diff --git a/.github/actions/setup-sqlite-version/action.yml b/.github/actions/setup-sqlite-version/action.yml
new file mode 100644
index 00000000..fdbc71c9
--- /dev/null
+++ b/.github/actions/setup-sqlite-version/action.yml
@@ -0,0 +1,39 @@
+name: "Setup SQLite version"
+description: "Build and activate a specific SQLite version from its amalgamation archive"
+inputs:
+  version:
+    description: "The SQLite version to install"
+    required: true
+  cflags:
+    description: "CFLAGS to use when compiling SQLite"
+    required: false
+    default: ""
+  skip-activate:
+    description: "Set to true to skip modifying the library path"
+    required: false
+    default: "false"
+  fallback-urls:
+    description: "Whitespace-separated fallback download URLs to try after sqlite.org"
+    required: false
+    default: ""
+outputs:
+  sqlite-location:
+    description: "Directory containing the compiled SQLite library"
+    value: ${{ steps.build.outputs.sqlite-location }}
+runs:
+  using: "composite"
+  steps:
+    - shell: bash
+      run: mkdir -p "$RUNNER_TEMP/sqlite-versions/downloads"
+    - uses: actions/cache@v6
+      with:
+        path: ${{ runner.temp }}/sqlite-versions/downloads
+        key: setup-sqlite-version-${{ inputs.version }}-amalgamation-v1
+    - id: build
+      shell: bash
+      run: bash "$GITHUB_ACTION_PATH/setup-sqlite-version.sh"
+      env:
+        SQLITE_VERSION: ${{ inputs.version }}
+        SQLITE_CFLAGS: ${{ inputs.cflags }}
+        SQLITE_SKIP_ACTIVATE: ${{ inputs.skip-activate }}
+        SQLITE_EXTRA_FALLBACK_URLS: ${{ inputs.fallback-urls }}
diff --git a/.github/actions/setup-sqlite-version/setup-sqlite-version.sh b/.github/actions/setup-sqlite-version/setup-sqlite-version.sh
new file mode 100644
index 00000000..03d6a68f
--- /dev/null
+++ b/.github/actions/setup-sqlite-version/setup-sqlite-version.sh
@@ -0,0 +1,144 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+version_spec="${SQLITE_VERSION:?SQLITE_VERSION is required}"
+cflags="${SQLITE_CFLAGS:-}"
+skip_activate="${SQLITE_SKIP_ACTIVATE:-false}"
+extra_fallback_urls="${SQLITE_EXTRA_FALLBACK_URLS:-}"
+
+case "$version_spec" in
+  3.46 | 3.46.0)
+    sqlite_version="3.46.0"
+    sqlite_year="2024"
+    amalgamation_id="3460000"
+    builtin_fallback_urls="https://static.simonwillison.net/static/2026/sqlite-amalgamation-3460000.zip"
+    ;;
+  3.25 | 3.25.0)
+    sqlite_version="3.25.0"
+    sqlite_year="2018"
+    amalgamation_id="3250000"
+    builtin_fallback_urls="https://static.simonwillison.net/static/2026/sqlite-amalgamation-3250000.zip?v=1"
+    ;;
+  *)
+    echo "::error::Unsupported SQLite version '$version_spec'. Add its release year and amalgamation id to $GITHUB_ACTION_PATH/setup-sqlite-version.sh."
+    exit 1
+    ;;
+esac
+
+case "$(uname -s)" in
+  Linux)
+    library_name="libsqlite3.so.0"
+    library_path_var="LD_LIBRARY_PATH"
+    ;;
+  Darwin)
+    library_name="libsqlite3.dylib"
+    library_path_var="DYLD_LIBRARY_PATH"
+    ;;
+  *)
+    echo "::error::Unsupported platform $(uname -s)"
+    exit 1
+    ;;
+esac
+
+runner_temp="${RUNNER_TEMP:-}"
+if [ -z "$runner_temp" ]; then
+  runner_temp="$(mktemp -d)"
+fi
+
+filename="sqlite-amalgamation-${amalgamation_id}"
+official_url="https://www.sqlite.org/${sqlite_year}/${filename}.zip"
+download_dir="${runner_temp}/sqlite-versions/downloads"
+source_root="${runner_temp}/sqlite-versions/source"
+source_dir="${source_root}/${filename}"
+build_dir="${runner_temp}/sqlite-versions/build/${sqlite_version}"
+archive_path="${download_dir}/${filename}.zip"
+
+mkdir -p "$download_dir" "$source_root" "$build_dir"
+
+download_archive() {
+  local url
+  local candidate_path="${archive_path}.tmp"
+  local urls=("$official_url")
+
+  for url in $builtin_fallback_urls $extra_fallback_urls; do
+    urls+=("$url")
+  done
+
+  rm -f "$candidate_path"
+  for url in "${urls[@]}"; do
+    echo "Downloading SQLite ${sqlite_version} amalgamation from ${url}"
+    if curl \
+      --fail \
+      --location \
+      --show-error \
+      --retry 5 \
+      --retry-delay 2 \
+      --retry-max-time 180 \
+      --retry-all-errors \
+      --connect-timeout 20 \
+      --max-time 240 \
+      --output "$candidate_path" \
+      "$url"; then
+      mv "$candidate_path" "$archive_path"
+      return 0
+    fi
+
+    echo "::warning::Download failed from ${url}"
+    rm -f "$candidate_path"
+  done
+
+  echo "::error::Could not download SQLite ${sqlite_version} amalgamation"
+  return 1
+}
+
+if [ ! -f "${source_dir}/sqlite3.c" ]; then
+  if [ ! -f "$archive_path" ]; then
+    download_archive
+  fi
+
+  rm -rf "$source_dir"
+  unzip -q "$archive_path" -d "$source_root"
+fi
+
+if [ ! -f "${source_dir}/sqlite3.c" ]; then
+  echo "::error::Expected ${source_dir}/sqlite3.c after extracting ${archive_path}"
+  exit 1
+fi
+
+read -r -a cflag_args <<< "$cflags"
+
+echo "Compiling SQLite ${sqlite_version} to ${build_dir}/${library_name}"
+gcc \
+  -fPIC \
+  -shared \
+  "${cflag_args[@]}" \
+  "${source_dir}/sqlite3.c" \
+  "-I${source_dir}" \
+  -o "${build_dir}/${library_name}"
+
+if [ "$library_name" = "libsqlite3.so.0" ]; then
+  ln -sf "$library_name" "${build_dir}/libsqlite3.so"
+fi
+
+if [ -n "${GITHUB_OUTPUT:-}" ]; then
+  echo "sqlite-location=${build_dir}" >> "$GITHUB_OUTPUT"
+else
+  echo "sqlite-location=${build_dir}"
+fi
+
+case "$(printf '%s' "$skip_activate" | tr '[:upper:]' '[:lower:]')" in
+  true | 1 | yes)
+    echo "Skipping ${library_path_var} activation"
+    ;;
+  *)
+    existing_value="${!library_path_var:-}"
+    if [ -n "${GITHUB_ENV:-}" ]; then
+      if [ -n "$existing_value" ]; then
+        echo "${library_path_var}=${build_dir}:${existing_value}" >> "$GITHUB_ENV"
+      else
+        echo "${library_path_var}=${build_dir}" >> "$GITHUB_ENV"
+      fi
+    fi
+    echo "Added ${build_dir} to ${library_path_var}"
+    ;;
+esac
diff --git a/.github/workflows/deploy-latest.yml b/.github/workflows/deploy-latest.yml
index b0640ae8..3fc83438 100644
--- a/.github/workflows/deploy-latest.yml
+++ b/.github/workflows/deploy-latest.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out datasette
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
     - name: Set up Python
       uses: actions/setup-python@v6
       with:
diff --git a/.github/workflows/documentation-links.yml b/.github/workflows/documentation-links.yml
deleted file mode 100644
index b8fb8aaa..00000000
--- a/.github/workflows/documentation-links.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-name: Read the Docs Pull Request Preview
-on:
-  pull_request:
-    types:
-      - opened
-
-permissions:
-  pull-requests: write
-
-jobs:
-  documentation-links:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: readthedocs/actions/preview@v1
-        with:
-          project-slug: "datasette"
diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml
index 5275ddef..f5b8dbf6 100644
--- a/.github/workflows/playwright.yml
+++ b/.github/workflows/playwright.yml
@@ -16,7 +16,7 @@ jobs:
       matrix:
         browser: [chromium, firefox, webkit]
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - name: Set up Python 3.14
       uses: actions/setup-python@v6
       with:
@@ -25,14 +25,14 @@ jobs:
         cache: pip
         cache-dependency-path: pyproject.toml
     - name: Cache uv
-      uses: actions/cache@v5
+      uses: actions/cache@v6
       with:
         path: ~/.cache/uv
         key: ${{ runner.os }}-py3.14-uv-${{ hashFiles('pyproject.toml') }}
         restore-keys: |
           ${{ runner.os }}-py3.14-uv-
     - name: Cache Playwright browsers
-      uses: actions/cache@v5
+      uses: actions/cache@v6
       with:
         path: ~/.cache/ms-playwright/
         key: ${{ runner.os }}-playwright-${{ matrix.browser }}-${{ hashFiles('pyproject.toml') }}
diff --git a/.github/workflows/prettier.yml b/.github/workflows/prettier.yml
index 735e14e9..d92ab82b 100644
--- a/.github/workflows/prettier.yml
+++ b/.github/workflows/prettier.yml
@@ -10,8 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out repo
-      uses: actions/checkout@v6
-    - uses: actions/cache@v5
+      uses: actions/checkout@v7
+    - uses: actions/cache@v6
       name: Configure npm caching
       with:
         path: ~/.npm
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 87300593..21ed4c12 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -14,7 +14,7 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v6
       with:
@@ -35,7 +35,7 @@ jobs:
     permissions:
       id-token: write
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - name: Set up Python
       uses: actions/setup-python@v6
       with:
@@ -56,7 +56,7 @@ jobs:
     needs: [deploy]
     if: "!github.event.release.prerelease"
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - name: Set up Python
       uses: actions/setup-python@v6
       with:
@@ -92,7 +92,7 @@ jobs:
     needs: [deploy]
     if: "!github.event.release.prerelease"
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - name: Build and push to Docker Hub
       env:
         DOCKER_USER: ${{ secrets.DOCKER_USER }}
diff --git a/.github/workflows/push_docker_tag.yml b/.github/workflows/push_docker_tag.yml
index e622ef4c..c5a4f0db 100644
--- a/.github/workflows/push_docker_tag.yml
+++ b/.github/workflows/push_docker_tag.yml
@@ -13,7 +13,7 @@ jobs:
   deploy_docker:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - name: Build and push to Docker Hub
       env:
         DOCKER_USER: ${{ secrets.DOCKER_USER }}
diff --git a/.github/workflows/spellcheck.yml b/.github/workflows/spellcheck.yml
index 9a808194..58635025 100644
--- a/.github/workflows/spellcheck.yml
+++ b/.github/workflows/spellcheck.yml
@@ -9,7 +9,7 @@ jobs:
   spellcheck:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - name: Set up Python
       uses: actions/setup-python@v6
       with:
diff --git a/.github/workflows/stable-docs.yml b/.github/workflows/stable-docs.yml
index 59b5fbc0..ecde5940 100644
--- a/.github/workflows/stable-docs.yml
+++ b/.github/workflows/stable-docs.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         fetch-depth: 0  # We need all commits to find docs/ changes
     - name: Set up Git user
diff --git a/.github/workflows/test-coverage.yml b/.github/workflows/test-coverage.yml
index c514048e..e9bd4bab 100644
--- a/.github/workflows/test-coverage.yml
+++ b/.github/workflows/test-coverage.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out datasette
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
     - name: Set up Python
       uses: actions/setup-python@v6
       with:
diff --git a/.github/workflows/test-pyodide.yml b/.github/workflows/test-pyodide.yml
index 5162c47a..5e81ed82 100644
--- a/.github/workflows/test-pyodide.yml
+++ b/.github/workflows/test-pyodide.yml
@@ -12,7 +12,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - name: Set up Python 3.10
       uses: actions/setup-python@v6
       with:
@@ -20,7 +20,7 @@ jobs:
         cache: 'pip'
         cache-dependency-path: '**/pyproject.toml'
     - name: Cache Playwright browsers
-      uses: actions/cache@v5
+      uses: actions/cache@v6
       with:
         path: ~/.cache/ms-playwright/
         key: ${{ runner.os }}-browsers
diff --git a/.github/workflows/test-sqlite-support.yml b/.github/workflows/test-sqlite-support.yml
index 23fce459..2fdb3a40 100644
--- a/.github/workflows/test-sqlite-support.yml
+++ b/.github/workflows/test-sqlite-support.yml
@@ -25,7 +25,7 @@ jobs:
           #"3.23.1" # 2018-04-10, before UPSERT
         ]
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v6
       with:
@@ -34,7 +34,7 @@ jobs:
         cache: pip
         cache-dependency-path: pyproject.toml
     - name: Set up SQLite ${{ matrix.sqlite-version }}
-      uses: asg017/sqlite-versions@71ea0de37ae739c33e447af91ba71dda8fcf22e6
+      uses: ./.github/actions/setup-sqlite-version
       with:
         version: ${{ matrix.sqlite-version }}
         cflags: "-DSQLITE_ENABLE_DESERIALIZE -DSQLITE_ENABLE_FTS5 -DSQLITE_ENABLE_FTS4 -DSQLITE_ENABLE_FTS3_PARENTHESIS -DSQLITE_ENABLE_RTREE -DSQLITE_ENABLE_JSON1"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a1b2e9d2..751eedfd 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -9,10 +9,11 @@ jobs:
   test:
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v6
       with:
diff --git a/.github/workflows/tmate-mac.yml b/.github/workflows/tmate-mac.yml
index a033cd92..f2c074a6 100644
--- a/.github/workflows/tmate-mac.yml
+++ b/.github/workflows/tmate-mac.yml
@@ -10,6 +10,6 @@ jobs:
   build:
     runs-on: macos-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - name: Setup tmate session
       uses: mxschmitt/action-tmate@v3
diff --git a/.github/workflows/tmate.yml b/.github/workflows/tmate.yml
index 72af1eec..5b8818c3 100644
--- a/.github/workflows/tmate.yml
+++ b/.github/workflows/tmate.yml
@@ -11,7 +11,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - name: Setup tmate session
       uses: mxschmitt/action-tmate@v3
       env:
diff --git a/.gitignore b/.gitignore
index 8c058692..2a7f6620 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,6 +5,8 @@ datasets.json
 
 scratchpad
 
+ignored/
+
 .vscode
 
 uv.lock
diff --git a/Justfile b/Justfile
index 5fcd9afd..6ffff870 100644
--- a/Justfile
+++ b/Justfile
@@ -33,10 +33,11 @@ export DATASETTE_SECRET := "not_a_secret"
   uv run codespell datasette -S datasette/static --ignore-words docs/codespell-ignore-words.txt
   uv run codespell tests --ignore-words docs/codespell-ignore-words.txt
 
-# Run linters: black, ruff, cog
+# Run linters: black, ruff, prettier, cog
 @lint: codespell
   uv run black datasette tests --check
   uv run ruff check datasette tests
+  npm run prettier -- --check
   uv run cog --check README.md docs/*.rst
 
 # Apply ruff fixes
diff --git a/datasette/__init__.py b/datasette/__init__.py
index eb18e59e..e0022178 100644
--- a/datasette/__init__.py
+++ b/datasette/__init__.py
@@ -1,8 +1,14 @@
 from datasette.permissions import Permission  # noqa
 from datasette.version import __version_info__, __version__  # noqa
 from datasette.events import Event  # noqa
-from datasette.tokens import TokenHandler, TokenRestrictions  # noqa
-from datasette.utils.asgi import Forbidden, NotFound, Request, Response  # noqa
+from datasette.tokens import TokenHandler, TokenInvalid, TokenRestrictions  # noqa
+from datasette.utils.asgi import (  # noqa
+    Forbidden,
+    NotFound,
+    PayloadTooLarge,
+    Request,
+    Response,
+)
 from datasette.utils import actor_matches_allow  # noqa
 from datasette.views import Context  # noqa
 from .hookspecs import hookimpl  # noqa
diff --git a/datasette/_pytest_plugin.py b/datasette/_pytest_plugin.py
index 103c616d..587380ed 100644
--- a/datasette/_pytest_plugin.py
+++ b/datasette/_pytest_plugin.py
@@ -89,7 +89,8 @@ def pytest_runtest_protocol(item, nextitem):
                 continue
             try:
                 ds.close()
-            except Exception as e:
+            except Exception as e:  # noqa: BLE001
+                # Surfaced as a pytest warning; teardown must not fail the run
                 item.warn(
                     pytest.PytestUnraisableExceptionWarning(
                         f"Error closing Datasette instance: {e!r}"
diff --git a/datasette/actor_auth_cookie.py b/datasette/actor_auth_cookie.py
index 368213af..7503f1d5 100644
--- a/datasette/actor_auth_cookie.py
+++ b/datasette/actor_auth_cookie.py
@@ -1,8 +1,10 @@
-from datasette import hookimpl
-from itsdangerous import BadSignature
-from datasette.utils import baseconv
 import time
 
+from itsdangerous import BadSignature
+
+from datasette import hookimpl
+from datasette.utils import baseconv
+
 
 @hookimpl
 def actor_from_request(datasette, request):
diff --git a/datasette/app.py b/datasette/app.py
index 139e4c34..c82ea075 100644
--- a/datasette/app.py
+++ b/datasette/app.py
@@ -2,7 +2,8 @@ from __future__ import annotations
 
 import asyncio
 import contextvars
-from typing import TYPE_CHECKING, Any, Dict, Iterable, List, Sequence
+from collections.abc import Iterable, Sequence
+from typing import TYPE_CHECKING, Any
 
 if TYPE_CHECKING:
     from datasette.permissions import Resource
@@ -12,12 +13,10 @@ import dataclasses
 import datetime
 import functools
 import glob
-import hashlib
-import httpx
 import importlib.metadata
 import inspect
-from itsdangerous import BadSignature
 import json
+import logging
 import os
 import re
 import secrets
@@ -29,78 +28,36 @@ import urllib.parse
 from concurrent import futures
 from pathlib import Path
 
-from markupsafe import Markup, escape
-from itsdangerous import URLSafeSerializer
+import httpx
+from itsdangerous import BadSignature, URLSafeSerializer
 from jinja2 import (
     ChoiceLoader,
     Environment,
     FileSystemLoader,
     PrefixLoader,
+    pass_context,
 )
 from jinja2.environment import Template
 from jinja2.exceptions import TemplateNotFound
+from markupsafe import Markup, escape
 
-from .events import Event
-from .column_types import SQLiteType
 from . import stored_queries, write_sql
-from .views import Context
-from .views.database import (
-    database_download,
-    DatabaseView,
-    TableCreateView,
-    QueryView,
-)
-from .views.execute_write import ExecuteWriteAnalyzeView, ExecuteWriteView
-from .views.stored_queries import (
-    QueryCreateAnalyzeView,
-    QueryDeleteView,
-    QueryDefinitionView,
-    QueryEditView,
-    GlobalQueryListView,
-    QueryListView,
-    QueryParametersView,
-    QueryStoreView,
-    QueryUpdateView,
-)
-from .views.index import IndexView
-from .views.special import (
-    JsonDataView,
-    PatternPortfolioView,
-    AutocompleteDebugView,
-    AuthTokenView,
-    ApiExplorerView,
-    CreateTokenView,
-    LogoutView,
-    AllowDebugView,
-    PermissionsDebugView,
-    MessagesDebugView,
-    AllowedResourcesView,
-    PermissionRulesView,
-    PermissionCheckView,
-    JumpView,
-    InstanceSchemaView,
-    DatabaseSchemaView,
-    TableSchemaView,
-)
-from .views.table import (
-    TableAutocompleteView,
-    TableInsertView,
-    TableUpsertView,
-    TableSetColumnTypeView,
-    TableDropView,
-    TableFragmentView,
-    table_view,
-)
-from .views.row import RowView, RowDeleteView, RowUpdateView
-from .renderer import json_renderer
-from .url_builder import Urls
+from .column_types import SQLiteType
+from .csrf import CrossOriginProtectionMiddleware
 from .database import Database, QueryInterrupted
-
+from .events import Event
+from .plugins import DEFAULT_PLUGINS, get_plugins, pm
+from .renderer import json_renderer
+from .resources import DatabaseResource, TableResource
+from .tokens import TokenInvalid
+from .tracer import AsgiTracer
+from .url_builder import Urls
 from .utils import (
+    SPATIALITE_FUNCTIONS,
     PaginatedResources,
     PrefixedUrlString,
-    SPATIALITE_FUNCTIONS,
     StartupError,
+    add_cors_headers,
     async_call_with_supported_arguments,
     await_me_maybe,
     baseconv,
@@ -115,44 +72,97 @@ from .utils import (
     move_plugins_and_allow,
     move_table_config,
     parse_metadata,
+    redact_keys,
     resolve_env_secrets,
     resolve_routes,
+    row_sql_params_pks,
+    sha256_file,
     tilde_decode,
     tilde_encode,
     to_css_class,
     urlsafe_components,
-    redact_keys,
-    row_sql_params_pks,
 )
 from .utils.asgi import (
     AsgiLifespan,
+    AsgiRunOnFirstRequest,
+    BadRequest,
+    DatabaseNotFound,
     Forbidden,
     NotFound,
-    DatabaseNotFound,
-    TableNotFound,
-    RowNotFound,
     Request,
     Response,
-    AsgiRunOnFirstRequest,
-    asgi_static,
+    RowNotFound,
+    TableNotFound,
     asgi_send,
     asgi_send_file,
     asgi_send_redirect,
+    asgi_static,
 )
-from .csrf import CrossOriginProtectionMiddleware
 from .utils.internal_db import init_internal_db, populate_schema_tables
 from .utils.sqlite import (
     sqlite3,
     using_pysqlite3,
 )
-from .tracer import AsgiTracer
-from .plugins import pm, DEFAULT_PLUGINS, get_plugins
 from .version import __version__
-
-from .resources import DatabaseResource, TableResource
+from .views import Context
+from .views.database import (
+    DatabaseView,
+    QueryView,
+    database_download,
+)
+from .views.execute_write import ExecuteWriteAnalyzeView, ExecuteWriteView
+from .views.index import IndexView
+from .views.row import RowDeleteView, RowUpdateView, RowView
+from .views.special import (
+    AllowDebugView,
+    AllowedResourcesView,
+    ApiExplorerView,
+    AuthTokenView,
+    AutocompleteDebugView,
+    CreateTokenView,
+    DatabaseSchemaView,
+    InstanceSchemaView,
+    JsonDataView,
+    JumpView,
+    LogoutView,
+    MessagesDebugView,
+    PatternPortfolioView,
+    PermissionCheckView,
+    PermissionRulesView,
+    PermissionsDebugView,
+    TableSchemaView,
+)
+from .views.stored_queries import (
+    GlobalQueryListView,
+    QueryCreateAnalyzeView,
+    QueryDefinitionView,
+    QueryDeleteView,
+    QueryEditView,
+    QueryListView,
+    QueryParametersView,
+    QueryStoreView,
+    QueryUpdateView,
+)
+from .views.table import (
+    TableAutocompleteView,
+    TableDropView,
+    TableFragmentView,
+    TableInsertView,
+    TableSetColumnTypeView,
+    TableUpsertView,
+    table_view,
+)
+from .views.table_create_alter import (
+    DatabaseForeignKeyTargetsView,
+    TableAlterView,
+    TableCreateView,
+    TableForeignKeySuggestionsView,
+)
 
 app_root = Path(__file__).parent.parent
 
+logger = logging.getLogger(__name__)
+
 
 # Context variable to track when code is executing within a datasette.client request
 _in_datasette_client = contextvars.ContextVar("in_datasette_client", default=False)
@@ -175,7 +185,7 @@ class PermissionCheck:
     """Represents a logged permission check for debugging purposes."""
 
     when: str
-    actor: Dict[str, Any] | None
+    actor: dict[str, Any] | None
     action: str
     parent: str | None
     child: str | None
@@ -200,6 +210,11 @@ SETTINGS = (
         100,
         "Maximum rows that can be inserted at a time using the bulk insert API",
     ),
+    Setting(
+        "max_post_body_bytes",
+        2 * 1024 * 1024,
+        "Maximum size in bytes for a POST body read into memory, e.g. JSON API requests - set 0 to disable this limit",
+    ),
     Setting(
         "num_sql_threads",
         3,
@@ -308,7 +323,7 @@ async def favicon(request, send):
         send,
         str(FAVICON_PATH),
         content_type="image/png",
-        headers={"Cache-Control": "max-age=3600, immutable, public"},
+        headers={"Cache-Control": "max-age=3600, public"},
     )
 
 
@@ -325,6 +340,57 @@ def _to_string(value):
         return json.dumps(value, default=str)
 
 
+def _template_context_json_default(value):
+    if dataclasses.is_dataclass(value) and not isinstance(value, type):
+        return {
+            field.name: getattr(value, field.name)
+            for field in dataclasses.fields(value)
+        }
+    return repr(value)
+
+
+@pass_context
+def _legacy_template_csrftoken(context):
+    request = context.get("request")
+    if request and "csrftoken" in request.scope:
+        return request.scope["csrftoken"]()
+    return ""
+
+
+def _resolve_static_asset_path(root_path, path):
+    root = Path(root_path).resolve()
+    full_path = (root / path).resolve()
+    try:
+        full_path.relative_to(root)
+    except ValueError:
+        raise ValueError("Static asset path cannot escape static root") from None
+    return full_path
+
+
+# Documentation for the variables Datasette.render_template() adds to the
+# context for every page. This is part of the documented template contract:
+# keys added in render_template() must be documented here - the contract
+# tests in tests/test_template_context.py enforce this, and the docs in
+# docs/template_context.rst are generated from it.
+TEMPLATE_BASE_CONTEXT = {
+    "request": "The current :ref:`Request object <internals_request>`, or None. Common properties include ``request.path``, ``request.args``, ``request.actor``, ``request.url_vars`` and ``request.host``.",
+    "crumb_items": 'Async function returning breadcrumb navigation items for the current page. Call it with ``request=request`` plus optional ``database=`` and ``table=`` arguments; it returns a list of ``{"href": url, "label": label}`` dictionaries.',
+    "urls": "Object with methods for constructing URLs within Datasette. Common methods include ``urls.instance()``, ``urls.database(database)``, ``urls.table(database, table)``, ``urls.query(database, query)``, ``urls.row(database, table, row_path)`` and ``urls.static(path)`` - see :ref:`internals_datasette_urls`.",
+    "actor": "The currently authenticated actor dictionary, or None. Actors usually include an ``id`` key and may include any other keys supplied by authentication plugins.",
+    "menu_links": "Async function returning links for the Datasette application menu, including links added by plugins. Each item is a link dictionary with ``href`` and ``label`` keys. See :ref:`plugin_hook_menu_links`; for page action menus that can also include JavaScript-backed buttons, see :ref:`plugin_actions`.",
+    "display_actor": "Function that accepts an actor dictionary and returns the display string used in the navigation menu.",
+    "show_logout": "True if the logout link should be shown in the navigation menu",
+    "zip": "Python's ``zip()`` builtin, made available to template logic",
+    "body_scripts": 'List of JavaScript snippets contributed by plugins using :ref:`plugin_hook_extra_body_script`. Each item is a dictionary with ``script`` containing JavaScript source and ``module`` indicating whether Datasette will wrap it in ``<script type="module">``; otherwise Datasette wraps it in a regular ``<script>`` block.',
+    "format_bytes": "Function that accepts a byte count integer and returns a human-readable string such as ``1.2 MB``.",
+    "show_messages": "Function returning any messages set for the current user, clearing them in the process. Returns a list of ``(message, type)`` pairs, where ``type`` is one of Datasette's ``INFO``, ``WARNING`` or ``ERROR`` constants.",
+    "extra_css_urls": "List of extra CSS stylesheets to include on the page. Each item is a dictionary with ``url`` and optional ``sri`` keys, from plugins and configuration.",
+    "extra_js_urls": "List of extra JavaScript URLs to include on the page. Each item is a dictionary with ``url`` plus optional ``sri`` and ``module`` keys, from plugins and configuration.",
+    "base_url": "The configured :ref:`setting_base_url` setting",
+    "datasette_version": "The version of Datasette that is running",
+}
+
+
 class Datasette:
     # Message constants:
     INFO = 1
@@ -369,7 +435,7 @@ class Datasette:
         if config_dir:
             db_files = []
             for ext in ("db", "sqlite", "sqlite3"):
-                db_files.extend(config_dir.glob("*.{}".format(ext)))
+                db_files.extend(config_dir.glob(f"*.{ext}"))
             self.files += tuple(str(f) for f in db_files)
         if (
             config_dir
@@ -417,6 +483,7 @@ class Datasette:
         self._internal_database.name = INTERNAL_DB_NAME
 
         self.cache_headers = cache_headers
+        self._static_asset_hashes = {}
         self.cors = cors
         config_files = []
         metadata_files = []
@@ -557,6 +624,8 @@ class Datasette:
         )
         environment.filters["escape_css_string"] = escape_css_string
         environment.filters["quote_plus"] = urllib.parse.quote_plus
+        environment.globals["csrftoken"] = _legacy_template_csrftoken
+        environment.globals["static"] = self.static
         self._jinja_env = environment
         environment.filters["escape_sqlite"] = escape_sqlite
         environment.filters["to_css_class"] = to_css_class
@@ -607,10 +676,10 @@ class Datasette:
     def get_jinja_environment(self, request: Request = None) -> Environment:
         environment = self._jinja_env
         if request:
-            for environment in pm.hook.jinja2_environment_from_request(
+            for hook_environment in pm.hook.jinja2_environment_from_request(
                 datasette=self, request=request, env=environment
             ):
-                pass
+                environment = hook_environment
         return environment
 
     def get_action(self, name_or_abbr: str):
@@ -664,7 +733,7 @@ class Datasette:
             catalog_database_names.update(
                 row["database_name"]
                 for row in await internal_db.execute(
-                    "select distinct database_name from {}".format(table)
+                    f"select distinct database_name from {table}"
                 )
                 if row["database_name"] is not None
             )
@@ -675,7 +744,7 @@ class Datasette:
                 for stale_db_name in stale_databases:
                     for table in catalog_table_names:
                         conn.execute(
-                            "DELETE FROM {} WHERE database_name = ?".format(table),
+                            f"DELETE FROM {table} WHERE database_name = ?",
                             [stale_db_name],
                         )
 
@@ -685,19 +754,7 @@ class Datasette:
             # Compare schema versions to see if we should skip it
             if schema_version == current_schema_versions.get(database_name):
                 continue
-            placeholders = "(?, ?, ?, ?)"
-            values = [database_name, str(db.path), db.is_memory, schema_version]
-            if db.path is None:
-                placeholders = "(?, null, ?, ?)"
-                values = [database_name, db.is_memory, schema_version]
-            await internal_db.execute_write(
-                """
-                INSERT OR REPLACE INTO catalog_databases (database_name, path, is_memory, schema_version)
-                VALUES {}
-            """.format(placeholders),
-                values,
-            )
-            await populate_schema_tables(internal_db, db)
+            await populate_schema_tables(internal_db, db, schema_version)
 
     @property
     def urls(self):
@@ -736,17 +793,13 @@ class Datasette:
                         action.name in action_names
                         and action != action_names[action.name]
                     ):
-                        raise StartupError(
-                            "Duplicate action name: {}".format(action.name)
-                        )
+                        raise StartupError(f"Duplicate action name: {action.name}")
                     if (
                         action.abbr
                         and action.abbr in action_abbrs
                         and action != action_abbrs[action.abbr]
                     ):
-                        raise StartupError(
-                            "Duplicate action abbr: {}".format(action.abbr)
-                        )
+                        raise StartupError(f"Duplicate action abbr: {action.abbr}")
                     action_names[action.name] = action
                     if action.abbr:
                         action_abbrs[action.abbr] = action
@@ -805,7 +858,7 @@ class Datasette:
         actor_id: str,
         *,
         expires_after: int | None = None,
-        restrictions: "TokenRestrictions | None" = None,
+        restrictions: TokenRestrictions | None = None,
         handler: str | None = None,
     ) -> str:
         """
@@ -845,7 +898,9 @@ class Datasette:
         Verify an API token by trying all registered token handlers.
 
         Returns an actor dict from the first handler that recognizes the
-        token, or None if no handler accepts it.
+        token, or None if no handler accepts it. A handler may raise
+        TokenInvalid for a token it recognizes but rejects (bad signature,
+        expired) - Datasette turns that into a 401 response.
         """
         for token_handler in self._token_handlers():
             result = await token_handler.verify_token(self, token)
@@ -860,7 +915,7 @@ class Datasette:
                 raise KeyError
             return matches[0]
         if name is None:
-            name = [key for key in self.databases.keys()][0]
+            name = next(iter(self.databases.keys()))
         return self.databases[name]
 
     def add_database(self, db, name=None, route=None):
@@ -873,7 +928,7 @@ class Datasette:
             suggestion = name
         i = 2
         while name in self.databases:
-            name = "{}_{}".format(suggestion, i)
+            name = f"{suggestion}_{i}"
             i += 1
         db.name = name
         db.route = route or name
@@ -908,13 +963,14 @@ class Datasette:
         for db in dbs:
             try:
                 db.close()
-            except Exception as e:
+            except Exception as e:  # noqa: BLE001
+                # Collect the first failure and re-raise after every close() has run
                 if first_exception is None:
                     first_exception = e
         if self.executor is not None:
             try:
                 self.executor.shutdown(wait=True, cancel_futures=True)
-            except Exception as e:
+            except Exception as e:  # noqa: BLE001
                 if first_exception is None:
                     first_exception = e
         if first_exception is not None:
@@ -1263,24 +1319,15 @@ class Datasette:
         actual = (
             actual_sqlite_type.value
             if actual_sqlite_type is not None
-            else "unrecognized {!r}".format(column_detail.type)
+            else f"unrecognized {column_detail.type!r}"
         )
         raise ValueError(
-            "Column type {!r} is only applicable to SQLite types {} but {}.{}.{} "
-            "has SQLite type {}".format(
-                ct_cls.name,
-                allowed,
-                database,
-                resource,
-                column,
-                actual,
-            )
+            f"Column type {ct_cls.name!r} is only applicable to SQLite types {allowed} but {database}.{resource}.{column} "
+            f"has SQLite type {actual}"
         )
 
     async def _apply_column_types_config(self):
         """Load column_types from datasette.json config into the internal DB."""
-        import logging
-
         for db_name, db_conf in (self.config or {}).get("databases", {}).items():
             for table_name, table_conf in db_conf.get("tables", {}).items():
                 for col_name, ct in table_conf.get("column_types", {}).items():
@@ -1290,7 +1337,7 @@ class Datasette:
                         col_type = ct["type"]
                         config = ct.get("config")
                     if col_type not in self._column_types:
-                        logging.warning(
+                        logger.warning(
                             "column_types config references unknown type %r "
                             "for %s.%s.%s",
                             col_type,
@@ -1303,7 +1350,7 @@ class Datasette:
                             db_name, table_name, col_name, col_type, config
                         )
                     except ValueError as ex:
-                        logging.warning(str(ex))
+                        logger.warning(str(ex))
 
     async def get_column_type(self, database: str, resource: str, column: str):
         """
@@ -1356,7 +1403,7 @@ class Datasette:
         resource: str,
         column: str,
         column_type: str,
-        config: dict = None,
+        config: dict | None = None,
     ) -> None:
         """Assign a column type. Overwrites any existing assignment."""
         ct_cls = self._column_types.get(column_type)
@@ -1430,24 +1477,53 @@ class Datasette:
 
         return db_plugin_config
 
-    def static_hash(self, filename):
-        if not hasattr(self, "_static_hashes"):
-            self._static_hashes = {}
-        path = os.path.join(str(app_root), "datasette/static", filename)
-        signature = (os.path.getmtime(path), os.path.getsize(path))
-        cached = self._static_hashes.get(filename)
-        if cached and cached["signature"] == signature:
-            return cached["hash"]
-        with open(path) as fp:
-            static_hash = hashlib.sha1(fp.read().encode("utf8")).hexdigest()[:6]
-        self._static_hashes[filename] = {
-            "signature": signature,
-            "hash": static_hash,
-        }
-        return static_hash
+    def _static_asset_path(self, path):
+        return _resolve_static_asset_path(app_root / "datasette" / "static", path)
 
-    def app_css_hash(self):
-        return self.static_hash("app.css")
+    def _static_plugin_asset_path(self, plugin_name, path):
+        for plugin in get_plugins():
+            if not plugin["static_path"]:
+                continue
+            possible_names = {plugin["name"], plugin["name"].replace("-", "_")}
+            if plugin_name in possible_names:
+                return _resolve_static_asset_path(plugin["static_path"], path)
+        raise FileNotFoundError(f"No static assets found for plugin {plugin_name}")
+
+    def _static_mounted_asset(self, mount_name, path):
+        mount_name = mount_name.strip("/")
+        for mount, dirname in self.static_mounts:
+            if mount.strip("/") == mount_name:
+                return (
+                    _resolve_static_asset_path(dirname, path),
+                    self.urls.path("/{}/{}".format(mount_name, path.lstrip("/"))),
+                )
+        raise FileNotFoundError(f"No static mount found for {mount_name}")
+
+    def _static_asset_hash(self, filepath):
+        filepath = Path(filepath)
+        if self.cache_headers:
+            cached = self._static_asset_hashes.get(filepath)
+            if cached:
+                return cached
+        digest = sha256_file(filepath)[:12]
+        if self.cache_headers:
+            self._static_asset_hashes[filepath] = digest
+        return digest
+
+    def static(self, path, plugin=None, mount=None):
+        if plugin and mount:
+            raise ValueError("Use either plugin= or mount=, not both")
+        if plugin:
+            filepath = self._static_plugin_asset_path(plugin, path)
+            url = self.urls.static_plugins(plugin, path)
+        elif mount:
+            filepath, url = self._static_mounted_asset(mount, path)
+        else:
+            filepath = self._static_asset_path(path)
+            url = self.urls.static(path)
+        hash_value = self._static_asset_hash(filepath)
+        separator = "&" if "?" in url else "?"
+        return url + separator + urllib.parse.urlencode({"_hash": hash_value})
 
     def _prepare_connection(self, conn, database):
         conn.row_factory = sqlite3.Row
@@ -1512,18 +1588,17 @@ class Datasette:
         if await self.allowed(action="view-instance", actor=actor):
             crumbs.append({"href": self.urls.instance(), "label": "home"})
         # Database link
-        if database:
-            if await self.allowed(
-                action="view-database",
-                resource=DatabaseResource(database=database),
-                actor=actor,
-            ):
-                crumbs.append(
-                    {
-                        "href": self.urls.database(database),
-                        "label": database,
-                    }
-                )
+        if database and await self.allowed(
+            action="view-database",
+            resource=DatabaseResource(database=database),
+            actor=actor,
+        ):
+            crumbs.append(
+                {
+                    "href": self.urls.database(database),
+                    "label": database,
+                }
+            )
         # Table link
         if table:
             assert database, "table= requires database="
@@ -1542,7 +1617,7 @@ class Datasette:
 
     async def actors_from_ids(
         self, actor_ids: Iterable[str | int]
-    ) -> Dict[int | str, Dict]:
+    ) -> dict[int | str, dict]:
         result = pm.hook.actors_from_ids(datasette=self, actor_ids=actor_ids)
         if result is None:
             # Do the default thing
@@ -1551,9 +1626,9 @@ class Datasette:
         return result
 
     async def track_event(self, event: Event):
-        assert isinstance(event, self.event_classes), "Invalid event type: {}".format(
-            type(event)
-        )
+        assert isinstance(
+            event, self.event_classes
+        ), f"Invalid event type: {type(event)}"
         for hook in pm.hook.track_event(datasette=self, event=event):
             await await_me_maybe(hook)
 
@@ -1590,7 +1665,7 @@ class Datasette:
         self,
         actor: dict,
         action: str,
-        resource: "Resource" | None = None,
+        resource: Resource | None = None,
     ):
         """
         Check if actor can see a resource and if it's private.
@@ -1789,10 +1864,7 @@ class Datasette:
         if truncated and resources:
             last_resource = resources[-1]
             # Use tilde-encoding like table pagination
-            next_token = "{},{}".format(
-                tilde_encode(str(last_resource.parent)),
-                tilde_encode(str(last_resource.child)),
-            )
+            next_token = f"{tilde_encode(str(last_resource.parent))},{tilde_encode(str(last_resource.child))}"
 
         return PaginatedResources(
             resources=resources,
@@ -1810,7 +1882,7 @@ class Datasette:
         self,
         *,
         action: str,
-        resource: "Resource" = None,
+        resource: Resource = None,
         actor: dict | None = None,
     ) -> bool:
         """
@@ -1841,7 +1913,7 @@ class Datasette:
         self,
         *,
         actions: Sequence[str],
-        resource: "Resource" = None,
+        resource: Resource = None,
         actor: dict | None = None,
     ) -> dict[str, bool]:
         """
@@ -1862,11 +1934,11 @@ class Datasette:
             )
             # {"edit-schema": True, "drop-table": True, "insert-row": False}
         """
-        from datasette.utils.actions_sql import check_permissions_for_actions
         from datasette.permissions import (
             _permission_check_cache,
             _skip_permission_checks,
         )
+        from datasette.utils.actions_sql import check_permissions_for_actions
 
         # For global actions, resource is None
         parent = resource.parent if resource else None
@@ -1955,7 +2027,7 @@ class Datasette:
         self,
         *,
         action: str,
-        resource: "Resource" = None,
+        resource: Resource = None,
         actor: dict | None = None,
     ):
         """
@@ -2009,13 +2081,15 @@ class Datasette:
         db = self.databases[database]
         foreign_keys = await db.foreign_keys_for_table(table)
         # Find the foreign_key for this column
-        try:
-            fk = [
+        fk = next(
+            (
                 foreign_key
                 for foreign_key in foreign_keys
                 if foreign_key["column"] == column
-            ][0]
-        except IndexError:
+            ),
+            None,
+        )
+        if fk is None:
             return {}
         # Ensure user has permission to view the referenced table
         from datasette.resources import TableResource
@@ -2077,6 +2151,18 @@ class Datasette:
             for name, d in self.databases.items()
         ]
 
+    async def _connected_databases_for_actor(self, actor):
+        page = await self.allowed_resources("view-database", actor)
+        allowed_names = {resource.parent async for resource in page.all()}
+        return [
+            database
+            for database in self._connected_databases()
+            if database["name"] in allowed_names
+        ]
+
+    async def _databases_data(self, request):
+        return {"databases": await self._connected_databases_for_actor(request.actor)}
+
     def _versions(self):
         conn = sqlite3.connect(":memory:")
         self._prepare_connection(conn, "_memory")
@@ -2091,16 +2177,17 @@ class Datasette:
                     sqlite_extensions[extension] = result.fetchone()[0]
                 else:
                     sqlite_extensions[extension] = None
-            except Exception:
+            except Exception:  # noqa: BLE001, S110
+                # Probing for optional SQLite extensions - absence is the normal case
                 pass
         # More details on SpatiaLite
         if "spatialite" in sqlite_extensions:
             spatialite_details = {}
             for fn in SPATIALITE_FUNCTIONS:
                 try:
-                    result = conn.execute("select {}()".format(fn))
+                    result = conn.execute(f"select {fn}()")
                     spatialite_details[fn] = result.fetchone()[0]
-                except Exception as e:
+                except sqlite3.Error as e:
                     spatialite_details[fn] = {"error": str(e)}
             sqlite_extensions["spatialite"] = spatialite_details
 
@@ -2108,9 +2195,7 @@ class Datasette:
         fts_versions = []
         for fts in ("FTS5", "FTS4", "FTS3"):
             try:
-                conn.execute(
-                    "CREATE VIRTUAL TABLE v{fts} USING {fts} (data)".format(fts=fts)
-                )
+                conn.execute(f"CREATE VIRTUAL TABLE v{fts} USING {fts} (data)")
                 fts_versions.append(fts)
             except sqlite3.OperationalError:
                 continue
@@ -2169,7 +2254,7 @@ class Datasette:
                 "static": p["static_path"] is not None,
                 "templates": p["templates_path"] is not None,
                 "version": p.get("version"),
-                "hooks": list(sorted(set(p["hooks"]))),
+                "hooks": sorted(set(p["hooks"])),
             }
             for p in ps
         ]
@@ -2245,13 +2330,15 @@ class Datasette:
 
     async def render_template(
         self,
-        templates: List[str] | str | Template,
-        context: Dict[str, Any] | Context | None = None,
+        templates: list[str] | str | Template,
+        context: dict[str, Any] | Context | None = None,
         request: Request | None = None,
         view_name: str | None = None,
     ):
         if not self._startup_invoked:
-            raise Exception("render_template() called before await ds.invoke_startup()")
+            raise RuntimeError(
+                "render_template() called before await ds.invoke_startup()"
+            )
         context = context or {}
         if isinstance(templates, Template):
             template = templates
@@ -2260,7 +2347,11 @@ class Datasette:
                 templates = [templates]
             template = self.get_jinja_environment(request).select_template(templates)
         if dataclasses.is_dataclass(context):
-            context = dataclasses.asdict(context)
+            # Shallow conversion - asdict() would deep-copy values, which
+            # is wasteful and fails on values like sqlite3.Row
+            context = {
+                f.name: getattr(context, f.name) for f in dataclasses.fields(context)
+            }
         body_scripts = []
         # pylint: disable=no-member
         for extra_script in pm.hook.extra_body_script(
@@ -2293,9 +2384,9 @@ class Datasette:
             datasette=self,
         ):
             extra_vars = await await_me_maybe(extra_vars)
-            assert isinstance(extra_vars, dict), "extra_vars is of type {}".format(
-                type(extra_vars)
-            )
+            assert isinstance(
+                extra_vars, dict
+            ), f"extra_vars is of type {type(extra_vars)}"
             extra_template_vars.update(extra_vars)
 
         async def menu_links():
@@ -2310,44 +2401,42 @@ class Datasette:
                     links.extend(extra_links)
             return links
 
