mockedApi.get.mockImplementation((url: string) =>
+      Promise.resolve({
+        data: url.includes('/snippet/history')
+          ? {
+              items: [
+                {
+                  id: 99,
+                  status: 'running',
+                  has_logs: false,
+                  execution_request: {
+                    task: 's',
+                    target: 'h',
+                    meta: {},
+                    tracking: {},
+                  },
+                  task: { id: 1, name: 's' },
+                },
+              ],
+            }
+          : makeSchema(),
+      })
+    );
+    mockedApi.post.mockResolvedValue({ data: { id: 99, status: 'stopped' } });
+
+    renderWithProviders(
+      <SnippetExecutionAccordion
+        snippetFilename="check.sh"
+        executorHost="db1"
+        title="Check Script"
+        defaultExpanded
+        showHistory
+      />
+    );
+
+    await userEvent.click(
+      await screen.findByRole('button', { name: 'Stop 99' })
+    );
+
+    await waitFor(() =>
+      expect(mockedApi.post).toHaveBeenCalledWith('/sep/task-history/99/stop/')
+    );
+
+    // The stop hook only invalidates ['task-history']; this accordion's history
+    // is keyed under ['snippets', filename, 'history'], so the wired onSuccess
+    // must refetch it directly — assert the history endpoint is hit again.
+    const historyGets = () =>
+      mockedApi.get.mock.calls.filter((call) =>
+        String(call[0]).includes('/snippet/history')
+      ).length;
+    await waitFor(() => expect(historyGets()).toBeGreaterThan(1));
+  });
+
+  it('does not render TaskHistoryTable when showHistory is false', async () => {
+    mockedApi.get.mockResolvedValue({ data: makeSchema() });
+
+    renderWithProviders(
+      <SnippetExecutionAccordion
+        snippetFilename="check.sh"
+        executorHost="db1"
+        title="Check Script"
+        defaultExpanded
+      />
+    );
+
+    await waitFor(() => {
+      expect(screen.getByLabelText(/Table Name/i)).toBeInTheDocument();
+    });
+
+    expect(screen.queryByTestId('task-history-table')).not.toBeInTheDocument();
+  });
+
+  it('renders sudo field when schema includes it', async () => {
+    mockedApi.get.mockResolvedValue({
+      data: makeSchema([
+        { type: 'bool', name: 'sudo', label: 'Run with sudo', required: false },
+      ]),
+    });
+
+    renderWithProviders(
+      <SnippetExecutionAccordion
+        snippetFilename="check.sh"
+        executorHost="db1"
+        title="Check Script"
+        defaultExpanded
+      />
+    );
+
+    await waitFor(() => {
+      expect(screen.getByLabelText(/Run with sudo/i)).toBeInTheDocument();
+    });
+  });
+
+  it('shows executor_host field when executorHost is empty string (treated as not hoisting)', async () => {
+    mockedApi.get.mockImplementation((url: string) =>
+      Promise.resolve({
+        data:
+          url === '/sep/hosts/'
+            ? [{ id: 'db2', name: 'db2', address: '10.0.0.2' }]
+            : makeSchema(),
+        headers: {},
+      })
+    );
+
+    renderWithProviders(
+      <SnippetExecutionAccordion
+        snippetFilename="check.sh"
+        executorHost=""
+        defaultExpanded
+      />
+    );
+
+    await waitFor(() => {
+      expect(screen.getByLabelText(/Executor Host/i)).toBeInTheDocument();
+    });
+  });
+
+  it('fetches schema with execution_only param', async () => {
+    mockedApi.get.mockResolvedValue({ data: makeSchema() });
+
+    renderWithProviders(
+      <SnippetExecutionAccordion snippetFilename="check.sh" defaultExpanded />
+    );
+
+    await waitFor(() =>
+      expect(mockedApi.get).toHaveBeenCalledWith(
+        '/apps/snippets/snippet/schema?snippet_filename=check.sh',
+        {
+          params: { execution_only: true },
+        }
+      )
+    );
+  });
+
+  it('passes executor_host from form (not hoisted) when executorHost is empty string', async () => {
+    const user = userEvent.setup();
+    mockedApi.get.mockImplementation((url: string) =>
+      Promise.resolve({
+        data:
+          url === '/sep/hosts/'
+            ? [{ id: 'db2', name: 'db2', address: '10.0.0.2' }]
+            : makeSchema(),
+        headers: {},
+      })
+    );
+    mockedApi.post.mockResolvedValue({ data: { task_id: 9 } });
+
+    renderWithProviders(
+      <SnippetExecutionAccordion
+        snippetFilename="check.sh"
+        executorHost=""
+        defaultExpanded
+      />
+    );
+
+    await waitFor(() => {
+      expect(screen.getByLabelText(/Executor Host/i)).toBeInTheDocument();
+    });
+
+    await user.click(screen.getByLabelText(/Executor Host/i));
+    await user.click(await screen.findByRole('option', { name: 'db2' }));
+    await user.click(screen.getByRole('button', { name: /execute/i }));
+
+    await waitFor(() => {
+      expect(mockedApi.post).toHaveBeenCalledWith(
+        expect.stringContaining('check.sh'),
+        {
+          executor_host: 'db2',
+          sudo: false,
+          args: {},
+        }
+      );
+    });
+  });
+
+  it('excludes sudo from args but includes at top level on submit', async () => {
+    const user = userEvent.setup();
+    mockedApi.get.mockResolvedValue({
+      data: makeSchema([
+        { type: 'bool', name: 'sudo', label: 'Run with sudo', required: false },
+      ]),
+    });
+    mockedApi.post.mockResolvedValue({ data: { task_id: 7 } });
+
+    renderWithProviders(
+      <SnippetExecutionAccordion
+        snippetFilename="check.sh"
+        executorHost="db1"
+        title="Check Script"
+        defaultExpanded
+      />
+    );
+
+    await waitFor(() => {
+      expect(screen.getByLabelText(/Run with sudo/i)).toBeInTheDocument();
+    });
+
+    await user.click(screen.getByLabelText(/Run with sudo/i));
+    await user.click(screen.getByRole('button', { name: /execute/i }));
+
+    await waitFor(() => {
+      expect(mockedApi.post).toHaveBeenCalledWith(
+        expect.stringContaining('check.sh'),
+        {
+          executor_host: 'db1',
+          sudo: true,
+          args: {},
+        }
+      );
+    });
+
+    // Verify sudo is NOT in args
+    const callArgs = mockedApi.post.mock.calls[0][1];
+    expect(callArgs.args).not.toHaveProperty('sudo');
+  });
+
+  // Regression: SEP-1555. The accordion previously stripped `script_preview`
+  // from every section, leaving the backend's "Script preview" collapsible
+  // (whose only field is that ScriptPreviewField) rendering an empty body.
+  it('renders the script preview field content inside the Script preview section', async () => {
+    mockedApi.get.mockImplementation((url: string) =>
+      Promise.resolve({
+        data: url.includes('/snippet/preview')
+          ? { content: 'echo hello', language: 'bash', is_truncated: false }
+          : makeSchemaWithPreview(),
+      })
+    );
+
+    renderWithProviders(
+      <SnippetExecutionAccordion
+        snippetFilename="check.sh"
+        executorHost="db1"
+        title="Check Script"
+        defaultExpanded
+      />
+    );
+
+    expect(await screen.findByText('Script preview')).toBeInTheDocument();
+    await waitFor(() => {
+      expect(mockedApi.get).toHaveBeenCalledWith(
+        '/apps/snippets/snippet/preview?snippet_filename=check.sh',
+        expect.anything()
+      );
+    });
+    // SyntaxHighlighter tokenises the content into per-token spans, so assert on
+    // the rendered <pre>'s combined text rather than a single text node.
+    await waitFor(() => {
+      const pre = document.querySelector('pre[data-language="bash"]');
+      expect(pre?.textContent).toContain('echo hello');
+    });
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/SnippetExecutionAccordion/SnippetExecutionAccordion.tsx b/ui/packages/sep/framework/src/components/SnippetExecutionAccordion/SnippetExecutionAccordion.tsx
new file mode 100644
index 00000000000..7e3d3e19f7c
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SnippetExecutionAccordion/SnippetExecutionAccordion.tsx
@@ -0,0 +1,327 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useState } from 'react';
+import {
+  Accordion,
+  AccordionDetails,
+  AccordionSummary,
+  Alert,
+  Box,
+  CircularProgress,
+  Dialog,
+  DialogContent,
+  DialogTitle,
+  Divider,
+  IconButton,
+  Typography,
+} from '@mui/material';
+import CloseIcon from '@mui/icons-material/Close';
+import ExpandMoreIcon from '@mui/icons-material/ExpandMore';
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { apiClient, type PluginSchema } from '@sep/api';
+import {
+  snippetPluginExecutePath,
+  snippetPluginHistoryPath,
+  snippetPluginSchemaPath,
+} from '../../snippetPluginPaths';
+import { SchemaFormRenderer } from '../SchemaFormRenderer';
+import {
+  TaskHistoryTable,
+  type PaginatedTaskHistory,
+  type TaskHistoryEntry,
+} from '../TaskHistoryTable';
+import { TaskLogViewer } from '../TaskLogViewer';
+import { useStopTaskHistory } from '../../hooks';
+
+/** Fields excluded from the snippet `args` payload (handled at top level instead). */
+const ARGS_EXCLUDED_FIELDS = new Set([
+  'executor_host',
+  'sudo',
+  'script_preview',
+]);
+
+export interface SnippetExecutionAccordionProps {
+  snippetFilename: string;
+  /** When non-empty, strips ``executor_host`` from the rendered form and injects this value at submit. */
+  executorHost?: string;
+  title?: string;
+  description?: string;
+  defaultExpanded?: boolean;
+  showHistory?: boolean;
+}
+
+interface ExecuteResponse {
+  task_id: number | null;
+}
+
+interface SnippetExecutionRequest {
+  executor_host: string;
+  sudo: boolean;
+  args: Record<string, unknown>;
+}
+
+function useSnippetAccordionSchema(filename: string, enabled: boolean) {
+  return useQuery<PluginSchema>({
+    queryKey: ['snippets', filename, 'schema', { execution_only: true }],
+    queryFn: async () => {
+      const { data } = await apiClient.get<PluginSchema>(
+        snippetPluginSchemaPath(filename),
+        {
+          params: { execution_only: true },
+        }
+      );
+      return data;
+    },
+    enabled,
+    staleTime: Infinity,
+  });
+}
+
+function useSnippetAccordionExecution(filename: string) {
+  const queryClient = useQueryClient();
+  return useMutation<ExecuteResponse, Error, SnippetExecutionRequest>({
+    mutationFn: async (body) => {
+      const { data } = await apiClient.post<ExecuteResponse>(
+        snippetPluginExecutePath(filename),
+        body
+      );
+      return data;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({
+        queryKey: ['snippets', filename, 'history'],
+      });
+    },
+  });
+}
+
+function useSnippetAccordionHistory(filename: string, enabled: boolean) {
+  return useQuery<PaginatedTaskHistory>({
+    queryKey: ['snippets', filename, 'history'],
+    queryFn: async () => {
+      const { data } = await apiClient.get<PaginatedTaskHistory>(
+        snippetPluginHistoryPath(filename)
+      );
+      return data;
+    },
+    enabled,
+  });
+}
+
+/**
+ * Self-contained accordion card that renders a snippet form, executes it,
+ * and shows the live log output. Intended for multi-snippet pages (alert
+ * troubleshooting) where one card per snippet is mounted on the same page.
+ *
+ * Schema fetch is deferred until the accordion is expanded. When a non-empty
+ * ``executorHost`` is provided, ``executor_host`` is stripped from the rendered
+ * form and injected at submit time — a single shared host selector drives all
+ * cards on the page. When omitted or empty, the field renders normally from
+ * the schema so the user selects a host per-card.
+ *
+ * When ``showHistory`` is ``true`` (used by the snippets detail page), a
+ * per-task execution history table is rendered below the form.
+ */
+export function SnippetExecutionAccordion({
+  snippetFilename,
+  executorHost,
+  title,
+  description,
+  defaultExpanded = false,
+  showHistory = false,
+}: SnippetExecutionAccordionProps) {
+  const [expanded, setExpanded] = useState(defaultExpanded);
+  const [currentTaskId, setCurrentTaskId] = useState<number | null>(null);
+  const [logsEntry, setLogsEntry] = useState<TaskHistoryEntry | null>(null);
+
+  const schemaQuery = useSnippetAccordionSchema(snippetFilename, expanded);
+  const executionMutation = useSnippetAccordionExecution(snippetFilename);
+  const historyQuery = useSnippetAccordionHistory(snippetFilename, showHistory);
+  const stop = useStopTaskHistory();
+
+  const displayTitle = title ?? snippetFilename;
+
+  const hoistingHost = Boolean(executorHost);
+  const filteredSections = (schemaQuery.data?.forms ?? []).map((section) => ({
+    ...section,
+    fields: section.fields.filter(
+      (field) => field.name !== 'executor_host' || !hoistingHost
+    ),
+  }));
+
+  const handleSubmit = (values: Record<string, unknown>) => {
+    const args: Record<string, unknown> = {};
+    for (const [key, value] of Object.entries(values)) {
+      if (ARGS_EXCLUDED_FIELDS.has(key)) {
+        continue;
+      }
+      if (value === '' || value === undefined) {
+        continue;
+      }
+      args[key] = value;
+    }
+    executionMutation.mutate(
+      {
+        executor_host: String(
+          hoistingHost ? executorHost : (values.executor_host ?? '')
+        ),
+        sudo: Boolean(values.sudo ?? false),
+        args,
+      },
+      {
+        onSuccess: (data) => {
+          if (data.task_id !== null && data.task_id !== undefined) {
+            setCurrentTaskId(data.task_id);
+          }
+        },
+      }
+    );
+  };
+
+  const submitError = executionMutation.isError
+    ? (executionMutation.error?.message ?? 'Execution failed')
+    : null;
+
+  return (
+    <Accordion
+      expanded={expanded}
+      onChange={(_, isExpanded) => setExpanded(isExpanded)}
+      disableGutters
+    >
+      <AccordionSummary expandIcon={<ExpandMoreIcon />}>
+        <Box>
+          <Typography variant="subtitle1" fontWeight={500}>
+            {displayTitle}
+          </Typography>
+          {description && (
+            <Typography variant="body2" color="text.secondary">
+              {description}
+            </Typography>
+          )}
+        </Box>
+      </AccordionSummary>
+
+      <AccordionDetails>
+        {schemaQuery.isLoading && (
+          <Box sx={{ display: 'flex', justifyContent: 'center', py: 4 }}>
+            <CircularProgress size={24} />
+          </Box>
+        )}
+
+        {schemaQuery.isError && (
+          <Alert severity="error">
+            Failed to load form: {schemaQuery.error?.message ?? 'unknown error'}
+          </Alert>
+        )}
+
+        {schemaQuery.data && (
+          <SchemaFormRenderer
+            sections={filteredSections}
+            onSubmit={handleSubmit}
+            submitLabel="Execute"
+            loading={executionMutation.isPending}
+            submitError={submitError}
+          />
+        )}
+
+        {currentTaskId !== null && (
+          <Box sx={{ mt: 2 }}>
+            <Divider sx={{ mb: 2 }} />
+            <TaskLogViewer taskHistoryId={currentTaskId} />
+          </Box>
+        )}
+
+        {showHistory && (
+          <>
+            <Divider sx={{ my: 3 }} />
+            <Typography variant="h6" sx={{ mb: 1 }}>
+              Execution history
+            </Typography>
+            {historyQuery.error ? (
+              <Alert severity="error">
+                Failed to load execution history: {historyQuery.error.message}
+              </Alert>
+            ) : (
+              <TaskHistoryTable
+                data={historyQuery.data?.items ?? []}
+                isLoading={historyQuery.isLoading}
+                hideTaskNameColumn
+                onViewLogs={setLogsEntry}
+                onStopTask={(entry) => {
+                  if (entry.id !== null && entry.id !== undefined) {
+                    // This accordion's history is keyed under
+                    // ['snippets', filename, 'history'] and does not poll, so the
+                    // stop hook's ['task-history'] invalidation never reaches it;
+                    // refetch this query directly once the stop succeeds.
+                    stop.mutate(entry.id, {
+                      onSuccess: () => {
+                        historyQuery.refetch();
+                      },
+                    });
+                  }
+                }}
+                isStopping={stop.isPending}
+              />
+            )}
+          </>
+        )}
+      </AccordionDetails>
+
+      <Dialog
+        open={logsEntry !== null}
+        onClose={() => setLogsEntry(null)}
+        fullWidth
+        maxWidth="lg"
+        aria-labelledby="snippet-task-logs-title"
+      >
+        <DialogTitle
+          id="snippet-task-logs-title"
+          sx={{
+            display: 'flex',
+            alignItems: 'center',
+            justifyContent: 'space-between',
+          }}
+        >
+          <span>
+            Task logs
+            {logsEntry?.task?.name ? ` - ${logsEntry.task.name}` : ''}
+            {logsEntry?.id !== null && logsEntry?.id !== undefined
+              ? ` #${logsEntry.id}`
+              : ''}
+          </span>
+          <IconButton
+            aria-label="Close logs dialog"
+            onClick={() => setLogsEntry(null)}
+            size="small"
+          >
+            <CloseIcon fontSize="small" />
+          </IconButton>
+        </DialogTitle>
+        <DialogContent dividers sx={{ p: 0 }}>
+          {logsEntry?.id !== null && logsEntry?.id !== undefined ? (
+            <TaskLogViewer
+              taskHistoryId={logsEntry.id}
+              taskStatus={logsEntry.status}
+              height={520}
+            />
+          ) : null}
+        </DialogContent>
+      </Dialog>
+    </Accordion>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/SnippetExecutionAccordion/index.ts b/ui/packages/sep/framework/src/components/SnippetExecutionAccordion/index.ts
new file mode 100644
index 00000000000..a8270ce4f8f
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/SnippetExecutionAccordion/index.ts
@@ -0,0 +1,19 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { SnippetExecutionAccordion } from './SnippetExecutionAccordion';
+export type { SnippetExecutionAccordionProps } from './SnippetExecutionAccordion';
diff --git a/ui/packages/sep/framework/src/components/TableSelector/TableSelector.test.tsx b/ui/packages/sep/framework/src/components/TableSelector/TableSelector.test.tsx
new file mode 100644
index 00000000000..27b6837abfe
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TableSelector/TableSelector.test.tsx
@@ -0,0 +1,376 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { act, render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { FormProvider, useForm } from 'react-hook-form';
+import type { PropsWithChildren } from 'react';
+import { TableSelector } from './TableSelector';
+import type { SchemaOption } from '../../hooks/useSchemas';
+import type { TableOption } from '../../hooks/useTables';
+
+vi.mock('@sep/api', () => ({
+  apiClient: { get: vi.fn(), post: vi.fn() },
+}));
+import { apiClient } from '@sep/api';
+const mocked = apiClient as unknown as { get: ReturnType<typeof vi.fn> };
+
+function makeClient() {
+  return new QueryClient({
+    defaultOptions: { queries: { retry: false, gcTime: 0, staleTime: 0 } },
+  });
+}
+
+interface FormShape {
+  schema: SchemaOption | null;
+  table: TableOption | null;
+}
+
+function Wrapper({
+  children,
+  client,
+}: PropsWithChildren<{ client: QueryClient }>) {
+  return <QueryClientProvider client={client}>{children}</QueryClientProvider>;
+}
+
+function Harness({ initialSchema }: { initialSchema: SchemaOption | null }) {
+  const methods = useForm<FormShape>({
+    defaultValues: { schema: initialSchema, table: null },
+  });
+  return (
+    <FormProvider {...methods}>
+      <TableSelector name="table" label="Table" dependsOn="schema" />
+    </FormProvider>
+  );
+}
+
+describe('TableSelector', () => {
+  beforeEach(() => {
+    mocked.get.mockReset();
+  });
+
+  it('disabled with no schema', () => {
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <Harness initialSchema={null} />
+      </Wrapper>
+    );
+    expect(screen.getByLabelText('Table')).toBeDisabled();
+    expect(screen.getByText('Select a schema first')).toBeInTheDocument();
+    expect(mocked.get).not.toHaveBeenCalled();
+  });
+
+  it('fetches tables when schema set', async () => {
+    mocked.get.mockResolvedValueOnce({
+      data: [
+        { id: 100, name: 'users' },
+        { id: 101, name: 'orders' },
+      ],
+    });
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <Harness initialSchema={{ id: 42, name: 'app_prod' }} />
+      </Wrapper>
+    );
+    await waitFor(() =>
+      expect(mocked.get).toHaveBeenCalledWith('/sep/schemas/42/tables')
+    );
+  });
+
+  it('resets value when parent schema changes', async () => {
+    mocked.get.mockResolvedValue({ data: [{ id: 1, name: 't' }] });
+    const client = makeClient();
+    let setSchema!: (s: SchemaOption | null) => void;
+
+    function Probe() {
+      const methods = useForm<FormShape>({
+        defaultValues: {
+          schema: { id: 1, name: 's' },
+          table: { id: 9, name: 'pre' },
+        },
+      });
+      setSchema = (s) => methods.setValue('schema', s);
+      return (
+        <FormProvider {...methods}>
+          <TableSelector name="table" label="Table" dependsOn="schema" />
+          <output data-testid="table-value">
+            {JSON.stringify(methods.watch('table'))}
+          </output>
+        </FormProvider>
+      );
+    }
+
+    render(
+      <Wrapper client={client}>
+        <Probe />
+      </Wrapper>
+    );
+
+    expect(screen.getByTestId('table-value').textContent).toContain('pre');
+
+    await act(async () => {
+      setSchema({ id: 2, name: 's2' });
+    });
+
+    await waitFor(() => {
+      expect(screen.getByTestId('table-value').textContent).toBe('null');
+    });
+  });
+
+  it('renders error state', async () => {
+    mocked.get.mockRejectedValueOnce(new Error('tables down'));
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <Harness initialSchema={{ id: 1, name: 's' }} />
+      </Wrapper>
+    );
+    await screen.findByText('tables down');
+  });
+
+  it('renders empty state', async () => {
+    mocked.get.mockResolvedValueOnce({ data: [] });
+    const client = makeClient();
+    render(
+      <Wrapper client={client}>
+        <Harness initialSchema={{ id: 1, name: 's' }} />
+      </Wrapper>
+    );
+    await screen.findByText('No tables in this schema');
+  });
+
+  describe('allow_custom (free-solo)', () => {
+    // The allow_custom path commits `number | string | null`, not a `TableOption`.
+    interface CustomFormShape {
+      schema: SchemaOption | null;
+      table: number | string | null;
+    }
+
+    function CustomProbe() {
+      const methods = useForm<CustomFormShape>({
+        defaultValues: { schema: { id: 42, name: 'app_prod' }, table: null },
+      });
+      return (
+        <FormProvider {...methods}>
+          <TableSelector
+            name="table"
+            label="Table"
+            dependsOn="schema"
+            allowCustom
+          />
+          <output data-testid="table-value">
+            {JSON.stringify(methods.watch('table'))}
+          </output>
+        </FormProvider>
+      );
+    }
+
+    const value = () => screen.getByTestId('table-value').textContent;
+
+    it('commits the inventory id when a table is picked', async () => {
+      mocked.get.mockResolvedValue({
+        data: [
+          { id: 100, name: 'users' },
+          { id: 101, name: 'orders' },
+        ],
+      });
+      const client = makeClient();
+      const user = userEvent.setup();
+      render(
+        <Wrapper client={client}>
+          <CustomProbe />
+        </Wrapper>
+      );
+      await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+      await user.click(screen.getByLabelText('Table'));
+      await user.click(await screen.findByText('orders'));
+      expect(value()).toBe('101');
+    });
+
+    it('commits a typed value as a string', async () => {
+      mocked.get.mockResolvedValue({ data: [{ id: 100, name: 'users' }] });
+      const client = makeClient();
+      const user = userEvent.setup();
+      render(
+        <Wrapper client={client}>
+          <CustomProbe />
+        </Wrapper>
+      );
+      await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+      await user.type(screen.getByLabelText('Table'), 'manual_table');
+      expect(value()).toBe('"manual_table"');
+    });
+
+    it('resolves a typed value matching an existing table to its id', async () => {
+      mocked.get.mockResolvedValue({ data: [{ id: 100, name: 'users' }] });
+      const client = makeClient();
+      const user = userEvent.setup();
+      render(
+        <Wrapper client={client}>
+          <CustomProbe />
+        </Wrapper>
+      );
+      await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+      await user.type(screen.getByLabelText('Table'), 'users');
+      expect(value()).toBe('100');
+    });
+
+    it('stays enabled and accepts a typed value when the parent schema is custom', async () => {
+      const client = makeClient();
+      const user = userEvent.setup();
+      function CascadeProbe() {
+        // Parent schema holds a free-typed (custom) string, not an inventory id.
+        const methods = useForm<{ schema: unknown; table: unknown }>({
+          defaultValues: { schema: 'custom_schema', table: null },
+        });
+        return (
+          <FormProvider {...methods}>
+            <TableSelector
+              name="table"
+              label="Table"
+              dependsOn="schema"
+              allowCustom
+            />
+            <output data-testid="table-value">
+              {JSON.stringify(methods.watch('table'))}
+            </output>
+          </FormProvider>
+        );
+      }
+      render(
+        <Wrapper client={client}>
+          <CascadeProbe />
+        </Wrapper>
+      );
+      const input = screen.getByLabelText('Table');
+      expect(input).not.toBeDisabled();
+      // No schema id means no table fetch is issued.
+      expect(mocked.get).not.toHaveBeenCalled();
+      await user.type(input, 'custom_table');
+      expect(screen.getByTestId('table-value').textContent).toBe(
+        '"custom_table"'
+      );
+    });
+
+    it('treats a numeric custom parent string as custom (not an inventory id)', async () => {
+      const client = makeClient();
+      const user = userEvent.setup();
+      function NumericCustomParentProbe() {
+        const methods = useForm<{ schema: unknown; table: unknown }>({
+          defaultValues: { schema: '42', table: null },
+        });
+        return (
+          <FormProvider {...methods}>
+            <TableSelector
+              name="table"
+              label="Table"
+              dependsOn="schema"
+              allowCustom
+            />
+            <output data-testid="table-value">
+              {JSON.stringify(methods.watch('table'))}
+            </output>
+          </FormProvider>
+        );
+      }
+      render(
+        <Wrapper client={client}>
+          <NumericCustomParentProbe />
+        </Wrapper>
+      );
+      const input = screen.getByLabelText('Table');
+      expect(input).not.toBeDisabled();
+      expect(mocked.get).not.toHaveBeenCalled();
+      await user.type(input, 'custom_table');
+      expect(screen.getByTestId('table-value').textContent).toBe(
+        '"custom_table"'
+      );
+    });
+
+    it('clears child value when parent custom value changes', async () => {
+      const client = makeClient();
+      const setSchemaRef: { current: ((value: unknown) => void) | null } = {
+        current: null,
+      };
+      function CustomParentChangeProbe() {
+        const methods = useForm<{ schema: unknown; table: unknown }>({
+          defaultValues: { schema: 'custom-schema-a', table: 'child-table' },
+        });
+        setSchemaRef.current = (value) => methods.setValue('schema', value);
+        return (
+          <FormProvider {...methods}>
+            <TableSelector
+              name="table"
+              label="Table"
+              dependsOn="schema"
+              allowCustom
+            />
+            <output data-testid="table-value">
+              {JSON.stringify(methods.watch('table'))}
+            </output>
+          </FormProvider>
+        );
+      }
+      render(
+        <Wrapper client={client}>
+          <CustomParentChangeProbe />
+        </Wrapper>
+      );
+      expect(screen.getByTestId('table-value').textContent).toBe(
+        '"child-table"'
+      );
+      await act(async () => {
+        setSchemaRef.current?.('custom-schema-b');
+      });
+      await waitFor(() => {
+        expect(screen.getByTestId('table-value').textContent).toBe('null');
+      });
+      expect(mocked.get).not.toHaveBeenCalled();
+    });
+  });
+
+  it('back-compat: without allowCustom a typed value is not committed', async () => {
+    mocked.get.mockResolvedValue({ data: [{ id: 100, name: 'users' }] });
+    const client = makeClient();
+    const user = userEvent.setup();
+    function Probe() {
+      const methods = useForm<FormShape>({
+        defaultValues: { schema: { id: 42, name: 'app_prod' }, table: null },
+      });
+      return (
+        <FormProvider {...methods}>
+          <TableSelector name="table" label="Table" dependsOn="schema" />
+          <output data-testid="bc-value">
+            {JSON.stringify(methods.watch('table'))}
+          </output>
+        </FormProvider>
+      );
+    }
+    render(
+      <Wrapper client={client}>
+        <Probe />
+      </Wrapper>
+    );
+    await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+    await user.type(screen.getByLabelText('Table'), 'manual_table');
+    expect(screen.getByTestId('bc-value').textContent).toBe('null');
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/TableSelector/TableSelector.tsx b/ui/packages/sep/framework/src/components/TableSelector/TableSelector.tsx
new file mode 100644
index 00000000000..7d26c0bcbd5
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TableSelector/TableSelector.tsx
@@ -0,0 +1,163 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useEffect, useRef } from 'react';
+import { useFormContext, useWatch } from 'react-hook-form';
+import { AutoCompleteInput } from '@percona/percona-ui';
+import { useTables, type TableOption } from '../../hooks/useTables';
+import type { SchemaOption } from '../../hooks/useSchemas';
+import { extractId } from '../../utils/extractId';
+import { FreeSoloSelect } from '../FreeSoloSelect';
+
+const EMPTY_OPTIONS: TableOption[] = [];
+
+export interface TableSelectorProps {
+  /**
+   * react-hook-form field name. Without `allowCustom`, stores a
+   * `TableOption | null`; with `allowCustom`, stores the committed
+   * `number | string | null` (inventory id, free-typed value, or unset).
+   */
+  name: string;
+  label: string;
+  required?: boolean;
+  /**
+   * Form field name of the parent `SchemaSelector`. The watched value is
+   * either a `SchemaOption` or a raw schema id.
+   */
+  dependsOn: string;
+  disabled?: boolean;
+  /** Offer free-text (free-solo) entry alongside the inventory options. */
+  allowCustom?: boolean;
+}
+
+const getOptionLabel = (opt: TableOption | string) =>
+  typeof opt === 'string' ? opt : opt.name;
+const getOptionName = (opt: TableOption) => opt.name;
+
+const isOptionEqualToValue = (a: TableOption, b: TableOption) => a.id === b.id;
+
+export function TableSelector({
+  name,
+  label,
+  required,
+  dependsOn,
+  disabled,
+  allowCustom,
+}: TableSelectorProps) {
+  const { control, setValue } = useFormContext();
+
+  const parent = useWatch({ control, name: dependsOn }) as
+    | SchemaOption
+    | number
+    | string
+    | null
+    | undefined;
+  const parentText = typeof parent === 'string' ? parent.trim() : '';
+  const parentIsCustom = Boolean(allowCustom) && parentText !== '';
+  const schemaId = parentIsCustom ? null : extractId(parent);
+  // A parent that resolves to no inventory id but holds a non-empty string is a
+  // free-typed (custom) parent value, not an absent one. A free-solo child can
+  // still accept a typed value in that case (it just has no options to offer).
+  const parentResetKey = parentIsCustom
+    ? `custom:${parentText}`
+    : `id:${schemaId ?? 'none'}`;
+
+  const prevParentKeyRef = useRef(parentResetKey);
+  useEffect(() => {
+    if (prevParentKeyRef.current !== parentResetKey) {
+      prevParentKeyRef.current = parentResetKey;
+      setValue(name, null, { shouldDirty: true, shouldValidate: false });
+    }
+  }, [parentResetKey, name, setValue]);
+
+  const {
+    data: tables = EMPTY_OPTIONS,
+    isLoading,
+    isError,
+    error,
+  } = useTables({ schemaId });
+
+  const noSchema = schemaId === null || schemaId === undefined;
+  const empty = !noSchema && !isLoading && !isError && tables.length === 0;
+
+  const helperText = noSchema
+    ? 'Select a schema first'
+    : isError
+      ? (error?.message ?? 'Failed to load tables')
+      : empty
+        ? 'No tables in this schema'
+        : undefined;
+
+  if (allowCustom) {
+    // Only a truly absent parent disables the control; a custom (free-typed)
+    // parent keeps it enabled so the user can type a custom table too.
+    const parentMissing = noSchema && !parentIsCustom;
+    return (
+      <FreeSoloSelect<TableOption>
+        name={name}
+        label={label}
+        options={tables}
+        getOptionLabel={getOptionName}
+        required={required}
+        disabled={disabled || parentMissing || isError}
+        loading={isLoading}
+        helperText={
+          parentMissing
+            ? 'Select a schema first'
+            : isError
+              ? helperText
+              : undefined
+        }
+        error={isError}
+        noOptionsText={
+          parentMissing
+            ? 'Select a schema first'
+            : parentIsCustom
+              ? 'Custom schema — type a table name'
+              : isLoading
+                ? 'Loading tables…'
+                : 'No tables in this schema'
+        }
+      />
+    );
+  }
+
+  return (
+    <AutoCompleteInput<TableOption>
+      name={name}
+      label={label}
+      control={control}
+      isRequired={required}
+      loading={isLoading}
+      disabled={disabled || noSchema || isError}
+      options={tables}
+      controllerProps={{
+        rules: required ? { required: `${label} is required` } : undefined,
+      }}
+      autoCompleteProps={{
+        getOptionLabel,
+        isOptionEqualToValue,
+        noOptionsText: noSchema
+          ? 'Select a schema first'
+          : isLoading
+            ? 'Loading tables…'
+            : 'No tables in this schema',
+      }}
+      textFieldProps={{ helperText, error: isError }}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/TableSelector/index.ts b/ui/packages/sep/framework/src/components/TableSelector/index.ts
new file mode 100644
index 00000000000..e7fe20dbd3e
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TableSelector/index.ts
@@ -0,0 +1,19 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { TableSelector } from './TableSelector';
+export type { TableSelectorProps } from './TableSelector';
diff --git a/ui/packages/sep/framework/src/components/TaskHistoryTable/ChainDisplay.tsx b/ui/packages/sep/framework/src/components/TaskHistoryTable/ChainDisplay.tsx
new file mode 100644
index 00000000000..a954d0d3728
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TaskHistoryTable/ChainDisplay.tsx
@@ -0,0 +1,89 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import LinkIcon from '@mui/icons-material/Link';
+import Box from '@mui/material/Box';
+import Chip from '@mui/material/Chip';
+import Tooltip from '@mui/material/Tooltip';
+import Typography from '@mui/material/Typography';
+
+export interface ChainDisplayProps {
+  chainNames?: readonly string[] | null;
+  /** When chainNames is empty but the task is part of a chain, depth > 0 renders a fallback link icon. */
+  chainDepth?: number | null;
+  onChainItemClick?: (name: string, index: number) => void;
+}
+
+export function ChainDisplay({
+  chainNames,
+  chainDepth,
+  onChainItemClick,
+}: ChainDisplayProps) {
+  if (chainNames && chainNames.length > 0) {
+    return (
+      <Box
+        component="span"
+        sx={{
+          display: 'inline-flex',
+          alignItems: 'center',
+          flexWrap: 'wrap',
+          gap: 0.5,
+        }}
+        data-testid="chain-display"
+      >
+        {chainNames.map((name, index) => (
+          <Box
+            key={`${name}-${index}`}
+            component="span"
+            sx={{ display: 'inline-flex', alignItems: 'center', gap: 0.5 }}
+          >
+            <Chip
+              size="small"
+              label={name}
+              variant="outlined"
+              clickable={!!onChainItemClick}
+              onClick={
+                onChainItemClick
+                  ? () => onChainItemClick(name, index)
+                  : undefined
+              }
+            />
+            {index < chainNames.length - 1 && (
+              <Typography component="span" variant="body2" aria-hidden>
+                →
+              </Typography>
+            )}
+          </Box>
+        ))}
+      </Box>
+    );
+  }
+
+  if (typeof chainDepth === 'number' && chainDepth > 0) {
+    return (
+      <Tooltip title={`Chained task (depth: ${chainDepth})`}>
+        <LinkIcon fontSize="small" data-testid="chain-depth-icon" />
+      </Tooltip>
+    );
+  }
+
+  return (
+    <Typography component="span" variant="body2" color="text.secondary">
+      —
+    </Typography>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/TaskHistoryTable/StatusBadge.tsx b/ui/packages/sep/framework/src/components/TaskHistoryTable/StatusBadge.tsx
new file mode 100644
index 00000000000..19a67a97155
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TaskHistoryTable/StatusBadge.tsx
@@ -0,0 +1,98 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { keyframes } from '@emotion/react';
+import AutorenewIcon from '@mui/icons-material/Autorenew';
+import CancelIcon from '@mui/icons-material/Cancel';
+import CheckCircleIcon from '@mui/icons-material/CheckCircle';
+import HelpOutlineIcon from '@mui/icons-material/HelpOutline';
+import HourglassEmptyIcon from '@mui/icons-material/HourglassEmpty';
+import HourglassDisabledIcon from '@mui/icons-material/HourglassDisabled';
+import ReportIcon from '@mui/icons-material/Report';
+import Chip from '@mui/material/Chip';
+import type { TaskHistoryStatus } from '../../hooks/useTaskHistory';
+
+const spin = keyframes`
+  from { transform: rotate(0deg); }
+  to { transform: rotate(360deg); }
+`;
+
+const spinningIconSx = {
+  '& .MuiChip-icon': {
+    animation: `${spin} 1.4s linear infinite`,
+  },
+} as const;
+
+type ChipColor = 'success' | 'error' | 'warning' | 'info' | 'default';
+
+interface StatusEntry {
+  label: string;
+  color: ChipColor;
+  icon: React.ReactElement;
+  spin?: boolean;
+}
+
+const STATUS_MAP: Record<TaskHistoryStatus, StatusEntry> = {
+  success: { label: 'Done', color: 'success', icon: <CheckCircleIcon /> },
+  failed: { label: 'Failed', color: 'error', icon: <ReportIcon /> },
+  running: {
+    label: 'Running',
+    color: 'info',
+    icon: <AutorenewIcon />,
+    spin: true,
+  },
+  pending: { label: 'Pending', color: 'default', icon: <HourglassEmptyIcon /> },
+  stopped: { label: 'Stopped', color: 'warning', icon: <CancelIcon /> },
+  lost: { label: 'Lost', color: 'default', icon: <HelpOutlineIcon /> },
+  stale: { label: 'Stale', color: 'default', icon: <HourglassDisabledIcon /> },
+};
+
+/**
+ * Narrow an arbitrary value to a {@link TaskHistoryStatus}.
+ *
+ * `STATUS_MAP` is the source of truth for the recognized statuses, so call
+ * sites that receive loosely-typed values (`unknown` list cells, `task.status`
+ * guarded only by `typeof === 'string'`) can validate before handing the value
+ * to {@link StatusBadge}, which would otherwise index `STATUS_MAP` with an
+ * unrecognized key.
+ */
+export function isTaskHistoryStatus(
+  value: unknown
+): value is TaskHistoryStatus {
+  return (
+    typeof value === 'string' &&
+    Object.prototype.hasOwnProperty.call(STATUS_MAP, value)
+  );
+}
+
+export interface StatusBadgeProps {
+  status: TaskHistoryStatus;
+}
+
+export function StatusBadge({ status }: StatusBadgeProps) {
+  const entry = STATUS_MAP[status];
+  return (
+    <Chip
+      size="small"
+      color={entry.color}
+      icon={entry.icon}
+      label={entry.label}
+      data-status={status}
+      sx={entry.spin ? spinningIconSx : undefined}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/TaskHistoryTable/TaskFilesDialog.test.tsx b/ui/packages/sep/framework/src/components/TaskHistoryTable/TaskFilesDialog.test.tsx
new file mode 100644
index 00000000000..84ef3a3fd2f
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TaskHistoryTable/TaskFilesDialog.test.tsx
@@ -0,0 +1,310 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { render, screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import type { PropsWithChildren } from 'react';
+import { TaskFilesDialog } from './TaskFilesDialog';
+
+vi.mock('@sep/api', () => ({
+  apiClient: {
+    get: vi.fn(),
+  },
+}));
+
+import { apiClient } from '@sep/api';
+
+const mockedApiClient = apiClient as unknown as {
+  get: ReturnType<typeof vi.fn>;
+};
+
+function makeQueryClient() {
+  return new QueryClient({
+    defaultOptions: { queries: { retry: false, gcTime: 0, staleTime: 0 } },
+  });
+}
+
+function Wrapper({
+  children,
+  client,
+}: PropsWithChildren<{ client: QueryClient }>) {
+  return <QueryClientProvider client={client}>{children}</QueryClientProvider>;
+}
+
+const FILE_LIST = {
+  'output/result.txt': { size: 1024, is_dir: false },
+  'output/logs/': { size: 0, is_dir: true },
+};
+
+describe('TaskFilesDialog', () => {
+  beforeEach(() => {
+    mockedApiClient.get.mockReset();
+    vi.spyOn(URL, 'createObjectURL').mockReturnValue('blob:mock');
+    vi.spyOn(URL, 'revokeObjectURL').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('does not render content when closed', () => {
+    const client = makeQueryClient();
+    render(
+      <Wrapper client={client}>
+        <TaskFilesDialog open={false} taskHistoryId={1} onClose={vi.fn()} />
+      </Wrapper>
+    );
+    expect(screen.queryByRole('dialog')).not.toBeInTheDocument();
+  });
+
+  it('shows loading spinner while fetching', () => {
+    mockedApiClient.get.mockImplementation(() => new Promise(() => {}));
+    const client = makeQueryClient();
+    render(
+      <Wrapper client={client}>
+        <TaskFilesDialog open taskHistoryId={1} onClose={vi.fn()} />
+      </Wrapper>
+    );
+    expect(screen.getByRole('progressbar')).toBeInTheDocument();
+  });
+
+  it('renders file rows after fetch', async () => {
+    mockedApiClient.get.mockResolvedValue({ data: FILE_LIST });
+    const client = makeQueryClient();
+    render(
+      <Wrapper client={client}>
+        <TaskFilesDialog open taskHistoryId={1} onClose={vi.fn()} />
+      </Wrapper>
+    );
+    await waitFor(() =>
+      expect(screen.getByText('result.txt')).toBeInTheDocument()
+    );
+    expect(screen.getByText('1.0 KB')).toBeInTheDocument();
+    expect(screen.getByText('logs')).toBeInTheDocument();
+    expect(screen.getByText('Folder')).toBeInTheDocument();
+    // Verify the list request escapes the default /api base URL so it hits /files/{id}
+    expect(mockedApiClient.get).toHaveBeenCalledWith(
+      '/files/1',
+      expect.objectContaining({ baseURL: '' })
+    );
+  });
+
+  it('shows empty state when file list is empty', async () => {
+    mockedApiClient.get.mockResolvedValue({ data: {} });
+    const client = makeQueryClient();
+    render(
+      <Wrapper client={client}>
+        <TaskFilesDialog open taskHistoryId={1} onClose={vi.fn()} />
+      </Wrapper>
+    );
+    await waitFor(() =>
+      expect(screen.getByText(/No files available/i)).toBeInTheDocument()
+    );
+  });
+
+  it('shows error alert when fetch fails', async () => {
+    mockedApiClient.get.mockRejectedValue(new Error('Network Error'));
+    const client = makeQueryClient();
+    render(
+      <Wrapper client={client}>
+        <TaskFilesDialog open taskHistoryId={1} onClose={vi.fn()} />
+      </Wrapper>
+    );
+    await waitFor(() =>
+      expect(screen.getByText(/Failed to load file list/i)).toBeInTheDocument()
+    );
+  });
+
+  it('calls onClose when dialog is dismissed', async () => {
+    mockedApiClient.get.mockResolvedValue({ data: FILE_LIST });
+    const onClose = vi.fn();
+    const client = makeQueryClient();
+    render(
+      <Wrapper client={client}>
+        <TaskFilesDialog open taskHistoryId={1} onClose={onClose} />
+      </Wrapper>
+    );
+    await waitFor(() =>
+      expect(screen.getByText('result.txt')).toBeInTheDocument()
+    );
+    await userEvent.keyboard('{Escape}');
+    expect(onClose).toHaveBeenCalled();
+  });
+
+  it('fires download mutation with correct path for a file', async () => {
+    mockedApiClient.get
+      .mockResolvedValueOnce({ data: FILE_LIST })
+      .mockResolvedValueOnce({ data: new Blob(['content']) });
+
+    const client = makeQueryClient();
+    render(
+      <Wrapper client={client}>
+        <TaskFilesDialog open taskHistoryId={42} onClose={vi.fn()} />
+      </Wrapper>
+    );
+
+    await waitFor(() =>
+      expect(screen.getByText('result.txt')).toBeInTheDocument()
+    );
+
+    const dialog = screen.getByRole('dialog');
+    await userEvent.click(
+      within(dialog).getByRole('button', { name: 'Download output/result.txt' })
+    );
+
+    await waitFor(() =>
+      expect(mockedApiClient.get).toHaveBeenCalledWith(
+        '/files/42/download',
+        expect.objectContaining({
+          baseURL: '',
+          params: { path: 'output/result.txt' },
+          responseType: 'blob',
+        })
+      )
+    );
+  });
+
+  it('fires download mutation with .tar.gz name for a directory', async () => {
+    mockedApiClient.get
+      .mockResolvedValueOnce({ data: FILE_LIST })
+      .mockResolvedValueOnce({ data: new Blob(['archive']) });
+
+    const capture = { anchor: null as HTMLAnchorElement | null };
+    const origCreate = document.createElement.bind(document);
+    vi.spyOn(document, 'createElement').mockImplementation((tag: string) => {
+      const el = origCreate(tag);
+      if (tag === 'a') {
+        capture.anchor = el as HTMLAnchorElement;
+      }
+      return el;
+    });
+
+    const client = makeQueryClient();
+    render(
+      <Wrapper client={client}>
+        <TaskFilesDialog open taskHistoryId={42} onClose={vi.fn()} />
+      </Wrapper>
+    );
+
+    await waitFor(() => expect(screen.getByText('logs')).toBeInTheDocument());
+
+    const dialog = screen.getByRole('dialog');
+    await userEvent.click(
+      within(dialog).getByRole('button', { name: 'Download output/logs/' })
+    );
+
+    await waitFor(() =>
+      expect(mockedApiClient.get).toHaveBeenCalledWith(
+        '/files/42/download',
+        expect.objectContaining({
+          baseURL: '',
+          params: { path: 'output/logs/' },
+          responseType: 'blob',
+        })
+      )
+    );
+    expect(capture.anchor?.download).toBe('logs.tar.gz');
+  });
+
+  it('uses full path in aria-label to disambiguate files with the same basename', async () => {
+    const data = {
+      'stdout/report.txt': { size: 100, is_dir: false },
+      'stderr/report.txt': { size: 200, is_dir: false },
+    };
+    mockedApiClient.get.mockResolvedValue({ data });
+    const client = makeQueryClient();
+    render(
+      <Wrapper client={client}>
+        <TaskFilesDialog open taskHistoryId={1} onClose={vi.fn()} />
+      </Wrapper>
+    );
+    await waitFor(() =>
+      expect(screen.getAllByText('report.txt')).toHaveLength(2)
+    );
+    expect(
+      screen.getByRole('button', { name: 'Download stdout/report.txt' })
+    ).toBeInTheDocument();
+    expect(
+      screen.getByRole('button', { name: 'Download stderr/report.txt' })
+    ).toBeInTheDocument();
+  });
+
+  it('disables all download buttons while a download is in flight', async () => {
+    let resolveDownload!: () => void;
+    mockedApiClient.get
+      .mockResolvedValueOnce({ data: FILE_LIST })
+      .mockImplementationOnce(
+        () =>
+          new Promise<{ data: Blob }>((res) => {
+            resolveDownload = () => res({ data: new Blob(['x']) });
+          })
+      );
+
+    const client = makeQueryClient();
+    render(
+      <Wrapper client={client}>
+        <TaskFilesDialog open taskHistoryId={1} onClose={vi.fn()} />
+      </Wrapper>
+    );
+
+    await waitFor(() =>
+      expect(screen.getByText('result.txt')).toBeInTheDocument()
+    );
+
+    const dialog = screen.getByRole('dialog');
+    await userEvent.click(
+      within(dialog).getByRole('button', { name: 'Download output/result.txt' })
+    );
+
+    // All buttons disabled while download is pending
+    await waitFor(() =>
+      screen.getAllByRole('button', { name: /^Download/ }).forEach((btn) => {
+        expect(btn).toBeDisabled();
+      })
+    );
+
+    resolveDownload();
+  });
+
+  it('shows inline error alert on download failure', async () => {
+    mockedApiClient.get
+      .mockResolvedValueOnce({ data: FILE_LIST })
+      .mockRejectedValueOnce(new Error('Server error'));
+
+    const client = makeQueryClient();
+    render(
+      <Wrapper client={client}>
+        <TaskFilesDialog open taskHistoryId={1} onClose={vi.fn()} />
+      </Wrapper>
+    );
+
+    await waitFor(() =>
+      expect(screen.getByText('result.txt')).toBeInTheDocument()
+    );
+
+    const dialog = screen.getByRole('dialog');
+    await userEvent.click(
+      within(dialog).getByRole('button', { name: 'Download output/result.txt' })
+    );
+
+    await waitFor(() =>
+      expect(within(dialog).getByText('Server error')).toBeInTheDocument()
+    );
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/TaskHistoryTable/TaskFilesDialog.tsx b/ui/packages/sep/framework/src/components/TaskHistoryTable/TaskFilesDialog.tsx
new file mode 100644
index 00000000000..8c80f79aa8d
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TaskHistoryTable/TaskFilesDialog.tsx
@@ -0,0 +1,169 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useEffect } from 'react';
+import DownloadIcon from '@mui/icons-material/Download';
+import Alert from '@mui/material/Alert';
+import Box from '@mui/material/Box';
+import CircularProgress from '@mui/material/CircularProgress';
+import Dialog from '@mui/material/Dialog';
+import DialogContent from '@mui/material/DialogContent';
+import DialogTitle from '@mui/material/DialogTitle';
+import IconButton from '@mui/material/IconButton';
+import Table from '@mui/material/Table';
+import TableBody from '@mui/material/TableBody';
+import TableCell from '@mui/material/TableCell';
+import TableHead from '@mui/material/TableHead';
+import TableRow from '@mui/material/TableRow';
+import Tooltip from '@mui/material/Tooltip';
+import Typography from '@mui/material/Typography';
+import { useTaskHistoryFiles } from '../../hooks/useTaskHistoryFiles';
+import { useTaskFileDownload } from '../../hooks/useTaskFileDownload';
+
+function formatSize(size: number): string {
+  if (size === 0) {
+    return '0 B';
+  }
+  const units = ['B', 'KB', 'MB', 'GB'];
+  const i = Math.min(
+    Math.floor(Math.log(size) / Math.log(1024)),
+    units.length - 1
+  );
+  return `${(size / 1024 ** i).toFixed(1)} ${units[i]}`;
+}
+
+function basename(path: string): string {
+  return path.split('/').filter(Boolean).pop() ?? path;
+}
+
+export interface TaskFilesDialogProps {
+  open: boolean;
+  taskHistoryId: number | null | undefined;
+  onClose: () => void;
+}
+
+export function TaskFilesDialog({
+  open,
+  taskHistoryId,
+  onClose,
+}: TaskFilesDialogProps) {
+  const { data, isLoading, isError } = useTaskHistoryFiles(
+    open ? taskHistoryId : null
+  );
+  const downloadMutation = useTaskFileDownload();
+  const { reset: resetMutation } = downloadMutation;
+
+  useEffect(() => {
+    if (!open) {
+      resetMutation();
+    }
+  }, [open, resetMutation]);
+
+  const entries = data ? Object.entries(data) : [];
+
+  function handleDownload(path: string, isDir: boolean) {
+    if (taskHistoryId === null || taskHistoryId === undefined) {
+      return;
+    }
+    downloadMutation.mutate({ taskHistoryId, path, isDir });
+  }
+
+  const anyPending = downloadMutation.isPending;
+
+  return (
+    <Dialog
+      open={open}
+      onClose={onClose}
+      fullWidth
+      maxWidth="sm"
+      aria-labelledby="task-files-dialog-title"
+    >
+      <DialogTitle id="task-files-dialog-title">Download files</DialogTitle>
+      <DialogContent>
+        {isLoading && (
+          <Box sx={{ display: 'flex', justifyContent: 'center', py: 3 }}>
+            <CircularProgress size={32} />
+          </Box>
+        )}
+        {isError && <Alert severity="error">Failed to load file list.</Alert>}
+        {downloadMutation.error && (
+          <Alert
+            severity="error"
+            onClose={() => resetMutation()}
+            sx={{ mb: 1 }}
+          >
+            {downloadMutation.error.message || 'Download failed'}
+          </Alert>
+        )}
+        {!isLoading && !isError && entries.length === 0 && (
+          <Typography variant="body2" color="text.secondary" sx={{ py: 2 }}>
+            No files available for this task run.
+          </Typography>
+        )}
+        {!isLoading && !isError && entries.length > 0 && (
+          <Table size="small">
+            <TableHead>
+              <TableRow>
+                <TableCell>Name</TableCell>
+                <TableCell>Size</TableCell>
+                <TableCell />
+              </TableRow>
+            </TableHead>
+            <TableBody>
+              {entries.map(([path, meta]) => {
+                const name = basename(path);
+                const isThisRowDownloading =
+                  anyPending && downloadMutation.variables?.path === path;
+                return (
+                  <TableRow key={path}>
+                    <TableCell sx={{ wordBreak: 'break-all' }} title={path}>
+                      {name}
+                    </TableCell>
+                    <TableCell>
+                      {meta.is_dir ? 'Folder' : formatSize(meta.size)}
+                    </TableCell>
+                    <TableCell align="right">
+                      <Tooltip
+                        title={
+                          meta.is_dir
+                            ? `Download as ${name}.tar.gz`
+                            : 'Download'
+                        }
+                      >
+                        <span>
+                          <IconButton
+                            size="small"
+                            aria-label={`Download ${path}`}
+                            disabled={anyPending}
+                            aria-busy={isThisRowDownloading}
+                            onClick={() => handleDownload(path, meta.is_dir)}
+                          >
+                            <DownloadIcon fontSize="small" />
+                          </IconButton>
+                        </span>
+                      </Tooltip>
+                    </TableCell>
+                  </TableRow>
+                );
+              })}
+            </TableBody>
+          </Table>
+        )}
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/TaskHistoryTable/TaskHistoryTable.test.tsx b/ui/packages/sep/framework/src/components/TaskHistoryTable/TaskHistoryTable.test.tsx
new file mode 100644
index 00000000000..85086bb6877
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TaskHistoryTable/TaskHistoryTable.test.tsx
@@ -0,0 +1,579 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import {
+  render,
+  renderHook,
+  screen,
+  waitFor,
+  within,
+} from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { SnackbarProvider } from 'notistack';
+import type { PropsWithChildren } from 'react';
+import { TaskHistoryTable } from './TaskHistoryTable';
+import { StatusBadge } from './StatusBadge';
+import { useTaskHistory } from '../../hooks/useTaskHistory';
+import type {
+  TaskHistoryEntry,
+  TaskHistoryStatus,
+} from './TaskHistoryTable.types';
+
+vi.mock('@sep/api', () => {
+  const RUNNING_STATUSES = new Set(['running', 'pending']);
+  return {
+    apiClient: {
+      get: vi.fn(),
+      post: vi.fn(),
+    },
+    RUNNING_STATUSES,
+    isRunningStatus: (status: string) => RUNNING_STATUSES.has(status),
+  };
+});
+
+import { apiClient } from '@sep/api';
+
+const mockedApiClient = apiClient as unknown as {
+  get: ReturnType<typeof vi.fn>;
+  post: ReturnType<typeof vi.fn>;
+};
+
+function makeEntry(
+  id: number,
+  status: TaskHistoryStatus,
+  overrides: Omit<Partial<TaskHistoryEntry>, 'task'> & {
+    task?: Partial<TaskHistoryEntry['task']>;
+  } = {}
+): TaskHistoryEntry {
+  const { task: taskOverride, ...rest } = overrides;
+  return {
+    id,
+    status,
+    display_name: `task-${id}`,
+    started_at: new Date(Date.UTC(2026, 0, 1, 0, id)).toISOString(),
+    finished_at:
+      status === 'running' || status === 'pending'
+        ? null
+        : new Date(Date.UTC(2026, 0, 1, 0, id, 30)).toISOString(),
+    duration: status === 'running' || status === 'pending' ? null : 30,
+    executed_by: 'admin',
+    has_logs: true,
+    task: {
+      id,
+      name: `task-${id}`,
+      ...taskOverride,
+    } as TaskHistoryEntry['task'],
+    execution_request: {
+      task: `task-${id}`,
+      target: `host-${id}`,
+      meta: {},
+      tracking: {},
+    } as TaskHistoryEntry['execution_request'],
+    ...rest,
+  };
+}
+
+function mockFilesList(
+  filesByHistoryId: Record<
+    number,
+    Record<string, { size: number; is_dir: boolean }>
+  >
+) {
+  mockedApiClient.get.mockImplementation(async (url: string) => {
+    const match = /^\/files\/(\d+)$/.exec(url);
+    if (!match) {
+      return { data: {} };
+    }
+    const historyId = Number(match[1]);
+    return { data: filesByHistoryId[historyId] ?? {} };
+  });
+}
+
+function makeQueryClient() {
+  return new QueryClient({
+    defaultOptions: { queries: { retry: false, gcTime: 0, staleTime: 0 } },
+  });
+}
+
+function Wrapper({
+  children,
+  client,
+}: PropsWithChildren<{ client: QueryClient }>) {
+  return (
+    <QueryClientProvider client={client}>
+      <SnackbarProvider>{children}</SnackbarProvider>
+    </QueryClientProvider>
+  );
+}
+
+describe('StatusBadge', () => {
+  it.each([
+    ['success', 'Done'],
+    ['failed', 'Failed'],
+    ['running', 'Running'],
+    ['pending', 'Pending'],
+    ['stopped', 'Stopped'],
+    ['lost', 'Lost'],
+    ['stale', 'Stale'],
+  ] as const)('renders %s as %s label', (status, label) => {
+    render(<StatusBadge status={status} />);
+    expect(screen.getByText(label)).toBeInTheDocument();
+    const chip = screen.getByText(label).closest('[data-status]');
+    expect(chip).toHaveAttribute('data-status', status);
+  });
+});
+
+describe('TaskHistoryTable rendering', () => {
+  const client = makeQueryClient();
+
+  it('renders rows for provided data and shows status badges', () => {
+    const data = [
+      makeEntry(1, 'success'),
+      makeEntry(2, 'failed'),
+      makeEntry(3, 'running'),
+    ];
+    render(
+      <Wrapper client={client}>
+        <TaskHistoryTable data={data} disablePolling />
+      </Wrapper>
+    );
+
+    expect(screen.getByText('Done')).toBeInTheDocument();
+    expect(screen.getByText('Failed')).toBeInTheDocument();
+    expect(screen.getByText('Running')).toBeInTheDocument();
+    expect(screen.getByText('task-1')).toBeInTheDocument();
+    expect(screen.getByText('host-2')).toBeInTheDocument();
+  });
+
+  it('shows empty state when no rows', () => {
+    render(
+      <Wrapper client={client}>
+        <TaskHistoryTable data={[]} disablePolling />
+      </Wrapper>
+    );
+    expect(screen.getByText('No task history')).toBeInTheDocument();
+  });
+
+  it('renders chain chips with separators when meta has _chain_task_names', () => {
+    const data = [
+      makeEntry(1, 'success', {
+        execution_request: {
+          task: 't',
+          target: 'h',
+          meta: { _chain_task_names: ['a', 'b', 'c'] },
+          tracking: {},
+        } as unknown as TaskHistoryEntry['execution_request'],
+      }),
+    ];
+    render(
+      <Wrapper client={client}>
+        <TaskHistoryTable data={data} disablePolling />
+      </Wrapper>
+    );
+    const chain = screen.getByTestId('chain-display');
+    expect(within(chain).getByText('a')).toBeInTheDocument();
+    expect(within(chain).getByText('b')).toBeInTheDocument();
+    expect(within(chain).getByText('c')).toBeInTheDocument();
+    expect(within(chain).getAllByText('→')).toHaveLength(2);
+  });
+});
+
+describe('TaskHistoryTable actions', () => {
+  const client = makeQueryClient();
+
+  it('shows stop button only for running/pending rows', () => {
+    const data = [makeEntry(1, 'success'), makeEntry(2, 'running')];
+    render(
+      <Wrapper client={client}>
+        <TaskHistoryTable data={data} disablePolling />
+      </Wrapper>
+    );
+    const stopButtons = screen.queryAllByRole('button', { name: 'Stop task' });
+    expect(stopButtons).toHaveLength(1);
+  });
+
+  it('calls onViewLogs when view-logs clicked', async () => {
+    const onViewLogs = vi.fn();
+    const data = [makeEntry(1, 'success')];
+    render(
+      <Wrapper client={client}>
+        <TaskHistoryTable data={data} disablePolling onViewLogs={onViewLogs} />
+      </Wrapper>
+    );
+    await userEvent.click(screen.getByRole('button', { name: 'View logs' }));
+    expect(onViewLogs).toHaveBeenCalledOnce();
+    expect(onViewLogs.mock.calls[0][0].id).toBe(1);
+  });
+
+  it('opens confirm dialog and invokes onStopTask on Stop click', async () => {
+    const onStopTask = vi.fn();
+    const data = [makeEntry(2, 'running')];
+    render(
+      <Wrapper client={client}>
+        <TaskHistoryTable data={data} disablePolling onStopTask={onStopTask} />
+      </Wrapper>
+    );
+    await userEvent.click(screen.getByRole('button', { name: 'Stop task' }));
+    const dialog = await screen.findByRole('dialog');
+    expect(within(dialog).getByText(/Are you sure/i)).toBeInTheDocument();
+    await userEvent.click(within(dialog).getByRole('button', { name: 'Stop' }));
+    expect(onStopTask).toHaveBeenCalledOnce();
+    expect(onStopTask.mock.calls[0][0].id).toBe(2);
+  });
+
+  it('disables the Stop button when no onStopTask is provided (presentational)', () => {
+    const data = [makeEntry(2, 'running')];
+    render(
+      <Wrapper client={client}>
+        <TaskHistoryTable data={data} disablePolling />
+      </Wrapper>
+    );
+    expect(screen.getByRole('button', { name: 'Stop task' })).toBeDisabled();
+  });
+
+  it('disables the Stop button while isStopping is true (presentational)', () => {
+    const onStopTask = vi.fn();
+    const data = [makeEntry(2, 'running')];
+    render(
+      <Wrapper client={client}>
+        <TaskHistoryTable
+          data={data}
+          disablePolling
+          onStopTask={onStopTask}
+          isStopping
+        />
+      </Wrapper>
+    );
+    expect(screen.getByRole('button', { name: 'Stop task' })).toBeDisabled();
+  });
+
+  it('enables the Stop button for running rows when onStopTask is provided and not stopping', () => {
+    const onStopTask = vi.fn();
+    const data = [makeEntry(2, 'running')];
+    render(
+      <Wrapper client={client}>
+        <TaskHistoryTable data={data} disablePolling onStopTask={onStopTask} />
+      </Wrapper>
+    );
+    expect(screen.getByRole('button', { name: 'Stop task' })).toBeEnabled();
+  });
+
+  it('skips stop callback when dialog Cancel clicked', async () => {
+    const onStopTask = vi.fn();
+    const data = [makeEntry(2, 'running')];
+    render(
+      <Wrapper client={client}>
+        <TaskHistoryTable data={data} disablePolling onStopTask={onStopTask} />
+      </Wrapper>
+    );
+    await userEvent.click(screen.getByRole('button', { name: 'Stop task' }));
+    const dialog = await screen.findByRole('dialog');
+    await userEvent.click(
+      within(dialog).getByRole('button', { name: 'Cancel' })
+    );
+    expect(onStopTask).not.toHaveBeenCalled();
+  });
+
+  it('shows download button only for completed rows with downloadable files', async () => {
+    mockFilesList({
+      1: { 'output/result.txt': { size: 128, is_dir: false } },
+      2: {},
+    });
+    const data = [
+      makeEntry(1, 'success', {
+        task: { output_files_path: 'run-script/local/output_files' },
+      }),
+      makeEntry(2, 'success', {
+        task: { output_files_path: 'run-script/local/output_files' },
+      }),
+      makeEntry(3, 'running', {
+        task: { output_files_path: 'run-script/local/output_files' },
+      }),
+      makeEntry(4, 'success', { has_logs: true }),
+    ];
+    render(
+      <Wrapper client={client}>
+        <TaskHistoryTable data={data} disablePolling />
+      </Wrapper>
+    );
+    await waitFor(() => {
+      expect(
+        screen.getAllByRole('button', { name: 'Download files' })
+      ).toHaveLength(1);
+    });
+  });
+
+  it('hides download button when the files API returns an empty listing', async () => {
+    mockFilesList({ 99: {} });
+    const data = [
+      makeEntry(99, 'success', {
+        has_logs: true,
+        task: { output_files_path: 'run-script/local/output_files' },
+      }),
+    ];
+    render(
+      <Wrapper client={client}>
+        <TaskHistoryTable data={data} disablePolling />
+      </Wrapper>
+    );
+    await waitFor(() => {
+      expect(mockedApiClient.get).toHaveBeenCalledWith(
+        '/files/99',
+        expect.objectContaining({ baseURL: '' })
+      );
+    });
+    expect(
+      screen.queryByRole('button', { name: 'Download files' })
+    ).not.toBeInTheDocument();
+  });
+
+  it('opens built-in files dialog when no onDownloadFiles callback provided', async () => {
+    mockFilesList({
+      5: { 'output/result.txt': { size: 512, is_dir: false } },
+    });
+    const data = [
+      makeEntry(5, 'success', {
+        task: { output_files_path: 'run-script/local/output_files' },
+      }),
+    ];
+    render(
+      <Wrapper client={client}>
+        <TaskHistoryTable data={data} disablePolling />
+      </Wrapper>
+    );
+    await userEvent.click(
+      await screen.findByRole('button', { name: 'Download files' })
+    );
+    const dialog = await screen.findByRole('dialog');
+    expect(within(dialog).getByText(/Download files/i)).toBeInTheDocument();
+  });
+
+  it('calls onDownloadFiles callback instead of opening built-in dialog when provided', async () => {
+    mockFilesList({
+      5: { 'output/result.txt': { size: 512, is_dir: false } },
+    });
+    const onDownloadFiles = vi.fn();
+    const data = [
+      makeEntry(5, 'success', {
+        task: { output_files_path: 'run-script/local/output_files' },
+      }),
+    ];
+    render(
+      <Wrapper client={client}>
+        <TaskHistoryTable
+          data={data}
+          disablePolling
+          onDownloadFiles={onDownloadFiles}
+        />
+      </Wrapper>
+    );
+    await userEvent.click(
+      await screen.findByRole('button', { name: 'Download files' })
+    );
+    expect(onDownloadFiles).toHaveBeenCalledOnce();
+    expect(onDownloadFiles.mock.calls[0][0].id).toBe(5);
+    // Built-in dialog should NOT open
+    expect(screen.queryByRole('dialog')).not.toBeInTheDocument();
+  });
+});
+
+describe('TaskHistoryTable sort + pagination', () => {
+  const client = makeQueryClient();
+
+  function taskNamesInOrder(): string[] {
+    const cells = screen.getAllByRole('cell');
+    return cells
+      .map((c) => c.textContent ?? '')
+      .filter((t) => /^task-\d+$/.test(t));
+  }
+
+  it('reorders rows when Started column header is toggled', async () => {
+    const data = [
+      makeEntry(1, 'success'),
+      makeEntry(2, 'success'),
+      makeEntry(3, 'success'),
+    ];
+    render(
+      <Wrapper client={client}>
+        <TaskHistoryTable data={data} disablePolling />
+      </Wrapper>
+    );
+
+    // Initial sort is started_at desc → task-3, task-2, task-1.
+    const initial = taskNamesInOrder();
+    expect(initial).toEqual(['task-3', 'task-2', 'task-1']);
+
+    await userEvent.click(screen.getByText('Started'));
+    const ascending = taskNamesInOrder();
+    expect(ascending).toEqual(['task-1', 'task-2', 'task-3']);
+    expect(ascending).not.toEqual(initial);
+  });
+
+  it('paginates: next page swaps the visible rows', async () => {
+    const data = Array.from({ length: 25 }, (_, i) =>
+      makeEntry(i + 1, 'success', {
+        // Override started_at so ascending id matches descending default sort.
+        started_at: new Date(Date.UTC(2026, 0, 1, 0, 25 - i)).toISOString(),
+      })
+    );
+    render(
+      <Wrapper client={client}>
+        <TaskHistoryTable data={data} disablePolling />
+      </Wrapper>
+    );
+
+    const firstPageNames = taskNamesInOrder();
+    expect(firstPageNames).toHaveLength(10);
+    expect(firstPageNames[0]).toBe('task-1');
+
+    await userEvent.click(screen.getByLabelText(/Go to next page/i));
+
+    const secondPageNames = taskNamesInOrder();
+    expect(secondPageNames).toHaveLength(10);
+    expect(secondPageNames[0]).toBe('task-11');
+    expect(secondPageNames).not.toEqual(firstPageNames);
+  });
+});
+
+describe('TaskHistoryTable connected stop mutation', () => {
+  beforeEach(() => {
+    mockedApiClient.get.mockReset();
+    mockedApiClient.post.mockReset();
+  });
+
+  it('without onStopTask, posts to stop endpoint and refetches', async () => {
+    const runningEntry = makeEntry(42, 'running');
+    const stoppedEntry = makeEntry(42, 'stopped', { duration: 10 });
+
+    let returnRunning = true;
+    mockedApiClient.get.mockImplementation(async () => ({
+      data: {
+        items: [returnRunning ? runningEntry : stoppedEntry],
+        total: 1,
+        offset: 0,
+        limit: 10,
+      },
+    }));
+    mockedApiClient.post.mockImplementation(async () => {
+      returnRunning = false;
+      return { data: stoppedEntry };
+    });
+
+    const client = makeQueryClient();
+    render(
+      <Wrapper client={client}>
+        <TaskHistoryTable taskName="my-task" disablePolling />
+      </Wrapper>
+    );
+
+    await waitFor(() =>
+      expect(screen.getByText('Running')).toBeInTheDocument()
+    );
+
+    await userEvent.click(screen.getByRole('button', { name: 'Stop task' }));
+    const dialog = await screen.findByRole('dialog');
+    await userEvent.click(within(dialog).getByRole('button', { name: 'Stop' }));
+
+    await waitFor(() =>
+      expect(mockedApiClient.post).toHaveBeenCalledWith(
+        '/sep/task-history/42/stop/'
+      )
+    );
+
+    await waitFor(() =>
+      expect(screen.getByText('Stopped')).toBeInTheDocument()
+    );
+    expect(mockedApiClient.get.mock.calls.length).toBeGreaterThan(1);
+  });
+});
+
+describe('useTaskHistory polling', () => {
+  beforeEach(() => {
+    mockedApiClient.get.mockReset();
+  });
+
+  const wait = (ms: number) => new Promise<void>((r) => setTimeout(r, ms));
+
+  it('polls only while running tasks exist, then stops', async () => {
+    let returnRunning = true;
+    mockedApiClient.get.mockImplementation(async () => ({
+      data: {
+        items: returnRunning
+          ? [makeEntry(1, 'running')]
+          : [makeEntry(1, 'success')],
+        total: 1,
+        offset: 0,
+        limit: 10,
+      },
+    }));
+
+    const client = makeQueryClient();
+    const { result } = renderHook(
+      () => useTaskHistory({ pollingIntervalMs: 50 }),
+      {
+        wrapper: ({ children }) => (
+          <Wrapper client={client}>{children}</Wrapper>
+        ),
+      }
+    );
+
+    await waitFor(() =>
+      expect(result.current.data?.items[0].status).toBe('running')
+    );
+    const callsAfterFirst = mockedApiClient.get.mock.calls.length;
+    await wait(160);
+    expect(mockedApiClient.get.mock.calls.length).toBeGreaterThan(
+      callsAfterFirst
+    );
+
+    returnRunning = false;
+    await waitFor(() =>
+      expect(result.current.data?.items[0].status).toBe('success')
+    );
+    await wait(80);
+    const callsAfterStable = mockedApiClient.get.mock.calls.length;
+    await wait(200);
+    expect(mockedApiClient.get.mock.calls.length).toBe(callsAfterStable);
+  });
+
+  it('does not poll when disablePolling=true even with running rows', async () => {
+    mockedApiClient.get.mockResolvedValue({
+      data: {
+        items: [makeEntry(1, 'running')],
+        total: 1,
+        offset: 0,
+        limit: 10,
+      },
+    });
+
+    const client = makeQueryClient();
+    renderHook(
+      () => useTaskHistory({ pollingIntervalMs: 30, disablePolling: true }),
+      {
+        wrapper: ({ children }) => (
+          <Wrapper client={client}>{children}</Wrapper>
+        ),
+      }
+    );
+
+    await waitFor(() => expect(mockedApiClient.get).toHaveBeenCalledTimes(1));
+    await wait(150);
+    expect(mockedApiClient.get).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/TaskHistoryTable/TaskHistoryTable.tsx b/ui/packages/sep/framework/src/components/TaskHistoryTable/TaskHistoryTable.tsx
new file mode 100644
index 00000000000..c9da340052d
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TaskHistoryTable/TaskHistoryTable.tsx
@@ -0,0 +1,527 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useCallback, useMemo, useState } from 'react';
+import DownloadIcon from '@mui/icons-material/Download';
+import StopCircleIcon from '@mui/icons-material/StopCircle';
+import VisibilityIcon from '@mui/icons-material/Visibility';
+import Button from '@mui/material/Button';
+import Dialog from '@mui/material/Dialog';
+import DialogActions from '@mui/material/DialogActions';
+import DialogContent from '@mui/material/DialogContent';
+import DialogContentText from '@mui/material/DialogContentText';
+import DialogTitle from '@mui/material/DialogTitle';
+import IconButton from '@mui/material/IconButton';
+import Stack from '@mui/material/Stack';
+import Tooltip from '@mui/material/Tooltip';
+import Typography from '@mui/material/Typography';
+import { MaterialReactTable, type MRT_ColumnDef } from 'material-react-table';
+import {
+  isRunningStatus,
+  useStopTaskHistory,
+  useTaskHistory,
+  useTaskHistoryByName,
+} from '../../hooks/useTaskHistory';
+import { useTaskHistoryFiles } from '../../hooks/useTaskHistoryFiles';
+import { SEP_TABLE_CLASS } from '../../constants';
+import { ChainDisplay } from './ChainDisplay';
+import { StatusBadge } from './StatusBadge';
+import { TaskFilesDialog } from './TaskFilesDialog';
+import type {
+  TaskHistoryEntry,
+  TaskHistoryTableProps,
+} from './TaskHistoryTable.types';
+
+/** Cache file-list probes across history-table poll ticks. */
+const DOWNLOADABLE_FILES_STALE_TIME_MS = 30_000;
+
+function formatDateTime(value?: string | null): string {
+  if (!value) {
+    return '—';
+  }
+  const d = new Date(value);
+  return Number.isNaN(d.getTime()) ? value : d.toLocaleString();
+}
+
+function formatDuration(seconds: number | null | undefined): string {
+  if (seconds === null || seconds === undefined) {
+    return '—';
+  }
+  if (seconds < 60) {
+    return `${seconds.toFixed(1)}s`;
+  }
+  const total = Math.round(seconds);
+  const m = Math.floor(total / 60);
+  const s = total % 60;
+  return `${m}m ${s}s`;
+}
+
+interface MetaShape {
+  _chain_task_names?: string[];
+  _chain_depth?: number;
+}
+
+function readMeta(entry: TaskHistoryEntry): MetaShape {
+  const meta = entry.execution_request?.meta as MetaShape | null | undefined;
+  return meta ?? {};
+}
+
+function canProbeDownloadableFiles(entry: TaskHistoryEntry): boolean {
+  return (
+    !isRunningStatus(entry.status) &&
+    entry.id !== null &&
+    entry.id !== undefined &&
+    Boolean(entry.task?.output_files_path)
+  );
+}
+
+function stopConfirmLabel(entry: TaskHistoryEntry): string {
+  return entry.task?.name ?? `#${entry.id ?? ''}`;
+}
+
+interface DownloadFilesButtonProps {
+  entry: TaskHistoryEntry;
+  onDownloadFiles: TaskHistoryTableProps['onDownloadFiles'];
+  onOpenBuiltIn: (entry: TaskHistoryEntry) => void;
+}
+
+/**
+ * Render the Download files action only when the run has user-visible files.
+ *
+ * ``has_logs`` is the wrong signal: logs can exist when the output directory
+ * is empty (e.g. only the hidden ``.sep-run-result.json`` marker). Probe the
+ * files API and hide the button until a non-empty listing is confirmed.
+ */
+function DownloadFilesButton({
+  entry,
+  onDownloadFiles,
+  onOpenBuiltIn,
+}: DownloadFilesButtonProps) {
+  const shouldProbe = canProbeDownloadableFiles(entry);
+  const { data, isLoading, isError } = useTaskHistoryFiles(
+    shouldProbe ? entry.id : null,
+    {
+      staleTime: DOWNLOADABLE_FILES_STALE_TIME_MS,
+    }
+  );
+
+  if (
+    !shouldProbe ||
+    isLoading ||
+    isError ||
+    !data ||
+    Object.keys(data).length === 0
+  ) {
+    return null;
+  }
+
+  return (
+    <Tooltip title="Download files">
+      <span>
+        <IconButton
+          size="small"
+          aria-label="Download files"
+          onClick={() => {
+            if (onDownloadFiles) {
+              onDownloadFiles(entry);
+            } else {
+              onOpenBuiltIn(entry);
+            }
+          }}
+        >
+          <DownloadIcon fontSize="small" />
+        </IconButton>
+      </span>
+    </Tooltip>
+  );
+}
+
+interface ViewProps {
+  rows: TaskHistoryEntry[];
+  isLoading: boolean;
+  resolveUserName: TaskHistoryTableProps['resolveUserName'];
+  onViewLogs: TaskHistoryTableProps['onViewLogs'];
+  onDownloadFiles: TaskHistoryTableProps['onDownloadFiles'];
+  onChainItemClick: TaskHistoryTableProps['onChainItemClick'];
+  hideTaskNameColumn?: boolean;
+  /** Called once the user confirms the stop dialog. */
+  onConfirmStop: (entry: TaskHistoryEntry) => void;
+  isStopping: boolean;
+  /** True when the row's stop action will resolve to a real handler (callback or internal mutation). */
+  canStop: (entry: TaskHistoryEntry) => boolean;
+}
+
+function TaskHistoryTableView({
+  rows,
+  isLoading,
+  resolveUserName,
+  onViewLogs,
+  onDownloadFiles,
+  onChainItemClick,
+  hideTaskNameColumn,
+  onConfirmStop,
+  isStopping,
+  canStop,
+}: ViewProps) {
+  const [pendingStopEntry, setPendingStopEntry] =
+    useState<TaskHistoryEntry | null>(null);
+  const [pendingFilesEntry, setPendingFilesEntry] =
+    useState<TaskHistoryEntry | null>(null);
+
+  const requestStop = useCallback(
+    (entry: TaskHistoryEntry) => setPendingStopEntry(entry),
+    []
+  );
+  const cancelStop = useCallback(() => setPendingStopEntry(null), []);
+  const confirmStop = useCallback(() => {
+    if (pendingStopEntry) {
+      onConfirmStop(pendingStopEntry);
+    }
+    setPendingStopEntry(null);
+  }, [onConfirmStop, pendingStopEntry]);
+  const columns = useMemo<MRT_ColumnDef<TaskHistoryEntry>[]>(() => {
+    const cols: MRT_ColumnDef<TaskHistoryEntry>[] = [
+      {
+        id: 'status',
+        header: 'Status',
+        size: 100,
+        accessorFn: (row) => row.status,
+        Cell: ({ row }) => <StatusBadge status={row.original.status} />,
+      },
+      ...(hideTaskNameColumn
+        ? []
+        : [
+            {
+              id: 'task',
+              header: 'Task',
+              accessorFn: (row: TaskHistoryEntry) => row.task?.name ?? '',
+              size: 140,
+            } satisfies MRT_ColumnDef<TaskHistoryEntry>,
+          ]),
+      {
+        id: 'host',
+        header: 'Host',
+        accessorFn: (row) => row.execution_request?.target ?? '',
+        size: 140,
+      },
+      {
+        id: 'chain',
+        header: 'Chain',
+        enableSorting: false,
+        size: 150,
+        Cell: ({ row }) => {
+          const meta = readMeta(row.original);
+          return (
+            <ChainDisplay
+              chainNames={meta._chain_task_names}
+              chainDepth={meta._chain_depth}
+              onChainItemClick={
+                onChainItemClick
+                  ? (name, index) => onChainItemClick(name, index, row.original)
+                  : undefined
+              }
+            />
+          );
+        },
+      },
+      {
+        id: 'started_at',
+        header: 'Started',
+        size: 160,
+        accessorFn: (row) => row.started_at ?? '',
+        sortingFn: 'datetime',
+        Cell: ({ row }) => (
+          <Typography variant="body2" sx={{ fontFamily: 'monospace' }}>
+            {formatDateTime(row.original.started_at)}
+          </Typography>
+        ),
+      },
+      {
+        id: 'duration',
+        header: 'Duration',
+        size: 90,
+        accessorFn: (row) => row.duration ?? -1,
+        Cell: ({ row }) => (
+          <Typography variant="body2" sx={{ fontFamily: 'monospace' }}>
+            {formatDuration(row.original.duration)}
+          </Typography>
+        ),
+      },
+      {
+        id: 'executed_by',
+        header: 'Executed By',
+        size: 120,
+        accessorFn: (row) =>
+          (resolveUserName
+            ? resolveUserName(row.executed_by)
+            : (row.executed_by ?? '')) || '',
+      },
+      {
+        id: 'actions',
+        header: 'Actions',
+        enableSorting: false,
+        enableColumnFilter: false,
+        size: 120,
+        Cell: ({ row }) => {
+          const entry = row.original;
+          const running = isRunningStatus(entry.status);
+          return (
+            <Stack direction="row" spacing={0.5}>
+              <Tooltip title="View logs">
+                <span>
+                  <IconButton
+                    size="small"
+                    aria-label="View logs"
+                    disabled={!onViewLogs || (!entry.has_logs && !running)}
+                    onClick={() => onViewLogs?.(entry)}
+                  >
+                    <VisibilityIcon fontSize="small" />
+                  </IconButton>
+                </span>
+              </Tooltip>
+              {running && (
+                <Tooltip title="Stop task">
+                  <span>
+                    <IconButton
+                      size="small"
+                      color="warning"
+                      aria-label="Stop task"
+                      onClick={() => requestStop(entry)}
+                      disabled={isStopping || !canStop(entry)}
+                    >
+                      <StopCircleIcon fontSize="small" />
+                    </IconButton>
+                  </span>
+                </Tooltip>
+              )}
+              <DownloadFilesButton
+                entry={entry}
+                onDownloadFiles={onDownloadFiles}
+                onOpenBuiltIn={setPendingFilesEntry}
+              />
+            </Stack>
+          );
+        },
+      },
+    ];
+    return cols;
+  }, [
+    hideTaskNameColumn,
+    onChainItemClick,
+    onDownloadFiles,
+    onViewLogs,
+    requestStop,
+    isStopping,
+    canStop,
+    resolveUserName,
+  ]);
+
+  return (
+    <>
+      <MaterialReactTable
+        columns={columns}
+        data={rows}
+        state={{ isLoading }}
+        enableColumnActions={false}
+        enableDensityToggle={false}
+        enableFullScreenToggle={false}
+        enableHiding={false}
+        enablePagination
+        enableSorting
+        muiTablePaperProps={{
+          className: SEP_TABLE_CLASS,
+        }}
+        initialState={{
+          density: 'compact',
+          sorting: [{ id: 'started_at', desc: true }],
+          pagination: { pageIndex: 0, pageSize: 10 },
+        }}
+        getRowId={(row, index) =>
+          String(
+            row.id ?? `${row.task?.name ?? 'row'}-${row.started_at ?? index}`
+          )
+        }
+        muiTableBodyRowProps={({ row }) =>
+          isRunningStatus(row.original.status)
+            ? {
+                'data-running': 'true',
+                sx: { backgroundColor: 'action.hover' },
+              }
+            : {}
+        }
+        renderEmptyRowsFallback={() => (
+          <Typography
+            variant="body2"
+            sx={{ p: 2, textAlign: 'center' }}
+            color="text.secondary"
+          >
+            No task history
+          </Typography>
+        )}
+      />
+      <Dialog
+        open={pendingStopEntry !== null}
+        onClose={cancelStop}
+        aria-labelledby="task-history-stop-title"
+      >
+        <DialogTitle id="task-history-stop-title">Stop task</DialogTitle>
+        <DialogContent>
+          <DialogContentText>
+            {pendingStopEntry
+              ? `Are you sure you want to stop the task ${stopConfirmLabel(pendingStopEntry)}?`
+              : ''}
+          </DialogContentText>
+        </DialogContent>
+        <DialogActions>
+          <Button onClick={cancelStop}>Cancel</Button>
+          <Button onClick={confirmStop} variant="contained" autoFocus>
+            Stop
+          </Button>
+        </DialogActions>
+      </Dialog>
+      <TaskFilesDialog
+        open={pendingFilesEntry !== null}
+        taskHistoryId={pendingFilesEntry?.id ?? null}
+        onClose={() => setPendingFilesEntry(null)}
+      />
+    </>
+  );
+}
+
+type ConnectedProps = Omit<TaskHistoryTableProps, 'data' | 'isLoading'>;
+
+function ConnectedTaskHistoryTable({
+  taskName,
+  statusFilter,
+  pollingIntervalMs,
+  disablePolling,
+  resolveUserName,
+  onViewLogs,
+  onStopTask,
+  onDownloadFiles,
+  onChainItemClick,
+  hideTaskNameColumn,
+}: ConnectedProps) {
+  const allHistory = useTaskHistory({
+    status: statusFilter,
+    pollingIntervalMs,
+    disablePolling,
+    enabled: !taskName,
+  });
+  const byNameHistory = useTaskHistoryByName(taskName, {
+    status: statusFilter,
+    pollingIntervalMs,
+    disablePolling,
+  });
+  const stopMutation = useStopTaskHistory();
+
+  const queryResult = taskName ? byNameHistory : allHistory;
+  const rows: TaskHistoryEntry[] = queryResult.data?.items ?? [];
+  const isLoading = queryResult.isLoading;
+
+  const onConfirmStop = useCallback(
+    (entry: TaskHistoryEntry) => {
+      if (onStopTask) {
+        onStopTask(entry);
+        return;
+      }
+      if (entry.id !== null && entry.id !== undefined) {
+        stopMutation.mutate(entry.id);
+      }
+    },
+    [onStopTask, stopMutation]
+  );
+
+  const canStop = useCallback(
+    (entry: TaskHistoryEntry) =>
+      !!onStopTask || (entry.id !== null && entry.id !== undefined),
+    [onStopTask]
+  );
+
+  return (
+    <TaskHistoryTableView
+      rows={rows}
+      isLoading={isLoading}
+      resolveUserName={resolveUserName}
+      onViewLogs={onViewLogs}
+      onDownloadFiles={onDownloadFiles}
+      onChainItemClick={onChainItemClick}
+      hideTaskNameColumn={hideTaskNameColumn}
+      onConfirmStop={onConfirmStop}
+      isStopping={stopMutation.isPending}
+      canStop={canStop}
+    />
+  );
+}
+
+interface PresentationalProps extends Omit<
+  TaskHistoryTableProps,
+  'taskName' | 'statusFilter' | 'pollingIntervalMs' | 'disablePolling'
+> {
+  data: TaskHistoryEntry[];
+}
+
+function PresentationalTaskHistoryTable({
+  data,
+  isLoading,
+  resolveUserName,
+  onViewLogs,
+  onStopTask,
+  isStopping,
+  onDownloadFiles,
+  onChainItemClick,
+  hideTaskNameColumn,
+}: PresentationalProps) {
+  const onConfirmStop = useCallback(
+    (entry: TaskHistoryEntry) => onStopTask?.(entry),
+    [onStopTask]
+  );
+
+  const canStop = useCallback(() => !!onStopTask, [onStopTask]);
+
+  return (
+    <TaskHistoryTableView
+      rows={data}
+      isLoading={!!isLoading}
+      resolveUserName={resolveUserName}
+      onViewLogs={onViewLogs}
+      onDownloadFiles={onDownloadFiles}
+      onChainItemClick={onChainItemClick}
+      hideTaskNameColumn={hideTaskNameColumn}
+      onConfirmStop={onConfirmStop}
+      isStopping={!!isStopping}
+      canStop={canStop}
+    />
+  );
+}
+
+/**
+ * Render task-history rows.
+ *
+ * Two modes:
+ * - Connected: when `data` is omitted, the component fetches via React Query
+ *   (requires a `QueryClientProvider`) and polls while running rows exist.
+ * - Presentational: when `data` is provided, the component renders the rows
+ *   verbatim with no React Query usage — safe for stories, tests, and any
+ *   consumer that already owns the data.
+ */
+export function TaskHistoryTable(props: TaskHistoryTableProps) {
+  if (props.data !== undefined) {
+    return <PresentationalTaskHistoryTable {...props} data={props.data} />;
+  }
+  return <ConnectedTaskHistoryTable {...props} />;
+}
diff --git a/ui/packages/sep/framework/src/components/TaskHistoryTable/TaskHistoryTable.types.ts b/ui/packages/sep/framework/src/components/TaskHistoryTable/TaskHistoryTable.types.ts
new file mode 100644
index 00000000000..1c06f3ec935
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TaskHistoryTable/TaskHistoryTable.types.ts
@@ -0,0 +1,61 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type {
+  PaginatedTaskHistory,
+  TaskHistoryEntry,
+  TaskHistoryStatus,
+} from '../../hooks/useTaskHistory';
+
+export type { PaginatedTaskHistory, TaskHistoryEntry, TaskHistoryStatus };
+
+export interface TaskHistoryTableProps {
+  /** Optional task name to scope the listing to a single task. */
+  taskName?: string;
+  /** Optional explicit data — bypasses the internal React Query hook (used in stories/tests). */
+  data?: TaskHistoryEntry[];
+  /** Server-side status filter (applied via the React Query hook). */
+  statusFilter?: TaskHistoryStatus | null;
+  /** Loading flag (only honored when `data` is provided). */
+  isLoading?: boolean;
+  /** Override polling interval in ms. Default 5000. */
+  pollingIntervalMs?: number;
+  /** Force-disable polling regardless of running tasks. */
+  disablePolling?: boolean;
+  /** Resolver from Casdoor user id → display name. */
+  resolveUserName?: (userId: string | null | undefined) => string;
+  /** Action callback: view logs for a row. */
+  onViewLogs?: (entry: TaskHistoryEntry) => void;
+  /** Action callback: stop a running task. */
+  onStopTask?: (entry: TaskHistoryEntry) => void;
+  /**
+   * Whether a stop request is currently in flight (presentational mode only).
+   * Drives the Stop button's spinner/disabled state; defaults to `false`. The
+   * connected variant derives this from its internal mutation instead.
+   */
+  isStopping?: boolean;
+  /** Action callback: open download dialog. */
+  onDownloadFiles?: (entry: TaskHistoryEntry) => void;
+  /** Action callback: navigate to chained task by name. */
+  onChainItemClick?: (
+    taskName: string,
+    index: number,
+    entry: TaskHistoryEntry
+  ) => void;
+  /** Hide the Task Name column (useful when scoped to a single task). */
+  hideTaskNameColumn?: boolean;
+}
diff --git a/ui/packages/sep/framework/src/components/TaskHistoryTable/index.ts b/ui/packages/sep/framework/src/components/TaskHistoryTable/index.ts
new file mode 100644
index 00000000000..07e4759d1a4
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TaskHistoryTable/index.ts
@@ -0,0 +1,31 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { TaskHistoryTable } from './TaskHistoryTable';
+export {
+  StatusBadge as TaskHistoryStatusBadge,
+  isTaskHistoryStatus,
+} from './StatusBadge';
+export { ChainDisplay } from './ChainDisplay';
+export { TaskFilesDialog } from './TaskFilesDialog';
+export type { TaskFilesDialogProps } from './TaskFilesDialog';
+export type {
+  TaskHistoryTableProps,
+  TaskHistoryEntry,
+  TaskHistoryStatus,
+  PaginatedTaskHistory,
+} from './TaskHistoryTable.types';
diff --git a/ui/packages/sep/framework/src/components/TaskLogViewer/ExecutionEventsPanel.tsx b/ui/packages/sep/framework/src/components/TaskLogViewer/ExecutionEventsPanel.tsx
new file mode 100644
index 00000000000..8c74503d54c
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TaskLogViewer/ExecutionEventsPanel.tsx
@@ -0,0 +1,144 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import SearchIcon from '@mui/icons-material/Search';
+import Box from '@mui/material/Box';
+import InputAdornment from '@mui/material/InputAdornment';
+import TextField from '@mui/material/TextField';
+import Typography from '@mui/material/Typography';
+import { useMemo, useState } from 'react';
+import type { ExecutionEvent } from '../../hooks/useExecutionEvents';
+
+export const STEPLESS_STEP_KEY = '';
+export const STEPLESS_STEP_LABEL = 'General';
+
+export interface ExecutionEventsPanelProps {
+  eventsByStep: Record<string, ExecutionEvent[]>;
+  activeStep: string | undefined;
+  height?: number | string;
+}
+
+function eventLine(ev: ExecutionEvent): string {
+  const step = ev.step ?? '';
+  const prefix = step !== '' ? `${ev.type}[${step}]` : ev.type;
+  return `${prefix} ${ev.description}`;
+}
+
+function matchesQuery(ev: ExecutionEvent, needle: string): boolean {
+  if (!needle) {
+    return true;
+  }
+  const haystack = `${ev.timestamp ?? ''} ${eventLine(ev)}`.toLowerCase();
+  return haystack.includes(needle);
+}
+
+export function ExecutionEventsPanel({
+  eventsByStep,
+  activeStep,
+  height = 400,
+}: ExecutionEventsPanelProps) {
+  const [query, setQuery] = useState('');
+
+  const stepKeys = Object.keys(eventsByStep);
+  const resolvedKey =
+    activeStep !== undefined && activeStep in eventsByStep
+      ? activeStep
+      : stepKeys[0];
+  const list =
+    resolvedKey !== undefined ? (eventsByStep[resolvedKey] ?? []) : [];
+
+  const needle = query.trim().toLowerCase();
+  const filtered = useMemo(
+    () => list.filter((ev) => matchesQuery(ev, needle)),
+    [list, needle]
+  );
+
+  if (stepKeys.length === 0) {
+    return (
+      <Box sx={{ p: 2, color: 'text.secondary' }}>
+        <Typography variant="body2">No execution events yet.</Typography>
+      </Box>
+    );
+  }
+
+  return (
+    <Box sx={{ display: 'flex', flexDirection: 'column', height }}>
+      <Box sx={{ p: 1, borderBottom: 1, borderColor: 'divider' }}>
+        <TextField
+          size="small"
+          fullWidth
+          placeholder="Search events"
+          value={query}
+          onChange={(e) => setQuery(e.target.value)}
+          slotProps={{
+            input: {
+              startAdornment: (
+                <InputAdornment position="start">
+                  <SearchIcon fontSize="small" />
+                </InputAdornment>
+              ),
+            },
+          }}
+        />
+      </Box>
+
+      {list.length === 0 ? (
+        <Box sx={{ p: 2, color: 'text.secondary' }}>
+          <Typography variant="body2">
+            No execution events for this step.
+          </Typography>
+        </Box>
+      ) : filtered.length === 0 ? (
+        <Box sx={{ p: 2, color: 'text.secondary' }}>
+          <Typography variant="body2">
+            No events match &ldquo;{query}&rdquo;.
+          </Typography>
+        </Box>
+      ) : (
+        <Box
+          component="ol"
+          sx={{
+            listStyle: 'none',
+            m: 0,
+            p: 1,
+            flex: 1,
+            overflow: 'auto',
+            fontFamily: "'Roboto Mono', monospace",
+            fontSize: '0.8rem',
+          }}
+        >
+          {filtered.map((ev, idx) => (
+            <Box
+              component="li"
+              key={`${ev.timestamp}-${idx}`}
+              sx={{ display: 'flex', gap: 1.5, py: 0.25 }}
+            >
+              <Box
+                component="time"
+                dateTime={ev.timestamp}
+                sx={{ color: 'text.secondary', whiteSpace: 'nowrap' }}
+              >
+                {ev.timestamp}
+              </Box>
+              <Box sx={{ whiteSpace: 'pre-wrap' }}>{eventLine(ev)}</Box>
+            </Box>
+          ))}
+        </Box>
+      )}
+    </Box>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/TaskLogViewer/LogOutputPane.tsx b/ui/packages/sep/framework/src/components/TaskLogViewer/LogOutputPane.tsx
new file mode 100644
index 00000000000..11064ea0c54
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TaskLogViewer/LogOutputPane.tsx
@@ -0,0 +1,58 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { LazyLog } from '@melloware/react-logviewer';
+import Box from '@mui/material/Box';
+import Typography from '@mui/material/Typography';
+
+export interface LogOutputPaneProps {
+  text: string;
+  wrap: boolean;
+  enableSearch?: boolean;
+  height?: number | string;
+  emptyLabel?: string;
+}
+
+export function LogOutputPane({
+  text,
+  wrap,
+  enableSearch = true,
+  height = 400,
+  emptyLabel = 'No output yet.',
+}: LogOutputPaneProps) {
+  if (!text) {
+    return (
+      <Box sx={{ height, width: '100%', p: 2, color: 'text.secondary' }}>
+        <Typography variant="body2">{emptyLabel}</Typography>
+      </Box>
+    );
+  }
+
+  return (
+    <Box sx={{ height, width: '100%' }}>
+      <LazyLog
+        text={text}
+        extraLines={1}
+        enableSearch={enableSearch}
+        wrapLines={wrap}
+        follow
+        selectableLines
+        caseInsensitive
+      />
+    </Box>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/TaskLogViewer/LogStepTabs.tsx b/ui/packages/sep/framework/src/components/TaskLogViewer/LogStepTabs.tsx
new file mode 100644
index 00000000000..4716f93c9f3
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TaskLogViewer/LogStepTabs.tsx
@@ -0,0 +1,77 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import Badge from '@mui/material/Badge';
+import Tab from '@mui/material/Tab';
+import Tabs from '@mui/material/Tabs';
+import { STEPLESS_STEP_KEY, STEPLESS_STEP_LABEL } from './ExecutionEventsPanel';
+
+export interface LogStepTabsProps {
+  steps: string[];
+  activeStep: string | undefined;
+  unreadSteps: Set<string>;
+  onSelect: (step: string) => void;
+}
+
+function stepLabel(step: string): string {
+  return step === STEPLESS_STEP_KEY ? STEPLESS_STEP_LABEL : step;
+}
+
+export function LogStepTabs({
+  steps,
+  activeStep,
+  unreadSteps,
+  onSelect,
+}: LogStepTabsProps) {
+  if (steps.length === 0) {
+    return null;
+  }
+
+  // Clamp to a valid step so MUI Tabs doesn't warn when activeStep tracks a
+  // different set (e.g. log steps vs execution-event steps).
+  const resolvedValue =
+    activeStep !== undefined && steps.includes(activeStep)
+      ? activeStep
+      : steps[0];
+
+  return (
+    <Tabs
+      value={resolvedValue}
+      onChange={(_, value: string) => onSelect(value)}
+      variant="scrollable"
+      scrollButtons="auto"
+      sx={{ minHeight: 36, '& .MuiTab-root': { minHeight: 36, py: 0.5 } }}
+    >
+      {steps.map((step) => (
+        <Tab
+          key={step}
+          value={step}
+          label={
+            <Badge
+              color="primary"
+              variant="dot"
+              invisible={!unreadSteps.has(step) || step === activeStep}
+              sx={{ '& .MuiBadge-badge': { right: -8, top: 2 } }}
+            >
+              <span>{stepLabel(step)}</span>
+            </Badge>
+          }
+        />
+      ))}
+    </Tabs>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/TaskLogViewer/StatusBadge.tsx b/ui/packages/sep/framework/src/components/TaskLogViewer/StatusBadge.tsx
new file mode 100644
index 00000000000..a65109b6ebd
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TaskLogViewer/StatusBadge.tsx
@@ -0,0 +1,67 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import CancelIcon from '@mui/icons-material/Cancel';
+import CheckCircleIcon from '@mui/icons-material/CheckCircle';
+import CloudOffIcon from '@mui/icons-material/CloudOff';
+import ErrorIcon from '@mui/icons-material/Error';
+import HelpIcon from '@mui/icons-material/Help';
+import ReportIcon from '@mui/icons-material/Report';
+import Chip from '@mui/material/Chip';
+import type { FinishStatus } from '../../hooks/useTaskLogs';
+
+export type BadgeStatus = FinishStatus | 'stream-error' | 'executor-gone';
+
+const MAP: Record<
+  BadgeStatus,
+  {
+    label: string;
+    color: 'success' | 'error' | 'warning' | 'default';
+    icon: React.ReactElement;
+  }
+> = {
+  success: { label: 'Done', color: 'success', icon: <CheckCircleIcon /> },
+  stopped: { label: 'Stopped', color: 'default', icon: <CancelIcon /> },
+  lost: { label: 'Lost', color: 'warning', icon: <HelpIcon /> },
+  failed: { label: 'Failed', color: 'error', icon: <ReportIcon /> },
+  'stream-error': {
+    label: 'Stream error',
+    color: 'error',
+    icon: <ErrorIcon />,
+  },
+  'executor-gone': {
+    label: 'Not in executor',
+    color: 'warning',
+    icon: <CloudOffIcon />,
+  },
+};
+
+export interface StatusBadgeProps {
+  status: BadgeStatus;
+}
+
+export function StatusBadge({ status }: StatusBadgeProps) {
+  const entry = MAP[status];
+  return (
+    <Chip
+      size="small"
+      color={entry.color}
+      icon={entry.icon}
+      label={entry.label}
+    />
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/TaskLogViewer/StreamErrorBlock.tsx b/ui/packages/sep/framework/src/components/TaskLogViewer/StreamErrorBlock.tsx
new file mode 100644
index 00000000000..9c08da9a679
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TaskLogViewer/StreamErrorBlock.tsx
@@ -0,0 +1,119 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import Alert from '@mui/material/Alert';
+import Box from '@mui/material/Box';
+import Typography from '@mui/material/Typography';
+import type { StreamError } from '../../hooks/useTaskLogs';
+
+interface ExecutorGoneDetail {
+  message?: string;
+  resource_type?: string;
+  resource_id?: string;
+  job_id?: string;
+  evaluation_id?: string;
+  executor_name?: string;
+  detail?: string;
+}
+
+function isObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function formatGenericDetail(detail: unknown): string {
+  if (typeof detail === 'string') {
+    return detail;
+  }
+  if (detail === null || detail === undefined) {
+    return 'Unknown stream error';
+  }
+  try {
+    return JSON.stringify(detail, null, 2);
+  } catch {
+    return String(detail);
+  }
+}
+
+function ExecutorGoneBlock({ detail }: { detail: ExecutorGoneDetail }) {
+  const summary =
+    detail.message || 'This run is no longer available in the task executor.';
+  const rows: [string, string][] = [];
+  if (detail.resource_type) {
+    rows.push(['Resource type', detail.resource_type]);
+  }
+  if (detail.resource_id) {
+    rows.push(['Resource', detail.resource_id]);
+  }
+  if (detail.job_id) {
+    rows.push(['Job ID', detail.job_id]);
+  }
+  if (detail.evaluation_id) {
+    rows.push(['Evaluation ID', detail.evaluation_id]);
+  }
+  if (detail.executor_name) {
+    rows.push(['Executor', detail.executor_name]);
+  }
+
+  return (
+    <Alert severity="warning" variant="outlined" sx={{ mb: 1 }} role="alert">
+      <Typography variant="body2" sx={{ mb: rows.length ? 1 : 0 }}>
+        {summary}
+      </Typography>
+      {rows.length > 0 && (
+        <Box component="ul" sx={{ m: 0, pl: 2 }}>
+          {rows.map(([k, v]) => (
+            <Box component="li" key={k} sx={{ fontSize: '0.85rem' }}>
+              <strong>{k}: </strong>
+              {v}
+            </Box>
+          ))}
+        </Box>
+      )}
+      {detail.detail && detail.detail !== summary && (
+        <Typography variant="caption" component="p" sx={{ mt: 1 }}>
+          {detail.detail}
+        </Typography>
+      )}
+    </Alert>
+  );
+}
+
+export interface StreamErrorBlockProps {
+  error: StreamError;
+}
+
+export function StreamErrorBlock({ error }: StreamErrorBlockProps) {
+  const { code, detail } = error;
+  if (code === 410 && isObject(detail)) {
+    return <ExecutorGoneBlock detail={detail as ExecutorGoneDetail} />;
+  }
+  return (
+    <Alert severity="error" variant="outlined" sx={{ mb: 1 }} role="alert">
+      <Box
+        component="pre"
+        sx={{
+          m: 0,
+          fontFamily: "'Roboto Mono', monospace",
+          fontSize: '0.8rem',
+          whiteSpace: 'pre-wrap',
+        }}
+      >
+        {formatGenericDetail(detail)}
+      </Box>
+    </Alert>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/TaskLogViewer/TaskLogViewer.tsx b/ui/packages/sep/framework/src/components/TaskLogViewer/TaskLogViewer.tsx
new file mode 100644
index 00000000000..2115e3ef6bf
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TaskLogViewer/TaskLogViewer.tsx
@@ -0,0 +1,396 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import DownloadIcon from '@mui/icons-material/Download';
+import Badge from '@mui/material/Badge';
+import Box from '@mui/material/Box';
+import FormControl from '@mui/material/FormControl';
+import FormControlLabel from '@mui/material/FormControlLabel';
+import IconButton from '@mui/material/IconButton';
+import MenuItem from '@mui/material/MenuItem';
+import Paper from '@mui/material/Paper';
+import Select from '@mui/material/Select';
+import Stack from '@mui/material/Stack';
+import Switch from '@mui/material/Switch';
+import Tab from '@mui/material/Tab';
+import Tabs from '@mui/material/Tabs';
+import Tooltip from '@mui/material/Tooltip';
+import Typography from '@mui/material/Typography';
+import { useEffect, useMemo, useRef, useState } from 'react';
+import { useExecutionEvents } from '../../hooks/useExecutionEvents';
+import { useLogDownload } from '../../hooks/useLogDownload';
+import { useTaskLogs, type LogType } from '../../hooks/useTaskLogs';
+import { ExecutionEventsPanel } from './ExecutionEventsPanel';
+import { LogOutputPane } from './LogOutputPane';
+import { LogStepTabs } from './LogStepTabs';
+import { StatusBadge, type BadgeStatus } from './StatusBadge';
+import { StreamErrorBlock } from './StreamErrorBlock';
+
+type TopTab = 'stdout' | 'stderr' | 'events';
+
+export const DEFAULT_LOG_TAIL_LINES = 1000;
+
+export const LOG_TAIL_LINE_OPTIONS = [
+  { label: '100', value: '100' },
+  { label: '1000', value: '1000' },
+  { label: '5000', value: '5000' },
+  { label: 'All', value: 'all' },
+] as const;
+
+export type LogTailLineChoice = (typeof LOG_TAIL_LINE_OPTIONS)[number]['value'];
+
+const LOG_TAIL_STORAGE_KEY = 'sep.taskLogViewer.tail';
+
+const DEFAULT_LOG_TAIL_CHOICE = '1000' satisfies LogTailLineChoice;
+
+function readStoredLogTailChoice(): LogTailLineChoice {
+  if (globalThis.localStorage === undefined) {
+    return DEFAULT_LOG_TAIL_CHOICE;
+  }
+  const stored = globalThis.localStorage.getItem(LOG_TAIL_STORAGE_KEY);
+  if (stored === 'all') {
+    return 'all';
+  }
+  if (stored === '100' || stored === '1000' || stored === '5000') {
+    return stored;
+  }
+  return DEFAULT_LOG_TAIL_CHOICE;
+}
+
+function logTailChoiceToParam(choice: LogTailLineChoice): number | undefined {
+  return choice === 'all' ? undefined : Number(choice);
+}
+
+export interface TaskLogViewerProps {
+  taskHistoryId: number | string;
+  taskStatus?: string;
+  height?: number | string;
+}
+
+function isRunningStatus(status?: string): boolean {
+  return (status ?? '').toLowerCase() === 'running';
+}
+
+function resolveBadgeStatus(
+  finishStatus: ReturnType<typeof useTaskLogs>['finishStatus'],
+  error: ReturnType<typeof useTaskLogs>['error']
+): BadgeStatus | undefined {
+  if (error) {
+    return error.code === 410 ? 'executor-gone' : 'stream-error';
+  }
+  return finishStatus;
+}
+
+export function TaskLogViewer({
+  taskHistoryId,
+  taskStatus,
+  height = 480,
+}: TaskLogViewerProps) {
+  const running = isRunningStatus(taskStatus);
+  const [logTailChoice, setLogTailChoice] = useState<LogTailLineChoice>(
+    readStoredLogTailChoice
+  );
+  const tailLines = logTailChoiceToParam(logTailChoice);
+  const effectiveTailLines = running ? undefined : tailLines;
+  const { textByStep, stepOrder, finishStatus, error } = useTaskLogs(
+    taskHistoryId,
+    effectiveTailLines
+  );
+  const { eventsByStep, stepOrder: eventStepOrder } = useExecutionEvents(
+    taskHistoryId,
+    running
+  );
+
+  const [topTab, setTopTab] = useState<TopTab>('stdout');
+  const [activeStep, setActiveStep] = useState<string | undefined>();
+  const [wrap, setWrap] = useState(false);
+
+  const [unreadTypes, setUnreadTypes] = useState<Set<LogType>>(new Set());
+  const [unreadEvents, setUnreadEvents] = useState(false);
+  const [unreadSteps, setUnreadSteps] = useState<Set<string>>(new Set());
+
+  const prevLogSizesRef = useRef<Record<string, number>>({});
+  const prevEventCountRef = useRef(0);
+
+  // Reset view state when switching to a different task history
+  useEffect(() => {
+    setActiveStep(undefined);
+    setUnreadTypes(new Set());
+    setUnreadSteps(new Set());
+    setUnreadEvents(false);
+    prevLogSizesRef.current = {};
+    prevEventCountRef.current = 0;
+  }, [taskHistoryId]);
+
+  useEffect(() => {
+    if (!activeStep && stepOrder.length > 0) {
+      setActiveStep(stepOrder[0]);
+    }
+  }, [stepOrder, activeStep]);
+
+  // Track unread notifications based on accumulated text growth
+  useEffect(() => {
+    for (const step of stepOrder) {
+      const pane = textByStep[step];
+      if (!pane) {
+        continue;
+      }
+      (['stdout', 'stderr'] as const).forEach((type) => {
+        const key = `${step}_${type}`;
+        const size = pane[type].length;
+        const prev = prevLogSizesRef.current[key] ?? 0;
+        if (size > prev) {
+          if (topTab !== type) {
+            setUnreadTypes((prevSet) => {
+              if (prevSet.has(type)) {
+                return prevSet;
+              }
+              const next = new Set(prevSet);
+              next.add(type);
+              return next;
+            });
+          }
+          if (activeStep !== step) {
+            setUnreadSteps((prevSet) => {
+              if (prevSet.has(step)) {
+                return prevSet;
+              }
+              const next = new Set(prevSet);
+              next.add(step);
+              return next;
+            });
+          }
+        }
+        prevLogSizesRef.current[key] = size;
+      });
+    }
+  }, [textByStep, stepOrder, topTab, activeStep]);
+
+  // Events unread badge on top tab
+  useEffect(() => {
+    const total = Object.values(eventsByStep).reduce(
+      (sum, list) => sum + list.length,
+      0
+    );
+    if (total > prevEventCountRef.current && topTab !== 'events') {
+      setUnreadEvents(true);
+    }
+    prevEventCountRef.current = total;
+  }, [eventsByStep, topTab]);
+
+  const handleTopTab = (value: TopTab) => {
+    setTopTab(value);
+    if (value === 'events') {
+      setUnreadEvents(false);
+    } else {
+      setUnreadTypes((prev) => {
+        if (!prev.has(value)) {
+          return prev;
+        }
+        const next = new Set(prev);
+        next.delete(value);
+        return next;
+      });
+    }
+  };
+
+  const handleStepSelect = (step: string) => {
+    setActiveStep(step);
+    setUnreadSteps((prev) => {
+      if (!prev.has(step)) {
+        return prev;
+      }
+      const next = new Set(prev);
+      next.delete(step);
+      return next;
+    });
+  };
+
+  const stepsForTabs = useMemo(
+    () => (topTab === 'events' ? eventStepOrder : stepOrder),
+    [topTab, eventStepOrder, stepOrder]
+  );
+
+  const currentPaneText = useMemo(() => {
+    if (topTab === 'events' || !activeStep) {
+      return '';
+    }
+    const pane = textByStep[activeStep];
+    if (!pane) {
+      return '';
+    }
+    return pane[topTab] ?? '';
+  }, [textByStep, activeStep, topTab]);
+
+  const download = useLogDownload();
+  const handleDownload = () => {
+    if (topTab === 'events') {
+      return;
+    }
+    const filename = `task-${taskHistoryId}-${activeStep ?? 'step'}-${topTab}.log`;
+    download(filename, currentPaneText);
+  };
+
+  const handleLogTailChange = (choice: LogTailLineChoice) => {
+    setLogTailChoice(choice);
+    if (globalThis.localStorage !== undefined) {
+      globalThis.localStorage.setItem(LOG_TAIL_STORAGE_KEY, choice);
+    }
+  };
+
+  const badgeStatus = resolveBadgeStatus(finishStatus, error);
+
+  return (
+    <Paper variant="outlined" sx={{ display: 'flex', flexDirection: 'column' }}>
+      <Stack
+        direction="row"
+        alignItems="center"
+        sx={{ px: 1, pt: 1, borderBottom: 1, borderColor: 'divider' }}
+      >
+        <Tabs
+          value={topTab}
+          onChange={(_, v: TopTab) => handleTopTab(v)}
+          sx={{ flex: 1, minHeight: 40 }}
+        >
+          <Tab
+            value="stdout"
+            label={
+              <Badge
+                color="primary"
+                variant="dot"
+                invisible={!unreadTypes.has('stdout')}
+              >
+                <span>stdout</span>
+              </Badge>
+            }
+          />
+          <Tab
+            value="stderr"
+            label={
+              <Badge
+                color="primary"
+                variant="dot"
+                invisible={!unreadTypes.has('stderr')}
+              >
+                <span>stderr</span>
+              </Badge>
+            }
+          />
+          <Tab
+            value="events"
+            label={
+              <Badge color="primary" variant="dot" invisible={!unreadEvents}>
+                <span>Execution events</span>
+              </Badge>
+            }
+          />
+        </Tabs>
+        <Stack direction="row" alignItems="center" spacing={1} sx={{ pr: 1 }}>
+          {badgeStatus && <StatusBadge status={badgeStatus} />}
+          <Tooltip
+            title={
+              running
+                ? 'Line cap applies to finished task logs only'
+                : 'Limit how many lines are loaded from the server'
+            }
+          >
+            <FormControl size="small" sx={{ minWidth: 96 }} disabled={running}>
+              <Select
+                value={logTailChoice}
+                onChange={(event) =>
+                  handleLogTailChange(event.target.value as LogTailLineChoice)
+                }
+                aria-label="Log lines to show"
+                disabled={running}
+                renderValue={(value) => (
+                  <Typography variant="body2" component="span">
+                    {value === 'all' ? 'All lines' : `Last ${value}`}
+                  </Typography>
+                )}
+                sx={{
+                  '& .MuiSelect-select': {
+                    py: 0.75,
+                    display: 'flex',
+                    alignItems: 'center',
+                  },
+                }}
+              >
+                {LOG_TAIL_LINE_OPTIONS.map((option) => (
+                  <MenuItem key={option.value} value={option.value}>
+                    {option.label === 'All'
+                      ? 'All lines'
+                      : `Last ${option.label}`}
+                  </MenuItem>
+                ))}
+              </Select>
+            </FormControl>
+          </Tooltip>
+          <FormControlLabel
+            control={
+              <Switch
+                size="small"
+                checked={wrap}
+                onChange={(_, checked) => setWrap(checked)}
+              />
+            }
+            label="Wrap"
+            slotProps={{ typography: { variant: 'body2' } }}
+          />
+          <Tooltip title="Download log">
+            <span>
+              <IconButton
+                size="small"
+                onClick={handleDownload}
+                disabled={topTab === 'events' || !currentPaneText}
+                aria-label="Download log"
+              >
+                <DownloadIcon fontSize="small" />
+              </IconButton>
+            </span>
+          </Tooltip>
+        </Stack>
+      </Stack>
+
+      {error && (
+        <Box sx={{ p: 1 }}>
+          <StreamErrorBlock error={error} />
+        </Box>
+      )}
+
+      <Box sx={{ flex: 1, minHeight: 0 }}>
+        {topTab === 'events' ? (
+          <ExecutionEventsPanel
+            eventsByStep={eventsByStep}
+            activeStep={activeStep}
+            height={height}
+          />
+        ) : (
+          <LogOutputPane text={currentPaneText} wrap={wrap} height={height} />
+        )}
+      </Box>
+
+      <Box sx={{ borderTop: 1, borderColor: 'divider', px: 1 }}>
+        <LogStepTabs
+          steps={stepsForTabs}
+          activeStep={activeStep}
+          unreadSteps={unreadSteps}
+          onSelect={handleStepSelect}
+        />
+      </Box>
+    </Paper>
+  );
+}
diff --git a/ui/packages/sep/framework/src/components/TaskLogViewer/__tests__/TaskLogViewer.test.tsx b/ui/packages/sep/framework/src/components/TaskLogViewer/__tests__/TaskLogViewer.test.tsx
new file mode 100644
index 00000000000..0cff8dc58e0
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TaskLogViewer/__tests__/TaskLogViewer.test.tsx
@@ -0,0 +1,405 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { act, render, screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import {
+  flushPromises,
+  mockStreamFetch,
+  type SseStreamHandle,
+} from '../../../../tests/eventSourceStub';
+import { QueryWrapper } from '../../../../tests/queryWrapper';
+import { TaskLogViewer } from '../TaskLogViewer';
+
+// Stub the log-viewer lib: real one depends on DOM APIs jsdom lacks.
+vi.mock('@melloware/react-logviewer', () => ({
+  LazyLog: ({ text }: { text: string }) => (
+    <pre data-testid="log-output">{text}</pre>
+  ),
+}));
+
+// Manual mock keeps axios out of the resolution graph.
+let _tokenProvider: () => string | null = () => null;
+vi.mock('@sep/api', () => ({
+  setTokenProvider: (p: () => string | null) => {
+    _tokenProvider = p;
+  },
+  getToken: () => _tokenProvider(),
+  refreshAccessToken: vi.fn<() => Promise<string | null>>(),
+  emitUnauthorized: vi.fn(),
+  apiClient: { get: vi.fn(), defaults: {} },
+}));
+
+describe('TaskLogViewer', () => {
+  let mock: ReturnType<typeof mockStreamFetch>;
+
+  beforeEach(() => {
+    mock = mockStreamFetch();
+    mock.install();
+    _tokenProvider = () => 'test-token';
+    globalThis.localStorage.clear();
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.clearAllMocks();
+    globalThis.localStorage.clear();
+  });
+
+  function streamUrlFor(id: string): string {
+    return `/stream-logs/${id}`;
+  }
+
+  function getHandle(id: string, callIndex = -1): SseStreamHandle {
+    const matches = mock.pending.filter((handle) => {
+      const path = handle.url.split('?')[0];
+      return path === streamUrlFor(id);
+    });
+    const handle = callIndex < 0 ? matches.at(callIndex) : matches[callIndex];
+    if (!handle) {
+      throw new Error(`No stream handle for ${streamUrlFor(id)}`);
+    }
+    return handle;
+  }
+
+  function getTailSelect() {
+    return screen.getByRole('combobox');
+  }
+
+  function fetchUrl(callIndex: number): string {
+    const url = mock.fetchSpy.mock.calls[callIndex]?.[0];
+    return typeof url === 'string' ? url : (url as URL).href;
+  }
+
+  function logFetchUrls(): string[] {
+    return mock.fetchSpy.mock.calls
+      .map((_, index) => fetchUrl(index))
+      .filter((url) => /^\/stream-logs\/[^/?]+(\?|$)/.test(url));
+  }
+
+  it('renders accumulated stdout for the first step by default', async () => {
+    render(
+      <QueryWrapper>
+        <TaskLogViewer taskHistoryId="7" taskStatus="RUNNING" />
+      </QueryWrapper>
+    );
+    await flushPromises();
+
+    const handle = getHandle('7');
+    act(() => {
+      handle.pushMessage({
+        msg: 'line-1\n',
+        step: 'setup',
+        type: 'stdout',
+        offset: 1,
+      });
+    });
+
+    await waitFor(() =>
+      expect(screen.getByTestId('log-output').textContent).toBe('line-1\n')
+    );
+  });
+
+  it('omits tail param for running tasks', async () => {
+    render(
+      <QueryWrapper>
+        <TaskLogViewer taskHistoryId="7" taskStatus="RUNNING" />
+      </QueryWrapper>
+    );
+    await flushPromises();
+
+    expect(logFetchUrls()[0]).toBe('/stream-logs/7');
+    expect(getTailSelect()).toHaveTextContent('Last 1000');
+    expect(getTailSelect()).toHaveAttribute('aria-disabled', 'true');
+  });
+
+  it('requests tail=1000 by default for finished tasks', async () => {
+    render(
+      <QueryWrapper>
+        <TaskLogViewer taskHistoryId="7" taskStatus="SUCCESS" />
+      </QueryWrapper>
+    );
+    await flushPromises();
+
+    expect(logFetchUrls()[0]).toBe('/stream-logs/7?tail=1000');
+    expect(getTailSelect()).toHaveTextContent('Last 1000');
+  });
+
+  it('restores the tail choice from localStorage for finished tasks', async () => {
+    globalThis.localStorage.setItem('sep.taskLogViewer.tail', '5000');
+
+    render(
+      <QueryWrapper>
+        <TaskLogViewer taskHistoryId="3" taskStatus="SUCCESS" />
+      </QueryWrapper>
+    );
+    await flushPromises();
+
+    expect(logFetchUrls()[0]).toBe('/stream-logs/3?tail=5000');
+    expect(getTailSelect()).toHaveTextContent('Last 5000');
+  });
+
+  it('omits tail param when All lines is selected for finished tasks', async () => {
+    render(
+      <QueryWrapper>
+        <TaskLogViewer taskHistoryId="5" taskStatus="SUCCESS" />
+      </QueryWrapper>
+    );
+    await flushPromises();
+    expect(logFetchUrls()[0]).toBe('/stream-logs/5?tail=1000');
+
+    const user = userEvent.setup();
+    await user.click(getTailSelect());
+    await user.click(screen.getByRole('option', { name: /all lines/i }));
+    await flushPromises();
+
+    expect(logFetchUrls().at(-1)).toBe('/stream-logs/5');
+  });
+
+  it('reconnects with a new tail when the line cap changes for finished tasks', async () => {
+    render(
+      <QueryWrapper>
+        <TaskLogViewer taskHistoryId="8" taskStatus="SUCCESS" />
+      </QueryWrapper>
+    );
+    await flushPromises();
+
+    const user = userEvent.setup();
+    await user.click(getTailSelect());
+    await user.click(screen.getByRole('option', { name: 'Last 100' }));
+    await flushPromises();
+
+    expect(logFetchUrls().at(-1)).toBe('/stream-logs/8?tail=100');
+    expect(globalThis.localStorage.getItem('sep.taskLogViewer.tail')).toBe(
+      '100'
+    );
+  });
+
+  it('clears displayed logs when the line cap changes for finished tasks', async () => {
+    render(
+      <QueryWrapper>
+        <TaskLogViewer taskHistoryId="11" taskStatus="SUCCESS" />
+      </QueryWrapper>
+    );
+    await flushPromises();
+
+    const firstHandle = getHandle('11');
+    act(() => {
+      firstHandle.pushMessage({
+        msg: 'keep-me\n',
+        step: 'setup',
+        type: 'stdout',
+        offset: 1,
+      });
+    });
+    await waitFor(() =>
+      expect(screen.getByTestId('log-output').textContent).toBe('keep-me\n')
+    );
+
+    const user = userEvent.setup();
+    await user.click(getTailSelect());
+    await user.click(screen.getByRole('option', { name: /last 5000/i }));
+    await flushPromises();
+
+    expect(screen.queryByTestId('log-output')).not.toBeInTheDocument();
+    expect(screen.getByText(/no output yet/i)).toBeInTheDocument();
+  });
+
+  it('marks the stderr top tab as unread when stderr arrives while on stdout', async () => {
+    render(
+      <QueryWrapper>
+        <TaskLogViewer taskHistoryId="1" taskStatus="RUNNING" />
+      </QueryWrapper>
+    );
+    await flushPromises();
+
+    const handle = getHandle('1');
+    act(() => {
+      handle.pushMessage({
+        msg: 'err\n',
+        step: 'setup',
+        type: 'stderr',
+        offset: 1,
+      });
+    });
+
+    await waitFor(() => {
+      const stderrTab = screen.getByRole('tab', { name: /stderr/i });
+      const dot = stderrTab.querySelector('.MuiBadge-dot');
+      expect(dot).toBeTruthy();
+      expect(dot?.classList.contains('MuiBadge-invisible')).toBe(false);
+    });
+
+    const stderrTab = screen.getByRole('tab', { name: /stderr/i });
+    const user = userEvent.setup();
+    await user.click(stderrTab);
+
+    // MUI Badge keeps the dot element but toggles an invisible class
+    const dotAfter = stderrTab.querySelector('.MuiBadge-dot');
+    expect(dotAfter?.classList.contains('MuiBadge-invisible')).toBe(true);
+  });
+
+  it('switches pane when clicking the Execution events tab', async () => {
+    render(
+      <QueryWrapper>
+        <TaskLogViewer taskHistoryId="1" taskStatus="RUNNING" />
+      </QueryWrapper>
+    );
+    await flushPromises();
+
+    const handle = getHandle('1');
+    act(() => {
+      handle.pushMessage({
+        msg: 'out\n',
+        step: 'setup',
+        type: 'stdout',
+        offset: 1,
+      });
+    });
+    await waitFor(() =>
+      expect(screen.getByTestId('log-output')).toBeInTheDocument()
+    );
+
+    const user = userEvent.setup();
+    await user.click(screen.getByRole('tab', { name: /execution events/i }));
+
+    expect(screen.queryByTestId('log-output')).not.toBeInTheDocument();
+    expect(screen.getByText(/no execution events yet/i)).toBeInTheDocument();
+  });
+
+  it('triggers a blob download when the download button is clicked', async () => {
+    const createObjectURL = vi.fn(() => 'blob:mock');
+    const revokeObjectURL = vi.fn();
+    vi.stubGlobal('URL', { ...URL, createObjectURL, revokeObjectURL });
+    const clickSpy = vi
+      .spyOn(HTMLAnchorElement.prototype, 'click')
+      .mockImplementation(() => {});
+
+    render(
+      <QueryWrapper>
+        <TaskLogViewer taskHistoryId="99" taskStatus="RUNNING" />
+      </QueryWrapper>
+    );
+    await flushPromises();
+
+    const handle = getHandle('99');
+    act(() => {
+      handle.pushMessage({
+        msg: 'payload',
+        step: 'run',
+        type: 'stdout',
+        offset: 1,
+      });
+    });
+    await waitFor(() =>
+      expect(screen.getByTestId('log-output')).toBeInTheDocument()
+    );
+
+    const user = userEvent.setup();
+    await user.click(screen.getByRole('button', { name: /download log/i }));
+
+    expect(createObjectURL).toHaveBeenCalledTimes(1);
+    expect(clickSpy).toHaveBeenCalledTimes(1);
+    expect(revokeObjectURL).toHaveBeenCalledWith('blob:mock');
+  });
+
+  it('renders a status badge when the stream finishes', async () => {
+    render(
+      <QueryWrapper>
+        <TaskLogViewer taskHistoryId="1" taskStatus="RUNNING" />
+      </QueryWrapper>
+    );
+    await flushPromises();
+
+    const handle = getHandle('1');
+    act(() => {
+      handle.pushNamed('finish', { status: 'success' });
+    });
+    await waitFor(() => expect(screen.getByText('Done')).toBeInTheDocument());
+  });
+
+  it('resets active step and unread state when taskHistoryId changes', async () => {
+    const { rerender } = render(
+      <QueryWrapper>
+        <TaskLogViewer taskHistoryId="1" taskStatus="RUNNING" />
+      </QueryWrapper>
+    );
+    await flushPromises();
+
+    const first = getHandle('1');
+    act(() => {
+      first.pushMessage({
+        msg: 'a\n',
+        step: 'alpha',
+        type: 'stdout',
+        offset: 1,
+      });
+    });
+    await waitFor(() =>
+      expect(screen.getByTestId('log-output').textContent).toBe('a\n')
+    );
+
+    rerender(
+      <QueryWrapper>
+        <TaskLogViewer taskHistoryId="2" taskStatus="RUNNING" />
+      </QueryWrapper>
+    );
+    await flushPromises();
+
+    // Previous step alpha no longer exists; empty state until new data arrives
+    expect(screen.queryByTestId('log-output')).not.toBeInTheDocument();
+    expect(screen.getByText(/no output yet/i)).toBeInTheDocument();
+
+    const second = getHandle('2');
+    act(() => {
+      second.pushMessage({
+        msg: 'b\n',
+        step: 'beta',
+        type: 'stdout',
+        offset: 1,
+      });
+    });
+    await waitFor(() =>
+      expect(screen.getByTestId('log-output').textContent).toBe('b\n')
+    );
+    // New step auto-selected, no unread dots from the prior task
+    const stepTab = screen.getByRole('tab', { name: /beta/i });
+    expect(within(stepTab).queryByRole('status')).toBeNull();
+  });
+
+  it('renders the executor-gone error block for 410', async () => {
+    render(
+      <QueryWrapper>
+        <TaskLogViewer taskHistoryId="1" taskStatus="RUNNING" />
+      </QueryWrapper>
+    );
+    await flushPromises();
+
+    const handle = getHandle('1');
+    act(() => {
+      handle.pushNamed('sep-error', {
+        code: 410,
+        detail: { message: 'gone', job_id: 'J-1', executor_name: 'nomad-a' },
+      });
+    });
+    await waitFor(() => expect(screen.getByText('gone')).toBeInTheDocument());
+    expect(screen.getByText(/J-1/)).toBeInTheDocument();
+    expect(screen.getByText(/nomad-a/)).toBeInTheDocument();
+    expect(screen.getByText('Not in executor')).toBeInTheDocument();
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/TaskLogViewer/__tests__/useExecutionEvents.test.tsx b/ui/packages/sep/framework/src/components/TaskLogViewer/__tests__/useExecutionEvents.test.tsx
new file mode 100644
index 00000000000..5e2848341eb
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TaskLogViewer/__tests__/useExecutionEvents.test.tsx
@@ -0,0 +1,330 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { act, renderHook, waitFor } from '@testing-library/react';
+import type { PropsWithChildren } from 'react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { useExecutionEvents } from '../../../hooks/useExecutionEvents';
+import {
+  flushPromises,
+  mockStreamFetch,
+} from '../../../../tests/eventSourceStub';
+
+// Manual mock keeps axios out of the resolution graph.
+// setTokenProvider / getToken are re-implemented with the same stateful semantics.
+// apiClient.get is a vi.fn() that tests configure per-scenario.
+let _tokenProvider: () => string | null = () => null;
+const mockApiGet =
+  vi.fn<(url: string, config: object) => Promise<{ data: unknown[] }>>();
+
+vi.mock('@sep/api', () => ({
+  setTokenProvider: (p: () => string | null) => {
+    _tokenProvider = p;
+  },
+  getToken: () => _tokenProvider(),
+  refreshAccessToken: vi.fn<() => Promise<string | null>>(),
+  emitUnauthorized: vi.fn(),
+  apiClient: {
+    get: (...args: Parameters<typeof mockApiGet>) => mockApiGet(...args),
+    defaults: {},
+  },
+}));
+
+const TEST_TOKEN = 'test-bearer-token';
+
+function createClient(): QueryClient {
+  return new QueryClient({
+    defaultOptions: { queries: { retry: false, gcTime: 0, staleTime: 0 } },
+  });
+}
+
+function makeWrapper(client: QueryClient) {
+  return ({ children }: PropsWithChildren) => (
+    <QueryClientProvider client={client}>{children}</QueryClientProvider>
+  );
+}
+
+describe('useExecutionEvents', () => {
+  let mock: ReturnType<typeof mockStreamFetch>;
+
+  beforeEach(() => {
+    mock = mockStreamFetch();
+    mock.install();
+    _tokenProvider = () => TEST_TOKEN;
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.clearAllMocks();
+  });
+
+  describe('running tasks (SSE)', () => {
+    it('fetches /stream-logs/{id}/execution-events with Bearer token', async () => {
+      const wrapper = makeWrapper(createClient());
+      renderHook(() => useExecutionEvents(42, true), { wrapper });
+      await flushPromises();
+
+      expect(mock.fetchSpy).toHaveBeenCalledTimes(1);
+      const [url] = mock.fetchSpy.mock.calls[0];
+      const urlStr = typeof url === 'string' ? url : (url as URL).href;
+      expect(urlStr).toBe('/stream-logs/42/execution-events');
+      // Headers instance lowercases names; stub normalises via Object.fromEntries(headers.entries())
+      expect(mock.pending[0].requestHeaders.authorization).toBe(
+        `Bearer ${TEST_TOKEN}`
+      );
+    });
+
+    it('accumulates events and groups them by step', async () => {
+      const wrapper = makeWrapper(createClient());
+      const { result } = renderHook(() => useExecutionEvents(1, true), {
+        wrapper,
+      });
+      await flushPromises();
+
+      const handle = mock.pending[0];
+
+      act(() => {
+        handle.pushMessage({
+          timestamp: 't1',
+          type: 'started',
+          description: 'A',
+          step: 'setup',
+        });
+        handle.pushMessage({
+          timestamp: 't2',
+          type: 'progress',
+          description: 'B',
+          step: 'setup',
+        });
+        handle.pushMessage({
+          timestamp: 't3',
+          type: 'started',
+          description: 'C',
+          step: 'test',
+        });
+      });
+
+      await waitFor(() => expect(result.current.events).toHaveLength(3));
+
+      expect(result.current.stepOrder).toEqual(['setup', 'test']);
+      expect(result.current.eventsByStep.setup).toHaveLength(2);
+      expect(result.current.eventsByStep.test).toHaveLength(1);
+    });
+
+    it('dedupes events with the same composite key', async () => {
+      const wrapper = makeWrapper(createClient());
+      const { result } = renderHook(() => useExecutionEvents(1, true), {
+        wrapper,
+      });
+      await flushPromises();
+
+      const handle = mock.pending[0];
+      const ev = {
+        timestamp: 't',
+        type: 'started',
+        description: 'A',
+        step: 'x',
+      };
+
+      act(() => {
+        handle.pushMessage(ev);
+        handle.pushMessage(ev); // duplicate
+        handle.pushMessage({ ...ev, description: 'B' }); // different → new key
+      });
+
+      await waitFor(() => expect(result.current.events).toHaveLength(2));
+    });
+
+    it('buckets events without a step under the stepless key', async () => {
+      const wrapper = makeWrapper(createClient());
+      const { result } = renderHook(() => useExecutionEvents(1, true), {
+        wrapper,
+      });
+      await flushPromises();
+
+      const handle = mock.pending[0];
+
+      act(() => {
+        handle.pushMessage({
+          timestamp: 't1',
+          type: 'started',
+          description: 'A',
+        });
+        handle.pushMessage({
+          timestamp: 't2',
+          type: 'started',
+          description: 'B',
+          step: null,
+        });
+      });
+
+      await waitFor(() => expect(result.current.events).toHaveLength(2));
+
+      expect(result.current.stepOrder).toEqual(['']);
+      expect(result.current.eventsByStep['']).toHaveLength(2);
+    });
+
+    it('handles finish by stopping loading and stopping the stream', async () => {
+      const wrapper = makeWrapper(createClient());
+      const { result } = renderHook(() => useExecutionEvents(1, true), {
+        wrapper,
+      });
+      await flushPromises();
+
+      const handle = mock.pending[0];
+
+      act(() => {
+        handle.pushNamed('finish', { status: 'success' });
+      });
+
+      await waitFor(() => expect(result.current.isLoading).toBe(false));
+    });
+
+    it('handles sep-error by setting error and stopping the stream', async () => {
+      const wrapper = makeWrapper(createClient());
+      const { result } = renderHook(() => useExecutionEvents(1, true), {
+        wrapper,
+      });
+      await flushPromises();
+
+      const handle = mock.pending[0];
+
+      act(() => {
+        handle.pushNamed('sep-error', { code: 500, detail: 'boom' });
+      });
+
+      await waitFor(() => expect(result.current.error).toBeDefined());
+    });
+
+    it('surfaces a terminal error when the stream closes unexpectedly', async () => {
+      const wrapper = makeWrapper(createClient());
+      const { result } = renderHook(() => useExecutionEvents(1, true), {
+        wrapper,
+      });
+      await flushPromises();
+
+      const handle = mock.pending[0];
+
+      act(() => {
+        handle.close();
+      });
+
+      await waitFor(() => expect(result.current.isLoading).toBe(false));
+    });
+
+    it('aborts the fetch on unmount', async () => {
+      const wrapper = makeWrapper(createClient());
+      const { unmount } = renderHook(() => useExecutionEvents(1, true), {
+        wrapper,
+      });
+      await flushPromises();
+
+      unmount();
+
+      expect(mock.pending[0].signal?.aborted).toBe(true);
+    });
+  });
+
+  describe('completed tasks (REST via apiClient)', () => {
+    it('calls /execution-events/{id} via apiClient and surfaces events', async () => {
+      mockApiGet.mockResolvedValue({
+        data: [
+          { timestamp: 't1', type: 'started', description: 'A', step: 'setup' },
+          {
+            timestamp: 't2',
+            type: 'completed',
+            description: 'B',
+            step: 'setup',
+          },
+        ],
+      } as never);
+
+      const wrapper = makeWrapper(createClient());
+      const { result } = renderHook(() => useExecutionEvents(7, false), {
+        wrapper,
+      });
+
+      await waitFor(() => expect(result.current.events).toHaveLength(2));
+
+      // Verify apiClient.get was called with the right URL and baseURL escape
+      expect(mockApiGet).toHaveBeenCalledWith(
+        '/execution-events/7',
+        expect.objectContaining({ baseURL: '' })
+      );
+      expect(result.current.stepOrder).toEqual(['setup']);
+      // SSE must not have been opened for a completed task
+      expect(mock.fetchSpy).not.toHaveBeenCalled();
+    });
+
+    it('surfaces an error when the REST response fails', async () => {
+      mockApiGet.mockRejectedValue(new Error('Request failed with status 401'));
+
+      const wrapper = makeWrapper(createClient());
+      const { result } = renderHook(() => useExecutionEvents(7, false), {
+        wrapper,
+      });
+
+      await waitFor(() => expect(result.current.error).toBeDefined());
+      expect(result.current.events).toEqual([]);
+    });
+
+    it('does not fetch when taskHistoryId is missing', () => {
+      const wrapper = makeWrapper(createClient());
+      renderHook(() => useExecutionEvents(undefined, false), { wrapper });
+
+      expect(mockApiGet).not.toHaveBeenCalled();
+      expect(mock.fetchSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('transition', () => {
+    it('switches from SSE to REST when isRunning flips to false', async () => {
+      mockApiGet.mockResolvedValue({
+        data: [
+          {
+            timestamp: 't-final',
+            type: 'completed',
+            description: 'done',
+            step: 'x',
+          },
+        ],
+      } as never);
+
+      const wrapper = makeWrapper(createClient());
+      const { rerender, result } = renderHook(
+        ({ running }: { running: boolean }) => useExecutionEvents(9, running),
+        { wrapper, initialProps: { running: true } }
+      );
+
+      await flushPromises();
+      const firstHandle = mock.pending[0];
+      expect(firstHandle).toBeDefined();
+
+      rerender({ running: false });
+
+      // SSE aborted after isRunning flip
+      expect(firstHandle.signal?.aborted).toBe(true);
+
+      await waitFor(() => expect(result.current.events).toHaveLength(1));
+      expect(mockApiGet).toHaveBeenCalledWith(
+        '/execution-events/9',
+        expect.objectContaining({ baseURL: '' })
+      );
+    });
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/TaskLogViewer/__tests__/useTaskLogs.test.ts b/ui/packages/sep/framework/src/components/TaskLogViewer/__tests__/useTaskLogs.test.ts
new file mode 100644
index 00000000000..31301fd948b
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TaskLogViewer/__tests__/useTaskLogs.test.ts
@@ -0,0 +1,409 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { act, renderHook, waitFor } from '@testing-library/react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { useTaskLogs } from '../../../hooks/useTaskLogs';
+import {
+  flushPromises,
+  mockStreamFetch,
+} from '../../../../tests/eventSourceStub';
+
+// Manual mock keeps axios out of the resolution graph.
+// setTokenProvider / getToken are re-implemented with the same stateful semantics.
+let _tokenProvider: () => string | null = () => null;
+vi.mock('@sep/api', () => ({
+  setTokenProvider: (p: () => string | null) => {
+    _tokenProvider = p;
+  },
+  getToken: () => _tokenProvider(),
+  refreshAccessToken: vi.fn<() => Promise<string | null>>(),
+  emitUnauthorized: vi.fn(),
+}));
+
+const TEST_TOKEN = 'test-bearer-token';
+
+describe('useTaskLogs', () => {
+  let mock: ReturnType<typeof mockStreamFetch>;
+
+  beforeEach(() => {
+    mock = mockStreamFetch();
+    mock.install();
+    _tokenProvider = () => TEST_TOKEN;
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.clearAllMocks();
+  });
+
+  it('fetches /stream-logs/{id} with Bearer token', async () => {
+    renderHook(() => useTaskLogs(42));
+    await flushPromises();
+
+    expect(mock.fetchSpy).toHaveBeenCalledTimes(1);
+    const [url] = mock.fetchSpy.mock.calls[0];
+    const urlStr = typeof url === 'string' ? url : (url as URL).href;
+    expect(urlStr).toBe('/stream-logs/42');
+    // Headers instance lowercases names; stub normalises via Object.fromEntries(headers.entries())
+    expect(mock.pending[0].requestHeaders.authorization).toBe(
+      `Bearer ${TEST_TOKEN}`
+    );
+  });
+
+  it('includes ?tail= when tail is set', async () => {
+    renderHook(() => useTaskLogs(42, 1000));
+    await flushPromises();
+
+    const [url] = mock.fetchSpy.mock.calls[0];
+    const urlStr = typeof url === 'string' ? url : (url as URL).href;
+    expect(urlStr).toBe('/stream-logs/42?tail=1000');
+  });
+
+  it('omits tail query param when tail is undefined (All)', async () => {
+    renderHook(() => useTaskLogs(42, undefined));
+    await flushPromises();
+
+    const [url] = mock.fetchSpy.mock.calls[0];
+    const urlStr = typeof url === 'string' ? url : (url as URL).href;
+    expect(urlStr).toBe('/stream-logs/42');
+  });
+
+  it('opens a fresh fetch when tail changes', async () => {
+    const { rerender } = renderHook(
+      ({ tail }: { tail?: number }) => useTaskLogs(1, tail),
+      {
+        initialProps: { tail: 1000 as number | undefined },
+      }
+    );
+    await flushPromises();
+
+    expect(mock.fetchSpy).toHaveBeenCalledTimes(1);
+    let urlStr =
+      typeof mock.fetchSpy.mock.calls[0][0] === 'string'
+        ? mock.fetchSpy.mock.calls[0][0]
+        : (mock.fetchSpy.mock.calls[0][0] as URL).href;
+    expect(urlStr).toBe('/stream-logs/1?tail=1000');
+
+    rerender({ tail: 5000 });
+    await flushPromises();
+
+    expect(mock.fetchSpy).toHaveBeenCalledTimes(2);
+    urlStr =
+      typeof mock.fetchSpy.mock.calls[1][0] === 'string'
+        ? mock.fetchSpy.mock.calls[1][0]
+        : (mock.fetchSpy.mock.calls[1][0] as URL).href;
+    expect(urlStr).toBe('/stream-logs/1?tail=5000');
+  });
+
+  it('omits Authorization header when no token is available', async () => {
+    _tokenProvider = () => null;
+    renderHook(() => useTaskLogs(42));
+    await flushPromises();
+
+    expect(mock.pending[0].requestHeaders.authorization).toBeUndefined();
+  });
+
+  it('accumulates log text grouped by step and type', async () => {
+    const { result } = renderHook(() => useTaskLogs(1));
+    await flushPromises();
+
+    const handle = mock.pending[0];
+
+    act(() => {
+      handle.pushMessage({
+        msg: 'hello ',
+        step: 'step1',
+        type: 'stdout',
+        offset: 1,
+      });
+      handle.pushMessage({
+        msg: 'world',
+        step: 'step1',
+        type: 'stdout',
+        offset: 2,
+      });
+      handle.pushMessage({
+        msg: 'boom',
+        step: 'step1',
+        type: 'stderr',
+        offset: 1,
+      });
+      handle.pushMessage({
+        msg: 'more',
+        step: 'step2',
+        type: 'stdout',
+        offset: 1,
+      });
+    });
+
+    await waitFor(() =>
+      expect(result.current.textByStep.step2?.stdout).toBe('more')
+    );
+
+    expect(result.current.textByStep.step1.stdout).toBe('hello world');
+    expect(result.current.textByStep.step1.stderr).toBe('boom');
+    expect(result.current.stepOrder).toEqual(['step1', 'step2']);
+  });
+
+  it('accepts the initial message when its offset is 0', async () => {
+    const { result } = renderHook(() => useTaskLogs(1));
+    await flushPromises();
+
+    const handle = mock.pending[0];
+    act(() => {
+      handle.pushMessage({
+        msg: 'first ',
+        step: 's',
+        type: 'stdout',
+        offset: 0,
+      });
+      handle.pushMessage({
+        msg: 'second',
+        step: 's',
+        type: 'stdout',
+        offset: 1,
+      });
+    });
+
+    await waitFor(() =>
+      expect(result.current.textByStep.s?.stdout).toBe('first second')
+    );
+  });
+
+  it('preserves empty-string log chunks and advances the offset', async () => {
+    const { result } = renderHook(() => useTaskLogs(1));
+    await flushPromises();
+
+    const handle = mock.pending[0];
+    act(() => {
+      handle.pushMessage({ msg: 'a', step: 's', type: 'stdout', offset: 0 });
+      handle.pushMessage({ msg: '', step: 's', type: 'stdout', offset: 1 });
+      handle.pushMessage({ msg: 'b', step: 's', type: 'stdout', offset: 2 });
+    });
+
+    await waitFor(() => expect(result.current.textByStep.s?.stdout).toBe('ab'));
+
+    // Offset 1 was consumed — duplicate at offset 1 must be ignored
+    act(() => {
+      handle.pushMessage({ msg: 'dup', step: 's', type: 'stdout', offset: 1 });
+    });
+    await flushPromises();
+
+    expect(result.current.textByStep.s.stdout).toBe('ab');
+  });
+
+  it('dedupes messages whose offset is not greater than the last seen', async () => {
+    const { result } = renderHook(() => useTaskLogs(1));
+    await flushPromises();
+
+    const handle = mock.pending[0];
+    act(() => {
+      handle.pushMessage({ msg: 'a', step: 's', type: 'stdout', offset: 5 });
+      handle.pushMessage({ msg: 'b', step: 's', type: 'stdout', offset: 5 }); // dup
+      handle.pushMessage({ msg: 'c', step: 's', type: 'stdout', offset: 4 }); // stale
+      handle.pushMessage({ msg: 'd', step: 's', type: 'stdout', offset: 6 });
+    });
+
+    await waitFor(() => expect(result.current.textByStep.s?.stdout).toBe('ad'));
+  });
+
+  it('ignores malformed payloads', async () => {
+    const { result } = renderHook(() => useTaskLogs(1));
+    await flushPromises();
+
+    const handle = mock.pending[0];
+    act(() => {
+      handle.pushMessage({ step: 's', type: 'stdout', offset: 2 }); // missing msg
+      handle.pushMessage({ msg: 'x', step: 's', type: 'stdout' }); // missing offset
+      handle.pushMessage({ msg: 'x', step: '', type: 'stdout', offset: 1 }); // empty step
+      handle.pushMessage({ msg: 'x', step: 's', type: '', offset: 1 }); // empty type
+    });
+    await flushPromises();
+
+    expect(result.current.textByStep).toEqual({});
+  });
+
+  it('handles finish event by setting status and stopping the stream', async () => {
+    const { result } = renderHook(() => useTaskLogs(1));
+    await flushPromises();
+
+    const handle = mock.pending[0];
+    act(() => {
+      handle.pushNamed('finish', { status: 'success' });
+    });
+
+    await waitFor(() => expect(result.current.streamStatus).toBe('finished'));
+    expect(result.current.finishStatus).toBe('success');
+  });
+
+  it('handles sep-error event with a 410 payload', async () => {
+    const { result } = renderHook(() => useTaskLogs(1));
+    await flushPromises();
+
+    const handle = mock.pending[0];
+    act(() => {
+      handle.pushNamed('sep-error', {
+        code: 410,
+        detail: { resource_type: 'job', job_id: 'J', message: 'gone' },
+      });
+    });
+
+    await waitFor(() => expect(result.current.streamStatus).toBe('error'));
+    expect(result.current.error?.code).toBe(410);
+  });
+
+  it('surfaces a terminal error when the server closes the stream without a finish event', async () => {
+    const { result } = renderHook(() => useTaskLogs(1));
+    await flushPromises();
+
+    const handle = mock.pending[0];
+    act(() => {
+      handle.close();
+    });
+
+    await waitFor(() => expect(result.current.streamStatus).toBe('error'));
+    expect(result.current.error).toBeDefined();
+  });
+
+  it('aborts the fetch on unmount', async () => {
+    const { unmount } = renderHook(() => useTaskLogs(1));
+    await flushPromises();
+
+    unmount();
+
+    // fetchEventSource propagates inputSignal.abort() to its internal
+    // curRequestController synchronously via the abort event listener.
+    expect(mock.pending[0].signal?.aborted).toBe(true);
+  });
+
+  it('opens a fresh fetch when the task id changes', async () => {
+    const { rerender } = renderHook(({ id }) => useTaskLogs(id), {
+      initialProps: { id: 1 as number | string },
+    });
+    await flushPromises();
+
+    expect(mock.fetchSpy).toHaveBeenCalledTimes(1);
+
+    rerender({ id: 2 });
+    await flushPromises();
+
+    expect(mock.fetchSpy).toHaveBeenCalledTimes(2);
+    const secondUrl = mock.fetchSpy.mock.calls[1][0];
+    const urlStr =
+      typeof secondUrl === 'string' ? secondUrl : (secondUrl as URL).href;
+    expect(urlStr).toBe('/stream-logs/2');
+  });
+
+  it('refreshes token on 401 and reconnects with the new token', async () => {
+    const { refreshAccessToken } = await import('@sep/api');
+    vi.mocked(refreshAccessToken).mockResolvedValue('new-token');
+
+    // First fetch returns 401; onopen calls refreshAccessToken() → new token →
+    // throws StreamRetriableAfterRefresh → onerror returns 0 (immediate retry).
+    mock.queueResponse({ status: 401 });
+
+    renderHook(() => useTaskLogs(1));
+
+    // onerror returns 0 so the library retries immediately (setTimeout 0 ms).
+    // waitFor polls until the second fetch appears.
+    await waitFor(() =>
+      expect(mock.fetchSpy.mock.calls.length).toBeGreaterThanOrEqual(2)
+    );
+
+    // pending[0] is the successful retry (non-200 responses skip pending); headers are lowercased
+    expect(mock.pending[0].requestHeaders.authorization).toBe(
+      'Bearer new-token'
+    );
+  });
+
+  it('surfaces an error and stops retrying when token refresh returns null', async () => {
+    const { refreshAccessToken } = await import('@sep/api');
+    vi.mocked(refreshAccessToken).mockResolvedValue(null);
+
+    mock.queueResponse({ status: 401 });
+
+    const { result } = renderHook(() => useTaskLogs(1));
+
+    await waitFor(() => expect(result.current.streamStatus).toBe('error'));
+    // Exactly one fetch: refresh failed → StreamFatalError → no retry.
+    expect(mock.fetchSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('surfaces an error and stops retrying on a non-401 open failure', async () => {
+    mock.queueResponse({ status: 503 });
+
+    const { result } = renderHook(() => useTaskLogs(1));
+
+    await waitFor(() => expect(result.current.streamStatus).toBe('error'));
+    expect(mock.fetchSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not write state from a stale aborted stream after id changes', async () => {
+    const { rerender, result } = renderHook(({ id }) => useTaskLogs(id), {
+      initialProps: { id: 1 as number | string },
+    });
+    await flushPromises();
+
+    const firstHandle = mock.pending[0];
+
+    // Change id before the first stream emits anything
+    rerender({ id: 2 });
+    await flushPromises();
+
+    // Push a message on the old (aborted) stream
+    act(() => {
+      firstHandle.pushMessage({
+        msg: 'stale',
+        step: 's',
+        type: 'stdout',
+        offset: 1,
+      });
+    });
+    await flushPromises();
+
+    // New stream has no data; stale message must not appear
+    expect(result.current.textByStep).toEqual({});
+  });
+
+  it('does not write state from a stale aborted stream after tail changes', async () => {
+    const { rerender, result } = renderHook(
+      ({ tail }) => useTaskLogs(1, tail),
+      {
+        initialProps: { tail: 1000 as number | undefined },
+      }
+    );
+    await flushPromises();
+
+    const firstHandle = mock.pending[0];
+
+    rerender({ tail: 100 });
+    await flushPromises();
+
+    act(() => {
+      firstHandle.pushMessage({
+        msg: 'stale',
+        step: 's',
+        type: 'stdout',
+        offset: 1,
+      });
+    });
+    await flushPromises();
+
+    expect(result.current.textByStep).toEqual({});
+  });
+});
diff --git a/ui/packages/sep/framework/src/components/TaskLogViewer/index.ts b/ui/packages/sep/framework/src/components/TaskLogViewer/index.ts
new file mode 100644
index 00000000000..6c47bd333d3
--- /dev/null
+++ b/ui/packages/sep/framework/src/components/TaskLogViewer/index.ts
@@ -0,0 +1,27 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { TaskLogViewer } from './TaskLogViewer';
+export type { TaskLogViewerProps } from './TaskLogViewer';
+export { DEFAULT_LOG_TAIL_LINES, LOG_TAIL_LINE_OPTIONS } from './TaskLogViewer';
+export type { LogTailLineChoice } from './TaskLogViewer';
+export { LogStepTabs } from './LogStepTabs';
+export { LogOutputPane } from './LogOutputPane';
+export { ExecutionEventsPanel } from './ExecutionEventsPanel';
+export { StreamErrorBlock } from './StreamErrorBlock';
+export { StatusBadge } from './StatusBadge';
+export type { BadgeStatus } from './StatusBadge';
diff --git a/ui/packages/sep/framework/src/constants.ts b/ui/packages/sep/framework/src/constants.ts
new file mode 100644
index 00000000000..00d1fc14e9e
--- /dev/null
+++ b/ui/packages/sep/framework/src/constants.ts
@@ -0,0 +1,20 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+// Project-prefixed class applied to MRT paper containers so theme.ts can scope
+// overrides without using MUI's reserved "Mui*" prefix.
+export const SEP_TABLE_CLASS = 'SepTable';
diff --git a/ui/packages/sep/framework/src/hooks/index.ts b/ui/packages/sep/framework/src/hooks/index.ts
new file mode 100644
index 00000000000..015355c920c
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/index.ts
@@ -0,0 +1,89 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export { useTaskLogs } from './useTaskLogs';
+export type {
+  TaskLogsState,
+  StepText,
+  LogType,
+  FinishStatus,
+  StreamError,
+  StreamStatus,
+} from './useTaskLogs';
+
+export { useExecutionEvents } from './useExecutionEvents';
+export type {
+  ExecutionEvent,
+  ExecutionEventsState,
+} from './useExecutionEvents';
+
+export { useLogDownload } from './useLogDownload';
+export type { DownloadLog } from './useLogDownload';
+
+export { useServices } from './useServices';
+export { useResolvedServiceField } from './useResolvedServiceField';
+export type { ResolvedServiceField } from './useResolvedServiceField';
+export type {
+  ServiceNodeOption,
+  ServiceOption,
+  ServiceType,
+  UseServicesOptions,
+} from './useServices';
+export { useSchemas } from './useSchemas';
+export type { SchemaOption, UseSchemasOptions } from './useSchemas';
+export { useTables } from './useTables';
+export type { TableOption, UseTablesOptions } from './useTables';
+export { useHosts } from './useHosts';
+export type { HostOption, UseHostsOptions } from './useHosts';
+export { useRemoteChoices } from './useRemoteChoices';
+export type { UseRemoteChoicesOptions } from './useRemoteChoices';
+
+export {
+  useTaskHistory,
+  useTaskHistoryByName,
+  useTaskHistoryByNames,
+  useStopTaskHistory,
+  useExecuteTask,
+  isRunningStatus,
+  RUNNING_STATUSES,
+} from './useTaskHistory';
+export type {
+  TaskHistoryStatus,
+  TaskHistoryEntry,
+  PaginatedTaskHistory,
+  UseTaskHistoryOptions,
+  TaskExecuteBody,
+} from './useTaskHistory';
+
+export { useTaskHistoryFiles } from './useTaskHistoryFiles';
+export type {
+  FileMetadata,
+  TaskHistoryFilesMap,
+  UseTaskHistoryFilesOptions,
+} from './useTaskHistoryFiles';
+
+export { useTaskFileDownload } from './useTaskFileDownload';
+export type { TaskFileDownloadParams } from './useTaskFileDownload';
+
+export { useSnippetPluginSchema } from './useSnippetPluginSchema';
+export { useSnippetPluginExecution } from './useSnippetPluginExecution';
+export type { UseSnippetPluginExecutionOptions } from './useSnippetPluginExecution';
+
+export { useTaskStats } from './useTaskStats';
+export type { TaskStatsView } from './useTaskStats';
+
+export { sepRetry } from './sepRetry';
diff --git a/ui/packages/sep/framework/src/hooks/sepRetry.test.ts b/ui/packages/sep/framework/src/hooks/sepRetry.test.ts
new file mode 100644
index 00000000000..7966f4d401b
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/sepRetry.test.ts
@@ -0,0 +1,66 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { ApiError, type ApiErrorKind } from '@sep/api';
+
+import { sepRetry } from './sepRetry';
+
+function httpError(status: number): ApiError {
+  return new ApiError({ kind: 'http', status, message: `HTTP ${status}` });
+}
+
+function nonHttpError(kind: Exclude<ApiErrorKind, 'http'>): ApiError {
+  return new ApiError({ kind, message: kind });
+}
+
+describe('sepRetry', () => {
+  it.each([401, 403, 404, 502])(
+    'does not retry deterministic %i responses',
+    (status) => {
+      expect(sepRetry(0, httpError(status))).toBe(false);
+      expect(sepRetry(1, httpError(status))).toBe(false);
+      expect(sepRetry(5, httpError(status))).toBe(false);
+    }
+  );
+
+  it('retries transient 5xx (non-502) up to a total of three attempts', () => {
+    const err = httpError(500);
+    expect(sepRetry(0, err)).toBe(true);
+    expect(sepRetry(1, err)).toBe(true);
+    expect(sepRetry(2, err)).toBe(false);
+  });
+
+  it('retries 503 / 504 as transient', () => {
+    expect(sepRetry(0, httpError(503))).toBe(true);
+    expect(sepRetry(0, httpError(504))).toBe(true);
+  });
+
+  it('retries network / timeout / unknown ApiErrors', () => {
+    expect(sepRetry(0, nonHttpError('network'))).toBe(true);
+    expect(sepRetry(1, nonHttpError('timeout'))).toBe(true);
+    expect(sepRetry(0, nonHttpError('unknown'))).toBe(true);
+  });
+
+  it('does not retry canceled requests', () => {
+    expect(sepRetry(0, nonHttpError('canceled'))).toBe(false);
+    expect(sepRetry(1, nonHttpError('canceled'))).toBe(false);
+  });
+
+  it('retries plain Error (non-ApiError) up to the same cap', () => {
+    const err = new Error('boom');
+    expect(sepRetry(0, err)).toBe(true);
+    expect(sepRetry(1, err)).toBe(true);
+    expect(sepRetry(2, err)).toBe(false);
+  });
+
+  it('respects the count cap regardless of count overflow', () => {
+    expect(sepRetry(100, httpError(500))).toBe(false);
+  });
+});
diff --git a/ui/packages/sep/framework/src/hooks/sepRetry.ts b/ui/packages/sep/framework/src/hooks/sepRetry.ts
new file mode 100644
index 00000000000..de4ab30a3fc
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/sepRetry.ts
@@ -0,0 +1,41 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { ApiError } from '@sep/api';
+
+/**
+ * Shared React Query `retry` predicate for SEP API hooks.
+ *
+ * Never retry on auth failures (401/403), missing resources (404),
+ * upstream-proxy failures (502 from `/api/sep/*` gateway routes), or
+ * user-driven aborts (``kind === 'canceled'``) — those are deterministic
+ * signals that won't change between retries. For anything else (transient
+ * network blips, 5xx other than 502), retry up to twice for a total of 3
+ * attempts.
+ */
+export function sepRetry(count: number, err: Error): boolean {
+  if (err instanceof ApiError) {
+    const { status, kind } = err;
+    if (status === 401 || status === 403 || status === 404 || status === 502) {
+      return false;
+    }
+    if (kind === 'canceled') {
+      return false;
+    }
+  }
+  return count < 2;
+}
diff --git a/ui/packages/sep/framework/src/hooks/useExecutionEvents.ts b/ui/packages/sep/framework/src/hooks/useExecutionEvents.ts
new file mode 100644
index 00000000000..b2faa668f8a
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/useExecutionEvents.ts
@@ -0,0 +1,301 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import {
+  EventStreamContentType,
+  fetchEventSource,
+} from '@microsoft/fetch-event-source';
+import {
+  apiClient,
+  emitUnauthorized,
+  getToken,
+  refreshAccessToken,
+} from '@sep/api';
+import { useQuery } from '@tanstack/react-query';
+import { useEffect, useMemo, useRef, useState } from 'react';
+
+export interface ExecutionEvent {
+  timestamp: string;
+  type: string;
+  description: string;
+  step?: string | null;
+}
+
+export interface ExecutionEventsState {
+  events: ExecutionEvent[];
+  eventsByStep: Record<string, ExecutionEvent[]>;
+  stepOrder: string[];
+  isLoading: boolean;
+  error?: unknown;
+}
+
+const STEPLESS_KEY = '';
+
+/** Consecutive transient stream failures tolerated before giving up. */
+const MAX_TRANSIENT_STREAM_FAILURES = 5;
+
+// See useTaskLogs.ts for the rationale behind these local sentinel classes.
+class StreamRetriableAfterRefresh extends Error {}
+class StreamFatalError extends Error {}
+
+function compositeKey(ev: ExecutionEvent): string {
+  return `${ev.timestamp ?? ''}|${ev.type ?? ''}|${ev.description ?? ''}|${ev.step ?? ''}`;
+}
+
+function groupByStep(events: ExecutionEvent[]): {
+  eventsByStep: Record<string, ExecutionEvent[]>;
+  stepOrder: string[];
+} {
+  const eventsByStep: Record<string, ExecutionEvent[]> = {};
+  const stepOrder: string[] = [];
+  for (const ev of events) {
+    const step = ev.step ?? '';
+    const key = step !== '' ? String(step) : STEPLESS_KEY;
+    if (!eventsByStep[key]) {
+      eventsByStep[key] = [];
+      stepOrder.push(key);
+    }
+    eventsByStep[key].push(ev);
+  }
+  return { eventsByStep, stepOrder };
+}
+
+async function fetchExecutionEvents(
+  taskHistoryId: string
+): Promise<ExecutionEvent[]> {
+  // Use apiClient (Bearer interceptor + 401-refresh) with baseURL: '' to reach
+  // the legacy /execution-events/{id} route that is not under /api.
+  const res = await apiClient.get<ExecutionEvent[]>(
+    `/execution-events/${taskHistoryId}`,
+    {
+      baseURL: '',
+    }
+  );
+  return Array.isArray(res.data) ? res.data : [];
+}
+
+/**
+ * Execution events for a task history.
+ *
+ * Running tasks stream via SSE /stream-logs/{id}/execution-events.
+ * Completed tasks fetch REST /execution-events/{id} through react-query for
+ * consistent error/loading/cache semantics with the rest of @sep/framework.
+ *
+ * Both paths attach the Bearer token from @sep/api's token provider so the
+ * SPA OAuth session is honoured without a session cookie.
+ */
+export function useExecutionEvents(
+  taskHistoryId: number | string | undefined,
+  isRunning: boolean
+): ExecutionEventsState {
+  const idStr =
+    taskHistoryId === undefined ||
+    taskHistoryId === null ||
+    taskHistoryId === ''
+      ? undefined
+      : encodeURIComponent(String(taskHistoryId));
+
+  // ── Completed tasks: REST via react-query ─────────────────────────────
+  const query = useQuery<ExecutionEvent[]>({
+    queryKey: ['execution-events', idStr],
+    queryFn: () => fetchExecutionEvents(idStr as string),
+    enabled: !isRunning && idStr !== undefined,
+  });
+
+  // ── Running tasks: SSE ────────────────────────────────────────────────
+  const [sseEvents, setSseEvents] = useState<ExecutionEvent[]>([]);
+  const [sseError, setSseError] = useState<unknown>(undefined);
+  const [sseLoading, setSseLoading] = useState(false);
+
+  const seenKeysRef = useRef<Set<string>>(new Set());
+
+  useEffect(() => {
+    if (!isRunning || idStr === undefined) {
+      return;
+    }
+
+    seenKeysRef.current = new Set();
+    setSseEvents([]);
+    setSseError(undefined);
+    setSseLoading(true);
+
+    const ctrl = new AbortController();
+    let currentToken = getToken() ?? '';
+    let refreshAttempted = false;
+    // Guards state setters so stale callbacks from an aborted stream cannot
+    // write into a subsequent stream's state (e.g. on rapid id changes).
+    let disposed = false;
+    // Tracks intentional terminal events (finish / sep-error) so onclose can
+    // distinguish a clean shutdown from an unexpected connection drop.
+    let terminatedCleanly = false;
+    // Consecutive transient failures, reset on every successful open. Bounds the
+    // otherwise-infinite fetchEventSource retry loop.
+    let transientFailures = 0;
+
+    fetchEventSource(`/stream-logs/${idStr}/execution-events`, {
+      signal: ctrl.signal,
+      openWhenHidden: true,
+
+      fetch: (input, init) => {
+        const headers = new Headers(init?.headers as HeadersInit | undefined);
+        if (currentToken) {
+          headers.set('Authorization', `Bearer ${currentToken}`);
+        }
+        return globalThis.fetch(input as RequestInfo, { ...init, headers });
+      },
+
+      onopen: async (response) => {
+        const contentType = response.headers.get('content-type') ?? '';
+        if (response.ok && contentType.includes(EventStreamContentType)) {
+          refreshAttempted = false;
+          transientFailures = 0;
+          return;
+        }
+        let isAuthFailure = false;
+        if (response.ok) {
+          isAuthFailure = true;
+        } else if (response.status === 401 && !refreshAttempted) {
+          refreshAttempted = true;
+          const newToken = await refreshAccessToken();
+          if (newToken) {
+            currentToken = newToken;
+            throw new StreamRetriableAfterRefresh();
+          }
+          isAuthFailure = true;
+        } else if (response.status === 401) {
+          isAuthFailure = true;
+        }
+        if (isAuthFailure) {
+          emitUnauthorized();
+        }
+        const message = response.ok
+          ? `Stream endpoint returned non-SSE content: ${contentType || 'unknown'}`
+          : `Stream open failed with status ${response.status}`;
+        // Terminal open failure — set error, abort, throw fatal sentinel so
+        // onerror re-throws and permanently stops the retry loop.
+        if (!disposed) {
+          setSseError({ message });
+          setSseLoading(false);
+        }
+        terminatedCleanly = true;
+        ctrl.abort();
+        throw new StreamFatalError(message);
+      },
+
+      onmessage: (ev) => {
+        if (disposed || ev.data === '') {
+          return;
+        }
+
+        if (ev.event === 'finish') {
+          terminatedCleanly = true;
+          setSseLoading(false);
+          ctrl.abort();
+          return;
+        }
+
+        if (ev.event === 'sep-error') {
+          terminatedCleanly = true;
+          let payload: unknown = ev.data;
+          try {
+            payload = JSON.parse(ev.data);
+          } catch {
+            // keep raw
+          }
+          setSseError(payload);
+          setSseLoading(false);
+          ctrl.abort();
+          return;
+        }
+
+        // Default message — execution event
+        let payload: ExecutionEvent;
+        try {
+          payload = JSON.parse(ev.data) as ExecutionEvent;
+        } catch {
+          return;
+        }
+        const key = compositeKey(payload);
+        if (seenKeysRef.current.has(key)) {
+          return;
+        }
+        seenKeysRef.current.add(key);
+        setSseEvents((prev) => [...prev, payload]);
+        setSseLoading(false);
+      },
+
+      onerror: (err): number | undefined => {
+        if (err instanceof StreamRetriableAfterRefresh) {
+          return 0;
+        }
+        if (err instanceof StreamFatalError) {
+          // State already set in onopen; re-throw to stop the retry loop.
+          throw err;
+        }
+        // Transient network error — let the library retry with backoff silently
+        // while the failure count stays under the cap. Do not set sseError: the
+        // previous events remain visible and the next successful open resumes
+        // streaming.
+        transientFailures += 1;
+        if (transientFailures < MAX_TRANSIENT_STREAM_FAILURES) {
+          return undefined;
+        }
+        // Cap reached: a persistently failing endpoint (500, DNS failure) would
+        // otherwise reconnect forever while the panel sits in its loading state,
+        // because nothing here clears it. Surface the failure and re-throw to
+        // stop the retry loop.
+        if (!disposed) {
+          setSseError({
+            message: `Execution events stream failed after ${MAX_TRANSIENT_STREAM_FAILURES} attempts.`,
+          });
+          setSseLoading(false);
+        }
+        terminatedCleanly = true;
+        ctrl.abort();
+        throw err;
+      },
+
+      onclose: () => {
+        if (disposed || terminatedCleanly) {
+          return;
+        }
+        // Stream closed unexpectedly without a finish/sep-error frame.
+        setSseError({ message: 'Execution events stream connection closed.' });
+        setSseLoading(false);
+      },
+    }).catch(() => {
+      // Expected abort on unmount / isRunning flip. StreamFatalError re-thrown
+      // from onerror also lands here; state is already set.
+    });
+
+    return () => {
+      disposed = true;
+      ctrl.abort();
+    };
+  }, [idStr, isRunning]);
+
+  const events = isRunning ? sseEvents : (query.data ?? []);
+  const error = isRunning ? sseError : (query.error ?? undefined);
+  const isLoading = isRunning ? sseLoading : query.isLoading;
+
+  const { eventsByStep, stepOrder } = useMemo(
+    () => groupByStep(events),
+    [events]
+  );
+
+  return { events, eventsByStep, stepOrder, isLoading, error };
+}
diff --git a/ui/packages/sep/framework/src/hooks/useHosts.test.tsx b/ui/packages/sep/framework/src/hooks/useHosts.test.tsx
new file mode 100644
index 00000000000..a693377a1a3
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/useHosts.test.tsx
@@ -0,0 +1,90 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { renderHook, waitFor } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import type { ReactNode } from 'react';
+
+vi.mock('@sep/api', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@sep/api')>()),
+  apiClient: { get: vi.fn(), post: vi.fn() },
+}));
+
+import { ApiError, apiClient } from '@sep/api';
+import { useHosts } from './useHosts';
+
+const mocked = apiClient as unknown as { get: ReturnType<typeof vi.fn> };
+
+function wrapper() {
+  // Use a QueryClient with no `retry` override so the hook-level `retry`
+  // predicate is the only thing governing retries. `retryDelay: 0` keeps
+  // the retry tests fast.
+  const client = new QueryClient({
+    defaultOptions: { queries: { gcTime: 0, staleTime: 0, retryDelay: 0 } },
+  });
+  return ({ children }: { children: ReactNode }) => (
+    <QueryClientProvider client={client}>{children}</QueryClientProvider>
+  );
+}
+
+beforeEach(() => {
+  mocked.get.mockReset();
+});
+
+describe('useHosts retry predicate', () => {
+  it('does not retry on a 502 ApiError (upstream Tasks-API failure)', async () => {
+    mocked.get.mockRejectedValue(
+      new ApiError({ kind: 'http', status: 502, message: 'tasks unreachable' })
+    );
+    const { result } = renderHook(() => useHosts(), { wrapper: wrapper() });
+    await waitFor(() => {
+      expect(result.current.isError).toBe(true);
+    });
+    expect(result.current.error).toBeInstanceOf(ApiError);
+    expect((result.current.error as InstanceType<typeof ApiError>).status).toBe(
+      502
+    );
+    expect(mocked.get).toHaveBeenCalledTimes(1);
+  });
+
+  it.each([
+    ['401', 401],
+    ['403', 403],
+    ['404', 404],
+  ])('does not retry on a %s ApiError', async (_label, status) => {
+    mocked.get.mockRejectedValue(
+      new ApiError({ kind: 'http', status, message: `HTTP ${status}` })
+    );
+    const { result } = renderHook(() => useHosts(), { wrapper: wrapper() });
+    await waitFor(() => {
+      expect(result.current.isError).toBe(true);
+    });
+    expect(mocked.get).toHaveBeenCalledTimes(1);
+  });
+
+  it('retries up to twice on a non-ApiError rejection (network blip)', async () => {
+    mocked.get.mockRejectedValue(new Error('network blip'));
+    const { result } = renderHook(() => useHosts(), { wrapper: wrapper() });
+    await waitFor(() => {
+      expect(result.current.isError).toBe(true);
+    });
+    // Predicate returns `count < 2` for non-ApiError, so React Query calls
+    // queryFn 3 times total (initial + 2 retries) before giving up.
+    expect(mocked.get).toHaveBeenCalledTimes(3);
+  });
+});
diff --git a/ui/packages/sep/framework/src/hooks/useHosts.ts b/ui/packages/sep/framework/src/hooks/useHosts.ts
new file mode 100644
index 00000000000..dfb5d1bed85
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/useHosts.ts
@@ -0,0 +1,60 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useQuery, type UseQueryResult } from '@tanstack/react-query';
+import { apiClient } from '@sep/api';
+import { sepRetry } from './sepRetry';
+
+export interface HostOption {
+  /** Executor node name — the value sent to the dispatch payload as `executor_host`. */
+  id: string;
+  /** Human-readable label: inventory display name when available, else `id`. */
+  name: string;
+  /** Network address reported by the executor. */
+  address: string;
+}
+
+export interface UseHostsOptions {
+  enabled?: boolean;
+}
+
+/**
+ * Fetch executor hosts merged with inventory display names.
+ *
+ * Calls the SEP-side proxy `GET /api/sep/hosts/`, which performs the
+ * Tasks/Inventory merge server-side. Loading and error states are
+ * first-class React Query states. When the Tasks API is unreachable the
+ * route responds with `502` + `{"detail": "<upstream detail>"}`; the axios
+ * interceptor turns that into an `ApiError` whose `.message` carries the
+ * detail, so consumers handle it via React Query's `isError` / `error`
+ * slot — no out-of-band header plumbing.
+ */
+export function useHosts(
+  options: UseHostsOptions = {}
+): UseQueryResult<HostOption[], Error> {
+  const { enabled = true } = options;
+  return useQuery<HostOption[], Error>({
+    queryKey: ['sep', 'hosts'],
+    enabled,
+    staleTime: 60_000,
+    queryFn: async () => {
+      const response = await apiClient.get<HostOption[]>('/sep/hosts/');
+      return response.data;
+    },
+    retry: sepRetry,
+  });
+}
diff --git a/ui/packages/sep/framework/src/hooks/useLogDownload.ts b/ui/packages/sep/framework/src/hooks/useLogDownload.ts
new file mode 100644
index 00000000000..cb1fb765ef3
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/useLogDownload.ts
@@ -0,0 +1,28 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useCallback } from 'react';
+import { downloadBlob } from '../utils/downloadBlob';
+
+export type DownloadLog = (filename: string, text: string) => void;
+
+export function useLogDownload(): DownloadLog {
+  return useCallback((filename: string, text: string) => {
+    const blob = new Blob([text], { type: 'text/plain;charset=utf-8' });
+    downloadBlob(blob, filename);
+  }, []);
+}
diff --git a/ui/packages/sep/framework/src/hooks/useRemoteChoices.test.tsx b/ui/packages/sep/framework/src/hooks/useRemoteChoices.test.tsx
new file mode 100644
index 00000000000..7f6505482cf
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/useRemoteChoices.test.tsx
@@ -0,0 +1,160 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { renderHook, waitFor } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import type { ReactNode } from 'react';
+
+vi.mock('@sep/api', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@sep/api')>()),
+  apiClient: { get: vi.fn(), post: vi.fn() },
+}));
+
+import { apiClient } from '@sep/api';
+import { useRemoteChoices } from './useRemoteChoices';
+
+const mocked = apiClient as unknown as { get: ReturnType<typeof vi.fn> };
+
+function newClient() {
+  return new QueryClient({
+    defaultOptions: { queries: { gcTime: 0, staleTime: 0, retryDelay: 0 } },
+  });
+}
+
+function wrapperFor(client: QueryClient) {
+  return ({ children }: { children: ReactNode }) => (
+    <QueryClientProvider client={client}>{children}</QueryClientProvider>
+  );
+}
+
+beforeEach(() => {
+  mocked.get.mockReset();
+  mocked.get.mockResolvedValue({ data: [{ value: 'a', label: 'A' }] });
+});
+
+describe('useRemoteChoices', () => {
+  it('fetches the endpoint URL when there is no cascade dependency', async () => {
+    const { result } = renderHook(
+      () => useRemoteChoices({ endpointUrl: '/apps/restore/backups' }),
+      {
+        wrapper: wrapperFor(newClient()),
+      }
+    );
+    await waitFor(() => expect(result.current.isSuccess).toBe(true));
+    expect(mocked.get).toHaveBeenCalledWith('/apps/restore/backups');
+    expect(result.current.data).toEqual([{ value: 'a', label: 'A' }]);
+  });
+
+  it('does not fetch until a cascade parent value is present', async () => {
+    const { result, rerender } = renderHook(
+      ({ v }: { v: string | null }) =>
+        useRemoteChoices({
+          endpointUrl: '/apps/restore/backups',
+          dependsOnName: 'cluster',
+          dependsOnValue: v,
+        }),
+      {
+        wrapper: wrapperFor(newClient()),
+        initialProps: { v: null as string | null },
+      }
+    );
+
+    expect(mocked.get).not.toHaveBeenCalled();
+    expect(result.current.fetchStatus).toBe('idle');
+
+    rerender({ v: 'cluster-a' });
+    await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+    expect(mocked.get).toHaveBeenCalledWith(
+      '/apps/restore/backups?cluster=cluster-a'
+    );
+  });
+
+  it('encodes special characters in the cascade value', async () => {
+    renderHook(
+      () =>
+        useRemoteChoices({
+          endpointUrl: '/apps/restore/backups',
+          dependsOnName: 'cluster',
+          dependsOnValue: 'a b/c&d',
+        }),
+      { wrapper: wrapperFor(newClient()) }
+    );
+    await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+    expect(mocked.get).toHaveBeenCalledWith(
+      '/apps/restore/backups?cluster=a+b%2Fc%26d'
+    );
+  });
+
+  it('preserves an existing query string on the endpoint URL', async () => {
+    renderHook(
+      () =>
+        useRemoteChoices({
+          endpointUrl: '/apps/restore/backups?scope=all',
+          dependsOnName: 'cluster',
+          dependsOnValue: 'c1',
+        }),
+      { wrapper: wrapperFor(newClient()) }
+    );
+    await waitFor(() => expect(mocked.get).toHaveBeenCalled());
+    expect(mocked.get).toHaveBeenCalledWith(
+      '/apps/restore/backups?scope=all&cluster=c1'
+    );
+  });
+
+  it('uses distinct cache keys for the same endpoint+value under different dependsOn names', async () => {
+    const client = newClient();
+    const wrapper = wrapperFor(client);
+    renderHook(
+      () =>
+        useRemoteChoices({
+          endpointUrl: '/e',
+          dependsOnName: 'a',
+          dependsOnValue: 'x',
+        }),
+      {
+        wrapper,
+      }
+    );
+    renderHook(
+      () =>
+        useRemoteChoices({
+          endpointUrl: '/e',
+          dependsOnName: 'b',
+          dependsOnValue: 'x',
+        }),
+      {
+        wrapper,
+      }
+    );
+    await waitFor(() => expect(mocked.get).toHaveBeenCalledTimes(2));
+    const urls = mocked.get.mock.calls.map((call) => call[0]);
+    expect(urls).toEqual(expect.arrayContaining(['/e?a=x', '/e?b=x']));
+  });
+
+  it('surfaces fetch errors via the error slot', async () => {
+    mocked.get.mockRejectedValue(new Error('boom'));
+    const { result } = renderHook(
+      () => useRemoteChoices({ endpointUrl: '/apps/restore/backups' }),
+      {
+        wrapper: wrapperFor(newClient()),
+      }
+    );
+    await waitFor(() => expect(result.current.isError).toBe(true));
+    expect(result.current.error).toBeInstanceOf(Error);
+  });
+});
diff --git a/ui/packages/sep/framework/src/hooks/useRemoteChoices.ts b/ui/packages/sep/framework/src/hooks/useRemoteChoices.ts
new file mode 100644
index 00000000000..d0fb217c7b2
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/useRemoteChoices.ts
@@ -0,0 +1,100 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useQuery, type UseQueryResult } from '@tanstack/react-query';
+import { apiClient, type ChoiceOption } from '@sep/api';
+import { sepRetry } from './sepRetry';
+
+export interface UseRemoteChoicesOptions {
+  /** Fully-resolved path the options are fetched from, relative to `apiClient`'s `/api` base. */
+  endpointUrl: string;
+  /** Sibling field name driving the cascade; `null`/`undefined` means no cascade. */
+  dependsOnName?: string | null;
+  /** Current value of the cascade parent; the fetch waits until this is set. */
+  dependsOnValue?: string | null;
+  enabled?: boolean;
+}
+
+/**
+ * Build the effective request URL: preserve any query string already on
+ * `endpointUrl` and, when a cascade dependency is provided, append it as a
+ * query parameter named after `dependsOnName` via `URLSearchParams` (so the
+ * value is encoded and a pre-existing `?` is not duplicated). Returns
+ * `endpointUrl` unchanged when no cascade value is present.
+ */
+function buildEffectiveUrl(
+  endpointUrl: string,
+  dependsOnName?: string | null,
+  dependsOnValue?: string | null
+): string {
+  if (
+    dependsOnName === null ||
+    dependsOnName === undefined ||
+    dependsOnValue === null ||
+    dependsOnValue === undefined
+  ) {
+    return endpointUrl;
+  }
+  const queryStart = endpointUrl.indexOf('?');
+  const path =
+    queryStart === -1 ? endpointUrl : endpointUrl.slice(0, queryStart);
+  const existingQuery =
+    queryStart === -1 ? '' : endpointUrl.slice(queryStart + 1);
+  const params = new URLSearchParams(existingQuery);
+  params.set(dependsOnName, dependsOnValue);
+  return `${path}?${params.toString()}`;
+}
+
+/**
+ * Fetch `Choice`-compatible options for a `RemoteChoices` field from its
+ * wire-declared endpoint.
+ *
+ * Mirrors the reference selector hooks (React Query + `apiClient` +
+ * `staleTime` + `sepRetry`), but reads the URL from `endpointUrl` rather than a
+ * hardcoded template. A cascading field (one with `dependsOnName`) skips the
+ * fetch until its parent has a value; a non-cascading field always fetches. The
+ * query key carries the full effective URL, so two fields that share an endpoint
+ * and parent value but cascade from differently-named parents do not collide.
+ */
+export function useRemoteChoices(
+  options: UseRemoteChoicesOptions
+): UseQueryResult<ChoiceOption[], Error> {
+  const {
+    endpointUrl,
+    dependsOnName,
+    dependsOnValue,
+    enabled = true,
+  } = options;
+  const effectiveUrl = buildEffectiveUrl(
+    endpointUrl,
+    dependsOnName,
+    dependsOnValue
+  );
+  const cascades = dependsOnName !== null && dependsOnName !== undefined;
+  return useQuery<ChoiceOption[], Error>({
+    queryKey: ['remote-choices', effectiveUrl],
+    enabled:
+      enabled &&
+      (!cascades || (dependsOnValue !== null && dependsOnValue !== undefined)),
+    staleTime: 60_000,
+    queryFn: async () => {
+      const response = await apiClient.get<ChoiceOption[]>(effectiveUrl);
+      return response.data;
+    },
+    retry: sepRetry,
+  });
+}
diff --git a/ui/packages/sep/framework/src/hooks/useResolvedServiceField.ts b/ui/packages/sep/framework/src/hooks/useResolvedServiceField.ts
new file mode 100644
index 00000000000..fa8c6d62f04
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/useResolvedServiceField.ts
@@ -0,0 +1,112 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useWatch } from 'react-hook-form';
+import {
+  serviceTypesForDependsOn,
+  useFormFields,
+} from '../components/SchemaFormRenderer/formFieldsContext';
+import { cascadeParentResetKey } from '../utils/cascadeParentResetKey';
+import { extractId } from '../utils/extractId';
+import {
+  useServices,
+  type ServiceOption,
+  type ServiceType,
+} from './useServices';
+
+const EMPTY_SERVICES: ServiceOption[] = [];
+
+function isHydratedService(value: unknown): value is ServiceOption {
+  return Boolean(value && typeof value === 'object' && 'name' in value);
+}
+
+export interface ResolvedServiceField {
+  /** Raw watched form value (object, scalar id, or empty). */
+  parent: unknown;
+  /** Hydrated service when available; undefined while resolving or when empty. */
+  service: ServiceOption | undefined;
+  /** Stable key for cascading resets when the parent selection changes. */
+  resetKey: string;
+  /**
+   * True while a scalar id is awaiting a bounded ``useServices`` fetch.
+   * Callers that need the display name should wait rather than treating the
+   * parent as missing.
+   */
+  isResolving: boolean;
+  /**
+   * True when the bounded ``useServices`` fetch failed. ``service`` stays
+   * undefined and ``isResolving`` is false, so callers need this to tell a
+   * failed lookup apart from an id that matched no service.
+   */
+  isError: boolean;
+  /** Error from the bounded ``useServices`` fetch, when it failed. */
+  error: Error | null;
+}
+
+/**
+ * Watch a service form field and resolve scalar ids to a hydrated
+ * {@link ServiceOption} the same way host cascade does.
+ *
+ * When ``serviceTypes`` is omitted, types are read from the parent field via
+ * {@link FormFieldsProvider} (``service_types`` on the named service field).
+ * Fetch stays disabled until a non-empty type filter is available
+ * (``undefined`` or ``[]`` both keep it off) so we never page the untyped
+ * services list that ``useServices`` would otherwise treat as "all types".
+ */
+export function useResolvedServiceField(
+  fieldName: string,
+  serviceTypes?: readonly ServiceType[]
+): ResolvedServiceField {
+  const fields = useFormFields();
+  const types = serviceTypes ?? serviceTypesForDependsOn(fields, fieldName);
+  const parent = useWatch({ name: fieldName }) as
+    | ServiceOption
+    | number
+    | string
+    | null
+    | undefined;
+
+  const unresolvedServiceId = isHydratedService(parent)
+    ? null
+    : extractId(parent);
+  // Require length > 0: ``[]`` normalises in useServices to an unbound fetch.
+  const enabled = unresolvedServiceId !== null && Boolean(types?.length);
+  const {
+    data: services = EMPTY_SERVICES,
+    isFetched,
+    isError,
+    error,
+  } = useServices({
+    serviceTypes: types,
+    enabled,
+  });
+
+  const service: ServiceOption | undefined = isHydratedService(parent)
+    ? parent
+    : unresolvedServiceId !== null
+      ? services.find((svc) => svc.id === unresolvedServiceId)
+      : undefined;
+
+  return {
+    parent,
+    service,
+    resetKey: cascadeParentResetKey(parent),
+    isResolving: enabled && !isFetched,
+    isError: enabled && isError,
+    error: enabled ? (error ?? null) : null,
+  };
+}
diff --git a/ui/packages/sep/framework/src/hooks/useSchemas.ts b/ui/packages/sep/framework/src/hooks/useSchemas.ts
new file mode 100644
index 00000000000..4ab1c537402
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/useSchemas.ts
@@ -0,0 +1,52 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useQuery, type UseQueryResult } from '@tanstack/react-query';
+import { apiClient } from '@sep/api';
+
+export interface SchemaOption {
+  id: number;
+  name: string;
+}
+
+export interface UseSchemasOptions {
+  serviceId: number | null | undefined;
+  enabled?: boolean;
+}
+
+/**
+ * Fetch schemas for a service via the SEP inventory gateway
+ * (`GET /sep/services/{id}/schemas` → `[{id, name}]`).
+ *
+ * Disabled when `serviceId` is nullish.
+ */
+export function useSchemas(
+  options: UseSchemasOptions
+): UseQueryResult<SchemaOption[], Error> {
+  const { serviceId, enabled = true } = options;
+  return useQuery<SchemaOption[], Error>({
+    queryKey: ['inventory', 'schemas', serviceId ?? null],
+    enabled: enabled && serviceId !== null && serviceId !== undefined,
+    staleTime: 60_000,
+    queryFn: async () => {
+      const { data } = await apiClient.get<SchemaOption[]>(
+        `/sep/services/${serviceId}/schemas`
+      );
+      return data;
+    },
+  });
+}
diff --git a/ui/packages/sep/framework/src/hooks/useServices.test.tsx b/ui/packages/sep/framework/src/hooks/useServices.test.tsx
new file mode 100644
index 00000000000..53d904b5297
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/useServices.test.tsx
@@ -0,0 +1,276 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { renderHook, waitFor } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import type { ReactNode } from 'react';
+
+vi.mock('@sep/api', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@sep/api')>()),
+  apiClient: { get: vi.fn(), post: vi.fn() },
+}));
+
+import { ApiError, apiClient } from '@sep/api';
+import { useServices } from './useServices';
+
+const mocked = apiClient as unknown as { get: ReturnType<typeof vi.fn> };
+
+function wrapper() {
+  // `retry: false` here is a no-op for this hook: useServices sets
+  // `retry: sepRetry` at the query level, which overrides the client default
+  // in React Query v5. We keep it for documentation. `retryDelay: 0` removes
+  // the exponential backoff so tests that exercise the retry path finish in
+  // milliseconds.
+  const client = new QueryClient({
+    defaultOptions: {
+      queries: { gcTime: 0, staleTime: 0, retry: false, retryDelay: 0 },
+    },
+  });
+  return ({ children }: { children: ReactNode }) => (
+    <QueryClientProvider client={client}>{children}</QueryClientProvider>
+  );
+}
+
+function page(
+  items: Array<{ id: number; name: string; type: string }>,
+  total: number,
+  offset = 0
+) {
+  return { data: { items, total, offset, limit: 200 } };
+}
+
+beforeEach(() => {
+  mocked.get.mockReset();
+});
+
+describe('useServices', () => {
+  it('omits service_type from request params when none is supplied', async () => {
+    mocked.get.mockResolvedValueOnce(page([], 0));
+
+    const { result } = renderHook(() => useServices(), { wrapper: wrapper() });
+    await waitFor(() => expect(result.current.isSuccess).toBe(true));
+
+    expect(mocked.get).toHaveBeenCalledTimes(1);
+    const [, config] = mocked.get.mock.calls[0];
+    expect(config.params).not.toHaveProperty('service_type');
+    expect(config.params).toMatchObject({ offset: 0, limit: 200 });
+  });
+
+  it('paginates until offset >= total for a single service type', async () => {
+    mocked.get
+      .mockResolvedValueOnce(
+        page(
+          Array.from({ length: 200 }, (_, i) => ({
+            id: i + 1,
+            name: `s${i + 1}`,
+            type: 'mysql',
+          })),
+          250
+        )
+      )
+      .mockResolvedValueOnce(
+        page(
+          Array.from({ length: 50 }, (_, i) => ({
+            id: 201 + i,
+            name: `s${201 + i}`,
+            type: 'mysql',
+          })),
+          250
+        )
+      );
+
+    const { result } = renderHook(
+      () => useServices({ serviceTypes: ['mysql'] as never[] }),
+      {
+        wrapper: wrapper(),
+      }
+    );
+    await waitFor(() => expect(result.current.isSuccess).toBe(true));
+
+    expect(mocked.get).toHaveBeenCalledTimes(2);
+    expect(result.current.data).toHaveLength(250);
+  });
+
+  it('breaks when items.length === 0 even before offset reaches total', async () => {
+    // Defensive break — server might claim total=999 but return zero items on
+    // the second page (e.g. a row got deleted between requests).
+    mocked.get
+      .mockResolvedValueOnce(page([{ id: 1, name: 's1', type: 'mysql' }], 999))
+      .mockResolvedValueOnce(page([], 999));
+
+    const { result } = renderHook(
+      () => useServices({ serviceTypes: ['mysql'] as never[] }),
+      {
+        wrapper: wrapper(),
+      }
+    );
+    await waitFor(() => expect(result.current.isSuccess).toBe(true));
+
+    expect(mocked.get).toHaveBeenCalledTimes(2);
+    expect(result.current.data).toEqual([{ id: 1, name: 's1', type: 'mysql' }]);
+  });
+
+  it('dedupes by id across parallel service-type fan-out', async () => {
+    mocked.get.mockImplementation(
+      (_url: string, config?: { params: Record<string, unknown> }) => {
+        if (config?.params.service_type === 'mysql') {
+          return Promise.resolve(
+            page(
+              [
+                { id: 1, name: 'svc1', type: 'mysql' },
+                { id: 2, name: 'svc2', type: 'mysql' },
+              ],
+              2
+            )
+          );
+        }
+        if (config?.params.service_type === 'postgresql') {
+          return Promise.resolve(
+            page(
+              [
+                { id: 2, name: 'svc2', type: 'mysql' },
+                { id: 3, name: 'svc3', type: 'postgresql' },
+              ],
+              2
+            )
+          );
+        }
+        return Promise.resolve(page([], 0));
+      }
+    );
+
+    const { result } = renderHook(
+      () => useServices({ serviceTypes: ['mysql', 'postgresql'] as never[] }),
+      { wrapper: wrapper() }
+    );
+    await waitFor(() => expect(result.current.isSuccess).toBe(true));
+
+    expect(result.current.data?.map((s) => s.id).sort()).toEqual([1, 2, 3]);
+  });
+
+  it('surfaces error when any service-type fan-out fetch rejects', async () => {
+    // Promise.all rejects on first failure — current trade-off. Document it
+    // here so any future partial-fallback change is intentional.
+    mocked.get.mockImplementation(
+      (_url: string, config?: { params: Record<string, unknown> }) => {
+        if (config?.params.service_type === 'mysql') {
+          return Promise.resolve(
+            page([{ id: 1, name: 'svc1', type: 'mysql' }], 1)
+          );
+        }
+        return Promise.reject(
+          new ApiError({
+            kind: 'http',
+            status: 500,
+            message: 'upstream blew up',
+          })
+        );
+      }
+    );
+
+    const { result } = renderHook(
+      () => useServices({ serviceTypes: ['mysql', 'postgresql'] as never[] }),
+      { wrapper: wrapper() }
+    );
+    await waitFor(() => expect(result.current.isError).toBe(true));
+    expect((result.current.error as InstanceType<typeof ApiError>).status).toBe(
+      500
+    );
+  });
+
+  it('produces a stable query key whether serviceTypes is undefined or empty', async () => {
+    mocked.get.mockResolvedValue(page([], 0));
+
+    const { result: ra } = renderHook(() => useServices(), {
+      wrapper: wrapper(),
+    });
+    const { result: rb } = renderHook(
+      () => useServices({ serviceTypes: [] as never[] }),
+      {
+        wrapper: wrapper(),
+      }
+    );
+
+    await waitFor(() => {
+      expect(ra.current.isSuccess).toBe(true);
+      expect(rb.current.isSuccess).toBe(true);
+    });
+
+    // Both call the same endpoint with no service_type filter; combined with
+    // STABLE_EMPTY this means React Query shares the cache entry.
+    const allCalls = mocked.get.mock.calls;
+    for (const [, config] of allCalls) {
+      expect(config.params).not.toHaveProperty('service_type');
+    }
+  });
+
+  it('aborts pagination after MAX_PAGES iterations to prevent runaway loops', async () => {
+    // Backend bug: `total` is reported as larger than what `items` can ever
+    // catch up to. Without the cap this would run forever and hang the tab.
+    mocked.get.mockImplementation(() =>
+      Promise.resolve(
+        page([{ id: 1, name: 's', type: 'mysql' }], Number.MAX_SAFE_INTEGER)
+      )
+    );
+
+    const { result } = renderHook(
+      () => useServices({ serviceTypes: ['mysql'] as never[] }),
+      {
+        wrapper: wrapper(),
+      }
+    );
+    await waitFor(() => expect(result.current.isError).toBe(true));
+    // Each attempt fetches exactly MAX_PAGES (50) pages before throwing the
+    // pagination-exceeded Error. sepRetry retries plain Errors up to 2 times,
+    // so the total call count is a multiple of 50. We assert the per-attempt
+    // ceiling (the guard's actual contract) rather than the retry-aware total.
+    expect(mocked.get.mock.calls.length).toBeGreaterThanOrEqual(50);
+    expect(mocked.get.mock.calls.length % 50).toBe(0);
+    expect((result.current.error as Error).message).toMatch(
+      /pagination exceeded/i
+    );
+  });
+
+  it('does not retry a deterministic 502 (sepRetry short-circuit)', async () => {
+    // Without `retry: sepRetry` React Query's default policy would fire 4
+    // attempts before surfacing the error on the required Database Host
+    // selector. The SEP gateway returns 502 only when the upstream Tasks
+    // API is unreachable — retrying just queues failed user-visible loads.
+    mocked.get.mockRejectedValue(
+      new ApiError({ kind: 'http', status: 502, message: '502 Bad Gateway' })
+    );
+
+    const { result } = renderHook(
+      () => useServices({ serviceTypes: ['mysql'] as never[] }),
+      {
+        wrapper: wrapper(),
+      }
+    );
+    await waitFor(() => expect(result.current.isError).toBe(true));
+
+    expect(mocked.get).toHaveBeenCalledTimes(1);
+    expect((result.current.error as InstanceType<typeof ApiError>).status).toBe(
+      502
+    );
+  });
+
+  it('respects enabled=false', async () => {
+    const { result } = renderHook(() => useServices({ enabled: false }), {
+      wrapper: wrapper(),
+    });
+    // Hook is disabled — no request should fire.
+    await new Promise((r) => setTimeout(r, 20));
+    expect(mocked.get).not.toHaveBeenCalled();
+    expect(result.current.isFetching).toBe(false);
+  });
+});
diff --git a/ui/packages/sep/framework/src/hooks/useServices.ts b/ui/packages/sep/framework/src/hooks/useServices.ts
new file mode 100644
index 00000000000..1d6857f7e2d
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/useServices.ts
@@ -0,0 +1,147 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useQuery, type UseQueryResult } from '@tanstack/react-query';
+import { apiClient, type InventoryComponents } from '@sep/api';
+import { sepRetry } from './sepRetry';
+
+export type ServiceType = InventoryComponents['schemas']['ServiceTypeEnum'];
+
+/** Inventory node fields needed to cascade an executor host from a service. */
+export interface ServiceNodeOption {
+  name: string;
+  address: string;
+}
+
+export interface ServiceOption {
+  id: number;
+  name: string;
+  type: ServiceType;
+  /** Present when the list response includes the nested inventory node. */
+  node?: ServiceNodeOption;
+}
+
+type PaginatedServices =
+  InventoryComponents['schemas']['PaginatedResponse_ServiceResponse_'];
+
+export interface UseServicesOptions {
+  serviceTypes?: readonly ServiceType[];
+  enabled?: boolean;
+}
+
+const DEFAULT_LIMIT = 200;
+// Upper bound on paginated fetch iterations. At DEFAULT_LIMIT=200 this caps
+// the response set at 10 000 services per type, well above any realistic
+// customer scale. The guard fires only when the backend reports `items` and
+// `total` in an inconsistent way that would otherwise spin forever.
+const MAX_PAGES = 50;
+
+const STABLE_EMPTY: readonly ServiceType[] = Object.freeze([] as ServiceType[]);
+
+function normaliseTypes(
+  types: readonly ServiceType[] | undefined
+): readonly ServiceType[] {
+  if (!types || types.length === 0) {
+    return STABLE_EMPTY;
+  }
+  return [...types].sort();
+}
+
+async function fetchServicesPage(
+  serviceType: ServiceType | undefined,
+  offset: number
+): Promise<PaginatedServices> {
+  const params: Record<string, string | number> = {
+    offset,
+    limit: DEFAULT_LIMIT,
+  };
+  if (serviceType) {
+    params.service_type = serviceType;
+  }
+  const { data } = await apiClient.get<PaginatedServices>('/sep/services/', {
+    params,
+  });
+  return data;
+}
+
+async function fetchServicesForType(
+  serviceType: ServiceType | undefined
+): Promise<ServiceOption[]> {
+  const out: ServiceOption[] = [];
+  let offset = 0;
+  for (let iter = 0; iter < MAX_PAGES; iter++) {
+    const page = await fetchServicesPage(serviceType, offset);
+    for (const svc of page.items) {
+      if (svc.id !== null && svc.id !== undefined) {
+        out.push({
+          id: svc.id,
+          name: svc.name,
+          type: svc.type,
+          ...(svc.node
+            ? { node: { name: svc.node.name, address: svc.node.address } }
+            : {}),
+        });
+      }
+    }
+    offset += page.items.length;
+    if (offset >= page.total || page.items.length === 0) {
+      return out;
+    }
+  }
+  throw new Error(
+    `useServices: pagination exceeded ${MAX_PAGES} pages for service_type=${serviceType ?? 'all'}; backend likely reports an inconsistent total/items pair`
+  );
+}
+
+/**
+ * Fetch services through the SEP gateway (`/api/sep/services/`), optionally
+ * filtered to one or more service types. Multiple types fan out to parallel
+ * paginated requests because the upstream `/services/` endpoint accepts a
+ * single `service_type` only. The frontend must not call `/api/inventory/`
+ * directly (see `app/sep/api/router.py`).
+ */
+export function useServices(
+  options: UseServicesOptions = {}
+): UseQueryResult<ServiceOption[], Error> {
+  const { enabled = true } = options;
+  const types = normaliseTypes(options.serviceTypes);
+  return useQuery<ServiceOption[], Error>({
+    queryKey: ['sep', 'services', { types }],
+    enabled,
+    staleTime: 60_000,
+    retry: sepRetry,
+    queryFn: async () => {
+      if (types.length === 0) {
+        return fetchServicesForType(undefined);
+      }
+      const pages = await Promise.all(
+        types.map((t) => fetchServicesForType(t))
+      );
+      const seen = new Set<number>();
+      const out: ServiceOption[] = [];
+      for (const page of pages) {
+        for (const svc of page) {
+          if (!seen.has(svc.id)) {
+            seen.add(svc.id);
+            out.push(svc);
+          }
+        }
+      }
+      return out;
+    },
+  });
+}
diff --git a/ui/packages/sep/framework/src/hooks/useSnippetPluginExecution.ts b/ui/packages/sep/framework/src/hooks/useSnippetPluginExecution.ts
new file mode 100644
index 00000000000..e664b2e82f5
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/useSnippetPluginExecution.ts
@@ -0,0 +1,63 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+import { apiClient } from '@sep/api';
+import type {
+  SnippetExecutionRequest,
+  SnippetExecutionResponse,
+} from '../types/snippetPlugin';
+
+export interface UseSnippetPluginExecutionOptions {
+  /**
+   * When set, invalidate per-snippet history after a successful execute
+   * (`useSnippetHistory` in `@sep/plugins-snippets` uses this query-key shape).
+   */
+  invalidateHistoryForFilename?: string;
+}
+
+/**
+ * POST snippet execution against an API path relative to `/api`
+ * (e.g. `/apps/snippets/my-script.sh/execute`).
+ */
+export function useSnippetPluginExecution(
+  executePath: string | null | undefined,
+  options?: UseSnippetPluginExecutionOptions
+) {
+  const queryClient = useQueryClient();
+  const historyFilename = options?.invalidateHistoryForFilename;
+
+  return useMutation<SnippetExecutionResponse, Error, SnippetExecutionRequest>({
+    mutationFn: async (body) => {
+      if (!executePath) {
+        throw new Error('Missing snippets plugin execute path');
+      }
+      const { data } = await apiClient.post<SnippetExecutionResponse>(
+        executePath,
+        body
+      );
+      return data;
+    },
+    onSuccess: () => {
+      if (historyFilename) {
+        queryClient.invalidateQueries({
+          queryKey: ['snippets', historyFilename, 'history'],
+        });
+      }
+    },
+  });
+}
diff --git a/ui/packages/sep/framework/src/hooks/useSnippetPluginSchema.ts b/ui/packages/sep/framework/src/hooks/useSnippetPluginSchema.ts
new file mode 100644
index 00000000000..f7074330c89
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/useSnippetPluginSchema.ts
@@ -0,0 +1,43 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useQuery } from '@tanstack/react-query';
+import { apiClient, type PluginSchema } from '@sep/api';
+
+const SNIPPET_PLUGIN_SCHEMA_STALE_MS = 5 * 60 * 1000;
+
+/**
+ * Load a snippets-plugin schema from an API path relative to `/api`
+ * (e.g. `/apps/snippets/my-script.sh/schema`, including encoded slashes).
+ *
+ * Shared by the snippets detail page (path derived from filename) and flows
+ * like ATW that compose the same URLs client-side.
+ */
+export function useSnippetPluginSchema(apiPath: string | null | undefined) {
+  return useQuery<PluginSchema>({
+    queryKey: ['plugins', 'snippets', 'schema', apiPath ?? ''],
+    queryFn: async () => {
+      if (!apiPath) {
+        throw new Error('Missing snippets plugin schema path');
+      }
+      const { data } = await apiClient.get<PluginSchema>(apiPath);
+      return data;
+    },
+    enabled: Boolean(apiPath),
+    staleTime: SNIPPET_PLUGIN_SCHEMA_STALE_MS,
+  });
+}
diff --git a/ui/packages/sep/framework/src/hooks/useTables.ts b/ui/packages/sep/framework/src/hooks/useTables.ts
new file mode 100644
index 00000000000..d7231ec8047
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/useTables.ts
@@ -0,0 +1,52 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useQuery, type UseQueryResult } from '@tanstack/react-query';
+import { apiClient } from '@sep/api';
+
+export interface TableOption {
+  id: number;
+  name: string;
+}
+
+export interface UseTablesOptions {
+  schemaId: number | null | undefined;
+  enabled?: boolean;
+}
+
+/**
+ * Fetch tables for a schema via the SEP inventory gateway
+ * (`GET /sep/schemas/{id}/tables` → `[{id, name}]`).
+ *
+ * Disabled when `schemaId` is nullish.
+ */
+export function useTables(
+  options: UseTablesOptions
+): UseQueryResult<TableOption[], Error> {
+  const { schemaId, enabled = true } = options;
+  return useQuery<TableOption[], Error>({
+    queryKey: ['inventory', 'tables', schemaId ?? null],
+    enabled: enabled && schemaId !== null && schemaId !== undefined,
+    staleTime: 60_000,
+    queryFn: async () => {
+      const { data } = await apiClient.get<TableOption[]>(
+        `/sep/schemas/${schemaId}/tables`
+      );
+      return data;
+    },
+  });
+}
diff --git a/ui/packages/sep/framework/src/hooks/useTaskFileDownload.ts b/ui/packages/sep/framework/src/hooks/useTaskFileDownload.ts
new file mode 100644
index 00000000000..7c6c548daea
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/useTaskFileDownload.ts
@@ -0,0 +1,45 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useMutation } from '@tanstack/react-query';
+import { apiClient } from '@sep/api';
+import { downloadBlob } from '../utils/downloadBlob';
+
+export interface TaskFileDownloadParams {
+  taskHistoryId: number;
+  /** Relative path of the file/directory as returned by the files list. */
+  path: string;
+  isDir: boolean;
+}
+
+export function useTaskFileDownload() {
+  return useMutation<void, Error, TaskFileDownloadParams>({
+    mutationFn: async ({ taskHistoryId, path, isDir }) => {
+      const { data } = await apiClient.get<Blob>(
+        `/files/${taskHistoryId}/download`,
+        {
+          baseURL: '',
+          params: { path },
+          responseType: 'blob',
+        }
+      );
+      const name = path.split('/').filter(Boolean).pop() ?? path;
+      const suggestedName = isDir ? `${name}.tar.gz` : name;
+      downloadBlob(data, suggestedName);
+    },
+  });
+}
diff --git a/ui/packages/sep/framework/src/hooks/useTaskHistory.test.tsx b/ui/packages/sep/framework/src/hooks/useTaskHistory.test.tsx
new file mode 100644
index 00000000000..8e3c5d69ea3
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/useTaskHistory.test.tsx
@@ -0,0 +1,236 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { act, renderHook, waitFor } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import type { ReactNode } from 'react';
+
+const { mockApiGet, mockApiPost } = vi.hoisted(() => ({
+  mockApiGet: vi.fn(),
+  mockApiPost: vi.fn(),
+}));
+
+vi.mock('@sep/api', async () => {
+  const actual = await vi.importActual<typeof import('@sep/api')>('@sep/api');
+  return {
+    ...actual,
+    apiClient: { get: mockApiGet, post: mockApiPost },
+  };
+});
+
+import {
+  useExecuteTask,
+  useStopTaskHistory,
+  useTaskHistory,
+  useTaskHistoryByNames,
+} from './useTaskHistory';
+
+const EMPTY_PAGE = {
+  items: [],
+  total: 0,
+  offset: 0,
+  limit: 0,
+};
+
+function wrapper() {
+  const client = new QueryClient({
+    defaultOptions: { queries: { retry: false, gcTime: 0, staleTime: 0 } },
+  });
+  return ({ children }: { children: ReactNode }) => (
+    <QueryClientProvider client={client}>{children}</QueryClientProvider>
+  );
+}
+
+beforeEach(() => {
+  mockApiGet.mockReset();
+  mockApiPost.mockReset();
+  mockApiGet.mockResolvedValue({ data: EMPTY_PAGE });
+  mockApiPost.mockResolvedValue({ data: {} });
+});
+
+describe('useTaskHistoryByNames', () => {
+  it('does not call the API when taskNames is empty', () => {
+    renderHook(() => useTaskHistoryByNames([]), { wrapper: wrapper() });
+    expect(mockApiGet).not.toHaveBeenCalled();
+  });
+
+  it('does not call the API when enabled=false', () => {
+    renderHook(() => useTaskHistoryByNames(['task-a'], { enabled: false }), {
+      wrapper: wrapper(),
+    });
+    expect(mockApiGet).not.toHaveBeenCalled();
+  });
+
+  it('calls /api/sep/task-history/ with deduplicated sorted task_names', async () => {
+    renderHook(() => useTaskHistoryByNames(['task-b', 'task-a', 'task-b']), {
+      wrapper: wrapper(),
+    });
+    await waitFor(() => {
+      expect(mockApiGet).toHaveBeenCalledWith('/sep/task-history/', {
+        params: {
+          task_names: ['task-a', 'task-b'],
+        },
+        paramsSerializer: { indexes: null },
+      });
+    });
+  });
+
+  it('forwards status, offset, and limit query params', async () => {
+    renderHook(
+      () =>
+        useTaskHistoryByNames(['task-a'], {
+          status: 'running',
+          offset: 5,
+          limit: 10,
+        }),
+      { wrapper: wrapper() }
+    );
+    await waitFor(() => {
+      expect(mockApiGet).toHaveBeenCalledWith('/sep/task-history/', {
+        params: {
+          status: 'running',
+          offset: 5,
+          limit: 10,
+          task_names: ['task-a'],
+        },
+        paramsSerializer: { indexes: null },
+      });
+    });
+  });
+});
+
+describe('useTaskHistory', () => {
+  it('lists through /api/sep/task-history/ and never /api/tasks/...', async () => {
+    renderHook(() => useTaskHistory(), { wrapper: wrapper() });
+    await waitFor(() => expect(mockApiGet).toHaveBeenCalled());
+    const [url] = mockApiGet.mock.calls[0];
+    expect(url).toBe('/sep/task-history/');
+    expect(
+      mockApiGet.mock.calls.every(([u]) => !String(u).startsWith('/tasks/'))
+    ).toBe(true);
+  });
+
+  it('sends exclude_internal=true when excludeInternal option is set', async () => {
+    renderHook(() => useTaskHistory({ excludeInternal: true }), {
+      wrapper: wrapper(),
+    });
+    await waitFor(() => {
+      expect(mockApiGet).toHaveBeenCalledWith('/sep/task-history/', {
+        params: { exclude_internal: true },
+      });
+    });
+  });
+
+  it('omits exclude_internal from params when excludeInternal is not set', async () => {
+    renderHook(() => useTaskHistory(), { wrapper: wrapper() });
+    await waitFor(() => expect(mockApiGet).toHaveBeenCalled());
+    const params = mockApiGet.mock.calls[0][1]?.params ?? {};
+    expect(params).not.toHaveProperty('exclude_internal');
+  });
+});
+
+describe('useStopTaskHistory', () => {
+  it('stops through /api/sep/task-history/{id}/stop/ and never /api/tasks/...', async () => {
+    const { result } = renderHook(() => useStopTaskHistory(), {
+      wrapper: wrapper(),
+    });
+    await act(async () => {
+      await result.current.mutateAsync(42);
+    });
+    expect(mockApiPost).toHaveBeenCalledWith('/sep/task-history/42/stop/');
+    expect(
+      mockApiPost.mock.calls.every(([u]) => !String(u).startsWith('/tasks/'))
+    ).toBe(true);
+  });
+});
+
+describe('useExecuteTask', () => {
+  it('encodes slash-containing plugin names per path segment', async () => {
+    const { result } = renderHook(
+      () => useExecuteTask('backup_mongo/restores'),
+      {
+        wrapper: wrapper(),
+      }
+    );
+
+    await act(async () => {
+      await result.current.mutateAsync({ taskName: 'my-restore-task' });
+    });
+
+    expect(mockApiPost).toHaveBeenCalledWith(
+      '/apps/backup_mongo/restores/my-restore-task/execute',
+      {}
+    );
+  });
+
+  it('posts to a single-segment plugin path unchanged', async () => {
+    const { result } = renderHook(() => useExecuteTask('backup_mongo'), {
+      wrapper: wrapper(),
+    });
+
+    await act(async () => {
+      await result.current.mutateAsync({ taskName: 'my-backup-task' });
+    });
+
+    expect(mockApiPost).toHaveBeenCalledWith(
+      '/apps/backup_mongo/my-backup-task/execute',
+      {}
+    );
+  });
+
+  it('encodes special characters in task names', async () => {
+    const taskName = 'weird/name with spaces&q=?';
+    const { result } = renderHook(
+      () => useExecuteTask('backup_mongo/restores'),
+      {
+        wrapper: wrapper(),
+      }
+    );
+
+    await act(async () => {
+      await result.current.mutateAsync({ taskName });
+    });
+
+    expect(mockApiPost).toHaveBeenCalledWith(
+      `/apps/backup_mongo/restores/${encodeURIComponent(taskName)}/execute`,
+      {}
+    );
+  });
+
+  it('posts an optional execute body for chain wiring', async () => {
+    const executeBody = {
+      chain_task_names: ['my-alter'],
+      chain_on_failure: true,
+    };
+    const { result } = renderHook(() => useExecuteTask('alters'), {
+      wrapper: wrapper(),
+    });
+
+    await act(async () => {
+      await result.current.mutateAsync({
+        taskName: 'my-alter-pre-checks',
+        executeBody,
+      });
+    });
+
+    expect(mockApiPost).toHaveBeenCalledWith(
+      '/apps/alters/my-alter-pre-checks/execute',
+      executeBody
+    );
+  });
+});
diff --git a/ui/packages/sep/framework/src/hooks/useTaskHistory.ts b/ui/packages/sep/framework/src/hooks/useTaskHistory.ts
new file mode 100644
index 00000000000..e6486933498
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/useTaskHistory.ts
@@ -0,0 +1,257 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import {
+  apiClient,
+  isRunningStatus,
+  RUNNING_STATUSES,
+  type SepComponents,
+  type TaskHistoryStatus,
+  type TasksComponents,
+} from '@sep/api';
+
+export type TaskHistoryEntry =
+  TasksComponents['schemas']['TaskHistoryResponse'];
+export type PaginatedTaskHistory =
+  TasksComponents['schemas']['PaginatedResponse_TaskHistoryResponse_'];
+
+/** Optional JSON body for ``POST .../execute`` (chain wiring, schedule ETA, etc.). */
+export type TaskExecuteBody =
+  SepComponents['schemas']['framework__TaskExecuteWrite'];
+
+// The poll-while-running status set is owned by the ``api`` package (the lower
+// layer) so the schema-driven list page and this hook share one definition.
+// Re-exported here to keep the ``@sep/framework`` import surface stable.
+export { isRunningStatus, RUNNING_STATUSES };
+export type { TaskHistoryStatus };
+
+export interface UseTaskHistoryOptions {
+  /** Filter by exact status (server-side ?status=). */
+  status?: TaskHistoryStatus | null;
+  /** Override polling interval (ms). Defaults to 5000. */
+  pollingIntervalMs?: number;
+  /** Disable polling regardless of running tasks. */
+  disablePolling?: boolean;
+  /** Optional offset/limit for client-side prefetch (server pagination is deferred). */
+  offset?: number;
+  limit?: number;
+  /** Disable the underlying query (no fetch, no polling). */
+  enabled?: boolean;
+  /** Exclude internal maintenance task rows before server-side pagination. */
+  excludeInternal?: boolean;
+}
+
+interface ListParams {
+  status?: TaskHistoryStatus | null;
+  offset?: number;
+  limit?: number;
+  excludeInternal?: boolean;
+}
+
+function buildParams({
+  status,
+  offset,
+  limit,
+  excludeInternal,
+}: ListParams): Record<string, string | number | boolean> {
+  const params: Record<string, string | number | boolean> = {};
+  if (status) {
+    params.status = status;
+  }
+  if (typeof offset === 'number') {
+    params.offset = offset;
+  }
+  if (typeof limit === 'number') {
+    params.limit = limit;
+  }
+  if (excludeInternal) {
+    params.exclude_internal = true;
+  }
+  return params;
+}
+
+function refetchIntervalFor(
+  data: PaginatedTaskHistory | undefined,
+  pollingMs: number,
+  disabled: boolean
+): number | false {
+  if (disabled) {
+    return false;
+  }
+  if (!data) {
+    return false;
+  }
+  const hasRunning = data.items.some((entry) => isRunningStatus(entry.status));
+  return hasRunning ? pollingMs : false;
+}
+
+/**
+ * List task history across all tasks.
+ *
+ * Requests are routed through ``GET /api/sep/task-history/`` (with no
+ * `task_names`) so the browser never calls the Tasks sub-app directly. Polling
+ * activates only when at least one row is in a running state, matching the
+ * legacy Jinja2 page reload behaviour. Server cursor pagination is deferred;
+ * callers paginate client-side for now.
+ */
+export function useTaskHistory(options: UseTaskHistoryOptions = {}) {
+  const {
+    status,
+    pollingIntervalMs = 5000,
+    disablePolling = false,
+    offset,
+    limit,
+    enabled = true,
+    excludeInternal = false,
+  } = options;
+  return useQuery<PaginatedTaskHistory>({
+    queryKey: [
+      'task-history',
+      { status: status ?? null, offset, limit, excludeInternal },
+    ],
+    enabled,
+    queryFn: async () => {
+      const { data } = await apiClient.get<PaginatedTaskHistory>(
+        '/sep/task-history/',
+        {
+          params: buildParams({ status, offset, limit, excludeInternal }),
+        }
+      );
+      return data;
+    },
+    refetchInterval: (query) =>
+      refetchIntervalFor(query.state.data, pollingIntervalMs, disablePolling),
+  });
+}
+
+/**
+ * List task history filtered to a specific task by name.
+ */
+export function useTaskHistoryByName(
+  taskName: string | undefined,
+  options: UseTaskHistoryOptions = {}
+) {
+  return useTaskHistoryByNames(taskName ? [taskName] : undefined, options);
+}
+
+/**
+ * List task history for one or more tasks, merged newest-first.
+ *
+ * Used by plugins whose detail page represents a task group (parent plus derived
+ * siblings) while executions are recorded on individual task names. Requests are
+ * routed through ``GET /api/sep/task-history/`` so the browser never calls the
+ * Tasks sub-app directly.
+ */
+export function useTaskHistoryByNames(
+  taskNames: string[] | undefined,
+  options: UseTaskHistoryOptions = {}
+) {
+  const {
+    status,
+    pollingIntervalMs = 5000,
+    disablePolling = false,
+    offset,
+    limit,
+    enabled = true,
+  } = options;
+  const names = [
+    ...new Set((taskNames ?? []).map((name) => name.trim()).filter(Boolean)),
+  ].sort();
+  return useQuery<PaginatedTaskHistory>({
+    queryKey: [
+      'task-history',
+      'merged',
+      names,
+      { status: status ?? null, offset, limit },
+    ],
+    enabled: enabled && names.length > 0,
+    queryFn: async () => {
+      const { data } = await apiClient.get<PaginatedTaskHistory>(
+        '/sep/task-history/',
+        {
+          params: {
+            ...buildParams({ status, offset, limit }),
+            task_names: names,
+          },
+          // FastAPI list query params use repeated keys (`task_names=a&task_names=b`),
+          // not axios' default bracket form (`task_names[]=a&task_names[]=b`).
+          paramsSerializer: { indexes: null },
+        }
+      );
+      return data;
+    },
+    refetchInterval: (query) =>
+      refetchIntervalFor(query.state.data, pollingIntervalMs, disablePolling),
+  });
+}
+
+/**
+ * Stop a running task history execution.
+ */
+export function useStopTaskHistory() {
+  const queryClient = useQueryClient();
+  return useMutation<TaskHistoryEntry, Error, number>({
+    mutationFn: async (taskHistoryId) => {
+      const { data } = await apiClient.post<TaskHistoryEntry>(
+        `/sep/task-history/${taskHistoryId}/stop/`
+      );
+      return data;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['task-history'] });
+    },
+  });
+}
+
+/**
+ * Dispatch a saved task for immediate execution.
+ *
+ * The request is routed through the SEP-level plugin gateway
+ * (``POST /api/apps/{pluginName}/{taskName}/execute``) — the FE must not
+ * call ``/api/tasks/*`` directly, as the Tasks sub-app is not exposed to the
+ * browser in a production deployment. The plugin-task detail query is also
+ * refreshed so the status chip on the detail page updates immediately after
+ * execution.
+ */
+export function useExecuteTask(pluginName: string) {
+  const queryClient = useQueryClient();
+  const pluginPath = pluginName.split('/').map(encodeURIComponent).join('/');
+  return useMutation<
+    unknown,
+    Error,
+    { taskName: string; executeBody?: TaskExecuteBody }
+  >({
+    mutationFn: async ({ taskName, executeBody }) => {
+      const { data } = await apiClient.post<unknown>(
+        `/apps/${pluginPath}/${encodeURIComponent(taskName)}/execute`,
+        executeBody ?? {}
+      );
+      return data;
+    },
+    onSuccess: (_data, { taskName }) => {
+      queryClient.invalidateQueries({ queryKey: ['task-history'] });
+      queryClient.invalidateQueries({ queryKey: ['task-history', taskName] });
+      queryClient.invalidateQueries({
+        queryKey: ['plugins', pluginName, 'tasks'],
+      });
+      queryClient.removeQueries({
+        queryKey: ['plugins', pluginName, 'tasks', taskName],
+      });
+    },
+  });
+}
diff --git a/ui/packages/sep/framework/src/hooks/useTaskHistoryFiles.ts b/ui/packages/sep/framework/src/hooks/useTaskHistoryFiles.ts
new file mode 100644
index 00000000000..3b338b2e6aa
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/useTaskHistoryFiles.ts
@@ -0,0 +1,51 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useQuery } from '@tanstack/react-query';
+import { apiClient, type SepComponents } from '@sep/api';
+
+export type FileMetadata = SepComponents['schemas']['FileMetadata'];
+export type TaskHistoryFilesMap = Record<string, FileMetadata>;
+
+export interface UseTaskHistoryFilesOptions {
+  /**
+   * React Query stale time in ms. The dialog keeps the default ``0`` so a
+   * re-open always re-lists; the history-table download affordance can pass a
+   * longer value to avoid re-hitting Nomad on every poll tick.
+   */
+  staleTime?: number;
+}
+
+export function useTaskHistoryFiles(
+  taskHistoryId: number | null | undefined,
+  options?: UseTaskHistoryFilesOptions
+) {
+  return useQuery<TaskHistoryFilesMap>({
+    queryKey: ['task-history-files', taskHistoryId],
+    enabled: taskHistoryId !== null && taskHistoryId !== undefined,
+    staleTime: options?.staleTime ?? 0,
+    queryFn: async () => {
+      const { data } = await apiClient.get<TaskHistoryFilesMap>(
+        `/files/${taskHistoryId}`,
+        {
+          baseURL: '',
+        }
+      );
+      return data;
+    },
+  });
+}
diff --git a/ui/packages/sep/framework/src/hooks/useTaskLogs.ts b/ui/packages/sep/framework/src/hooks/useTaskLogs.ts
new file mode 100644
index 00000000000..4bf3c49f24e
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/useTaskLogs.ts
@@ -0,0 +1,316 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import {
+  EventStreamContentType,
+  fetchEventSource,
+} from '@microsoft/fetch-event-source';
+import { emitUnauthorized, getToken, refreshAccessToken } from '@sep/api';
+import { useEffect, useRef, useState } from 'react';
+
+export type LogType = 'stdout' | 'stderr';
+
+export type StepText = Record<LogType, string>;
+
+export type FinishStatus = 'success' | 'failed' | 'stopped' | 'lost';
+
+export interface StreamError {
+  code?: number;
+  detail: unknown;
+}
+
+export type StreamStatus =
+  | 'idle'
+  | 'connecting'
+  | 'streaming'
+  | 'finished'
+  | 'error';
+
+export interface TaskLogsState {
+  textByStep: Record<string, StepText>;
+  stepOrder: string[];
+  streamStatus: StreamStatus;
+  finishStatus?: FinishStatus;
+  error?: StreamError;
+}
+
+interface IncomingLog {
+  msg: string;
+  step: string;
+  type: LogType;
+  offset: number;
+}
+
+// Thrown from onopen after a successful token refresh so onerror can return 0
+// (immediate retry) with the new token.
+class StreamRetriableAfterRefresh extends Error {}
+
+// Thrown from onopen for terminal open failures so onerror re-throws and stops
+// the retry loop permanently. Prevents infinite reconnects after auth failure.
+class StreamFatalError extends Error {}
+
+/**
+ * SSE-backed log stream for a task history.
+ *
+ * Single /stream-logs/{id} endpoint covers both running and completed tasks:
+ * the server streams historical log lines then emits a `finish` event with
+ * terminal status. No REST fallback needed.
+ *
+ * Uses @microsoft/fetch-event-source so the Bearer token can be attached as a
+ * header — the browser EventSource API has no headers option and could only
+ * carry cookies, which are not in scope for the SPA OAuth session.
+ *
+ * @param taskHistoryId - Task history to stream logs for.
+ * @param tail - When set, request only the last N lines per stream from the server.
+ */
+export function useTaskLogs(
+  taskHistoryId: number | string | undefined,
+  tail?: number
+): TaskLogsState {
+  const [textByStep, setTextByStep] = useState<Record<string, StepText>>({});
+  const [stepOrder, setStepOrder] = useState<string[]>([]);
+  const [streamStatus, setStreamStatus] = useState<StreamStatus>('idle');
+  const [finishStatus, setFinishStatus] = useState<FinishStatus | undefined>();
+  const [error, setError] = useState<StreamError | undefined>();
+
+  const offsetsRef = useRef<Record<string, number>>({});
+  // Stable ref so onclose can read current streamStatus without re-registering.
+  const streamStatusRef = useRef<StreamStatus>('idle');
+
+  useEffect(() => {
+    if (
+      taskHistoryId === undefined ||
+      taskHistoryId === null ||
+      taskHistoryId === ''
+    ) {
+      return;
+    }
+
+    // Reset state on id or tail change
+    offsetsRef.current = {};
+    setTextByStep({});
+    setStepOrder([]);
+    setFinishStatus(undefined);
+    setError(undefined);
+    streamStatusRef.current = 'connecting';
+    setStreamStatus('connecting');
+
+    const ctrl = new AbortController();
+    let currentToken = getToken() ?? '';
+    let refreshAttempted = false;
+    // Guards all state setters: set to true in cleanup so stale callbacks
+    // from an aborted stream cannot write into a subsequent stream's state.
+    let disposed = false;
+    // Set at every intentional terminal site so onclose can distinguish a clean
+    // shutdown from an unexpected connection drop.
+    let terminatedCleanly = false;
+
+    const baseUrl = `/stream-logs/${encodeURIComponent(String(taskHistoryId))}`;
+    const url =
+      tail !== undefined && tail > 0
+        ? `${baseUrl}?tail=${encodeURIComponent(String(tail))}`
+        : baseUrl;
+
+    fetchEventSource(url, {
+      signal: ctrl.signal,
+      openWhenHidden: true,
+
+      // Custom fetch so we can inject a fresh token on every (re)connect,
+      // including after a 401-triggered refresh.
+      fetch: (input, init) => {
+        // Preserve existing headers (fetchEventSource passes a plain object,
+        // but guard against Headers/string[][] just in case).
+        const headers = new Headers(init?.headers as HeadersInit | undefined);
+        // Only attach the header when a token is available; an empty Bearer
+        // value could confuse backend Bearer-detection logic.
+        if (currentToken) {
+          headers.set('Authorization', `Bearer ${currentToken}`);
+        }
+        return globalThis.fetch(input as RequestInfo, { ...init, headers });
+      },
+
+      onopen: async (response) => {
+        const contentType = response.headers.get('content-type') ?? '';
+        if (response.ok && contentType.includes(EventStreamContentType)) {
+          // Reset so that future reconnects (e.g. after a network blip that
+          // expires the token) are still allowed to attempt a refresh.
+          refreshAttempted = false;
+          if (!disposed) {
+            streamStatusRef.current = 'streaming';
+            setStreamStatus('streaming');
+          }
+          return;
+        }
+        // Auth-failure detection: HTML redirect (SPA fallback on expired session),
+        // or 401 after refresh fails. Mirror the apiClient behaviour by calling
+        // emitUnauthorized() so the shell can clear auth and redirect to login.
+        let isAuthFailure = false;
+        if (response.ok) {
+          // Status 200 but wrong content-type — backend redirected to the HTML
+          // login page (SPA fallback).
+          isAuthFailure = true;
+        } else if (response.status === 401 && !refreshAttempted) {
+          refreshAttempted = true;
+          const newToken = await refreshAccessToken();
+          if (newToken) {
+            currentToken = newToken;
+            throw new StreamRetriableAfterRefresh();
+          }
+          isAuthFailure = true;
+        } else if (response.status === 401) {
+          isAuthFailure = true;
+        }
+        if (isAuthFailure) {
+          emitUnauthorized();
+        }
+        // Build a content-type-aware message so "Stream open failed with status 200"
+        // never appears when the SPA fallback serves index.html.
+        const message = response.ok
+          ? `Stream endpoint returned non-SSE content: ${contentType || 'unknown'}`
+          : `Stream open failed with status ${response.status}`;
+        // Set error state, abort, then throw fatal sentinel so onerror re-throws
+        // it and permanently stops the retry loop.
+        if (!disposed) {
+          setError({ detail: { message } });
+          streamStatusRef.current = 'error';
+          setStreamStatus('error');
+        }
+        terminatedCleanly = true;
+        ctrl.abort();
+        throw new StreamFatalError(message);
+      },
+
+      onmessage: (ev) => {
+        if (disposed) {
+          return;
+        }
+        if (ev.data === '') {
+          return; // keepalive comment line
+        }
+
+        if (ev.event === 'finish') {
+          try {
+            const data = JSON.parse(ev.data) as { status?: FinishStatus };
+            if (data.status) {
+              setFinishStatus(data.status);
+            }
+          } catch {
+            // ignore malformed finish payload
+          }
+          streamStatusRef.current = 'finished';
+          setStreamStatus('finished');
+          terminatedCleanly = true;
+          ctrl.abort();
+          return;
+        }
+
+        if (ev.event === 'sep-error') {
+          let payload: StreamError;
+          try {
+            const parsed = JSON.parse(ev.data) as {
+              code?: number;
+              detail?: unknown;
+            };
+            payload = { code: parsed.code, detail: parsed.detail ?? ev.data };
+          } catch {
+            payload = { detail: String(ev.data || 'Unknown stream error') };
+          }
+          setError(payload);
+          streamStatusRef.current = 'error';
+          setStreamStatus('error');
+          terminatedCleanly = true;
+          ctrl.abort();
+          return;
+        }
+
+        // Default message event — log line
+        let payload: IncomingLog;
+        try {
+          payload = JSON.parse(ev.data) as IncomingLog;
+        } catch {
+          return;
+        }
+        const { msg, step, type, offset } = payload;
+        // `step: ''` is a valid stepless line, not a malformed payload:
+        // `useExecutionEvents` buckets it under the same empty key and the
+        // viewer labels that bucket "General". Rejecting it would drop output.
+        if (
+          typeof msg !== 'string' ||
+          typeof step !== 'string' ||
+          !type ||
+          typeof offset !== 'number'
+        ) {
+          return;
+        }
+        const key = `${step}_${type}`;
+        const previousOffset = offsetsRef.current[key];
+        if (previousOffset !== undefined && offset <= previousOffset) {
+          return;
+        }
+        offsetsRef.current[key] = offset;
+
+        setTextByStep((prev) => {
+          const existing = prev[step] ?? { stdout: '', stderr: '' };
+          return {
+            ...prev,
+            [step]: { ...existing, [type]: existing[type] + msg },
+          };
+        });
+        setStepOrder((prev) => (prev.includes(step) ? prev : [...prev, step]));
+      },
+
+      onerror: (err): number | undefined => {
+        if (err instanceof StreamRetriableAfterRefresh) {
+          // Immediate retry: token was just refreshed, no need to back off.
+          return 0;
+        }
+        if (err instanceof StreamFatalError) {
+          // State already set in onopen; re-throw to stop the retry loop.
+          throw err;
+        }
+        // Transient network blip — stay in 'connecting' and let fetchEventSource
+        // retry with default 1 000 ms backoff.
+        if (!disposed) {
+          streamStatusRef.current = 'connecting';
+          setStreamStatus('connecting');
+        }
+        return undefined;
+      },
+
+      onclose: () => {
+        if (disposed || terminatedCleanly) {
+          return;
+        }
+        // Server closed the connection without a finish/sep-error frame.
+        setError({ detail: { message: 'Task log stream connection closed.' } });
+        streamStatusRef.current = 'error';
+        setStreamStatus('error');
+      },
+    }).catch(() => {
+      // fetchEventSource rejects when AbortController fires — expected on
+      // unmount / id change. StreamFatalError re-thrown from onerror also
+      // lands here; state is already set so we can ignore it.
+    });
+
+    return () => {
+      disposed = true;
+      ctrl.abort();
+    };
+  }, [taskHistoryId, tail]);
+
+  return { textByStep, stepOrder, streamStatus, finishStatus, error };
+}
diff --git a/ui/packages/sep/framework/src/hooks/useTaskStats.test.tsx b/ui/packages/sep/framework/src/hooks/useTaskStats.test.tsx
new file mode 100644
index 00000000000..88820726422
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/useTaskStats.test.tsx
@@ -0,0 +1,156 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { renderHook, waitFor } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import type { ReactNode } from 'react';
+
+const { mockSepGet } = vi.hoisted(() => ({ mockSepGet: vi.fn() }));
+
+vi.mock('@sep/api', async () => {
+  const actual = await vi.importActual<typeof import('@sep/api')>('@sep/api');
+  return {
+    ...actual,
+    sepApi: { GET: mockSepGet },
+  };
+});
+
+import { useTaskStats } from './useTaskStats';
+
+const SUCCESS_RESPONSE = {
+  data: {
+    engine: 'nomad',
+    total: 1,
+    status: { pass: 1, fail: 0 },
+    duration: { average_seconds: 1, last_seconds: 1, total_seconds: 1 },
+    last_finished_at: new Date().toISOString(),
+  },
+  error: undefined,
+  response: { ok: true, status: 200, statusText: 'OK' } as Response,
+};
+
+function wrapper() {
+  const client = new QueryClient({
+    defaultOptions: { queries: { retry: false, gcTime: 0, staleTime: 0 } },
+  });
+  return ({ children }: { children: ReactNode }) => (
+    <QueryClientProvider client={client}>{children}</QueryClientProvider>
+  );
+}
+
+beforeEach(() => {
+  mockSepGet.mockReset();
+});
+
+describe('useTaskStats', () => {
+  it('does not call the API when taskName is undefined', () => {
+    mockSepGet.mockResolvedValue(SUCCESS_RESPONSE);
+    renderHook(() => useTaskStats(undefined), { wrapper: wrapper() });
+    expect(mockSepGet).not.toHaveBeenCalled();
+  });
+
+  it('does not call the API for whitespace-only taskName', () => {
+    mockSepGet.mockResolvedValue(SUCCESS_RESPONSE);
+    renderHook(() => useTaskStats('   '), { wrapper: wrapper() });
+    expect(mockSepGet).not.toHaveBeenCalled();
+  });
+
+  it('does not call the API when enabled=false', () => {
+    mockSepGet.mockResolvedValue(SUCCESS_RESPONSE);
+    renderHook(() => useTaskStats('foo', false), { wrapper: wrapper() });
+    expect(mockSepGet).not.toHaveBeenCalled();
+  });
+
+  it('calls /api/sep/task-stats/{task_name} with the trimmed name in path params', async () => {
+    mockSepGet.mockResolvedValue(SUCCESS_RESPONSE);
+    renderHook(() => useTaskStats('  my-task  '), { wrapper: wrapper() });
+    await waitFor(() => {
+      expect(mockSepGet).toHaveBeenCalledWith(
+        '/api/sep/task-stats/{task_name}',
+        {
+          params: { path: { task_name: 'my-task' } },
+        }
+      );
+    });
+  });
+
+  it('passes URL-special characters through to the openapi-fetch client', async () => {
+    mockSepGet.mockResolvedValue(SUCCESS_RESPONSE);
+    renderHook(() => useTaskStats('weird/name with spaces&q=?'), {
+      wrapper: wrapper(),
+    });
+    await waitFor(() => {
+      expect(mockSepGet).toHaveBeenCalledWith(
+        '/api/sep/task-stats/{task_name}',
+        {
+          params: { path: { task_name: 'weird/name with spaces&q=?' } },
+        }
+      );
+    });
+  });
+
+  it('throws an ApiError with the response status (no retry on 401)', async () => {
+    mockSepGet.mockResolvedValue({
+      data: undefined,
+      error: { detail: 'nope' },
+      response: {
+        ok: false,
+        status: 401,
+        statusText: 'Unauthorized',
+        url: 'http://localhost/api/sep/task-stats/foo',
+      } as Response,
+    });
+    const { result } = renderHook(() => useTaskStats('foo'), {
+      wrapper: wrapper(),
+    });
+    await waitFor(() => {
+      expect(result.current.isError).toBe(true);
+    });
+    const { ApiError } = await import('@sep/api');
+    expect(result.current.error).toBeInstanceOf(ApiError);
+    const err = result.current.error as InstanceType<typeof ApiError>;
+    expect(err.status).toBe(401);
+    expect(err.message).toBe('nope');
+    expect(mockSepGet).toHaveBeenCalledTimes(1);
+  });
+
+  it('throws an ApiError with status 502 and does not retry on upstream failure', async () => {
+    mockSepGet.mockResolvedValue({
+      data: undefined,
+      error: { detail: 'tasks unreachable' },
+      response: {
+        ok: false,
+        status: 502,
+        statusText: 'Bad Gateway',
+        url: 'http://localhost/api/sep/task-stats/foo',
+      } as Response,
+    });
+    const { result } = renderHook(() => useTaskStats('foo'), {
+      wrapper: wrapper(),
+    });
+    await waitFor(() => {
+      expect(result.current.isError).toBe(true);
+    });
+    const { ApiError } = await import('@sep/api');
+    expect(result.current.error).toBeInstanceOf(ApiError);
+    const err = result.current.error as InstanceType<typeof ApiError>;
+    expect(err.status).toBe(502);
+    expect(err.message).toBe('tasks unreachable');
+    expect(mockSepGet).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/ui/packages/sep/framework/src/hooks/useTaskStats.ts b/ui/packages/sep/framework/src/hooks/useTaskStats.ts
new file mode 100644
index 00000000000..303c8f38b89
--- /dev/null
+++ b/ui/packages/sep/framework/src/hooks/useTaskStats.ts
@@ -0,0 +1,69 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useQuery } from '@tanstack/react-query';
+import { sepApi, throwOnApiError } from '@sep/api';
+import { sepRetry } from './sepRetry';
+
+/**
+ * Consumer-side view of the task-stats payload.
+ *
+ * The SEP proxy at ``app/sep/api/routes/task_stats.py`` returns the raw
+ * upstream payload (``dict[str, Any]``) on success and a ``502`` with a
+ * ``{"detail": ...}`` body on upstream failure (surfaced here as an
+ * ``ApiError`` on the React Query error slot — not as ``{}``). Every field
+ * is optional because the upstream success payload itself is untyped.
+ * Consumers thus see two distinct empty-state signals: upstream failure as
+ * ``isError`` (no ``data`` to inspect), and a successful-but-empty stats
+ * payload as ``data`` present with ``total === 0``.
+ */
+export interface TaskStatsView {
+  engine?: string;
+  total?: number;
+  status?: { pass?: number; fail?: number };
+  duration?: {
+    average_seconds?: number | null;
+    last_seconds?: number | null;
+    total_seconds?: number | null;
+  };
+  last_finished_at?: string | null;
+}
+
+/**
+ * Query the aggregated execution statistics for a task by name.
+ *
+ * The task identifier is the task's ``name`` (string), not the database id.
+ * The hook is a no-op when ``taskName`` is missing or whitespace-only.
+ */
+export function useTaskStats(taskName: string | undefined, enabled = true) {
+  const trimmed = taskName?.trim();
+  return useQuery<TaskStatsView>({
+    queryKey: ['task-stats', trimmed],
+    enabled: enabled && Boolean(trimmed),
+    queryFn: async () => {
+      const data = await throwOnApiError(
+        sepApi.GET('/api/sep/task-stats/{task_name}', {
+          params: { path: { task_name: trimmed as string } },
+        })
+      );
+      return data as unknown as TaskStatsView;
+    },
+    refetchOnWindowFocus: false,
+    retry: sepRetry,
+    staleTime: 30_000,
+  });
+}
diff --git a/ui/packages/sep/framework/src/index.ts b/ui/packages/sep/framework/src/index.ts
new file mode 100644
index 00000000000..c173a73a861
--- /dev/null
+++ b/ui/packages/sep/framework/src/index.ts
@@ -0,0 +1,215 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+// Constants
+export { SEP_TABLE_CLASS } from './constants';
+
+// Components
+export { SchemaFormRenderer } from './components/SchemaFormRenderer';
+export type {
+  RenderFieldArgs,
+  RenderFieldOverride,
+} from './components/SchemaFormRenderer';
+export { SchemaListView } from './components/SchemaListView';
+export type {
+  RenderListColumnArgs,
+  RenderListColumnOverride,
+} from './components/SchemaListView';
+export {
+  SchemaDrivenPlugin,
+  DeleteConfirmDialog,
+  PluginCreatePage,
+  PluginDetailPage,
+  PluginListPage,
+  PluginSchedulePage,
+} from './components/SchemaDrivenPlugin';
+export type {
+  PluginFormSlotProps,
+  RenderFormSlot,
+} from './components/SchemaDrivenPlugin';
+export type { DeleteConfirmDialogProps } from './components/SchemaDrivenPlugin';
+export type { TaskExecuteAction } from './components/SchemaDrivenPlugin/PluginDetailPage';
+export type { TaskExecuteBody } from './hooks';
+export { pathToEntityList } from './components/SchemaDrivenPlugin/PluginDetailPage';
+export {
+  getStoredForm,
+  STORED_FORM_KEY,
+} from './components/SchemaDrivenPlugin';
+export { ServiceSelector } from './components/ServiceSelector';
+export type { ServiceSelectorProps } from './components/ServiceSelector';
+export { SchemaSelector } from './components/SchemaSelector';
+export type { SchemaSelectorProps } from './components/SchemaSelector';
+export { RemoteChoiceSelector } from './components/RemoteChoiceSelector';
+export type { RemoteChoiceSelectorProps } from './components/RemoteChoiceSelector';
+export { TableSelector } from './components/TableSelector';
+export type { TableSelectorProps } from './components/TableSelector';
+export { FreeSoloSelect } from './components/FreeSoloSelect';
+export type { FreeSoloSelectProps } from './components/FreeSoloSelect';
+export {
+  HostSelector,
+  StandaloneHostSelector,
+} from './components/HostSelector';
+export type { StandaloneHostSelectorProps } from './components/HostSelector';
+export {
+  TaskLogViewer,
+  LogStepTabs,
+  LogOutputPane,
+  ExecutionEventsPanel,
+  StreamErrorBlock,
+  StatusBadge,
+} from './components/TaskLogViewer';
+export type {
+  TaskLogViewerProps,
+  BadgeStatus,
+} from './components/TaskLogViewer';
+export {
+  TaskHistoryTable,
+  TaskHistoryStatusBadge,
+  isTaskHistoryStatus,
+  ChainDisplay,
+  TaskFilesDialog,
+} from './components/TaskHistoryTable';
+export type {
+  TaskHistoryTableProps,
+  TaskHistoryEntry,
+  TaskHistoryStatus,
+  PaginatedTaskHistory,
+  TaskFilesDialogProps,
+} from './components/TaskHistoryTable';
+export { SnippetExecutionAccordion } from './components/SnippetExecutionAccordion';
+export type { SnippetExecutionAccordionProps } from './components/SnippetExecutionAccordion';
+export { ChainBuilder } from './components/ChainBuilder';
+
+export type {
+  ChainBuilderProps,
+  ChainValue,
+  AvailableTask,
+} from './components/ChainBuilder';
+export {
+  AlertOnFailField,
+  ALERT_ON_FAIL_FIELD_NAME,
+} from './components/AlertOnFailField';
+export { ScheduledTasksPanel } from './components/ScheduledTasksPanel';
+export {
+  describePeriod,
+  formatRelativeTime,
+  formatAbsoluteTime,
+  selectSchedule,
+} from './components/ScheduledTasksPanel';
+export type { PeriodDescription } from './components/ScheduledTasksPanel';
+export { ScheduleCell } from './components/ScheduleCell';
+export type { ScheduleCellProps } from './components/ScheduleCell';
+export { ScheduleSummary } from './components/ScheduleSummary';
+export type { ScheduleSummaryProps } from './components/ScheduleSummary';
+export {
+  useScheduledTasksForPlugin,
+  useCreateScheduledTask,
+  useUpdateScheduledTask,
+  useDeleteScheduledTask,
+  type PeriodicTaskResponse,
+  type PeriodicTaskCreate,
+  type PeriodicTaskUpdate,
+  type CrontabSchedule,
+  type IntervalSchedule,
+  type PeriodicTaskExecuteRequest,
+} from './components/ScheduledTasksPanel/hooks';
+export { default as DetailSyntaxHighlighter } from './components/SchemaDrivenPlugin/DetailSyntaxHighlighter';
+export { detailSyntaxBlockSx } from './components/SchemaDrivenPlugin/detailSyntaxStyles';
+export type { DetailSyntaxLanguage } from './components/SchemaDrivenPlugin/detailSyntaxStyles';
+
+// Hooks
+export {
+  useServices,
+  useSchemas,
+  useTables,
+  useHosts,
+  useResolvedServiceField,
+  useRemoteChoices,
+} from './hooks';
+export type {
+  ServiceOption,
+  ServiceNodeOption,
+  ServiceType,
+  SchemaOption,
+  TableOption,
+  HostOption,
+  UseServicesOptions,
+  UseSchemasOptions,
+  UseTablesOptions,
+  UseHostsOptions,
+  UseRemoteChoicesOptions,
+  ResolvedServiceField,
+} from './hooks';
+export { cascadeParentResetKey } from './utils/cascadeParentResetKey';
+
+export {
+  useTaskLogs,
+  useExecutionEvents,
+  useLogDownload,
+  useTaskHistory,
+  useTaskHistoryByName,
+  useTaskHistoryByNames,
+  useStopTaskHistory,
+  useSnippetPluginExecution,
+  useSnippetPluginSchema,
+  isRunningStatus,
+  RUNNING_STATUSES,
+  useTaskHistoryFiles,
+  useTaskFileDownload,
+} from './hooks';
+export type {
+  TaskLogsState,
+  StepText,
+  LogType,
+  FinishStatus,
+  StreamError,
+  StreamStatus,
+  ExecutionEvent,
+  ExecutionEventsState,
+  DownloadLog,
+  FileMetadata,
+  TaskHistoryFilesMap,
+  UseTaskHistoryFilesOptions,
+  TaskFileDownloadParams,
+  UseSnippetPluginExecutionOptions,
+} from './hooks';
+
+export {
+  SNIPPET_FORM_RESERVED_FIELD_NAMES,
+  buildSnippetExecutionFormPayload,
+} from './utils/snippetFormSubmission';
+export type { SnippetExecutionFormPayload } from './utils/snippetFormSubmission';
+
+export type {
+  SnippetExecutionRequest,
+  SnippetExecutionResponse,
+} from './types/snippetPlugin';
+
+export { resolvePath } from './utils/resolvePath';
+
+export { downloadBlob } from './utils/downloadBlob';
+
+export {
+  SNIPPETS_PLUGINS_API_BASE,
+  SNIPPET_PLUGIN_PER_SNIPPET_BASE,
+  snippetPluginApprovalPath,
+  snippetPluginDownloadPath,
+  snippetPluginExecutePath,
+  snippetPluginHistoryPath,
+  snippetPluginPreviewPath,
+  snippetPluginSchemaPath,
+} from './snippetPluginPaths';
diff --git a/ui/packages/sep/framework/src/snippetPluginPaths.test.ts b/ui/packages/sep/framework/src/snippetPluginPaths.test.ts
new file mode 100644
index 00000000000..9cddb19ab4c
--- /dev/null
+++ b/ui/packages/sep/framework/src/snippetPluginPaths.test.ts
@@ -0,0 +1,82 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, expect, it } from 'vitest';
+import {
+  SNIPPET_PLUGIN_PER_SNIPPET_BASE,
+  snippetPluginApprovalPath,
+  snippetPluginDownloadPath,
+  snippetPluginExecutePath,
+  snippetPluginHistoryPath,
+  snippetPluginPreviewPath,
+  snippetPluginSchemaPath,
+} from './snippetPluginPaths';
+
+describe('snippetPluginPaths', () => {
+  it('exposes the /snippet sub-prefix for per-snippet operations', () => {
+    expect(SNIPPET_PLUGIN_PER_SNIPPET_BASE).toBe('/apps/snippets/snippet');
+  });
+
+  it('carries the filename in the snippet_filename query parameter', () => {
+    expect(snippetPluginSchemaPath('hello.sh')).toBe(
+      '/apps/snippets/snippet/schema?snippet_filename=hello.sh'
+    );
+    expect(snippetPluginExecutePath('hello.sh')).toBe(
+      '/apps/snippets/snippet/execute?snippet_filename=hello.sh'
+    );
+    expect(snippetPluginPreviewPath('hello.sh')).toBe(
+      '/apps/snippets/snippet/preview?snippet_filename=hello.sh'
+    );
+    expect(snippetPluginDownloadPath('hello.sh')).toBe(
+      '/apps/snippets/snippet/download?snippet_filename=hello.sh'
+    );
+    expect(snippetPluginHistoryPath('hello.sh')).toBe(
+      '/apps/snippets/snippet/history?snippet_filename=hello.sh'
+    );
+    expect(snippetPluginApprovalPath('hello.sh')).toBe(
+      '/apps/snippets/snippet/approval?snippet_filename=hello.sh'
+    );
+  });
+
+  it('escapes nested filenames using URLSearchParams encoding', () => {
+    const filename = 'diag/slow-query.sh';
+    expect(snippetPluginSchemaPath(filename)).toBe(
+      '/apps/snippets/snippet/schema?snippet_filename=diag%2Fslow-query.sh'
+    );
+    expect(snippetPluginExecutePath(filename)).toBe(
+      '/apps/snippets/snippet/execute?snippet_filename=diag%2Fslow-query.sh'
+    );
+  });
+
+  it('never bakes nested filenames into the URL path itself', () => {
+    const filename = 'diag/slow-query.sh';
+    for (const builder of [
+      snippetPluginSchemaPath,
+      snippetPluginExecutePath,
+      snippetPluginPreviewPath,
+      snippetPluginDownloadPath,
+      snippetPluginHistoryPath,
+      snippetPluginApprovalPath,
+    ]) {
+      const url = builder(filename);
+      const [path] = url.split('?');
+      expect(path).not.toContain('diag');
+      expect(path).not.toContain('slow-query');
+      expect(path).not.toContain('%2F');
+    }
+  });
+});
diff --git a/ui/packages/sep/framework/src/snippetPluginPaths.ts b/ui/packages/sep/framework/src/snippetPluginPaths.ts
new file mode 100644
index 00000000000..28e8c8877b5
--- /dev/null
+++ b/ui/packages/sep/framework/src/snippetPluginPaths.ts
@@ -0,0 +1,64 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/**
+ * Snippets plugin JSON API path prefix (axios `apiClient` uses base `/api`).
+ *
+ * Per-snippet routes live under `${SNIPPETS_PLUGINS_API_BASE}/snippet/...` and
+ * carry the snippet filename in the `snippet_filename` query parameter.
+ * Query strings are opaque to the routing layer, so the contract
+ * survives the trip end-to-end regardless of intermediate normalisation.
+ */
+export const SNIPPETS_PLUGINS_API_BASE = '/apps/snippets';
+
+/** API path prefix for per-snippet operations (filename rides in the query string). */
+export const SNIPPET_PLUGIN_PER_SNIPPET_BASE = `${SNIPPETS_PLUGINS_API_BASE}/snippet`;
+
+function buildPerSnippetPath(action: string, filename: string): string {
+  const params = new URLSearchParams({ snippet_filename: filename });
+  return `${SNIPPET_PLUGIN_PER_SNIPPET_BASE}/${action}?${params.toString()}`;
+}
+
+/** Path for `GET` per-snippet plugin schema. */
+export function snippetPluginSchemaPath(filename: string): string {
+  return buildPerSnippetPath('schema', filename);
+}
+
+/** Path for `POST` snippet execution. */
+export function snippetPluginExecutePath(filename: string): string {
+  return buildPerSnippetPath('execute', filename);
+}
+
+/** Path for `GET` script preview. */
+export function snippetPluginPreviewPath(filename: string): string {
+  return buildPerSnippetPath('preview', filename);
+}
+
+/** Path for `GET` raw snippet file download. */
+export function snippetPluginDownloadPath(filename: string): string {
+  return buildPerSnippetPath('download', filename);
+}
+
+/** Path for `GET` per-snippet execution history. */
+export function snippetPluginHistoryPath(filename: string): string {
+  return buildPerSnippetPath('history', filename);
+}
+
+/** Path for `PUT`/`DELETE` snippet approval. */
+export function snippetPluginApprovalPath(filename: string): string {
+  return buildPerSnippetPath('approval', filename);
+}
diff --git a/ui/packages/sep/framework/src/types/snippetPlugin.ts b/ui/packages/sep/framework/src/types/snippetPlugin.ts
new file mode 100644
index 00000000000..463b84a3a5a
--- /dev/null
+++ b/ui/packages/sep/framework/src/types/snippetPlugin.ts
@@ -0,0 +1,29 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/** Body shape accepted by `POST /api/apps/snippets/{filename}/execute`. */
+export interface SnippetExecutionRequest {
+  executor_host: string;
+  sudo?: boolean;
+  args?: Record<string, unknown>;
+}
+
+export interface SnippetExecutionResponse {
+  task_name: string;
+  task_id: number | null;
+  snippet_filename: string;
+}
diff --git a/ui/packages/sep/framework/src/utils/cascadeParentResetKey.ts b/ui/packages/sep/framework/src/utils/cascadeParentResetKey.ts
new file mode 100644
index 00000000000..67898e17aeb
--- /dev/null
+++ b/ui/packages/sep/framework/src/utils/cascadeParentResetKey.ts
@@ -0,0 +1,38 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/**
+ * Stable key for resetting cascaded children when an upstream selector changes.
+ *
+ * Handles hydrated option objects, numeric ids, digit-only strings (treated as
+ * ids), and free-typed non-id strings (``custom:``). Empty / missing parents
+ * share ``id:none``.
+ */
+export function cascadeParentResetKey(parent: unknown): string {
+  if (parent && typeof parent === 'object' && 'id' in parent) {
+    const id = (parent as { id: unknown }).id;
+    return `id:${id ?? 'none'}`;
+  }
+  if (typeof parent === 'number' && Number.isFinite(parent)) {
+    return `id:${parent}`;
+  }
+  if (typeof parent === 'string' && parent.trim() !== '') {
+    const text = parent.trim();
+    return /^\d+$/.test(text) ? `id:${text}` : `custom:${text}`;
+  }
+  return 'id:none';
+}
diff --git a/ui/packages/sep/framework/src/utils/downloadBlob.test.ts b/ui/packages/sep/framework/src/utils/downloadBlob.test.ts
new file mode 100644
index 00000000000..4160fc2d3b8
--- /dev/null
+++ b/ui/packages/sep/framework/src/utils/downloadBlob.test.ts
@@ -0,0 +1,81 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { downloadBlob } from './downloadBlob';
+
+describe('downloadBlob', () => {
+  const createObjectURL = vi.fn(() => 'blob:mock-url');
+  const revokeObjectURL = vi.fn();
+  let clickSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    vi.useFakeTimers();
+    createObjectURL.mockClear();
+    revokeObjectURL.mockClear();
+    vi.stubGlobal('URL', { ...URL, createObjectURL, revokeObjectURL });
+    clickSpy = vi
+      .spyOn(HTMLAnchorElement.prototype, 'click')
+      .mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    vi.unstubAllGlobals();
+    vi.useRealTimers();
+  });
+
+  it('clicks a hidden anchor with the blob URL and suggested filename', () => {
+    const blob = new Blob(['data']);
+
+    downloadBlob(blob, 'report.pdf');
+
+    expect(createObjectURL).toHaveBeenCalledWith(blob);
+    expect(clickSpy).toHaveBeenCalledOnce();
+    const anchor = clickSpy.mock.instances[0] as HTMLAnchorElement;
+    expect(anchor.href).toContain('blob:mock-url');
+    expect(anchor.download).toBe('report.pdf');
+    // The anchor is hidden so it never affects layout or focus order.
+    expect(anchor.style.display).toBe('none');
+    // Anchor is removed after the click; nothing lingers in the DOM.
+    expect(document.querySelector('a')).toBeNull();
+  });
+
+  it('defers revoking the object URL until after the current tick', () => {
+    downloadBlob(new Blob(['data']), 'report.pdf');
+
+    // Not revoked synchronously — Safari/Firefox race the download otherwise.
+    expect(revokeObjectURL).not.toHaveBeenCalled();
+    vi.runAllTimers();
+    expect(revokeObjectURL).toHaveBeenCalledWith('blob:mock-url');
+  });
+
+  it('removes the anchor and still revokes the URL when the anchor click throws', () => {
+    clickSpy.mockImplementation(() => {
+      throw new Error('click failed');
+    });
+
+    expect(() => downloadBlob(new Blob(['data']), 'report.pdf')).toThrow(
+      'click failed'
+    );
+    // The finally block cleans up even on the throw path.
+    expect(document.querySelector('a')).toBeNull();
+    vi.runAllTimers();
+    expect(revokeObjectURL).toHaveBeenCalledWith('blob:mock-url');
+  });
+});
diff --git a/ui/packages/sep/framework/src/utils/downloadBlob.ts b/ui/packages/sep/framework/src/utils/downloadBlob.ts
new file mode 100644
index 00000000000..5514b68ac43
--- /dev/null
+++ b/ui/packages/sep/framework/src/utils/downloadBlob.ts
@@ -0,0 +1,44 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/**
+ * Trigger a browser download for an in-memory Blob.
+ *
+ * Writes the blob to an object URL, clicks a hidden anchor to start the
+ * download, then defers revoking the URL. Callers handle the fetch; this owns
+ * everything after the Blob is in hand.
+ *
+ * @param data Blob to download.
+ * @param filename Suggested file name for the saved download.
+ */
+export function downloadBlob(data: Blob, filename: string): void {
+  const url = URL.createObjectURL(data);
+  const anchor = document.createElement('a');
+  anchor.href = url;
+  anchor.download = filename;
+  // Keep the anchor out of the layout/focus order; it only exists to be clicked.
+  anchor.style.display = 'none';
+  document.body.appendChild(anchor);
+  try {
+    anchor.click();
+  } finally {
+    anchor.remove();
+    // Defer revocation: Safari and Firefox can race the anchor-triggered
+    // download if the blob URL is revoked in the same tick as .click().
+    setTimeout(() => URL.revokeObjectURL(url), 0);
+  }
+}
diff --git a/ui/packages/sep/framework/src/utils/extractId.test.ts b/ui/packages/sep/framework/src/utils/extractId.test.ts
new file mode 100644
index 00000000000..afc1c989101
--- /dev/null
+++ b/ui/packages/sep/framework/src/utils/extractId.test.ts
@@ -0,0 +1,61 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { extractId } from './extractId';
+
+describe('extractId', () => {
+  it('passes a finite number through', () => {
+    expect(extractId(7)).toBe(7);
+    expect(extractId(0)).toBe(0);
+  });
+
+  it('parses a decimal-integer string', () => {
+    expect(extractId('42')).toBe(42);
+    expect(extractId(' 42 ')).toBe(42);
+    expect(extractId('-3')).toBe(-3);
+  });
+
+  it('extracts the id from an option object recursively', () => {
+    expect(extractId({ id: '9', name: 'svc' })).toBe(9);
+    expect(extractId({ id: { id: 9 } })).toBe(9);
+  });
+
+  it('rejects strings that only look numeric', () => {
+    // `Number` would turn these into 0 / 1.5 / 16, each of which then reads as a
+    // resolvable inventory id and fires a lookup for a service that cannot exist.
+    expect(extractId('   ')).toBeNull();
+    expect(extractId('')).toBeNull();
+    expect(extractId('1.5')).toBeNull();
+    expect(extractId('0x10')).toBeNull();
+    expect(extractId('12abc')).toBeNull();
+  });
+
+  it('rejects a fractional or unsafe-integer number, like the string branch', () => {
+    expect(extractId(1.5)).toBeNull();
+    expect(extractId(Number.MAX_SAFE_INTEGER + 1)).toBeNull();
+    expect(extractId({ id: 1.5 })).toBeNull();
+  });
+
+  it('rejects non-finite numbers and unrelated values', () => {
+    expect(extractId(Number.NaN)).toBeNull();
+    expect(extractId(Number.POSITIVE_INFINITY)).toBeNull();
+    expect(extractId(null)).toBeNull();
+    expect(extractId(undefined)).toBeNull();
+    expect(extractId({ name: 'no id' })).toBeNull();
+  });
+});
diff --git a/ui/packages/sep/framework/src/utils/extractId.ts b/ui/packages/sep/framework/src/utils/extractId.ts
new file mode 100644
index 00000000000..e07c083f6a1
--- /dev/null
+++ b/ui/packages/sep/framework/src/utils/extractId.ts
@@ -0,0 +1,51 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/**
+ * Extract a numeric id from a value that may be:
+ *   - a safe-integer number (returned as-is),
+ *   - a decimal-integer string (parsed; fractional, hex, whitespace-only and
+ *     otherwise non-integer strings return `null`),
+ *   - an option object with an `id` field (recursively extracted),
+ *   - or anything else (returns `null`).
+ *
+ * Used by the cascading selectors to handle parent values that may come from
+ * either an upstream selector (object form) or a persisted form default
+ * (scalar form, possibly stringified).
+ */
+export function extractId(value: unknown): number | null {
+  if (typeof value === 'number') {
+    // Same bar as the string branch below: a fractional or unsafe-integer id
+    // would otherwise pass here and enable a lookup no service can satisfy.
+    return Number.isSafeInteger(value) ? value : null;
+  }
+  if (typeof value === 'string' && value !== '') {
+    // Only decimal integers: `Number` would coerce a whitespace-only string to
+    // `0` and accept `'1.5'` / `'0x10'`, each of which then reads as a
+    // resolvable inventory id and fires a lookup for a service that cannot exist.
+    const trimmed = value.trim();
+    if (!/^-?\d+$/.test(trimmed)) {
+      return null;
+    }
+    const n = Number(trimmed);
+    return Number.isSafeInteger(n) ? n : null;
+  }
+  if (value && typeof value === 'object' && 'id' in value) {
+    return extractId((value as { id: unknown }).id);
+  }
+  return null;
+}
diff --git a/ui/packages/sep/framework/src/utils/referenceOption.test.ts b/ui/packages/sep/framework/src/utils/referenceOption.test.ts
new file mode 100644
index 00000000000..6051504faad
--- /dev/null
+++ b/ui/packages/sep/framework/src/utils/referenceOption.test.ts
@@ -0,0 +1,44 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, expect, it } from 'vitest';
+import {
+  isHydratedReferenceOption,
+  resolveReferenceOption,
+} from './referenceOption';
+
+describe('referenceOption', () => {
+  const options = [
+    { id: 7, name: 'mysql-prod', type: 'mysql' },
+    { id: 9, name: 'pg-prod', type: 'postgresql' },
+  ];
+
+  it('detects hydrated option objects', () => {
+    expect(isHydratedReferenceOption({ id: 7, name: 'mysql-prod' })).toBe(true);
+    expect(isHydratedReferenceOption(7)).toBe(false);
+    expect(isHydratedReferenceOption({ id: 7 })).toBe(false);
+  });
+
+  it('resolves scalar ids to inventory options', () => {
+    expect(resolveReferenceOption(7, options)).toEqual(options[0]);
+    expect(resolveReferenceOption('9', options)).toEqual(options[1]);
+  });
+
+  it('returns null for unknown ids until options include a match', () => {
+    expect(resolveReferenceOption(99, options)).toBeNull();
+  });
+});
diff --git a/ui/packages/sep/framework/src/utils/referenceOption.ts b/ui/packages/sep/framework/src/utils/referenceOption.ts
new file mode 100644
index 00000000000..223d412dfed
--- /dev/null
+++ b/ui/packages/sep/framework/src/utils/referenceOption.ts
@@ -0,0 +1,70 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { extractId } from './extractId';
+
+/** Minimal inventory option shape used by reference selectors. */
+export interface ReferenceOption {
+  id: number;
+  name?: string;
+}
+
+/**
+ * Return whether `value` is a fully hydrated inventory option object.
+ *
+ * Persisted `data['_form']` bodies store reference fields as scalar ids;
+ * live create/edit forms store the richer option object until submit coercion.
+ */
+export function isHydratedReferenceOption(
+  value: unknown
+): value is ReferenceOption {
+  return (
+    value !== null &&
+    typeof value === 'object' &&
+    'id' in value &&
+    'name' in value &&
+    typeof (value as { name: unknown }).name === 'string'
+  );
+}
+
+/**
+ * Resolve a stored reference value into an inventory option for display.
+ *
+ * Accepts a scalar id (number or numeric string), a partially populated option
+ * object, or an already hydrated option. Returns `null` when the id cannot be
+ * matched in `options` yet (for example while services are still loading).
+ */
+export function resolveReferenceOption<T extends ReferenceOption>(
+  stored: unknown,
+  options: readonly T[]
+): T | null {
+  if (stored === null || stored === undefined || stored === '') {
+    return null;
+  }
+  const id = extractId(stored);
+  if (id !== null) {
+    const match = options.find((option) => option.id === id);
+    if (match) {
+      return match;
+    }
+    if (isHydratedReferenceOption(stored)) {
+      return stored as T;
+    }
+    return null;
+  }
+  return null;
+}
diff --git a/ui/packages/sep/framework/src/utils/resolvePath.test.ts b/ui/packages/sep/framework/src/utils/resolvePath.test.ts
new file mode 100644
index 00000000000..8ea1ea1b126
--- /dev/null
+++ b/ui/packages/sep/framework/src/utils/resolvePath.test.ts
@@ -0,0 +1,103 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ */
+
+import { describe, expect, it } from 'vitest';
+
+import { resolvePath } from './resolvePath';
+
+describe('resolvePath', () => {
+  it('resolves a nested dotted path', () => {
+    expect(resolvePath({ a: { b: { c: 1 } } }, 'a.b.c')).toBe(1);
+  });
+
+  it('returns undefined when an intermediate node is missing', () => {
+    expect(resolvePath({ a: {} }, 'a.b.c')).toBeUndefined();
+  });
+
+  it('returns undefined when an intermediate node is a primitive', () => {
+    expect(resolvePath({ a: 1 }, 'a.b')).toBeUndefined();
+  });
+
+  it('returns the verbatim primitive leaf, including falsy values', () => {
+    expect(resolvePath({ a: 0 }, 'a')).toBe(0);
+    expect(resolvePath({ a: false }, 'a')).toBe(false);
+    expect(resolvePath({ a: '' }, 'a')).toBe('');
+  });
+
+  it('returns null leaves verbatim — caller applies its own empty guard', () => {
+    expect(resolvePath({ a: null }, 'a')).toBeNull();
+  });
+
+  it('resolves array index syntax', () => {
+    expect(resolvePath({ xs: [{ n: 1 }, { n: 2 }] }, 'xs[1].n')).toBe(2);
+  });
+
+  it('resolves multi-dimensional array indices', () => {
+    expect(
+      resolvePath(
+        {
+          m: [
+            [1, 2],
+            [3, 4],
+          ],
+        },
+        'm[1][0]'
+      )
+    ).toBe(3);
+  });
+
+  it('returns undefined when an array index is out of bounds', () => {
+    expect(resolvePath({ xs: [1] }, 'xs[5]')).toBeUndefined();
+  });
+
+  it('returns undefined for an empty path', () => {
+    expect(resolvePath({ a: 1 }, '')).toBeUndefined();
+  });
+
+  it('returns undefined when record is null or undefined', () => {
+    expect(resolvePath(null, 'a')).toBeUndefined();
+    expect(resolvePath(undefined, 'a')).toBeUndefined();
+  });
+
+  it('returns undefined when an array index syntax targets a non-array', () => {
+    expect(resolvePath({ xs: { 0: 'oops' } }, 'xs[0]')).toBeUndefined();
+  });
+
+  describe('security', () => {
+    it('refuses to walk __proto__', () => {
+      expect(resolvePath({}, '__proto__')).toBeUndefined();
+    });
+
+    it('refuses to walk constructor', () => {
+      expect(resolvePath({}, 'constructor')).toBeUndefined();
+    });
+
+    it('refuses to walk prototype', () => {
+      expect(resolvePath({ a: {} }, 'a.prototype.toString')).toBeUndefined();
+    });
+
+    it('refuses nested __proto__ traversal', () => {
+      expect(resolvePath({ a: {} }, 'a.__proto__.polluted')).toBeUndefined();
+    });
+
+    it('refuses inherited properties — own-property-only', () => {
+      const proto = { inherited: 1 };
+      const child = Object.create(proto) as Record<string, unknown>;
+      child.own = 2;
+      expect(resolvePath(child, 'own')).toBe(2);
+      expect(resolvePath(child, 'inherited')).toBeUndefined();
+    });
+
+    it('returns undefined for invalid segments', () => {
+      expect(resolvePath({ 'foo-bar': 1 }, 'foo-bar')).toBeUndefined();
+      expect(resolvePath({ '1foo': 1 }, '1foo')).toBeUndefined();
+      expect(resolvePath({ a: 1 }, 'foo bar')).toBeUndefined();
+    });
+  });
+});
diff --git a/ui/packages/sep/framework/src/utils/resolvePath.ts b/ui/packages/sep/framework/src/utils/resolvePath.ts
new file mode 100644
index 00000000000..13c6101e6bd
--- /dev/null
+++ b/ui/packages/sep/framework/src/utils/resolvePath.ts
@@ -0,0 +1,61 @@
+// Copyright (C) 2026 Percona LLC
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+const SAFE_SEGMENT = /^([A-Za-z_][A-Za-z0-9_]*)((?:\[\d+\])*)$/;
+const ARRAY_INDEX = /\[(\d+)\]/g;
+const FORBIDDEN_KEYS = new Set([
+  '__proto__',
+  'constructor',
+  'prototype',
+  '__class__',
+]);
+
+/**
+ * Resolve a dotted path against a record, returning the resolved value or
+ * `undefined` when any segment of the path cannot be walked.
+ *
+ * Supports dotted property access and `[N]` array indices (e.g.
+ * `"data.items[0].name"`). Prototype-walking keys (`__proto__`, `constructor`,
+ * `prototype`, `__class__`) are refused. Inherited properties are not
+ * resolved — only own string-keyed properties.
+ *
+ * Returns the resolved value verbatim, including `null`, `false`, `0`, and
+ * empty strings — callers must apply their own empty-value guard.
+ */
+export function resolvePath(record: unknown, path: string): unknown {
+  if (record === null || record === undefined || !path) {
+    return undefined;
+  }
+  let cursor: unknown = record;
+  for (const rawSegment of path.split('.')) {
+    if (cursor === null || cursor === undefined || typeof cursor !== 'object') {
+      return undefined;
+    }
+    const match = SAFE_SEGMENT.exec(rawSegment);
+    if (!match) {
+      return undefined;
+    }
+    const base = match[1];
+    if (FORBIDDEN_KEYS.has(base)) {
+      return undefined;
+    }
+    if (!Object.prototype.hasOwnProperty.call(cursor as object, base)) {
+      return undefined;
+    }
+    cursor = (cursor as Record<string, unknown>)[base];
+    const indices = match[2];
+    if (indices) {
+      for (const indexMatch of indices.matchAll(ARRAY_INDEX)) {
+        if (!Array.isArray(cursor)) {
+          return undefined;
+        }
+        cursor = cursor[Number(indexMatch[1])];
+      }
+    }
+  }
+  return cursor;
+}
diff --git a/ui/packages/sep/framework/src/utils/snippetFormSubmission.ts b/ui/packages/sep/framework/src/utils/snippetFormSubmission.ts
new file mode 100644
index 00000000000..ba9c970446d
--- /dev/null
+++ b/ui/packages/sep/framework/src/utils/snippetFormSubmission.ts
@@ -0,0 +1,54 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/** Form field names handled outside `args` for snippet execute API bodies. */
+export const SNIPPET_FORM_RESERVED_FIELD_NAMES = new Set([
+  'executor_host',
+  'sudo',
+  'script_preview',
+]);
+
+/** Body shape accepted by `POST /api/apps/snippets/{filename}/execute`. */
+export interface SnippetExecutionFormPayload {
+  executor_host: string;
+  sudo: boolean;
+  args: Record<string, unknown>;
+}
+
+/**
+ * Map raw `SchemaFormRenderer` values into the snippets execute request body.
+ * Strips reserved UI fields and drops empty optional args.
+ */
+export function buildSnippetExecutionFormPayload(
+  values: Record<string, unknown>
+): SnippetExecutionFormPayload {
+  const args: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(values)) {
+    if (SNIPPET_FORM_RESERVED_FIELD_NAMES.has(key)) {
+      continue;
+    }
+    if (value === '' || value === undefined) {
+      continue;
+    }
+    args[key] = value;
+  }
+  return {
+    executor_host: String(values.executor_host ?? ''),
+    sudo: Boolean(values.sudo ?? false),
+    args,
+  };
+}
diff --git a/ui/packages/sep/framework/tests/eventSourceStub.ts b/ui/packages/sep/framework/tests/eventSourceStub.ts
new file mode 100644
index 00000000000..3e12dbe1e98
--- /dev/null
+++ b/ui/packages/sep/framework/tests/eventSourceStub.ts
@@ -0,0 +1,161 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { vi } from 'vitest';
+
+const encoder = new TextEncoder();
+
+/**
+ * Per-request handle that lets tests push SSE frames into the stream and
+ * inspect what headers the hook sent.
+ */
+export interface SseStreamHandle {
+  readonly url: string;
+  /** Raw request headers (including Authorization) */
+  readonly requestHeaders: Record<string, string>;
+  /** Signal from the internal AbortController that fetchEventSource created */
+  readonly signal: AbortSignal | undefined;
+  pushMessage(data: unknown): void;
+  pushNamed(event: string, data: unknown): void;
+  pushRaw(frame: string): void;
+  close(): void;
+  errorStream(reason?: unknown): void;
+}
+
+interface QueuedResponse {
+  status: number;
+  contentType?: string;
+}
+
+/**
+ * Create a mock `fetch` that returns controllable SSE streams.
+ *
+ * Call `install()` to stub `globalThis.fetch`. For each network request the
+ * hook makes, a `SseStreamHandle` is pushed into `pending` so tests can drive
+ * the stream with `pushMessage` / `pushNamed` / `close`.
+ *
+ * Non-200 responses (e.g. 401) can be pre-queued via `queueResponse` — the
+ * next fetch call dequeues that config instead of creating a stream.
+ */
+export function mockStreamFetch() {
+  const pending: SseStreamHandle[] = [];
+  const responseQueue: QueuedResponse[] = [];
+
+  const fetchSpy = vi.fn(
+    (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+      const url =
+        typeof input === 'string'
+          ? input
+          : input instanceof URL
+            ? input.href
+            : (input as Request).url;
+
+      const cfg = responseQueue.shift();
+
+      if (cfg && cfg.status !== 200) {
+        // Non-streaming response (e.g. 401 for auth tests)
+        return Promise.resolve(
+          new Response(null, {
+            status: cfg.status,
+            headers: { 'Content-Type': cfg.contentType ?? 'application/json' },
+          })
+        );
+      }
+
+      // Normal SSE response with a controllable ReadableStream
+      let ctrl!: ReadableStreamDefaultController<Uint8Array>;
+      const body = new ReadableStream<Uint8Array>({
+        start(c) {
+          ctrl = c;
+        },
+      });
+
+      const rawHeaders = init?.headers;
+      let requestHeaders: Record<string, string> = {};
+      if (rawHeaders instanceof Headers) {
+        requestHeaders = Object.fromEntries(rawHeaders.entries());
+      } else if (Array.isArray(rawHeaders)) {
+        requestHeaders = Object.fromEntries(rawHeaders);
+      } else if (rawHeaders) {
+        requestHeaders = rawHeaders as Record<string, string>;
+      }
+
+      const handle: SseStreamHandle = {
+        url,
+        requestHeaders,
+        signal: init?.signal ?? undefined,
+        pushMessage(data) {
+          ctrl.enqueue(encoder.encode(`data: ${JSON.stringify(data)}\n\n`));
+        },
+        pushNamed(event, data) {
+          ctrl.enqueue(
+            encoder.encode(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`)
+          );
+        },
+        pushRaw(frame) {
+          ctrl.enqueue(encoder.encode(frame));
+        },
+        close() {
+          ctrl.close();
+        },
+        errorStream(reason) {
+          ctrl.error(reason);
+        },
+      };
+
+      pending.push(handle);
+
+      return Promise.resolve(
+        new Response(body, {
+          status: 200,
+          headers: { 'Content-Type': 'text/event-stream' },
+        })
+      );
+    }
+  );
+
+  return {
+    /** One entry per fetch call, in order. */
+    pending,
+    /** The raw vitest spy — use for call count assertions etc. */
+    fetchSpy,
+    /** Replace `globalThis.fetch` with this mock. */
+    install() {
+      vi.stubGlobal('fetch', fetchSpy);
+    },
+    /** Queue a non-200 response for the *next* fetch call. */
+    queueResponse(opts: QueuedResponse) {
+      responseQueue.push(opts);
+    },
+  };
+}
+
+/**
+ * Drain the microtask queue by chaining several `queueMicrotask` calls.
+ *
+ * Uses `queueMicrotask` (not `setTimeout`) so it works correctly even when
+ * `vi.useFakeTimers` is active (fake timers intercept `setTimeout` but not
+ * the microtask queue). Four levels cover the nested `await` chain inside
+ * `fetchEventSource` (fetch → onopen → async callbacks → onerror).
+ */
+export function flushPromises(): Promise<void> {
+  return new Promise((resolve) => {
+    queueMicrotask(() =>
+      queueMicrotask(() => queueMicrotask(() => queueMicrotask(resolve)))
+    );
+  });
+}
diff --git a/ui/packages/sep/framework/tests/queryWrapper.tsx b/ui/packages/sep/framework/tests/queryWrapper.tsx
new file mode 100644
index 00000000000..99f066788f7
--- /dev/null
+++ b/ui/packages/sep/framework/tests/queryWrapper.tsx
@@ -0,0 +1,32 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import type { PropsWithChildren } from 'react';
+
+export function createTestQueryClient(): QueryClient {
+  return new QueryClient({
+    defaultOptions: {
+      queries: { retry: false, gcTime: 0, staleTime: 0 },
+    },
+  });
+}
+
+export function QueryWrapper({ children }: PropsWithChildren) {
+  const client = createTestQueryClient();
+  return <QueryClientProvider client={client}>{children}</QueryClientProvider>;
+}
diff --git a/ui/packages/sep/framework/tests/setup.ts b/ui/packages/sep/framework/tests/setup.ts
new file mode 100644
index 00000000000..1ff291e1f7b
--- /dev/null
+++ b/ui/packages/sep/framework/tests/setup.ts
@@ -0,0 +1,24 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import '@testing-library/jest-dom/vitest';
+import { afterEach } from 'vitest';
+import { cleanup } from '@testing-library/react';
+
+afterEach(() => {
+  cleanup();
+});
diff --git a/ui/packages/sep/framework/tsconfig.json b/ui/packages/sep/framework/tsconfig.json
new file mode 100644
index 00000000000..93dc92b0d11
--- /dev/null
+++ b/ui/packages/sep/framework/tsconfig.json
@@ -0,0 +1,10 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "rootDir": ".",
+    "outDir": "dist",
+    "types": ["vitest/globals", "@testing-library/jest-dom"]
+  },
+  "include": ["src", "test", "tests"]
+}
diff --git a/ui/packages/sep/framework/vitest.config.ts b/ui/packages/sep/framework/vitest.config.ts
new file mode 100644
index 00000000000..5c5270493fb
--- /dev/null
+++ b/ui/packages/sep/framework/vitest.config.ts
@@ -0,0 +1,51 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import react from '@vitejs/plugin-react-swc';
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  plugins: [react()],
+  resolve: {
+    // Collapse to one instance of each. Under pnpm, react-dom and the code under
+    // test otherwise resolve `react` to different symlink paths, giving vite-node
+    // two React modules → "Invalid hook call". `dedupe` funnels every specifier to
+    // one resolved copy (no hardcoded node_modules paths, which break under pnpm).
+    dedupe: ['react', 'react-dom', 'react-hook-form', '@tanstack/react-query'],
+  },
+  test: {
+    environment: 'jsdom',
+    globals: true,
+    setupFiles: ['./tests/setup.ts'],
+    css: false,
+    server: {
+      deps: {
+        // Route React consumers through Vite's transform so their `react` imports
+        // share the single instance.
+        inline: [
+          'react-dom',
+          '@testing-library/react',
+          '@percona/percona-ui',
+          '@mui/material',
+          '@mui/system',
+          '@mui/utils',
+          'material-react-table',
+        ],
+      },
+    },
+  },
+});
diff --git a/ui/packages/sep/shared/package.json b/ui/packages/sep/shared/package.json
new file mode 100644
index 00000000000..efc173d7214
--- /dev/null
+++ b/ui/packages/sep/shared/package.json
@@ -0,0 +1,17 @@
+{
+  "name": "@sep/shared",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "main": "./src/index.ts",
+  "types": "./src/index.ts",
+  "scripts": {
+    "type-check": "tsc --noEmit",
+    "check-types": "tsc --noEmit",
+    "lint": "oxlint --config ../../../oxlintrc.json src",
+    "format": "oxfmt --write src"
+  },
+  "devDependencies": {
+    "typescript": "~6.0.3"
+  }
+}
diff --git a/ui/packages/sep/shared/src/index.ts b/ui/packages/sep/shared/src/index.ts
new file mode 100644
index 00000000000..eff612f353d
--- /dev/null
+++ b/ui/packages/sep/shared/src/index.ts
@@ -0,0 +1,68 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/**
+ * @sep/shared — Tiny constants & utility package.
+ *
+ * API client, auth, types, and schema components have moved to:
+ *   - @sep/api      — client, auth, types, hooks
+ *   - @sep/framework — SchemaFormRenderer, SchemaDrivenPlugin, etc.
+ *
+ * This package now only holds cross-cutting constants and tiny utilities
+ * shared across all packages (e.g., route paths, feature flags).
+ */
+
+// ── Route paths (single source of truth for the sidebar) ──────────────
+//
+// navigation.tsx (the sidebar) reads every `to:` from this map. router.tsx
+// still declares its own `path` literals (it is NOT wired to this map), so
+// each value here SHOULD match the corresponding router path and, for
+// schema-driven plugins, that plugin's `PLUGIN_BASE_PATH`. Nothing enforces
+// that at compile time — the `sidebar-navigation` e2e spec is the safety net
+// that DETECTS drift (it cannot prevent it). When migrating a plugin, update
+// the router route and the entry here together (see SEP-1270). Convention:
+//   • schema-driven plugins live under /apps/<name>  (checksums, mysql_backups, archives)
+//   • domain-grouped backups keep /backups/<db>          (mongodb, postgresql)
+//   • cross-cutting tools stay at bare top-level paths   (inventory, tasks, …)
+// `schemaAlters` backs the "Schema Change / Alters" sidebar item; the other
+// /schema-change/* entries (`schemaChecksums`, `schemaInventory`) are legacy
+// router aliases with no sidebar consumer, kept intentionally.
+export const ROUTES = {
+  dashboard: '/',
+  login: '/login',
+  inventory: '/inventory',
+  tasks: '/tasks',
+  snippets: '/snippets',
+  atw: '/atw',
+  alertTemplates: '/alerts/templates',
+  alertTroubleshooting: '/alerts/troubleshooting',
+  schemaAlters: '/schema-change/alters',
+  schemaChecksums: '/schema-change/checksums',
+  schemaInventory: '/schema-change/inventory',
+  checksums: '/apps/checksums',
+  mysqlBackups: '/apps/mysql_backups',
+  backupsMongodb: '/backups/mongodb',
+  backupsPostgresql: '/backups/postgresql',
+  archive: '/apps/archives',
+  dipper: '/dipper',
+  reports: '/reports',
+  settings: '/settings',
+} as const;
+
+// ── App-wide constants ────────────────────────────────────────────────
+export const APP_NAME = 'Services Enablement Platform';
+export const APP_SHORT_NAME = 'SEP';
diff --git a/ui/packages/sep/shared/tsconfig.json b/ui/packages/sep/shared/tsconfig.json
new file mode 100644
index 00000000000..3b79150329e
--- /dev/null
+++ b/ui/packages/sep/shared/tsconfig.json
@@ -0,0 +1,4 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "include": ["./src"]
+}
diff --git a/ui/pnpm-lock.yaml b/ui/pnpm-lock.yaml
index 58880b801ae..970070416fb 100644
--- a/ui/pnpm-lock.yaml
+++ b/ui/pnpm-lock.yaml
@@ -83,6 +83,15 @@ importers:
       '@reactour/tour':
         specifier: ^3.8.0
         version: 3.8.0(react@19.2.8)
+      '@sep/api':
+        specifier: workspace:*
+        version: link:../../packages/sep/api
+      '@sep/framework':
+        specifier: workspace:*
+        version: link:../../packages/sep/framework
+      '@sep/plugins-atw':
+        specifier: workspace:*
+        version: link:../../packages/plugins/atw
       '@tanstack/react-query':
         specifier: ^5.100.7
         version: 5.101.4(react@19.2.8)
@@ -125,6 +134,9 @@ importers:
       react-router-dom:
         specifier: ^7.14.0
         version: 7.18.2(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react-syntax-highlighter:
+        specifier: ^16.1.0
+        version: 16.1.1(react@19.2.8)
       rehype-raw:
         specifier: ^7.0.0
         version: 7.0.0
@@ -133,7 +145,7 @@ importers:
         version: 4.0.1
       vite-plugin-svgr:
         specifier: ^5.2.0
-        version: 5.2.0(rollup@4.62.4)(typescript@6.0.3)(vite@8.2.0(@types/node@20.19.43)(terser@5.49.0)(yaml@2.9.0))
+        version: 5.2.0(rollup@4.62.4)(typescript@6.0.3)(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0))
       zod:
         specifier: ^4.3.6
         version: 4.4.3
@@ -150,12 +162,15 @@ importers:
       '@types/react-dom':
         specifier: ^19.1.0
         version: 19.2.4(@types/react@19.2.18)
+      '@types/react-syntax-highlighter':
+        specifier: ^15.5.13
+        version: 15.5.13
       '@vitejs/plugin-basic-ssl':
         specifier: ^2.3.0
-        version: 2.3.0(vite@8.2.0(@types/node@20.19.43)(terser@5.49.0)(yaml@2.9.0))
+        version: 2.3.0(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0))
       '@vitejs/plugin-react-swc':
         specifier: ^4.3.1
-        version: 4.3.3(@swc/helpers@0.5.23)(vite@8.2.0(@types/node@20.19.43)(terser@5.49.0)(yaml@2.9.0))
+        version: 4.3.3(@swc/helpers@0.5.23)(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0))
       jsdom:
         specifier: ^29.1.1
         version: 29.1.1
@@ -164,13 +179,13 @@ importers:
         version: 6.0.3
       vite:
         specifier: ^8.0.16
-        version: 8.2.0(@types/node@20.19.43)(sass@1.63.2)(terser@5.49.0)(yaml@2.9.0)
+        version: 8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(sass@1.63.2)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0)
       vite-tsconfig-paths:
         specifier: ^6.1.1
-        version: 6.1.1(typescript@6.0.3)(vite@8.2.0(@types/node@20.19.43)(terser@5.49.0)(yaml@2.9.0))
+        version: 6.1.1(typescript@6.0.3)(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0))
       vitest:
         specifier: ^4.0.0
-        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@20.19.43)(jsdom@29.1.1)(vite@8.2.0(@types/node@20.19.43)(sass@1.63.2)(terser@5.49.0)(yaml@2.9.0))
+        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@20.19.43)(jsdom@29.1.1)(msw@2.15.0(@types/node@20.19.43)(typescript@6.0.3))(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0))
 