+        # Keys added here must be documented in TEMPLATE_BASE_CONTEXT -
+        # the contract tests fail otherwise
         template_context = {
             **context,
-            **{
-                "request": request,
-                "crumb_items": self._crumb_items,
-                "urls": self.urls,
-                "actor": request.actor if request else None,
-                "menu_links": menu_links,
-                "display_actor": display_actor,
-                "show_logout": request is not None
-                and "ds_actor" in request.cookies
-                and request.actor,
-                "app_css_hash": self.app_css_hash(),
-                "edit_tools_js_hash": self.static_hash("edit-tools.js"),
-                "table_js_hash": self.static_hash("table.js"),
-                "zip": zip,
-                "body_scripts": body_scripts,
-                "format_bytes": format_bytes,
-                "show_messages": lambda: self._show_messages(request),
-                "extra_css_urls": await self._asset_urls(
-                    "extra_css_urls", template, context, request, view_name
-                ),
-                "extra_js_urls": await self._asset_urls(
-                    "extra_js_urls", template, context, request, view_name
-                ),
-                "base_url": self.setting("base_url"),
-                "csrftoken": (
-                    request.scope["csrftoken"]
-                    if request and "csrftoken" in request.scope
-                    else lambda: ""
-                ),
-                "datasette_version": __version__,
-            },
+            "request": request,
+            "crumb_items": self._crumb_items,
+            "urls": self.urls,
+            "actor": request.actor if request else None,
+            "menu_links": menu_links,
+            "display_actor": display_actor,
+            "show_logout": request is not None
+            and "ds_actor" in request.cookies
+            and request.actor,
+            "zip": zip,
+            "body_scripts": body_scripts,
+            "format_bytes": format_bytes,
+            "show_messages": lambda: self._show_messages(request),
+            "extra_css_urls": await self._asset_urls(
+                "extra_css_urls", template, context, request, view_name
+            ),
+            "extra_js_urls": await self._asset_urls(
+                "extra_js_urls", template, context, request, view_name
+            ),
+            "base_url": self.setting("base_url"),
+            "datasette_version": __version__,
             **extra_template_vars,
         }
         if request and request.args.get("_context") and self.setting("template_debug"):
             return "<pre>{}</pre>".format(
-                escape(json.dumps(template_context, default=repr, indent=4))
+                escape(
+                    json.dumps(
+                        template_context,
+                        default=_template_context_json_default,
+                        indent=4,
+                    )
+                )
             )
 
         return await template.render_async(template_context)
@@ -2419,10 +2508,9 @@ class Datasette:
         def add_route(view, regex):
             routes.append((regex, view))
 
-        add_route(IndexView.as_view(self), r"/(\.(?P<format>jsono?))?$")
-        add_route(IndexView.as_view(self), r"/-/(\.(?P<format>jsono?))?$")
+        add_route(IndexView.as_view(self), r"/(\.(?P<format>json))?$")
+        add_route(IndexView.as_view(self), r"/-/(\.(?P<format>json))?$")
         add_route(permanent_redirect("/-/"), r"/-$")
-        # TODO: /favicon.ico and /-/static/ deserve far-future cache expires
         add_route(favicon, "/favicon.ico")
 
         add_route(
@@ -2457,7 +2545,10 @@ class Datasette:
         )
         add_route(
             JsonDataView.as_view(
-                self, "plugins.json", self._plugins, needs_request=True
+                self,
+                "plugins.json",
+                self._plugins,
+                needs_request=True,
             ),
             r"/-/plugins(\.(?P<format>json))?$",
         )
@@ -2470,11 +2561,18 @@ class Datasette:
             r"/-/config(\.(?P<format>json))?$",
         )
         add_route(
-            JsonDataView.as_view(self, "threads.json", self._threads),
+            JsonDataView.as_view(
+                self, "threads.json", self._threads, permission="permissions-debug"
+            ),
             r"/-/threads(\.(?P<format>json))?$",
         )
         add_route(
-            JsonDataView.as_view(self, "databases.json", self._connected_databases),
+            JsonDataView.as_view(
+                self,
+                "databases.json",
+                self._databases_data,
+                needs_request=True,
+            ),
             r"/-/databases(\.(?P<format>json))?$",
         )
         add_route(
@@ -2487,7 +2585,7 @@ class Datasette:
             JsonDataView.as_view(
                 self,
                 "actions.json",
-                self._actions,
+                lambda: {"actions": self._actions()},
                 template="debug_actions.html",
                 permission="permissions-debug",
             ),
@@ -2562,6 +2660,10 @@ class Datasette:
             r"/(?P<database>[^\/\.]+)(\.(?P<format>\w+))?$",
         )
         add_route(TableCreateView.as_view(self), r"/(?P<database>[^\/\.]+)/-/create$")
+        add_route(
+            DatabaseForeignKeyTargetsView.as_view(self),
+            r"/(?P<database>[^\/\.]+)/-/foreign-key-targets$",
+        )
         add_route(
             QueryListView.as_view(self),
             r"/(?P<database>[^\/\.]+)/-/queries(\.(?P<format>json))?$",
@@ -2626,6 +2728,14 @@ class Datasette:
             TableUpsertView.as_view(self),
             r"/(?P<database>[^\/\.]+)/(?P<table>[^\/\.]+)/-/upsert$",
         )
+        add_route(
+            TableAlterView.as_view(self),
+            r"/(?P<database>[^\/\.]+)/(?P<table>[^\/\.]+)/-/alter$",
+        )
+        add_route(
+            TableForeignKeySuggestionsView.as_view(self),
+            r"/(?P<database>[^\/\.]+)/(?P<table>[^\/\.]+)/-/foreign-key-suggestions$",
+        )
         add_route(
             TableSetColumnTypeView.as_view(self),
             r"/(?P<database>[^\/\.]+)/(?P<table>[^\/\.]+)/-/set-column-type$",
@@ -2683,6 +2793,10 @@ class Datasette:
         db, table_name, _ = await self.resolve_table(request)
         pk_values = urlsafe_components(request.url_vars["pks"])
         sql, params, pks = await row_sql_params_pks(db, table_name, pk_values)
+        if len(pk_values) != len(pks):
+            raise BadRequest(
+                "URL row identifier does not match the primary key for this table"
+            )
         results = await db.execute(sql, params, truncate=True)
         row = results.first()
         if row is None:
@@ -2741,7 +2855,11 @@ class DatasetteRouter:
         if base_url != "/" and path.startswith(base_url):
             path = "/" + path[len(base_url) :]
             scope = dict(scope, route_path=path)
-        request = Request(scope, receive)
+        request = Request(
+            scope,
+            receive,
+            max_post_body_bytes=self.ds.setting("max_post_body_bytes"),
+        )
         # Populate request_messages if ds_messages cookie is present
         try:
             request._messages = self.ds.unsign(
@@ -2761,13 +2879,24 @@ class DatasetteRouter:
         # Handle authentication
         default_actor = scope.get("actor") or None
         actor = None
+        token_error = None
         results = pm.hook.actor_from_request(datasette=self.ds, request=request)
         for result in results:
-            result = await await_me_maybe(result)
+            try:
+                result = await await_me_maybe(result)
+            except TokenInvalid as ex:
+                # A presented token was recognized but rejected - fail the
+                # request with a 401 even if another credential is valid,
+                # but keep awaiting the remaining coroutines first
+                if token_error is None:
+                    token_error = ex
+                continue
             if result and actor is None:
                 actor = result
                 # Don't break — we must await all coroutines to avoid
                 # "coroutine was never awaited" warnings
+        if token_error is not None:
+            return await self.handle_401(request, send, token_error)
         scope_modifications["actor"] = actor or default_actor
         scope = dict(scope, **scope_modifications)
 
@@ -2796,9 +2925,19 @@ class DatasetteRouter:
                     custom_response
                 ), "Default forbidden() hook should have been called"
                 return await custom_response.asgi_send(send)
-        except Exception as exception:
+        except Exception as exception:  # noqa: BLE001
+            # This IS the top-level error handler - it must catch everything
             return await self.handle_exception(request, send, exception)
 
+    async def handle_401(self, request, send, exception):
+        # A presented bearer token was recognized by a handler but rejected.
+        # Bearer tokens are API credentials, so this is always JSON.
+        headers = {"www-authenticate": 'Bearer error="invalid_token"'}
+        if self.ds.cors:
+            add_cors_headers(headers)
+        response = Response.error([str(exception)], 401, headers=headers)
+        await response.asgi_send(send)
+
     async def handle_404(self, request, send, exception=None):
         # If path contains % encoding, redirect to tilde encoding
         if "%" in request.path:
@@ -2809,7 +2948,7 @@ class DatasetteRouter:
                 request.path.replace("~", "~7E").replace("%", "~").replace(".", "~2E")
             )
             if request.query_string:
-                new_path += "?{}".format(request.query_string)
+                new_path += f"?{request.query_string}"
             await asgi_send_redirect(send, new_path)
             return
         # If URL has a trailing slash, redirect to URL without it
@@ -3019,8 +3158,7 @@ _curly_re = re.compile(r"({.*?})")
 
 def route_pattern_from_filepath(filepath):
     # Drop the ".html" suffix
-    if filepath.endswith(".html"):
-        filepath = filepath[: -len(".html")]
+    filepath = filepath.removesuffix(".html")
     re_bits = ["/"]
     for bit in _curly_re.split(filepath):
         if _curly_re.match(bit):
diff --git a/datasette/blob_renderer.py b/datasette/blob_renderer.py
index 4d8c6bea..b6c8b77f 100644
--- a/datasette/blob_renderer.py
+++ b/datasette/blob_renderer.py
@@ -1,8 +1,9 @@
-from datasette import hookimpl
-from datasette.utils.asgi import Response, BadRequest
-from datasette.utils import to_css_class
 import hashlib
 
+from datasette import hookimpl
+from datasette.utils import to_css_class
+from datasette.utils.asgi import BadRequest, Response
+
 _BLOB_COLUMN = "_blob_column"
 _BLOB_HASH = "_blob_hash"
 
diff --git a/datasette/cli.py b/datasette/cli.py
index 90a33e80..57db83b6 100644
--- a/datasette/cli.py
+++ b/datasette/cli.py
@@ -1,43 +1,45 @@
 import asyncio
-import uvicorn
-import click
-from click import formatting
-from click.types import CompositeParamType
-from click_default_group import DefaultGroup
 import functools
 import json
 import os
 import pathlib
-from runpy import run_module
 import shutil
-from subprocess import call
 import sys
 import textwrap
 import webbrowser
+from runpy import run_module
+from subprocess import call
+
+import click
+import uvicorn
+from click import formatting
+from click.types import CompositeParamType
+from click_default_group import DefaultGroup
+
 from .app import (
-    Datasette,
     DEFAULT_SETTINGS,
     SETTINGS,
     SQLITE_LIMIT_ATTACHED,
+    Datasette,
     pm,
 )
 from .inspect import inspect_tables
 from .utils import (
+    ConnectionProblem,
     LoadExtension,
+    SpatialiteConnectionProblem,
+    SpatialiteNotFound,
     StartupError,
+    StaticMount,
+    ValueAsBooleanError,
     check_connection,
     deep_dict_update,
     find_spatialite,
-    parse_metadata,
-    ConnectionProblem,
-    SpatialiteConnectionProblem,
     initial_path_for_datasette,
     pairs_to_nested_config,
+    parse_metadata,
     temporary_docker_directory,
     value_as_boolean,
-    SpatialiteNotFound,
-    StaticMount,
-    ValueAsBooleanError,
 )
 from .utils.sqlite import sqlite3
 from .utils.testing import TestClient
@@ -75,7 +77,7 @@ class Setting(CompositeParamType):
             # Datasette 1.0, we turn bare setting names into setting.name
             # Type checking for those older settings
             default = DEFAULT_SETTINGS[name]
-            name = "settings.{}".format(name)
+            name = f"settings.{name}"
             if isinstance(default, bool):
                 try:
                     return name, "true" if value_as_boolean(value) else "false"
@@ -171,7 +173,6 @@ async def inspect_(files, sqlite_extensions):
 @cli.group()
 def publish():
     """Publish specified SQLite database files to the internet along with a Datasette-powered interface and API"""
-    pass
 
 
 # Register publish plugins
@@ -578,27 +579,27 @@ def serve(
         # https://github.com/simonw/datasette/issues/2389
         deep_dict_update(config_data, settings_updates)
 
-    kwargs = dict(
-        immutables=immutable,
-        cache_headers=not reload,
-        cors=cors,
-        inspect_data=inspect_data,
-        config=config_data,
-        metadata=metadata_data,
-        sqlite_extensions=sqlite_extensions,
-        template_dir=template_dir,
-        plugins_dir=plugins_dir,
-        static_mounts=static,
-        settings=None,  # These are passed in config= now
-        memory=memory,
-        secret=secret,
-        version_note=version_note,
-        pdb=pdb,
-        crossdb=crossdb,
-        nolock=nolock,
-        internal=internal,
-        default_deny=default_deny,
-    )
+    kwargs = {
+        "immutables": immutable,
+        "cache_headers": not reload,
+        "cors": cors,
+        "inspect_data": inspect_data,
+        "config": config_data,
+        "metadata": metadata_data,
+        "sqlite_extensions": sqlite_extensions,
+        "template_dir": template_dir,
+        "plugins_dir": plugins_dir,
+        "static_mounts": static,
+        "settings": None,  # These are passed in config= now
+        "memory": memory,
+        "secret": secret,
+        "version_note": version_note,
+        "pdb": pdb,
+        "crossdb": crossdb,
+        "nolock": nolock,
+        "internal": internal,
+        "default_deny": default_deny,
+    }
 
     # Separate directories from files
     directories = [f for f in files if os.path.isdir(f)]
@@ -621,9 +622,7 @@ def serve(
                 conn.close()
             else:
                 raise click.ClickException(
-                    "Invalid value for '[FILES]...': Path '{}' does not exist.".format(
-                        file
-                    )
+                    f"Invalid value for '[FILES]...': Path '{file}' does not exist."
                 )
 
     # Check for duplicate files by resolving all paths to their absolute forms
@@ -684,7 +683,7 @@ def serve(
         client = TestClient(ds)
         request_headers = {}
         if token:
-            request_headers["Authorization"] = "Bearer {}".format(token)
+            request_headers["Authorization"] = f"Bearer {token}"
         cookies = {}
         if actor:
             cookies["ds_actor"] = client.actor_cookie(json.loads(actor))
@@ -719,9 +718,13 @@ def serve(
             path = run_sync(lambda: initial_path_for_datasette(ds))
             url = f"http://{host}:{port}{path}"
         webbrowser.open(url)
-    uvicorn_kwargs = dict(
-        host=host, port=port, log_level="info", lifespan="on", workers=1
-    )
+    uvicorn_kwargs = {
+        "host": host,
+        "port": port,
+        "log_level": "info",
+        "lifespan": "on",
+        "workers": 1,
+    }
     if uds:
         uvicorn_kwargs["uds"] = uds
     if ssl_keyfile:
@@ -885,7 +888,7 @@ async def check_databases(ds):
             )
         except ConnectionProblem as e:
             raise click.UsageError(
-                f"Connection to {database.path} failed check: {str(e.args[0])}"
+                f"Connection to {database.path} failed check: {e.args[0]!s}"
             )
     # If --crossdb and more than SQLITE_LIMIT_ATTACHED show warning
     if (
@@ -893,9 +896,5 @@ async def check_databases(ds):
         and len([db for db in ds.databases.values() if not db.is_memory])
         > SQLITE_LIMIT_ATTACHED
     ):
-        msg = (
-            "Warning: --crossdb only works with the first {} attached databases".format(
-                SQLITE_LIMIT_ATTACHED
-            )
-        )
+        msg = f"Warning: --crossdb only works with the first {SQLITE_LIMIT_ATTACHED} attached databases"
         click.echo(click.style(msg, bold=True, fg="yellow"), err=True)
diff --git a/datasette/column_types.py b/datasette/column_types.py
index 11a14ec0..92fdd969 100644
--- a/datasette/column_types.py
+++ b/datasette/column_types.py
@@ -64,14 +64,14 @@ class ColumnType:
         Return an HTML string to render this cell value, or None to
         fall through to the default render_cell plugin hook chain.
         """
-        return None
+        return
 
     async def validate(self, value, datasette):
         """
         Validate a value before it is written. Return None if valid,
         or a string error message if invalid.
         """
-        return None
+        return
 
     async def transform_value(self, value, datasette):
         """
diff --git a/datasette/csrf.py b/datasette/csrf.py
index df239aee..a62f9473 100644
--- a/datasette/csrf.py
+++ b/datasette/csrf.py
@@ -40,12 +40,12 @@ def _origin_tuple(value):
     scheme = (parsed.scheme or "").lower()
     host = (parsed.hostname or "").lower()
     if not scheme or not host:
-        raise ValueError("missing scheme or host in {!r}".format(value))
+        raise ValueError(f"missing scheme or host in {value!r}")
     port = parsed.port  # may raise ValueError on bad ports
     if port is None:
         port = DEFAULT_PORTS.get(scheme)
     if port is None:
-        raise ValueError("unknown default port for scheme {!r}".format(scheme))
+        raise ValueError(f"unknown default port for scheme {scheme!r}")
     return scheme, host, port
 
 
@@ -125,9 +125,7 @@ class CrossOriginProtectionMiddleware:
                 return
             await self._forbid(
                 send,
-                "Sec-Fetch-Site was {!r}, expected 'same-origin' or 'none'".format(
-                    sec_fetch_site
-                ),
+                f"Sec-Fetch-Site was {sec_fetch_site!r}, expected 'same-origin' or 'none'",
             )
             return
 
@@ -141,11 +139,11 @@ class CrossOriginProtectionMiddleware:
         request_scheme = self._request_scheme(scope)
         try:
             origin_tuple = _origin_tuple(origin)
-            expected_tuple = _origin_tuple("{}://{}".format(request_scheme, host))
+            expected_tuple = _origin_tuple(f"{request_scheme}://{host}")
         except ValueError:
             await self._forbid(
                 send,
-                "Malformed Origin {!r} or Host {!r}".format(origin, host),
+                f"Malformed Origin {origin!r} or Host {host!r}",
             )
             return
 
@@ -155,7 +153,7 @@ class CrossOriginProtectionMiddleware:
 
         await self._forbid(
             send,
-            "Origin {!r} does not match Host {!r}".format(origin, host),
+            f"Origin {origin!r} does not match Host {host!r}",
         )
 
     def _request_scheme(self, scope):
@@ -163,7 +161,8 @@ class CrossOriginProtectionMiddleware:
             try:
                 if self.datasette.setting("force_https_urls"):
                     return "https"
-            except Exception:
+            except Exception:  # noqa: BLE001, S110
+                # Settings may not be readable this early; fall back to the ASGI scheme
                 pass
         return scope.get("scheme") or "http"
 
diff --git a/datasette/database.py b/datasette/database.py
index e7fe1ed9..e162d34e 100644
--- a/datasette/database.py
+++ b/datasette/database.py
@@ -1,33 +1,35 @@
 import asyncio
 import atexit
-from collections import namedtuple
 import inspect
 import os
-from pathlib import Path
 import queue
-import sqlite_utils
 import sys
 import tempfile
 import threading
 import uuid
+from collections import namedtuple
+from pathlib import Path
 
+import sqlite_utils
+
+from .inspect import inspect_hash
 from .tracer import trace
 from .utils import (
     call_with_supported_arguments,
     detect_fts,
     detect_primary_keys,
     detect_spatialite,
+    escape_sqlite,
     get_all_foreign_keys,
     get_outbound_foreign_keys,
     md5_not_usedforsecurity,
-    sqlite_timelimit,
     sqlite3,
-    table_columns,
+    sqlite_timelimit,
     table_column_details,
+    table_columns,
 )
 from .utils.sql_analysis import SQLAnalysis, analyze_sql_tables
 from .utils.sqlite import sqlite_hidden_table_names
-from .inspect import inspect_hash
 
 connections = threading.local()
 
@@ -98,9 +100,7 @@ class Database:
 
     def _check_not_closed(self):
         if self._closed:
-            raise DatasetteClosedError(
-                "Database {!r} has been closed".format(self.name)
-            )
+            raise DatasetteClosedError(f"Database {self.name!r} has been closed")
 
     def _remove_pending_execute_future(self, future):
         with self._pending_execute_futures_lock:
@@ -139,7 +139,7 @@ class Database:
         if write:
             extra_kwargs["isolation_level"] = "IMMEDIATE"
         if self.memory_name:
-            uri = "file:{}?mode=memory&cache=shared".format(self.memory_name)
+            uri = f"file:{self.memory_name}?mode=memory&cache=shared"
             conn = sqlite3.connect(
                 uri, uri=True, check_same_thread=False, **extra_kwargs
             )
@@ -192,21 +192,20 @@ class Database:
             write_thread.join(timeout=10)
             if write_thread.is_alive():
                 sys.stderr.write(
-                    "Datasette: write thread for {!r} did not exit within 10s\n".format(
-                        self.name
-                    )
+                    f"Datasette: write thread for {self.name!r} did not exit within 10s\n"
                 )
                 sys.stderr.flush()
         for future in pending_execute_futures:
             try:
                 future.result()
-            except Exception:
+            except Exception:  # noqa: BLE001, S110
+                # Shutdown teardown - a failed pending write must not block close()
                 pass
         # Close anything still tracked in _all_file_connections
         for connection in self._all_file_connections:
             try:
                 connection.close()
-            except Exception:
+            except Exception:  # noqa: BLE001, S110
                 pass
         self._all_file_connections = []
         # Drop per-thread cached read connections we can reach
@@ -218,13 +217,13 @@ class Database:
         if self._read_connection is not None:
             try:
                 self._read_connection.close()
-            except Exception:
+            except Exception:  # noqa: BLE001, S110
                 pass
             self._read_connection = None
         if self._write_connection is not None:
             try:
                 self._write_connection.close()
-            except Exception:
+            except Exception:  # noqa: BLE001, S110
                 pass
             self._write_connection = None
         if self.is_temp_disk:
@@ -246,6 +245,7 @@ class Database:
         request=None,
         return_all=False,
         returning_limit=EXECUTE_WRITE_RETURNING_LIMIT,
+        transaction=True,
     ):
         self._check_not_closed()
         if returning_limit < 0:
@@ -258,7 +258,9 @@ class Database:
             )
 
         with trace("sql", database=self.name, sql=sql.strip(), params=params):
-            results = await self.execute_write_fn(_inner, block=block, request=request)
+            results = await self.execute_write_fn(
+                _inner, block=block, request=request, transaction=transaction
+            )
         return results
 
     async def execute_write_script(self, sql, block=True, request=None):
@@ -348,6 +350,7 @@ class Database:
                 self.ds._prepare_connection(self._write_connection, self.name)
             if transaction:
                 with self._write_connection:
+                    self._write_connection.execute("BEGIN IMMEDIATE")
                     result = fn(self._write_connection)
             else:
                 result = fn(self._write_connection)
@@ -366,7 +369,8 @@ class Database:
             async def _dispatch_events_after_write():
                 try:
                     await reply_future
-                except Exception:
+                except Exception:  # noqa: BLE001
+                    # The write failed; skip success events regardless of why
                     # if the write failed, don't emit success events
                     return
                 for event in pending_events:
@@ -419,9 +423,7 @@ class Database:
             self._write_thread = threading.Thread(
                 target=self._execute_writes, daemon=True
             )
-            self._write_thread.name = "_execute_writes for database {}".format(
-                self.name
-            )
+            self._write_thread.name = f"_execute_writes for database {self.name}"
             self._write_thread.start()
         task_id = uuid.uuid5(uuid.NAMESPACE_DNS, "datasette.io")
         loop = asyncio.get_running_loop()
@@ -442,7 +444,8 @@ class Database:
         try:
             conn = self.connect(write=True)
             self.ds._prepare_connection(conn, self.name)
-        except Exception as e:
+        except Exception as e:  # noqa: BLE001
+            # Stored and re-raised to whoever queues the next write
             conn_exception = e
         while True:
             task = self._write_queue.get()
@@ -450,7 +453,8 @@ class Database:
                 if conn is not None:
                     try:
                         conn.close()
-                    except Exception:
+                    except Exception:  # noqa: BLE001, S110
+                        # Best-effort close as the write thread exits
                         pass
                 return
             exception = None
@@ -469,19 +473,21 @@ class Database:
                         except ValueError:
                             # Was probably a memory connection
                             pass
-                except Exception as e:
-                    sys.stderr.write("{}\n".format(e))
+                except Exception as e:  # noqa: BLE001
+                    # Write thread must survive any task failure or the database wedges
+                    sys.stderr.write(f"{e}\n")
                     sys.stderr.flush()
                     exception = e
             else:
                 try:
                     if task.transaction:
                         with conn:
+                            conn.execute("BEGIN IMMEDIATE")
                             result = task.fn(conn)
                     else:
                         result = task.fn(conn)
-                except Exception as e:
-                    sys.stderr.write("{}\n".format(e))
+                except Exception as e:  # noqa: BLE001
+                    sys.stderr.write(f"{e}\n")
                     sys.stderr.flush()
                     exception = e
             _deliver_write_result(task, result, exception)
@@ -548,9 +554,7 @@ class Database:
                         raise QueryInterrupted(e, sql, params)
                     if log_sql_errors:
                         sys.stderr.write(
-                            "ERROR: conn={}, sql = {}, params = {}: {}\n".format(
-                                conn, repr(sql), params, e
-                            )
+                            f"ERROR: conn={conn}, sql = {sql!r}, params = {params}: {e}\n"
                         )
                         sys.stderr.flush()
                     raise
@@ -603,7 +607,7 @@ class Database:
             try:
                 table_count = (
                     await self.execute(
-                        f"select count(*) from (select * from [{table}] limit {self.count_limit + 1})",
+                        f"select count(*) from (select * from {escape_sqlite(table)} limit {self.count_limit + 1})",
                         custom_time_limit=limit,
                     )
                 ).rows[0][0]
@@ -707,9 +711,9 @@ class Database:
             column_names
             and len(column_names) == 2
             and ("id" in column_names or "pk" in column_names)
-            and not set(column_names) == {"id", "pk"}
+            and set(column_names) != {"id", "pk"}
         ):
-            return [c for c in column_names if c not in ("id", "pk")][0]
+            return next(c for c in column_names if c not in ("id", "pk"))
         # Couldn't find a label:
         return None
 
@@ -851,10 +855,10 @@ def _apply_write_wrapper(fn, wrapper_factory, track_event):
 class WriteTask:
     __slots__ = (
         "fn",
-        "task_id",
+        "isolated_connection",
         "loop",
         "reply_future",
-        "isolated_connection",
+        "task_id",
         "transaction",
     )
 
@@ -895,7 +899,7 @@ class QueryInterrupted(Exception):
         self.params = params
 
     def __str__(self):
-        return "QueryInterrupted: {}".format(self.e)
+        return f"QueryInterrupted: {self.e}"
 
 
 class MultipleValues(Exception):
diff --git a/datasette/default_actions.py b/datasette/default_actions.py
index 2f78570b..ee165ae5 100644
--- a/datasette/default_actions.py
+++ b/datasette/default_actions.py
@@ -2,8 +2,8 @@ from datasette import hookimpl
 from datasette.permissions import Action
 from datasette.resources import (
     DatabaseResource,
-    TableResource,
     QueryResource,
+    TableResource,
 )
 
 
@@ -61,6 +61,12 @@ def register_actions():
             description="Create tables",
             resource_class=DatabaseResource,
         ),
+        Action(
+            name="create-view",
+            abbr="cv",
+            description="Create views",
+            resource_class=DatabaseResource,
+        ),
         Action(
             name="store-query",
             abbr="sq",
@@ -111,6 +117,12 @@ def register_actions():
             description="Drop tables",
             resource_class=TableResource,
         ),
+        Action(
+            name="drop-view",
+            abbr="dv",
+            description="Drop views",
+            resource_class=TableResource,
+        ),
         # Query-level actions (child-level)
         Action(
             name="view-query",
diff --git a/datasette/default_magic_parameters.py b/datasette/default_magic_parameters.py
index 91c1c5aa..bff5f0a7 100644
--- a/datasette/default_magic_parameters.py
+++ b/datasette/default_magic_parameters.py
@@ -1,8 +1,9 @@
-from datasette import hookimpl
 import datetime
 import os
 import time
 
+from datasette import hookimpl
+
 
 def header(key, request):
     key = key.replace("_", "-").encode("utf-8")
diff --git a/datasette/default_permissions/__init__.py b/datasette/default_permissions/__init__.py
index 6cd46f04..dee5df42 100644
--- a/datasette/default_permissions/__init__.py
+++ b/datasette/default_permissions/__init__.py
@@ -17,18 +17,29 @@ UNION/INTERSECT operations. The order of evaluation is:
 
 from __future__ import annotations
 
-# Re-export all hooks and public utilities
-from .restrictions import (
-    actor_restrictions_sql as actor_restrictions_sql,
-    restrictions_allow_action as restrictions_allow_action,
-    ActorRestrictions as ActorRestrictions,
-)
-from .root import root_user_permissions_sql as root_user_permissions_sql
 from .config import config_permissions_sql as config_permissions_sql
+from .defaults import (
+    DEFAULT_ALLOW_ACTIONS as DEFAULT_ALLOW_ACTIONS,
+)
+from .defaults import (
+    default_action_permissions_sql as default_action_permissions_sql,
+)
 from .defaults import (
     # Avoid "datasette.default_permissions" does not explicitly export attribute
     default_allow_sql_check as default_allow_sql_check,
-    default_action_permissions_sql as default_action_permissions_sql,
-    default_query_permissions_sql as default_query_permissions_sql,
-    DEFAULT_ALLOW_ACTIONS as DEFAULT_ALLOW_ACTIONS,
 )
+from .defaults import (
+    default_query_permissions_sql as default_query_permissions_sql,
+)
+from .restrictions import (
+    ActorRestrictions as ActorRestrictions,
+)
+
+# Re-export all hooks and public utilities
+from .restrictions import (
+    actor_restrictions_sql as actor_restrictions_sql,
+)
+from .restrictions import (
+    restrictions_allow_action as restrictions_allow_action,
+)
+from .root import root_user_permissions_sql as root_user_permissions_sql
diff --git a/datasette/default_permissions/config.py b/datasette/default_permissions/config.py
index aab87c1c..4494f07f 100644
--- a/datasette/default_permissions/config.py
+++ b/datasette/default_permissions/config.py
@@ -6,7 +6,7 @@ Applies permission rules from datasette.yaml configuration.
 
 from __future__ import annotations
 
-from typing import TYPE_CHECKING, Any, List, Optional, Set, Tuple
+from typing import TYPE_CHECKING, Any
 
 if TYPE_CHECKING:
     from datasette.app import Datasette
@@ -55,8 +55,8 @@ class ConfigPermissionProcessor:
 
     def __init__(
         self,
-        datasette: "Datasette",
-        actor: Optional[dict],
+        datasette: Datasette,
+        actor: dict | None,
         action: str,
     ):
         self.datasette = datasette
@@ -74,8 +74,8 @@ class ConfigPermissionProcessor:
         self.restrictions = actor.get("_r", {}) if actor else {}
 
         # Pre-compute restriction info for efficiency
-        self.restricted_databases: Set[str] = set()
-        self.restricted_tables: Set[Tuple[str, str]] = set()
+        self.restricted_databases: set[str] = set()
+        self.restricted_tables: set[tuple[str, str]] = set()
 
         if self.has_restrictions:
             self.restricted_databases = {
@@ -92,16 +92,20 @@ class ConfigPermissionProcessor:
             # Tables implicitly reference their parent databases
             self.restricted_databases.update(db for db, _ in self.restricted_tables)
 
-    def evaluate_allow_block(self, allow_block: Any) -> Optional[bool]:
+    def evaluate_allow_block(self, allow_block: Any) -> bool | None:
         """Evaluate an allow block against the current actor."""
         if allow_block is None:
             return None
+        # Values passed using ``-s permissions.* 1`` or ``0`` are parsed as
+        # integers, but should retain the CLI's boolean 1/0 behavior.
+        if isinstance(allow_block, int) and allow_block in (0, 1):
+            return bool(allow_block)
         return actor_matches_allow(self.actor, allow_block)
 
     def is_in_restriction_allowlist(
         self,
-        parent: Optional[str],
-        child: Optional[str],
+        parent: str | None,
+        child: str | None,
     ) -> bool:
         """Check if resource is allowed by actor restrictions."""
         if not self.has_restrictions:
@@ -143,9 +147,9 @@ class ConfigPermissionProcessor:
 
     def add_permissions_rule(
         self,
-        parent: Optional[str],
-        child: Optional[str],
-        permissions_block: Optional[dict],
+        parent: str | None,
+        child: str | None,
+        permissions_block: dict | None,
         scope_desc: str,
     ) -> None:
         """Add a rule from a permissions:{action} block."""
@@ -165,8 +169,8 @@ class ConfigPermissionProcessor:
 
     def add_allow_block_rule(
         self,
-        parent: Optional[str],
-        child: Optional[str],
+        parent: str | None,
+        child: str | None,
         allow_block: Any,
         scope_desc: str,
     ) -> None:
@@ -198,8 +202,8 @@ class ConfigPermissionProcessor:
 
     def _add_restriction_gate_denies(
         self,
-        parent: Optional[str],
-        child: Optional[str],
+        parent: str | None,
+        child: str | None,
         is_allowed: bool,
         scope_desc: str,
     ) -> None:
@@ -231,7 +235,7 @@ class ConfigPermissionProcessor:
                     if db_name == parent:
                         self.collector.add(db_name, table_name, False, reason)
 
-    def process(self) -> Optional[PermissionSQL]:
+    def process(self) -> PermissionSQL | None:
         """Process all config rules and return combined PermissionSQL."""
         self._process_root_permissions()
         self._process_databases()
@@ -421,10 +425,10 @@ class ConfigPermissionProcessor:
 
 @hookimpl(specname="permission_resources_sql")
 async def config_permissions_sql(
-    datasette: "Datasette",
-    actor: Optional[dict],
+    datasette: Datasette,
+    actor: dict | None,
     action: str,
-) -> Optional[List[PermissionSQL]]:
+) -> list[PermissionSQL] | None:
     """
     Apply permission rules from datasette.yaml configuration.
 
diff --git a/datasette/default_permissions/defaults.py b/datasette/default_permissions/defaults.py
index 5bc74425..6f97812b 100644
--- a/datasette/default_permissions/defaults.py
+++ b/datasette/default_permissions/defaults.py
@@ -6,7 +6,7 @@ Provides default allow rules for standard view/execute actions.
 
 from __future__ import annotations
 
-from typing import TYPE_CHECKING, Optional
+from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
     from datasette.app import Datasette
@@ -29,29 +29,28 @@ DEFAULT_ALLOW_ACTIONS = frozenset(
 
 @hookimpl(specname="permission_resources_sql")
 async def default_allow_sql_check(
-    datasette: "Datasette",
-    actor: Optional[dict],
+    datasette: Datasette,
+    actor: dict | None,
     action: str,
-) -> Optional[PermissionSQL]:
+) -> PermissionSQL | None:
     """
     Enforce the default_allow_sql setting.
 
     When default_allow_sql is false (the default), execute-sql is denied
     unless explicitly allowed by config or other rules.
     """
-    if action == "execute-sql":
-        if not datasette.setting("default_allow_sql"):
-            return PermissionSQL.deny(reason="default_allow_sql is false")
+    if action == "execute-sql" and not datasette.setting("default_allow_sql"):
+        return PermissionSQL.deny(reason="default_allow_sql is false")
 
     return None
 
 
 @hookimpl(specname="permission_resources_sql")
 async def default_action_permissions_sql(
-    datasette: "Datasette",
-    actor: Optional[dict],
+    datasette: Datasette,
+    actor: dict | None,
     action: str,
-) -> Optional[PermissionSQL]:
+) -> PermissionSQL | None:
     """
     Provide default allow rules for standard view/execute actions.
 
@@ -71,10 +70,10 @@ async def default_action_permissions_sql(
 
 @hookimpl(specname="permission_resources_sql")
 async def default_query_permissions_sql(
-    datasette: "Datasette",
-    actor: Optional[dict],
+    datasette: Datasette,
+    actor: dict | None,
     action: str,
-) -> Optional[PermissionSQL]:
+) -> PermissionSQL | None:
     actor_id = actor.get("id") if isinstance(actor, dict) else None
 
     if action not in {"view-query", "update-query", "delete-query"}:
diff --git a/datasette/default_permissions/helpers.py b/datasette/default_permissions/helpers.py
index 47e03569..5e59b7b4 100644
--- a/datasette/default_permissions/helpers.py
+++ b/datasette/default_permissions/helpers.py
@@ -5,7 +5,7 @@ Shared helper utilities for default permission implementations.
 from __future__ import annotations
 
 from dataclasses import dataclass
-from typing import TYPE_CHECKING, List, Optional, Set
+from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
     from datasette.app import Datasette
@@ -13,7 +13,7 @@ if TYPE_CHECKING:
 from datasette.permissions import PermissionSQL
 
 
-def get_action_name_variants(datasette: "Datasette", action: str) -> Set[str]:
+def get_action_name_variants(datasette: Datasette, action: str) -> set[str]:
     """
     Get all name variants for an action (full name and abbreviation).
 
@@ -27,7 +27,7 @@ def get_action_name_variants(datasette: "Datasette", action: str) -> Set[str]:
     return variants
 
 
-def action_in_list(datasette: "Datasette", action: str, action_list: list) -> bool:
+def action_in_list(datasette: Datasette, action: str, action_list: list) -> bool:
     """Check if an action (or its abbreviation) is in a list."""
     return bool(get_action_name_variants(datasette, action).intersection(action_list))
 
@@ -36,8 +36,8 @@ def action_in_list(datasette: "Datasette", action: str, action_list: list) -> bo
 class PermissionRow:
     """A single permission rule row."""
 
-    parent: Optional[str]
-    child: Optional[str]
+    parent: str | None
+    child: str | None
     allow: bool
     reason: str
 
@@ -46,14 +46,14 @@ class PermissionRowCollector:
     """Collects permission rows and converts them to PermissionSQL."""
 
     def __init__(self, prefix: str = "row"):
-        self.rows: List[PermissionRow] = []
+        self.rows: list[PermissionRow] = []
         self.prefix = prefix
 
     def add(
         self,
-        parent: Optional[str],
-        child: Optional[str],
-        allow: Optional[bool],
+        parent: str | None,
+        child: str | None,
+        allow: bool | None,
         reason: str,
         if_not_none: bool = False,
     ) -> None:
@@ -62,7 +62,7 @@ class PermissionRowCollector:
             return
         self.rows.append(PermissionRow(parent, child, allow, reason))
 
-    def to_permission_sql(self) -> Optional[PermissionSQL]:
+    def to_permission_sql(self) -> PermissionSQL | None:
         """Convert collected rows to a PermissionSQL object."""
         if not self.rows:
             return None
diff --git a/datasette/default_permissions/restrictions.py b/datasette/default_permissions/restrictions.py
index a22cd7e5..88e1d274 100644
--- a/datasette/default_permissions/restrictions.py
+++ b/datasette/default_permissions/restrictions.py
@@ -8,7 +8,7 @@ contains allowlists of resources the actor can access.
 from __future__ import annotations
 
 from dataclasses import dataclass
-from typing import TYPE_CHECKING, List, Optional, Set, Tuple
+from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
     from datasette.app import Datasette
@@ -23,12 +23,12 @@ from .helpers import action_in_list, get_action_name_variants
 class ActorRestrictions:
     """Parsed actor restrictions from the _r key."""
 
-    global_actions: List[str]  # _r.a - globally allowed actions
+    global_actions: list[str]  # _r.a - globally allowed actions
     database_actions: dict  # _r.d - {db_name: [actions]}
     table_actions: dict  # _r.r - {db_name: {table: [actions]}}
 
     @classmethod
-    def from_actor(cls, actor: Optional[dict]) -> Optional["ActorRestrictions"]:
+    def from_actor(cls, actor: dict | None) -> ActorRestrictions | None:
         """Parse restrictions from actor dict. Returns None if no restrictions."""
         if not actor:
             return None
@@ -44,11 +44,11 @@ class ActorRestrictions:
             table_actions=restrictions.get("r", {}),
         )
 
-    def is_action_globally_allowed(self, datasette: "Datasette", action: str) -> bool:
+    def is_action_globally_allowed(self, datasette: Datasette, action: str) -> bool:
         """Check if action is in the global allowlist."""
         return action_in_list(datasette, action, self.global_actions)
 
-    def get_allowed_databases(self, datasette: "Datasette", action: str) -> Set[str]:
+    def get_allowed_databases(self, datasette: Datasette, action: str) -> set[str]:
         """Get database names where this action is allowed."""
         allowed = set()
         for db_name, db_actions in self.database_actions.items():
@@ -57,8 +57,8 @@ class ActorRestrictions:
         return allowed
 
     def get_allowed_tables(
-        self, datasette: "Datasette", action: str
-    ) -> Set[Tuple[str, str]]:
+        self, datasette: Datasette, action: str
+    ) -> set[tuple[str, str]]:
         """Get (database, table) pairs where this action is allowed."""
         allowed = set()
         for db_name, tables in self.table_actions.items():
@@ -70,10 +70,10 @@ class ActorRestrictions:
 
 @hookimpl(specname="permission_resources_sql")
 async def actor_restrictions_sql(
-    datasette: "Datasette",
-    actor: Optional[dict],
+    datasette: Datasette,
+    actor: dict | None,
     action: str,
-) -> Optional[List[PermissionSQL]]:
+) -> list[PermissionSQL] | None:
     """
     Handle actor restriction-based permission rules.
 