   apps/pmm-compat:
     dependencies:
@@ -225,7 +240,7 @@ importers:
         version: 0.2.39(@swc/core@1.15.47(@swc/helpers@0.5.23))
       '@testing-library/jest-dom':
         specifier: 6.1.4
-        version: 6.1.4(@jest/globals@29.7.0)(@types/jest@29.5.14)(jest@29.7.0(@types/node@20.19.43)(babel-plugin-macros@3.1.0)(ts-node@10.9.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(@types/node@20.19.43)(typescript@5.5.4)))(vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@20.19.43)(jsdom@29.1.1)(vite@8.2.0(@types/node@20.19.43)(sass@1.63.2)(terser@5.49.0)(yaml@2.9.0)))
+        version: 6.1.4(@jest/globals@29.7.0)(@types/jest@29.5.14)(jest@29.7.0(@types/node@20.19.43)(babel-plugin-macros@3.1.0)(ts-node@10.9.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(@types/node@20.19.43)(typescript@5.5.4)))(vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@20.19.43)(jsdom@29.1.1)(msw@2.15.0(@types/node@20.19.43)(typescript@5.5.4))(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(sass@1.63.2)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0)))
       '@testing-library/react':
         specifier: 14.0.0
         version: 14.0.0(@types/react@18.3.31)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
@@ -288,7 +303,7 @@ importers:
         version: 0.2.7(@swc/core@1.15.47(@swc/helpers@0.5.23))(webpack@5.109.2)
       terser-webpack-plugin:
         specifier: ^5.3.10
-        version: 5.6.1(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack@5.109.2)
+        version: 5.6.1(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack@5.109.2)
       ts-node:
         specifier: ^10.9.2
         version: 10.9.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(@types/node@20.19.43)(typescript@5.5.4)
@@ -297,7 +312,7 @@ importers:
         version: 5.5.4
       webpack:
         specifier: ^5.104.1
-        version: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack-cli@5.1.4)
+        version: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack-cli@5.1.4)
       webpack-cli:
         specifier: ^5.1.4
         version: 5.1.4(webpack@5.109.2)
@@ -314,6 +329,219 @@ importers:
         specifier: ^0.6.2
         version: 0.6.2
 
+  packages/plugins/atw:
+    dependencies:
+      '@sep/api':
+        specifier: workspace:*
+        version: link:../../sep/api
+      '@sep/framework':
+        specifier: workspace:*
+        version: link:../../sep/framework
+    devDependencies:
+      '@emotion/react':
+        specifier: ^11.11.4
+        version: 11.14.0(@types/react@19.2.18)(react@19.2.8)
+      '@emotion/styled':
+        specifier: ^11.11.5
+        version: 11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8)
+      '@mui/icons-material':
+        specifier: 7.3.7
+        version: 7.3.7(@mui/material@7.3.7(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(@types/react@19.2.18)(react@19.2.8)
+      '@mui/material':
+        specifier: 7.3.7
+        version: 7.3.7(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@tanstack/react-query':
+        specifier: ^5.100.7
+        version: 5.101.4(react@19.2.8)
+      '@testing-library/jest-dom':
+        specifier: ^6.6.3
+        version: 6.10.0(@testing-library/dom@9.3.4)
+      '@testing-library/react':
+        specifier: ^16.3.0
+        version: 16.3.2(@testing-library/dom@9.3.4)(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@testing-library/user-event':
+        specifier: ^14.6.1
+        version: 14.6.1(@testing-library/dom@9.3.4)
+      '@types/react':
+        specifier: ^19.1.0
+        version: 19.2.18
+      '@vitejs/plugin-react-swc':
+        specifier: ^4.3.1
+        version: 4.3.3(@swc/helpers@0.5.23)(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0))
+      jsdom:
+        specifier: ^29.1.1
+        version: 29.1.1
+      notistack:
+        specifier: ^3.0.0
+        version: 3.0.2(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react:
+        specifier: ^19.1.0
+        version: 19.2.8
+      react-dom:
+        specifier: ^19.1.0
+        version: 19.2.8(react@19.2.8)
+      react-router-dom:
+        specifier: ^7.14.0
+        version: 7.18.2(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      typescript:
+        specifier: ~6.0.3
+        version: 6.0.3
+      vitest:
+        specifier: ^4.0.0
+        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@20.19.43)(jsdom@29.1.1)(msw@2.15.0(@types/node@20.19.43)(typescript@6.0.3))(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0))
+
+  packages/sep/api:
+    dependencies:
+      axios:
+        specifier: ^1.15.2
+        version: 1.19.0
+      openapi-fetch:
+        specifier: ^0.17.0
+        version: 0.17.0
+      react:
+        specifier: ^19.0.0
+        version: 19.2.8
+    devDependencies:
+      '@tanstack/react-query':
+        specifier: ^5.100.7
+        version: 5.101.4(react@19.2.8)
+      '@types/node':
+        specifier: ^20.0.0
+        version: 20.19.43
+      '@types/react':
+        specifier: ^19.1.0
+        version: 19.2.18
+      msw:
+        specifier: ^2.13.6
+        version: 2.15.0(@types/node@20.19.43)(typescript@6.0.3)
+      openapi-typescript:
+        specifier: ^7.9.0
+        version: 7.13.0(typescript@6.0.3)
+      tsx:
+        specifier: ^4.19.0
+        version: 4.23.4
+      typescript:
+        specifier: ~6.0.3
+        version: 6.0.3
+      vitest:
+        specifier: ^4.0.0
+        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@20.19.43)(jsdom@29.1.1)(msw@2.15.0(@types/node@20.19.43)(typescript@6.0.3))(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0))
+
+  packages/sep/framework:
+    dependencies:
+      '@dnd-kit/core':
+        specifier: ^6.3.1
+        version: 6.3.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@dnd-kit/sortable':
+        specifier: ^10.0.0
+        version: 10.0.0(@dnd-kit/core@6.3.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)
+      '@dnd-kit/utilities':
+        specifier: ^3.2.2
+        version: 3.2.2(react@19.2.8)
+      '@microsoft/fetch-event-source':
+        specifier: 2.0.1
+        version: 2.0.1
+      '@sep/api':
+        specifier: workspace:*
+        version: link:../api
+      '@sep/shared':
+        specifier: workspace:*
+        version: link:../shared
+      '@types/react-syntax-highlighter':
+        specifier: ^15.5.13
+        version: 15.5.13
+      cronstrue:
+        specifier: ^3.14.0
+        version: 3.24.0
+      material-react-table:
+        specifier: ^1.15.1
+        version: 1.15.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@mui/icons-material@7.3.7(@mui/material@7.3.7(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@mui/material@7.3.7(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      prism-react-renderer:
+        specifier: ^2.4.1
+        version: 2.4.1(react@19.2.8)
+      prismjs:
+        specifier: ^1.30.0
+        version: 1.30.0
+      react-syntax-highlighter:
+        specifier: ^16.1.1
+        version: 16.1.1(react@19.2.8)
+      sql-formatter:
+        specifier: ^15.7.4
+        version: 15.8.2
+    devDependencies:
+      '@emotion/react':
+        specifier: ^11.11.4
+        version: 11.14.0(@types/react@19.2.18)(react@19.2.8)
+      '@emotion/styled':
+        specifier: ^11.11.5
+        version: 11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8)
+      '@melloware/react-logviewer':
+        specifier: ^6.5.0
+        version: 6.5.5(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@mui/icons-material':
+        specifier: 7.3.7
+        version: 7.3.7(@mui/material@7.3.7(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(@types/react@19.2.18)(react@19.2.8)
+      '@mui/material':
+        specifier: 7.3.7
+        version: 7.3.7(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@percona/percona-ui':
+        specifier: 1.0.22
+        version: 1.0.22(46f3b00c55de1f105bc9f3068b58f1a0)
+      '@tanstack/react-query':
+        specifier: ^5.100.7
+        version: 5.101.4(react@19.2.8)
+      '@testing-library/jest-dom':
+        specifier: ^6.6.3
+        version: 6.10.0(@testing-library/dom@9.3.4)
+      '@testing-library/react':
+        specifier: ^16.3.0
+        version: 16.3.2(@testing-library/dom@9.3.4)(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@testing-library/user-event':
+        specifier: ^14.6.1
+        version: 14.6.1(@testing-library/dom@9.3.4)
+      '@types/prismjs':
+        specifier: ^1.26.5
+        version: 1.26.6
+      '@types/react':
+        specifier: ^19.1.0
+        version: 19.2.18
+      '@vitejs/plugin-react-swc':
+        specifier: ^4.3.1
+        version: 4.3.3(@swc/helpers@0.5.23)(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0))
+      jsdom:
+        specifier: ^29.1.1
+        version: 29.1.1
+      notistack:
+        specifier: ^3.0.2
+        version: 3.0.2(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react:
+        specifier: ^19.1.0
+        version: 19.2.8
+      react-dom:
+        specifier: ^19.1.0
+        version: 19.2.8(react@19.2.8)
+      react-hook-form:
+        specifier: ^7.71.2
+        version: 7.84.0(react@19.2.8)
+      react-router-dom:
+        specifier: ^7.14.0
+        version: 7.18.2(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      typescript:
+        specifier: ~6.0.3
+        version: 6.0.3
+      vite:
+        specifier: ^8.0.16
+        version: 8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(sass@1.63.2)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0)
+      vitest:
+        specifier: ^4.0.0
+        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@20.19.43)(jsdom@29.1.1)(msw@2.15.0(@types/node@20.19.43)(typescript@6.0.3))(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0))
+
+  packages/sep/shared:
+    devDependencies:
+      typescript:
+        specifier: ~6.0.3
+        version: 6.0.3
+
   packages/shared:
     dependencies:
       uuid:
@@ -633,6 +861,28 @@ packages:
     resolution: {integrity: sha512-dBVuXR082gk3jsFp7Rd/JI4kytwGHecnCoTtXFb7DB6CNHp4rg5k1bhg0nWdLGLnOV71lmDzGQaLMy8iPLY0pw==}
     engines: {node: '>=10.0.0'}
 