@@ -140,10 +140,10 @@ async def actor_restrictions_sql(
 
 
 def restrictions_allow_action(
-    datasette: "Datasette",
+    datasette: Datasette,
     restrictions: dict,
     action: str,
-    resource: Optional[str | Tuple[str, str]],
+    resource: str | tuple[str, str] | None,
 ) -> bool:
     """
     Check if restrictions allow the requested action on the requested resource.
diff --git a/datasette/default_permissions/root.py b/datasette/default_permissions/root.py
index 4931f7ff..22d13f65 100644
--- a/datasette/default_permissions/root.py
+++ b/datasette/default_permissions/root.py
@@ -6,7 +6,7 @@ Grants full permissions to the root user when --root flag is used.
 
 from __future__ import annotations
 
-from typing import TYPE_CHECKING, Optional
+from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
     from datasette.app import Datasette
@@ -17,9 +17,9 @@ from datasette.permissions import PermissionSQL
 
 @hookimpl(specname="permission_resources_sql")
 async def root_user_permissions_sql(
-    datasette: "Datasette",
-    actor: Optional[dict],
-) -> Optional[PermissionSQL]:
+    datasette: Datasette,
+    actor: dict | None,
+) -> PermissionSQL | None:
     """
     Grant root user full permissions when --root flag is used.
     """
diff --git a/datasette/default_permissions/tokens.py b/datasette/default_permissions/tokens.py
index 7a359dc6..52daf8a2 100644
--- a/datasette/default_permissions/tokens.py
+++ b/datasette/default_permissions/tokens.py
@@ -7,7 +7,7 @@ to datasette.verify_token() so all registered handlers are tried.
 
 from __future__ import annotations
 
-from typing import TYPE_CHECKING, Optional
+from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
     from datasette.app import Datasette
@@ -17,15 +17,13 @@ from datasette.tokens import SignedTokenHandler
 
 
 @hookimpl
-def register_token_handler(datasette: "Datasette"):
+def register_token_handler(datasette: Datasette):
     """Register the default signed token handler."""
     return SignedTokenHandler()
 
 
 @hookimpl(specname="actor_from_request")
-async def actor_from_signed_api_token(
-    datasette: "Datasette", request
-) -> Optional[dict]:
+async def actor_from_signed_api_token(datasette: Datasette, request) -> dict | None:
     """
     Authenticate requests using API tokens by delegating to all registered
     token handlers via datasette.verify_token().
diff --git a/datasette/default_table_actions.py b/datasette/default_table_actions.py
new file mode 100644
index 00000000..0f2f32ef
--- /dev/null
+++ b/datasette/default_table_actions.py
@@ -0,0 +1,29 @@
+from datasette import hookimpl
+from datasette.resources import TableResource
+
+
+@hookimpl
+def table_actions(datasette, actor, database, table, request):
+    async def inner():
+        db = datasette.get_database(database)
+        if not db.is_mutable:
+            return []
+        if not await datasette.allowed(
+            action="alter-table",
+            resource=TableResource(database=database, table=table),
+            actor=actor,
+        ):
+            return []
+        return [
+            {
+                "type": "button",
+                "label": "Alter table",
+                "description": "Change columns and primary key for this table.",
+                "attrs": {
+                    "aria-label": f"Alter table {table}",
+                    "data-table-action": "alter-table",
+                },
+            }
+        ]
+
+    return inner
diff --git a/datasette/events.py b/datasette/events.py
index e8786da9..5f3fd06e 100644
--- a/datasette/events.py
+++ b/datasette/events.py
@@ -1,8 +1,9 @@
 from abc import ABC, abstractproperty
 from dataclasses import asdict, dataclass, field
-from datasette.hookspecs import hookimpl
 from datetime import datetime, timezone
 
+from datasette.hookspecs import hookimpl
+
 
 @dataclass
 class Event(ABC):
diff --git a/datasette/extras.py b/datasette/extras.py
index 5cab52a4..fb8c2e06 100644
--- a/datasette/extras.py
+++ b/datasette/extras.py
@@ -5,6 +5,8 @@ from typing import ClassVar
 
 from asyncinject import Registry
 
+from datasette.utils.asgi import BadRequest
+
 
 def extra_names_from_request(request):
     extra_bits = request.args.getlist("_extra")
@@ -81,6 +83,16 @@ class ExtraRegistry:
     def public_classes_for_scope(self, scope):
         return self.classes_for_scope(scope, include_internal=False)
 
+    def internal_classes_for_scope(self, scope):
+        # Extras that are available to HTML templates but excluded from
+        # JSON responses - plain Providers are dependency plumbing and
+        # never surface as keys, so they are not included
+        return [
+            cls
+            for cls in self.classes_for_scope(scope)
+            if issubclass(cls, Extra) and not cls.public
+        ]
+
     def _registry_for_scope(self, scope):
         registry = self._scope_registries.get(scope)
         if registry is None:
@@ -103,6 +115,17 @@ class ExtraRegistry:
             self._allowed_names[key] = names
         return names
 
+    def validate_requested(self, requested, scope):
+        """
+        Raise BadRequest if any requested extra name is not a public extra
+        for this scope. Used by data formats such as .json - HTML pages
+        silently ignore unknown names instead.
+        """
+        allowed = self._allowed_names_for_scope(scope, include_internal=False)
+        unknown = sorted(name for name in requested if name not in allowed)
+        if unknown:
+            raise BadRequest("Unknown _extra: {}".format(", ".join(unknown)))
+
     async def resolve(self, requested, context, scope, include_internal=False):
         allowed_names = self._allowed_names_for_scope(scope, include_internal)
         requested_names = [name for name in requested if name in allowed_names]
diff --git a/datasette/facets.py b/datasette/facets.py
index abe0605e..8c09e1dc 100644
--- a/datasette/facets.py
+++ b/datasette/facets.py
@@ -1,12 +1,13 @@
 import json
 import urllib
+
 from datasette import hookimpl
 from datasette.database import QueryInterrupted
 from datasette.utils import (
+    detect_json1,
     escape_sqlite,
     path_with_added_args,
     path_with_removed_args,
-    detect_json1,
     sqlite3,
 )
 
@@ -30,7 +31,7 @@ def load_facet_configs(request, table_config):
             assert (
                 len(facet_config.values()) == 1
             ), "Metadata config dicts should be {type: config}"
-            type, facet_config = list(facet_config.items())[0]
+            type, facet_config = next(iter(facet_config.items()))
             if isinstance(facet_config, str):
                 facet_config = {"simple": facet_config}
         facet_configs.setdefault(type, []).append(
@@ -85,7 +86,7 @@ class Facet:
         self.database = database
         # For foreign key expansion. Can be None for e.g. stored SQL queries:
         self.table = table
-        self.sql = sql or f"select * from [{table}]"
+        self.sql = sql or f"select * from {escape_sqlite(table)}"
         self.params = params or []
         self.table_config = table_config
         # row_count can be None, in which case we calculate it ourselves:
@@ -160,18 +161,13 @@ class ColumnFacet(Facet):
         for column in columns:
             if column in already_enabled:
                 continue
-            suggested_facet_sql = """
-                with limited as (select * from ({sql}) limit {suggest_consider})
-                select {column} as value, count(*) as n from limited
+            suggested_facet_sql = f"""
+                with limited as (select * from ({self.sql}) limit {self.suggest_consider})
+                select {escape_sqlite(column)} as value, count(*) as n from limited
                 where value is not null
                 group by value
-                limit {limit}
-            """.format(
-                column=escape_sqlite(column),
-                sql=self.sql,
-                limit=facet_size + 1,
-                suggest_consider=self.suggest_consider,
-            )
+                limit {facet_size + 1}
+            """
             distinct_values = None
             try:
                 distinct_values = await self.ds.execute(
@@ -267,7 +263,7 @@ class ColumnFacet(Facet):
                 for row in facet_rows:
                     column_qs = column
                     if column.startswith("_"):
-                        column_qs = "{}__exact".format(column)
+                        column_qs = f"{column}__exact"
                     selected = (column_qs, str(row["value"])) in qs_pairs
                     if selected:
                         toggle_path = path_with_removed_args(
@@ -342,12 +338,12 @@ class ArrayFacet(Facet):
                         for v in await self.ds.execute(
                             self.database,
                             (
-                                "select {column} from ({sql}) "
-                                "where {column} is not null "
-                                "and {column} != '' "
-                                "and json_array_length({column}) > 0 "
+                                f"select {escape_sqlite(column)} from ({self.sql}) "
+                                f"where {escape_sqlite(column)} is not null "
+                                f"and {escape_sqlite(column)} != '' "
+                                f"and json_array_length({escape_sqlite(column)}) > 0 "
                                 "limit 100"
-                            ).format(column=escape_sqlite(column), sql=self.sql),
+                            ),
                             self.params,
                             truncate=False,
                             custom_time_limit=self.ds.setting(
@@ -388,14 +384,14 @@ class ArrayFacet(Facet):
             source = source_and_config["source"]
             column = config.get("column") or config["simple"]
             # https://github.com/simonw/datasette/issues/448
-            facet_sql = """
-                with inner as ({sql}),
+            facet_sql = f"""
+                with inner as ({self.sql}),
                 deduped_array_items as (
                     select
                         distinct j.value,
                         inner.*
                     from
-                        json_each([inner].{col}) j
+                        json_each([inner].{escape_sqlite(column)}) j
                         join inner
                 )
                 select
@@ -406,12 +402,8 @@ class ArrayFacet(Facet):
                 group by
                     value
                 order by
-                    count(*) desc, value limit {limit}
-            """.format(
-                col=escape_sqlite(column),
-                sql=self.sql,
-                limit=facet_size + 1,
-            )
+                    count(*) desc, value limit {facet_size + 1}
+            """
             try:
                 facet_rows_results = await self.ds.execute(
                     self.database,
diff --git a/datasette/filters.py b/datasette/filters.py
index 95cc5f37..1d4e32c2 100644
--- a/datasette/filters.py
+++ b/datasette/filters.py
@@ -1,8 +1,11 @@
+import json
+from typing import ClassVar
+
 from datasette import hookimpl
 from datasette.resources import DatabaseResource
-from datasette.views.base import DatasetteError
 from datasette.utils.asgi import BadRequest
-import json
+from datasette.views.base import DatasetteError
+
 from .utils import detect_json1, escape_sqlite, path_with_removed_args
 
 
@@ -99,9 +102,9 @@ def search_filters(request, database, table, datasette):
                             fts_table=escape_sqlite(fts_table),
                             search_col=escape_sqlite(search_col),
                             match_clause=(
-                                ":search_{}".format(i)
+                                f":search_{i}"
                                 if search_mode_raw
-                                else "escape_fts(:search_{})".format(i)
+                                else f"escape_fts(:search_{i})"
                             ),
                         )
                     )
@@ -134,11 +137,11 @@ def through_filters(request, database, table, datasette):
                 value = through_data["value"]
                 db = datasette.get_database(database)
                 outgoing_foreign_keys = await db.foreign_keys_for_table(through_table)
-                try:
-                    fk_to_us = [
-                        fk for fk in outgoing_foreign_keys if fk["other_table"] == table
-                    ][0]
-                except IndexError:
+                fk_to_us = next(
+                    (fk for fk in outgoing_foreign_keys if fk["other_table"] == table),
+                    None,
+                )
+                if fk_to_us is None:
                     raise DatasetteError(
                         "Invalid _through - could not find corresponding foreign key"
                     )
@@ -365,7 +368,7 @@ class Filters:
             ),
         ]
     )
-    _filters_by_key = {f.key: f for f in _filters}
+    _filters_by_key: ClassVar[dict[str, Filter]] = {f.key: f for f in _filters}
 
     def __init__(self, pairs):
         self.pairs = pairs
diff --git a/datasette/fixtures.py b/datasette/fixtures.py
index 7c85e16a..049e35ed 100644
--- a/datasette/fixtures.py
+++ b/datasette/fixtures.py
@@ -1,9 +1,10 @@
-from datasette.utils.sqlite import sqlite3
-from datasette.utils import documented
 import itertools
 import random
 import string
 
+from datasette.utils import documented
+from datasette.utils.sqlite import sqlite3
+
 __all__ = [
     "EXTRA_DATABASE_SQL",
     "TABLES",
@@ -346,9 +347,7 @@ CREATE VIEW searchable_view_configured_by_metadata AS
     + '\nINSERT INTO no_primary_key VALUES ("RENDER_CELL_DEMO", "a202", "b202", "c202");\n'
     + "\n".join(
         [
-            'INSERT INTO compound_three_primary_keys VALUES ("{a}", "{b}", "{c}", "{content}");'.format(
-                a=a, b=b, c=c, content=content
-            )
+            f'INSERT INTO compound_three_primary_keys VALUES ("{a}", "{b}", "{c}", "{content}");'
             for a, b, c, content in generate_compound_rows(1001)
         ]
     )
diff --git a/datasette/forbidden.py b/datasette/forbidden.py
index 41c48396..67bf0d8b 100644
--- a/datasette/forbidden.py
+++ b/datasette/forbidden.py
@@ -1,9 +1,20 @@
-from datasette import hookimpl, Response
+from datasette import Response, hookimpl
+
+from .utils import add_cors_headers
 
 
 @hookimpl(trylast=True)
 def forbidden(datasette, request, message):
     async def inner():
+        if (
+            request.path.split("?")[0].endswith(".json")
+            or "application/json" in (request.headers.get("accept") or "")
+            or request.headers.get("content-type") == "application/json"
+        ):
+            headers = {}
+            if datasette.cors:
+                add_cors_headers(headers)
+            return Response.error(message, 403, headers=headers)
         return Response.html(
             await datasette.render_template(
                 "error.html",
diff --git a/datasette/handle_exception.py b/datasette/handle_exception.py
index 96398a4c..c36d5dbe 100644
--- a/datasette/handle_exception.py
+++ b/datasette/handle_exception.py
@@ -1,16 +1,21 @@
-from datasette import hookimpl, Response
-from .utils import add_cors_headers
+import traceback
+
+from markupsafe import Markup
+
+from datasette import Response, hookimpl
+
+from .utils import add_cors_headers, error_body
 from .utils.asgi import (
     Base400,
 )
 from .views.base import DatasetteError
-from markupsafe import Markup
-import traceback
 
+# Debugger imports are deliberate - they back the "pdb" setting, which drops
+# into a debugger on unhandled exceptions
 try:
-    import ipdb as pdb
+    import ipdb as pdb  # noqa: T100
 except ImportError:
-    import pdb
+    import pdb  # noqa: T100
 
 try:
     import rich
@@ -28,6 +33,7 @@ def handle_exception(datasette, request, exception):
             rich.get_console().print_exception(show_locals=True)
 
         title = None
+        plain_message = None
         if isinstance(exception, Base400):
             status = exception.status
             info = {}
@@ -36,6 +42,7 @@ def handle_exception(datasette, request, exception):
             status = exception.status
             info = exception.error_dict
             message = exception.message
+            plain_message = exception.plain_message
             if exception.message_is_html:
                 message = Markup(message)
             title = exception.title
@@ -45,6 +52,13 @@ def handle_exception(datasette, request, exception):
             message = str(exception)
             traceback.print_exc()
         templates = [f"{status}.html", "error.html"]
+        headers = {}
+        if datasette.cors:
+            add_cors_headers(headers)
+        if request.path.split("?")[0].endswith(".json"):
+            body = dict(info)
+            body.update(error_body(plain_message or message, status))
+            return Response.json(body, status=status, headers=headers)
         info.update(
             {
                 "ok": False,
@@ -53,25 +67,18 @@ def handle_exception(datasette, request, exception):
                 "title": title,
             }
         )
-        headers = {}
-        if datasette.cors:
-            add_cors_headers(headers)
-        if request.path.split("?")[0].endswith(".json"):
-            return Response.json(info, status=status, headers=headers)
-        else:
-            environment = datasette.get_jinja_environment(request)
-            template = environment.select_template(templates)
-            return Response.html(
-                await template.render_async(
-                    dict(
-                        info,
-                        urls=datasette.urls,
-                        app_css_hash=datasette.app_css_hash(),
-                        menu_links=lambda: [],
-                    )
-                ),
-                status=status,
-                headers=headers,
-            )
+        environment = datasette.get_jinja_environment(request)
+        template = environment.select_template(templates)
+        return Response.html(
+            await template.render_async(
+                dict(
+                    info,
+                    urls=datasette.urls,
+                    menu_links=list,
+                )
+            ),
+            status=status,
+            headers=headers,
+        )
 
     return inner
diff --git a/datasette/hookspecs.py b/datasette/hookspecs.py
index 7c56f882..f89f2f36 100644
--- a/datasette/hookspecs.py
+++ b/datasette/hookspecs.py
@@ -1,5 +1,4 @@
-from pluggy import HookimplMarker
-from pluggy import HookspecMarker
+from pluggy import HookimplMarker, HookspecMarker
 
 hookspec = HookspecMarker("datasette")
 hookimpl = HookimplMarker("datasette")
diff --git a/datasette/inspect.py b/datasette/inspect.py
index 5e681e03..b126ce5c 100644
--- a/datasette/inspect.py
+++ b/datasette/inspect.py
@@ -1,13 +1,13 @@
 import hashlib
 
 from .utils import (
-    detect_spatialite,
     detect_fts,
     detect_primary_keys,
+    detect_spatialite,
     escape_sqlite,
     get_all_foreign_keys,
-    table_columns,
     sqlite3,
+    table_columns,
 )
 
 HASH_BLOCK_SIZE = 1024 * 1024
@@ -95,10 +95,10 @@ def inspect_tables(conn, database_metadata):
                 """)
         ]
 
-    for t in tables.keys():
+    for t, table_info in tables.items():
         for hidden_table in hidden_tables:
             if t == hidden_table or t.startswith(hidden_table):
-                tables[t]["hidden"] = True
+                table_info["hidden"] = True
                 continue
 
     return tables
diff --git a/datasette/jump.py b/datasette/jump.py
index d138e827..d70d33df 100644
--- a/datasette/jump.py
+++ b/datasette/jump.py
@@ -21,7 +21,7 @@ class JumpSQL:
         search_text: str | None = None,
         display_name: str | None = None,
         item_type: str = "menu",
-    ) -> "JumpSQL":
+    ) -> JumpSQL:
         if search_text is None:
             search_text = " ".join(
                 text for text in (label, display_name, description) if text is not None
diff --git a/datasette/permissions.py b/datasette/permissions.py
index 786dc026..e03b065c 100644
--- a/datasette/permissions.py
+++ b/datasette/permissions.py
@@ -1,7 +1,7 @@
+import contextvars
 from abc import ABC, abstractmethod
 from dataclasses import dataclass
 from typing import Any, NamedTuple
-import contextvars
 
 # Context variable to track when permission checks should be skipped
 _skip_permission_checks = contextvars.ContextVar(
@@ -72,8 +72,8 @@ class Resource(ABC):
         )
 
     def __repr__(self) -> str:
-        return "{}(parent={!r}, child={!r})".format(
-            self.__class__.__name__, self.parent, self.child
+        return (
+            f"{self.__class__.__name__}(parent={self.parent!r}, child={self.child!r})"
         )
 
     @property
@@ -129,7 +129,6 @@ class Resource(ABC):
 
         Must return two columns: parent, child
         """
-        pass
 
 
 class AllowedResource(NamedTuple):
diff --git a/datasette/plugins.py b/datasette/plugins.py
index f0fbc7f8..9cf94079 100644
--- a/datasette/plugins.py
+++ b/datasette/plugins.py
@@ -1,20 +1,14 @@
 import importlib
+import importlib.metadata as importlib_metadata
+import importlib.resources as importlib_resources
 import os
-import pluggy
-from pprint import pprint
 import sys
+from pprint import pprint
+
+import pluggy
+
 from . import hookspecs
 
-if sys.version_info >= (3, 9):
-    import importlib.resources as importlib_resources
-else:
-    import importlib_resources
-if sys.version_info >= (3, 10):
-    import importlib.metadata as importlib_metadata
-else:
-    import importlib_metadata
-
-
 DEFAULT_PLUGINS = (
     "datasette.publish.heroku",
     "datasette.publish.cloudrun",
@@ -31,6 +25,7 @@ DEFAULT_PLUGINS = (
     "datasette.default_debug_menu",
     "datasette.default_jump_items",
     "datasette.default_database_actions",
+    "datasette.default_table_actions",
     "datasette.default_query_actions",
     "datasette.handle_exception",
     "datasette.forbidden",
@@ -84,7 +79,7 @@ if DATASETTE_LOAD_PLUGINS is not None:
                     # Ensure name can be found in plugin_to_distinfo later:
                     pm._plugin_distinfo.append((mod, distribution))
         except importlib_metadata.PackageNotFoundError:
-            sys.stderr.write("Plugin {} could not be found\n".format(package_name))
+            sys.stderr.write(f"Plugin {package_name} could not be found\n")
 
 
 # Load default plugins
diff --git a/datasette/publish/cloudrun.py b/datasette/publish/cloudrun.py
index 63d22fe8..9ace865b 100644
--- a/datasette/publish/cloudrun.py
+++ b/datasette/publish/cloudrun.py
@@ -1,15 +1,17 @@
-from datasette import hookimpl
-import click
 import json
 import os
 import re
 from subprocess import CalledProcessError, check_call, check_output
 
+import click
+
+from datasette import hookimpl
+
+from ..utils import temporary_docker_directory
 from .common import (
     add_common_publish_arguments_and_options,
     fail_if_publish_binary_not_installed,
 )
-from ..utils import temporary_docker_directory
 
 
 @hookimpl
@@ -219,7 +221,7 @@ def publish_subcommand(publish):
 
             check_call(
                 "gcloud builds submit --tag {}{}".format(
-                    image_id, " --timeout {}".format(timeout) if timeout else ""
+                    image_id, f" --timeout {timeout}" if timeout else ""
                 ),
                 shell=True,
             )
@@ -231,7 +233,7 @@ def publish_subcommand(publish):
             ("--min-instances", min_instances),
         ):
             if value is not None:
-                extra_deploy_options.append("{} {}".format(option, value))
+                extra_deploy_options.append(f"{option} {value}")
         check_call(
             "gcloud run deploy --allow-unauthenticated --platform=managed --image {} {}{}".format(
                 image_id,
@@ -258,24 +260,16 @@ def _ensure_artifact_registry(artifact_project, artifact_region, artifact_reposi
         ) from exc
 
     describe_cmd = (
-        "gcloud artifacts repositories describe {repo} --project {project} "
-        "--location {location} --quiet"
-    ).format(
-        repo=artifact_repository,
-        project=artifact_project,
-        location=artifact_region,
+        f"gcloud artifacts repositories describe {artifact_repository} --project {artifact_project} "
+        f"--location {artifact_region} --quiet"
     )
     try:
         check_call(describe_cmd, shell=True)
         return
     except CalledProcessError:
         create_cmd = (
-            "gcloud artifacts repositories create {repo} --repository-format=docker "
-            '--location {location} --project {project} --description "Datasette Cloud Run images" --quiet'
-        ).format(
-            repo=artifact_repository,
-            location=artifact_region,
-            project=artifact_project,
+            f"gcloud artifacts repositories create {artifact_repository} --repository-format=docker "
+            f'--location {artifact_region} --project {artifact_project} --description "Datasette Cloud Run images" --quiet'
         )
         try:
             check_call(create_cmd, shell=True)
diff --git a/datasette/publish/common.py b/datasette/publish/common.py
index 29665eb3..27dfd4bf 100644
--- a/datasette/publish/common.py
+++ b/datasette/publish/common.py
@@ -1,9 +1,11 @@
-from ..utils import StaticMount
-import click
 import os
 import shutil
 import sys
 
+import click
+
+from ..utils import StaticMount
+
 
 def add_common_publish_arguments_and_options(subcommand):
     for decorator in reversed(
@@ -76,9 +78,7 @@ def fail_if_publish_binary_not_installed(binary, publish_target, install_link):
     """Exit (with error message) if ``binary` isn't installed"""
     if not shutil.which(binary):
         click.secho(
-            "Publishing to {publish_target} requires {binary} to be installed and configured".format(
-                publish_target=publish_target, binary=binary
-            ),
+            f"Publishing to {publish_target} requires {binary} to be installed and configured",
             bg="red",
             fg="white",
             bold=True,
diff --git a/datasette/publish/heroku.py b/datasette/publish/heroku.py
index f576a346..b0290833 100644
--- a/datasette/publish/heroku.py
+++ b/datasette/publish/heroku.py
@@ -1,19 +1,21 @@
-from contextlib import contextmanager
-from datasette import hookimpl
-import click
 import json
 import os
 import pathlib
 import shlex
 import shutil
-from subprocess import call, check_output
 import tempfile
+from contextlib import contextmanager
+from subprocess import call, check_output
+
+import click
+
+from datasette import hookimpl
+from datasette.utils import link_or_copy, link_or_copy_directory, parse_metadata
 
 from .common import (
     add_common_publish_arguments_and_options,
     fail_if_publish_binary_not_installed,
 )
-from datasette.utils import link_or_copy, link_or_copy_directory, parse_metadata
 
 
 @hookimpl
@@ -234,7 +236,7 @@ def temporary_heroku_directory(
             extras.extend(["--static", f"{mount_point}:{mount_point}"])
 
         quoted_files = " ".join(
-            ["-i {}".format(shlex.quote(file_name)) for file_name in file_names]
+            [f"-i {shlex.quote(file_name)}" for file_name in file_names]
         )
         procfile_cmd = "web: datasette serve --host 0.0.0.0 {quoted_files} --cors --port $PORT --inspect-file inspect-data.json {extras}".format(
             quoted_files=quoted_files, extras=" ".join(extras)
diff --git a/datasette/renderer.py b/datasette/renderer.py
index f40e3dbb..0e01f52f 100644
--- a/datasette/renderer.py
+++ b/datasette/renderer.py
@@ -1,11 +1,13 @@
 import json
+
 from datasette.extras import extra_names_from_request
 from datasette.utils import (
-    value_as_boolean,
-    remove_infinites,
     CustomJSONEncoder,
+    error_body,
     path_from_row_pks,
+    remove_infinites,
     sqlite3,
+    value_as_boolean,
 )
 from datasette.utils.asgi import Response
 
@@ -52,8 +54,7 @@ def json_renderer(request, args, data, error, truncated=None):
     if error:
         shape = "objects"
         status_code = 400
-        data["error"] = error
-        data["ok"] = False
+        data.update(error_body(error, status_code))
 
     if truncated is not None:
         data["truncated"] = truncated
@@ -87,7 +88,8 @@ def json_renderer(request, args, data, error, truncated=None):
                         object_rows[pk_string] = row
                     data = object_rows
             if shape_error:
-                data = {"ok": False, "error": shape_error}
+                status_code = 400
+                data = error_body(shape_error, status_code)
         elif shape == "array":
             data = data["rows"]
 
@@ -100,12 +102,7 @@ def json_renderer(request, args, data, error, truncated=None):
             data["rows"] = [list(row.values()) for row in data["rows"]]
     else:
         status_code = 400
-        data = {
-            "ok": False,
-            "error": f"Invalid _shape: {shape}",
-            "status": 400,
-            "title": None,
-        }
+        data = error_body(f"Invalid _shape: {shape}", status_code)
 
     # Don't include "columns" in output
     # https://github.com/simonw/datasette/issues/2136
diff --git a/datasette/static/app.css b/datasette/static/app.css
index 5fe4502d..d101e4b7 100644
--- a/datasette/static/app.css
+++ b/datasette/static/app.css
@@ -609,9 +609,6 @@ button.core[type=button] {
     border-color: #007bff;
 }
 
-.filter-row {
-    margin-bottom: 0.6em;
-}
 .search-row {
     margin-bottom: 1.8em;
 }
@@ -623,72 +620,239 @@ button.core[type=button] {
     width: 80px;
 }
 
-.select-wrapper {
-    border: 1px solid #ccc;
-    width: 120px;
-    border-radius: 3px;
+.filters .search-row {
+    box-sizing: border-box;
+    display: grid;
+    grid-template-columns: max-content minmax(16rem, 1fr);
+    align-items: center;
+    gap: 0.6rem;
+    margin: 0 0 0.45rem;
+    padding-right: var(--filter-two-icon-space);
+}
+
+.filters .search-row label {
+    width: auto;
     padding: 0;
-    background-color: #fafafa;
-    position: relative;
+    color: var(--filter-muted);
+    font-size: 0.875rem;
+    font-weight: 600;
+}
+
+.filters {
+    --filter-ink: #0f0f0f;
+    --filter-paper: #eef6ff;
+    --filter-muted: #6b6b6b;
+    --filter-rule: #d8e6f5;
+    --filter-accent: #1a56db;
+    --filter-control-border: #bfccd9;
+    --filter-control-height: 2.125rem;
+    --filter-control-gap: 0.4rem;
+    --filter-row-icon-size: 2rem;
+    --filter-two-icon-space: calc(
+        (2 * var(--filter-row-icon-size)) + (2 * var(--filter-control-gap))
+    );
+    display: grid;
+    grid-template-columns: minmax(0, 1fr);
+    gap: 0.55rem;
+    max-width: 760px;
+    margin: 0 0 1rem;
+    padding: 0.75rem;
+    border: 1px solid var(--filter-rule);
+    border-radius: 8px;
+    background: var(--filter-paper);
+    color: var(--filter-ink);
+    font-size: 0.875rem;
+}
+
+.filters .filter-row {
+    margin-bottom: 0;
+}
+
+.filters .filter-controls-row {
+    display: grid;
+    min-width: 0;
+    width: 100%;
+    max-width: 100%;
+    box-sizing: border-box;
+    grid-template-columns:
+        minmax(8rem, 0.75fr)
+        minmax(6.5rem, 0.5fr)
+        minmax(12rem, 1.2fr)
+        var(--filter-row-icon-size)
+        var(--filter-row-icon-size);
+    gap: var(--filter-control-gap);
+    align-items: center;
+}
+
+.filters .filter-actions-row {
+    display: flex;
+    align-items: center;
+    justify-content: flex-start;
+    flex-wrap: wrap;
+    gap: 0.6rem;
+}
+
+.select-wrapper {
     display: inline-block;
-    margin-right: 0.3em;
-}
-.select-wrapper:focus-within {
-    border: 1px solid black;
+    width: 120px;
+    min-width: 0;
 }
+
 .select-wrapper.filter-op {
     width: 80px;
 }
-.select-wrapper::after {
-    content: "\25BE";
-    position: absolute;
-    top: 0px;
-    right: 0.4em;
-    color: #bbb;
-    pointer-events: none;
-    font-size: 1.2em;
-    padding-top: 0.16em;
+
+.filters .select-wrapper {
+    width: auto;
 }
 
 .select-wrapper select {
-    padding: 9px 8px;
+    box-sizing: border-box;
     width: 100%;
-    border: none;
-    box-shadow: none;
-    background: transparent;
-    background-image: none;
-    -webkit-appearance: none;
-    -moz-appearance: none;
+    height: var(--filter-control-height);
+    border: 1px solid var(--filter-control-border, #ccc);
+    border-radius: 5px;
+    background-color: #fff;
+    color: inherit;
     cursor: pointer;
+    font-family: inherit;
+    font-size: 0.875rem;
+    line-height: 1.25;
+    padding: 7px 8px;
 }
-.select-wrapper select {
-    font-size: 1em;
-    font-family: Helvetica, sans-serif;
-}
+
 .select-wrapper option {
     font-size: 1em;
     font-family: Helvetica, sans-serif;
 }
 
 .select-wrapper select:focus {
+    border-color: var(--filter-accent, #000);
+    box-shadow: 0 0 0 2px rgba(26, 86, 219, 0.14);
     outline: none;
 }
-.filters {
-    font-size: 0.8em;
-}
 .filters input.filter-value {
-    width: 200px;
-    border-radius: 3px;
-    -webkit-appearance: none;
-    padding: 9px 4px;
-    font-size: 16px;
-    font-family: Helvetica, sans-serif;
+    box-sizing: border-box;
+    width: 100%;
+    min-width: 0;
+    height: var(--filter-control-height);
+    border: 1px solid var(--filter-control-border);
+    border-radius: 5px;
+    background: #fff;
+    color: inherit;
+    font-family: inherit;
+    font-size: 0.875rem;
+    line-height: 1.25;
+    padding: 7px 9px;
+}
+
+.filters input.filter-value:focus {
+    border-color: var(--filter-accent);
+    box-shadow: 0 0 0 2px rgba(26, 86, 219, 0.14);
+    outline: none;
+}
+
+.filters input[type=submit] {
+    border-color: var(--filter-accent);
+    background: var(--filter-accent);
+    border-radius: 5px;
+    font-weight: 500;
+    padding: 0.55rem 0.85rem;
+}
+
+.filters input[type=submit]:hover,
+.filters input[type=submit]:focus {
+    background: #1949b8;
+    border-color: #1949b8;
+}
+
+.filters button.filter-row-icon {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    box-sizing: border-box;
+    width: var(--filter-row-icon-size);
+    height: var(--filter-row-icon-size);
+    min-width: var(--filter-row-icon-size);
+    padding: 0;
+    border: 1px solid var(--filter-rule);
+    border-radius: 5px;
+    background: #fff;
+    color: var(--filter-muted);
+    font-family: inherit;
+    font-size: 1.15rem;
+    font-weight: 600;
+    line-height: 1;
+}
+
+.filters button.filter-row-icon[hidden] {
+    display: none;
+}
+
+.filters button.filter-row-icon:focus-visible {
+    outline: 3px solid rgba(26, 86, 219, 0.14);
+    outline-offset: 2px;
+}
+
+.filters .filter-row-remove-icon {
+    display: block;
+    height: 14px;
+    width: 14px;
+}
+
+.filters button.filter-row-remove:hover,
+.filters button.filter-row-remove:focus {
+    border-color: #c9d5e3;
+    background: #f8fbff;
+    color: var(--filter-ink);
+}
+
+.filters button.filter-row-add {
+    border-color: var(--filter-accent);
+    background: var(--filter-accent);
+    color: #fff;
+}
+
+.filters .filter-row-add-icon {
+    display: block;
+    height: 16px;
+    width: 16px;
+}
+
+.filters button.filter-row-add:hover,
+.filters button.filter-row-add:focus {
+    border-color: #1949b8;
+    background: #1949b8;
+    color: #fff;
+}
+
+.filters button.filter-row-add:focus-visible svg {
+    color: #fff;
+    stroke: currentColor;
 }
 
 #_search {
     font-size: 16px;
 }
 
+.filters #_search {
+    box-sizing: border-box;
+    width: 100%;
+    height: var(--filter-control-height);
+    border: 1px solid var(--filter-control-border);
+    border-radius: 5px;
+    background: #fff;
+    color: var(--filter-ink);
+    font: inherit;
+    padding: 7px 9px;
+}
+
+.filters #_search:focus {
+    border-color: var(--filter-accent);
+    box-shadow: 0 0 0 2px rgba(26, 86, 219, 0.14);
+    outline: none;
+}
+
 
 
 
@@ -1477,6 +1641,11 @@ dialog.row-edit-dialog::backdrop {
     overflow-y: auto;
 }
 
+.row-edit-fields[hidden],
+.row-edit-bulk[hidden] {
+    display: none;
+}
+
 .row-edit-field {
     display: grid;
     grid-template-columns: minmax(120px, 180px) minmax(0, 1fr);
@@ -1536,6 +1705,118 @@ textarea.row-edit-input {
     background: var(--paper);
 }
 
+.row-edit-binary-control {
+    display: grid;
+    gap: 8px;
+    box-sizing: border-box;
+    width: 100%;
+    min-width: 0;
+    border: 1px solid var(--rule);
+    border-radius: 5px;
+    padding: 10px;
+    background: #fff;
+}
+
+.row-edit-binary-control:focus {
+    border-color: var(--accent);
+    outline: 3px solid rgba(26, 86, 219, 0.12);
+}
+
+.row-edit-binary-preview[hidden] {
+    display: none;
+}
+
+.row-edit-binary-preview img {
+    display: block;
+    max-width: min(240px, 100%);
+    max-height: 180px;
+    border: 1px solid var(--rule);
+    border-radius: 4px;
+    background: var(--paper);
+}
+
+.row-edit-binary-status {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: baseline;
+    gap: 8px;
+    min-width: 0;
+}
+
+.row-edit-binary-size {
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 0.86rem;
+}
+
+.row-edit-binary-name {
+    color: var(--muted);
+    font-size: 0.82rem;
+    overflow-wrap: anywhere;
+}
+
+.row-edit-binary-name[hidden] {
+    display: none;
+}
+
+.row-edit-binary-actions {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 8px;
+}
+
+.row-edit-binary-file-button,
+.row-edit-binary-clear {
+    appearance: none;
+    border: 1px solid var(--rule);
+    border-radius: 4px;
+    background: #fff;
+    color: var(--accent);
+    cursor: pointer;
+    font: inherit;
+    font-size: 0.78rem;
+    line-height: 1.2;
+    padding: 6px 8px;
+}
+
+.row-edit-binary-file-button:hover,
+.row-edit-binary-file-button:focus-within,
+.row-edit-binary-clear:hover,
+.row-edit-binary-clear:focus {
+    background: #f8fafc;
+}
+
+.row-edit-binary-file-button:focus-within,
+.row-edit-binary-clear:focus {
+    outline: 3px solid rgba(26, 86, 219, 0.12);
+    outline-offset: 1px;
+}
+
+.row-edit-binary-file-button input[type="file"] {
+    position: absolute;
+    width: 1px;
+    height: 1px;
+    opacity: 0;
+    overflow: hidden;
+}
+
+.row-edit-binary-clear[hidden] {
+    display: none;
+}
+
+.row-edit-binary-drop-target {
+    border: 1px dashed var(--rule);
+    border-radius: 4px;
+    padding: 7px 8px;
+    color: var(--muted);
+    font-size: 0.78rem;
+}
+
+.row-edit-binary-dragover .row-edit-binary-drop-target {
+    border-color: var(--accent);
+    background: var(--paper);
+    color: var(--ink);
+}
+
 .row-edit-default {
     display: grid;
     grid-template-columns: minmax(0, 1fr) 7.25rem;
@@ -1634,6 +1915,207 @@ textarea.row-edit-input {
     margin: 0;
 }
 
+.row-edit-bulk {
+    display: grid;
+    gap: 8px;
+    padding: 16px 24px 24px;
+    overflow-y: auto;
+}
+
+.row-edit-bulk-editor {
+    display: grid;
+    gap: 8px;
+}
+
+.row-edit-bulk-editor[hidden] {
+    display: none;
+}
+
+.row-edit-bulk-actions {
+    display: flex;
+    align-items: center;
+    flex-wrap: wrap;
+    gap: 8px;
+    justify-content: flex-start;
+}
+
+.row-edit-bulk-actions .btn {
+    padding-left: 12px;
+    padding-right: 12px;
+}
+
+.row-edit-bulk-conflict {
+    display: grid;
+    grid-template-columns: minmax(120px, 180px) minmax(0, 1fr);
+    gap: 8px 12px;
+    align-items: start;
+}
+
+.row-edit-bulk-conflict[hidden] {
+    display: none;
+}
+
+.row-edit-bulk-conflict-label {
+    color: var(--ink);
+    font-size: 0.82rem;
+    padding-top: 8px;
+}
+
+.row-edit-bulk-conflict-control {
+    display: grid;
+    gap: 4px;
+}
+
+.row-edit-bulk-conflict-help {
+    color: var(--muted);
+    font-size: 0.78rem;
+    margin: 0;
+}
+
+.row-edit-copy-template-label-narrow {
+    display: none;
+}
+
+.row-edit-bulk-template-note {
+    color: var(--muted);
+    font-size: 0.82rem;
+}
+
+.row-edit-bulk-template-note-narrow {
+    display: none;
+}
+
+.row-edit-bulk-textarea {
+    min-height: 16rem;
+    resize: vertical;
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 0.82rem;
+    line-height: 1.45;
+}
+
+.row-edit-bulk-textarea.row-edit-bulk-drop-target {
+    border-color: var(--accent);
+    background: #f8fbff;
+    outline: 3px solid rgba(26, 86, 219, 0.12);
+}
+
+.row-edit-bulk-note {
+    color: var(--muted);
+    font-size: 0.82rem;
+    margin: 0;
+}
+
+.row-edit-bulk-note label,
+.row-edit-bulk-note .button-as-link {
+    font: inherit;
+}
+
+@media (max-width: 640px) {
+    .row-edit-copy-template-label-wide {
+        display: none;
+    }
+
+    .row-edit-copy-template-label-narrow {
+        display: inline;
+    }
+
+    .row-edit-bulk-template-note-wide {
+        display: none;
+    }
+
+    .row-edit-bulk-template-note-narrow {
+        display: inline;
+    }
+}
+
+.row-edit-bulk-preview {
+    display: grid;
+    gap: 8px;
+    margin-top: 8px;
+}
+
+.row-edit-bulk-preview[hidden] {
+    display: none;
+}
+
+.row-edit-bulk-preview-summary {
+    color: var(--ink);
+    font-size: 0.9rem;
+    font-weight: 600;
+    margin: 0;
+}
+
+.row-edit-bulk-preview-table-wrap {
+    border: 1px solid var(--rule);
+    border-radius: 5px;
+    max-height: 18rem;
+    overflow: auto;
+    background: #fff;
+}
+
+.row-edit-bulk-preview-table {
+    border-collapse: collapse;
+    font-size: 0.78rem;
+    min-width: 100%;
+    width: max-content;
+}
+
+.row-edit-bulk-preview-table th,
+.row-edit-bulk-preview-table td {
+    border-bottom: 1px solid var(--rule);
+    border-right: 1px solid var(--rule);
+    max-width: 18rem;
+    overflow-wrap: anywhere;
+    padding: 6px 8px;
+    text-align: left;
+    vertical-align: top;
+    white-space: normal;
+}
+
+.row-edit-bulk-preview-table th {
+    background: var(--paper);
+    color: var(--ink);
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-weight: 600;
+    position: sticky;
+    top: 0;
+    z-index: 1;
+}
+
+.row-edit-bulk-preview-table tr:last-child td {
+    border-bottom: none;
+}
+
+.row-edit-bulk-preview-table th:last-child,
+.row-edit-bulk-preview-table td:last-child {
+    border-right: none;
+}
+
+.row-edit-bulk-preview-null,
+.row-edit-bulk-preview-auto {
+    color: var(--muted);
+    font-style: italic;
+}
+
+.row-edit-bulk-progress {
+    display: grid;
+    gap: 6px;
+}
+
+.row-edit-bulk-progress[hidden] {
+    display: none;
+}
+
+.row-edit-bulk-progress-bar {
+    width: 100%;
+}
+
+.row-edit-bulk-progress-status {
+    color: var(--ink);
+    font-size: 0.9rem;
+    margin: 0;
+}
+
 datasette-autocomplete {
     display: block;
     position: relative;
@@ -1712,6 +2194,16 @@ datasette-autocomplete input[type="text"],
     background: var(--paper);
 }
 
+.row-edit-mode-link {
+    color: var(--accent);
+    font-size: 0.9rem;
+    margin-right: auto;
+}
+
+.row-edit-mode-link[hidden] {
+    display: none;
+}
+
 .row-edit-dialog .btn {
     border: none;
     border-radius: 5px;
@@ -1749,6 +2241,1110 @@ datasette-autocomplete input[type="text"],
     cursor: not-allowed;
 }
 