+  '@dnd-kit/accessibility@3.1.1':
+    resolution: {integrity: sha512-2P+YgaXF+gRsIihwwY1gCsQSYnu9Zyj2py8kY5fFvUM1qm2WA2u639R6YNVfU4GWr+ZM5mqEsfHZZLoRONbemw==}
+    peerDependencies:
+      react: '>=16.8.0'
+
+  '@dnd-kit/core@6.3.1':
+    resolution: {integrity: sha512-xkGBRQQab4RLwgXxoqETICr6S5JlogafbhNsidmrkVv2YRs5MLwpjoF2qpiGjQt8S9AoxtIV603s0GIUpY5eYQ==}
+    peerDependencies:
+      react: '>=16.8.0'
+      react-dom: '>=16.8.0'
+
+  '@dnd-kit/sortable@10.0.0':
+    resolution: {integrity: sha512-+xqhmIIzvAYMGfBYYnbKuNicfSsk4RksY2XdmJhT+HAC01nix6fHCztU68jooFiMUB01Ky3F0FyOvhG/BZrWkg==}
+    peerDependencies:
+      '@dnd-kit/core': ^6.3.0
+      react: '>=16.8.0'
+
+  '@dnd-kit/utilities@3.2.2':
+    resolution: {integrity: sha512-+MKAJEOfaBe5SmV6t34p80MMKhjvUz0vRrvVJbPT0WElzaOJ/1xs+D+KDv+tD/NE5ujfrChEcshd4fLn0wpiqg==}
+    peerDependencies:
+      react: '>=16.8.0'
+
   '@emnapi/core@2.0.0-alpha.3':
     resolution: {integrity: sha512-AZypUeJ/yByuxyS7BlSNRDOMLMlROYtjYdIAuBmJssVz1UJDSeYxLrdizhXCFYhedC5bqd/ASy8EuNXbVVXp9g==}
 