+dialog.table-create-dialog {
+    --ink: #0f0f0f;
+    --paper: #eef6ff;
+    --muted: #6b6b6b;
+    --rule: #d8e6f5;
+    --accent: #1a56db;
+    --card: #ffffff;
+    border: none;
+    border-radius: var(--modal-border-radius, 0.75rem);
+    padding: 0;
+    margin: auto;
+    width: min(980px, calc(100vw - 32px));
+    max-width: 95vw;
+    max-height: min(780px, calc(100vh - 32px));
+    box-shadow: var(--modal-shadow, 0 20px 25px -5px rgba(0, 0, 0, 0.1), 0 10px 10px -5px rgba(0, 0, 0, 0.04));
+    animation: datasette-modal-slide-in var(--modal-animation-duration, 0.2s) ease-out;
+    overflow: hidden;
+    font-family: system-ui, -apple-system, sans-serif;
+    background: var(--card);
+}
+
+dialog.table-create-dialog[open] {
+    display: flex;
+    flex-direction: column;
+}
+
+dialog.table-create-dialog::backdrop {
+    background: var(--modal-backdrop-bg, rgba(0, 0, 0, 0.5));
+    backdrop-filter: var(--modal-backdrop-blur, blur(4px));
+    -webkit-backdrop-filter: var(--modal-backdrop-blur, blur(4px));
+    animation: datasette-modal-fade-in var(--modal-animation-duration, 0.2s) ease-out;
+}
+
+.table-create-dialog .modal-header {
+    padding: 20px 24px 12px;
+    border-bottom: 1px solid var(--rule);
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    flex-shrink: 0;
+    min-width: 0;
+}
+
+.table-create-dialog .modal-title {
+    display: flex;
+    align-items: center;
+    min-width: 0;
+    max-width: 100%;
+    font-size: 1rem;
+    font-weight: 600;
+    color: var(--ink);
+}
+
+.table-create-form {
+    display: flex;
+    flex: 1 1 auto;
+    min-height: 0;
+    flex-direction: column;
+}
+
+.table-create-error {
+    border-left: 4px solid #b91c1c;
+    border-radius: 4px;
+    background: #fff1f1;
+    color: #7f1d1d;
+    font-size: 0.9rem;
+    margin: 12px 24px 0;
+    padding: 10px 12px;
+}
+
+.table-create-error:focus {
+    outline: 3px solid rgba(185, 28, 28, 0.18);
+    outline-offset: 2px;
+}
+
+.table-create-fields {
+    display: grid;
+    gap: 18px;
+    padding: 16px 24px 24px;
+    overflow-y: auto;
+}
+
+.table-create-field {
+    display: grid;
+    grid-template-columns: minmax(120px, 180px) minmax(0, 1fr);
+    gap: 12px;
+    align-items: start;
+}
+
+.table-create-label,
+.table-create-column-headings {
+    color: var(--ink);
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 0.82rem;
+}
+
+.table-create-label {
+    padding-top: 8px;
+}
+
+.table-create-column-label {
+    border: 0;
+    clip: rect(0 0 0 0);
+    height: 1px;
+    margin: -1px;
+    overflow: hidden;
+    padding: 0;
+    position: absolute;
+    white-space: nowrap;
+    width: 1px;
+}
+
+.table-create-input {
+    box-sizing: border-box;
+    min-width: 0;
+    min-height: 46px;
+    border: 1px solid var(--rule);
+    border-radius: 5px;
+    padding: 8px 10px;
+    color: var(--ink);
+    background: #fff;
+    font: inherit;
+    line-height: 1.35;
+}
+
+select.table-create-input {
+    height: 46px;
+}
+
+.table-create-input-placeholder {
+    color: var(--muted);
+}
+
+.table-create-foreign-key-target option,
+.table-create-custom-column-type option,
+.table-create-default-expr option {
+    color: var(--ink);
+}
+
+.table-create-foreign-key-target option[value=""],
+.table-create-custom-column-type option[value=""],
+.table-create-default-expr option[value=""] {
+    color: var(--muted);
+}
+
+.table-create-table-name {
+    width: 100%;
+}
+
+.table-create-input:focus {
+    border-color: var(--accent);
+    outline: 3px solid rgba(26, 86, 219, 0.12);
+}
+
+.table-create-columns {
+    display: grid;
+    gap: 10px;
+}
+
+.table-create-columns[hidden],
+.table-create-data[hidden],
+.table-create-data-editor[hidden],
+.table-create-data-preview[hidden] {
+    display: none;
+}
+
+.table-create-data,
+.table-create-data-editor {
+    display: grid;
+    gap: 8px;
+}
+
+.table-create-data-label {
+    color: var(--ink);
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 0.82rem;
+}
+
+.table-create-data-textarea {
+    min-height: 16rem;
+    resize: vertical;
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 0.82rem;
+    line-height: 1.45;
+}
+
+.table-create-data-textarea.table-create-data-drop-target {
+    border-color: var(--accent);
+    background: #f8fbff;
+    outline: 3px solid rgba(26, 86, 219, 0.12);
+}
+
+.table-create-data-note {
+    color: var(--muted);
+    font-size: 0.82rem;
+    margin: 0;
+}
+
+.table-create-data-note label,
+.table-create-data-note .button-as-link {
+    font: inherit;
+}
+
+.table-create-data-preview {
+    display: grid;
+    gap: 10px;
+}
+
+.table-create-data-preview-summary {
+    color: var(--ink);
+    font-size: 0.9rem;
+    font-weight: 600;
+    margin: 0;
+}
+
+.table-create-data-pk-field {
+    display: grid;
+    grid-template-columns: minmax(120px, 180px) minmax(0, 1fr);
+    gap: 12px;
+    align-items: center;
+}
+
+.table-create-data-preview-table-wrap {
+    border: 1px solid var(--rule);
+    border-radius: 5px;
+    max-height: 18rem;
+    overflow: auto;
+    background: #fff;
+}
+
+.table-create-data-preview-table {
+    border-collapse: collapse;
+    font-size: 0.78rem;
+    min-width: 100%;
+    width: max-content;
+}
+
+.table-create-data-preview-table th,
+.table-create-data-preview-table td {
+    border-bottom: 1px solid var(--rule);
+    border-right: 1px solid var(--rule);
+    max-width: 18rem;
+    overflow-wrap: anywhere;
+    padding: 6px 8px;
+    text-align: left;
+    vertical-align: top;
+    white-space: normal;
+}
+
+.table-create-data-preview-table th {
+    background: var(--paper);
+    color: var(--ink);
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-weight: 600;
+    position: sticky;
+    top: 0;
+    z-index: 1;
+}
+
+.table-create-data-preview-table tr:last-child td {
+    border-bottom: none;
+}
+
+.table-create-data-preview-table th:last-child,
+.table-create-data-preview-table td:last-child {
+    border-right: none;
+}
+
+.table-create-data-preview-null {
+    color: var(--muted);
+    font-style: italic;
+}
+
+.table-create-column-list {
+    display: grid;
+    gap: 8px;
+}
+
+.table-create-column-headings,
+.table-create-column-main {
+    display: grid;
+    grid-template-columns: minmax(140px, 1.2fr) minmax(7.5rem, 0.7fr) max-content 32px;
+    align-items: center;
+    gap: 8px;
+    min-width: 0;
+}
+
+.table-create-column-row {
+    display: grid;
+    gap: 8px;
+    min-width: 0;
+}
+
+.table-create-column-headings {
+    color: var(--muted);
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 0.72rem;
+    padding: 0 1px;
+}
+
+.table-create-column-details {
+    display: grid;
+    grid-template-columns: minmax(0, 1fr) minmax(0, 1fr);
+    align-items: start;
+    gap: 12px 16px;
+    padding: 12px;
+    border-left: 3px solid var(--rule);
+    background: #f8fafc;
+}
+
+.table-create-column-details[hidden] {
+    display: none;
+}
+
+.table-create-detail-field {
+    display: grid;
+    gap: 4px;
+    min-width: 0;
+}
+
+.table-create-detail-label {
+    color: var(--muted);
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 0.72rem;
+}
+
+.table-create-detail-help,
+.table-alter-detail-help {
+    color: var(--muted);
+    font-size: 0.82rem;
+    line-height: 1.35;
+    margin: 0;
+}
+
+.table-create-detail-check {
+    display: inline-flex;
+    align-items: flex-start;
+    gap: 8px;
+    color: var(--ink);
+    font-size: 0.85rem;
+    line-height: 1.35;
+    min-width: 0;
+    white-space: normal;
+}
+
+.table-create-not-null,
+.table-create-primary-key,
+.table-create-foreign-key-field,
+.table-create-default-options {
+    grid-column: 1 / -1;
+}
+
+.table-create-default-options,
+.table-alter-default-options {
+    border: 1px solid var(--rule);
+    border-radius: 5px;
+    background: #fff;
+    color: var(--ink);
+    min-width: 0;
+}
+
+.table-create-default-options > summary,
+.table-alter-default-options > summary {
+    cursor: pointer;
+    color: var(--accent);
+    font-size: 0.85rem;
+    padding: 8px 10px;
+}
+
+.table-create-default-options > summary:focus,
+.table-alter-default-options > summary:focus {
+    outline: 3px solid rgba(26, 86, 219, 0.12);
+    outline-offset: 1px;
+}
+
+.table-create-default-grid,
+.table-alter-default-grid {
+    display: grid;
+    grid-template-columns: minmax(0, 1fr) minmax(0, 1fr);
+    gap: 12px 16px;
+    padding: 0 10px 10px;
+}
+
+.table-create-detail-check input {
+    flex: 0 0 auto;
+    margin: 0.15rem 0 0;
+}
+
+.table-create-detail-check span {
+    min-width: 0;
+    overflow-wrap: break-word;
+}
+
+.table-create-move-controls {
+    display: grid;
+    grid-template-columns: repeat(4, 32px);
+    gap: 4px;
+    justify-content: start;
+}
+
+.table-create-more-options {
+    appearance: none;
+    border: 0;
+    background: transparent;
+    color: var(--accent);
+    cursor: pointer;
+    font: inherit;
+    font-size: 0.85rem;
+    justify-self: start;
+    padding: 0;
+    grid-column: 1 / -1;
+    text-align: left;
+}
+
+.table-create-more-options:hover,
+.table-create-more-options:focus {
+    text-decoration: underline;
+}
+
+.table-create-more-options:focus {
+    outline: 3px solid rgba(26, 86, 219, 0.12);
+    outline-offset: 2px;
+}
+
+.table-create-more-options:disabled {
+    color: var(--muted);
+    cursor: default;
+    text-decoration: none;
+}
+
+.table-create-icon-button {
+    appearance: none;
+    border: 1px solid rgba(74, 85, 104, 0.24);
+    background: transparent;
+    color: #4a5568;
+    border-radius: 4px;
+    cursor: pointer;
+    display: inline-grid;
+    place-items: center;
+    height: 32px;
+    width: 32px;
+    padding: 0;
+}
+
+.table-create-icon-button:hover,
+.table-create-icon-button:focus {
+    background: rgba(74, 85, 104, 0.07);
+}
+
+.table-create-icon-button:focus {
+    outline: 3px solid #b3d4ff;
+    outline-offset: 1px;
+}
+
+.table-create-icon-button svg {
+    display: block;
+}
+
+.table-create-add-column {
+    appearance: none;
+    justify-self: start;
+    border: 1px solid var(--rule);
+    border-radius: 5px;
+    background: #fff;
+    color: var(--accent);
+    cursor: pointer;
+    display: inline-flex;
+    align-items: center;
+    gap: 6px;
+    font: inherit;
+    font-size: 0.85rem;
+    padding: 7px 10px;
+}
+
+.table-create-add-column svg {
+    display: block;
+    flex: 0 0 auto;
+}
+
+.table-create-add-column:hover,
+.table-create-add-column:focus {
+    background: #f8fafc;
+}
+
+.table-create-add-column:focus {
+    outline: 3px solid rgba(26, 86, 219, 0.12);
+    outline-offset: 1px;
+}
+
+.table-create-dialog .modal-footer {
+    padding: 14px 20px;
+    border-top: 1px solid var(--rule);
+    display: flex;
+    align-items: center;
+    justify-content: flex-end;
+    gap: 10px;
+    flex-shrink: 0;
+    background: var(--paper);
+}
+
+.table-create-mode-link {
+    color: var(--accent);
+    font-size: 0.9rem;
+    margin-right: auto;
+}
+
+.table-create-mode-link[hidden] {
+    display: none;
+}
+
+.table-create-dialog .btn {
+    border: none;
+    border-radius: 5px;
+    padding: 9px 20px;
+    font-size: 0.85rem;
+    font-weight: 500;
+    cursor: pointer;
+    touch-action: manipulation;
+    font-family: inherit;
+    transition: background 0.12s;
+}
+
+.table-create-dialog .btn-ghost {
+    background: transparent;
+    color: var(--muted);
+    border: 1px solid var(--rule);
+}
+
+.table-create-dialog .btn-ghost:hover {
+    background: var(--rule);
+    color: var(--ink);
+}
+
+.table-create-dialog .btn-primary {
+    background: var(--accent);
+    color: #fff;
+}
+
+.table-create-dialog .btn-primary:hover {
+    background: #1949b8;
+}
+
+.table-create-dialog .btn:disabled,
+.table-create-add-column:disabled,
+.table-create-icon-button:disabled {
+    opacity: 0.55;
+    cursor: not-allowed;
+}
+
+dialog.table-alter-dialog {
+    --ink: #0f0f0f;
+    --paper: #eef6ff;
+    --muted: #6b6b6b;
+    --rule: #d8e6f5;
+    --accent: #1a56db;
+    --card: #ffffff;
+    border: none;
+    border-radius: var(--modal-border-radius, 0.75rem);
+    padding: 0;
+    margin: auto;
+    width: min(980px, calc(100vw - 32px));
+    max-width: 95vw;
+    max-height: min(780px, calc(100vh - 32px));
+    box-shadow: var(--modal-shadow, 0 20px 25px -5px rgba(0, 0, 0, 0.1), 0 10px 10px -5px rgba(0, 0, 0, 0.04));
+    animation: datasette-modal-slide-in var(--modal-animation-duration, 0.2s) ease-out;
+    overflow: hidden;
+    font-family: system-ui, -apple-system, sans-serif;
+    background: var(--card);
+}
+
+dialog.table-alter-dialog[open] {
+    display: flex;
+    flex-direction: column;
+}
+
+dialog.table-alter-dialog::backdrop {
+    background: var(--modal-backdrop-bg, rgba(0, 0, 0, 0.5));
+    backdrop-filter: var(--modal-backdrop-blur, blur(4px));
+    -webkit-backdrop-filter: var(--modal-backdrop-blur, blur(4px));
+    animation: datasette-modal-fade-in var(--modal-animation-duration, 0.2s) ease-out;
+}
+
+.table-alter-dialog .modal-header {
+    padding: 20px 24px 12px;
+    border-bottom: 1px solid var(--rule);
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    flex-shrink: 0;
+    min-width: 0;
+}
+
+.table-alter-dialog .modal-title {
+    display: flex;
+    align-items: center;
+    min-width: 0;
+    max-width: 100%;
+    font-size: 1rem;
+    font-weight: 600;
+    color: var(--ink);
+}
+
+.table-alter-form {
+    display: flex;
+    flex: 1 1 auto;
+    min-height: 0;
+    flex-direction: column;
+}
+
+.table-alter-error {
+    border-left: 4px solid #b91c1c;
+    border-radius: 4px;
+    background: #fff1f1;
+    color: #7f1d1d;
+    font-size: 0.9rem;
+    margin: 12px 24px 0;
+    padding: 10px 12px;
+}
+
+.table-alter-error:focus {
+    outline: 3px solid rgba(185, 28, 28, 0.18);
+    outline-offset: 2px;
+}
+
+.table-alter-fields {
+    display: grid;
+    gap: 18px;
+    padding: 16px 24px 24px;
+    overflow-y: auto;
+}
+
+.table-alter-table-options {
+    border-top: 1px solid var(--rule);
+    padding-top: 12px;
+}
+
+.table-alter-table-options > summary {
+    color: var(--ink);
+    cursor: pointer;
+    font-weight: 600;
+}
+
+.table-alter-table-options > summary:focus {
+    outline: 3px solid rgba(26, 86, 219, 0.12);
+    outline-offset: 3px;
+}
+
+.table-alter-table-name-field {
+    display: grid;
+    gap: 4px;
+    margin-top: 10px;
+    max-width: 24rem;
+}
+
+.table-alter-fields[hidden],
+.table-alter-dialog .modal-footer [hidden] {
+    display: none;
+}
+
+.table-alter-review {
+    display: grid;
+    gap: 12px;
+    overflow-y: auto;
+    padding: 16px 24px 24px;
+}
+
+.table-alter-review[hidden] {
+    display: none;
+}
+
+.table-alter-review-title {
+    color: var(--ink);
+    font-size: 1rem;
+    line-height: 1.35;
+    margin: 0;
+}
+
+.table-alter-review-title:focus {
+    outline: 3px solid rgba(26, 86, 219, 0.12);
+    outline-offset: 2px;
+}
+
+.table-alter-review-intro {
+    color: var(--muted);
+    font-size: 0.9rem;
+    margin: 0;
+}
+
+.table-alter-review-warning {
+    border-left: 4px solid #b91c1c;
+    border-radius: 4px;
+    background: #fff1f1;
+    color: #7f1d1d;
+    font-size: 0.9rem;
+    margin: 0;
+    padding: 10px 12px;
+}
+
+.table-alter-review-list {
+    display: grid;
+    gap: 8px;
+    margin: 0;
+    padding-left: 1.4rem;
+}
+
+.table-alter-review-list li {
+    color: var(--ink);
+    line-height: 1.4;
+}
+
+.table-alter-review-damaging {
+    font-weight: 600;
+}
+
+.table-alter-review-name {
+    background: #eef6ff;
+    border: 1px solid #c9ddf2;
+    border-radius: 4px;
+    color: var(--ink);
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 0.85em;
+    padding: 1px 4px;
+    white-space: nowrap;
+}
+
+.table-alter-columns {
+    display: grid;
+    gap: 10px;
+}
+
+.table-alter-column-list {
+    display: grid;
+    gap: 8px;
+}
+
+.table-alter-column-headings,
+.table-alter-column-main {
+    display: grid;
+    grid-template-columns: minmax(140px, 1.2fr) minmax(7.5rem, 0.7fr) max-content 32px;
+    align-items: center;
+    gap: 8px;
+    min-width: 0;
+}
+
+.table-alter-column-row {
+    display: grid;
+    gap: 8px;
+    min-width: 0;
+}
+
+.table-alter-column-headings {
+    color: var(--muted);
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 0.72rem;
+    padding: 0 1px;
+}
+
+.table-alter-column-label {
+    border: 0;
+    clip: rect(0 0 0 0);
+    height: 1px;
+    margin: -1px;
+    overflow: hidden;
+    padding: 0;
+    position: absolute;
+    white-space: nowrap;
+    width: 1px;
+}
+
+.table-alter-input {
+    box-sizing: border-box;
+    min-width: 0;
+    min-height: 46px;
+    border: 1px solid var(--rule);
+    border-radius: 5px;
+    padding: 8px 10px;
+    color: var(--ink);
+    background: #fff;
+    font: inherit;
+    line-height: 1.35;
+}
+
+select.table-alter-input {
+    height: 46px;
+}
+
+.table-alter-input-placeholder {
+    color: var(--muted);
+}
+
+.table-alter-default-expr option,
+.table-alter-custom-column-type option,
+.table-alter-foreign-key-target option {
+    color: var(--ink);
+}
+
+.table-alter-default-expr option[value=""],
+.table-alter-custom-column-type option[value=""],
+.table-alter-foreign-key-target option[value=""] {
+    color: var(--muted);
+}
+
+.table-alter-input:focus {
+    border-color: var(--accent);
+    outline: 3px solid rgba(26, 86, 219, 0.12);
+}
+
+.table-alter-column-details {
+    display: grid;
+    grid-template-columns: minmax(0, 1fr) minmax(0, 1fr);
+    align-items: start;
+    gap: 12px 16px;
+    padding: 12px;
+    border-left: 3px solid var(--rule);
+    background: #f8fafc;
+}
+
+.table-alter-column-details[hidden] {
+    display: none;
+}
+
+.table-alter-detail-field {
+    display: grid;
+    gap: 4px;
+    min-width: 0;
+}
+
+.table-alter-detail-label {
+    color: var(--muted);
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 0.72rem;
+}
+
+.table-alter-detail-check {
+    display: inline-flex;
+    align-items: flex-start;
+    gap: 8px;
+    color: var(--ink);
+    font-size: 0.85rem;
+    line-height: 1.35;
+    min-width: 0;
+    white-space: normal;
+}
+
+.table-alter-not-null,
+.table-alter-primary-key,
+.table-alter-foreign-key-field,
+.table-alter-default-options {
+    grid-column: 1 / -1;
+}
+
+.table-alter-detail-check input {
+    flex: 0 0 auto;
+    margin: 0.15rem 0 0;
+}
+
+.table-alter-detail-check span {
+    min-width: 0;
+    overflow-wrap: break-word;
+}
+
+.table-alter-move-controls {
+    display: grid;
+    grid-template-columns: repeat(4, 32px);
+    gap: 4px;
+    justify-content: start;
+}
+
+.table-alter-more-options {
+    appearance: none;
+    border: 0;
+    background: transparent;
+    color: var(--accent);
+    cursor: pointer;
+    font: inherit;
+    font-size: 0.85rem;
+    justify-self: start;
+    padding: 0;
+    grid-column: 1 / -1;
+    text-align: left;
+}
+
+.table-alter-more-options:hover,
+.table-alter-more-options:focus {
+    text-decoration: underline;
+}
+
+.table-alter-more-options:focus {
+    outline: 3px solid rgba(26, 86, 219, 0.12);
+    outline-offset: 2px;
+}
+
+.table-alter-more-options:disabled {
+    color: var(--muted);
+    cursor: default;
+    text-decoration: none;
+}
+
+.table-alter-icon-button {
+    appearance: none;
+    border: 1px solid rgba(74, 85, 104, 0.24);
+    background: transparent;
+    color: #4a5568;
+    border-radius: 4px;
+    cursor: pointer;
+    display: inline-grid;
+    place-items: center;
+    height: 32px;
+    width: 32px;
+    padding: 0;
+}
+
+.table-alter-icon-button:hover,
+.table-alter-icon-button:focus {
+    background: rgba(74, 85, 104, 0.07);
+}
+
+.table-alter-icon-button:focus {
+    outline: 3px solid #b3d4ff;
+    outline-offset: 1px;
+}
+
+.table-alter-icon-button svg {
+    display: block;
+}
+
+.table-alter-add-column {
+    appearance: none;
+    justify-self: start;
+    border: 1px solid var(--rule);
+    border-radius: 5px;
+    background: #fff;
+    color: var(--accent);
+    cursor: pointer;
+    display: inline-flex;
+    align-items: center;
+    gap: 6px;
+    font: inherit;
+    font-size: 0.85rem;
+    padding: 7px 10px;
+}
+
+.table-alter-add-column svg {
+    display: block;
+    flex: 0 0 auto;
+}
+
+.table-alter-add-column:hover,
+.table-alter-add-column:focus {
+    background: #f8fafc;
+}
+
+.table-alter-add-column:focus {
+    outline: 3px solid rgba(26, 86, 219, 0.12);
+    outline-offset: 1px;
+}
+
+.table-alter-dialog .modal-footer {
+    padding: 14px 20px;
+    border-top: 1px solid var(--rule);
+    display: flex;
+    align-items: center;
+    justify-content: flex-end;
+    gap: 10px;
+    flex-shrink: 0;
+    background: var(--paper);
+}
+
+.table-alter-dialog .btn {
+    border: none;
+    border-radius: 5px;
+    padding: 9px 20px;
+    font-size: 0.85rem;
+    font-weight: 500;
+    cursor: pointer;
+    touch-action: manipulation;
+    font-family: inherit;
+    transition: background 0.12s;
+}
+
+.table-alter-dialog .btn-ghost {
+    background: transparent;
+    color: var(--muted);
+    border: 1px solid var(--rule);
+}
+
+.table-alter-dialog .btn-ghost:hover {
+    background: var(--rule);
+    color: var(--ink);
+}
+
+.table-alter-dialog .btn-danger {
+    background: #b91c1c;
+    color: #fff;
+    margin-right: auto;
+}
+
+.table-alter-dialog .btn-danger:hover {
+    background: #991b1b;
+}
+
+.table-alter-dialog .btn-danger:disabled,
+.table-alter-dialog .btn-danger:disabled:hover {
+    background: #d98c8c;
+    color: #fff;
+}
+
+.table-alter-dialog .btn-primary {
+    background: var(--accent);
+    color: #fff;
+}
+
+.table-alter-dialog .btn-primary:hover {
+    background: #1949b8;
+}
+
+.table-alter-dialog .btn-primary:disabled,
+.table-alter-dialog .btn-primary:disabled:hover {
+    background: #a0aec0;
+    color: #fff;
+}
+
+.table-alter-dialog .btn:disabled,
+.table-alter-add-column:disabled,
+.table-alter-icon-button:disabled {
+    opacity: 0.55;
+    cursor: not-allowed;
+}
+
+@media (max-width: 900px) {
+    dialog.table-alter-dialog {
+        width: 95vw;
+        max-height: 85vh;
+        border-radius: 0.5rem;
+    }
+
+    .table-alter-dialog .modal-header,
+    .table-alter-fields,
+    .table-alter-review {
+        padding-left: 18px;
+        padding-right: 18px;
+    }
+
+    .table-alter-error {
+        margin-left: 18px;
+        margin-right: 18px;
+    }
+
+    .table-alter-column-headings {
+        display: none;
+    }
+
+    .table-alter-column-row {
+        padding-bottom: 8px;
+        border-bottom: 1px solid var(--rule);
+    }
+
+    .table-alter-column-main {
+        grid-template-columns: minmax(0, 1fr) minmax(7.5rem, 0.8fr) 32px;
+        align-items: end;
+    }
+
+    .table-alter-column-name {
+        grid-column: 1;
+        grid-row: 1;
+    }
+
+    .table-alter-column-type {
+        grid-column: 2;
+        grid-row: 1;
+    }
+
+    .table-alter-remove-column {
+        grid-column: 3;
+        grid-row: 1;
+        justify-self: end;
+    }
+
+    .table-alter-move-controls {
+        grid-column: 1;
+        grid-row: 2;
+        justify-self: start;
+    }
+
+    .table-alter-more-options {
+        align-self: center;
+        grid-column: 2 / 4;
+        grid-row: 2;
+    }
+
+    .table-alter-column-details {
+        grid-template-columns: 1fr;
+    }
+
+    .table-alter-default-grid {
+        grid-template-columns: 1fr;
+    }
+
+    .table-alter-dialog .modal-footer {
+        padding-left: 18px;
+        padding-right: 18px;
+    }
+}
+
 .row-link-with-actions {
     display: inline-flex;
     align-items: center;
@@ -1868,7 +3464,8 @@ datasette-autocomplete input[type="text"],
     .row-edit-dialog .modal-header,
     .row-edit-summary,
     .row-edit-loading,
-    .row-edit-fields {
+    .row-edit-fields,
+    .row-edit-bulk {
         padding-left: 18px;
         padding-right: 18px;
     }
@@ -1887,11 +3484,106 @@ datasette-autocomplete input[type="text"],
         padding-top: 0;
     }
 
+    .row-edit-bulk-conflict {
+        grid-template-columns: 1fr;
+        gap: 5px;
+    }
+
+    .row-edit-bulk-conflict-label {
+        padding-top: 0;
+    }
+
     .row-edit-dialog .modal-footer {
         padding-left: 18px;
         padding-right: 18px;
     }
 
+    dialog.table-create-dialog {
+        width: 95vw;
+        max-height: 85vh;
+        border-radius: 0.5rem;
+    }
+
+    .table-create-dialog .modal-header,
+    .table-create-fields {
+        padding-left: 18px;
+        padding-right: 18px;
+    }
+
+    .table-create-error {
+        margin-left: 18px;
+        margin-right: 18px;
+    }
+
+    .table-create-field {
+        grid-template-columns: 1fr;
+        gap: 5px;
+    }
+
+    .table-create-label {
+        padding-top: 0;
+    }
+
+    .table-create-data-pk-field {
+        grid-template-columns: 1fr;
+        gap: 5px;
+    }
+
+    .table-create-column-headings {
+        display: none;
+    }
+
+    .table-create-column-row {
+        padding-bottom: 8px;
+        border-bottom: 1px solid var(--rule);
+    }
+
+    .table-create-column-main {
+        grid-template-columns: minmax(0, 1fr) minmax(7.5rem, 0.8fr) 32px;
+        align-items: end;
+    }
+
+    .table-create-column-name {
+        grid-column: 1;
+        grid-row: 1;
+    }
+
+    .table-create-column-type {
+        grid-column: 2;
+        grid-row: 1;
+    }
+
+    .table-create-remove-column {
+        grid-column: 3;
+        grid-row: 1;
+        justify-self: end;
+    }
+
+    .table-create-move-controls {
+        grid-column: 1;
+        grid-row: 2;
+        justify-self: start;
+    }
+
+    .table-create-more-options {
+        align-self: center;
+        grid-column: 2 / 4;
+        grid-row: 2;
+    }
+
+    .table-create-column-details {
+        grid-template-columns: 1fr;
+    }
+
+    .table-create-default-grid {
+        grid-template-columns: 1fr;
+    }
+
+    .table-create-dialog .modal-footer {
+        padding-left: 18px;
+        padding-right: 18px;
+    }
+
     .row-inline-action {
         min-height: 30px;
         min-width: 30px;
@@ -1960,14 +3652,56 @@ datasette-autocomplete input[type="text"],
         margin-bottom: 0.35rem;
     }
 
-    .select-wrapper {
-        width: 100px;
+    .filters {
+        max-width: none;
+        padding: 0.65rem;
     }
-    .select-wrapper.filter-op {
-        width: 60px;
+    .filters .search-row {
+        grid-template-columns: max-content minmax(0, 1fr);
+        padding-right: 0;
+    }
+    .filters .filter-controls-row {
+        --filter-value-button-space: 0px;
+        --filter-remove-button-offset: 0px;
+        grid-template-columns: repeat(2, minmax(0, 1fr));
+    }
+    .filters .filter-controls-row-one-button {
+        --filter-value-button-space: calc(
+            var(--filter-row-icon-size) + var(--filter-control-gap)
+        );
+    }
+    .filters .filter-controls-row-two-buttons {
+        --filter-value-button-space: var(--filter-two-icon-space);
+        --filter-remove-button-offset: calc(
+            var(--filter-row-icon-size) + var(--filter-control-gap)
+        );
+    }
+    .filters .filter-controls-row .select-wrapper {
+        grid-row: 1;
+        grid-column: 1 / 2;
+    }
+    .filters .filter-controls-row .select-wrapper.filter-op {
+        grid-column: 2 / 3;
     }
     .filters input.filter-value {
-        width: 140px;
+        grid-row: 2;
+        grid-column: 1 / 3;
+        justify-self: start;
+        width: calc(100% - var(--filter-value-button-space));
+    }
+    .filters button.filter-row-icon {
+        grid-row: 2;
+        grid-column: 1 / 3;
+        justify-self: end;
+    }
+    .filters .filter-controls-row-two-buttons button.filter-row-remove:not([hidden]) {
+        margin-right: var(--filter-remove-button-offset);
+    }
+    .filters .filter-actions-row {
+        justify-content: flex-start;
+    }
+    .filters .filter-actions-row input[type=submit] {
+        flex: 0 1 auto;
     }
     button.choose-columns-mobile,
     button.table-insert-row,
diff --git a/datasette/static/edit-tools.js b/datasette/static/edit-tools.js
index 8142d02b..9e8b93f6 100644
--- a/datasette/static/edit-tools.js
+++ b/datasette/static/edit-tools.js
@@ -2,6 +2,12 @@ var ROW_DELETE_DIALOG_ID = "row-delete-dialog";
 var rowDeleteDialogState = null;
 var ROW_EDIT_DIALOG_ID = "row-edit-dialog";
 var rowEditDialogState = null;
+var ROW_EDIT_BINARY_IMAGE_PREVIEW_MAX_BYTES = 10 * 1024 * 1024;
+var TABLE_CREATE_DIALOG_ID = "table-create-dialog";
+var tableCreateDialogState = null;
+var TABLE_CREATE_AUTOMATIC_PK = "__datasette_automatic_pk__";
+var TABLE_ALTER_DIALOG_ID = "table-alter-dialog";
+var tableAlterDialogState = null;
 
 function ensureRowMutationStatus(manager) {
   var status = document.querySelector(".row-mutation-status");
@@ -43,6 +49,2403 @@ function hideRowMutationStatus() {
   status.textContent = "";
 }
 
+function databaseCreateTableData() {
+  return (
+    window._datasetteDatabaseData && window._datasetteDatabaseData.createTable
+  );
+}
+
+function tableCreateColumnTypes() {
+  var data = databaseCreateTableData() || {};
+  return data.columnTypes && data.columnTypes.length
+    ? data.columnTypes
+    : ["text", "integer", "float", "blob"];
+}
+
+function tableCreateDefaultExpressions() {
+  var data = databaseCreateTableData() || {};
+  return data.defaultExpressions || [];
+}
+
+var SQLITE_COLUMN_TYPE_LABELS = {
+  float: "floating point number",
+  real: "floating point number",
+  blob: "blob - binary data",
+};
+
+function sqliteColumnTypeLabel(type) {
+  return SQLITE_COLUMN_TYPE_LABELS[type] || type;
+}
+
+function populateSqliteColumnTypeSelect(select, type, options) {
+  options.forEach(function (option) {
+    var optionElement = document.createElement("option");
+    optionElement.value = option;
+    optionElement.textContent = sqliteColumnTypeLabel(option);
+    select.appendChild(optionElement);
+  });
+  select.value = options.indexOf(type) === -1 ? options[0] : type;
+}
+
+function updateSelectPlaceholder(select, placeholderClass) {
+  select.classList.toggle(placeholderClass, !select.value);
+}
+
+function createCustomColumnTypeSelect(options, className, placeholderClass) {
+  var select = document.createElement("select");
+  select.className = className;
+  select.setAttribute("aria-label", "Custom column type");
+  var blankOption = document.createElement("option");
+  blankOption.value = "";
+  blankOption.textContent = "- custom type -";
+  select.appendChild(blankOption);
+  options.forEach(function (option) {
+    var optionElement = document.createElement("option");
+    optionElement.value = option.name;
+    optionElement.textContent = option.description
+      ? option.description + " (" + option.name + ")"
+      : option.name;
+    select.appendChild(optionElement);
+  });
+  updateSelectPlaceholder(select, placeholderClass);
+  return select;
+}
+
+function normalizeDefaultExpressionOption(option) {
+  if (typeof option === "string") {
+    return {
+      value: option,
+      label: option.replace(/_/g, " "),
+      sqliteType: "",
+    };
+  }
+  option = option || {};
+  return {
+    value: option.value || "",
+    label: option.label || option.value || "",
+    sqliteType: option.sqliteType || "",
+  };
+}
+
+function defaultExpressionOptionForValue(options, value) {
+  var match = null;
+  (options || []).some(function (option) {
+    var normalized = normalizeDefaultExpressionOption(option);
+    if (normalized.value === value) {
+      match = normalized;
+      return true;
+    }
+    return false;
+  });
+  return match;
+}
+
+function defaultExpressionLabelForValue(options, value) {
+  var option = defaultExpressionOptionForValue(options, value);
+  return option && option.label
+    ? option.label
+    : value
+      ? value.replace(/_/g, " ")
+      : "";
+}
+
+function applyDefaultExpressionColumnType(row, prefix, options, columnTypes) {
+  var defaultExprSelect = row.querySelector("." + prefix + "-default-expr");
+  var typeSelect = row.querySelector("." + prefix + "-column-type");
+  if (!defaultExprSelect || !typeSelect || !defaultExprSelect.value) {
+    return false;
+  }
+  var option = defaultExpressionOptionForValue(
+    options,
+    defaultExprSelect.value,
+  );
+  if (
+    option &&
+    option.sqliteType &&
+    (columnTypes || []).indexOf(option.sqliteType) !== -1 &&
+    typeSelect.value !== option.sqliteType
+  ) {
+    typeSelect.value = option.sqliteType;
+    return true;
+  }
+  return false;
+}
+
+function createDefaultExpressionSelect(
+  options,
+  className,
+  placeholderClass,
+  value,
+) {
+  var select = document.createElement("select");
+  select.className = className;
+  var blankOption = document.createElement("option");
+  blankOption.value = "";
+  blankOption.textContent = "- default expr -";
+  select.appendChild(blankOption);
+  options.forEach(function (option) {
+    var normalized = normalizeDefaultExpressionOption(option);
+    if (!normalized.value) {
+      return;
+    }
+    var optionElement = document.createElement("option");
+    optionElement.value = normalized.value;
+    optionElement.textContent = normalized.label;
+    select.appendChild(optionElement);
+  });
+  select.value = value || "";
+  updateSelectPlaceholder(select, placeholderClass);
+  return select;
+}
+
+function createSchemaDialogDefaultControls(prefix, index, expressions, column) {
+  var defaultDetails = document.createElement("details");
+  defaultDetails.className = prefix + "-default-options";
+  defaultDetails.open = !!(
+    column &&
+    (column.defaultValue || column.defaultExpr)
+  );
+  var summary = document.createElement("summary");
+  summary.textContent = "Set a default value";
+  defaultDetails.appendChild(summary);
+
+  var defaultGrid = document.createElement("div");
+  defaultGrid.className = prefix + "-default-grid";
+
+  var defaultExprId = prefix + "-column-default-expr-" + index;
+  var defaultExprField = document.createElement("div");
+  defaultExprField.className = prefix + "-detail-field";
+  var defaultExprLabel = document.createElement("label");
+  defaultExprLabel.className = prefix + "-detail-label";
+  defaultExprLabel.setAttribute("for", defaultExprId);
+  defaultExprLabel.textContent = "Default expression";
+  var defaultExprSelect = createDefaultExpressionSelect(
+    expressions,
+    prefix + "-input " + prefix + "-default-expr",
+    prefix + "-input-placeholder",
+    column && column.defaultExpr,
+  );
+  defaultExprSelect.id = defaultExprId;
+  defaultExprSelect.setAttribute("aria-label", "Default expression");
+  defaultExprField.appendChild(defaultExprLabel);
+  defaultExprField.appendChild(defaultExprSelect);
+
+  var defaultId = prefix + "-column-default-" + index;
+  var defaultField = document.createElement("div");
+  defaultField.className = prefix + "-detail-field";
+  var defaultLabel = document.createElement("label");
+  defaultLabel.className = prefix + "-detail-label";
+  defaultLabel.setAttribute("for", defaultId);
+  defaultLabel.textContent = "or default to a specific value";
+  var defaultInput = document.createElement("input");
+  defaultInput.id = defaultId;
+  defaultInput.className = prefix + "-input " + prefix + "-default";
+  defaultInput.type = "text";
+  defaultInput.autocomplete = "off";
+  defaultInput.placeholder = "default";
+  defaultInput.setAttribute("aria-label", "or default to a specific value");
+  defaultInput.value = column && column.defaultValue ? column.defaultValue : "";
+  defaultField.appendChild(defaultLabel);
+  defaultField.appendChild(defaultInput);
+
+  defaultGrid.appendChild(defaultExprField);
+  defaultGrid.appendChild(defaultField);
+  defaultDetails.appendChild(defaultGrid);
+
+  return {
+    controls: defaultDetails,
+    defaultInput: defaultInput,
+    defaultExprSelect: defaultExprSelect,
+  };
+}
+
+function syncSchemaDialogDefaultControls(row, prefix) {
+  if (!row) {
+    return;
+  }
+  var defaultInput = row.querySelector("." + prefix + "-default");
+  var defaultExprSelect = row.querySelector("." + prefix + "-default-expr");
+  if (!defaultInput || !defaultExprSelect) {
+    return;
+  }
+  updateSelectPlaceholder(defaultExprSelect, prefix + "-input-placeholder");
+}
+
+var COLUMN_MOVE_ICONS = {
+  top: '<svg aria-hidden="true" xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m18 17-6-6-6 6"></path><path d="m18 11-6-6-6 6"></path></svg>',
+  up: '<svg aria-hidden="true" xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m18 15-6-6-6 6"></path></svg>',
+  down: '<svg aria-hidden="true" xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m6 9 6 6 6-6"></path></svg>',
+  bottom:
+    '<svg aria-hidden="true" xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m6 7 6 6 6-6"></path><path d="m6 13 6 6 6-6"></path></svg>',
+  remove:
+    '<svg aria-hidden="true" xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 6h18"></path><path d="M8 6V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"></path><path d="M19 6l-1 14a2 2 0 0 1-2 2H8a2 2 0 0 1-2-2L5 6"></path></svg>',
+};
+
+function createSchemaDialogIconButton(prefix, modifier, ariaLabel, title, svg) {
+  var button = document.createElement("button");
+  button.type = "button";
+  button.className = prefix + "-icon-button " + prefix + "-" + modifier;
+  button.setAttribute("aria-label", ariaLabel);
+  button.title = title;
+  button.dataset.defaultTitle = title;
+  button.innerHTML = svg;
+  return button;
+}
+
+function createSchemaDialogMoveControls(prefix) {
+  var moveControls = document.createElement("div");
+  moveControls.className = prefix + "-move-controls";
+
+  var moveTopButton = createSchemaDialogIconButton(
+    prefix,
+    "move-top",
+    "Move column to top",
+    "Move column to top",
+    COLUMN_MOVE_ICONS.top,
+  );
+  var moveUpButton = createSchemaDialogIconButton(
+    prefix,
+    "move-up",
+    "Move column up",
+    "Move column up",
+    COLUMN_MOVE_ICONS.up,
+  );
+  var moveDownButton = createSchemaDialogIconButton(
+    prefix,
+    "move-down",
+    "Move column down",
+    "Move column down",
+    COLUMN_MOVE_ICONS.down,
+  );
+  var moveBottomButton = createSchemaDialogIconButton(
+    prefix,
+    "move-bottom",
+    "Move column to bottom",
+    "Move column to bottom",
+    COLUMN_MOVE_ICONS.bottom,
+  );
+
+  moveControls.appendChild(moveTopButton);
+  moveControls.appendChild(moveUpButton);
+  moveControls.appendChild(moveDownButton);
+  moveControls.appendChild(moveBottomButton);
+
+  return {
+    controls: moveControls,
+    topButton: moveTopButton,
+    upButton: moveUpButton,
+    downButton: moveDownButton,
+    bottomButton: moveBottomButton,
+  };
+}
+
+function createSchemaDialogMoreOptionsButton(prefix, details) {
+  var expandButton = document.createElement("button");
+  expandButton.type = "button";
+  expandButton.className = prefix + "-more-options";
+  expandButton.setAttribute("aria-label", "Toggle column settings");
+  expandButton.setAttribute("aria-controls", details.id);
+  expandButton.setAttribute("aria-expanded", details.hidden ? "false" : "true");
+  updateSchemaDialogMoreOptionsButton(expandButton);
+  return expandButton;
+}
+
+function updateSchemaDialogMoreOptionsButton(button) {
+  var isExpanded = button.getAttribute("aria-expanded") === "true";
+  button.textContent = isExpanded ? "v Hide options" : "> Advanced options";
+  button.title = isExpanded ? "Hide column settings" : "Show column settings";
+}
+
+function toggleSchemaDialogMoreOptions(button, details) {
+  var isExpanded = button.getAttribute("aria-expanded") === "true";
+  details.hidden = isExpanded;
+  button.setAttribute("aria-expanded", isExpanded ? "false" : "true");
+  updateSchemaDialogMoreOptionsButton(button);
+}
+
+function schemaDialogRows(state, prefix) {
+  return Array.prototype.slice.call(
+    state.columnList.querySelectorAll("." + prefix + "-column-row"),
+  );
+}
+
+function schemaDialogRowIsPrimaryKey(row, prefix) {
+  var input = row && row.querySelector("." + prefix + "-primary-key-input");
+  return !!(input && input.checked);
+}
+
+function schemaDialogFirstNonPrimaryRow(state, prefix) {
+  var rows = schemaDialogRows(state, prefix);
+  for (var i = 0; i < rows.length; i += 1) {
+    if (!schemaDialogRowIsPrimaryKey(rows[i], prefix)) {
+      return rows[i];
+    }
+  }
+  return null;
+}
+
+function updateSchemaDialogMoveButtons(state, prefix) {
+  if (!state || !state.columnList) {
+    return;
+  }
+  var firstNonPrimary = schemaDialogFirstNonPrimaryRow(state, prefix);
+  var rows = schemaDialogRows(state, prefix);
+  var hasPrimaryKeys = rows.some(function (row) {
+    return schemaDialogRowIsPrimaryKey(row, prefix);
+  });
+  var primaryKeyMoveTitle = "Primary key columns are always listed first";
+  rows.forEach(function (row) {
+    var isPrimaryKey = schemaDialogRowIsPrimaryKey(row, prefix);
+    var previous = row.previousElementSibling;
+    var next = row.nextElementSibling;
+    row
+      .querySelectorAll("." + prefix + "-move-controls button")
+      .forEach(function (button) {
+        button.title = button.dataset.defaultTitle || button.title;
+        button.disabled = state.isSaving || isPrimaryKey;
+        if (isPrimaryKey) {
+          button.title = primaryKeyMoveTitle;
+        }
+      });
+    if (!isPrimaryKey) {
+      var topButton = row.querySelector("." + prefix + "-move-top");
+      var upButton = row.querySelector("." + prefix + "-move-up");
+      var downButton = row.querySelector("." + prefix + "-move-down");
+      var bottomButton = row.querySelector("." + prefix + "-move-bottom");
+      topButton.disabled =
+        state.isSaving || !firstNonPrimary || row === firstNonPrimary;
+      upButton.disabled =
+        state.isSaving ||
+        !previous ||
+        schemaDialogRowIsPrimaryKey(previous, prefix);
+      downButton.disabled = state.isSaving || !next;
+      bottomButton.disabled = state.isSaving || !next;
+      if (hasPrimaryKeys && row === firstNonPrimary) {
+        topButton.title = primaryKeyMoveTitle;
+        upButton.title = primaryKeyMoveTitle;
+      }
+    }
+  });
+}
+
+function normalizeSchemaDialogPrimaryKeyRows(state, prefix) {
+  var rows = schemaDialogRows(state, prefix);
+  rows
+    .filter(function (row) {
+      return schemaDialogRowIsPrimaryKey(row, prefix);
+    })
+    .concat(
+      rows.filter(function (row) {
+        return !schemaDialogRowIsPrimaryKey(row, prefix);
+      }),
+    )
+    .forEach(function (row) {
+      state.columnList.appendChild(row);
+    });
+}
+
+function tableCreateCustomColumnTypes() {
+  var data = databaseCreateTableData() || {};
+  return data.customColumnTypes || [];
+}
+
+function tableCreateCustomColumnType(name) {
+  var options = tableCreateCustomColumnTypes();
+  for (var i = 0; i < options.length; i += 1) {
+    if (options[i].name === name) {
+      return options[i];
+    }
+  }
+  return null;
+}
+
+function tableCreateCustomTypeAppliesToSqliteType(option, sqliteType) {
+  return (
+    option &&
+    option.sqliteTypes &&
+    option.sqliteTypes.indexOf(sqliteType) !== -1
+  );
+}
+
+function tableCreateDialogRows(state) {
+  return schemaDialogRows(state, "table-create");
+}
+
+function tableCreateRowIsPrimaryKey(row) {
+  return schemaDialogRowIsPrimaryKey(row, "table-create");
+}
+
+function tableCreateFirstNonPrimaryRow(state) {
+  return schemaDialogFirstNonPrimaryRow(state, "table-create");
+}
+
+function updateTableCreateMoveButtons(state) {
+  updateSchemaDialogMoveButtons(state, "table-create");
+}
+
+function schemaDialogTypeAffinity(type) {
+  if (type === "float") {
+    return "real";
+  }
+  return type;
+}
+
+function foreignKeyTypesCompatible(sourceAffinity, targetAffinity) {
+  if (sourceAffinity === targetAffinity) {
+    return true;
+  }
+  var numericAffinities = ["integer", "real", "numeric"];
+  if (sourceAffinity === "numeric") {
+    return numericAffinities.indexOf(targetAffinity) !== -1;
+  }
+  if (targetAffinity === "numeric") {
+    return numericAffinities.indexOf(sourceAffinity) !== -1;
+  }
+  return false;
+}
+
+function foreignKeyTargetKey(target) {
+  return target.fk_table + "\u001f" + target.fk_column;
+}
+
+function foreignKeyTargetLabel(target) {
+  return (
+    target.fk_table +
+    "." +
+    target.fk_column +
+    " (" +
+    sqliteColumnTypeLabel(target.type) +
+    ")"
+  );
+}
+
+function appendForeignKeyTargetOption(select, target) {
+  var optionElement = document.createElement("option");
+  optionElement.value = foreignKeyTargetKey(target);
+  optionElement.dataset.fkTable = target.fk_table;
+  optionElement.dataset.fkColumn = target.fk_column;
+  optionElement.dataset.fkType = target.type;
+  optionElement.textContent = foreignKeyTargetLabel(target);
+  select.appendChild(optionElement);
+  return optionElement;
+}
+
+function sqliteColumnTypeForForeignKeyTarget(type) {
+  var affinity = schemaDialogTypeAffinity(type);
+  if (affinity === "real" || affinity === "numeric") {
+    return "float";
+  }
+  if (["text", "integer", "blob"].indexOf(affinity) !== -1) {
+    return affinity;
+  }
+  return "";
+}
+
+function selectedSchemaDialogForeignKeyOption(foreignKeySelect) {
+  return foreignKeySelect && foreignKeySelect.selectedOptions
+    ? foreignKeySelect.selectedOptions[0]
+    : null;
+}
+
+function setBlankSchemaDialogColumnNameFromForeignKey(
+  row,
+  prefix,
+  foreignKeyOption,
+) {
+  var nameInput = row.querySelector("." + prefix + "-column-name");
+  if (
+    nameInput &&
+    !nameInput.value.trim() &&
+    foreignKeyOption &&
+    foreignKeyOption.dataset.fkTable &&
+    foreignKeyOption.dataset.fkColumn
+  ) {
+    nameInput.value =
+      foreignKeyOption.dataset.fkTable +
+      "_" +
+      foreignKeyOption.dataset.fkColumn;
+  }
+}
+
+function tableCreateForeignKeyTargetsUrl() {
+  var data = databaseCreateTableData() || {};
+  if (data.foreignKeyTargetsPath) {
+    return data.foreignKeyTargetsPath;
+  }
+  if (!data.path) {
+    return null;
+  }
+  return data.path.replace(/\/-\/create$/, "/-/foreign-key-targets");
+}
+
+function populateSchemaDialogForeignKeySelect(
+  select,
+  state,
+  prefix,
+  sourceType,
+  options,
+) {
+  options = options || {};
+  var previousKey = select.value || select.dataset.selectedKey || "";
+  select.textContent = "";
+
+  var blankOption = document.createElement("option");
+  blankOption.value = "";
+  blankOption.textContent = "- no foreign key -";
+  select.appendChild(blankOption);
+
+  if (state.foreignKeyTargetsLoading) {
+    var loadingOption = document.createElement("option");
+    loadingOption.value = "";
+    loadingOption.disabled = true;
+    loadingOption.textContent = "Loading foreign keys...";
+    select.appendChild(loadingOption);
+  } else if (state.foreignKeyTargetsError) {
+    var errorOption = document.createElement("option");
+    errorOption.value = "";
+    errorOption.disabled = true;
+    errorOption.textContent = "Could not load foreign keys";
+    select.appendChild(errorOption);
+  } else {
+    var sourceAffinity = schemaDialogTypeAffinity(sourceType);
+    (state.foreignKeyTargets || []).forEach(function (target) {
+      if (
+        options.filterByType !== false &&
+        !foreignKeyTypesCompatible(sourceAffinity, target.type)
+      ) {
+        return;
+      }
+      appendForeignKeyTargetOption(select, target);
+    });
+  }
+
+  select.value = previousKey;
+  if (
+    previousKey &&
+    select.value !== previousKey &&
+    select.dataset.currentFkTable &&
+    select.dataset.currentFkColumn
+  ) {
+    appendForeignKeyTargetOption(select, {
+      fk_table: select.dataset.currentFkTable,
+      fk_column: select.dataset.currentFkColumn,
+      type: select.dataset.currentFkType || sourceType,
+    });
+    select.value = previousKey;
+  }
+  if (select.value !== previousKey) {
+    select.value = "";
+  }
+  select.dataset.selectedKey = select.value;
+  select.disabled = state.isSaving || select.options.length <= 1;
+  updateSelectPlaceholder(select, prefix + "-input-placeholder");
+}
+
+function syncSchemaDialogForeignKeyOptions(row, state, prefix, options) {
+  var typeSelect = row.querySelector("." + prefix + "-column-type");
+  var foreignKeySelect = row.querySelector(
+    "." + prefix + "-foreign-key-target",
+  );
+  if (!typeSelect || !foreignKeySelect) {
+    return;
+  }
+  populateSchemaDialogForeignKeySelect(
+    foreignKeySelect,
+    state,
+    prefix,
+    typeSelect.value,
+    options,
+  );
+}
+
+function syncSchemaDialogCustomTypeAndForeignKey(row, state, prefix) {
+  var customTypeSelect = row.querySelector(
+    "." + prefix + "-custom-column-type",
+  );
+  var foreignKeySelect = row.querySelector(
+    "." + prefix + "-foreign-key-target",
+  );
+  if (!foreignKeySelect) {
+    return;
+  }
+
+  var hasCustomType = customTypeSelect && !!customTypeSelect.value;
+  var hasForeignKey = !!foreignKeySelect.value;
+
+  if (customTypeSelect && hasForeignKey) {
+    customTypeSelect.value = "";
+    updateSelectPlaceholder(customTypeSelect, prefix + "-input-placeholder");
+    hasCustomType = false;
+  }
+
+  if (hasCustomType) {
+    foreignKeySelect.value = "";
+    foreignKeySelect.dataset.selectedKey = "";
+    updateSelectPlaceholder(foreignKeySelect, prefix + "-input-placeholder");
+    hasForeignKey = false;
+  }
+
+  if (customTypeSelect) {
+    customTypeSelect.disabled = state.isSaving;
+  }
+  foreignKeySelect.disabled =
+    state.isSaving || foreignKeySelect.options.length <= 1;
+}
+
+function handleSchemaDialogForeignKeyChange(row, state, prefix, options) {
+  options = options || {};
+  var foreignKeySelect = row.querySelector(
+    "." + prefix + "-foreign-key-target",
+  );
+  var typeSelect = row.querySelector("." + prefix + "-column-type");
+  var customTypeSelect = row.querySelector(
+    "." + prefix + "-custom-column-type",
+  );
+  if (!foreignKeySelect) {
+    return;
+  }
+  foreignKeySelect.dataset.selectedKey = foreignKeySelect.value;
+  updateSelectPlaceholder(foreignKeySelect, prefix + "-input-placeholder");
+
+  var foreignKeyOption = selectedSchemaDialogForeignKeyOption(foreignKeySelect);
+  setBlankSchemaDialogColumnNameFromForeignKey(row, prefix, foreignKeyOption);
+
+  var columnTypes = options.columnTypes || [];
+  var foreignKeyColumnType =
+    foreignKeyOption && foreignKeyOption.dataset.fkType
+      ? sqliteColumnTypeForForeignKeyTarget(foreignKeyOption.dataset.fkType)
+      : "";
+  if (
+    options.matchType &&
+    typeSelect &&
+    foreignKeyColumnType &&
+    columnTypes.indexOf(foreignKeyColumnType) !== -1 &&
+    typeSelect.value !== foreignKeyColumnType
+  ) {
+    typeSelect.value = foreignKeyColumnType;
+    syncSchemaDialogForeignKeyOptions(
+      row,
+      state,
+      prefix,
+      options.foreignKeyOptions,
+    );
+  }
+
+  if (customTypeSelect && foreignKeySelect.value) {
+    customTypeSelect.value = "";
+    updateSelectPlaceholder(customTypeSelect, prefix + "-input-placeholder");
+  }
+  syncSchemaDialogCustomTypeAndForeignKey(row, state, prefix);
+}
+
+function refreshSchemaDialogForeignKeyControls(state, prefix, options) {
+  schemaDialogRows(state, prefix).forEach(function (row) {
+    syncSchemaDialogForeignKeyOptions(row, state, prefix, options);
+    syncSchemaDialogCustomTypeAndForeignKey(row, state, prefix);
+  });
+}
+
+async function loadSchemaDialogForeignKeyTargets(state, prefix, url, options) {
+  if (!url || !window.fetch) {
+    state.foreignKeyTargets = [];
+    state.foreignKeyTargetsLoading = false;
+    refreshSchemaDialogForeignKeyControls(state, prefix, options);
+    return;
+  }
+  state.foreignKeyTargets = [];
+  state.foreignKeyTargetsError = null;
+  state.foreignKeyTargetsLoading = true;
+  refreshSchemaDialogForeignKeyControls(state, prefix, options);
+  try {
+    var response = await fetch(url, {
+      headers: {
+        Accept: "application/json",
+      },
+    });
+    var data = await response.json();
+    if (!response.ok || data.ok === false) {
+      throw rowMutationRequestError(response, data);
+    }
+    state.foreignKeyTargets = data.targets || [];
+  } catch (error) {
+    state.foreignKeyTargets = [];
+    state.foreignKeyTargetsError = error;
+  } finally {
+    state.foreignKeyTargetsLoading = false;
+    refreshSchemaDialogForeignKeyControls(state, prefix, options);
+  }
+}
+
+function syncTableCreateForeignKeyOptions(row, state) {
+  syncSchemaDialogForeignKeyOptions(row, state, "table-create", {
+    filterByType: false,
+  });
+}
+
+function syncTableCreateCustomTypeAndForeignKey(row, state) {
+  syncSchemaDialogCustomTypeAndForeignKey(row, state, "table-create");
+}
+
+function refreshTableCreateForeignKeyControls(state) {
+  tableCreateDialogRows(state).forEach(function (row) {
+    syncTableCreateForeignKeyOptions(row, state);
+    syncTableCreateCustomTypeAndForeignKey(row, state);
+  });
+}
+
+function updateTableCreateColumnRules(state) {
+  normalizeSchemaDialogPrimaryKeyRows(state, "table-create");
+  tableCreateDialogRows(state).forEach(function (row) {
+    syncTableCreateForeignKeyOptions(row, state);
+    syncTableCreateCustomTypeAndForeignKey(row, state);
+    syncSchemaDialogDefaultControls(row, "table-create");
+  });
+  updateTableCreateMoveButtons(state);
+}
+
+async function loadTableCreateForeignKeyTargets(state) {
+  return loadSchemaDialogForeignKeyTargets(
+    state,
+    "table-create",
+    tableCreateForeignKeyTargetsUrl(),
+    { filterByType: false },
+  );
+}
+
+function tableCreateIsDataMode(state) {
+  return state && state.mode === "data";
+}
+
+function tableCreateSaveButtonText(state) {
+  if (tableCreateIsDataMode(state)) {
+    return state.dataPreviewReady ? "Create table" : "Preview rows";
+  }
+  return "Create table";
+}
+
+function tableCreateCanInsertRows() {
+  var data = databaseCreateTableData() || {};
+  return !!data.canInsertRows;
+}
+
+function syncTableCreateModeUi(state) {
+  if (!state) {
+    return;
+  }
+  var isDataMode = tableCreateIsDataMode(state);
+  state.columnsPanel.hidden = isDataMode;
+  state.dataPanel.hidden = !isDataMode;
+  state.dataEditor.hidden = !isDataMode || state.dataPreviewReady;
+  state.dataPreview.hidden = !isDataMode || !state.dataPreviewReady;
+  state.createFromDataLink.hidden = isDataMode || !tableCreateCanInsertRows();
+  state.manualCreateLink.hidden = !isDataMode;
+}
+
+function updateTableCreateDialogButtons(state) {
+  if (!state) {
+    return;
+  }
+  syncTableCreateModeUi(state);
+  state.cancelButton.disabled = state.isSaving;
+  state.saveButton.disabled = state.isSaving;
+  state.addColumnButton.disabled = state.isSaving;
+  state.cancelButton.textContent =
+    tableCreateIsDataMode(state) && state.dataPreviewReady ? "Back" : "Cancel";
+  state.saveButton.textContent = state.isSaving
+    ? "Creating..."
+    : tableCreateSaveButtonText(state);
+}
+
+function tableCreateDialogSignature(state) {
+  if (!state || !state.form) {
+    return "";
+  }
+  var signature = {
+    table: state.tableName.value,
+    data: state.dataTextarea ? state.dataTextarea.value : "",
+    dataPrimaryKey: state.dataPkSelect
+      ? state.dataPkSelect.value
+      : TABLE_CREATE_AUTOMATIC_PK,
+    columns: tableCreateDialogRows(state).map(function (row) {
+      return {
+        name: row.querySelector(".table-create-column-name").value,
+        type: row.querySelector(".table-create-column-type").value,
+        customType:
+          (
+            row.querySelector(".table-create-custom-column-type") || {
+              value: "",
+            }
+          ).value || "",
+        pk: row.querySelector(".table-create-primary-key-input").checked,
+        notNull: row.querySelector(".table-create-not-null-input").checked,
+        defaultValue: row.querySelector(".table-create-default").value,
+        defaultExpr: row.querySelector(".table-create-default-expr").value,
+        foreignKey:
+          (
+            row.querySelector(".table-create-foreign-key-target") || {
+              value: "",
+            }
+          ).value || "",
+      };
+    }),
+  };
+  return JSON.stringify(signature);
+}
+
+function tableCreateDialogHasChanges(state) {
+  return (
+    !!state &&
+    !state.isSaving &&
+    tableCreateDialogSignature(state) !== state.initialSignature
+  );
+}
+
+function clearTableCreateDialogError(state) {
+  state.error.hidden = true;
+  state.error.textContent = "";
+  state.dialog.removeAttribute("aria-describedby");
+}
+
+function showTableCreateDialogError(state, message) {
+  state.error.hidden = false;
+  state.error.textContent = message;
+  state.dialog.setAttribute("aria-describedby", "table-create-error");
+  state.error.focus();
+}
+
+function setTableCreateDialogSaving(state, isSaving) {
+  state.isSaving = isSaving;
+  state.columnList
+    .querySelectorAll("input, select, button")
+    .forEach(function (control) {
+      control.disabled = isSaving;
+    });
+  state.fields
+    .querySelectorAll(
+      ".table-create-data input, .table-create-data select, .table-create-data textarea, .table-create-data button",
+    )
+    .forEach(function (control) {
+      control.disabled = isSaving;
+    });
+  state.tableName.disabled = isSaving;
+  if (!isSaving) {
+    updateTableCreateColumnRules(state);
+  }
+  updateTableCreateDialogButtons(state);
+  updateTableCreateMoveButtons(state);
+}
+
+function tableCreateSelectTypeValue(select, type) {
+  var options = tableCreateColumnTypes();
+  populateSqliteColumnTypeSelect(select, type, options);
+}
+
+function updateTableCreateCustomColumnTypePlaceholder(select) {
+  updateSelectPlaceholder(select, "table-create-input-placeholder");
+}
+
+function createTableCustomColumnTypeSelect() {
+  var options = tableCreateCustomColumnTypes();
+  return createCustomColumnTypeSelect(
+    options,
+    "table-create-input table-create-custom-column-type",
+    "table-create-input-placeholder",
+  );
+}
+
+function syncTableCreateCustomTypeForSqliteType(row) {
+  var typeSelect = row.querySelector(".table-create-column-type");
+  var customTypeSelect = row.querySelector(".table-create-custom-column-type");
+  if (!typeSelect || !customTypeSelect || !customTypeSelect.value) {
+    return;
+  }
+  var option = tableCreateCustomColumnType(customTypeSelect.value);
+  if (!tableCreateCustomTypeAppliesToSqliteType(option, typeSelect.value)) {
+    customTypeSelect.value = "";
+    updateTableCreateCustomColumnTypePlaceholder(customTypeSelect);
+  }
+}
+
+function createTableColumnRow(state, column) {
+  var index = state.nextColumnIndex;
+  state.nextColumnIndex += 1;
+
+  var row = document.createElement("div");
+  row.className = "table-create-column-row";
+
+  var main = document.createElement("div");
+  main.className = "table-create-column-main";
+
+  var details = document.createElement("div");
+  details.className = "table-create-column-details";
+  details.id = "table-create-column-details-" + index;
+  details.hidden = !(column && column.expanded);
+
+  var expandButton = createSchemaDialogMoreOptionsButton(
+    "table-create",
+    details,
+  );
+
+  var nameId = "table-create-column-name-" + index;
+  var nameLabel = document.createElement("label");
+  nameLabel.className = "table-create-column-label";
+  nameLabel.setAttribute("for", nameId);
+  nameLabel.textContent = "Column";
+
+  var nameInput = document.createElement("input");
+  nameInput.id = nameId;
+  nameInput.className = "table-create-input table-create-column-name";
+  nameInput.type = "text";
+  nameInput.required = true;
+  nameInput.autocomplete = "off";
+  nameInput.placeholder = "column name";
+  nameInput.value = column && column.name ? column.name : "";
+
+  var typeSelect = document.createElement("select");
+  typeSelect.className = "table-create-input table-create-column-type";
+  typeSelect.setAttribute("aria-label", "Column type");
+  tableCreateSelectTypeValue(typeSelect, column && column.type);
+
+  var customTypeSelect = null;
+  var customTypeField = null;
+  if (tableCreateCustomColumnTypes().length) {
+    var customTypeId = "table-create-column-custom-type-" + index;
+    customTypeField = document.createElement("div");
+    customTypeField.className =
+      "table-create-detail-field table-create-custom-type-field";
+    var customTypeLabel = document.createElement("label");
+    customTypeLabel.className = "table-create-detail-label";
+    customTypeLabel.setAttribute("for", customTypeId);
+    customTypeLabel.textContent = "Custom type";
+    var customTypeHelpId = "table-create-column-custom-type-help-" + index;
+    var customTypeHelp = document.createElement("p");
+    customTypeHelp.id = customTypeHelpId;
+    customTypeHelp.className = "table-create-detail-help";
+    customTypeHelp.textContent =
+      "Controls how Datasette displays and edits this column";
+    customTypeSelect = createTableCustomColumnTypeSelect();
+    customTypeSelect.id = customTypeId;
+    customTypeSelect.setAttribute("aria-describedby", customTypeHelpId);
+    customTypeSelect.value =
+      column && column.customType ? column.customType : "";
+    updateTableCreateCustomColumnTypePlaceholder(customTypeSelect);
+    customTypeField.appendChild(customTypeLabel);
+    customTypeField.appendChild(customTypeHelp);
+    customTypeField.appendChild(customTypeSelect);
+  }
+
+  var pkLabel = document.createElement("label");
+  pkLabel.className = "table-create-detail-check table-create-primary-key";
+  var pkInput = document.createElement("input");
+  pkInput.type = "checkbox";
+  pkInput.className = "table-create-primary-key-input";
+  pkInput.checked = !!(column && column.primaryKey);
+  var pkText = document.createElement("span");
+  var pkStrong = document.createElement("strong");
+  pkStrong.textContent = "Primary key";
+  pkText.appendChild(pkStrong);
+  pkText.appendChild(
+    document.createTextNode(" This ID uniquely identifies the record"),
+  );
+  pkLabel.appendChild(pkInput);
+  pkLabel.appendChild(pkText);
+
+  var foreignKeyId = "table-create-column-foreign-key-" + index;
+  var foreignKeyHelpId = "table-create-column-foreign-key-help-" + index;
+  var foreignKeyField = document.createElement("div");
+  foreignKeyField.className =
+    "table-create-detail-field table-create-foreign-key-field";
+  var foreignKeyLabel = document.createElement("label");
+  foreignKeyLabel.className = "table-create-detail-label";
+  foreignKeyLabel.setAttribute("for", foreignKeyId);
+  foreignKeyLabel.textContent = "Foreign key";
+  var foreignKeyHelp = document.createElement("p");
+  foreignKeyHelp.id = foreignKeyHelpId;
+  foreignKeyHelp.className = "table-create-detail-help";
+  foreignKeyHelp.textContent = "Link this column to another table.";
+  var foreignKeySelect = document.createElement("select");
+  foreignKeySelect.id = foreignKeyId;
+  foreignKeySelect.className =
+    "table-create-input table-create-foreign-key-target";
+  foreignKeySelect.setAttribute("aria-label", "Foreign key target");
+  foreignKeySelect.setAttribute("aria-describedby", foreignKeyHelpId);
+  foreignKeyField.appendChild(foreignKeyLabel);
+  foreignKeyField.appendChild(foreignKeyHelp);
+  foreignKeyField.appendChild(foreignKeySelect);
+
+  var notNullLabel = document.createElement("label");
+  notNullLabel.className = "table-create-detail-check table-create-not-null";
+  var notNullInput = document.createElement("input");
+  notNullInput.type = "checkbox";
+  notNullInput.className = "table-create-not-null-input";
+  notNullInput.checked = !!(column && column.notNull);
+  var notNullText = document.createElement("span");
+  var notNullStrong = document.createElement("strong");
+  notNullStrong.textContent = "Not null";
+  notNullText.appendChild(notNullStrong);
+  notNullText.appendChild(
+    document.createTextNode(" This value cannot be left unset"),
+  );
+  notNullLabel.appendChild(notNullInput);
+  notNullLabel.appendChild(notNullText);
+
+  var defaultControls = createSchemaDialogDefaultControls(
+    "table-create",
+    index,
+    tableCreateDefaultExpressions(),
+    {
+      defaultValue: column && column.defaultValue,
+      defaultExpr: column && column.defaultExpr,
+    },
+  );
+
+  var moveControls = createSchemaDialogMoveControls("table-create");
+
+  var removeButton = createSchemaDialogIconButton(
+    "table-create",
+    "remove-column",
+    "Remove column",
+    "Remove column",
+    COLUMN_MOVE_ICONS.remove,
+  );
+
+  main.appendChild(nameLabel);
+  main.appendChild(nameInput);
+  main.appendChild(typeSelect);
+  main.appendChild(moveControls.controls);
+  main.appendChild(removeButton);
+  main.appendChild(expandButton);
+
+  if (customTypeField) {
+    details.appendChild(customTypeField);
+  }
+  details.appendChild(defaultControls.controls);
+  details.appendChild(notNullLabel);
+  details.appendChild(pkLabel);
+  details.appendChild(foreignKeyField);
+  row.appendChild(main);
+  row.appendChild(details);
+
+  removeButton.addEventListener("click", function () {
+    if (state.isSaving) {
+      return;
+    }
+    row.remove();
+    clearTableCreateDialogError(state);
+    updateTableCreateColumnRules(state);
+    var nextInput = state.columnList.querySelector(".table-create-column-name");
+    if (nextInput) {
+      nextInput.focus();
+    } else {
+      state.addColumnButton.focus();
+    }
+  });
+
+  nameInput.addEventListener("input", function () {
+    clearTableCreateDialogError(state);
+  });
+  typeSelect.addEventListener("change", function () {
+    clearTableCreateDialogError(state);
+    syncTableCreateCustomTypeForSqliteType(row);
+    syncTableCreateForeignKeyOptions(row, state);
+    syncTableCreateCustomTypeAndForeignKey(row, state);
+  });
+  if (customTypeSelect) {
+    customTypeSelect.addEventListener("change", function () {
+      clearTableCreateDialogError(state);
+      updateTableCreateCustomColumnTypePlaceholder(customTypeSelect);
+      if (customTypeSelect.value) {
+        foreignKeySelect.value = "";
+        foreignKeySelect.dataset.selectedKey = "";
+      }
+      var option = tableCreateCustomColumnType(customTypeSelect.value);
+      if (
+        option &&
+        option.fixedSqliteType &&
+        tableCreateColumnTypes().indexOf(option.fixedSqliteType) !== -1
+      ) {
+        typeSelect.value = option.fixedSqliteType;
+        syncTableCreateForeignKeyOptions(row, state);
+      }
+      syncTableCreateCustomTypeAndForeignKey(row, state);
+    });
+  }
+  pkInput.addEventListener("change", function () {
+    clearTableCreateDialogError(state);
+    updateTableCreateColumnRules(state);
+  });
+  notNullInput.addEventListener("change", function () {
+    clearTableCreateDialogError(state);
+  });
+  defaultControls.defaultInput.addEventListener("input", function () {
+    if (defaultControls.defaultInput.value) {
+      defaultControls.defaultExprSelect.value = "";
+      syncSchemaDialogDefaultControls(row, "table-create");
+    }
+    clearTableCreateDialogError(state);
+  });
+  defaultControls.defaultExprSelect.addEventListener("change", function () {
+    if (defaultControls.defaultExprSelect.value) {
+      defaultControls.defaultInput.value = "";
+    }
+    if (
+      applyDefaultExpressionColumnType(
+        row,
+        "table-create",
+        tableCreateDefaultExpressions(),
+        tableCreateColumnTypes(),
+      )
+    ) {
+      syncTableCreateCustomTypeForSqliteType(row);
+      syncTableCreateForeignKeyOptions(row, state);
+      syncTableCreateCustomTypeAndForeignKey(row, state);
+    }
+    syncSchemaDialogDefaultControls(row, "table-create");
+    clearTableCreateDialogError(state);
+  });
+  foreignKeySelect.addEventListener("change", function () {
+    clearTableCreateDialogError(state);
+    handleSchemaDialogForeignKeyChange(row, state, "table-create", {
+      columnTypes: tableCreateColumnTypes(),
+      foreignKeyOptions: { filterByType: false },
+      matchType: true,
+    });
+  });
+
+  expandButton.addEventListener("click", function () {
+    toggleSchemaDialogMoreOptions(expandButton, details);
+  });
+
+  moveControls.topButton.addEventListener("click", function () {
+    var first = tableCreateFirstNonPrimaryRow(state);
+    if (
+      state.isSaving ||
+      tableCreateRowIsPrimaryKey(row) ||
+      !first ||
+      first === row
+    ) {
+      return;
+    }
+    state.columnList.insertBefore(row, first);
+    clearTableCreateDialogError(state);
+    updateTableCreateColumnRules(state);
+    row.querySelector(".table-create-column-name").focus();
+  });
+
+  moveControls.upButton.addEventListener("click", function () {
+    var previous = row.previousElementSibling;
+    if (
+      state.isSaving ||
+      tableCreateRowIsPrimaryKey(row) ||
+      !previous ||
+      tableCreateRowIsPrimaryKey(previous)
+    ) {
+      return;
+    }
+    state.columnList.insertBefore(row, previous);
+    clearTableCreateDialogError(state);
+    updateTableCreateColumnRules(state);
+    row.querySelector(".table-create-column-name").focus();
+  });
+
+  moveControls.downButton.addEventListener("click", function () {
+    var next = row.nextElementSibling;
+    if (state.isSaving || tableCreateRowIsPrimaryKey(row) || !next) {
+      return;
+    }
+    state.columnList.insertBefore(next, row);
+    clearTableCreateDialogError(state);
+    updateTableCreateColumnRules(state);
+    row.querySelector(".table-create-column-name").focus();
+  });
+
+  moveControls.bottomButton.addEventListener("click", function () {
+    var last = state.columnList.lastElementChild;
+    if (
+      state.isSaving ||
+      tableCreateRowIsPrimaryKey(row) ||
+      !last ||
+      last === row
+    ) {
+      return;
+    }
+    state.columnList.appendChild(row);
+    clearTableCreateDialogError(state);
+    updateTableCreateColumnRules(state);
+    row.querySelector(".table-create-column-name").focus();
+  });
+
+  syncSchemaDialogDefaultControls(row, "table-create");
+  return row;
+}
+
+function addTableCreateColumn(state, column) {
+  var row = createTableColumnRow(state, column || { type: "text" });
+  state.columnList.appendChild(row);
+  updateTableCreateColumnRules(state);
+  return row;
+}
+
+function resetTableCreateDialog(state) {
+  state.mode = "manual";
+  state.nextColumnIndex = 0;
+  state.tableName.value = "";
+  state.dataTextarea.value = "";
+  resetTableCreateDataPreview(state);
+  state.columnList.textContent = "";
+  addTableCreateColumn(state, {
+    name: "id",
+    type: "integer",
+    primaryKey: true,
+  });
+  addTableCreateColumn(state, {
+    name: "",
+    type: "text",
+    primaryKey: false,
+  });
+  updateTableCreateColumnRules(state);
+  updateTableCreateDialogButtons(state);
+  state.initialSignature = tableCreateDialogSignature(state);
+}
+
+function showTableCreateDataMode(state) {
+  if (!state || state.isSaving || !tableCreateCanInsertRows()) {
+    return;
+  }
+  state.mode = "data";
+  clearTableCreateDialogError(state);
+  updateTableCreateDialogButtons(state);
+  if (state.dataPreviewReady && state.dataPkSelect) {
+    state.dataPkSelect.focus();
+  } else {
+    state.dataTextarea.focus();
+  }
+}
+
+function showTableCreateManualMode(state) {
+  if (!state || state.isSaving) {
+    return;
+  }
+  state.mode = "manual";
+  clearTableCreateDialogError(state);
+  updateTableCreateDialogButtons(state);
+  var firstInput = state.columnList.querySelector(".table-create-column-name");
+  if (firstInput) {
+    firstInput.focus();
+  } else {
+    state.tableName.focus();
+  }
+}
+
+function collectTableCreatePayload(state) {
+  var payload = {
+    table: state.tableName.value.trim(),
+    columns: [],
+  };
+  var primaryKeys = [];
+  tableCreateDialogRows(state).forEach(function (row) {
+    var name = row.querySelector(".table-create-column-name").value.trim();
+    var type = row.querySelector(".table-create-column-type").value;
+    var column = { name: name, type: type };
+    var foreignKeySelect = row.querySelector(
+      ".table-create-foreign-key-target",
+    );
+    var foreignKeyOption =
+      foreignKeySelect && foreignKeySelect.selectedOptions
+        ? foreignKeySelect.selectedOptions[0]
+        : null;
+    if (
+      foreignKeyOption &&
+      foreignKeyOption.dataset.fkTable &&
+      foreignKeyOption.dataset.fkColumn
+    ) {
+      column.fk_table = foreignKeyOption.dataset.fkTable;
+      column.fk_column = foreignKeyOption.dataset.fkColumn;
+    }
+    if (row.querySelector(".table-create-not-null-input").checked) {
+      column.not_null = true;
+    }
+    var defaultExpr = row.querySelector(".table-create-default-expr").value;
+    var defaultValue = row.querySelector(".table-create-default").value;
+    if (defaultExpr) {
+      column.default_expr = defaultExpr;
+    } else if (defaultValue) {
+      column.default = defaultValue;
+    }
+    payload.columns.push(column);
+    if (row.querySelector(".table-create-primary-key-input").checked) {
+      primaryKeys.push(name);
+    }
+  });
+  if (primaryKeys.length === 1) {
+    payload.pk = primaryKeys[0];
+  } else if (primaryKeys.length > 1) {
+    payload.pks = primaryKeys;
+  }
+  return payload;
+}
+
+function collectTableCreateColumnTypeAssignments(state) {
+  var assignments = [];
+  tableCreateDialogRows(state).forEach(function (row) {
+    var customTypeSelect = row.querySelector(
+      ".table-create-custom-column-type",
+    );
+    if (!customTypeSelect || !customTypeSelect.value) {
+      return;
+    }
+    assignments.push({
+      column: row.querySelector(".table-create-column-name").value.trim(),
+      columnType: customTypeSelect.value,
+      sqliteType: row.querySelector(".table-create-column-type").value,
+    });
+  });
+  return assignments;
+}
+
+function validateTableCreatePayload(payload) {
+  var tableNameError = validateTableCreateTableName(payload.table);
+  if (tableNameError) {
+    return tableNameError;
+  }
+  if (!payload.columns.length) {
+    return "At least one column is required.";
+  }
+  var seen = {};
+  var supportedTypes = tableCreateColumnTypes();
+  for (var i = 0; i < payload.columns.length; i += 1) {
+    var column = payload.columns[i];
+    if (!column.name) {
+      return "Column name is required.";
+    }
+    if (column.name.indexOf("\n") !== -1) {
+      return "Column names cannot contain newlines.";
+    }
+    var columnKey = column.name.toLowerCase();
+    if (seen[columnKey]) {
+      return "Duplicate column name: " + column.name;
+    }
+    seen[columnKey] = true;
+    if (supportedTypes.indexOf(column.type) === -1) {
+      return "Unsupported column type: " + column.type;
+    }
+    if (column.default && column.default_expr) {
+      return "Use either a default value or a default expression.";
+    }
+  }
+  return null;
+}
+
+function validateTableCreateTableName(tableName) {
+  if (!tableName) {
+    return "Table name is required.";
+  }
+  if (tableName.indexOf("\n") !== -1) {
+    return "Table name cannot contain newlines.";
+  }
+  if (/^sqlite_/i.test(tableName)) {
+    return "Table name cannot start with sqlite_.";
+  }
+  return null;
+}
+
+function validateTableCreateColumnTypeAssignments(assignments) {
+  for (var i = 0; i < assignments.length; i += 1) {
+    var assignment = assignments[i];
+    var option = tableCreateCustomColumnType(assignment.columnType);
+    if (!option) {
+      return "Unknown custom column type: " + assignment.columnType;
+    }
+    if (
+      !tableCreateCustomTypeAppliesToSqliteType(option, assignment.sqliteType)
+    ) {
+      return (
+        "Custom type " +
+        assignment.columnType +
+        " cannot be used with SQLite type " +
+        assignment.sqliteType +
+        "."
+      );
+    }
+  }
+  return null;
+}
+
+function normalizeCreateTableDataJsonValue(value) {
+  if (typeof value === "undefined") {
+    return null;
+  }
+  if (Array.isArray(value) || (value && typeof value === "object")) {
+    return JSON.stringify(value);
+  }
+  return value;
+}
+
+function createTableDataColumnObjects(names) {
+  return names.map(function (name) {
+    return { name: name };
+  });
+}
+
+function validateCreateTableDataHeaders(headers) {
+  if (!headers.length) {
+    throw new Error("No columns found to preview.");
+  }
+  var seen = {};
+  headers.forEach(function (name, index) {
+    if (!name) {
+      throw new Error("Column header " + (index + 1) + " is blank.");
+    }
+    if (name.indexOf("\n") !== -1) {
+      throw new Error("Column names cannot contain newlines.");
+    }
+    var key = name.toLowerCase();
+    if (seen[key]) {
+      throw new Error("Duplicate column name: " + name);
+    }
+    seen[key] = true;
+  });
+}
+
+function jsonRowIsObject(item) {
+  return !!(item && typeof item === "object" && !Array.isArray(item));
+}
+
+function extractJsonObjectRows(parsed) {
+  if (Array.isArray(parsed)) {
+    return parsed;
+  }
+  if (!jsonRowIsObject(parsed)) {
+    throw new Error(
+      "JSON must be an array of objects, or an object containing an array of objects.",
+    );
+  }
+
+  var bestRows = null;
+  Object.keys(parsed).forEach(function (key) {
+    var value = parsed[key];
+    if (!Array.isArray(value) || !value.every(jsonRowIsObject)) {
+      return;
+    }
+    if (!bestRows || value.length > bestRows.length) {
+      bestRows = value;
+    }
+  });
+  if (!bestRows) {
+    throw new Error(
+      "JSON object must contain at least one root key with an array of objects.",
+    );
+  }
+  return bestRows;
+}
+
+function parseJsonObjectRows(text) {
+  var parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    throw new Error("Invalid JSON: " + error.message);
+  }
+  var rows = extractJsonObjectRows(parsed);
+  if (!rows.length) {
+    throw new Error("No rows found to preview.");
+  }
+  return rows;
+}
+
+function parseJsonCreateTableRows(text) {
+  var parsed = parseJsonObjectRows(text);
+
+  var columnNames = [];
+  var columnMap = {};
+  parsed.forEach(function (item, index) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) {
+      throw new Error("JSON row " + (index + 1) + " must be an object.");
+    }
+    Object.keys(item).forEach(function (name) {
+      if (!columnMap[name]) {
+        columnMap[name] = true;
+        columnNames.push(name);
+      }
+    });
+  });
+  validateCreateTableDataHeaders(columnNames);
+
+  var rows = parsed.map(function (item) {
+    var row = {};
+    columnNames.forEach(function (name) {
+      row[name] = Object.prototype.hasOwnProperty.call(item, name)
+        ? normalizeCreateTableDataJsonValue(item[name])
+        : null;
+    });
+    return row;
+  });
+  return {
+    columns: createTableDataColumnObjects(columnNames),
+    rows: rows,
+  };
+}
+
+function createTableDelimitedValueIsInteger(value) {
+  return /^[-+]?\d+$/.test(String(value).trim());
+}
+
+function createTableDelimitedValueIsFloat(value) {
+  var trimmed = String(value).trim();
+  if (!trimmed) {
+    return false;
+  }
+  var numberValue = Number(trimmed);
+  return Number.isFinite(numberValue);
+}
+
+function inferCreateTableDelimitedColumnType(values) {
+  var nonBlankValues = values.filter(function (value) {
+    return String(value).trim() !== "";
+  });
+  if (!nonBlankValues.length) {
+    return "text";
+  }
+  if (nonBlankValues.every(createTableDelimitedValueIsInteger)) {
+    return "integer";
+  }
+  if (nonBlankValues.every(createTableDelimitedValueIsFloat)) {
+    return "float";
+  }
+  return "text";
+}
+
+function coerceCreateTableDelimitedValue(value, type) {
+  var trimmed = String(value).trim();
+  if (trimmed === "") {
+    return type === "integer" || type === "float" ? null : "";
+  }
+  if (type === "integer") {
+    return parseInt(trimmed, 10);
+  }
+  if (type === "float") {
+    return Number(trimmed);
+  }
+  return value;
+}
+
+function detectCreateTableDataDelimiter(text) {
+  var firstLine =
+    text.split(/\r\n|\n|\r/).find(function (line) {
+      return line.trim() !== "";
+    }) || "";
+  var csvRows = delimiterPreviewRows(firstLine, ",");
+  var tsvRows = delimiterPreviewRows(firstLine, "\t");
+  var csvColumns = csvRows.length ? csvRows[0].length : 0;
+  var tsvColumns = tsvRows.length ? tsvRows[0].length : 0;
+
+  if (firstLine.indexOf("\t") !== -1 && firstLine.indexOf(",") === -1) {
+    return "\t";
+  }
+  if (tsvColumns > csvColumns) {
+    return "\t";
+  }
+  if (csvColumns > 1) {
+    return ",";
+  }
+  if (tsvColumns > 1) {
+    return "\t";
+  }
+  return null;
+}
+
+function parseDelimitedCreateTableRows(text) {
+  var delimiter = detectCreateTableDataDelimiter(text);
+  var rows = (
+    delimiter === null
+      ? splitSingleColumnRows(text)
+      : splitDelimitedRows(text, delimiter)
+  ).filter(function (row) {
+    return !bulkInsertDelimitedRowIsBlank(row);
+  });
+  if (!rows.length) {
+    throw new Error("No rows found to preview.");
+  }
+
+  var headers = rows[0].map(function (value) {
+    return value.trim();
+  });
+  validateCreateTableDataHeaders(headers);
+  var dataRows = rows.slice(1);
+  if (!dataRows.length) {
+    throw new Error("No data rows found to preview.");
+  }
+
+  dataRows.forEach(function (row, index) {
+    if (row.length > headers.length) {
+      throw new Error(
+        "Row " +
+          (index + 1) +
+          " has " +
+          row.length +
+          " values, but only " +
+          headers.length +
+          " columns were provided.",
+      );
+    }
+  });
+
+  var columnTypes = headers.map(function (_name, columnIndex) {
+    return inferCreateTableDelimitedColumnType(
+      dataRows.map(function (row) {
+        return row[columnIndex] || "";
+      }),
+    );
+  });
+
+  return {
+    columns: createTableDataColumnObjects(headers),
+    rows: dataRows.map(function (row) {
+      var rowObject = {};
+      headers.forEach(function (name, columnIndex) {
+        rowObject[name] = coerceCreateTableDelimitedValue(
+          row[columnIndex] || "",
+          columnTypes[columnIndex],
+        );
+      });
+      return rowObject;
+    }),
+  };
+}
+
+function parseCreateTableDataRows(text) {
+  var trimmed = text.trim();
+  if (!trimmed) {
+    throw new Error("Paste rows before previewing.");
+  }
+  if (trimmed[0] === "[" || trimmed[0] === "{") {
+    return parseJsonCreateTableRows(trimmed);
+  }
+  return parseDelimitedCreateTableRows(trimmed);
+}
+
+function tableCreateDataRecommendedPrimaryKey(columns, rows) {
+  var candidates = [];
+  columns.forEach(function (column, columnIndex) {
+    var distinctValues = {};
+    var maxLength = 0;
+    var valid = rows.length > 0;
+    rows.forEach(function (row) {
+      if (!valid) {
+        return;
+      }
+      var value = row[column.name];
+      if (value === null || typeof value === "undefined") {
+        valid = false;
+        return;
+      }
+      var text = String(value).trim();
+      if (!text || text.length >= 20 || /\s/.test(text)) {
+        valid = false;
+        return;
+      }
+      if (distinctValues[text]) {
+        valid = false;
+        return;
+      }
+      distinctValues[text] = true;
+      maxLength = Math.max(maxLength, text.length);
+    });
+    if (valid) {
+      candidates.push({
+        name: column.name,
+        maxLength: maxLength,
+        columnIndex: columnIndex,
+      });
+    }
+  });
+  candidates.sort(function (left, right) {
+    if (left.maxLength !== right.maxLength) {
+      return left.maxLength - right.maxLength;
+    }
+    return left.columnIndex - right.columnIndex;
+  });
+  return candidates.length ? candidates[0].name : TABLE_CREATE_AUTOMATIC_PK;
+}
+
+function renderTableCreateDataPreview(state, preview) {
+  state.dataPreview.textContent = "";
+
+  var summary = document.createElement("p");
+  summary.className = "table-create-data-preview-summary";
+  summary.textContent =
+    "Previewing " +
+    preview.rows.length +
+    " row" +
+    (preview.rows.length === 1 ? "." : "s.");
+  state.dataPreview.appendChild(summary);
+
+  var pkField = document.createElement("div");
+  pkField.className = "table-create-data-pk-field";
+  var pkLabel = document.createElement("label");
+  pkLabel.className = "table-create-data-label";
+  pkLabel.setAttribute("for", "table-create-data-primary-key");
+  pkLabel.textContent = "Primary key";
+  var pkSelect = document.createElement("select");
+  pkSelect.id = "table-create-data-primary-key";
+  pkSelect.className = "table-create-input table-create-data-primary-key";
+  var automaticOption = document.createElement("option");
+  automaticOption.value = TABLE_CREATE_AUTOMATIC_PK;
+  automaticOption.textContent = "Automatic ID column";
+  pkSelect.appendChild(automaticOption);
+  preview.columns.forEach(function (column) {
+    var option = document.createElement("option");
+    option.value = column.name;
+    option.textContent = column.name;
+    pkSelect.appendChild(option);
+  });
+  pkSelect.value = tableCreateDataRecommendedPrimaryKey(
+    preview.columns,
+    preview.rows,
+  );
+  pkSelect.addEventListener("change", function () {
+    clearTableCreateDialogError(state);
+  });
+  state.dataPkSelect = pkSelect;
+  pkField.appendChild(pkLabel);
+  pkField.appendChild(pkSelect);
+  state.dataPreview.appendChild(pkField);
+
+  var tableWrap = document.createElement("div");
+  tableWrap.className = "table-create-data-preview-table-wrap";
+  var table = document.createElement("table");
+  table.className = "table-create-data-preview-table";
+  var thead = document.createElement("thead");
+  var headerRow = document.createElement("tr");
+  preview.columns.forEach(function (column) {
+    var th = document.createElement("th");
+    th.scope = "col";
+    th.textContent = column.name;
+    headerRow.appendChild(th);
+  });
+  thead.appendChild(headerRow);
+  table.appendChild(thead);
+
+  var tbody = document.createElement("tbody");
+  preview.rows.forEach(function (row) {
+    var tr = document.createElement("tr");
+    preview.columns.forEach(function (column) {
+      var td = document.createElement("td");
+      var value = row[column.name];
+      td.textContent = bulkInsertPreviewValue(value);
+      if (value === null) {
+        td.className = "table-create-data-preview-null";
+      }
+      tr.appendChild(td);
+    });
+    tbody.appendChild(tr);
+  });
+  table.appendChild(tbody);
+  tableWrap.appendChild(table);
+  state.dataPreview.appendChild(tableWrap);
+  state.dataPreview.hidden = false;
+}
+
+function resetTableCreateDataPreview(state) {
+  state.dataPreviewRows = null;
+  state.dataPreviewColumns = [];
+  state.dataPreviewReady = false;
+  state.dataPkSelect = null;
+  state.dataPreview.hidden = true;
+  state.dataPreview.textContent = "";
+  syncTableCreateModeUi(state);
+}
+
+function tableCreateTableNameFromFileName(fileName) {
+  var baseName = (fileName || "").replace(/^.*[\\/]/, "");
+  var nameWithoutExtension = baseName.replace(/\.[^.]*$/, "");
+  return nameWithoutExtension
+    .trim()
+    .replace(/\s+/g, "_")
+    .toLowerCase()
+    .replace(/[^a-z0-9_]/g, "");
+}
+
+async function loadTableCreateDataTextFile(state, file) {
+  if (!file) {
+    return;
+  }
+  try {
+    var text = await readTextFile(file);
+    var tableName = tableCreateTableNameFromFileName(file.name);
+    if (tableName) {
+      state.tableName.value = tableName;
+      state.tableName.dispatchEvent(new Event("input", { bubbles: true }));
+    }
+    state.dataTextarea.value = text;
+    state.dataTextarea.dispatchEvent(new Event("input", { bubbles: true }));
+    clearTableCreateDialogError(state);
+    state.dataTextarea.focus();
+  } catch (_error) {
+    showTableCreateDialogError(state, "Could not read that text file.");
+  }
+}
+
+function previewTableCreateDataRows(state) {
+  clearTableCreateDialogError(state);
+  resetTableCreateDataPreview(state);
+  try {
+    var preview = parseCreateTableDataRows(state.dataTextarea.value);
+    state.dataPreviewRows = preview.rows;
+    state.dataPreviewColumns = preview.columns;
+    state.dataPreviewReady = true;
+    renderTableCreateDataPreview(state, preview);
+    updateTableCreateDialogButtons(state);
+  } catch (error) {
+    showTableCreateDialogError(
+      state,
+      error.message || "Could not preview rows.",
+    );
+    updateTableCreateDialogButtons(state);
+  }
+}
+
+function collectTableCreateDataPayload(state) {
+  var payload = {
+    table: state.tableName.value.trim(),
+    rows: state.dataPreviewRows || [],
+  };
+  var primaryKey = state.dataPkSelect
+    ? state.dataPkSelect.value
+    : TABLE_CREATE_AUTOMATIC_PK;
+  payload.pk =
+    primaryKey === TABLE_CREATE_AUTOMATIC_PK ? "id" : primaryKey || undefined;
+  return payload;
+}
+
+function validateTableCreateDataPayload(payload, state) {
+  var tableNameError = validateTableCreateTableName(payload.table);
+  if (tableNameError) {
+    return tableNameError;
+  }
+  if (!payload.rows.length) {
+    return "No rows found to create.";
+  }
+  if (
+    state.dataPkSelect &&
+    state.dataPkSelect.value === TABLE_CREATE_AUTOMATIC_PK &&
+    payload.rows.some(function (row) {
+      return Object.prototype.hasOwnProperty.call(row, "id");
+    })
+  ) {
+    return (
+      "Automatic ID column cannot be used because the pasted data " +
+      "already has an id column."
+    );
+  }
+  return null;
+}
+
+function fallbackTableUrl(tableName) {
+  var data = databaseCreateTableData() || {};
+  if (!data.path) {
+    return null;
+  }
+  return data.path.replace(/\/-\/create$/, "/" + encodeURIComponent(tableName));
+}
+
+function tableCreateSetColumnTypeUrl(responseData, payload) {
+  var tableUrl =
+    responseData.table_url ||
+    fallbackTableUrl(responseData.table || payload.table);
+  if (!tableUrl) {
+    return null;
+  }
+  var url = new URL(tableUrl, location.href);
+  url.hash = "";
+  url.search = "";
+  url.pathname = url.pathname.replace(/\/$/, "") + "/-/set-column-type";
+  return url.toString();
+}
+
+async function assignTableCreateColumnTypes(
+  responseData,
+  payload,
+  assignments,
+) {
+  if (!assignments.length) {
+    return;
+  }
+  var url = tableCreateSetColumnTypeUrl(responseData, payload);
+  if (!url) {
+    throw new Error("Could not find the set column type URL.");
+  }
+  for (var i = 0; i < assignments.length; i += 1) {
+    var assignment = assignments[i];
+    var response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+      },
+      body: JSON.stringify({
+        column: assignment.column,
+        column_type: {
+          type: assignment.columnType,
+        },
+      }),
+    });
+    var data = null;
+    try {
+      data = await response.json();
+    } catch (_error) {
+      data = null;
+    }
+    if (!response.ok || (data && data.ok === false)) {
+      var error = rowMutationRequestError(response, data);
+      throw new Error(
+        "Created table, but could not set custom type for " +
+          assignment.column +
+          ": " +
+          error.message,
+      );
+    }
+  }
+}
+
+async function createTableFromDataPreview(state) {
+  var data = databaseCreateTableData();
+  if (!data || !data.path) {
+    showTableCreateDialogError(state, "Could not find the create table URL.");
+    return;
+  }
+  var payload = collectTableCreateDataPayload(state);
+  var validationError = validateTableCreateDataPayload(payload, state);
+  if (validationError) {
+    showTableCreateDialogError(state, validationError);
+    return;
+  }
+  clearTableCreateDialogError(state);
+  setTableCreateDialogSaving(state, true);
+  try {
+    var response = await fetch(data.path, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+      },
+      body: JSON.stringify(payload),
+    });
+    var responseData = null;
+    try {
+      responseData = await response.json();
+    } catch (_error) {
+      responseData = null;
+    }
+    if (!response.ok || (responseData && responseData.ok === false)) {
+      throw rowMutationRequestError(response, responseData);
+    }
+    var tableUrl =
+      responseData.table_url ||
+      fallbackTableUrl(responseData.table || payload.table);
+    state.shouldRestoreFocus = false;
+    state.dialog.close();
+    if (tableUrl) {
+      location.href = tableUrl;
+    } else {
+      location.reload();
+    }
+  } catch (error) {
+    setTableCreateDialogSaving(state, false);
+    showTableCreateDialogError(
+      state,
+      error.message || "Could not create table",
+    );
+  }
+}
+
+async function saveTableCreateDialog(state) {
+  if (state.isSaving) {
+    return;
+  }
+  var data = databaseCreateTableData();
+  if (!data || !data.path) {
+    showTableCreateDialogError(state, "Could not find the create table URL.");
+    return;
+  }
+  if (tableCreateIsDataMode(state)) {
+    if (!state.dataPreviewReady) {
+      previewTableCreateDataRows(state);
+    } else {
+      await createTableFromDataPreview(state);
+    }
+    return;
+  }
+  clearTableCreateDialogError(state);
+  var payload = collectTableCreatePayload(state);
+  var columnTypeAssignments = collectTableCreateColumnTypeAssignments(state);
+  var validationError = validateTableCreatePayload(payload);
+  if (validationError) {
+    showTableCreateDialogError(state, validationError);
+    return;
+  }
+  var columnTypeValidationError = validateTableCreateColumnTypeAssignments(
+    columnTypeAssignments,
+  );
+  if (columnTypeValidationError) {
+    showTableCreateDialogError(state, columnTypeValidationError);
+    return;
+  }
+  setTableCreateDialogSaving(state, true);
+  try {
+    var response = await fetch(data.path, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+      },
+      body: JSON.stringify(payload),
+    });
+    var responseData = null;
+    try {
+      responseData = await response.json();
+    } catch (_error) {
+      responseData = null;
+    }
+    if (!response.ok || (responseData && responseData.ok === false)) {
+      throw rowMutationRequestError(response, responseData);
+    }
+    await assignTableCreateColumnTypes(
+      responseData,
+      payload,
+      columnTypeAssignments,
+    );
+    var tableUrl =
+      responseData.table_url ||
+      fallbackTableUrl(responseData.table || payload.table);
+    state.shouldRestoreFocus = false;
+    state.dialog.close();
+    if (tableUrl) {
+      location.href = tableUrl;
+    } else {
+      location.reload();
+    }
+  } catch (error) {
+    setTableCreateDialogSaving(state, false);
+    showTableCreateDialogError(
+      state,
+      error.message || "Could not create table",
+    );
+  }
+}
+
+function confirmDiscardTableCreateChanges(state) {
+  if (!tableCreateDialogHasChanges(state)) {
+    return true;
+  }
+  return window.confirm("Discard this new table?");
+}
+
+function closeTableCreateDialogIfConfirmed(state) {
+  if (!state || state.isSaving) {
+    return false;
+  }
+  if (!confirmDiscardTableCreateChanges(state)) {
+    return false;
+  }
+  state.shouldRestoreFocus = true;
+  state.dialog.close();
+  return true;
+}
+
+function ensureTableCreateDialog(manager) {
+  if (tableCreateDialogState) {
+    return tableCreateDialogState;
+  }
+  if (!window.HTMLDialogElement) {
+    return null;
+  }
+
+  var dialog = document.createElement("dialog");
+  dialog.id = TABLE_CREATE_DIALOG_ID;
+  dialog.className = "table-create-dialog";
+  dialog.setAttribute("aria-labelledby", "table-create-title");
+  dialog.innerHTML = `
+    <div class="modal-header">
+      <span class="modal-title" id="table-create-title">Create table</span>
+    </div>
+    <form class="table-create-form" method="post" novalidate>
+      <p class="table-create-error" id="table-create-error" role="alert" tabindex="-1" hidden></p>
+      <div class="table-create-fields">
+        <div class="table-create-field">
+          <label class="table-create-label" for="table-create-name">Table name</label>
+          <input class="table-create-input table-create-table-name" id="table-create-name" type="text" name="table" required autocomplete="off">
+        </div>
+        <div class="table-create-columns">
+          <div class="table-create-column-headings" aria-hidden="true">
+            <span>Column</span>
+            <span>Type</span>
+            <span>Move</span>
+            <span></span>
+          </div>
+          <div class="table-create-column-list"></div>
+          <button type="button" class="table-create-add-column"><svg aria-hidden="true" xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M5 12h14"></path><path d="M12 5v14"></path></svg><span>Add column</span></button>
+        </div>
+        <div class="table-create-data" hidden>
+          <div class="table-create-data-editor">
+            <p class="table-create-data-note"><label for="table-create-data-textarea">Paste TSV, CSV, or JSON</label>. You can also <button type="button" class="button-as-link table-create-data-open-file">open a file</button> or drop it onto this textarea</p>
+            <input class="table-create-data-file-input" type="file" accept=".csv,.tsv,.json,.txt,text/csv,text/tab-separated-values,application/json,text/plain" hidden>
+            <textarea class="table-create-input table-create-data-textarea" id="table-create-data-textarea" name="_create_rows" rows="12" spellcheck="false"></textarea>
+          </div>
+          <div class="table-create-data-preview" hidden></div>
+        </div>
+      </div>
+      <div class="modal-footer">
+        <a href="#" class="table-create-mode-link table-create-from-data">Create table from data</a>
+        <a href="#" class="table-create-mode-link table-create-manual" hidden>Create table manually</a>
+        <button type="button" class="btn btn-ghost table-create-cancel">Cancel</button>
+        <button type="submit" class="btn btn-primary table-create-save">Create table</button>
+      </div>
+    </form>
+  `;
+  document.body.appendChild(dialog);
+
+  tableCreateDialogState = {
+    dialog: dialog,
+    form: dialog.querySelector(".table-create-form"),
+    title: dialog.querySelector(".modal-title"),
+    error: dialog.querySelector(".table-create-error"),
+    fields: dialog.querySelector(".table-create-fields"),
+    tableName: dialog.querySelector(".table-create-table-name"),
+    columnsPanel: dialog.querySelector(".table-create-columns"),
+    columnList: dialog.querySelector(".table-create-column-list"),
+    addColumnButton: dialog.querySelector(".table-create-add-column"),
+    dataPanel: dialog.querySelector(".table-create-data"),
+    dataEditor: dialog.querySelector(".table-create-data-editor"),
+    dataTextarea: dialog.querySelector(".table-create-data-textarea"),
+    dataOpenFileButton: dialog.querySelector(".table-create-data-open-file"),
+    dataFileInput: dialog.querySelector(".table-create-data-file-input"),
+    dataPreview: dialog.querySelector(".table-create-data-preview"),
+    createFromDataLink: dialog.querySelector(".table-create-from-data"),
+    manualCreateLink: dialog.querySelector(".table-create-manual"),
+    cancelButton: dialog.querySelector(".table-create-cancel"),
+    saveButton: dialog.querySelector(".table-create-save"),
+    currentButton: null,
+    shouldRestoreFocus: true,
+    isSaving: false,
+    mode: "manual",
+    dataPreviewRows: null,
+    dataPreviewColumns: [],
+    dataPreviewReady: false,
+    dataPkSelect: null,
+    initialSignature: "",
+    nextColumnIndex: 0,
+    foreignKeyTargets: [],
+    foreignKeyTargetsError: null,
+    foreignKeyTargetsLoading: false,
+    manager: manager,
+  };
+
+  tableCreateDialogState.form.addEventListener("submit", function (ev) {
+    ev.preventDefault();
+    saveTableCreateDialog(tableCreateDialogState);
+  });
+
+  tableCreateDialogState.addColumnButton.addEventListener("click", function () {
+    if (tableCreateDialogState.isSaving) {
+      return;
+    }
+    var row = addTableCreateColumn(tableCreateDialogState, { type: "text" });
+    clearTableCreateDialogError(tableCreateDialogState);
+    row.querySelector(".table-create-column-name").focus();
+  });
+
+  tableCreateDialogState.cancelButton.addEventListener("click", function () {
+    if (
+      tableCreateIsDataMode(tableCreateDialogState) &&
+      tableCreateDialogState.dataPreviewReady &&
+      !tableCreateDialogState.isSaving
+    ) {
+      resetTableCreateDataPreview(tableCreateDialogState);
+      updateTableCreateDialogButtons(tableCreateDialogState);
+      tableCreateDialogState.dataTextarea.focus();
+      return;
+    }
+    closeTableCreateDialogIfConfirmed(tableCreateDialogState);
+  });
+
+  tableCreateDialogState.createFromDataLink.addEventListener(
+    "click",
+    function (ev) {
+      ev.preventDefault();
+      showTableCreateDataMode(tableCreateDialogState);
+    },
+  );
+
+  tableCreateDialogState.manualCreateLink.addEventListener(
+    "click",
+    function (ev) {
+      ev.preventDefault();
+      showTableCreateManualMode(tableCreateDialogState);
+    },
+  );
+
+  tableCreateDialogState.tableName.addEventListener("input", function () {
+    clearTableCreateDialogError(tableCreateDialogState);
+  });
+
+  tableCreateDialogState.dataOpenFileButton.addEventListener(
+    "click",
+    function () {
+      tableCreateDialogState.dataFileInput.click();
+    },
+  );
+
+  tableCreateDialogState.dataFileInput.addEventListener(
+    "change",
+    async function (ev) {
+      var files = ev.target.files;
+      await loadTableCreateDataTextFile(
+        tableCreateDialogState,
+        files && files.length ? files[0] : null,
+      );
+      ev.target.value = "";
+    },
+  );
+
+  tableCreateDialogState.dataTextarea.addEventListener(
+    "dragenter",
+    function (ev) {
+      ev.preventDefault();
+      tableCreateDialogState.dataTextarea.classList.add(
+        "table-create-data-drop-target",
+      );
+    },
+  );
+
+  tableCreateDialogState.dataTextarea.addEventListener(
+    "dragover",
+    function (ev) {
+      ev.preventDefault();
+      tableCreateDialogState.dataTextarea.classList.add(
+        "table-create-data-drop-target",
+      );
+    },
+  );
+
+  tableCreateDialogState.dataTextarea.addEventListener(
+    "dragleave",
+    function () {
+      tableCreateDialogState.dataTextarea.classList.remove(
+        "table-create-data-drop-target",
+      );
+    },
+  );
+
+  tableCreateDialogState.dataTextarea.addEventListener(
+    "drop",
+    async function (ev) {
+      ev.preventDefault();
+      tableCreateDialogState.dataTextarea.classList.remove(
+        "table-create-data-drop-target",
+      );
+      var files = ev.dataTransfer && ev.dataTransfer.files;
+      if (!files || !files.length) {
+        return;
+      }
+      await loadTableCreateDataTextFile(tableCreateDialogState, files[0]);
+    },
+  );
+
+  tableCreateDialogState.dataTextarea.addEventListener("dragend", function () {
+    tableCreateDialogState.dataTextarea.classList.remove(
+      "table-create-data-drop-target",
+    );
+  });
+
+  tableCreateDialogState.dataTextarea.addEventListener("input", function () {
+    resetTableCreateDataPreview(tableCreateDialogState);
+    clearTableCreateDialogError(tableCreateDialogState);
+    updateTableCreateDialogButtons(tableCreateDialogState);
+  });
+
+  dialog.addEventListener("click", function (ev) {
+    if (ev.target === dialog) {
+      closeTableCreateDialogIfConfirmed(tableCreateDialogState);
+    }
+  });
+
+  dialog.addEventListener("keydown", function (ev) {
+    if (ev.key !== "Escape") {
+      return;
+    }
+    ev.preventDefault();
+    closeTableCreateDialogIfConfirmed(tableCreateDialogState);
+  });
+
+  dialog.addEventListener("cancel", function (ev) {
+    ev.preventDefault();
+    closeTableCreateDialogIfConfirmed(tableCreateDialogState);
+  });
+
+  dialog.addEventListener("close", function () {
+    var state = tableCreateDialogState;
+    clearTableCreateDialogError(state);
+    setTableCreateDialogSaving(state, false);
+    if (
+      state.shouldRestoreFocus &&
+      state.currentButton &&
+      document.contains(state.currentButton)
+    ) {
+      state.currentButton.focus();
+    }
+  });
+
+  return tableCreateDialogState;
+}
+
+function openTableCreateDialog(button, manager) {
+  var data = databaseCreateTableData();
+  if (!data) {
+    return;
+  }
+  var state = ensureTableCreateDialog(manager);
+  if (!state) {
+    return;
+  }
+
+  var menu = button.closest("details");
+  if (menu) {
+    menu.open = false;
+  }
+  state.manager = manager;
+  state.currentButton = button;
+  state.shouldRestoreFocus = true;
+  state.title.textContent = "Create a table in " + data.databaseName;
+  clearTableCreateDialogError(state);
+  resetTableCreateDialog(state);
+  loadTableCreateForeignKeyTargets(state);
+  if (!state.dialog.open) {
+    state.dialog.showModal();
+  }
+  state.tableName.focus();
+}
+
+function initTableCreateActions(manager) {
+  if (
+    !window.fetch ||
+    !window.HTMLDialogElement ||
+    !databaseCreateTableData()
+  ) {
+    return;
+  }
+  document.addEventListener("click", function (ev) {
+    var button = ev.target.closest(
+      'button[data-database-action="create-table"]',
+    );
+    if (!button) {
+      return;
+    }
+    ev.preventDefault();
+    openTableCreateDialog(button, manager);
+  });
+}
+
 function setRowDeleteDialogBusy(state, isBusy) {
   state.isBusy = isBusy;
   state.confirmButton.disabled = isBusy;
@@ -141,6 +2544,1622 @@ function tableInsertData() {
   return tablePageData().insertRow;
 }
 