@@ -702,6 +952,162 @@ packages:
   '@emotion/weak-memoize@0.4.0':
     resolution: {integrity: sha512-snKqtPW01tN0ui7yu9rGv69aJXr/a/Ywvl11sUjNtEcRc+ng/mQriFL0wLXMef74iHa/EkftbDzU9F8iFbH+zg==}
 
+  '@esbuild/aix-ppc64@0.25.12':
+    resolution: {integrity: sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
+  '@esbuild/android-arm64@0.25.12':
+    resolution: {integrity: sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
+  '@esbuild/android-arm@0.25.12':
+    resolution: {integrity: sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
+  '@esbuild/android-x64@0.25.12':
+    resolution: {integrity: sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
+  '@esbuild/darwin-arm64@0.25.12':
+    resolution: {integrity: sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@esbuild/darwin-x64@0.25.12':
+    resolution: {integrity: sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@esbuild/freebsd-arm64@0.25.12':
+    resolution: {integrity: sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-x64@0.25.12':
+    resolution: {integrity: sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@esbuild/linux-arm64@0.25.12':
+    resolution: {integrity: sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@esbuild/linux-arm@0.25.12':
+    resolution: {integrity: sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
+  '@esbuild/linux-ia32@0.25.12':
+    resolution: {integrity: sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
+  '@esbuild/linux-loong64@0.25.12':
+    resolution: {integrity: sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@esbuild/linux-mips64el@0.25.12':
+    resolution: {integrity: sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@esbuild/linux-ppc64@0.25.12':
+    resolution: {integrity: sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@esbuild/linux-riscv64@0.25.12':
+    resolution: {integrity: sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@esbuild/linux-s390x@0.25.12':
+    resolution: {integrity: sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@esbuild/linux-x64@0.25.12':
+    resolution: {integrity: sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
+  '@esbuild/netbsd-arm64@0.25.12':
+    resolution: {integrity: sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-x64@0.25.12':
+    resolution: {integrity: sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@esbuild/openbsd-arm64@0.25.12':
+    resolution: {integrity: sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-x64@0.25.12':
+    resolution: {integrity: sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openharmony-arm64@0.25.12':
+    resolution: {integrity: sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@esbuild/sunos-x64@0.25.12':
+    resolution: {integrity: sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@esbuild/win32-arm64@0.25.12':
+    resolution: {integrity: sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@esbuild/win32-ia32@0.25.12':
+    resolution: {integrity: sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@esbuild/win32-x64@0.25.12':
+    resolution: {integrity: sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
   '@eslint-community/eslint-utils@4.10.1':
     resolution: {integrity: sha512-cuadcxVFE8sDK6iWJbs8Sn0av2Nrh2QSGQhVlBW9AaAHqHwjWsZHT8LJ4hFGPh7ASBV2deFdM7H/DPjulmh8rg==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
@@ -945,6 +1351,41 @@ packages:
     resolution: {integrity: sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==}
     engines: {node: '>=18.18'}
 
+  '@inquirer/ansi@2.0.7':
+    resolution: {integrity: sha512-3eTuUO1vH2cZm2ZKHeQxnOqlTi9EfZDGgIe3BL3I4u+rJHocr9Fz86M4fjYABPvFnQG/gGK551HqDiIcETwU6Q==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+
+  '@inquirer/confirm@6.1.1':
+    resolution: {integrity: sha512-eb8DBZcz/2qHWQda4rk2JiQk5h9QV/cVHi1yjt0f69WFZMRFn0sJTye3EAP8icut8UDMjQPsaH5KbcOogefrFQ==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/core@11.2.1':
+    resolution: {integrity: sha512-Qd6GJT1yVyrZZCfN8W2qKF5ApmqryXRhRKCuip8h01x2w/esJQ2XIYc6f9abMIHgKQdBfFTSOdbHRLAhuM09UA==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/figures@2.0.7':
+    resolution: {integrity: sha512-aJ8TBPOGB6f/2qziPfElISTCEd5XOYTFckA2SGjhNmiKzfK/u4ot3v0DUzGVdUnKjN10EqnnEPck36BkyfLnJw==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+
+  '@inquirer/type@4.0.7':
+    resolution: {integrity: sha512-t28inv14nMQ1PhKpsJPY+kEs/c00qzeCOS2gTNRyTjG5d6qsVA2fItxW4hkvGZ5lvanGLdtCzVIx5dwdRpN1+g==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
   '@internationalized/date@3.12.3':
     resolution: {integrity: sha512-fuLX+3ZKLsxI73y8b01EG/WjHb6gE6weCqlfawPO27kBWGMh9G1yH6Csv1uU7/cac9H2GHmOMt6CjmuQ1aia4Q==}
 
@@ -1076,6 +1517,15 @@ packages:
   '@leeoniya/ufuzzy@1.0.19':
     resolution: {integrity: sha512-0pikDeYt0IHEUPza5RTCDXc/17S1pTrYnReEMp8Aa6k1ovzw5QdZLwicW8TjljwEZRb6oYag0xmALohrcq/yOQ==}
 
+  '@melloware/react-logviewer@6.5.5':
+    resolution: {integrity: sha512-chYodsDPIJ6pLkoQ904EOKUX65kEfFCd2n6SpMTDWmM+Bai5HTj5+FDIGD+hfKRNQMpZJpN5SPpxXMLrDuTEag==}
+    peerDependencies:
+      react: '>=17.0.0'
+      react-dom: '>=17.0.0'
+
+  '@microsoft/fetch-event-source@2.0.1':
+    resolution: {integrity: sha512-W6CLUJ2eBMw3Rec70qrsEW0jOm/3twwJv21mrmj2yORiaVmVYGS4sSS5yUwvQc1ZlDLYGPnClVWmUUMagKNsfA==}
+
   '@monaco-editor/loader@1.7.0':
     resolution: {integrity: sha512-gIwR1HrJrrx+vfyOhYmCZ0/JcWqG5kbfG7+d3f/C1LXk2EvzAbHSg3MQ5lO2sMlo9izoAZ04shohfKLVT6crVA==}
 
@@ -1086,6 +1536,10 @@ packages:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
+  '@mswjs/interceptors@0.41.9':
+    resolution: {integrity: sha512-VVPPgHyQ6ShqnrmDWuxjmUIsO9gWyOZFmuOfLd9LfBGQJwZfy0gvv9pbHSJuoFNIYC7ZDX9aoFwowjcdSC4E8w==}
+    engines: {node: '>=18'}
+
   '@mui/core-downloads-tracker@7.3.7':
     resolution: {integrity: sha512-8jWwS6FweMkpyRkrJooamUGe1CQfO1yJ+lM43IyUJbrhHW/ObES+6ry4vfGi8EKaldHL3t3BG1bcLcERuJPcjg==}
 
@@ -1246,6 +1700,18 @@ packages:
     resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
     engines: {node: '>= 8'}
 
+  '@open-draft/deferred-promise@2.2.0':
+    resolution: {integrity: sha512-CecwLWx3rhxVQF6V4bAgPS5t+So2sTbPgAzafKkVizyi7tlwpcFpdFqq+wqF2OwNBmqFuu6tOyouTuxgpMfzmA==}
+
+  '@open-draft/deferred-promise@3.0.0':
+    resolution: {integrity: sha512-XW375UK8/9SqUVNVa6M0yEy8+iTi4QN5VZ7aZuRFQmy76LRwI9wy5F4YIBU6T+eTe2/DNDo8tqu8RHlwLHM6RA==}
+
+  '@open-draft/logger@0.3.0':
+    resolution: {integrity: sha512-X2g45fzhxH238HKO4xbSr7+wBS8Fvw6ixhTDuvLd5mqh6bJJCFAPwU9mPDxbcrRtfxv4u5IHCEH77BmxvXmmxQ==}
+
+  '@open-draft/until@2.1.0':
+    resolution: {integrity: sha512-U69T3ItWHvLwGg5eJ0n3I62nWuE6ilHlmz7zM0npLBRvPRd7e6NYmg54vvRtP5mZG7kZqZCFVdsTWo7BPtBujg==}
+
   '@openfeature/core@1.12.0':
     resolution: {integrity: sha512-7PCPzyd1OC19begz30+CRknFB0ChtyaZUhk7YWrk+Bov1fpVw0HYkTXtoxxsvPfDZB9P9WsT7uixN+Z8f9+bcA==}
 
@@ -1565,6 +2031,20 @@ packages:
     cpu: [x64]
     os: [win32]
 
+  '@percona/percona-ui@1.0.22':
+    resolution: {integrity: sha512-9sTo4J+H9zlGJMT6cKWiK3kZbD4KfrzKn0UFOWjNqMSXwNGWp8/vwls2KMeN9FJDTJfUhYg0fLxWU5SRAO4Crg==}
+    peerDependencies:
+      '@emotion/react': ^11.11.4
+      '@emotion/styled': ^11.11.5
+      '@mui/icons-material': 7.3.7
+      '@mui/material': 7.3.7
+      '@mui/utils': 7.3.7
+      '@mui/x-date-pickers': ^7.29.4
+      notistack: ^3.0.2
+      react: ^18.3.1
+      react-dom: ^18.3.1
+      react-hook-form: ^7.50.0
+
   '@percona/percona-ui@1.0.24':
     resolution: {integrity: sha512-5sFhMr+q6tEwjxWri6UugWgpiApzTU1xuPB8LQ2N9/G38oMUMPwUZFF3L8H6xzaEF90c8CluujnpOYKHYp0Z3w==}
     peerDependencies:
@@ -1883,6 +2363,16 @@ packages:
     peerDependencies:
       react: 16.x || 17.x || 18.x || 19.x
 
+  '@redocly/ajv@8.11.2':
+    resolution: {integrity: sha512-io1JpnwtIcvojV7QKDUSIuMN/ikdOUd1ReEnUnMKGfDVridQZ31J0MmIuqwuRjWDZfmvr+Q0MqCcfHM2gTivOg==}
+
+  '@redocly/config@0.22.0':
+    resolution: {integrity: sha512-gAy93Ddo01Z3bHuVdPWfCwzgfaYgMdaZPcfL7JZ7hWJoK9V0lXDbigTWkhiPFAaLWzbOJ+kbUQG1+XwIm0KRGQ==}
+
+  '@redocly/openapi-core@1.34.18':
+    resolution: {integrity: sha512-UyKIm0wTPw5BcY7Z2PkbK1Ma260um96LSBWXHrdSMe+ZV0EPMyDfAcUcjjm3qEiGST9OK/1TriekdPCZkn4Q3A==}
+    engines: {node: '>=18.17.0', npm: '>=9.5.0'}
+
   '@remix-run/router@1.23.3':
     resolution: {integrity: sha512-4An71tdz9X8+3sI4Qqqd2LWd9vS39J7sqd9EU4Scw7TJE/qB10Flv/UuqbPVgfQV9XoK8Np6jNquZitnZq5i+Q==}
     engines: {node: '>=14.0.0'}
@@ -2382,6 +2872,10 @@ packages:
     resolution: {integrity: sha512-Wo1iKt2b9OT7d+YGhvEPD3DXvPv2etTusIMhMUoG7fbhmxcXCtIjJDEygy91Y2JFlwGyjqiBPRozme7UD8hoqg==}
     engines: {node: '>=12'}
 
+  '@tanstack/match-sorter-utils@8.8.4':
+    resolution: {integrity: sha512-rKH8LjZiszWEvmi01NR72QWZ8m4xmXre0OOwlRGnjU01Eqz/QnN+cqpty2PJ0efHblq09+KilvyR7lsbzmXVEw==}
+    engines: {node: '>=12'}
+
   '@tanstack/query-core@5.101.4':
     resolution: {integrity: sha512-gNwcvOJcRbLWPOLG/2OBm+zM+Yv+MKsXKEOWC57USuZDEsI71hEErQsiEGx5wX9rzWWkfwM0fVSPoiIFSsxfiw==}
 
@@ -2390,6 +2884,13 @@ packages:
     peerDependencies:
       react: ^18 || ^19
 
+  '@tanstack/react-table@8.10.7':
+    resolution: {integrity: sha512-bXhjA7xsTcsW8JPTTYlUg/FuBpn8MNjiEPhkNhIGCUR6iRQM2+WEco4OBpvDeVcR9SE+bmWLzdfiY7bCbCSVuA==}
+    engines: {node: '>=12'}
+    peerDependencies:
+      react: '>=16'
+      react-dom: '>=16'
+
   '@tanstack/react-table@8.20.6':
     resolution: {integrity: sha512-w0jluT718MrOKthRcr2xsjqzx+oEM7B7s/XXyfs19ll++hlId3fjTm+B2zrR3ijpANpkzBAr15j1XGVOMxpggQ==}
     engines: {node: '>=12'}
@@ -2397,6 +2898,11 @@ packages:
       react: '>=16.8'
       react-dom: '>=16.8'
 
+  '@tanstack/react-virtual@3.0.0-beta.65':
+    resolution: {integrity: sha512-Q21cUoE0C8Oyzy3RAMV+u4BuB+RwIf2/oQRCWksmIBp1PqLEtvXhAldh7v/wUt7WKEkislKDICZAvbYYs7EAyQ==}
+    peerDependencies:
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0
+
   '@tanstack/react-virtual@3.11.2':
     resolution: {integrity: sha512-OuFzMXPF4+xZgx8UzJha0AieuMihhhaWG0tCqpp6tDzlFwOmNBPYMuLOtMJ1Tr4pXLHmgjcWhG6RlknY2oNTdQ==}
     peerDependencies:
@@ -2409,10 +2915,17 @@ packages:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
+  '@tanstack/table-core@8.10.7':
+    resolution: {integrity: sha512-KQk5OMg5OH6rmbHZxuNROvdI+hKDIUxANaHlV+dPlNN7ED3qYQ/WkpY2qlXww1SIdeMlkIhpN/2L00rof0fXFw==}
+    engines: {node: '>=12'}
+
   '@tanstack/table-core@8.20.5':
     resolution: {integrity: sha512-P9dF7XbibHph2PFRz8gfBKEXEY/HJPOhym8CHmjF8y3q5mWpKx9xtZapXQUWCgkqvsK0R46Azuz+VaxD4Xl+Tg==}
     engines: {node: '>=12'}
 
+  '@tanstack/virtual-core@3.0.0-beta.65':
+    resolution: {integrity: sha512-ObP2pvXBdbivinr7BWDbGqYt4TK8wNzYsOWio+qBkDx5AJFuvqcdJxcCCYnv4dzVTe5ELA1MT4tkt8NB/tnEdA==}
+
   '@tanstack/virtual-core@3.11.2':
     resolution: {integrity: sha512-vTtpNt7mKCiZ1pwU9hfKPhpdVO2sVzFQsxoVBGtOSHxlrRRzYr8iQ2TlwbAcRYCcEiZ9ECAM8kBzH0v2+VzfKw==}
 
@@ -2470,6 +2983,12 @@ packages:
       '@types/react-dom':
         optional: true
 
+  '@testing-library/user-event@14.6.1':
+    resolution: {integrity: sha512-vq7fv0rnt+QTXgPxr5Hjc210p6YKq2kmdziLgnsZGgLJ9e6VAShx1pACLuRjd/AS/sr7phAR58OIIpf0LlmQNw==}
+    engines: {node: '>=12', npm: '>=6'}
+    peerDependencies:
+      '@testing-library/dom': '>=7.21.4'
+
   '@tootallnate/once@2.0.1':
     resolution: {integrity: sha512-HqmEUIGRJ5fSXchkVgR5F7qn48bDBzv0kWj/Kfu5e6uci4UlEeng4331LnBkWffb++Ei3FOVLxo8JJWMFBDMeQ==}
     engines: {node: '>= 10'}
@@ -2622,6 +3141,9 @@ packages:
     peerDependencies:
       '@types/react': ^19.2.0
 
+  '@types/react-syntax-highlighter@15.5.13':
+    resolution: {integrity: sha512-uLGJ87j6Sz8UaBAooU0T6lWJ0dBmjZgN1PZTrj05TNql2/XpC6+4HhMT5syIdFUUt+FASfCeLLv4kBygNU+8qA==}
+
   '@types/react-table@7.7.20':
     resolution: {integrity: sha512-ahMp4pmjVlnExxNwxyaDrFgmKxSbPwU23sGQw2gJK4EhCvnvmib2s/O/+y1dfV57dXOwpr2plfyBol+vEHbi2w==}
 
@@ -2639,12 +3161,18 @@ packages:
   '@types/resolve@1.20.2':
     resolution: {integrity: sha512-60BCwRFOZCQhDncwQdxxeOEEkbc5dIMccYLwbxsS4TUNeVECQ/pBJ0j09mrHOl/JJvpRPGwO9SvE4nR2Nb/a4Q==}
 
+  '@types/set-cookie-parser@2.4.10':
+    resolution: {integrity: sha512-GGmQVGpQWUe5qglJozEjZV/5dyxbOOZ0LHe/lqyWssB88Y4svNfst0uqBVscdDeIKl5Jy5+aPSvy7mI9tYRguw==}
+
   '@types/sizzle@2.3.10':
     resolution: {integrity: sha512-TC0dmN0K8YcWEAEfiPi5gJP14eJe30TTGjkvek3iM/1NdHHsdCA/Td6GvNndMOo/iSnIsZ4HuuhrYPDAmbxzww==}
 
   '@types/stack-utils@2.0.3':
     resolution: {integrity: sha512-9aEbYZ3TbYMznPdcdr3SmIrLXwC/AKZXQeCf9Pgao5CKb8CyHuEX5jzWPTkvregvhRJHcpRO6BFoGW9ycaOkYw==}
 
+  '@types/statuses@2.0.6':
+    resolution: {integrity: sha512-xMAgYwceFhRA2zY+XbEA7mxYbA093wdiW8Vu6gZPGWy9cmOyU9XesH1tNcEWsKFd5Vzrqx5T3D38PWx1FIIXkA==}
+
   '@types/string-hash@1.1.3':
     resolution: {integrity: sha512-p6skq756fJWiA59g2Uss+cMl6tpoDGuCBuxG0SI1t0NwJmYOU66LAMS6QiCgu7cUh3/hYCaMl5phcCW1JP5wOA==}
 
@@ -2866,6 +3394,10 @@ packages:
     resolution: {integrity: sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==}
     engines: {node: '>= 6.0.0'}
 
+  agent-base@7.1.4:
+    resolution: {integrity: sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==}
+    engines: {node: '>= 14'}
+
   ajv-formats@2.1.1:
     resolution: {integrity: sha512-Wx0Kx52hxE7C18hkMEggYlEifqWZtYaRgouJor+WMdPnQyEK13vgEWyVNup7SoeeoLMsr4kf5h6dOW11I15MUA==}
     peerDependencies:
@@ -2890,6 +3422,10 @@ packages:
   ajv@8.20.0:
     resolution: {integrity: sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==}
 
+  ansi-colors@4.1.3:
+    resolution: {integrity: sha512-/6w/C21Pm1A7aZitlI5Ni/2J6FFQN8i1Cvz3kHABAAbw93v/NlvKdVOqz7CCWz/3iv/JplRSEEZ83XION15ovw==}
+    engines: {node: '>=6'}
+
   ansi-escapes@4.3.2:
     resolution: {integrity: sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==}
     engines: {node: '>=8'}
@@ -3100,6 +3636,9 @@ packages:
     resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==}
     engines: {node: '>=10'}
 
+  change-case@5.4.4:
+    resolution: {integrity: sha512-HRQyTk2/YPEkt9TnUPbOpr64Uw3KOicFWPVBb+xiHvd6eBx/qPr9xqfBFDT8P2vWsvvz4jbEkfDe71W3VyNu2w==}
+
   char-regex@1.0.2:
     resolution: {integrity: sha512-kWWXztvZ5SBQV+eRgKFeh8q5sLuZY2+8WUIzlxWVTg+oGwY14qylx1KbKzHd8P6ZYkAg0xyIDU9JMHhyJMZ1jw==}
     engines: {node: '>=10'}
@@ -3134,6 +3673,10 @@ packages:
   classnames@2.5.1:
     resolution: {integrity: sha512-saHYOzhIQs6wy2sVxTM6bUDsQO4F50V9RQ22qBpEdCW+I+/Wmke2HOl6lS6dTpdxVhb88/I6+Hs+438c3lfUow==}
 
+  cli-width@4.1.0:
+    resolution: {integrity: sha512-ouuZd4/dm2Sw5Gmqy6bGyNNNe1qt9RpmxveLSO7KcgsTnU7RXfsw+/bukWGo1abgBiMAic068rclZsO4IWmmxQ==}
+    engines: {node: '>= 12'}
+
   client-only@0.0.1:
     resolution: {integrity: sha512-IV3Ou0jSMzZrd3pZ48nLkT9DA7Ag1pnPzaiQhpW7c3RbcqqzvzzVu+L8gfqMp/8IM2MQtSiqaCxrrcfu8I8rMA==}
 
@@ -3170,6 +3713,9 @@ packages:
   colord@2.9.3:
     resolution: {integrity: sha512-jeC1axXpnb0/2nn/Y1LPuLdgXBLH7aDcHu4KEKfqw3CUhX7ZpfBSlPKyqXE6btIgEzfWtrX3/tyBCaCvXvMkOw==}
 
+  colorette@1.4.0:
+    resolution: {integrity: sha512-Y2oEozpomLn7Q3HFP7dpww7AtMJplbM9lGZP6RDfHqmbeRjiwRg4n6VM6j4KLmRke85uWEI7JqF17f3pqdRA0g==}
+
   colorette@2.0.20:
     resolution: {integrity: sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==}
 
@@ -3246,6 +3792,10 @@ packages:
   create-require@1.1.1:
     resolution: {integrity: sha512-dcKFX3jn0MpIaXjisoRvexIJVEKzaq7z2rZKxf+MSr9TkdmHmsU4m2lcLojrj/FHl8mk5VxMmYA+ftRkP/3oKQ==}
 
+  cronstrue@3.24.0:
+    resolution: {integrity: sha512-t/Ji3Ur2c/pzhIAWNwC0ftl3JAE4dLfCjAdZoTZXmPDZwcispnS1PaMcMS4OmIIXyIVouAz+yw+mfQiE3hz5OQ==}
+    hasBin: true
+
   cross-spawn@7.0.6:
     resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
     engines: {node: '>= 8'}
@@ -3561,6 +4111,9 @@ packages:
     resolution: {integrity: sha512-HceXsAluGbXKCz2qCVbXFUH4Vn4eNMWxY5gzydMFMnS1zKSwvDASqLwcrYLIFDpwuZ63FUAqjDLEP1eicHt8DQ==}
     hasBin: true
 
+  discontinuous-range@1.0.0:
+    resolution: {integrity: sha512-c68LpLbO+7kP/b1Hr1qs8/BJ09F5khZGTxqxZuhzxpmwJKOgRFHJWIb9/KmqnqHhLdO55aOxFH/EGBvUQbL/RQ==}
+
   dom-accessibility-api@0.5.16:
     resolution: {integrity: sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg==}
 
@@ -3680,6 +4233,11 @@ packages:
     resolution: {integrity: sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==}
     engines: {node: '>= 0.4'}
 
+  esbuild@0.25.12:
+    resolution: {integrity: sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==}
+    engines: {node: '>=18'}
+    hasBin: true
+
   escalade@3.2.0:
     resolution: {integrity: sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==}
     engines: {node: '>=6'}
@@ -3821,9 +4379,18 @@ packages:
   fast-shallow-equal@1.0.0:
     resolution: {integrity: sha512-HPtaa38cPgWvaCFmRNhlc6NG7pv6NUHqjPgVAkWGoB9mQMwYB27/K0CvOM5Czy+qpT3e8XJ6Q4aPAnzpNpzNaw==}
 
+  fast-string-truncated-width@3.0.3:
+    resolution: {integrity: sha512-0jjjIEL6+0jag3l2XWWizO64/aZVtpiGE3t0Zgqxv0DPuxiMjvB3M24fCyhZUO4KomJQPj3LTSUnDP3GpdwC0g==}
+
+  fast-string-width@3.0.2:
+    resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==}
+
   fast-uri@3.1.5:
     resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==}
 
+  fast-wrap-ansi@0.2.2:
+    resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==}
+
   fast_array_intersect@1.1.0:
     resolution: {integrity: sha512-/DCilZlUdz2XyNDF+ASs0PwY+RKG9Y4Silp/gbS72Cvbg4oibc778xcecg+pnNyiNHYgh/TApsiDTjpdniyShw==}
 
@@ -3837,6 +4404,9 @@ packages:
   fastq@1.20.1:
     resolution: {integrity: sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==}
 
+  fault@1.0.4:
+    resolution: {integrity: sha512-CJ0HCB5tL5fYTEA7ToAq5+kTwd++Borf1/bifxd9iT70QcXr4MRrO3Llf8Ifs70q+SJcGHFtnIE/Nw6giCtECA==}
+
   faye-websocket@0.10.0:
     resolution: {integrity: sha512-Xhj93RXbMSq8urNCUq4p9l0P6hnySJ/7YNRhYNug0bLOuii7pKO7xQFb5mx9xZXWCar88pLPb805PvUkwrLZpQ==}
     engines: {node: '>=0.4.0'}
@@ -3915,6 +4485,10 @@ packages:
     resolution: {integrity: sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==}
     engines: {node: '>= 6'}
 
+  format@0.2.2:
+    resolution: {integrity: sha512-wzsgA6WOq+09wrU1tsJ09udeR/YZRaeArL9e1wPbFg3GG2yDnC2ldKpxs4xunpFF9DgqCqOIra3bc1HWrJ37Ww==}
+    engines: {node: '>=0.4.x'}
+
   fs-extra@10.1.0:
     resolution: {integrity: sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ==}
     engines: {node: '>=12'}
@@ -4022,6 +4596,10 @@ packages:
   graceful-fs@4.2.11:
     resolution: {integrity: sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==}
 
+  graphql@16.14.2:
+    resolution: {integrity: sha512-Chq1s4CY7jmh8gO2qvLIJyfCDIN+EHLFW/9iShnp1z8FjBQMoodWP1kDC36VAMXXIvAjj4ARa7ntfAV2BrjsbA==}
+    engines: {node: ^12.22.0 || ^14.16.0 || ^16.0.0 || >=17.0.0}
+
   handlebars@4.7.9:
     resolution: {integrity: sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==}
     engines: {node: '>=0.4.7'}
@@ -4077,13 +4655,26 @@ packages:
   header-case@2.0.4:
     resolution: {integrity: sha512-H/vuk5TEEVZwrR0lp2zed9OCo1uAILMlx0JEMgC26rzyJJ3N1v6XkwHHXJQdR2doSjcGPM6OKPYoJgf0plJ11Q==}
 
+  headers-polyfill@5.0.1:
+    resolution: {integrity: sha512-1TJ6Fih/b8h5TIcv+1+Hw0PDQWJTKDKzFZzcKOiW1wJza3XoAQlkCuXLbymPYB8+ZQyw8mHvdw560e8zVFIWyA==}
+
   highlight-words-core@1.2.3:
     resolution: {integrity: sha512-m1O9HW3/GNHxzSIXWw1wCNXXsgLlxrP0OI6+ycGUhiUHkikqW3OrwVHz+lxeNBe5yqLESdIcj8PowHQ2zLvUvQ==}
 
+  highlight-words@1.2.2:
+    resolution: {integrity: sha512-Mf4xfPXYm8Ay1wTibCrHpNWeR2nUMynMVFkXCi4mbl+TEgmNOe+I4hV7W3OCZcSvzGL6kupaqpfHOemliMTGxQ==}
+    engines: {node: '>= 16', npm: '>= 8'}
+
   highlight-words@2.0.0:
     resolution: {integrity: sha512-If5n+IhSBRXTScE7wl16VPmd+44Vy7kof24EdqhjsZsDuHikpv1OCagVcJFpB4fS4UPUniedlWqrjIO8vWOsIQ==}
     engines: {node: '>= 20', npm: '>= 9'}
 
+  highlight.js@10.7.3:
+    resolution: {integrity: sha512-tzcUFauisWKNHaRkN4Wjl/ZA07gENAjFl3J/c480dprkGTg5EQstgaNFqBfUqCq54kZRIEcreTsAgF/m2quD7A==}
+
+  highlightjs-vue@1.0.0:
+    resolution: {integrity: sha512-PDEfEF102G23vHmPhLyPboFCD+BkMGu+GuJe2d9/eH4FsCwvgBpnc9n0pGE+ffKdph38s6foEZiEjdgHdzp+IA==}
+
   history@4.10.1:
     resolution: {integrity: sha512-36nwAD620w12kuzPAsyINPWJqlNbij+hpK1k9XRloDtym8mxzGYl2c17LnV6IAGB2Dmg4tEa7G7DlawS0+qjew==}
 
@@ -4093,6 +4684,9 @@ packages:
   hoist-non-react-statics@3.3.2:
     resolution: {integrity: sha512-/gGivxi8JPKWNm/W0jSmzcMPpfpPLc3dY/6GxhX2hQ9iGj3aDfklV4ET7NjKpSinLpJ5vafa9iiGIEZg10SfBw==}
 
+  hotkeys-js@4.0.4:
+    resolution: {integrity: sha512-hseNiqaskxSnujuGp8aRMLJfcjaFiTSS0I2GQhqru82N/sx6CGyUf6pvU5X1iycvw2EqmvILkFIb5OzYFXY+9A==}
+
   html-encoding-sniffer@3.0.0:
     resolution: {integrity: sha512-oWv4T4yJ52iKrufjnyZPkrN0CH3QnrUqdB6In1g5Fe1mia8GmF36gnfNySxoZtxD5+NmYw1EElVXiBk93UeskA==}
     engines: {node: '>=12'}
@@ -4124,6 +4718,10 @@ packages:
     resolution: {integrity: sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==}
     engines: {node: '>= 6'}
 
+  https-proxy-agent@7.0.6:
+    resolution: {integrity: sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==}
+    engines: {node: '>= 14'}
+
   human-signals@2.1.0:
     resolution: {integrity: sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==}
     engines: {node: '>=10.17.0'}
@@ -4203,6 +4801,10 @@ packages:
     resolution: {integrity: sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==}
     engines: {node: '>=8'}
 
+  index-to-position@1.2.0:
+    resolution: {integrity: sha512-Yg7+ztRkqslMAS2iFaU+Oa4KTSidr63OsFGlOrJoW981kIYO3CGCS3wA95P1mUi/IVSJkn0D479KTJpVpvFNuw==}
+    engines: {node: '>=18'}
+
   inflight@1.0.6:
     resolution: {integrity: sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==}
     deprecated: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
@@ -4316,6 +4918,9 @@ packages:
   is-module@1.0.0:
     resolution: {integrity: sha512-51ypPSPCoTEIN9dy5Oy+h4pShgJmPCygKfyRCISBI+JoWT/2oJvK8QPxmwv7b/p239jXrm9M1mlQbyKJ5A152g==}
 
+  is-node-process@1.2.0:
+    resolution: {integrity: sha512-Vg4o6/fqPxIjtxgUH5QLJhwZ7gW5diGCVlXpuUfELC62CuxM1iHcRe51f2W1FDy04Ai4KJkagKjx3XaqyfRKXw==}
+
   is-number-object@1.1.1:
     resolution: {integrity: sha512-lZhclumE1G6VYD8VHe35wFaIif+CTy5SJIi5+3y4psDgWu4wPDoBhF8NxUOinEc7pHgiTsT6MaBb92rKhhD+Xw==}
     engines: {node: '>= 0.4'}
@@ -4568,6 +5173,10 @@ packages:
   js-cookie@2.2.1:
     resolution: {integrity: sha512-HvdH2LzI/EAZcUwA8+0nKNtWHqS+ZmijLA30RwZA0bo7ToCckjK5MkGhjED9KoRcXO6BaGI3I9UIzSA1FKFPOQ==}
 
+  js-levenshtein@1.1.6:
+    resolution: {integrity: sha512-X2BB11YZtrRqY4EnQcLX5Rh373zbK4alC1FW7D7MBhL2gtcC17cTnr6DmfHZeS0s2rTHjUTMMHfG7gO8SSdw+g==}
+    engines: {node: '>=0.10.0'}
+
   js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
@@ -4575,6 +5184,10 @@ packages:
     resolution: {integrity: sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==}
     hasBin: true
 
+  js-yaml@4.3.0:
+    resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==}
+    hasBin: true
+
   js-yaml@4.3.1:
     resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==}
     hasBin: true
@@ -4775,6 +5388,9 @@ packages:
   lower-case@2.0.2:
     resolution: {integrity: sha512-7fm3l3NAF9WfN6W3JOmf5drwpVqX78JtoGJ3A6W0a6ZnldM41w2fV5D490psKFTpMds8TJse/eHLFFsNHHjHgg==}
 
+  lowlight@1.20.0:
+    resolution: {integrity: sha512-8Ktj+prEb1RoCPkEOrPMYUN/nCggB7qAWe3a7OpMjWQkh3l2RD5wKRQ+o8Q8YuI9RG/xs95waaI/E6ym/7NsTw==}
+
   lru-cache@10.4.3:
     resolution: {integrity: sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==}
 
@@ -4815,6 +5431,17 @@ packages:
     engines: {node: '>= 20'}
     hasBin: true
 
+  material-react-table@1.15.1:
+    resolution: {integrity: sha512-TXidRV7lGtCV5G/ON9Y38TztRcmpKFodFmyTCjvlKXCl5/9X+KY4waP8U0l16FFslg1f7HGWhfkqV5OfUfEIoA==}
+    engines: {node: '>=14'}
+    peerDependencies:
+      '@emotion/react': '>=11'
+      '@emotion/styled': '>=11'
+      '@mui/icons-material': 7.3.7
+      '@mui/material': 7.3.7
+      react: '>=17.0'
+      react-dom: '>=17.0'
+
   material-react-table@3.2.1:
     resolution: {integrity: sha512-sQtTf7bETpkPN2Hm5BVtz89wrfXCVQguz6XlwMChSnfKFO5QCKAJJC5aSIKnUc3S0AvTz/k/ILi00FnnY1Gixw==}
     engines: {node: '>=16'}
@@ -5086,6 +5713,9 @@ packages:
     resolution: {integrity: sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==}
     engines: {node: '>=16 || 14 >=14.17'}
 
+  mitt@3.0.1:
+    resolution: {integrity: sha512-vKivATfr97l2/QBCYAkXYDbrIWPM2IIKEl7YPhjCvKlG3kE2gm+uBo6nEXK3M5/Ffh/FLpKExzOQ3JJoJGFKBw==}
+
   moment-timezone@0.5.47:
     resolution: {integrity: sha512-UbNt/JAWS0m/NJOebR0QMRHBk0hu03r5dx9GK8Cs0AS3I81yDcOc9k+DytPItgVvBP7J6Mf6U2n3BPAacAV9oA==}
 
@@ -5095,9 +5725,26 @@ packages:
   monaco-editor@0.34.1:
     resolution: {integrity: sha512-FKc80TyiMaruhJKKPz5SpJPIjL+dflGvz4CpuThaPMc94AyN7SeC9HQ8hrvaxX7EyHdJcUY5i4D0gNyJj1vSZQ==}
 
+  moo@0.5.3:
+    resolution: {integrity: sha512-m2fmM2dDm7GZQsY7KK2cme8agi+AAljILjQnof7p1ZMDe6dQ4bdnSMx0cPppudoeNv5hEFQirN6u+O4fDE0IWA==}
+
   ms@2.1.3:
     resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
 
+  msw@2.15.0:
+    resolution: {integrity: sha512-2wQAmKkQKxRuXvYJxVhPGG0wZNBQyD06oJvxqw90XqLvptdqxdlHrFUfEteKkpaNORX3Xzc+HtEl/q0nfmN2wQ==}
+    engines: {node: '>=18'}
+    hasBin: true
+    peerDependencies:
+      typescript: '>= 4.8.x'
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
+  mute-stream@3.0.0:
+    resolution: {integrity: sha512-dkEJPVvun4FryqBmZ5KhDo0K9iDXAwn08tMLDinNdRBNPcYEDiWYysLcc6k3mjTMlbP9KyylvRpd4wFtwrT9rw==}
+    engines: {node: ^20.17.0 || >=22.9.0}
+
   nano-css@5.6.2:
     resolution: {integrity: sha512-+6bHaC8dSDGALM1HJjOHVXpuastdu2xFoZlC77Jh4cg+33Zcgm+Gxd+1xsnpZK14eyHObSp82+ll5y3SX75liw==}
     peerDependencies:
@@ -5112,6 +5759,10 @@ packages:
   natural-compare@1.4.0:
     resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
 
+  nearley@2.20.1:
+    resolution: {integrity: sha512-+Mc8UaAebFzgV+KpI5n7DasuuQCHA89dmwm7JXw3TV43ukfNQ9DnBH3Mdb2g/I4Fdxc26pwimBWvjIw0UAILSQ==}
+    hasBin: true
+
   neo-async@2.6.2:
     resolution: {integrity: sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==}
 
@@ -5187,10 +5838,25 @@ packages:
     resolution: {integrity: sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==}
     engines: {node: '>=6'}
 
+  openapi-fetch@0.17.0:
+    resolution: {integrity: sha512-PsbZR1wAPcG91eEthKhN+Zn92FMHxv+/faECIwjXdxfTODGSGegYv0sc1Olz+HYPvKOuoXfp+0pA2XVt2cI0Ig==}
+
+  openapi-typescript-helpers@0.1.0:
+    resolution: {integrity: sha512-OKTGPthhivLw/fHz6c3OPtg72vi86qaMlqbJuVJ23qOvQ+53uw1n7HdmkJFibloF7QEjDrDkzJiOJuockM/ljw==}
+
+  openapi-typescript@7.13.0:
+    resolution: {integrity: sha512-EFP392gcqXS7ntPvbhBzbF8TyBA+baIYEm791Hy5YkjDYKTnk/Tn5OQeKm5BIZvJihpp8Zzr4hzx0Irde1LNGQ==}
+    hasBin: true
+    peerDependencies:
+      typescript: ^5.x
+
   optionator@0.9.4:
     resolution: {integrity: sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==}
     engines: {node: '>= 0.8.0'}
 
+  outvariant@1.4.3:
+    resolution: {integrity: sha512-+Sl2UErvtsoajRDKCE5/dBz4DIvHXQQnAxtQTF04OJxY0+DyZXSo5P5Bb7XYWOh81syohlYL24hbDwxedPUJCA==}
+
   oxfmt@0.49.0:
     resolution: {integrity: sha512-IAHFMdlJSWe+oAr65dx22UvjCtV9DBMisAuLnKpDqMQrctzCkGnj3QRwNHm0d+uwSWPalsDF8ZYLz9rh6nH2IQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
@@ -5269,6 +5935,10 @@ packages:
     resolution: {integrity: sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==}
     engines: {node: '>=8'}
 
+  parse-json@8.3.0:
+    resolution: {integrity: sha512-ybiGyvspI+fAoRQbIPRddCcSTV9/LsJbf0e/S85VLowVGzRmokfneg2kwVW/KU5rOXrPSbF1qAKPMgNTqqROQQ==}
+    engines: {node: '>=18'}
+
   parse5@7.3.0:
     resolution: {integrity: sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==}
 
@@ -5300,6 +5970,9 @@ packages:
   path-to-regexp@1.9.0:
     resolution: {integrity: sha512-xIp7/apCFJuUHdDLWe8O1HIkb0kQrOMb/0u6FXQjemHn/ii5LrIzU6bdECnsiTF/GjZkMEKg1xdiZwNqDYlZ6g==}
 
+  path-to-regexp@6.3.0:
+    resolution: {integrity: sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==}
+
   path-type@4.0.0:
     resolution: {integrity: sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==}
     engines: {node: '>=8'}
@@ -5343,6 +6016,10 @@ packages:
     engines: {node: '>=20'}
     hasBin: true
 
+  pluralize@8.0.0:
+    resolution: {integrity: sha512-Nc3IT5yHzflTfbjgqWcCPpo7DaKy4FnpB0l/zCAW0Tc7jxAiuqSxHasntB3D7887LSrA93kDJ9IXovxJYxyLCA==}
+    engines: {node: '>=4'}
+
   portfinder@1.0.38:
     resolution: {integrity: sha512-rEwq/ZHlJIKw++XtLAO8PPuOQA/zaPJOZJ37BVuN97nLpMJeuDVLVGRwbFoBgLudgdTMP2hdRJP++H+8QOA3vg==}
     engines: {node: '>= 10.12'}
@@ -5650,6 +6327,13 @@ packages:
   raf@3.4.1:
     resolution: {integrity: sha512-Sq4CW4QhwOHE8ucn6J34MqtZCeWFP2aQSmrlroYgqAV1PjStIhJXxYuTgUIfkEk7zTLjmIjLmU5q+fbD1NnOJA==}
 
+  railroad-diagrams@1.0.0:
+    resolution: {integrity: sha512-cz93DjNeLY0idrCNOH6PviZGRN9GJhsdm9hpn1YCS879fj4W+x5IFJhhkRZcwVgMmFF7R82UA/7Oh+R8lLZg6A==}
+
+  randexp@0.4.6:
+    resolution: {integrity: sha512-80WNmd9DA0tmZrw9qQa62GPPWfuXJknrmVmLcxvq4uZBdYqb1wYoKTmnlGUchvVWe0XiLupYkBoXVOxz3C8DYQ==}
+    engines: {node: '>=0.12'}
+
   raw-body@1.1.7:
     resolution: {integrity: sha512-WmJJU2e9Y6M5UzTOkHaM7xJGAPQD8PNzx3bAd2+uhZAim6wDk6dAZxPVYLF67XhbR4hmKGh33Lpmh4XWrCH5Mg==}
     engines: {node: '>= 0.8.0'}
@@ -5872,6 +6556,15 @@ packages:
     peerDependencies:
       react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
 
+  react-string-replace@2.0.1:
+    resolution: {integrity: sha512-J7y/IxZkwhOgCexu6GtkNH2FIa9f/z6ykvK1YXS8VLIdvcP8Vyx3LAUFsfIFvq3aQbmin2d+clFR1J50LnR2yA==}
+
+  react-syntax-highlighter@16.1.1:
+    resolution: {integrity: sha512-PjVawBGy80C6YbC5DDZJeUjBmC7skaoEUdvfFQediQHgCL7aKyVHe57SaJGfQsloGDac+gCpTfRdtxzWWKmCXA==}
+    engines: {node: '>= 16.20.2'}
+    peerDependencies:
+      react: '>= 0.14.0'
+
   react-table@7.8.0:
     resolution: {integrity: sha512-hNaz4ygkZO4bESeFfnfOft73iBUj8K5oKi1EcSHPAibEydfsX2MyU6Z8KCr3mv3C9Kqqh71U+DhZkFvibbnPbA==}
     peerDependencies:
@@ -5925,6 +6618,9 @@ packages:
   redux@5.0.1:
     resolution: {integrity: sha512-M9/ELqF6fy8FwmkpnF0S3YKOqMyoWJ4+CS5Efg2ct3oY9daQvd/Pc71FpGZsVsbl3Cpb+IIcjBDUnnyBdQbq4w==}
 
+  refractor@5.0.0:
+    resolution: {integrity: sha512-QXOrHQF5jOpjjLfiNk5GFnWhRXvxjUVnlFxkeDmewR5sXkr3iM46Zo+CnRR8B+MDVqkULW4EcLVcRBNOPXHosw==}
+
   regexp.prototype.flags@1.5.4:
     resolution: {integrity: sha512-dYqgNSZbDwkaJ2ceRd9ojCGjBq+mOm9LmtXnAnEGyHhN/5R7iDW2TRw3h+o/jCFxus3P2LfWIIiwowAjANm7IA==}
     engines: {node: '>= 0.4'}
@@ -5944,6 +6640,9 @@ packages:
   remark-stringify@11.0.0:
     resolution: {integrity: sha512-1OSmLd3awB/t8qdoEOMazZkNsfVTeY4fTsgzcQFdXNq8ToTN4ZGwrMnlda4K6smTFKD+GRV6O48i6Z4iKgPPpw==}
 
+  remove-accents@0.4.2:
+    resolution: {integrity: sha512-7pXIJqJOq5tFgG1A2Zxti3Ht8jJF337m4sowbuHsW30ZnkQFnDzy9qBNhgzX8ZLW4+UBcXiiR7SwR6pokHsxiA==}
+
   remove-accents@0.5.0:
     resolution: {integrity: sha512-8g3/Otx1eJaVD12e31UbJj1YzdtVvzH85HV7t+9MJYk/u3XmkOUJ5Ys9wQrf9PCPK8+xn4ymzqYCiZl6QWKn+A==}
 
@@ -5991,6 +6690,13 @@ packages:
     engines: {node: '>= 0.4'}
     hasBin: true
 
+  ret@0.1.15:
+    resolution: {integrity: sha512-TTlYpa+OL+vMMNG24xSlQGEJ3B/RzEfUlLct7b5G/ytav+wPrplCpVMFuwzXbkecJrb6IYo1iFb0S9v37754mg==}
+    engines: {node: '>=0.12'}
+
+  rettime@0.11.11:
+    resolution: {integrity: sha512-ILJRqVWBCTlg9r42fFgwVZx1gnFAcQF8mRoMkbgQfIrjEDf9nbBFDFx00oloOa+Q869FUtaYDXZvEfnecQSCoQ==}
+
   reusify@1.1.0:
     resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
     engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
@@ -6129,6 +6835,9 @@ packages:
   set-cookie-parser@2.7.2:
     resolution: {integrity: sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==}
 
+  set-cookie-parser@3.1.2:
+    resolution: {integrity: sha512-5/r/lTwbJ3zQ+qwdUFZYeRNqda7P5HD8zQKqlSjdGt1/S0cjLAphHusj4Y58ahDtWn/g32xrIS58/ikOvwl0Lw==}
+
   set-function-length@1.2.2:
     resolution: {integrity: sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==}
     engines: {node: '>= 0.4'}
@@ -6268,6 +6977,10 @@ packages:
   sprintf-js@1.0.3:
     resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==}
 
+  sql-formatter@15.8.2:
+    resolution: {integrity: sha512-kTYRg5FIcvsDtYUG2Qn9pYT6xKwiLJN5TTIvc5Mur6hIg4pSfdpHu8Yyu5bqESLHnVM3mXzD446cb2+uEaKZXg==}
+    hasBin: true
+
   stable@0.1.8:
     resolution: {integrity: sha512-ji9qxRnOVfcuLDySj9qzhGSEFVobyt1kIOSkj1qZzYLzq7Tos/oUUWvotUPQLlrsidqsK6tBH89Bc9kL5zHA6w==}
     deprecated: 'Modern JS already guarantees Array#sort() is a stable sort, so this library is deprecated. See the compatibility table on MDN: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/sort#browser_compatibility'
@@ -6294,6 +7007,10 @@ packages:
   state-local@1.0.7:
     resolution: {integrity: sha512-HTEHMNieakEnoe33shBYcZ7NX83ACUjCu8c40iOGEZsngj9zRnkqS9j1pqQPXwobB0ZcVTk27REb7COQ0UR59w==}
 
+  statuses@2.0.2:
+    resolution: {integrity: sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==}
+    engines: {node: '>= 0.8'}
+
   std-env@4.2.0:
     resolution: {integrity: sha512-oCUKSupKTHX53EyjDtuZQ64pjLJ6yYCtpmEw0goYxtjG9KpbRe8KAsl2tBUGU9DyMcJ0RwJ8GqJAFzMXcXW1Rw==}
 
@@ -6301,6 +7018,9 @@ packages:
     resolution: {integrity: sha512-eLoXW/DHyl62zxY4SCaIgnRhuMr6ri4juEYARS8E6sCEqzKpOiE521Ucofdx+KnDZl5xmvGYaaKCk5FEOxJCoQ==}
     engines: {node: '>= 0.4'}
 
+  strict-event-emitter@0.5.1:
+    resolution: {integrity: sha512-vMgjE/GGEPEFnhFub6pa4FmJBRBVOLpIII2hvCZ8Kzb7K0hlHo7mQv6xYrBvCL2LtAIBwFUK8wvuJgTVSQ5MFQ==}
+
   string-hash@1.1.3:
     resolution: {integrity: sha512-kJUvRUFK49aub+a7T1nNE66EJbZBMnBgoC1UbCZ5n6bsZKBRga4KgBRTMn/pFkeCZSYtNeSyMxPDM0AXWELk2A==}
 
@@ -6380,6 +7100,10 @@ packages:
   stylis@4.4.0:
     resolution: {integrity: sha512-5Z9ZpRzfuH6l/UAvCPAPUo3665Nk2wLaZU3x+TLHKVzIz33+sbJqbtrYoC3KD4/uVOr2Zp+L0LySezP9OHV9yA==}
 
+  supports-color@10.2.2:
+    resolution: {integrity: sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g==}
+    engines: {node: '>=18'}
+
   supports-color@7.2.0:
     resolution: {integrity: sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==}
     engines: {node: '>=8'}
@@ -6412,6 +7136,10 @@ packages:
   tabbable@6.5.0:
     resolution: {integrity: sha512-wieBHXygIm7OyQOu5hQlkk62/WyCFYGlWg7L6/ZCUZwx0o398Zkn4pVmMyfYhfMG8kGrj/Krt8eIk6UKC6VzwA==}
 
+  tagged-tag@1.0.0:
+    resolution: {integrity: sha512-yEFYrVhod+hdNyx7g5Bnkkb0G6si8HJurOoOEgC8B/O0uXLHlaey/65KRv6cuWBNhBgHKAROVpc7QyYqE5gFng==}
+    engines: {node: '>=20'}
+
   tapable@2.3.3:
     resolution: {integrity: sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==}
     engines: {node: '>=6'}
@@ -6618,6 +7346,11 @@ packages:
   tslib@2.8.1:
     resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
 
+  tsx@4.23.4:
+    resolution: {integrity: sha512-ZiUQ8oT/KzN51mJUWPqARYqwFLFJZtGZipRkw1ynHMr9vy3eU77m5yfF3Gzm6meEg/beW+lUu3fHYgskTN2oVQ==}
+    engines: {node: '>=18.0.0'}
+    hasBin: true
+
   turbo@2.10.8:
     resolution: {integrity: sha512-9+8YX5QOkGXzZxcIykTHgaooRHGMWO+jfdyRK0o+rN0U7hBIig2MrJ8r/aNzIPDPhdA73SGb0O+tIztaModTMg==}
     hasBin: true
@@ -6638,6 +7371,10 @@ packages:
     resolution: {integrity: sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==}
     engines: {node: '>=16'}
 
+  type-fest@5.8.0:
+    resolution: {integrity: sha512-YGYEVz3Fm5iy/AybuA0oyNFq7H4CgQNfRp/qfe8nurE1kuCeNm3/vfm9X4Mtl+qLyaKJUh5xrFZwogr41SMjYA==}
+    engines: {node: '>=20'}
+
   type-of@2.0.1:
     resolution: {integrity: sha512-39wxbwHdQ2sTiBB8wAzKfQ9GN+om8w+sjNWzr+vZJR5AMD5J+J7Yc8AtXnU9r/r2c8XiDZ/smxutDmZehX/qpQ==}
 
@@ -6701,6 +7438,9 @@ packages:
     resolution: {integrity: sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==}
     engines: {node: '>= 10.0.0'}
 