+function tableAlterData() {
+  return tablePageData().alterTable;
+}
+
+function tableAlterColumnTypes() {
+  var data = tableAlterData() || {};
+  return data.columnTypes && data.columnTypes.length
+    ? data.columnTypes
+    : ["text", "integer", "float", "blob"];
+}
+
+function tableAlterDefaultExpressions() {
+  var data = tableAlterData() || {};
+  return data.defaultExpressions || [];
+}
+
+function tableAlterForeignKeyTargetsUrl() {
+  var data = tableAlterData() || {};
+  return data.foreignKeyTargetsPath || null;
+}
+
+function tableAlterCustomColumnTypes() {
+  var data = tableAlterData() || {};
+  return data.customColumnTypes || [];
+}
+
+function tableAlterCustomColumnType(name) {
+  var options = tableAlterCustomColumnTypes();
+  for (var i = 0; i < options.length; i += 1) {
+    if (options[i].name === name) {
+      return options[i];
+    }
+  }
+  return null;
+}
+
+function tableAlterCustomTypeAppliesToSqliteType(option, sqliteType) {
+  return (
+    option &&
+    option.sqliteTypes &&
+    option.sqliteTypes.indexOf(sqliteType) !== -1
+  );
+}
+
+function tableAlterDialogRows(state) {
+  return schemaDialogRows(state, "table-alter");
+}
+
+function syncTableAlterForeignKeyOptions(row, state) {
+  syncSchemaDialogForeignKeyOptions(row, state, "table-alter", {
+    filterByType: false,
+  });
+}
+
+function tableAlterRowSignature(row) {
+  var foreignKeySelect = row.querySelector(".table-alter-foreign-key-target");
+  var foreignKeyValue = foreignKeySelect
+    ? foreignKeySelect.value || foreignKeySelect.dataset.selectedKey || ""
+    : "";
+  var foreignKeyOption =
+    foreignKeySelect && foreignKeySelect.selectedOptions
+      ? foreignKeySelect.selectedOptions[0]
+      : null;
+  return {
+    existing: row.dataset.existing === "1",
+    originalName: row.dataset.originalName || "",
+    name: row.querySelector(".table-alter-column-name").value,
+    type: row.querySelector(".table-alter-column-type").value,
+    customType:
+      (
+        row.querySelector(".table-alter-custom-column-type") || {
+          value: "",
+        }
+      ).value || "",
+    notNull: row.querySelector(".table-alter-not-null-input").checked,
+    defaultValue: row.querySelector(".table-alter-default").value,
+    defaultExpr: row.querySelector(".table-alter-default-expr").value,
+    pk: row.querySelector(".table-alter-primary-key-input").checked,
+    foreignKey: foreignKeyValue,
+    foreignKeyTable:
+      foreignKeyOption && foreignKeyOption.dataset.fkTable
+        ? foreignKeyOption.dataset.fkTable
+        : "",
+    foreignKeyColumn:
+      foreignKeyOption && foreignKeyOption.dataset.fkColumn
+        ? foreignKeyOption.dataset.fkColumn
+        : "",
+  };
+}
+
+function tableAlterDialogSignature(state) {
+  if (!state || !state.form) {
+    return "";
+  }
+  return JSON.stringify({
+    tableName: state.tableNameInput ? state.tableNameInput.value.trim() : "",
+    columns: tableAlterDialogRows(state).map(tableAlterRowSignature),
+    deletedColumns: state.deletedColumns.slice(),
+  });
+}
+
+function tableAlterDialogHasChanges(state) {
+  return (
+    !!state &&
+    !state.isSaving &&
+    tableAlterDialogSignature(state) !== state.initialSignature
+  );
+}
+
+function updateTableAlterSaveButtonState(state) {
+  if (!state || !state.saveButton) {
+    return;
+  }
+  state.saveButton.disabled =
+    state.isSaving ||
+    (state.mode !== "review" &&
+      tableAlterDialogSignature(state) === state.initialSignature);
+}
+
+function tableAlterRowIsPrimaryKey(row) {
+  return schemaDialogRowIsPrimaryKey(row, "table-alter");
+}
+
+function tableAlterFirstNonPrimaryRow(state) {
+  return schemaDialogFirstNonPrimaryRow(state, "table-alter");
+}
+
+function updateTableAlterMoveButtons(state) {
+  updateSchemaDialogMoveButtons(state, "table-alter");
+}
+
+function normalizeTableAlterPrimaryKeyRows(state) {
+  normalizeSchemaDialogPrimaryKeyRows(state, "table-alter");
+}
+
+function clearTableAlterDialogError(state) {
+  state.error.hidden = true;
+  state.error.textContent = "";
+  state.dialog.removeAttribute("aria-describedby");
+}
+
+function showTableAlterDialogError(state, message) {
+  state.error.hidden = false;
+  state.error.textContent = message;
+  state.dialog.setAttribute("aria-describedby", "table-alter-error");
+  state.error.focus();
+}
+
+function setTableAlterDialogSaving(state, isSaving) {
+  state.isSaving = isSaving;
+  state.cancelButton.disabled = isSaving;
+  state.addColumnButton.disabled = isSaving;
+  state.backButton.disabled = isSaving;
+  state.dropButton.disabled = isSaving;
+  state.saveButton.textContent = isSaving
+    ? state.mode === "review"
+      ? "Applying..."
+      : "Preparing..."
+    : tableAlterSaveButtonText(state);
+  state.fields
+    .querySelectorAll("input, select, button")
+    .forEach(function (control) {
+      control.disabled = isSaving;
+    });
+  if (!isSaving) {
+    state.columnList
+      .querySelectorAll(".table-alter-default-expr")
+      .forEach(function (select) {
+        syncSchemaDialogDefaultControls(
+          select.closest(".table-alter-column-row"),
+          "table-alter",
+        );
+      });
+    refreshSchemaDialogForeignKeyControls(state, "table-alter");
+  }
+  updateTableAlterMoveButtons(state);
+  updateTableAlterSaveButtonState(state);
+}
+
+function tableAlterSaveButtonText(state) {
+  return state && state.mode === "review" ? "Apply changes" : "Review changes";
+}
+
+function tableAlterSelectTypeValue(select, type) {
+  var options = tableAlterColumnTypes();
+  populateSqliteColumnTypeSelect(select, type, options);
+}
+
+function updateTableAlterCustomColumnTypePlaceholder(select) {
+  updateSelectPlaceholder(select, "table-alter-input-placeholder");
+}
+
+function createTableAlterCustomColumnTypeSelect() {
+  var options = tableAlterCustomColumnTypes();
+  return createCustomColumnTypeSelect(
+    options,
+    "table-alter-input table-alter-custom-column-type",
+    "table-alter-input-placeholder",
+  );
+}
+
+function syncTableAlterCustomTypeForSqliteType(row) {
+  var typeSelect = row.querySelector(".table-alter-column-type");
+  var customTypeSelect = row.querySelector(".table-alter-custom-column-type");
+  if (!typeSelect || !customTypeSelect || !customTypeSelect.value) {
+    return;
+  }
+  var option = tableAlterCustomColumnType(customTypeSelect.value);
+  if (!tableAlterCustomTypeAppliesToSqliteType(option, typeSelect.value)) {
+    customTypeSelect.value = "";
+    updateTableAlterCustomColumnTypePlaceholder(customTypeSelect);
+  }
+}
+
+function createTableAlterColumnRow(state, column) {
+  var index = state.nextColumnIndex;
+  state.nextColumnIndex += 1;
+  var existing = !!(column && column.existing);
+  var originalName = existing ? column.name || "" : "";
+  var originalCustomType =
+    existing && column.column_type ? column.column_type.type || "" : "";
+  var originalDefaultExpr =
+    existing && column.has_default && column.default_expr
+      ? column.default_expr
+      : "";
+  var originalDefault =
+    existing &&
+    column.has_default &&
+    !originalDefaultExpr &&
+    column.default !== null
+      ? String(column.default)
+      : "";
+  var originalForeignKey =
+    existing && column.foreign_key
+      ? foreignKeyTargetKey(column.foreign_key)
+      : "";
+
+  var row = document.createElement("div");
+  row.className = "table-alter-column-row";
+  row.dataset.existing = existing ? "1" : "0";
+  row.dataset.originalName = originalName;
+  row.dataset.originalType = existing ? column.type || "text" : "";
+  row.dataset.originalNotNull = existing && column.notnull ? "1" : "0";
+  row.dataset.originalHasDefault = existing && column.has_default ? "1" : "0";
+  row.dataset.originalDefault = originalDefault;
+  row.dataset.originalDefaultExpr = originalDefaultExpr;
+  row.dataset.originalPk = existing && column.is_pk ? "1" : "0";
+  row.dataset.originalCustomType = originalCustomType;
+  row.dataset.originalForeignKey = originalForeignKey;
+
+  var main = document.createElement("div");
+  main.className = "table-alter-column-main";
+
+  var details = document.createElement("div");
+  details.className = "table-alter-column-details";
+  details.id = "table-alter-column-details-" + index;
+  details.hidden = !(column && column.expanded);
+
+  var expandButton = createSchemaDialogMoreOptionsButton(
+    "table-alter",
+    details,
+  );
+
+  var nameId = "table-alter-column-name-" + index;
+  var nameLabel = document.createElement("label");
+  nameLabel.className = "table-alter-column-label";
+  nameLabel.setAttribute("for", nameId);
+  nameLabel.textContent = "Column";
+
+  var nameInput = document.createElement("input");
+  nameInput.id = nameId;
+  nameInput.className = "table-alter-input table-alter-column-name";
+  nameInput.type = "text";
+  nameInput.required = true;
+  nameInput.autocomplete = "off";
+  nameInput.placeholder = "column name";
+  nameInput.value = column && column.name ? column.name : "";
+
+  var typeSelect = document.createElement("select");
+  typeSelect.className = "table-alter-input table-alter-column-type";
+  typeSelect.setAttribute("aria-label", "Column type");
+  tableAlterSelectTypeValue(typeSelect, column && column.type);
+
+  var customTypeSelect = null;
+  var customTypeField = null;
+  if (tableAlterCustomColumnTypes().length) {
+    var customTypeId = "table-alter-column-custom-type-" + index;
+    customTypeField = document.createElement("div");
+    customTypeField.className =
+      "table-alter-detail-field table-alter-custom-type-field";
+    var customTypeLabel = document.createElement("label");
+    customTypeLabel.className = "table-alter-detail-label";
+    customTypeLabel.setAttribute("for", customTypeId);
+    customTypeLabel.textContent = "Custom type";
+    var customTypeHelpId = "table-alter-column-custom-type-help-" + index;
+    var customTypeHelp = document.createElement("p");
+    customTypeHelp.id = customTypeHelpId;
+    customTypeHelp.className = "table-alter-detail-help";
+    customTypeHelp.textContent =
+      "Controls how Datasette displays and edits this column";
+    customTypeSelect = createTableAlterCustomColumnTypeSelect();
+    customTypeSelect.id = customTypeId;
+    customTypeSelect.setAttribute("aria-describedby", customTypeHelpId);
+    customTypeSelect.value = originalCustomType;
+    updateTableAlterCustomColumnTypePlaceholder(customTypeSelect);
+    customTypeField.appendChild(customTypeLabel);
+    customTypeField.appendChild(customTypeHelp);
+    customTypeField.appendChild(customTypeSelect);
+  }
+
+  var notNullLabel = document.createElement("label");
+  notNullLabel.className = "table-alter-detail-check table-alter-not-null";
+  var notNullInput = document.createElement("input");
+  notNullInput.type = "checkbox";
+  notNullInput.className = "table-alter-not-null-input";
+  notNullInput.checked = !!(column && column.notnull);
+  var notNullText = document.createElement("span");
+  var notNullStrong = document.createElement("strong");
+  notNullStrong.textContent = "Not null";
+  notNullText.appendChild(notNullStrong);
+  notNullText.appendChild(
+    document.createTextNode(" This value cannot be left unset"),
+  );
+  notNullLabel.appendChild(notNullInput);
+  notNullLabel.appendChild(notNullText);
+
+  var defaultControls = createSchemaDialogDefaultControls(
+    "table-alter",
+    index,
+    tableAlterDefaultExpressions(),
+    {
+      defaultValue: originalDefault,
+      defaultExpr: originalDefaultExpr,
+    },
+  );
+  var defaultInput = defaultControls.defaultInput;
+  var defaultExprSelect = defaultControls.defaultExprSelect;
+
+  var foreignKeyId = "table-alter-column-foreign-key-" + index;
+  var foreignKeyHelpId = "table-alter-column-foreign-key-help-" + index;
+  var foreignKeyField = document.createElement("div");
+  foreignKeyField.className =
+    "table-alter-detail-field table-alter-foreign-key-field";
+  var foreignKeyLabel = document.createElement("label");
+  foreignKeyLabel.className = "table-alter-detail-label";
+  foreignKeyLabel.setAttribute("for", foreignKeyId);
+  foreignKeyLabel.textContent = "Foreign key";
+  var foreignKeyHelp = document.createElement("p");
+  foreignKeyHelp.id = foreignKeyHelpId;
+  foreignKeyHelp.className = "table-alter-detail-help";
+  foreignKeyHelp.textContent = "Link this column to another table.";
+  var foreignKeySelect = document.createElement("select");
+  foreignKeySelect.id = foreignKeyId;
+  foreignKeySelect.className =
+    "table-alter-input table-alter-foreign-key-target";
+  foreignKeySelect.setAttribute("aria-label", "Foreign key target");
+  foreignKeySelect.setAttribute("aria-describedby", foreignKeyHelpId);
+  foreignKeySelect.dataset.selectedKey = originalForeignKey;
+  if (column && column.foreign_key) {
+    foreignKeySelect.dataset.currentFkTable = column.foreign_key.fk_table;
+    foreignKeySelect.dataset.currentFkColumn = column.foreign_key.fk_column;
+    appendForeignKeyTargetOption(foreignKeySelect, {
+      fk_table: column.foreign_key.fk_table,
+      fk_column: column.foreign_key.fk_column,
+      type: column.type || "text",
+    });
+    foreignKeySelect.value = originalForeignKey;
+  }
+  foreignKeyField.appendChild(foreignKeyLabel);
+  foreignKeyField.appendChild(foreignKeyHelp);
+  foreignKeyField.appendChild(foreignKeySelect);
+
+  var pkLabel = document.createElement("label");
+  pkLabel.className = "table-alter-detail-check table-alter-primary-key";
+  var pkInput = document.createElement("input");
+  pkInput.type = "checkbox";
+  pkInput.className = "table-alter-primary-key-input";
+  pkInput.checked = !!(column && column.is_pk);
+  var pkText = document.createElement("span");
+  var pkStrong = document.createElement("strong");
+  pkStrong.textContent = "Primary key";
+  pkText.appendChild(pkStrong);
+  pkText.appendChild(
+    document.createTextNode(" This ID uniquely identifies the record"),
+  );
+  pkLabel.appendChild(pkInput);
+  pkLabel.appendChild(pkText);
+
+  var moveControls = createSchemaDialogMoveControls("table-alter");
+
+  var removeButton = createSchemaDialogIconButton(
+    "table-alter",
+    "remove-column",
+    existing ? "Drop column" : "Remove column",
+    existing ? "Drop column" : "Remove column",
+    COLUMN_MOVE_ICONS.remove,
+  );
+  main.appendChild(nameLabel);
+  main.appendChild(nameInput);
+  main.appendChild(typeSelect);
+  main.appendChild(moveControls.controls);
+  main.appendChild(removeButton);
+  main.appendChild(expandButton);
+
+  if (customTypeField) {
+    details.appendChild(customTypeField);
+  }
+  details.appendChild(defaultControls.controls);
+  details.appendChild(notNullLabel);
+  details.appendChild(pkLabel);
+  details.appendChild(foreignKeyField);
+  row.appendChild(main);
+  row.appendChild(details);
+
+  var controls = [
+    nameInput,
+    typeSelect,
+    notNullInput,
+    defaultInput,
+    defaultExprSelect,
+    pkInput,
+    foreignKeySelect,
+  ];
+  if (customTypeSelect) {
+    controls.push(customTypeSelect);
+  }
+  controls.forEach(function (control) {
+    control.addEventListener("input", function () {
+      clearTableAlterDialogError(state);
+      updateTableAlterSaveButtonState(state);
+    });
+    control.addEventListener("change", function () {
+      clearTableAlterDialogError(state);
+      updateTableAlterSaveButtonState(state);
+    });
+  });
+
+  defaultInput.addEventListener("input", function () {
+    if (defaultInput.value) {
+      defaultExprSelect.value = "";
+      syncSchemaDialogDefaultControls(row, "table-alter");
+    }
+    updateTableAlterSaveButtonState(state);
+  });
+  defaultExprSelect.addEventListener("change", function () {
+    if (defaultExprSelect.value) {
+      defaultInput.value = "";
+    }
+    if (
+      applyDefaultExpressionColumnType(
+        row,
+        "table-alter",
+        tableAlterDefaultExpressions(),
+        tableAlterColumnTypes(),
+      )
+    ) {
+      syncTableAlterCustomTypeForSqliteType(row);
+      syncTableAlterForeignKeyOptions(row, state);
+      syncSchemaDialogCustomTypeAndForeignKey(row, state, "table-alter");
+    }
+    syncSchemaDialogDefaultControls(row, "table-alter");
+    updateTableAlterSaveButtonState(state);
+  });
+  pkInput.addEventListener("change", function () {
+    normalizeTableAlterPrimaryKeyRows(state);
+    updateTableAlterMoveButtons(state);
+    updateTableAlterSaveButtonState(state);
+  });
+
+  expandButton.addEventListener("click", function () {
+    toggleSchemaDialogMoreOptions(expandButton, details);
+  });
+
+  typeSelect.addEventListener("change", function () {
+    syncTableAlterCustomTypeForSqliteType(row);
+    syncTableAlterForeignKeyOptions(row, state);
+    syncSchemaDialogCustomTypeAndForeignKey(row, state, "table-alter");
+    updateTableAlterSaveButtonState(state);
+  });
+  if (customTypeSelect) {
+    customTypeSelect.addEventListener("change", function () {
+      updateTableAlterCustomColumnTypePlaceholder(customTypeSelect);
+      var option = tableAlterCustomColumnType(customTypeSelect.value);
+      if (
+        option &&
+        option.fixedSqliteType &&
+        tableAlterColumnTypes().indexOf(option.fixedSqliteType) !== -1
+      ) {
+        typeSelect.value = option.fixedSqliteType;
+        syncTableAlterForeignKeyOptions(row, state);
+      }
+      syncSchemaDialogCustomTypeAndForeignKey(row, state, "table-alter");
+      updateTableAlterSaveButtonState(state);
+    });
+  }
+  foreignKeySelect.addEventListener("change", function () {
+    handleSchemaDialogForeignKeyChange(row, state, "table-alter", {
+      columnTypes: tableAlterColumnTypes(),
+      foreignKeyOptions: { filterByType: false },
+      matchType: true,
+    });
+    updateTableAlterSaveButtonState(state);
+  });
+
+  moveControls.topButton.addEventListener("click", function () {
+    var first = tableAlterFirstNonPrimaryRow(state);
+    if (
+      state.isSaving ||
+      tableAlterRowIsPrimaryKey(row) ||
+      !first ||
+      first === row
+    ) {
+      return;
+    }
+    state.columnList.insertBefore(row, first);
+    clearTableAlterDialogError(state);
+    updateTableAlterMoveButtons(state);
+    updateTableAlterSaveButtonState(state);
+    row.querySelector(".table-alter-column-name").focus();
+  });
+
+  moveControls.upButton.addEventListener("click", function () {
+    var previous = row.previousElementSibling;
+    if (
+      state.isSaving ||
+      tableAlterRowIsPrimaryKey(row) ||
+      !previous ||
+      tableAlterRowIsPrimaryKey(previous)
+    ) {
+      return;
+    }
+    state.columnList.insertBefore(row, previous);
+    clearTableAlterDialogError(state);
+    updateTableAlterMoveButtons(state);
+    updateTableAlterSaveButtonState(state);
+    row.querySelector(".table-alter-column-name").focus();
+  });
+
+  moveControls.downButton.addEventListener("click", function () {
+    var next = row.nextElementSibling;
+    if (state.isSaving || tableAlterRowIsPrimaryKey(row) || !next) {
+      return;
+    }
+    state.columnList.insertBefore(next, row);
+    clearTableAlterDialogError(state);
+    updateTableAlterMoveButtons(state);
+    updateTableAlterSaveButtonState(state);
+    row.querySelector(".table-alter-column-name").focus();
+  });
+
+  moveControls.bottomButton.addEventListener("click", function () {
+    var last = state.columnList.lastElementChild;
+    if (
+      state.isSaving ||
+      tableAlterRowIsPrimaryKey(row) ||
+      !last ||
+      last === row
+    ) {
+      return;
+    }
+    state.columnList.appendChild(row);
+    clearTableAlterDialogError(state);
+    updateTableAlterMoveButtons(state);
+    updateTableAlterSaveButtonState(state);
+    row.querySelector(".table-alter-column-name").focus();
+  });
+
+  removeButton.addEventListener("click", function () {
+    if (state.isSaving) {
+      return;
+    }
+    if (row.dataset.existing === "1") {
+      state.deletedColumns.push(row.dataset.originalName);
+    }
+    row.remove();
+    clearTableAlterDialogError(state);
+    updateTableAlterMoveButtons(state);
+    updateTableAlterSaveButtonState(state);
+    var nextInput = state.columnList.querySelector(".table-alter-column-name");
+    if (nextInput) {
+      nextInput.focus();
+    } else {
+      state.addColumnButton.focus();
+    }
+  });
+
+  syncSchemaDialogDefaultControls(row, "table-alter");
+  syncTableAlterForeignKeyOptions(row, state);
+  syncSchemaDialogCustomTypeAndForeignKey(row, state, "table-alter");
+  return row;
+}
+
+function addTableAlterColumn(state, column) {
+  var row = createTableAlterColumnRow(state, column || { type: "text" });
+  state.columnList.appendChild(row);
+  return row;
+}
+
+function resetTableAlterDialog(state, data) {
+  state.nextColumnIndex = 0;
+  state.deletedColumns = [];
+  state.originalTableName = data.tableName || "";
+  state.tableNameInput.value = state.originalTableName;
+  state.tableOptions.open = false;
+  state.originalPrimaryKeys = (data.primaryKeys || []).slice();
+  state.originalColumnNames = (data.columns || []).map(function (column) {
+    return column.name;
+  });
+  state.columnList.textContent = "";
+  (data.columns || []).forEach(function (column) {
+    addTableAlterColumn(
+      state,
+      Object.assign({}, column, {
+        existing: true,
+      }),
+    );
+  });
+  normalizeTableAlterPrimaryKeyRows(state);
+  state.initialSignature = tableAlterDialogSignature(state);
+  showTableAlterEditor(state);
+}
+
+function collectTableAlterRows(state) {
+  return tableAlterDialogRows(state).map(function (row) {
+    var signature = tableAlterRowSignature(row);
+    signature.originalType = row.dataset.originalType || "";
+    signature.originalNotNull = row.dataset.originalNotNull === "1";
+    signature.originalHasDefault = row.dataset.originalHasDefault === "1";
+    signature.originalDefault = row.dataset.originalDefault || "";
+    signature.originalDefaultExpr = row.dataset.originalDefaultExpr || "";
+    signature.originalPk = row.dataset.originalPk === "1";
+    signature.originalCustomType = row.dataset.originalCustomType || "";
+    signature.originalForeignKey = row.dataset.originalForeignKey || "";
+    return signature;
+  });
+}
+
+function validateTableAlterRows(state, rows) {
+  var tableName = state.tableNameInput.value.trim();
+  if (!tableName) {
+    return "Table name is required.";
+  }
+  if (tableName.indexOf("\n") !== -1) {
+    return "Table names cannot contain newlines.";
+  }
+  if (/^sqlite_/.test(tableName)) {
+    return "Table names cannot start with sqlite_.";
+  }
+  if (!rows.length) {
+    return "At least one column is required.";
+  }
+  var seen = {};
+  var supportedTypes = tableAlterColumnTypes();
+  for (var i = 0; i < rows.length; i += 1) {
+    var row = rows[i];
+    var name = row.name.trim();
+    if (!name) {
+      return "Column name is required.";
+    }
+    if (name.indexOf("\n") !== -1) {
+      return "Column names cannot contain newlines.";
+    }
+    var columnKey = name.toLowerCase();
+    if (seen[columnKey]) {
+      return "Duplicate column name: " + name;
+    }
+    seen[columnKey] = true;
+    if (supportedTypes.indexOf(row.type) === -1) {
+      return "Unsupported column type: " + row.type;
+    }
+    if (row.customType) {
+      var option = tableAlterCustomColumnType(row.customType);
+      if (!option) {
+        return "Unknown custom column type: " + row.customType;
+      }
+      if (!tableAlterCustomTypeAppliesToSqliteType(option, row.type)) {
+        return (
+          "Custom type " +
+          row.customType +
+          " cannot be used with SQLite type " +
+          row.type +
+          "."
+        );
+      }
+    }
+    if (row.defaultValue && row.defaultExpr) {
+      return "Use either a default value or a default expression.";
+    }
+    if (!row.existing && row.notNull && !row.defaultValue && !row.defaultExpr) {
+      return "New NOT NULL columns need a default or default expression.";
+    }
+  }
+  var pkColumns = rows.filter(function (row) {
+    return row.pk;
+  });
+  if (state.originalPrimaryKeys.length && !pkColumns.length) {
+    return "At least one primary key column is required.";
+  }
+  return null;
+}
+
+function collectTableAlterColumnTypeAssignments(rows) {
+  var assignments = [];
+  if (!tableAlterCustomColumnTypes().length) {
+    return assignments;
+  }
+  rows.forEach(function (row) {
+    var renamed = row.existing && row.name.trim() !== row.originalName;
+    if (row.customType === row.originalCustomType && !renamed) {
+      return;
+    }
+    if (!row.customType && !row.originalCustomType) {
+      return;
+    }
+    assignments.push({
+      column: row.name.trim(),
+      columnType: row.customType || null,
+      sqliteType: row.type,
+    });
+  });
+  return assignments;
+}
+
+function tableAlterPkIdentityColumns(rows) {
+  return rows
+    .filter(function (row) {
+      return row.pk;
+    })
+    .map(function (row) {
+      return row.existing ? row.originalName : row.name.trim();
+    });
+}
+
+function tableAlterPkChanged(state, rows) {
+  return (
+    JSON.stringify(tableAlterPkIdentityColumns(rows)) !==
+    JSON.stringify(state.originalPrimaryKeys)
+  );
+}
+
+function tableAlterNaturalColumnOrder(state, rows) {
+  var existingRowsByOriginalName = {};
+  var newRows = [];
+  rows.forEach(function (row) {
+    if (row.existing) {
+      existingRowsByOriginalName[row.originalName] = row;
+    } else {
+      newRows.push(row);
+    }
+  });
+  var naturalOrder = [];
+  state.originalColumnNames.forEach(function (originalName) {
+    var row = existingRowsByOriginalName[originalName];
+    if (row) {
+      naturalOrder.push(row.name.trim());
+    }
+  });
+  newRows.forEach(function (row) {
+    naturalOrder.push(row.name.trim());
+  });
+  return naturalOrder;
+}
+
+function tableAlterColumnsReordered(state, rows) {
+  var finalOrder = rows.map(function (row) {
+    return row.name.trim();
+  });
+  return (
+    JSON.stringify(finalOrder) !==
+    JSON.stringify(tableAlterNaturalColumnOrder(state, rows))
+  );
+}
+
+function tableAlterForeignKeyIdentity(row) {
+  return [
+    row.name.trim(),
+    row.foreignKeyTable || "",
+    row.foreignKeyColumn || "",
+  ].join("\u001f");
+}
+
+function tableAlterOriginalForeignKeyIdentity(row) {
+  return [row.originalName || "", row.originalForeignKey].join("\u001f");
+}
+
+function tableAlterForeignKeyRows(rows) {
+  return rows
+    .filter(function (row) {
+      return row.foreignKey && row.foreignKeyTable && row.foreignKeyColumn;
+    })
+    .map(function (row) {
+      return {
+        column: row.name.trim(),
+        fk_table: row.foreignKeyTable,
+        fk_column: row.foreignKeyColumn,
+      };
+    });
+}
+
+function tableAlterForeignKeysChanged(rows) {
+  var original = rows
+    .filter(function (row) {
+      return row.existing && row.originalForeignKey;
+    })
+    .map(tableAlterOriginalForeignKeyIdentity);
+  var final = rows
+    .filter(function (row) {
+      return row.foreignKey && row.foreignKeyTable && row.foreignKeyColumn;
+    })
+    .map(tableAlterForeignKeyIdentity);
+  return JSON.stringify(original) !== JSON.stringify(final);
+}
+
+function collectTableAlterPayload(state) {
+  var rows = collectTableAlterRows(state);
+  var validationError = validateTableAlterRows(state, rows);
+  if (validationError) {
+    return { error: validationError };
+  }
+
+  var operations = [];
+  var tableName = state.tableNameInput.value.trim();
+  if (tableName !== state.originalTableName) {
+    operations.push({
+      op: "rename_table",
+      args: { to: tableName },
+    });
+  }
+  var columnTypeAssignments = collectTableAlterColumnTypeAssignments(rows);
+  rows.forEach(function (row) {
+    var name = row.name.trim();
+    if (!row.existing) {
+      var addArgs = {
+        name: name,
+        type: row.type,
+        not_null: row.notNull,
+      };
+      if (row.defaultExpr) {
+        addArgs.default_expr = row.defaultExpr;
+      } else if (row.defaultValue || row.notNull) {
+        addArgs.default = row.defaultValue;
+      }
+      operations.push({ op: "add_column", args: addArgs });
+      return;
+    }
+
+    var originalName = row.originalName;
+    if (name !== originalName) {
+      operations.push({
+        op: "rename_column",
+        args: { name: originalName, to: name },
+      });
+    }
+
+    var alterArgs = { name: originalName };
+    if (row.type !== row.originalType) {
+      alterArgs.type = row.type;
+    }
+    if (row.notNull !== row.originalNotNull) {
+      alterArgs.not_null = row.notNull;
+    }
+    if (row.defaultExpr !== row.originalDefaultExpr) {
+      if (row.defaultExpr) {
+        alterArgs.default_expr = row.defaultExpr;
+      } else {
+        alterArgs.default = row.defaultValue === "" ? null : row.defaultValue;
+      }
+    } else if (row.originalHasDefault) {
+      if (row.defaultValue !== row.originalDefault) {
+        alterArgs.default = row.defaultValue === "" ? null : row.defaultValue;
+      }
+    } else if (row.defaultValue) {
+      alterArgs.default = row.defaultValue;
+    }
+    if (Object.keys(alterArgs).length > 1) {
+      operations.push({ op: "alter_column", args: alterArgs });
+    }
+  });
+
+  state.deletedColumns.forEach(function (name) {
+    operations.push({ op: "drop_column", args: { name: name } });
+  });
+
+  var pkColumns = rows
+    .filter(function (row) {
+      return row.pk;
+    })
+    .map(function (row) {
+      return row.name.trim();
+    });
+  if (tableAlterPkChanged(state, rows)) {
+    operations.push({ op: "set_primary_key", args: { columns: pkColumns } });
+  }
+
+  if (tableAlterColumnsReordered(state, rows)) {
+    operations.push({
+      op: "reorder_columns",
+      args: {
+        columns: rows.map(function (row) {
+          return row.name.trim();
+        }),
+      },
+    });
+  }
+
+  if (tableAlterForeignKeysChanged(rows)) {
+    operations.push({
+      op: "set_foreign_keys",
+      args: {
+        foreign_keys: tableAlterForeignKeyRows(rows),
+      },
+    });
+  }
+
+  if (!operations.length && !columnTypeAssignments.length) {
+    return { error: "No changes to apply." };
+  }
+  return {
+    payload: operations.length ? { operations: operations } : null,
+    columnTypeAssignments: columnTypeAssignments,
+  };
+}
+
+function tableAlterQuotedName(name) {
+  return '"' + name + '"';
+}
+
+function tableAlterReadableDefaultExpression(value) {
+  return defaultExpressionLabelForValue(tableAlterDefaultExpressions(), value);
+}
+
+function tableAlterReadableValue(value) {
+  if (value === null) {
+    return "NULL";
+  }
+  return '"' + String(value) + '"';
+}
+
+function tableAlterOperationSummary(operation) {
+  var args = operation.args || {};
+  if (operation.op === "rename_table") {
+    return {
+      text: "Rename table to " + tableAlterQuotedName(args.to) + ".",
+      damaging: false,
+    };
+  }
+  if (operation.op === "add_column") {
+    var addDetails = ["as " + args.type];
+    if (args.not_null) {
+      addDetails.push("with values required");
+    }
+    if (args.default_expr) {
+      addDetails.push(
+        "defaulting to " +
+          tableAlterReadableDefaultExpression(args.default_expr),
+      );
+    } else if (Object.prototype.hasOwnProperty.call(args, "default")) {
+      addDetails.push(
+        "with default value " + tableAlterReadableValue(args.default),
+      );
+    }
+    return {
+      text:
+        "Add column " +
+        tableAlterQuotedName(args.name) +
+        " " +
+        addDetails.join(", ") +
+        ".",
+      damaging: false,
+    };
+  }
+  if (operation.op === "rename_column") {
+    return {
+      text:
+        "Rename column " +
+        tableAlterQuotedName(args.name) +
+        " to " +
+        tableAlterQuotedName(args.to) +
+        ".",
+      damaging: false,
+    };
+  }
+  if (operation.op === "alter_column") {
+    var changes = [];
+    if (args.type) {
+      changes.push("set type to " + args.type);
+    }
+    if (Object.prototype.hasOwnProperty.call(args, "not_null")) {
+      changes.push(
+        args.not_null ? "not null (require values)" : "allow unset values",
+      );
+    }
+    if (args.default_expr) {
+      changes.push(
+        "default to " + tableAlterReadableDefaultExpression(args.default_expr),
+      );
+    } else if (Object.prototype.hasOwnProperty.call(args, "default")) {
+      changes.push(
+        args.default === null
+          ? "remove the default value"
+          : "set default value to " + tableAlterReadableValue(args.default),
+      );
+    }
+    return {
+      text:
+        "Change column " +
+        tableAlterQuotedName(args.name) +
+        ": " +
+        changes.join(", ") +
+        ".",
+      damaging: false,
+    };
+  }
+  if (operation.op === "drop_column") {
+    return {
+      text: "Drop column " + tableAlterQuotedName(args.name) + ".",
+      damaging: true,
+    };
+  }
+  if (operation.op === "set_primary_key") {
+    return {
+      text:
+        "Set primary key to " +
+        (args.columns || []).map(tableAlterQuotedName).join(", ") +
+        ".",
+      damaging: false,
+    };
+  }
+  if (operation.op === "reorder_columns") {
+    return {
+      text:
+        "Set column order to " +
+        (args.columns || []).map(tableAlterQuotedName).join(", ") +
+        ".",
+      damaging: false,
+    };
+  }
+  if (operation.op === "set_foreign_keys") {
+    var foreignKeys = args.foreign_keys || [];
+    return {
+      text: foreignKeys.length
+        ? "Set foreign keys to " +
+          foreignKeys
+            .map(function (foreignKey) {
+              return (
+                tableAlterQuotedName(foreignKey.column) +
+                " -> " +
+                foreignKey.fk_table +
+                "." +
+                foreignKey.fk_column
+              );
+            })
+            .join(", ") +
+          "."
+        : "Remove all foreign keys.",
+      damaging: false,
+    };
+  }
+  return {
+    text: "Run " + operation.op + ".",
+    damaging: false,
+  };
+}
+
+function tableAlterColumnTypeAssignmentSummary(assignment) {
+  return {
+    text: assignment.columnType
+      ? "Set custom type for column " +
+        tableAlterQuotedName(assignment.column) +
+        " to " +
+        assignment.columnType +
+        "."
+      : "Remove custom type from column " +
+        tableAlterQuotedName(assignment.column) +
+        ".",
+    damaging: false,
+  };
+}
+
+function tableAlterReviewItems(result) {
+  var items = [];
+  var operations = result.payload ? result.payload.operations || [] : [];
+  operations.forEach(function (operation) {
+    items.push(tableAlterOperationSummary(operation));
+  });
+  (result.columnTypeAssignments || []).forEach(function (assignment) {
+    items.push(tableAlterColumnTypeAssignmentSummary(assignment));
+  });
+  return items;
+}
+
+function tableAlterReviewHasDamagingItems(items) {
+  return items.some(function (item) {
+    return item.damaging;
+  });
+}
+
+function appendTableAlterReviewText(element, text) {
+  text.split(/("[^"]+")/g).forEach(function (part) {
+    if (!part) {
+      return;
+    }
+    if (part.charAt(0) === '"' && part.charAt(part.length - 1) === '"') {
+      var name = document.createElement("code");
+      name.className = "table-alter-review-name";
+      name.textContent = part.slice(1, -1);
+      element.appendChild(name);
+    } else {
+      element.appendChild(document.createTextNode(part));
+    }
+  });
+}
+
+function tableAlterSetColumnTypeUrl(tableUrl) {
+  if (tableUrl) {
+    return tableUrl.replace(/\/$/, "") + "/-/set-column-type";
+  }
+  var data = tableAlterData();
+  if (!data || !data.path) {
+    return null;
+  }
+  var url = new URL(data.path, location.href);
+  url.pathname = url.pathname.replace(/\/-\/alter\/?$/, "/-/set-column-type");
+  return url.toString();
+}
+
+async function assignTableAlterColumnTypes(assignments, tableUrl) {
+  if (!assignments.length) {
+    return;
+  }
+  var url = tableAlterSetColumnTypeUrl(tableUrl);
+  if (!url) {
+    throw new Error("Could not find the set column type URL.");
+  }
+  for (var i = 0; i < assignments.length; i += 1) {
+    var assignment = assignments[i];
+    var response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+      },
+      body: JSON.stringify({
+        column: assignment.column,
+        column_type: assignment.columnType
+          ? {
+              type: assignment.columnType,
+            }
+          : null,
+      }),
+    });
+    var data = null;
+    try {
+      data = await response.json();
+    } catch (_error) {
+      data = null;
+    }
+    if (!response.ok || (data && data.ok === false)) {
+      var error = rowMutationRequestError(response, data);
+      throw new Error(
+        "Saved schema changes, but could not set custom type for " +
+          assignment.column +
+          ": " +
+          error.message,
+      );
+    }
+  }
+}
+
+function tableAlterResultRenamesTable(result) {
+  return !!(
+    result &&
+    result.payload &&
+    (result.payload.operations || []).some(function (operation) {
+      return operation.op === "rename_table";
+    })
+  );
+}
+
+function showTableAlterEditor(state) {
+  state.mode = "edit";
+  state.reviewResult = null;
+  state.dialog.classList.remove("table-alter-reviewing");
+  state.fields.hidden = false;
+  state.review.hidden = true;
+  state.review.textContent = "";
+  state.backButton.hidden = true;
+  var data = tableAlterData();
+  state.dropButton.hidden = !(data && data.dropPath);
+  state.saveButton.textContent = tableAlterSaveButtonText(state);
+  updateTableAlterMoveButtons(state);
+  updateTableAlterSaveButtonState(state);
+}
+
+function showTableAlterReview(state, result) {
+  var items = tableAlterReviewItems(result);
+  state.mode = "review";
+  state.reviewResult = result;
+  state.dialog.classList.add("table-alter-reviewing");
+  state.fields.hidden = true;
+  state.review.hidden = false;
+  state.review.textContent = "";
+  state.backButton.hidden = false;
+  state.dropButton.hidden = true;
+  state.saveButton.textContent = tableAlterSaveButtonText(state);
+  updateTableAlterSaveButtonState(state);
+
+  var heading = document.createElement("h3");
+  heading.className = "table-alter-review-title";
+  heading.tabIndex = -1;
+  heading.textContent = "Review changes";
+  state.review.appendChild(heading);
+
+  var intro = document.createElement("p");
+  intro.className = "table-alter-review-intro";
+  intro.textContent = "These changes will be applied to the table.";
+  state.review.appendChild(intro);
+
+  if (tableAlterReviewHasDamagingItems(items)) {
+    var warning = document.createElement("p");
+    warning.className = "table-alter-review-warning";
+    warning.setAttribute("role", "alert");
+    warning.textContent =
+      "Warning: data in dropped columns will be permanently lost.";
+    state.review.appendChild(warning);
+  }
+
+  var list = document.createElement("ol");
+  list.className = "table-alter-review-list";
+  items.forEach(function (item) {
+    var listItem = document.createElement("li");
+    appendTableAlterReviewText(listItem, item.text);
+    if (item.damaging) {
+      listItem.className = "table-alter-review-damaging";
+    }
+    list.appendChild(listItem);
+  });
+  state.review.appendChild(list);
+  heading.focus();
+}
+
+async function applyTableAlterChanges(state, result) {
+  if (state.isSaving) {
+    return;
+  }
+  if (!result) {
+    showTableAlterDialogError(state, "Could not find the reviewed changes.");
+    return;
+  }
+  var data = tableAlterData();
+  if (!data || !data.path) {
+    showTableAlterDialogError(state, "Could not find the alter table URL.");
+    return;
+  }
+  clearTableAlterDialogError(state);
+  if (result.error) {
+    showTableAlterDialogError(state, result.error);
+    return;
+  }
+  setTableAlterDialogSaving(state, true);
+  try {
+    var responseData = null;
+    if (result.payload) {
+      var response = await fetch(data.path, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Accept: "application/json",
+        },
+        body: JSON.stringify(result.payload),
+      });
+      try {
+        responseData = await response.json();
+      } catch (_error) {
+        responseData = null;
+      }
+      if (!response.ok || (responseData && responseData.ok === false)) {
+        throw rowMutationRequestError(response, responseData);
+      }
+    }
+    var tableUrl = responseData && responseData.table_url;
+    await assignTableAlterColumnTypes(
+      result.columnTypeAssignments || [],
+      tableUrl,
+    );
+    state.shouldRestoreFocus = false;
+    state.dialog.close();
+    if (tableAlterResultRenamesTable(result) && tableUrl) {
+      window.location.href = tableUrl;
+    } else {
+      location.reload();
+    }
+  } catch (error) {
+    setTableAlterDialogSaving(state, false);
+    showTableAlterDialogError(state, error.message || "Could not alter table");
+  }
+}
+
+function tableAlterDatabaseUrl() {
+  var data = tableAlterData();
+  if (!data || !data.path) {
+    return null;
+  }
+  var url = new URL(data.path, location.href);
+  url.pathname = url.pathname.replace(/\/[^/]+\/-\/alter\/?$/, "");
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+
+async function dropTableFromAlterDialog(state) {
+  if (state.isSaving) {
+    return;
+  }
+  var data = tableAlterData();
+  if (!data || !data.dropPath) {
+    return;
+  }
+  if (
+    !window.confirm(
+      'Permanently delete the table "' +
+        data.tableName +
+        '"? This will delete all of its data and cannot be undone.',
+    )
+  ) {
+    return;
+  }
+  clearTableAlterDialogError(state);
+  setTableAlterDialogSaving(state, true);
+  try {
+    var response = await fetch(data.dropPath, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+      },
+      body: JSON.stringify({ confirm: true }),
+    });
+    var responseData = null;
+    try {
+      responseData = await response.json();
+    } catch (_error) {
+      responseData = null;
+    }
+    if (!response.ok || (responseData && responseData.ok === false)) {
+      throw rowMutationRequestError(response, responseData);
+    }
+    state.shouldRestoreFocus = false;
+    state.dialog.close();
+    window.location.href = tableAlterDatabaseUrl() || "/";
+  } catch (error) {
+    setTableAlterDialogSaving(state, false);
+    showTableAlterDialogError(state, error.message || "Could not drop table");
+  }
+}
+
+async function saveTableAlterDialog(state) {
+  if (state.isSaving) {
+    return;
+  }
+  if (state.mode === "review") {
+    if (!state.reviewResult) {
+      showTableAlterDialogError(state, "Could not find the reviewed changes.");
+      return;
+    }
+    await applyTableAlterChanges(state, state.reviewResult);
+    return;
+  }
+  clearTableAlterDialogError(state);
+  var result = collectTableAlterPayload(state);
+  if (result.error) {
+    showTableAlterDialogError(state, result.error);
+    return;
+  }
+  showTableAlterReview(state, result);
+}
+
+function confirmDiscardTableAlterChanges(state) {
+  if (!tableAlterDialogHasChanges(state)) {
+    return true;
+  }
+  return window.confirm("Discard table changes?");
+}
+
+function closeTableAlterDialogIfConfirmed(state) {
+  if (!state || state.isSaving) {
+    return false;
+  }
+  if (!confirmDiscardTableAlterChanges(state)) {
+    return false;
+  }
+  state.shouldRestoreFocus = true;
+  state.dialog.close();
+  return true;
+}
+
+function closeTableAlterDialog(state) {
+  if (!state || state.isSaving) {
+    return false;
+  }
+  state.shouldRestoreFocus = true;
+  state.dialog.close();
+  return true;
+}
+
+function ensureTableAlterDialog(manager) {
+  if (tableAlterDialogState) {
+    return tableAlterDialogState;
+  }
+  if (!window.HTMLDialogElement) {
+    return null;
+  }
+
+  var dialog = document.createElement("dialog");
+  dialog.id = TABLE_ALTER_DIALOG_ID;
+  dialog.className = "table-alter-dialog";
+  dialog.setAttribute("aria-labelledby", "table-alter-title");
+  dialog.innerHTML = `
+    <div class="modal-header">
+      <span class="modal-title" id="table-alter-title">Alter table</span>
+    </div>
+    <form class="table-alter-form" method="post" novalidate>
+      <p class="table-alter-error" id="table-alter-error" role="alert" tabindex="-1" hidden></p>
+      <div class="table-alter-fields">
+        <div class="table-alter-columns">
+          <div class="table-alter-column-headings" aria-hidden="true">
+            <span>Column</span>
+            <span>Type</span>
+            <span>Move</span>
+            <span></span>
+          </div>
+          <div class="table-alter-column-list"></div>
+          <button type="button" class="table-alter-add-column"><svg aria-hidden="true" xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M5 12h14"></path><path d="M12 5v14"></path></svg><span>Add column</span></button>
+        </div>
+        <details class="table-alter-table-options">
+          <summary>Rename table</summary>
+          <div class="table-alter-table-name-field">
+            <label class="table-alter-detail-label" for="table-alter-table-name">New table name</label>
+            <input id="table-alter-table-name" class="table-alter-input table-alter-table-name" type="text" autocomplete="off" placeholder="table name" required>
+          </div>
+        </details>
+      </div>
+      <div class="table-alter-review" hidden></div>
+      <div class="modal-footer">
+        <button type="button" class="btn btn-danger table-alter-drop" hidden>Drop table</button>
+        <button type="button" class="btn btn-ghost table-alter-back" hidden>Back</button>
+        <button type="button" class="btn btn-ghost table-alter-cancel">Cancel</button>
+        <button type="submit" class="btn btn-primary table-alter-save">Review changes</button>
+      </div>
+    </form>
+  `;
+  document.body.appendChild(dialog);
+
+  tableAlterDialogState = {
+    dialog: dialog,
+    form: dialog.querySelector(".table-alter-form"),
+    title: dialog.querySelector(".modal-title"),
+    error: dialog.querySelector(".table-alter-error"),
+    fields: dialog.querySelector(".table-alter-fields"),
+    tableOptions: dialog.querySelector(".table-alter-table-options"),
+    tableNameInput: dialog.querySelector(".table-alter-table-name"),
+    review: dialog.querySelector(".table-alter-review"),
+    columnList: dialog.querySelector(".table-alter-column-list"),
+    addColumnButton: dialog.querySelector(".table-alter-add-column"),
+    backButton: dialog.querySelector(".table-alter-back"),
+    dropButton: dialog.querySelector(".table-alter-drop"),
+    cancelButton: dialog.querySelector(".table-alter-cancel"),
+    saveButton: dialog.querySelector(".table-alter-save"),
+    currentButton: null,
+    shouldRestoreFocus: true,
+    isSaving: false,
+    initialSignature: "",
+    originalTableName: "",
+    nextColumnIndex: 0,
+    deletedColumns: [],
+    originalColumnNames: [],
+    originalPrimaryKeys: [],
+    foreignKeyTargets: [],
+    foreignKeyTargetsError: null,
+    foreignKeyTargetsLoading: false,
+    mode: "edit",
+    reviewResult: null,
+    manager: manager,
+  };
+
+  tableAlterDialogState.form.addEventListener("submit", function (ev) {
+    ev.preventDefault();
+    saveTableAlterDialog(tableAlterDialogState);
+  });
+
+  tableAlterDialogState.tableNameInput.addEventListener("input", function () {
+    clearTableAlterDialogError(tableAlterDialogState);
+    updateTableAlterSaveButtonState(tableAlterDialogState);
+  });
+
+  tableAlterDialogState.addColumnButton.addEventListener("click", function () {
+    if (tableAlterDialogState.isSaving) {
+      return;
+    }
+    var row = addTableAlterColumn(tableAlterDialogState, {
+      type: "text",
+      existing: false,
+      expanded: true,
+    });
+    clearTableAlterDialogError(tableAlterDialogState);
+    updateTableAlterMoveButtons(tableAlterDialogState);
+    updateTableAlterSaveButtonState(tableAlterDialogState);
+    row.querySelector(".table-alter-column-name").focus();
+  });
+
+  tableAlterDialogState.cancelButton.addEventListener("click", function () {
+    closeTableAlterDialog(tableAlterDialogState);
+  });
+
+  tableAlterDialogState.dropButton.addEventListener("click", function () {
+    dropTableFromAlterDialog(tableAlterDialogState);
+  });
+
+  tableAlterDialogState.backButton.addEventListener("click", function () {
+    if (tableAlterDialogState.isSaving) {
+      return;
+    }
+    clearTableAlterDialogError(tableAlterDialogState);
+    showTableAlterEditor(tableAlterDialogState);
+    var firstName = tableAlterDialogState.columnList.querySelector(
+      ".table-alter-column-name",
+    );
+    if (firstName) {
+      firstName.focus();
+    }
+  });
+
+  dialog.addEventListener("click", function (ev) {
+    if (ev.target === dialog) {
+      closeTableAlterDialogIfConfirmed(tableAlterDialogState);
+    }
+  });
+
+  dialog.addEventListener("keydown", function (ev) {
+    if (ev.key !== "Escape") {
+      return;
+    }
+    ev.preventDefault();
+    closeTableAlterDialogIfConfirmed(tableAlterDialogState);
+  });
+
+  dialog.addEventListener("cancel", function (ev) {
+    ev.preventDefault();
+    closeTableAlterDialogIfConfirmed(tableAlterDialogState);
+  });
+
+  dialog.addEventListener("close", function () {
+    var state = tableAlterDialogState;
+    clearTableAlterDialogError(state);
+    setTableAlterDialogSaving(state, false);
+    if (
+      state.shouldRestoreFocus &&
+      state.currentButton &&
+      document.contains(state.currentButton)
+    ) {
+      state.currentButton.focus();
+    }
+  });
+
+  return tableAlterDialogState;
+}
+
+function openTableAlterDialog(button, manager) {
+  var data = tableAlterData();
+  if (!data) {
+    return;
+  }
+  var state = ensureTableAlterDialog(manager);
+  if (!state) {
+    return;
+  }
+
+  var menu = button.closest("details");
+  if (menu) {
+    menu.open = false;
+  }
+  state.manager = manager;
+  state.currentButton = button;
+  state.shouldRestoreFocus = true;
+  state.title.textContent = "Alter table " + data.tableName;
+  clearTableAlterDialogError(state);
+  resetTableAlterDialog(state, data);
+  loadSchemaDialogForeignKeyTargets(
+    state,
+    "table-alter",
+    tableAlterForeignKeyTargetsUrl(),
+    { filterByType: false },
+  );
+  if (!state.dialog.open) {
+    state.dialog.showModal();
+  }
+  var firstName = state.columnList.querySelector(".table-alter-column-name");
+  if (firstName) {
+    firstName.focus();
+  }
+}
+
+function initTableAlterActions(manager) {
+  if (!window.fetch || !window.HTMLDialogElement || !tableAlterData()) {
+    return;
+  }
+  document.addEventListener("click", function (ev) {
+    var button = ev.target.closest('button[data-table-action="alter-table"]');
+    if (!button) {
+      return;
+    }
+    ev.preventDefault();
+    openTableAlterDialog(button, manager);
+  });
+}
+
 function tableForeignKeys() {
   return tablePageData().foreignKeys || {};
 }
@@ -314,6 +4333,14 @@ function tableInsertUrl() {
   return url.toString();
 }
 
+function tableUpsertUrl() {
+  var data = tableInsertData();
+  if (data && data.upsertPath) {
+    return new URL(data.upsertPath, location.href).toString();
+  }
+  return null;
+}
+
 function rowResourceUrl(row) {
   var rowId = row.getAttribute("data-row");
   if (!rowId) {
@@ -330,7 +4357,7 @@ function rowJsonUrl(row) {
     return "";
   }
   url.pathname = url.pathname + ".json";
-  url.searchParams.set("_extra", "columns,column_types");
+  url.searchParams.set("_extra", "columns,column_types,column_details");
   return url.toString();
 }
 
@@ -610,10 +4637,155 @@ function initRowDeleteActions(manager) {
   });
 }
 
+function isBase64JsonValue(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return false;
+  }
+  var keys = Object.keys(value);
+  return (
+    keys.length === 2 &&
+    Object.prototype.hasOwnProperty.call(value, "$base64") &&
+    Object.prototype.hasOwnProperty.call(value, "encoded") &&
+    value.$base64 === true &&
+    typeof value.encoded === "string"
+  );
+}
+
+function shouldUseBinaryControl(value, options) {
+  options = options || {};
+  var sqliteType = (options.sqliteType || "").toLowerCase();
+  return (
+    isBase64JsonValue(value) ||
+    sqliteType === "blob" ||
+    options.valueKind === "binary"
+  );
+}
+
+function binaryEncodedValue(value) {
+  return isBase64JsonValue(value) ? value.encoded : "";
+}
+
+function binaryByteLengthFromBase64(encoded) {
+  encoded = (encoded || "").replace(/\s/g, "");
+  if (!encoded) {
+    return 0;
+  }
+  var padding = 0;
+  if (encoded.slice(-2) === "==") {
+    padding = 2;
+  } else if (encoded.slice(-1) === "=") {
+    padding = 1;
+  }
+  return Math.max(0, Math.floor((encoded.length * 3) / 4) - padding);
+}
+
+function rowEditBinaryValue(encoded) {
+  return {
+    $base64: true,
+    encoded: encoded || "",
+  };
+}
+
+function formatRowEditBinarySize(byteLength) {
+  var number = byteLength.toLocaleString();
+  return "Binary: " + number + " byte" + (byteLength === 1 ? "" : "s");
+}
+
+function base64ToUint8Array(encoded) {
+  var binary = window.atob(encoded || "");
+  var bytes = new Uint8Array(binary.length);
+  for (var i = 0; i < binary.length; i += 1) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+
+function uint8ArrayToBase64(bytes) {
+  var chunks = [];
+  var chunkSize = 0x8000;
+  for (var i = 0; i < bytes.length; i += chunkSize) {
+    chunks.push(
+      String.fromCharCode.apply(null, bytes.subarray(i, i + chunkSize)),
+    );
+  }
+  return window.btoa(chunks.join(""));
+}
+
+function rowEditBinaryImageMimeType(bytes) {
+  if (!bytes || !bytes.length) {
+    return null;
+  }
+  if (
+    bytes.length >= 8 &&
+    bytes[0] === 0x89 &&
+    bytes[1] === 0x50 &&
+    bytes[2] === 0x4e &&
+    bytes[3] === 0x47 &&
+    bytes[4] === 0x0d &&
+    bytes[5] === 0x0a &&
+    bytes[6] === 0x1a &&
+    bytes[7] === 0x0a
+  ) {
+    return "image/png";
+  }
+  if (
+    bytes.length >= 3 &&
+    bytes[0] === 0xff &&
+    bytes[1] === 0xd8 &&
+    bytes[2] === 0xff
+  ) {
+    return "image/jpeg";
+  }
+  if (
+    bytes.length >= 6 &&
+    bytes[0] === 0x47 &&
+    bytes[1] === 0x49 &&
+    bytes[2] === 0x46 &&
+    bytes[3] === 0x38 &&
+    (bytes[4] === 0x37 || bytes[4] === 0x39) &&
+    bytes[5] === 0x61
+  ) {
+    return "image/gif";
+  }
+  if (
+    bytes.length >= 12 &&
+    bytes[0] === 0x52 &&
+    bytes[1] === 0x49 &&
+    bytes[2] === 0x46 &&
+    bytes[3] === 0x46 &&
+    bytes[8] === 0x57 &&
+    bytes[9] === 0x45 &&
+    bytes[10] === 0x42 &&
+    bytes[11] === 0x50
+  ) {
+    return "image/webp";
+  }
+  if (
+    bytes.length >= 12 &&
+    bytes[4] === 0x66 &&
+    bytes[5] === 0x74 &&
+    bytes[6] === 0x79 &&
+    bytes[7] === 0x70 &&
+    bytes[8] === 0x61 &&
+    bytes[9] === 0x76 &&
+    bytes[10] === 0x69 &&
+    (bytes[11] === 0x66 || bytes[11] === 0x73)
+  ) {
+    return "image/avif";
+  }
+  if (bytes.length >= 2 && bytes[0] === 0x42 && bytes[1] === 0x4d) {
+    return "image/bmp";
+  }
+  return null;
+}
+
 function valueToEditText(value) {
   if (value === null || typeof value === "undefined") {
     return "";
   }
+  if (isBase64JsonValue(value)) {
+    return value.encoded;
+  }
   if (typeof value === "object") {
     return JSON.stringify(value, null, 2);
   }
@@ -624,6 +4796,9 @@ function shouldUseTextarea(value, columnType) {
   if (columnType && columnType.type === "textarea") {
     return true;
   }
+  if (isBase64JsonValue(value)) {
+    return false;
+  }
   if (value && typeof value === "object") {
     return true;
   }
@@ -632,6 +4807,9 @@ function shouldUseTextarea(value, columnType) {
 }
 
 function rowEditValueKind(value) {
+  if (isBase64JsonValue(value)) {
+    return "binary";
+  }
   if (value === null || typeof value === "undefined") {
     return "null";
   }
@@ -655,6 +4833,261 @@ function rowEditControlElement(control, autocompleteUrl) {
   return autocomplete;
 }
 
+function revokeRowEditBinaryPreview(wrapper) {
+  if (wrapper && wrapper._rowEditBinaryPreviewUrl) {
+    URL.revokeObjectURL(wrapper._rowEditBinaryPreviewUrl);
+    wrapper._rowEditBinaryPreviewUrl = null;
+  }
+}
+
+function updateRowEditBinaryPreview(wrapper, encoded, byteLength) {
+  var preview = wrapper.querySelector(".row-edit-binary-preview");
+  if (!preview) {
+    return;
+  }
+  revokeRowEditBinaryPreview(wrapper);
+  preview.hidden = true;
+  preview.textContent = "";
+  if (
+    !encoded ||
+    byteLength >= ROW_EDIT_BINARY_IMAGE_PREVIEW_MAX_BYTES ||
+    !window.atob ||
+    !window.Blob ||
+    !window.URL ||
+    !URL.createObjectURL
+  ) {
+    return;
+  }
+
+  var bytes;
+  try {
+    bytes = base64ToUint8Array(encoded);
+  } catch (_error) {
+    return;
+  }
+  var mimeType = rowEditBinaryImageMimeType(bytes);
+  if (!mimeType) {
+    return;
+  }
+
+  var image = document.createElement("img");
+  image.alt = "";
+  var objectUrl = URL.createObjectURL(new Blob([bytes], { type: mimeType }));
+  wrapper._rowEditBinaryPreviewUrl = objectUrl;
+
+  var showPreview = function () {
+    if (wrapper._rowEditBinaryPreviewUrl === objectUrl) {
+      preview.hidden = false;
+    }
+  };
+  var hidePreview = function () {
+    if (wrapper._rowEditBinaryPreviewUrl === objectUrl) {
+      revokeRowEditBinaryPreview(wrapper);
+      preview.hidden = true;
+      preview.textContent = "";
+    }
+  };
+  image.onload = showPreview;
+  image.onerror = hidePreview;
+  image.src = objectUrl;
+  preview.appendChild(image);
+}
+
+function updateRowEditBinaryDisplay(wrapper, control, fileName) {
+  var kind = rowEditControlValueKind(control);
+  var size = wrapper.querySelector(".row-edit-binary-size");
+  var name = wrapper.querySelector(".row-edit-binary-name");
+  var clear = wrapper.querySelector(".row-edit-binary-clear");
+  var byteLength =
+    kind === "binary" ? binaryByteLengthFromBase64(control.value) : null;
+
+  if (size) {
+    size.textContent =
+      kind === "binary"
+        ? formatRowEditBinarySize(byteLength)
+        : "No binary data";
+  }
+  if (name) {
+    name.textContent = fileName || "";
+    name.hidden = !fileName;
+  }
+  if (clear) {
+    clear.hidden = control.dataset.notNull === "1" || kind !== "binary";
+  }
+  if (kind === "binary") {
+    updateRowEditBinaryPreview(wrapper, control.value, byteLength);
+  } else {
+    updateRowEditBinaryPreview(wrapper, "", 0);
+  }
+}
+
+function setRowEditBinaryControlValue(control, encoded, fileName) {
+  control.value = encoded || "";
+  control.dataset.currentValueKind = "binary";
+  updateRowEditBinaryDisplay(control._rowEditBinaryWrapper, control, fileName);
+  control.dispatchEvent(new Event("input", { bubbles: true }));
+}
+
+function clearRowEditBinaryControlValue(control) {
+  control.value = "";
+  control.dataset.currentValueKind = "null";
+  updateRowEditBinaryDisplay(control._rowEditBinaryWrapper, control, "");
+  control.dispatchEvent(new Event("input", { bubbles: true }));
+}
+
+function readRowEditBinaryFile(file) {
+  return new Promise(function (resolve, reject) {
+    var reader = new FileReader();
+    reader.onload = function () {
+      try {
+        var bytes = new Uint8Array(reader.result || new ArrayBuffer(0));
+        resolve({
+          encoded: uint8ArrayToBase64(bytes),
+          name: file && file.name ? file.name : "",
+        });
+      } catch (error) {
+        reject(error);
+      }
+    };
+    reader.onerror = function () {
+      reject(reader.error || new Error("Could not read file"));
+    };
+    reader.readAsArrayBuffer(file);
+  });
+}
+
+function rowEditBinaryValueFromText(text) {
+  var encoder = new TextEncoder();
+  var bytes = encoder.encode(text || "");
+  return {
+    encoded: uint8ArrayToBase64(bytes),
+    name: "Pasted text",
+  };
+}
+
+function rowEditBinaryFirstClipboardFile(clipboardData) {
+  if (!clipboardData) {
+    return null;
+  }
+  if (clipboardData.files && clipboardData.files.length) {
+    return clipboardData.files[0];
+  }
+  var items = clipboardData.items || [];
+  for (var i = 0; i < items.length; i += 1) {
+    if (items[i].kind === "file") {
+      return items[i].getAsFile();
+    }
+  }
+  return null;
+}
+
+function handleRowEditBinaryFile(control, file) {
+  if (!file) {
+    return;
+  }
+  readRowEditBinaryFile(file)
+    .then(function (value) {
+      setRowEditBinaryControlValue(control, value.encoded, value.name);
+    })
+    .catch(function (error) {
+      console.error("Could not read binary file", error);
+    });
+}
+
+function createRowEditBinaryControlElement(control, value, options, labelId) {
+  var wrapper = document.createElement("div");
+  wrapper.className = "row-edit-binary-control";
+  wrapper.dataset.column = control.name;
+  wrapper.setAttribute("role", "group");
+  wrapper.setAttribute("tabindex", "0");
+  wrapper.setAttribute("aria-labelledby", labelId);
+
+  var preview = document.createElement("div");
+  preview.className = "row-edit-binary-preview";
+  preview.hidden = true;
+
+  var status = document.createElement("div");
+  status.className = "row-edit-binary-status";
+  var size = document.createElement("span");
+  size.className = "row-edit-binary-size";
+  var name = document.createElement("span");
+  name.className = "row-edit-binary-name";
+  name.hidden = true;
+  status.appendChild(size);
+  status.appendChild(name);
+
+  var actions = document.createElement("div");
+  actions.className = "row-edit-binary-actions";
+  var fileLabel = document.createElement("label");
+  fileLabel.className = "row-edit-binary-file-button";
+  fileLabel.textContent = "Attach file";
+  var fileInput = document.createElement("input");
+  fileInput.type = "file";
+  fileInput.setAttribute("aria-label", "Attach file for " + control.name);
+  fileInput.addEventListener("change", function () {
+    if (fileInput.files && fileInput.files.length) {
+      handleRowEditBinaryFile(control, fileInput.files[0]);
+    }
+  });
+  fileLabel.appendChild(fileInput);
+  actions.appendChild(fileLabel);
+
+  var clearButton = document.createElement("button");
+  clearButton.type = "button";
+  clearButton.className = "row-edit-binary-clear";
+  clearButton.textContent = "Set NULL";
+  clearButton.addEventListener("click", function () {
+    clearRowEditBinaryControlValue(control);
+    wrapper.focus();
+  });
+  actions.appendChild(clearButton);
+
+  var dropTarget = document.createElement("div");
+  dropTarget.className = "row-edit-binary-drop-target";
+  dropTarget.textContent = "Drop or paste file contents";
+  ["dragenter", "dragover"].forEach(function (eventName) {
+    wrapper.addEventListener(eventName, function (ev) {
+      ev.preventDefault();
+      wrapper.classList.add("row-edit-binary-dragover");
+    });
+  });
+  ["dragleave", "drop"].forEach(function (eventName) {
+    wrapper.addEventListener(eventName, function () {
+      wrapper.classList.remove("row-edit-binary-dragover");
+    });
+  });
+  wrapper.addEventListener("drop", function (ev) {
+    ev.preventDefault();
+    var file = ev.dataTransfer && ev.dataTransfer.files[0];
+    handleRowEditBinaryFile(control, file);
+  });
+  wrapper.addEventListener("paste", function (ev) {
+    var file = rowEditBinaryFirstClipboardFile(ev.clipboardData);
+    if (file) {
+      ev.preventDefault();
+      handleRowEditBinaryFile(control, file);
+      return;
+    }
+    var text = ev.clipboardData && ev.clipboardData.getData("text");
+    if (text) {
+      ev.preventDefault();
+      var pasted = rowEditBinaryValueFromText(text);
+      setRowEditBinaryControlValue(control, pasted.encoded, pasted.name);
+    }
+  });
+
+  control.type = "hidden";
+  control._rowEditBinaryWrapper = wrapper;
+  wrapper.appendChild(control);
+  wrapper.appendChild(preview);
+  wrapper.appendChild(status);
+  wrapper.appendChild(actions);
+  wrapper.appendChild(dropTarget);
+
+  updateRowEditBinaryDisplay(wrapper, control, "");
+  return wrapper;
+}
+
 function columnTypeForContext(columnType) {
   if (!columnType) {
     return null;
@@ -918,6 +5351,11 @@ function focusFirstRowEditControl(state, options) {
     if (focusRowEditPluginControl(field)) {
       return true;
     }
+    var binaryControl = field.querySelector(".row-edit-binary-control");
+    if (binaryControl) {
+      binaryControl.focus();
+      return true;
+    }
     control.focus();
     return true;
   }
@@ -941,6 +5379,11 @@ function destroyRowEditFields(state) {
         }
       }
     });
+  state.fields
+    .querySelectorAll(".row-edit-binary-control")
+    .forEach(function (binaryControl) {
+      revokeRowEditBinaryPreview(binaryControl);
+    });
   state.fields.innerHTML = "";
 }
 
@@ -967,34 +5410,50 @@ function createRowEditField(column, value, isPk, columnType, index, options) {
   controlWrap.className = "row-edit-control-wrap";
 
   var context = columnFormControlContext(column, isPk, columnType, options);
-  var pluginControl = makeColumnField(options.manager, context);
+  var isBinaryField = shouldUseBinaryControl(value, options);
+  var pluginControl = isBinaryField
+    ? null
+    : makeColumnField(options.manager, context);
   var useTextarea =
-    (pluginControl && pluginControl.useTextarea === true) ||
-    shouldUseTextarea(value, columnType);
+    !isBinaryField &&
+    ((pluginControl && pluginControl.useTextarea === true) ||
+      shouldUseTextarea(value, columnType));
   var control = useTextarea
     ? document.createElement("textarea")
     : document.createElement("input");
+  var initialValue = isBinaryField
+    ? binaryEncodedValue(value)
+    : valueToEditText(value);
+  var initialValueKind = options.valueKind || rowEditValueKind(value);
+  if (isBinaryField) {
+    initialValueKind = isBase64JsonValue(value) ? "binary" : "null";
+  }
   control.className = "row-edit-input";
   control.id = fieldId;
   control.name = column;
-  control.value = valueToEditText(value);
+  control.value = initialValue;
   control.setAttribute("aria-describedby", metaId);
-  control.dataset.initialValue = valueToEditText(value);
-  control.dataset.initialValueKind =
-    options.valueKind || rowEditValueKind(value);
+  control.dataset.initialValue = initialValue;
+  control.dataset.initialValueKind = initialValueKind;
   control.dataset.primaryKey = isPk ? "1" : "0";
   control.dataset.currentValueKind = control.dataset.initialValueKind;
+  if (isBinaryField) {
+    control.dataset.binaryField = "1";
+    control.dataset.notNull = options.notnull ? "1" : "0";
+  }
   if (hasDefaultExpression) {
     control.dataset.useSqliteDefault = useSqliteDefault ? "1" : "0";
   }
   if (useSqliteDefault) {
     control.disabled = true;
   }
-  if (options.omitIfBlank) {
+  if (options.omitIfBlank || (isBinaryField && options.mode === "insert")) {
     control.dataset.omitIfBlank = "1";
   }
 
-  if (control.nodeName === "TEXTAREA") {
+  if (isBinaryField) {
+    control.type = "hidden";
+  } else if (control.nodeName === "TEXTAREA") {
     control.rows = Math.min(8, Math.max(3, control.value.split("\n").length));
   } else {
     control.type = "text";
@@ -1068,9 +5527,11 @@ function createRowEditField(column, value, isPk, columnType, index, options) {
   field._datasetteColumnFormField = fieldApi;
   var pluginControlElement = renderColumnField(pluginControl, fieldApi);
   var controlElement =
+    (isBinaryField &&
+      createRowEditBinaryControlElement(control, value, options, labelId)) ||
     pluginControlElement ||
     rowEditControlElement(control, options.autocompleteUrl);
-  if (options.autocompleteUrl && !pluginControlElement) {
+  if (options.autocompleteUrl && !pluginControlElement && !isBinaryField) {
     control.addEventListener("input", function () {
       setForeignKeyMetaLink(meta, options.autocompleteUrl, null);
     });
@@ -1161,18 +5622,64 @@ function clearRowEditDialogError(state) {
   state.error.textContent = "";
 }
 
-function showRowEditDialogError(state, message) {
+function showRowEditDialogError(state, message, options) {
   state.error.hidden = false;
   state.error.textContent = message;
-  state.error.focus();
+  if (!options || options.focus !== false) {
+    state.error.focus();
+  }
+}
+
+function rowEditIsMultipleInsert(state) {
+  return state.mode === "insert" && state.insertMode === "multiple";
+}
+
+function syncRowEditInsertModeUi(state) {
+  var isInsert = state.mode === "insert";
+  var isMultiple = rowEditIsMultipleInsert(state);
+  state.fields.hidden = isMultiple;
+  state.bulkInsertPanel.hidden = !isMultiple;
+  state.bulkInsertEditor.hidden = !isMultiple || state.bulkInsertPreviewReady;
+  state.bulkInsertPreview.hidden = !isMultiple || !state.bulkInsertPreviewReady;
+  state.bulkInsertLink.hidden = !isInsert || isMultiple;
+  state.singleInsertLink.hidden = !isInsert || !isMultiple;
 }
 
 function updateRowEditDialogButtons(state) {
   state.saveButton.disabled =
-    state.isLoading || state.isSaving || !state.hasLoaded;
+    state.isLoading ||
+    state.isSaving ||
+    !state.hasLoaded ||
+    state.bulkInsertInserted ||
+    (rowEditIsMultipleInsert(state) &&
+      !state.bulkInsertPreviewReady &&
+      !!state.bulkInsertLiveValidationError);
   state.cancelButton.disabled = state.isSaving;
-  var saveLabel = state.mode === "insert" ? "Insert row" : "Save";
-  state.saveButton.textContent = state.isSaving ? "Saving..." : saveLabel;
+  syncRowEditInsertModeUi(state);
+  state.cancelButton.textContent =
+    rowEditIsMultipleInsert(state) &&
+    state.bulkInsertPreviewReady &&
+    !state.bulkInsertInserted
+      ? "Back"
+      : state.bulkInsertInserted
+        ? "Close and view table"
+        : "Cancel";
+  var saveLabel = rowEditIsMultipleInsert(state)
+    ? state.bulkInsertInserted
+      ? "Inserted"
+      : state.bulkInsertPreviewReady
+        ? bulkInsertSaveLabel(state)
+        : "Preview rows"
+    : state.mode === "insert"
+      ? "Insert row"
+      : "Save";
+  state.saveButton.textContent = state.isSaving
+    ? rowEditIsMultipleInsert(state)
+      ? bulkInsertConflictMode(state) === "upsert"
+        ? "Updating..."
+        : "Inserting..."
+      : "Saving..."
+    : saveLabel;
   state.form.setAttribute(
     "aria-busy",
     state.isLoading || state.isSaving ? "true" : "false",
@@ -1192,6 +5699,9 @@ function setRowEditDialogSaving(state, isSaving) {
 
 function valueFromRowEditControl(control) {
   var value = control.value;
+  if (rowEditControlValueKind(control) === "binary") {
+    return rowEditBinaryValue(value);
+  }
   return valueFromRowEditText(
     control.name,
     value,
@@ -1202,6 +5712,9 @@ function valueFromRowEditControl(control) {
 function valueFromRowEditText(name, value, initialValueKind) {
   var trimmed = value.trim();
 