+  until-async@3.0.2:
+    resolution: {integrity: sha512-IiSk4HlzAMqTUseHHe3VhIGyuFmN90zMTpD3Z3y8jeQbzLIq500MVM7Jq2vUAnTKAFPJrqwkzr6PoTcPhGcOiw==}
+
   update-browserslist-db@1.2.3:
     resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==}
     hasBin: true
@@ -6713,6 +7453,9 @@ packages:
   upper-case-first@2.0.2:
     resolution: {integrity: sha512-514ppYHBaKwfJRK/pNC6c/OxfGa0obSnAl106u97Ed0I625Nin96KAjttZF6ZL3e1XLtphxnqrOi9iWgm+u+bg==}
 
+  uri-js-replace@1.0.1:
+    resolution: {integrity: sha512-W+C9NWNLFOoBI2QWDp4UT9pv65r2w5Cx+3sTYFvtMdDBxkKt1syCqsUdSFAChbEe1uK5TfS04wt/nGwmaeIQ0g==}
+
   uri-js@4.4.1:
     resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
 
@@ -6766,6 +7509,26 @@ packages:
   vfile@6.0.3:
     resolution: {integrity: sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q==}
 
+  virtua@0.49.1:
+    resolution: {integrity: sha512-6f79msqg3jzNFdqJiS0FSzhRN1EHlDhR7EvW7emp6z5qQ22VdsReiDHflkpMEMhoAyUuYr69nwT0aagiM7NrUg==}
+    peerDependencies:
+      react: '>=16.14.0'
+      react-dom: '>=16.14.0'
+      solid-js: '>=1.0'
+      svelte: '>=5.0'
+      vue: '>=3.2'
+    peerDependenciesMeta:
+      react:
+        optional: true
+      react-dom:
+        optional: true
+      solid-js:
+        optional: true
+      svelte:
+        optional: true
+      vue:
+        optional: true
+
   vite-plugin-svgr@5.2.0:
     resolution: {integrity: sha512-qj2eAKF8C6PZWemVTvQA0xgQIcP1hHU6Buh7fl6BhvayWwnuxE+z417miKxeDvRWbDrupQ1oK99hfxElopJ3sQ==}
     peerDependencies:
@@ -7071,6 +7834,9 @@ packages:
   yallist@3.1.1:
     resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==}
 
+  yaml-ast-parser@0.0.43:
+    resolution: {integrity: sha512-2PTINUwsRqSd+s8XxKaJWQlUuEMHJQyEuh2edBbW8KNJz0SJPwUSD2zRWqezFEdN7IzAgeuYHFUCF7o8zRdZ0A==}
+
   yaml@1.10.3:
     resolution: {integrity: sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA==}
     engines: {node: '>= 6'}
@@ -7177,7 +7943,7 @@ snapshots:
       '@babel/types': 7.29.8
       '@jridgewell/remapping': 2.3.5
       convert-source-map: 2.0.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       gensync: 1.0.0-beta.2
       json5: 2.2.3
       semver: 6.3.1
@@ -7338,7 +8104,7 @@ snapshots:
       '@babel/parser': 7.29.8
       '@babel/template': 7.29.7
       '@babel/types': 7.29.8
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
     transitivePeerDependencies:
       - supports-color
 
@@ -7387,6 +8153,31 @@ snapshots:
 
   '@discoveryjs/json-ext@0.5.7': {}
 
+  '@dnd-kit/accessibility@3.1.1(react@19.2.8)':
+    dependencies:
+      react: 19.2.8
+      tslib: 2.8.1
+
+  '@dnd-kit/core@6.3.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
+    dependencies:
+      '@dnd-kit/accessibility': 3.1.1(react@19.2.8)
+      '@dnd-kit/utilities': 3.2.2(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      tslib: 2.8.1
+
+  '@dnd-kit/sortable@10.0.0(@dnd-kit/core@6.3.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)':
+    dependencies:
+      '@dnd-kit/core': 6.3.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@dnd-kit/utilities': 3.2.2(react@19.2.8)
+      react: 19.2.8
+      tslib: 2.8.1
+
+  '@dnd-kit/utilities@3.2.2(react@19.2.8)':
+    dependencies:
+      react: 19.2.8
+      tslib: 2.8.1
+
   '@emnapi/core@2.0.0-alpha.3':
     dependencies:
       '@emnapi/wasi-threads': 2.0.1
@@ -7512,19 +8303,97 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@emotion/unitless@0.10.0': {}
+  '@emotion/unitless@0.10.0': {}
+
+  '@emotion/use-insertion-effect-with-fallbacks@1.2.0(react@18.3.1)':
+    dependencies:
+      react: 18.3.1
+
+  '@emotion/use-insertion-effect-with-fallbacks@1.2.0(react@19.2.8)':
+    dependencies:
+      react: 19.2.8
+
+  '@emotion/utils@1.4.2': {}
+
+  '@emotion/weak-memoize@0.4.0': {}
+
+  '@esbuild/aix-ppc64@0.25.12':
+    optional: true
+
+  '@esbuild/android-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/android-arm@0.25.12':
+    optional: true
+
+  '@esbuild/android-x64@0.25.12':
+    optional: true
+
+  '@esbuild/darwin-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/darwin-x64@0.25.12':
+    optional: true
+
+  '@esbuild/freebsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/freebsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-arm@0.25.12':
+    optional: true
+
+  '@esbuild/linux-ia32@0.25.12':
+    optional: true
+
+  '@esbuild/linux-loong64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-mips64el@0.25.12':
+    optional: true
+
+  '@esbuild/linux-ppc64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-riscv64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-s390x@0.25.12':
+    optional: true
+
+  '@esbuild/linux-x64@0.25.12':
+    optional: true
+
+  '@esbuild/netbsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/netbsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/openbsd-arm64@0.25.12':
+    optional: true
 
-  '@emotion/use-insertion-effect-with-fallbacks@1.2.0(react@18.3.1)':
-    dependencies:
-      react: 18.3.1
+  '@esbuild/openbsd-x64@0.25.12':
+    optional: true
 
-  '@emotion/use-insertion-effect-with-fallbacks@1.2.0(react@19.2.8)':
-    dependencies:
-      react: 19.2.8
+  '@esbuild/openharmony-arm64@0.25.12':
+    optional: true
 
-  '@emotion/utils@1.4.2': {}
+  '@esbuild/sunos-x64@0.25.12':
+    optional: true
 
-  '@emotion/weak-memoize@0.4.0': {}
+  '@esbuild/win32-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/win32-ia32@0.25.12':
+    optional: true
+
+  '@esbuild/win32-x64@0.25.12':
+    optional: true
 
   '@eslint-community/eslint-utils@4.10.1(eslint@10.8.0)':
     dependencies:
@@ -7536,7 +8405,7 @@ snapshots:
   '@eslint/config-array@0.23.5':
     dependencies:
       '@eslint/object-schema': 3.0.5
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       minimatch: 10.2.6
     transitivePeerDependencies:
       - supports-color
@@ -7869,6 +8738,33 @@ snapshots:
 
   '@humanwhocodes/retry@0.4.3': {}
 
+  '@inquirer/ansi@2.0.7': {}
+
+  '@inquirer/confirm@6.1.1(@types/node@20.19.43)':
+    dependencies:
+      '@inquirer/core': 11.2.1(@types/node@20.19.43)
+      '@inquirer/type': 4.0.7(@types/node@20.19.43)
+    optionalDependencies:
+      '@types/node': 20.19.43
+
+  '@inquirer/core@11.2.1(@types/node@20.19.43)':
+    dependencies:
+      '@inquirer/ansi': 2.0.7
+      '@inquirer/figures': 2.0.7
+      '@inquirer/type': 4.0.7(@types/node@20.19.43)
+      cli-width: 4.1.0
+      fast-wrap-ansi: 0.2.2
+      mute-stream: 3.0.0
+      signal-exit: 4.1.0
+    optionalDependencies:
+      '@types/node': 20.19.43
+
+  '@inquirer/figures@2.0.7': {}
+
+  '@inquirer/type@4.0.7(@types/node@20.19.43)':
+    optionalDependencies:
+      '@types/node': 20.19.43
+
   '@internationalized/date@3.12.3':
     dependencies:
       '@swc/helpers': 0.5.23
@@ -8121,6 +9017,22 @@ snapshots:
 
   '@leeoniya/ufuzzy@1.0.19': {}
 
+  '@melloware/react-logviewer@6.5.5(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
+    dependencies:
+      hotkeys-js: 4.0.4
+      immutable: 5.1.9
+      mitt: 3.0.1
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      react-string-replace: 2.0.1
+      virtua: 0.49.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+    transitivePeerDependencies:
+      - solid-js
+      - svelte
+      - vue
+
+  '@microsoft/fetch-event-source@2.0.1': {}
+
   '@monaco-editor/loader@1.7.0':
     dependencies:
       state-local: 1.0.7
@@ -8132,6 +9044,15 @@ snapshots:
       react: 18.3.1
       react-dom: 18.3.1(react@18.3.1)
 
+  '@mswjs/interceptors@0.41.9':
+    dependencies:
+      '@open-draft/deferred-promise': 2.2.0
+      '@open-draft/logger': 0.3.0
+      '@open-draft/until': 2.1.0
+      is-node-process: 1.2.0
+      outvariant: 1.4.3
+      strict-event-emitter: 0.5.1
+
   '@mui/core-downloads-tracker@7.3.7': {}
 
   '@mui/icons-material@7.3.7(@mui/material@7.3.7(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(@types/react@19.2.18)(react@19.2.8)':
@@ -8270,6 +9191,17 @@ snapshots:
       '@nodelib/fs.scandir': 2.1.5
       fastq: 1.20.1
 
+  '@open-draft/deferred-promise@2.2.0': {}
+
+  '@open-draft/deferred-promise@3.0.0': {}
+
+  '@open-draft/logger@0.3.0':
+    dependencies:
+      is-node-process: 1.2.0
+      outvariant: 1.4.3
+
+  '@open-draft/until@2.1.0': {}
+
   '@openfeature/core@1.12.0': {}
 
   '@openfeature/ofrep-core@2.3.0(@openfeature/core@1.12.0)':
@@ -8458,6 +9390,24 @@ snapshots:
   '@oxlint/binding-win32-x64-msvc@1.76.0':
     optional: true
 
+  '@percona/percona-ui@1.0.22(46f3b00c55de1f105bc9f3068b58f1a0)':
+    dependencies:
+      '@emotion/react': 11.14.0(@types/react@19.2.18)(react@19.2.8)
+      '@emotion/styled': 11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8)
+      '@fontsource/poppins': 5.3.0
+      '@fontsource/roboto': 5.3.0
+      '@fontsource/roboto-mono': 5.3.0
+      '@mui/icons-material': 7.3.7(@mui/material@7.3.7(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(@types/react@19.2.18)(react@19.2.8)
+      '@mui/material': 7.3.7(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@mui/utils': 7.3.7(@types/react@19.2.18)(react@19.2.8)
+      '@mui/x-date-pickers': 7.29.4(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@mui/material@7.3.7(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(@mui/system@7.3.7(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(date-fns@4.1.0)(moment@2.30.1)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      material-react-table: 3.2.1(ffd7a467fdfa2c805c677d05446fb4c4)
+      notistack: 3.0.2(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      react-hook-form: 7.84.0(react@19.2.8)
+      react-is: 18.3.1
+
   '@percona/percona-ui@1.0.24(46f3b00c55de1f105bc9f3068b58f1a0)':
     dependencies:
       '@emotion/react': 11.14.0(@types/react@19.2.18)(react@19.2.8)
@@ -8837,6 +9787,29 @@ snapshots:
       react: 19.2.8
       resize-observer-polyfill: 1.5.1
 
+  '@redocly/ajv@8.11.2':
+    dependencies:
+      fast-deep-equal: 3.1.3
+      json-schema-traverse: 1.0.0
+      require-from-string: 2.0.2
+      uri-js-replace: 1.0.1
+
+  '@redocly/config@0.22.0': {}
+
+  '@redocly/openapi-core@1.34.18(supports-color@10.2.2)':
+    dependencies:
+      '@redocly/ajv': 8.11.2
+      '@redocly/config': 0.22.0
+      colorette: 1.4.0
+      https-proxy-agent: 7.0.6(supports-color@10.2.2)
+      js-levenshtein: 1.1.6
+      js-yaml: 4.3.0
+      minimatch: 5.1.9
+      pluralize: 8.0.0
+      yaml-ast-parser: 0.0.43
+    transitivePeerDependencies:
+      - supports-color
+
   '@remix-run/router@1.23.3': {}
 
   '@rolldown/binding-android-arm64@1.2.1':
@@ -9194,6 +10167,10 @@ snapshots:
     dependencies:
       remove-accents: 0.5.0
 
+  '@tanstack/match-sorter-utils@8.8.4':
+    dependencies:
+      remove-accents: 0.4.2
+
   '@tanstack/query-core@5.101.4': {}
 
   '@tanstack/react-query@5.101.4(react@19.2.8)':
@@ -9201,12 +10178,23 @@ snapshots:
       '@tanstack/query-core': 5.101.4
       react: 19.2.8
 
+  '@tanstack/react-table@8.10.7(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
+    dependencies:
+      '@tanstack/table-core': 8.10.7
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+
   '@tanstack/react-table@8.20.6(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@tanstack/table-core': 8.20.5
       react: 19.2.8
       react-dom: 19.2.8(react@19.2.8)
 
+  '@tanstack/react-virtual@3.0.0-beta.65(react@19.2.8)':
+    dependencies:
+      '@tanstack/virtual-core': 3.0.0-beta.65
+      react: 19.2.8
+
   '@tanstack/react-virtual@3.11.2(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@tanstack/virtual-core': 3.11.2
@@ -9219,8 +10207,12 @@ snapshots:
       react: 18.3.1
       react-dom: 18.3.1(react@18.3.1)
 
+  '@tanstack/table-core@8.10.7': {}
+
   '@tanstack/table-core@8.20.5': {}
 
+  '@tanstack/virtual-core@3.0.0-beta.65': {}
+
   '@tanstack/virtual-core@3.11.2': {}
 
   '@tanstack/virtual-core@3.17.7': {}
@@ -9236,7 +10228,7 @@ snapshots:
       lz-string: 1.5.0
       pretty-format: 27.5.1
 
-  '@testing-library/jest-dom@6.1.4(@jest/globals@29.7.0)(@types/jest@29.5.14)(jest@29.7.0(@types/node@20.19.43)(babel-plugin-macros@3.1.0)(ts-node@10.9.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(@types/node@20.19.43)(typescript@5.5.4)))(vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@20.19.43)(jsdom@29.1.1)(vite@8.2.0(@types/node@20.19.43)(sass@1.63.2)(terser@5.49.0)(yaml@2.9.0)))':
+  '@testing-library/jest-dom@6.1.4(@jest/globals@29.7.0)(@types/jest@29.5.14)(jest@29.7.0(@types/node@20.19.43)(babel-plugin-macros@3.1.0)(ts-node@10.9.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(@types/node@20.19.43)(typescript@5.5.4)))(vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@20.19.43)(jsdom@29.1.1)(msw@2.15.0(@types/node@20.19.43)(typescript@5.5.4))(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(sass@1.63.2)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0)))':
     dependencies:
       '@adobe/css-tools': 4.5.0
       '@babel/runtime': 7.29.7
@@ -9250,7 +10242,7 @@ snapshots:
       '@jest/globals': 29.7.0
       '@types/jest': 29.5.14
       jest: 29.7.0(@types/node@20.19.43)(babel-plugin-macros@3.1.0)(ts-node@10.9.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(@types/node@20.19.43)(typescript@5.5.4))
-      vitest: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@20.19.43)(jsdom@29.1.1)(vite@8.2.0(@types/node@20.19.43)(sass@1.63.2)(terser@5.49.0)(yaml@2.9.0))
+      vitest: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@20.19.43)(jsdom@29.1.1)(msw@2.15.0(@types/node@20.19.43)(typescript@5.5.4))(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(sass@1.63.2)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0))
 
   '@testing-library/jest-dom@6.10.0(@testing-library/dom@9.3.4)':
     dependencies:
@@ -9282,6 +10274,10 @@ snapshots:
       '@types/react': 19.2.18
       '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
+  '@testing-library/user-event@14.6.1(@testing-library/dom@9.3.4)':
+    dependencies:
+      '@testing-library/dom': 9.3.4
+
   '@tootallnate/once@2.0.1': {}
 
   '@tsconfig/node10@1.0.12': {}
@@ -9428,6 +10424,10 @@ snapshots:
     dependencies:
       '@types/react': 19.2.18
 
+  '@types/react-syntax-highlighter@15.5.13':
+    dependencies:
+      '@types/react': 18.3.31
+
   '@types/react-table@7.7.20':
     dependencies:
       '@types/react': 18.3.31
@@ -9451,10 +10451,16 @@ snapshots:
 
   '@types/resolve@1.20.2': {}
 
+  '@types/set-cookie-parser@2.4.10':
+    dependencies:
+      '@types/node': 20.19.43
+
   '@types/sizzle@2.3.10': {}
 
   '@types/stack-utils@2.0.3': {}
 
+  '@types/statuses@2.0.6': {}
+
   '@types/string-hash@1.1.3': {}
 
   '@types/systemjs@6.15.3': {}
@@ -9484,7 +10490,7 @@ snapshots:
     dependencies:
       '@typescript-eslint/tsconfig-utils': 8.65.0(typescript@5.5.4)
       '@typescript-eslint/types': 8.65.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       typescript: 5.5.4
     transitivePeerDependencies:
       - supports-color
@@ -9506,7 +10512,7 @@ snapshots:
       '@typescript-eslint/tsconfig-utils': 8.65.0(typescript@5.5.4)
       '@typescript-eslint/types': 8.65.0
       '@typescript-eslint/visitor-keys': 8.65.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       minimatch: 10.2.6
       semver: 7.8.5
       tinyglobby: 0.2.17
@@ -9533,15 +10539,15 @@ snapshots:
 
   '@ungap/structured-clone@1.3.3': {}
 
-  '@vitejs/plugin-basic-ssl@2.3.0(vite@8.2.0(@types/node@20.19.43)(terser@5.49.0)(yaml@2.9.0))':
+  '@vitejs/plugin-basic-ssl@2.3.0(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0))':
     dependencies:
-      vite: 8.2.0(@types/node@20.19.43)(sass@1.63.2)(terser@5.49.0)(yaml@2.9.0)
+      vite: 8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(sass@1.63.2)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0)
 
-  '@vitejs/plugin-react-swc@4.3.3(@swc/helpers@0.5.23)(vite@8.2.0(@types/node@20.19.43)(terser@5.49.0)(yaml@2.9.0))':
+  '@vitejs/plugin-react-swc@4.3.3(@swc/helpers@0.5.23)(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0))':
     dependencies:
       '@rolldown/pluginutils': 1.0.1
       '@swc/core': 1.15.47(@swc/helpers@0.5.23)
-      vite: 8.2.0(@types/node@20.19.43)(sass@1.63.2)(terser@5.49.0)(yaml@2.9.0)
+      vite: 8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(sass@1.63.2)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0)
     transitivePeerDependencies:
       - '@swc/helpers'
 
@@ -9554,13 +10560,24 @@ snapshots:
       chai: 6.2.2
       tinyrainbow: 3.1.1
 
-  '@vitest/mocker@4.1.10(vite@8.2.0(@types/node@20.19.43)(sass@1.63.2)(terser@5.49.0)(yaml@2.9.0))':
+  '@vitest/mocker@4.1.10(msw@2.15.0(@types/node@20.19.43)(typescript@5.5.4))(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(sass@1.63.2)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0))':
     dependencies:
       '@vitest/spy': 4.1.10
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
-      vite: 8.2.0(@types/node@20.19.43)(sass@1.63.2)(terser@5.49.0)(yaml@2.9.0)
+      msw: 2.15.0(@types/node@20.19.43)(typescript@5.5.4)
+      vite: 8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(sass@1.63.2)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0)
+    optional: true
+
+  '@vitest/mocker@4.1.10(msw@2.15.0(@types/node@20.19.43)(typescript@6.0.3))(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0))':
+    dependencies:
+      '@vitest/spy': 4.1.10
+      estree-walker: 3.0.3
+      magic-string: 0.30.21
+    optionalDependencies:
+      msw: 2.15.0(@types/node@20.19.43)(typescript@6.0.3)
+      vite: 8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(sass@1.63.2)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0)
 
   '@vitest/pretty-format@4.1.10':
     dependencies:
@@ -9664,17 +10681,17 @@ snapshots:
 
   '@webpack-cli/configtest@2.1.1(webpack-cli@5.1.4)(webpack@5.109.2)':
     dependencies:
-      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack-cli@5.1.4)
+      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack-cli@5.1.4)
       webpack-cli: 5.1.4(webpack@5.109.2)
 
   '@webpack-cli/info@2.0.2(webpack-cli@5.1.4)(webpack@5.109.2)':
     dependencies:
-      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack-cli@5.1.4)
+      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack-cli@5.1.4)
       webpack-cli: 5.1.4(webpack@5.109.2)
 
   '@webpack-cli/serve@2.0.5(webpack-cli@5.1.4)(webpack@5.109.2)':
     dependencies:
-      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack-cli@5.1.4)
+      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack-cli@5.1.4)
       webpack-cli: 5.1.4(webpack@5.109.2)
 
   '@wojtekmaj/date-utils@2.0.2': {}
@@ -9706,10 +10723,12 @@ snapshots:
 
   agent-base@6.0.2:
     dependencies:
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
     transitivePeerDependencies:
       - supports-color
 
+  agent-base@7.1.4: {}
+
   ajv-formats@2.1.1(ajv@8.20.0):
     optionalDependencies:
       ajv: 8.20.0
@@ -9737,6 +10756,8 @@ snapshots:
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
 
+  ansi-colors@4.1.3: {}
+
   ansi-escapes@4.3.2:
     dependencies:
       type-fest: 0.21.3
@@ -9981,6 +11002,8 @@ snapshots:
       ansi-styles: 4.3.0
       supports-color: 7.2.0
 
+  change-case@5.4.4: {}
+
   char-regex@1.0.2: {}
 
   character-entities-html4@2.1.0: {}
@@ -10011,6 +11034,8 @@ snapshots:
 
   classnames@2.5.1: {}
 
+  cli-width@4.1.0: {}
+
   client-only@0.0.1: {}
 
   cliui@8.0.1:
@@ -10041,6 +11066,8 @@ snapshots:
 
   colord@2.9.3: {}
 
+  colorette@1.4.0: {}
+
   colorette@2.0.20: {}
 
   combined-stream@1.0.8:
@@ -10085,7 +11112,7 @@ snapshots:
       normalize-path: 3.0.0
       schema-utils: 4.3.3
       serialize-javascript: 7.0.7
-      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack-cli@5.1.4)
+      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack-cli@5.1.4)
 
   cosmiconfig@7.1.0:
     dependencies:
@@ -10121,6 +11148,8 @@ snapshots:
 
   create-require@1.1.1: {}
 
+  cronstrue@3.24.0: {}
+
   cross-spawn@7.0.6:
     dependencies:
       path-key: 3.1.1
@@ -10150,7 +11179,7 @@ snapshots:
       postcss-value-parser: 4.2.0
       semver: 7.8.5
     optionalDependencies:
-      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack-cli@5.1.4)
+      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack-cli@5.1.4)
 
   css-select@4.3.0:
     dependencies:
@@ -10407,9 +11436,11 @@ snapshots:
     dependencies:
       ms: 2.1.3
 
-  debug@4.4.3:
+  debug@4.4.3(supports-color@10.2.2):
     dependencies:
       ms: 2.1.3
+    optionalDependencies:
+      supports-color: 10.2.2
 
   decimal.js@10.6.0: {}
 
@@ -10484,6 +11515,8 @@ snapshots:
 
   direction@0.1.5: {}
 
+  discontinuous-range@1.0.0: {}
+
   dom-accessibility-api@0.5.16: {}
 
   dom-accessibility-api@0.6.3: {}
@@ -10613,6 +11646,35 @@ snapshots:
       has-tostringtag: 1.0.2
       hasown: 2.0.4
 
+  esbuild@0.25.12:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.25.12
+      '@esbuild/android-arm': 0.25.12
+      '@esbuild/android-arm64': 0.25.12
+      '@esbuild/android-x64': 0.25.12
+      '@esbuild/darwin-arm64': 0.25.12
+      '@esbuild/darwin-x64': 0.25.12
+      '@esbuild/freebsd-arm64': 0.25.12
+      '@esbuild/freebsd-x64': 0.25.12
+      '@esbuild/linux-arm': 0.25.12
+      '@esbuild/linux-arm64': 0.25.12
+      '@esbuild/linux-ia32': 0.25.12
+      '@esbuild/linux-loong64': 0.25.12
+      '@esbuild/linux-mips64el': 0.25.12
+      '@esbuild/linux-ppc64': 0.25.12
+      '@esbuild/linux-riscv64': 0.25.12
+      '@esbuild/linux-s390x': 0.25.12
+      '@esbuild/linux-x64': 0.25.12
+      '@esbuild/netbsd-arm64': 0.25.12
+      '@esbuild/netbsd-x64': 0.25.12
+      '@esbuild/openbsd-arm64': 0.25.12
+      '@esbuild/openbsd-x64': 0.25.12
+      '@esbuild/openharmony-arm64': 0.25.12
+      '@esbuild/sunos-x64': 0.25.12
+      '@esbuild/win32-arm64': 0.25.12
+      '@esbuild/win32-ia32': 0.25.12
+      '@esbuild/win32-x64': 0.25.12
+
   escalade@3.2.0: {}
 
   escape-string-regexp@2.0.0: {}
@@ -10659,7 +11721,7 @@ snapshots:
       '@types/estree': 1.0.9
       ajv: 6.15.0
       cross-spawn: 7.0.6
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       escape-string-regexp: 4.0.0
       eslint-scope: 9.1.2
       eslint-visitor-keys: 5.0.1
@@ -10764,8 +11826,18 @@ snapshots:
 
   fast-shallow-equal@1.0.0: {}
 
+  fast-string-truncated-width@3.0.3: {}
+
+  fast-string-width@3.0.2:
+    dependencies:
+      fast-string-truncated-width: 3.0.3
+
   fast-uri@3.1.5: {}
 
+  fast-wrap-ansi@0.2.2:
+    dependencies:
+      fast-string-width: 3.0.2
+
   fast_array_intersect@1.1.0: {}
 
   fastest-levenshtein@1.0.16: {}
@@ -10776,6 +11848,10 @@ snapshots:
     dependencies:
       reusify: 1.1.0
 
+  fault@1.0.4:
+    dependencies:
+      format: 0.2.2
+
   faye-websocket@0.10.0:
     dependencies:
       websocket-driver: 0.7.5
@@ -10847,7 +11923,7 @@ snapshots:
       semver: 7.8.5
       tapable: 2.3.3
       typescript: 5.5.4
-      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack-cli@5.1.4)
+      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack-cli@5.1.4)
 
   form-data@4.0.6:
     dependencies:
@@ -10857,6 +11933,8 @@ snapshots:
       hasown: 2.0.4
       mime-types: 2.1.35
 
+  format@0.2.2: {}
+
   fs-extra@10.1.0:
     dependencies:
       graceful-fs: 4.2.11
@@ -10980,6 +12058,8 @@ snapshots:
 
   graceful-fs@4.2.11: {}
 
+  graphql@16.14.2: {}
+
   handlebars@4.7.9:
     dependencies:
       minimist: 1.2.8
@@ -11087,10 +12167,21 @@ snapshots:
       capital-case: 1.0.4
       tslib: 2.8.1
 
+  headers-polyfill@5.0.1:
+    dependencies:
+      '@types/set-cookie-parser': 2.4.10
+      set-cookie-parser: 3.1.2
+
   highlight-words-core@1.2.3: {}
 
+  highlight-words@1.2.2: {}
+
   highlight-words@2.0.0: {}
 
+  highlight.js@10.7.3: {}
+
+  highlightjs-vue@1.0.0: {}
+
   history@4.10.1:
     dependencies:
       '@babel/runtime': 7.29.7
@@ -11108,6 +12199,8 @@ snapshots:
     dependencies:
       react-is: 16.13.1
 
+  hotkeys-js@4.0.4: {}
+
   html-encoding-sniffer@3.0.0:
     dependencies:
       whatwg-encoding: 2.0.0
@@ -11134,14 +12227,21 @@ snapshots:
     dependencies:
       '@tootallnate/once': 2.0.1
       agent-base: 6.0.2
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
     transitivePeerDependencies:
       - supports-color
 
   https-proxy-agent@5.0.1:
     dependencies:
       agent-base: 6.0.2
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
+    transitivePeerDependencies:
+      - supports-color
+
+  https-proxy-agent@7.0.6(supports-color@10.2.2):
+    dependencies:
+      agent-base: 7.1.4
+      debug: 4.4.3(supports-color@10.2.2)
     transitivePeerDependencies:
       - supports-color
 
@@ -11207,12 +12307,14 @@ snapshots:
     dependencies:
       source-map-js: 1.2.1
       strip-comments: 2.0.1
-      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack-cli@5.1.4)
+      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack-cli@5.1.4)
 
   imurmurhash@0.1.4: {}
 
   indent-string@4.0.0: {}
 
+  index-to-position@1.2.0: {}
+
   inflight@1.0.6:
     dependencies:
       once: 1.4.0
@@ -11317,6 +12419,8 @@ snapshots:
 
   is-module@1.0.0: {}
 
+  is-node-process@1.2.0: {}
+
   is-number-object@1.1.1:
     dependencies:
       call-bound: 1.0.4
@@ -11411,7 +12515,7 @@ snapshots:
 
   istanbul-lib-source-maps@4.0.1:
     dependencies:
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       istanbul-lib-coverage: 3.2.2
       source-map: 0.6.1
     transitivePeerDependencies:
@@ -11764,6 +12868,8 @@ snapshots:
 
   js-cookie@2.2.1: {}
 
+  js-levenshtein@1.1.6: {}
+
   js-tokens@4.0.0: {}
 
   js-yaml@3.15.1:
@@ -11771,6 +12877,10 @@ snapshots:
       argparse: 1.0.10
       esprima: 4.0.1
 
+  js-yaml@4.3.0:
+    dependencies:
+      argparse: 2.0.1
+
   js-yaml@4.3.1:
     dependencies:
       argparse: 2.0.1
@@ -11960,6 +13070,11 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
+  lowlight@1.20.0:
+    dependencies:
+      fault: 1.0.4
+      highlight.js: 10.7.3
+
   lru-cache@10.4.3: {}
 
   lru-cache@11.5.2: {}
@@ -11992,6 +13107,19 @@ snapshots:
 
   marked@16.3.0: {}
 
+  material-react-table@1.15.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@mui/icons-material@7.3.7(@mui/material@7.3.7(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@mui/material@7.3.7(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react-dom@19.2.8(react@19.2.8))(react@19.2.8):
+    dependencies:
+      '@emotion/react': 11.14.0(@types/react@19.2.18)(react@19.2.8)
+      '@emotion/styled': 11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8)
+      '@mui/icons-material': 7.3.7(@mui/material@7.3.7(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(@types/react@19.2.18)(react@19.2.8)
+      '@mui/material': 7.3.7(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@tanstack/match-sorter-utils': 8.8.4
+      '@tanstack/react-table': 8.10.7(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@tanstack/react-virtual': 3.0.0-beta.65(react@19.2.8)
+      highlight-words: 1.2.2
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+
   material-react-table@3.2.1(ffd7a467fdfa2c805c677d05446fb4c4):
     dependencies:
       '@emotion/react': 11.14.0(@types/react@19.2.18)(react@19.2.8)
@@ -12357,7 +13485,7 @@ snapshots:
   micromark@4.0.2:
     dependencies:
       '@types/debug': 4.1.13
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       decode-named-character-reference: 1.3.0
       devlop: 1.1.0
       micromark-core-commonmark: 2.0.3
@@ -12413,19 +13541,22 @@ snapshots:
 
   minimist@1.2.8: {}
 
-  minimizer-webpack-plugin@5.6.1(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack@5.109.2):
+  minimizer-webpack-plugin@5.6.1(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack@5.109.2):
     dependencies:
       '@jridgewell/trace-mapping': 0.3.31
       jest-worker: 27.5.1
       schema-utils: 4.3.3
       terser: 5.49.0
-      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack-cli@5.1.4)
+      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack-cli@5.1.4)
     optionalDependencies:
       '@swc/core': 1.15.47(@swc/helpers@0.5.23)
+      esbuild: 0.25.12
       postcss: 8.5.25
 
   minipass@7.1.3: {}
 
+  mitt@3.0.1: {}
+
   moment-timezone@0.5.47:
     dependencies:
       moment: 2.30.1
@@ -12434,8 +13565,63 @@ snapshots:
 
   monaco-editor@0.34.1: {}
 
+  moo@0.5.3: {}
+
   ms@2.1.3: {}
 
+  msw@2.15.0(@types/node@20.19.43)(typescript@5.5.4):
+    dependencies:
+      '@inquirer/confirm': 6.1.1(@types/node@20.19.43)
+      '@mswjs/interceptors': 0.41.9
+      '@open-draft/deferred-promise': 3.0.0
+      '@types/statuses': 2.0.6
+      cookie: 1.1.1
+      graphql: 16.14.2
+      headers-polyfill: 5.0.1
+      is-node-process: 1.2.0
+      outvariant: 1.4.3
+      path-to-regexp: 6.3.0
+      picocolors: 1.1.1
+      rettime: 0.11.11
+      statuses: 2.0.2
+      strict-event-emitter: 0.5.1
+      tough-cookie: 6.0.2
+      type-fest: 5.8.0
+      until-async: 3.0.2
+      yargs: 17.7.3
+    optionalDependencies:
+      typescript: 5.5.4
+    transitivePeerDependencies:
+      - '@types/node'
+    optional: true
+
+  msw@2.15.0(@types/node@20.19.43)(typescript@6.0.3):
+    dependencies:
+      '@inquirer/confirm': 6.1.1(@types/node@20.19.43)
+      '@mswjs/interceptors': 0.41.9
+      '@open-draft/deferred-promise': 3.0.0
+      '@types/statuses': 2.0.6
+      cookie: 1.1.1
+      graphql: 16.14.2
+      headers-polyfill: 5.0.1
+      is-node-process: 1.2.0
+      outvariant: 1.4.3
+      path-to-regexp: 6.3.0
+      picocolors: 1.1.1
+      rettime: 0.11.11
+      statuses: 2.0.2
+      strict-event-emitter: 0.5.1
+      tough-cookie: 6.0.2
+      type-fest: 5.8.0
+      until-async: 3.0.2
+      yargs: 17.7.3
+    optionalDependencies:
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - '@types/node'
+
+  mute-stream@3.0.0: {}
+
   nano-css@5.6.2(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
     dependencies:
       '@jridgewell/sourcemap-codec': 1.5.5
@@ -12453,6 +13639,13 @@ snapshots:
 
   natural-compare@1.4.0: {}
 
+  nearley@2.20.1:
+    dependencies:
+      commander: 2.20.3
+      moo: 0.5.3
+      railroad-diagrams: 1.0.0
+      randexp: 0.4.6
+
   neo-async@2.6.2: {}
 
   no-case@3.0.4:
@@ -12526,6 +13719,22 @@ snapshots:
     dependencies:
       mimic-fn: 2.1.0
 
+  openapi-fetch@0.17.0:
+    dependencies:
+      openapi-typescript-helpers: 0.1.0
+
+  openapi-typescript-helpers@0.1.0: {}
+
+  openapi-typescript@7.13.0(typescript@6.0.3):
+    dependencies:
+      '@redocly/openapi-core': 1.34.18(supports-color@10.2.2)
+      ansi-colors: 4.1.3
+      change-case: 5.4.4
+      parse-json: 8.3.0
+      supports-color: 10.2.2
+      typescript: 6.0.3
+      yargs-parser: 21.1.1
+
   optionator@0.9.4:
     dependencies:
       deep-is: 0.1.4
@@ -12535,6 +13744,8 @@ snapshots:
       type-check: 0.4.0
       word-wrap: 1.2.5
 
+  outvariant@1.4.3: {}
+
   oxfmt@0.49.0:
     dependencies:
       tinypool: 2.1.0
@@ -12639,6 +13850,12 @@ snapshots:
       json-parse-even-better-errors: 2.3.1
       lines-and-columns: 1.2.4
 
+  parse-json@8.3.0:
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      index-to-position: 1.2.0
+      type-fest: 4.41.0
+
   parse5@7.3.0:
     dependencies:
       entities: 6.0.1
@@ -12669,6 +13886,8 @@ snapshots:
     dependencies:
       isarray: 0.0.1
 
+  path-to-regexp@6.3.0: {}
+
   path-type@4.0.0: {}
 
   pathe@2.0.3: {}
@@ -12699,10 +13918,12 @@ snapshots:
     optionalDependencies:
       fsevents: 2.3.2
 
+  pluralize@8.0.0: {}
+
   portfinder@1.0.38:
     dependencies:
       async: 3.2.6
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
     transitivePeerDependencies:
       - supports-color
 
@@ -12999,6 +14220,13 @@ snapshots:
     dependencies:
       performance-now: 2.1.0
 
+  railroad-diagrams@1.0.0: {}
+
+  randexp@0.4.6:
+    dependencies:
+      discontinuous-range: 1.0.0
+      ret: 0.1.15
+
   raw-body@1.1.7:
     dependencies:
       bytes: 1.0.0
@@ -13272,6 +14500,18 @@ snapshots:
       react: 18.3.1
       use-sync-external-store: 1.6.0(react@18.3.1)
 
+  react-string-replace@2.0.1: {}
+
+  react-syntax-highlighter@16.1.1(react@19.2.8):
+    dependencies:
+      '@babel/runtime': 7.29.7
+      highlight.js: 10.7.3
+      highlightjs-vue: 1.0.0
+      lowlight: 1.20.0
+      prismjs: 1.30.0
+      react: 19.2.8
+      refractor: 5.0.0
+
   react-table@7.8.0(react@18.3.1):
     dependencies:
       react: 18.3.1
@@ -13346,6 +14586,13 @@ snapshots:
 
   redux@5.0.1: {}
 
+  refractor@5.0.0:
+    dependencies:
+      '@types/hast': 3.0.5
+      '@types/prismjs': 1.26.6
+      hastscript: 9.0.1
+      parse-entities: 4.0.2
+
   regexp.prototype.flags@1.5.4:
     dependencies:
       call-bind: 1.0.9
@@ -13395,6 +14642,8 @@ snapshots:
       mdast-util-to-markdown: 2.1.2
       unified: 11.0.5
 
+  remove-accents@0.4.2: {}
+
   remove-accents@0.5.0: {}
 
   replace-in-file-webpack-plugin@1.0.6: {}
@@ -13430,6 +14679,10 @@ snapshots:
       path-parse: 1.0.7
       supports-preserve-symlinks-flag: 1.0.0
 
+  ret@0.1.15: {}
+
+  rettime@0.11.11: {}
+
   reusify@1.1.0: {}
 
   robust-predicates@3.0.3: {}
@@ -13561,7 +14814,7 @@ snapshots:
     dependencies:
       klona: 2.0.6
       neo-async: 2.6.2
-      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack-cli@5.1.4)
+      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack-cli@5.1.4)
     optionalDependencies:
       sass: 1.63.2
 
@@ -13608,6 +14861,8 @@ snapshots:
 
   set-cookie-parser@2.7.2: {}
 
+  set-cookie-parser@3.1.2: {}
+
   set-function-length@1.2.2:
     dependencies:
       define-data-property: 1.1.4
@@ -13774,6 +15029,11 @@ snapshots:
 
   sprintf-js@1.0.3: {}
 
+  sql-formatter@15.8.2:
+    dependencies:
+      argparse: 2.0.1
+      nearley: 2.20.1
+
   stable@0.1.8: {}
 
   stack-generator@2.0.10:
@@ -13801,6 +15061,8 @@ snapshots:
 
   state-local@1.0.7: {}
 
+  statuses@2.0.2: {}
+
   std-env@4.2.0: {}
 
   stop-iteration-iterator@1.1.0:
@@ -13808,6 +15070,8 @@ snapshots:
       es-errors: 1.3.0
       internal-slot: 1.1.0
 
+  strict-event-emitter@0.5.1: {}
+
   string-hash@1.1.3: {}
 
   string-length@4.0.2:
@@ -13860,7 +15124,7 @@ snapshots:
 
   style-loader@3.3.3(webpack@5.109.2):
     dependencies:
-      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack-cli@5.1.4)
+      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack-cli@5.1.4)
 
   style-to-js@1.1.21:
     dependencies:
@@ -13880,6 +15144,8 @@ snapshots:
 
   stylis@4.4.0: {}
 
+  supports-color@10.2.2: {}
+
   supports-color@7.2.0:
     dependencies:
       has-flag: 4.0.0
@@ -13906,23 +15172,26 @@ snapshots:
     dependencies:
       '@swc/core': 1.15.47(@swc/helpers@0.5.23)
       '@swc/counter': 0.1.3
-      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack-cli@5.1.4)
+      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack-cli@5.1.4)
 
   symbol-tree@3.2.4: {}
 
   tabbable@6.5.0: {}
 
+  tagged-tag@1.0.0: {}
+
   tapable@2.3.3: {}
 
-  terser-webpack-plugin@5.6.1(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack@5.109.2):
+  terser-webpack-plugin@5.6.1(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack@5.109.2):
     dependencies:
       '@jridgewell/trace-mapping': 0.3.31
       jest-worker: 27.5.1
       schema-utils: 4.3.3
       terser: 5.49.0
-      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack-cli@5.1.4)
+      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack-cli@5.1.4)
     optionalDependencies:
       '@swc/core': 1.15.47(@swc/helpers@0.5.23)
+      esbuild: 0.25.12
       postcss: 8.5.25
 
   terser@5.49.0:
@@ -14071,6 +15340,12 @@ snapshots:
 
   tslib@2.8.1: {}
 
+  tsx@4.23.4:
+    dependencies:
+      esbuild: 0.25.12
+    optionalDependencies:
+      fsevents: 2.3.3
+
   turbo@2.10.8:
     optionalDependencies:
       '@turbo/darwin-64': 2.10.8
@@ -14090,6 +15365,10 @@ snapshots:
 
   type-fest@4.41.0: {}
 
+  type-fest@5.8.0:
+    dependencies:
+      tagged-tag: 1.0.0
+
   type-of@2.0.1: {}
 
   typed-assert@1.0.9: {}
@@ -14146,6 +15425,8 @@ snapshots:
 
   universalify@2.0.1: {}
 
+  until-async@3.0.2: {}
+
   update-browserslist-db@1.2.3(browserslist@4.28.7):
     dependencies:
       browserslist: 4.28.7
@@ -14158,6 +15439,8 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
+  uri-js-replace@1.0.1: {}
+
   uri-js@4.4.1:
     dependencies:
       punycode: 2.3.1
@@ -14210,28 +15493,33 @@ snapshots:
       '@types/unist': 3.0.3
       vfile-message: 4.0.3
 
-  vite-plugin-svgr@5.2.0(rollup@4.62.4)(typescript@6.0.3)(vite@8.2.0(@types/node@20.19.43)(terser@5.49.0)(yaml@2.9.0)):
+  virtua@0.49.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8):
+    optionalDependencies:
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+
+  vite-plugin-svgr@5.2.0(rollup@4.62.4)(typescript@6.0.3)(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0)):
     dependencies:
       '@rollup/pluginutils': 5.4.0(rollup@4.62.4)
       '@svgr/core': 8.1.0(typescript@6.0.3)
       '@svgr/plugin-jsx': 8.1.0(@svgr/core@8.1.0(typescript@6.0.3))
-      vite: 8.2.0(@types/node@20.19.43)(sass@1.63.2)(terser@5.49.0)(yaml@2.9.0)
+      vite: 8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(sass@1.63.2)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0)
     transitivePeerDependencies:
       - rollup
       - supports-color
       - typescript
 
-  vite-tsconfig-paths@6.1.1(typescript@6.0.3)(vite@8.2.0(@types/node@20.19.43)(terser@5.49.0)(yaml@2.9.0)):
+  vite-tsconfig-paths@6.1.1(typescript@6.0.3)(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0)):
     dependencies:
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       globrex: 0.1.2
       tsconfck: 3.1.6(typescript@6.0.3)
-      vite: 8.2.0(@types/node@20.19.43)(sass@1.63.2)(terser@5.49.0)(yaml@2.9.0)
+      vite: 8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(sass@1.63.2)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0)
     transitivePeerDependencies:
       - supports-color
       - typescript
 
-  vite@8.2.0(@types/node@20.19.43)(sass@1.63.2)(terser@5.49.0)(yaml@2.9.0):
+  vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(sass@1.63.2)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0):
     dependencies:
       lightningcss: 1.33.0
       picomatch: 4.0.5
@@ -14240,15 +15528,47 @@ snapshots:
       tinyglobby: 0.2.17
     optionalDependencies:
       '@types/node': 20.19.43
+      esbuild: 0.25.12
       fsevents: 2.3.3
       sass: 1.63.2
       terser: 5.49.0
+      tsx: 4.23.4
       yaml: 2.9.0
 
-  vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@20.19.43)(jsdom@29.1.1)(vite@8.2.0(@types/node@20.19.43)(sass@1.63.2)(terser@5.49.0)(yaml@2.9.0)):
+  vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@20.19.43)(jsdom@29.1.1)(msw@2.15.0(@types/node@20.19.43)(typescript@5.5.4))(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(sass@1.63.2)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0)):
+    dependencies:
+      '@vitest/expect': 4.1.10
+      '@vitest/mocker': 4.1.10(msw@2.15.0(@types/node@20.19.43)(typescript@5.5.4))(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(sass@1.63.2)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0))
+      '@vitest/pretty-format': 4.1.10
+      '@vitest/runner': 4.1.10
+      '@vitest/snapshot': 4.1.10
+      '@vitest/spy': 4.1.10
+      '@vitest/utils': 4.1.10
+      es-module-lexer: 2.3.1
+      expect-type: 1.4.0
+      magic-string: 0.30.21
+      obug: 2.1.4
+      pathe: 2.0.3
+      picomatch: 4.0.5
+      std-env: 4.2.0
+      tinybench: 2.9.0
+      tinyexec: 1.3.0
+      tinyglobby: 0.2.17
+      tinyrainbow: 3.1.1
+      vite: 8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(sass@1.63.2)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0)
+      why-is-node-running: 2.3.0
+    optionalDependencies:
+      '@opentelemetry/api': 1.9.1
+      '@types/node': 20.19.43
+      jsdom: 29.1.1
+    transitivePeerDependencies:
+      - msw
+    optional: true
+
+  vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@20.19.43)(jsdom@29.1.1)(msw@2.15.0(@types/node@20.19.43)(typescript@6.0.3))(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0)):
     dependencies:
       '@vitest/expect': 4.1.10
-      '@vitest/mocker': 4.1.10(vite@8.2.0(@types/node@20.19.43)(sass@1.63.2)(terser@5.49.0)(yaml@2.9.0))
+      '@vitest/mocker': 4.1.10(msw@2.15.0(@types/node@20.19.43)(typescript@6.0.3))(vite@8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0))
       '@vitest/pretty-format': 4.1.10
       '@vitest/runner': 4.1.10
       '@vitest/snapshot': 4.1.10
@@ -14265,7 +15585,7 @@ snapshots:
       tinyexec: 1.3.0
       tinyglobby: 0.2.17
       tinyrainbow: 3.1.1
-      vite: 8.2.0(@types/node@20.19.43)(sass@1.63.2)(terser@5.49.0)(yaml@2.9.0)
+      vite: 8.2.0(@types/node@20.19.43)(esbuild@0.25.12)(sass@1.63.2)(terser@5.49.0)(tsx@4.23.4)(yaml@2.9.0)
       why-is-node-running: 2.3.0
     optionalDependencies:
       '@opentelemetry/api': 1.9.1
@@ -14320,7 +15640,7 @@ snapshots:
       import-local: 3.2.0
       interpret: 3.1.1
       rechoir: 0.8.0
-      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack-cli@5.1.4)
+      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack-cli@5.1.4)
       webpack-merge: 5.10.0
 
   webpack-livereload-plugin@3.0.2(webpack@5.109.2):
@@ -14329,7 +15649,7 @@ snapshots:
       portfinder: 1.0.38
       schema-utils: 4.3.3
       tiny-lr: 1.1.1
-      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack-cli@5.1.4)
+      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack-cli@5.1.4)
     transitivePeerDependencies:
       - supports-color
 
@@ -14350,11 +15670,11 @@ snapshots:
   webpack-subresource-integrity@5.1.0(webpack@5.109.2):
     dependencies:
       typed-assert: 1.0.9
-      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack-cli@5.1.4)
+      webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack-cli@5.1.4)
 
   webpack-virtual-modules@0.6.2: {}
 
-  webpack@5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack-cli@5.1.4):
+  webpack@5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack-cli@5.1.4):
     dependencies:
       '@types/estree': 1.0.9
       '@types/json-schema': 7.0.15
@@ -14370,7 +15690,7 @@ snapshots:
       events: 3.3.0
       graceful-fs: 4.2.11
       mime-db: 1.54.0
-      minimizer-webpack-plugin: 5.6.1(@swc/core@1.15.47(@swc/helpers@0.5.23))(postcss@8.5.25)(webpack@5.109.2)
+      minimizer-webpack-plugin: 5.6.1(@swc/core@1.15.47(@swc/helpers@0.5.23))(esbuild@0.25.12)(postcss@8.5.25)(webpack@5.109.2)
       neo-async: 2.6.2
       schema-utils: 4.3.3
       tapable: 2.3.3
@@ -14499,6 +15819,8 @@ snapshots:
 
   yallist@3.1.1: {}
 
+  yaml-ast-parser@0.0.43: {}
+
   yaml@1.10.3: {}
 
   yaml@2.9.0: {}
diff --git a/ui/pnpm-workspace.yaml b/ui/pnpm-workspace.yaml
index 56863a41bce..211a4e15349 100644
--- a/ui/pnpm-workspace.yaml
+++ b/ui/pnpm-workspace.yaml
@@ -1,6 +1,8 @@
 packages:
   - 'apps/*'
   - 'packages/*'
+  - 'packages/sep/*'
+  - 'packages/plugins/*'
 
 allowBuilds:
   '@swc/core': true
diff --git a/ui/turbo.json b/ui/turbo.json
index 3298412ff82..74791c502a2 100644
--- a/ui/turbo.json
+++ b/ui/turbo.json
@@ -17,7 +17,12 @@
     },
     "dev": {
       "cache": false,
-      "persistent": true
+      "persistent": true,
+      "passThroughEnv": [
+        "PMM_SERVER_URL",
+        "PMM_DEV_SEP_BACKEND_URL",
+        "PMM_DEV_SEP_INTERNAL_TOKEN"
+      ]
     },
     "format": {
       "dependsOn": ["^format"]