+  if (initialValueKind === "binary") {
+    return rowEditBinaryValue(value);
+  }
   if (initialValueKind === "null" && value === "") {
     return null;
   }
@@ -1329,7 +5842,11 @@ function collectRowFormValues(state) {
     if (control.dataset.useSqliteDefault === "1") {
       return;
     }
-    if (control.dataset.omitIfBlank === "1" && control.value === "") {
+    if (
+      control.dataset.omitIfBlank === "1" &&
+      control.value === "" &&
+      rowEditControlValueKind(control) !== "binary"
+    ) {
       return;
     }
     if (
@@ -1363,6 +5880,16 @@ function rowEditDialogHasChanges(state) {
   if (!state || !state.hasLoaded || state.isLoading) {
     return false;
   }
+  if (state.bulkInsertInserted) {
+    return false;
+  }
+  if (
+    state.mode === "insert" &&
+    state.bulkInsertTextarea &&
+    state.bulkInsertTextarea.value.trim()
+  ) {
+    return true;
+  }
   var fields = state.fields.querySelectorAll(".row-edit-field");
   for (var i = 0; i < fields.length; i += 1) {
     var fieldApi = fields[i]._datasetteColumnFormField;
@@ -1396,6 +5923,831 @@ function closeRowEditDialogIfConfirmed(state) {
   return true;
 }
 
+function setRowInsertDialogTitle(state) {
+  var insertData = tableInsertData() || {};
+  var title = rowEditIsMultipleInsert(state)
+    ? "Insert multiple rows"
+    : "Insert row";
+  setRowDialogTitle(
+    state.title,
+    insertData.tableName ? title + " into " + insertData.tableName : title,
+  );
+}
+
+function showMultipleRowInsert(state) {
+  if (!state || state.mode !== "insert" || state.isSaving) {
+    return;
+  }
+  state.insertMode = "multiple";
+  if (state.bulkInsertPreviewReady || state.bulkInsertInserted) {
+    resetBulkInsertPreview(state);
+  }
+  clearRowEditDialogError(state);
+  setRowInsertDialogTitle(state);
+  syncBulkInsertConflictUi(state);
+  syncBulkInsertTextareaValidation(state);
+  updateRowEditDialogButtons(state);
+  state.bulkInsertTextarea.focus();
+}
+
+function showSingleRowInsert(state) {
+  if (!state || state.mode !== "insert" || state.isSaving) {
+    return;
+  }
+  state.insertMode = "single";
+  clearRowEditDialogError(state);
+  setRowInsertDialogTitle(state);
+  updateRowEditDialogButtons(state);
+  if (!focusFirstRowEditControl(state, { skipReadonly: true })) {
+    state.saveButton.focus();
+  }
+}
+
+function bulkInsertConflictMode(state) {
+  if (!state || !state.bulkInsertHasPrimaryKeyColumns) {
+    return "insert";
+  }
+  return state.bulkInsertConflictMode || "ignore";
+}
+
+function syncBulkInsertConflictUi(state) {
+  if (!state || !state.bulkInsertConflictField) {
+    return;
+  }
+  var insertData = tableInsertData() || {};
+  var primaryKeys = insertData.primaryKeys || [];
+  var hasPrimaryKeys = primaryKeys.length > 0;
+  var hasPrimaryKeyColumns =
+    hasPrimaryKeys &&
+    bulkInsertTextIncludesPrimaryKeyColumns(
+      state.bulkInsertTextarea.value,
+      state.bulkInsertColumnDetails,
+      primaryKeys,
+    );
+  state.bulkInsertHasPrimaryKeyColumns = hasPrimaryKeyColumns;
+  var canUpsert = hasPrimaryKeyColumns && !!state.currentUpsertUrl;
+  var upsertOption = state.bulkInsertConflictSelect.querySelector(
+    'option[value="upsert"]',
+  );
+  if (upsertOption) {
+    upsertOption.disabled = !canUpsert;
+    upsertOption.hidden = !canUpsert;
+  }
+  if (
+    !hasPrimaryKeyColumns ||
+    (!canUpsert && bulkInsertConflictMode(state) === "upsert")
+  ) {
+    state.bulkInsertConflictMode = hasPrimaryKeys ? "ignore" : "insert";
+    state.bulkInsertConflictSelect.value = state.bulkInsertConflictMode;
+  }
+  state.bulkInsertConflictField.hidden = !hasPrimaryKeyColumns;
+  state.bulkInsertConflictSelect.value = bulkInsertConflictMode(state);
+  var helpText = "";
+  if (bulkInsertConflictMode(state) === "upsert") {
+    helpText =
+      "Rows with existing primary keys will be updated; new primary keys will be inserted.";
+  } else if (bulkInsertConflictMode(state) === "ignore") {
+    helpText = "Rows with existing primary keys will be skipped.";
+  } else {
+    helpText = "Rows with existing primary keys will stop the import.";
+  }
+  state.bulkInsertConflictHelp.textContent = helpText;
+}
+
+function bulkInsertSaveLabel(state) {
+  if (!state.bulkInsertPreviewReady) {
+    return "Preview rows";
+  }
+  if (bulkInsertConflictMode(state) === "upsert") {
+    return "Update or insert rows";
+  }
+  return "Insert these rows";
+}
+
+function readTextFile(file) {
+  if (file.text) {
+    return file.text();
+  }
+  return new Promise(function (resolve, reject) {
+    var reader = new FileReader();
+    reader.onload = function () {
+      resolve(reader.result || "");
+    };
+    reader.onerror = function () {
+      reject(reader.error);
+    };
+    reader.readAsText(file);
+  });
+}
+
+async function loadBulkInsertTextFile(state, file) {
+  if (!file) {
+    return;
+  }
+  try {
+    state.bulkInsertTextarea.value = await readTextFile(file);
+    state.bulkInsertTextarea.dispatchEvent(
+      new Event("input", { bubbles: true }),
+    );
+    state.bulkInsertTextarea.focus();
+  } catch (_error) {
+    showRowEditDialogError(state, "Could not read that text file.");
+  }
+}
+
+function bulkInsertTemplateText(state) {
+  return (state.bulkInsertTemplateColumns || []).join("\t");
+}
+
+async function copyTextToClipboard(text) {
+  if (navigator.clipboard && navigator.clipboard.writeText) {
+    await navigator.clipboard.writeText(text);
+    return;
+  }
+  var textarea = document.createElement("textarea");
+  textarea.value = text;
+  textarea.setAttribute("readonly", "");
+  textarea.style.position = "fixed";
+  textarea.style.top = "-1000px";
+  textarea.style.left = "-1000px";
+  document.body.appendChild(textarea);
+  textarea.select();
+  var copied = document.execCommand("copy");
+  textarea.remove();
+  if (!copied) {
+    throw new Error("copy failed");
+  }
+}
+
+function setBulkInsertCopyButtonReady(state) {
+  state.copyTemplateButton.textContent = "";
+  var wideLabel = document.createElement("span");
+  wideLabel.className = "row-edit-copy-template-label-wide";
+  wideLabel.textContent = "Copy spreadsheet template";
+  state.copyTemplateButton.appendChild(wideLabel);
+  var narrowLabel = document.createElement("span");
+  narrowLabel.className = "row-edit-copy-template-label-narrow";
+  narrowLabel.textContent = "Copy template";
+  state.copyTemplateButton.appendChild(narrowLabel);
+}
+
+function setBulkInsertCopyButtonCopied(state) {
+  state.copyTemplateButton.textContent = "Copied";
+  clearTimeout(state.copyTemplateResetTimer);
+  state.copyTemplateResetTimer = setTimeout(function () {
+    setBulkInsertCopyButtonReady(state);
+  }, 1500);
+}
+
+function resetBulkInsertPreview(state) {
+  state.bulkInsertPreviewRows = null;
+  state.bulkInsertPreviewReady = false;
+  state.bulkInsertInserted = false;
+  state.bulkInsertInsertedCount = 0;
+  state.bulkInsertPreview.hidden = true;
+  state.bulkInsertPreview.textContent = "";
+  state.bulkInsertProgress.hidden = true;
+  state.bulkInsertProgressBar.value = 0;
+  state.bulkInsertProgressBar.max = 1;
+  state.bulkInsertProgressStatus.textContent = "";
+  syncBulkInsertConflictUi(state);
+  syncRowEditInsertModeUi(state);
+}
+
+function normalizeBulkInsertCell(column, value) {
+  if (typeof value === "undefined") {
+    return column.notnull ? "" : null;
+  }
+  if (value === null) {
+    return column.notnull ? "" : null;
+  }
+  if (value === "" && column.notnull) {
+    return "";
+  }
+  if (column.value_kind === "number" && typeof value === "string") {
+    return valueFromRowEditText(column.name, value, "number");
+  }
+  return value;
+}
+
+function rowObjectForBulkInsert(valuesByColumn, columns) {
+  var row = {};
+  columns.forEach(function (column) {
+    var hasValue = Object.prototype.hasOwnProperty.call(
+      valuesByColumn,
+      column.name,
+    );
+    if (!hasValue) {
+      return;
+    }
+    row[column.name] = normalizeBulkInsertCell(
+      column,
+      valuesByColumn[column.name],
+    );
+  });
+  return row;
+}
+
+function splitDelimitedRows(text, delimiter) {
+  var rows = [];
+  var row = [];
+  var cell = "";
+  var inQuotes = false;
+
+  for (var i = 0; i < text.length; i += 1) {
+    var character = text[i];
+    if (inQuotes) {
+      if (character === '"') {
+        if (text[i + 1] === '"') {
+          cell += '"';
+          i += 1;
+        } else {
+          inQuotes = false;
+        }
+      } else {
+        cell += character;
+      }
+      continue;
+    }
+
+    if (character === '"') {
+      inQuotes = true;
+    } else if (character === delimiter) {
+      row.push(cell);
+      cell = "";
+    } else if (character === "\n" || character === "\r") {
+      row.push(cell);
+      rows.push(row);
+      row = [];
+      cell = "";
+      if (character === "\r" && text[i + 1] === "\n") {
+        i += 1;
+      }
+    } else {
+      cell += character;
+    }
+  }
+
+  if (inQuotes) {
+    throw new Error("Unclosed quoted value.");
+  }
+  row.push(cell);
+  rows.push(row);
+
+  while (rows.length && bulkInsertDelimitedRowIsBlank(rows[rows.length - 1])) {
+    rows.pop();
+  }
+  return rows;
+}
+
+function bulkInsertDelimitedRowIsBlank(row) {
+  return row.every(function (value) {
+    return value.trim() === "";
+  });
+}
+
+function delimiterPreviewRows(text, delimiter) {
+  try {
+    return splitDelimitedRows(text, delimiter);
+  } catch (_error) {
+    return [];
+  }
+}
+
+function splitSingleColumnRows(text) {
+  var rows = text.split(/\r\n|\n|\r/).map(function (line) {
+    return [line];
+  });
+  while (rows.length && bulkInsertDelimitedRowIsBlank(rows[rows.length - 1])) {
+    rows.pop();
+  }
+  return rows;
+}
+
+function detectBulkInsertDelimiter(text, columns) {
+  var firstLine =
+    text.split(/\r\n|\n|\r/).find(function (line) {
+      return line.trim() !== "";
+    }) || "";
+  var csvRows = delimiterPreviewRows(firstLine, ",");
+  var tsvRows = delimiterPreviewRows(firstLine, "\t");
+  var csvColumns = csvRows.length ? csvRows[0].length : 0;
+  var tsvColumns = tsvRows.length ? tsvRows[0].length : 0;
+
+  if (firstLine.indexOf("\t") !== -1 && firstLine.indexOf(",") === -1) {
+    return "\t";
+  }
+  if (tsvColumns > csvColumns) {
+    return "\t";
+  }
+  if (csvColumns > 1) {
+    return ",";
+  }
+  if (tsvColumns > 1) {
+    return "\t";
+  }
+  if (columns.length === 1 || bulkInsertColumnMap(columns)[firstLine.trim()]) {
+    return null;
+  }
+  throw new Error("Could not detect CSV or TSV columns.");
+}
+
+function bulkInsertColumnMap(columns) {
+  var map = {};
+  columns.forEach(function (column) {
+    map[column.name] = column;
+  });
+  return map;
+}
+
+function bulkInsertTextIncludesPrimaryKeyColumns(text, columns, primaryKeys) {
+  if (!primaryKeys.length || !text.trim()) {
+    return false;
+  }
+  var trimmed = text.trim();
+  try {
+    if (trimmed[0] === "[" || trimmed[0] === "{") {
+      return jsonBulkInsertTextIncludesPrimaryKeyColumns(trimmed, primaryKeys);
+    }
+    return delimitedBulkInsertTextIncludesPrimaryKeyColumns(
+      trimmed,
+      columns,
+      primaryKeys,
+    );
+  } catch (_error) {
+    return false;
+  }
+}
+
+function jsonBulkInsertTextIncludesPrimaryKeyColumns(text, primaryKeys) {
+  var rows = parseJsonObjectRows(text);
+  var seenKeys = {};
+  rows.forEach(function (row) {
+    Object.keys(row).forEach(function (key) {
+      seenKeys[key] = true;
+    });
+  });
+  return primaryKeys.every(function (key) {
+    return !!seenKeys[key];
+  });
+}
+
+function delimitedBulkInsertTextIncludesPrimaryKeyColumns(
+  text,
+  columns,
+  primaryKeys,
+) {
+  var delimiter = detectBulkInsertDelimiter(text, columns);
+  var rows = (
+    delimiter === null
+      ? splitSingleColumnRows(text)
+      : splitDelimitedRows(text, delimiter)
+  ).filter(function (row) {
+    return !bulkInsertDelimitedRowIsBlank(row);
+  });
+  if (!rows.length) {
+    return false;
+  }
+
+  var columnMap = bulkInsertColumnMap(columns);
+  var header = rows[0].map(function (value) {
+    return value.trim();
+  });
+  var headerMatches = header.filter(function (name) {
+    return !!columnMap[name];
+  }).length;
+  if (headerMatches > 0) {
+    return primaryKeys.every(function (key) {
+      return header.indexOf(key) !== -1;
+    });
+  }
+
+  var headers = columns.map(function (column) {
+    return column.name;
+  });
+  var suppliedColumnCount = rows.reduce(function (count, row) {
+    return Math.max(count, row.length);
+  }, 0);
+  return primaryKeys.every(function (key) {
+    var index = headers.indexOf(key);
+    return index !== -1 && index < suppliedColumnCount;
+  });
+}
+
+function bulkInsertLiveValidationShouldWait(message) {
+  return (
+    message === "Paste rows before previewing." ||
+    message === "No data rows found to preview." ||
+    message.indexOf("Invalid JSON:") === 0
+  );
+}
+
+function bulkInsertLiveValidationError(state) {
+  var text = state.bulkInsertTextarea.value;
+  if (!text.trim()) {
+    return null;
+  }
+  try {
+    parseBulkInsertRows(text, state.bulkInsertColumnDetails);
+  } catch (error) {
+    var message = error.message || "Could not preview rows.";
+    return bulkInsertLiveValidationShouldWait(message) ? null : message;
+  }
+  return null;
+}
+
+function syncBulkInsertTextareaValidation(state) {
+  if (!rowEditIsMultipleInsert(state) || state.bulkInsertPreviewReady) {
+    state.bulkInsertLiveValidationError = null;
+    return;
+  }
+  state.bulkInsertLiveValidationError = bulkInsertLiveValidationError(state);
+  if (state.bulkInsertLiveValidationError) {
+    showRowEditDialogError(state, state.bulkInsertLiveValidationError, {
+      focus: false,
+    });
+  } else {
+    clearRowEditDialogError(state);
+  }
+}
+
+function parseJsonBulkInsertRows(text, columns) {
+  var parsed = parseJsonObjectRows(text);
+
+  var columnMap = bulkInsertColumnMap(columns);
+  return parsed.map(function (item, index) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) {
+      throw new Error("JSON row " + (index + 1) + " must be an object.");
+    }
+    Object.keys(item).forEach(function (key) {
+      if (!columnMap[key]) {
+        throw new Error(
+          "JSON row " + (index + 1) + " has unknown column " + key + ".",
+        );
+      }
+    });
+    return rowObjectForBulkInsert(item, columns);
+  });
+}
+
+function parseDelimitedBulkInsertRows(text, columns) {
+  var delimiter = detectBulkInsertDelimiter(text, columns);
+  var rows = (
+    delimiter === null
+      ? splitSingleColumnRows(text)
+      : splitDelimitedRows(text, delimiter)
+  ).filter(function (row) {
+    return !bulkInsertDelimitedRowIsBlank(row);
+  });
+  if (!rows.length) {
+    throw new Error("No rows found to preview.");
+  }
+
+  var columnMap = bulkInsertColumnMap(columns);
+  var header = rows[0].map(function (value) {
+    return value.trim();
+  });
+  var headerMatches = header.filter(function (name) {
+    return !!columnMap[name];
+  }).length;
+  var hasHeader = headerMatches > 0;
+  var dataRows = hasHeader ? rows.slice(1) : rows;
+  var headers = hasHeader
+    ? header
+    : columns.map(function (column) {
+        return column.name;
+      });
+  var seenHeaders = {};
+
+  if (hasHeader) {
+    headers.forEach(function (name) {
+      if (!name) {
+        return;
+      }
+      if (!columnMap[name]) {
+        throw new Error("Unknown column " + name + " in header row.");
+      }
+      if (seenHeaders[name]) {
+        throw new Error("Duplicate column " + name + " in header row.");
+      }
+      seenHeaders[name] = true;
+    });
+  }
+
+  if (!dataRows.length) {
+    throw new Error("No data rows found to preview.");
+  }
+
+  return dataRows.map(function (row, rowIndex) {
+    if (row.length > headers.length) {
+      throw new Error(
+        "Row " +
+          (rowIndex + 1) +
+          " has " +
+          row.length +
+          " values, but only " +
+          headers.length +
+          " columns were provided.",
+      );
+    }
+    var valuesByColumn = {};
+    row.forEach(function (value, index) {
+      var columnName = headers[index];
+      if (columnMap[columnName]) {
+        valuesByColumn[columnName] = value;
+      }
+    });
+    return rowObjectForBulkInsert(valuesByColumn, columns);
+  });
+}
+
+function parseBulkInsertRows(text, columns) {
+  var trimmed = text.trim();
+  if (!trimmed) {
+    throw new Error("Paste rows before previewing.");
+  }
+  if (trimmed[0] === "[" || trimmed[0] === "{") {
+    return parseJsonBulkInsertRows(trimmed, columns);
+  }
+  return parseDelimitedBulkInsertRows(trimmed, columns);
+}
+
+function bulkInsertPreviewValue(value) {
+  if (value === null) {
+    return "null";
+  }
+  if (typeof value === "object") {
+    return JSON.stringify(value);
+  }
+  return String(value);
+}
+
+function bulkInsertPreviewCell(column, hasValue, value) {
+  if (!hasValue && column.is_auto_pk) {
+    return {
+      text: "auto",
+      className: "row-edit-bulk-preview-auto",
+    };
+  }
+  if (value === null) {
+    return {
+      text: bulkInsertPreviewValue(value),
+      className: "row-edit-bulk-preview-null",
+    };
+  }
+  return {
+    text: hasValue ? bulkInsertPreviewValue(value) : "",
+    className: "",
+  };
+}
+
+function renderBulkInsertPreview(state, rows) {
+  state.bulkInsertPreview.textContent = "";
+  var summary = document.createElement("p");
+  summary.className = "row-edit-bulk-preview-summary";
+  summary.textContent =
+    "Previewing " + rows.length + " row" + (rows.length === 1 ? "." : "s.");
+  state.bulkInsertPreview.appendChild(summary);
+
+  var tableWrap = document.createElement("div");
+  tableWrap.className = "row-edit-bulk-preview-table-wrap";
+  var table = document.createElement("table");
+  table.className = "row-edit-bulk-preview-table";
+  var thead = document.createElement("thead");
+  var headerRow = document.createElement("tr");
+  state.bulkInsertColumnDetails.forEach(function (column) {
+    var th = document.createElement("th");
+    th.scope = "col";
+    th.textContent = column.name;
+    headerRow.appendChild(th);
+  });
+  thead.appendChild(headerRow);
+  table.appendChild(thead);
+
+  var tbody = document.createElement("tbody");
+  rows.forEach(function (row) {
+    var tr = document.createElement("tr");
+    state.bulkInsertColumnDetails.forEach(function (column) {
+      var td = document.createElement("td");
+      var hasValue = Object.prototype.hasOwnProperty.call(row, column.name);
+      var value = hasValue ? row[column.name] : "";
+      var cell = bulkInsertPreviewCell(column, hasValue, value);
+      td.textContent = cell.text;
+      if (cell.className) {
+        td.className = cell.className;
+      }
+      tr.appendChild(td);
+    });
+    tbody.appendChild(tr);
+  });
+  table.appendChild(tbody);
+  tableWrap.appendChild(table);
+  state.bulkInsertPreview.appendChild(tableWrap);
+  state.bulkInsertPreview.hidden = false;
+}
+
+function previewBulkInsertRows(state) {
+  clearRowEditDialogError(state);
+  resetBulkInsertPreview(state);
+  syncBulkInsertConflictUi(state);
+  try {
+    var rows = parseBulkInsertRows(
+      state.bulkInsertTextarea.value,
+      state.bulkInsertColumnDetails,
+    );
+    state.bulkInsertPreviewRows = rows;
+    state.bulkInsertPreviewReady = true;
+    renderBulkInsertPreview(state, rows);
+    updateRowEditDialogButtons(state);
+  } catch (error) {
+    showRowEditDialogError(state, error.message || "Could not preview rows.");
+    updateRowEditDialogButtons(state);
+  }
+}
+
+function updateBulkInsertProgress(state, inserted, total) {
+  var words = bulkInsertProgressWords(state);
+  state.bulkInsertProgress.hidden = false;
+  state.bulkInsertProgressBar.max = total || 1;
+  state.bulkInsertProgressBar.value = inserted;
+  state.bulkInsertProgressStatus.textContent =
+    inserted >= total
+      ? total + " row" + (total === 1 ? " " : "s ") + words.complete + "."
+      : words.active + " " + inserted + " of " + total + " rows...";
+}
+
+function bulkInsertBatches(rows, batchSize) {
+  var batches = [];
+  var size = Math.max(1, batchSize || 1);
+  for (var index = 0; index < rows.length; index += size) {
+    batches.push(rows.slice(index, index + size));
+  }
+  return batches;
+}
+
+function animateBulkInsertProgress(state, from, to, total, duration) {
+  state.bulkInsertProgress.hidden = false;
+  state.bulkInsertProgressBar.max = total || 1;
+  if (duration <= 0 || !window.requestAnimationFrame) {
+    updateBulkInsertProgress(state, to, total);
+    return Promise.resolve();
+  }
+
+  return new Promise(function (resolve) {
+    var startTime = null;
+    var step = function (timestamp) {
+      if (startTime === null) {
+        startTime = timestamp;
+      }
+      var progress = Math.min((timestamp - startTime) / duration, 1);
+      var easedProgress = 1 - Math.pow(1 - progress, 3);
+      var value = from + (to - from) * easedProgress;
+      var displayValue = progress === 1 ? to : Math.floor(value);
+      var words = bulkInsertProgressWords(state);
+      state.bulkInsertProgressBar.value = value;
+      state.bulkInsertProgressStatus.textContent =
+        displayValue >= total
+          ? total + " row" + (total === 1 ? " " : "s ") + words.complete + "."
+          : words.active + " " + displayValue + " of " + total + " rows...";
+      if (progress < 1) {
+        window.requestAnimationFrame(step);
+      } else {
+        updateBulkInsertProgress(state, to, total);
+        resolve();
+      }
+    };
+    window.requestAnimationFrame(step);
+  });
+}
+
+function bulkInsertProgressWords(state) {
+  var mode = bulkInsertConflictMode(state);
+  if (mode === "upsert") {
+    return {
+      active: "Upserting",
+      complete: "upserted",
+    };
+  }
+  if (mode === "ignore") {
+    return {
+      active: "Processing",
+      complete: "processed",
+    };
+  }
+  return {
+    active: "Inserting",
+    complete: "inserted",
+  };
+}
+
+function validateBulkInsertConflictRows(state, rows) {
+  if (bulkInsertConflictMode(state) !== "upsert") {
+    return null;
+  }
+  var insertData = tableInsertData() || {};
+  var primaryKeys = insertData.primaryKeys || [];
+  for (var index = 0; index < rows.length; index += 1) {
+    var row = rows[index];
+    var missing = primaryKeys.filter(function (key) {
+      return (
+        !Object.prototype.hasOwnProperty.call(row, key) ||
+        row[key] === null ||
+        typeof row[key] === "undefined"
+      );
+    });
+    if (missing.length) {
+      return (
+        "Row " +
+        (index + 1) +
+        " is missing primary key " +
+        missing.join(", ") +
+        ". Upsert requires primary key values for every row."
+      );
+    }
+  }
+  return null;
+}
+
+async function insertBulkPreviewRows(state) {
+  if (!state.bulkInsertPreviewRows || state.bulkInsertInserted) {
+    return;
+  }
+  var conflictMode = bulkInsertConflictMode(state);
+  var url =
+    conflictMode === "upsert" ? state.currentUpsertUrl : state.currentInsertUrl;
+  if (!url) {
+    showRowEditDialogError(
+      state,
+      conflictMode === "upsert"
+        ? "Could not find the row upsert URL."
+        : "Could not find the row insert URL.",
+    );
+    return;
+  }
+
+  var rows = state.bulkInsertPreviewRows;
+  var validationError = validateBulkInsertConflictRows(state, rows);
+  if (validationError) {
+    showRowEditDialogError(state, validationError);
+    return;
+  }
+  var total = rows.length;
+  var inserted = state.bulkInsertInsertedCount || 0;
+  var batches = bulkInsertBatches(
+    rows.slice(inserted),
+    state.bulkInsertMaxRows,
+  );
+  var progressAnimationDuration = 500 / Math.max(batches.length, 1);
+
+  clearRowEditDialogError(state);
+  updateBulkInsertProgress(state, inserted, total);
+  setRowEditDialogSaving(state, true);
+  try {
+    for (var batchIndex = 0; batchIndex < batches.length; batchIndex += 1) {
+      var batch = batches[batchIndex];
+      var payload = { rows: batch };
+      if (conflictMode === "ignore") {
+        payload.ignore = true;
+      }
+      var response = await fetch(url, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Accept: "application/json",
+        },
+        body: JSON.stringify(payload),
+      });
+      var data = null;
+      try {
+        data = await response.json();
+      } catch (_error) {
+        data = null;
+      }
+      if (!response.ok || (data && data.ok === false)) {
+        throw rowMutationRequestError(response, data);
+      }
+      var previousInserted = inserted;
+      inserted += batch.length;
+      state.bulkInsertInsertedCount = inserted;
+      await animateBulkInsertProgress(
+        state,
+        previousInserted,
+        inserted,
+        total,
+        progressAnimationDuration,
+      );
+    }
+    state.bulkInsertInserted = true;
+    state.shouldReloadOnClose = true;
+    state.redirectOnCloseUrl = tableBaseUrl().toString();
+    updateBulkInsertProgress(state, inserted, total);
+  } catch (error) {
+    showRowEditDialogError(state, error.message || "Could not insert rows.");
+  } finally {
+    setRowEditDialogSaving(state, false);
+  }
+}
+
 function scheduleCloseRowEditDialogIfConfirmed(state) {
   // Fix for an issue in Safari where hitting Esc would show
   // the confirm() prompt asking if state should be discarded
@@ -1494,6 +6846,14 @@ async function saveRowEditDialog(state) {
   if (state.isLoading || state.isSaving || !state.hasLoaded) {
     return;
   }
+  if (rowEditIsMultipleInsert(state)) {
+    if (!state.bulkInsertPreviewReady) {
+      previewBulkInsertRows(state);
+    } else if (!state.bulkInsertInserted) {
+      await insertBulkPreviewRows(state);
+    }
+    return;
+  }
   clearRowEditDialogError(state);
   setRowEditDialogSaving(state, true);
 
@@ -1651,9 +7011,12 @@ function renderRowEditFields(state, data) {
   var columns = data.columns || (row ? Object.keys(row) : []);
   var primaryKeys = data.primary_keys || [];
   var columnTypes = data.column_types || {};
+  var columnDetails = data.column_details || {};
 
+  state.insertMode = "single";
   destroyRowEditFields(state);
   columns.forEach(function (column, index) {
+    var columnDetail = columnDetails[column] || {};
     state.fields.appendChild(
       createRowEditField(
         column,
@@ -1667,7 +7030,9 @@ function renderRowEditFields(state, data) {
           form: state.form,
           manager: state.manager,
           mode: state.mode,
+          notnull: columnDetail.notnull,
           primaryKeyReadonly: true,
+          sqliteType: columnDetail.sqlite_type,
         },
       ),
     );
@@ -1682,7 +7047,23 @@ function renderRowEditFields(state, data) {
 
 function renderRowInsertFields(state, data) {
   var columns = data.columns || [];
+  var bulkColumns = data.bulkColumns || columns;
 
+  state.insertMode = "single";
+  state.bulkInsertColumnDetails = bulkColumns.slice();
+  state.bulkInsertMaxRows = data.maxInsertRows || 100;
+  state.bulkInsertColumns = bulkColumns.map(function (column) {
+    return column.name;
+  });
+  state.bulkInsertTemplateColumns = columns.map(function (column) {
+    return column.name;
+  });
+  state.copyTemplateButton.disabled = !state.bulkInsertTemplateColumns.length;
+  setBulkInsertCopyButtonReady(state);
+  syncBulkInsertConflictUi(state);
+  clearTimeout(state.copyTemplateResetTimer);
+  state.copyTemplateResetTimer = null;
+  resetBulkInsertPreview(state);
   destroyRowEditFields(state);
   columns.forEach(function (column, index) {
     state.fields.appendChild(
@@ -1772,7 +7153,36 @@ function ensureRowEditDialog(manager) {
       <p class="row-edit-loading" role="status" aria-live="polite">Loading row...</p>
       <p class="row-edit-error" role="alert" tabindex="-1" hidden></p>
       <div class="row-edit-fields"></div>
+      <div class="row-edit-bulk" hidden>
+        <div class="row-edit-bulk-editor">
+          <p class="row-edit-bulk-note"><label for="row-edit-bulk-textarea">Paste TSV, CSV, or JSON</label>. You can also <button type="button" class="button-as-link row-edit-bulk-open-file">open a file</button> or drop it onto this textarea</p>
+          <input class="row-edit-bulk-file-input" type="file" accept=".csv,.tsv,.json,.txt,text/csv,text/tab-separated-values,application/json,text/plain" hidden>
+          <textarea class="row-edit-input row-edit-bulk-textarea" id="row-edit-bulk-textarea" name="_bulk_rows" rows="12" spellcheck="false"></textarea>
+          <div class="row-edit-bulk-conflict" hidden>
+            <label class="row-edit-bulk-conflict-label" for="row-edit-bulk-conflict-mode">If the row exists already</label>
+            <div class="row-edit-bulk-conflict-control">
+              <select class="row-edit-input row-edit-bulk-conflict-mode" id="row-edit-bulk-conflict-mode" aria-describedby="row-edit-bulk-conflict-help">
+                <option value="insert">Stop with an error</option>
+                <option value="ignore">Skip existing rows</option>
+                <option value="upsert">Update existing and insert new</option>
+              </select>
+              <p class="row-edit-bulk-conflict-help" id="row-edit-bulk-conflict-help"></p>
+            </div>
+          </div>
+          <div class="row-edit-bulk-actions">
+            <button type="button" class="btn btn-ghost row-edit-copy-template"><span class="row-edit-copy-template-label-wide">Copy spreadsheet template</span><span class="row-edit-copy-template-label-narrow">Copy template</span></button>
+            <span class="row-edit-bulk-template-note"><span class="row-edit-bulk-template-note-wide">You can paste the template into Google Sheets or Excel.</span><span class="row-edit-bulk-template-note-narrow">Paste into Google Sheets or Excel</span></span>
+          </div>
+        </div>
+        <div class="row-edit-bulk-preview" hidden></div>
+        <div class="row-edit-bulk-progress" hidden>
+          <progress class="row-edit-bulk-progress-bar" value="0" max="1"></progress>
+          <p class="row-edit-bulk-progress-status" role="status" aria-live="polite"></p>
+        </div>
+      </div>
       <div class="modal-footer">
+        <a href="#" class="row-edit-mode-link row-edit-bulk-insert" hidden>Insert multiple rows</a>
+        <a href="#" class="row-edit-mode-link row-edit-single-insert" hidden>Insert single row</a>
         <button type="button" class="btn btn-ghost row-edit-cancel">Cancel</button>
         <button type="submit" class="btn btn-primary row-edit-save" disabled>Save</button>
       </div>
@@ -1788,6 +7198,27 @@ function ensureRowEditDialog(manager) {
     loading: dialog.querySelector(".row-edit-loading"),
     error: dialog.querySelector(".row-edit-error"),
     fields: dialog.querySelector(".row-edit-fields"),
+    bulkInsertPanel: dialog.querySelector(".row-edit-bulk"),
+    bulkInsertEditor: dialog.querySelector(".row-edit-bulk-editor"),
+    bulkInsertTextarea: dialog.querySelector(".row-edit-bulk-textarea"),
+    bulkInsertPreview: dialog.querySelector(".row-edit-bulk-preview"),
+    bulkInsertProgress: dialog.querySelector(".row-edit-bulk-progress"),
+    bulkInsertProgressBar: dialog.querySelector(".row-edit-bulk-progress-bar"),
+    bulkInsertProgressStatus: dialog.querySelector(
+      ".row-edit-bulk-progress-status",
+    ),
+    bulkInsertConflictField: dialog.querySelector(".row-edit-bulk-conflict"),
+    bulkInsertConflictSelect: dialog.querySelector(
+      ".row-edit-bulk-conflict-mode",
+    ),
+    bulkInsertConflictHelp: dialog.querySelector(
+      ".row-edit-bulk-conflict-help",
+    ),
+    copyTemplateButton: dialog.querySelector(".row-edit-copy-template"),
+    bulkInsertOpenFileButton: dialog.querySelector(".row-edit-bulk-open-file"),
+    bulkInsertFileInput: dialog.querySelector(".row-edit-bulk-file-input"),
+    bulkInsertLink: dialog.querySelector(".row-edit-bulk-insert"),
+    singleInsertLink: dialog.querySelector(".row-edit-single-insert"),
     cancelButton: dialog.querySelector(".row-edit-cancel"),
     saveButton: dialog.querySelector(".row-edit-save"),
     currentButton: null,
@@ -1795,9 +7226,25 @@ function ensureRowEditDialog(manager) {
     currentRowId: null,
     currentPkPath: null,
     currentInsertUrl: null,
+    currentUpsertUrl: null,
     currentUpdateUrl: null,
     currentFragmentUrl: null,
     mode: "edit",
+    insertMode: "single",
+    bulkInsertConflictMode: "ignore",
+    bulkInsertHasPrimaryKeyColumns: false,
+    bulkInsertLiveValidationError: null,
+    bulkInsertColumns: [],
+    bulkInsertTemplateColumns: [],
+    bulkInsertColumnDetails: [],
+    bulkInsertPreviewRows: null,
+    bulkInsertPreviewReady: false,
+    bulkInsertInserted: false,
+    bulkInsertInsertedCount: 0,
+    bulkInsertMaxRows: 100,
+    shouldReloadOnClose: false,
+    redirectOnCloseUrl: null,
+    copyTemplateResetTimer: null,
     loadId: 0,
     manager: manager,
     isLoading: false,
@@ -1813,12 +7260,139 @@ function ensureRowEditDialog(manager) {
   });
 
   rowEditDialogState.cancelButton.addEventListener("click", function () {
+    if (
+      rowEditIsMultipleInsert(rowEditDialogState) &&
+      rowEditDialogState.bulkInsertPreviewReady &&
+      !rowEditDialogState.bulkInsertInserted &&
+      !rowEditDialogState.isSaving
+    ) {
+      resetBulkInsertPreview(rowEditDialogState);
+      updateRowEditDialogButtons(rowEditDialogState);
+      rowEditDialogState.bulkInsertTextarea.focus();
+      return;
+    }
     if (!rowEditDialogState.isSaving) {
       rowEditDialogState.shouldRestoreFocus = true;
       dialog.close();
     }
   });
 
+  rowEditDialogState.bulkInsertLink.addEventListener("click", function (ev) {
+    ev.preventDefault();
+    showMultipleRowInsert(rowEditDialogState);
+  });
+
+  rowEditDialogState.singleInsertLink.addEventListener("click", function (ev) {
+    ev.preventDefault();
+    showSingleRowInsert(rowEditDialogState);
+  });
+
+  rowEditDialogState.copyTemplateButton.addEventListener(
+    "click",
+    async function () {
+      try {
+        await copyTextToClipboard(bulkInsertTemplateText(rowEditDialogState));
+        clearRowEditDialogError(rowEditDialogState);
+        setBulkInsertCopyButtonCopied(rowEditDialogState);
+      } catch (_error) {
+        showRowEditDialogError(
+          rowEditDialogState,
+          "Could not copy the spreadsheet template.",
+        );
+      }
+    },
+  );
+
+  rowEditDialogState.bulkInsertOpenFileButton.addEventListener(
+    "click",
+    function () {
+      rowEditDialogState.bulkInsertFileInput.click();
+    },
+  );
+
+  rowEditDialogState.bulkInsertFileInput.addEventListener(
+    "change",
+    async function (ev) {
+      var files = ev.target.files;
+      await loadBulkInsertTextFile(
+        rowEditDialogState,
+        files && files.length ? files[0] : null,
+      );
+      ev.target.value = "";
+    },
+  );
+
+  rowEditDialogState.bulkInsertTextarea.addEventListener(
+    "dragenter",
+    function (ev) {
+      ev.preventDefault();
+      rowEditDialogState.bulkInsertTextarea.classList.add(
+        "row-edit-bulk-drop-target",
+      );
+    },
+  );
+
+  rowEditDialogState.bulkInsertTextarea.addEventListener(
+    "dragover",
+    function (ev) {
+      ev.preventDefault();
+      rowEditDialogState.bulkInsertTextarea.classList.add(
+        "row-edit-bulk-drop-target",
+      );
+    },
+  );
+
+  rowEditDialogState.bulkInsertTextarea.addEventListener(
+    "dragleave",
+    function () {
+      rowEditDialogState.bulkInsertTextarea.classList.remove(
+        "row-edit-bulk-drop-target",
+      );
+    },
+  );
+
+  rowEditDialogState.bulkInsertTextarea.addEventListener(
+    "drop",
+    async function (ev) {
+      ev.preventDefault();
+      rowEditDialogState.bulkInsertTextarea.classList.remove(
+        "row-edit-bulk-drop-target",
+      );
+      var files = ev.dataTransfer && ev.dataTransfer.files;
+      if (!files || !files.length) {
+        return;
+      }
+      await loadBulkInsertTextFile(rowEditDialogState, files[0]);
+    },
+  );
+
+  rowEditDialogState.bulkInsertTextarea.addEventListener(
+    "dragend",
+    function () {
+      rowEditDialogState.bulkInsertTextarea.classList.remove(
+        "row-edit-bulk-drop-target",
+      );
+    },
+  );
+
+  rowEditDialogState.bulkInsertTextarea.addEventListener("input", function () {
+    resetBulkInsertPreview(rowEditDialogState);
+    syncBulkInsertTextareaValidation(rowEditDialogState);
+    updateRowEditDialogButtons(rowEditDialogState);
+  });
+
+  rowEditDialogState.bulkInsertConflictSelect.addEventListener(
+    "change",
+    function () {
+      rowEditDialogState.bulkInsertConflictMode =
+        rowEditDialogState.bulkInsertConflictSelect.value;
+      syncBulkInsertConflictUi(rowEditDialogState);
+      resetBulkInsertPreview(rowEditDialogState);
+      syncBulkInsertTextareaValidation(rowEditDialogState);
+      updateRowEditDialogButtons(rowEditDialogState);
+    },
+  );
+
   dialog.addEventListener("click", function (ev) {
     if (ev.target === dialog) {
       closeRowEditDialogIfConfirmed(rowEditDialogState);
@@ -1840,8 +7414,17 @@ function ensureRowEditDialog(manager) {
 
   dialog.addEventListener("close", function () {
     var state = rowEditDialogState;
+    var shouldReloadOnClose = state.shouldReloadOnClose;
+    var redirectOnCloseUrl = state.redirectOnCloseUrl;
     state.loadId += 1;
     state.isClosePending = false;
+    state.bulkInsertLiveValidationError = null;
+    state.shouldReloadOnClose = false;
+    state.redirectOnCloseUrl = null;
+    clearTimeout(state.copyTemplateResetTimer);
+    state.copyTemplateResetTimer = null;
+    setBulkInsertCopyButtonReady(state);
+    resetBulkInsertPreview(state);
     clearRowEditDialogError(state);
     state.hasLoaded = false;
     destroyRowEditFields(state);
@@ -1854,6 +7437,13 @@ function ensureRowEditDialog(manager) {
     ) {
       state.currentButton.focus();
     }
+    if (shouldReloadOnClose) {
+      if (redirectOnCloseUrl) {
+        location.href = redirectOnCloseUrl;
+      } else {
+        location.reload();
+      }
+    }
   });
 
   return rowEditDialogState;
@@ -1876,8 +7466,10 @@ async function openRowEditDialog(button, manager) {
   state.currentRowId = row.getAttribute("data-row") || "";
   state.currentPkPath = rowDisplayLabel(row);
   state.currentInsertUrl = null;
+  state.currentUpsertUrl = null;
   state.currentUpdateUrl = rowUpdateUrl(row);
   state.currentFragmentUrl = rowFragmentUrl(row);
+  state.insertMode = "single";
   if (state.currentUpdateUrl) {
     state.form.action = new URL(
       state.currentUpdateUrl,
@@ -1903,6 +7495,7 @@ async function openRowEditDialog(button, manager) {
   );
   state.summary.hidden = true;
   state.summary.textContent = "";
+  syncRowEditInsertModeUi(state);
 
   if (!state.dialog.open) {
     state.dialog.showModal();
@@ -1951,8 +7544,16 @@ function openRowInsertDialog(button, manager) {
   state.currentRowId = null;
   state.currentPkPath = null;
   state.currentInsertUrl = tableInsertUrl();
+  state.currentUpsertUrl = tableUpsertUrl();
   state.currentUpdateUrl = null;
   state.currentFragmentUrl = null;
+  state.insertMode = "single";
+  state.bulkInsertConflictMode = "ignore";
+  state.bulkInsertLiveValidationError = null;
+  state.bulkInsertTextarea.value = "";
+  state.shouldReloadOnClose = false;
+  state.redirectOnCloseUrl = null;
+  resetBulkInsertPreview(state);
   state.shouldRestoreFocus = true;
   state.hasLoaded = false;
   state.loadId += 1;
@@ -1970,14 +7571,10 @@ function openRowInsertDialog(button, manager) {
   setRowEditDialogLoading(state, false);
   destroyRowEditFields(state);
   state.dialog.removeAttribute("aria-describedby");
-  setRowDialogTitle(
-    state.title,
-    insertData.tableName
-      ? "Insert row into " + insertData.tableName
-      : "Insert row",
-  );
+  setRowInsertDialogTitle(state);
   state.summary.hidden = true;
   state.summary.textContent = "";
+  syncRowEditInsertModeUi(state);
 
   if (!state.dialog.open) {
     state.dialog.showModal();
@@ -2017,6 +7614,8 @@ document.addEventListener("datasette_init", function (evt) {
   const { detail: manager } = evt;
 
   registerBuiltinColumnFieldPlugins(manager);
+  initTableCreateActions(manager);
+  initTableAlterActions(manager);
   initRowInsertActions(manager);
   initRowEditActions(manager);
   initRowDeleteActions(manager);
diff --git a/datasette/static/table.js b/datasette/static/table.js
index f160f3f3..74a96d8e 100644
--- a/datasette/static/table.js
+++ b/datasette/static/table.js
@@ -633,32 +633,151 @@ const initDatasetteTable = function (manager) {
   });
 };
 
-/* Add x buttons to the filter rows */
-function addButtonsToFilterRows(manager) {
-  var x = "✖";
-  var rows = Array.from(
-    document.querySelectorAll(manager.selectors.filterRow),
+function filterRowSelector(manager) {
+  return manager.selectors.filterRows || manager.selectors.filterRow;
+}
+
+function filterRowsWithControls(manager) {
+  return Array.from(
+    document.querySelectorAll(filterRowSelector(manager)),
   ).filter((el) => el.querySelector(".filter-op"));
-  rows.forEach((row) => {
-    var a = document.createElement("a");
-    a.setAttribute("href", "#");
-    a.setAttribute("aria-label", "Remove this filter");
-    a.style.textDecoration = "none";
-    a.innerText = x;
-    a.addEventListener("click", (ev) => {
-      ev.preventDefault();
-      let row = ev.target.closest("div");
-      row.querySelector("select").value = "";
-      row.querySelector(".filter-op select").value = "exact";
-      row.querySelector("input.filter-value").value = "";
-      ev.target.closest("a").style.display = "none";
-    });
-    row.appendChild(a);
+}
+
+function filterRowNumberFromName(name) {
+  var match = name && name.match(/^_filter_column_(\d+)$/);
+  return match ? parseInt(match[1], 10) : 0;
+}
+
+function nextFilterRowNumber(manager) {
+  return filterRowsWithControls(manager).reduce((max, row) => {
     var column = row.querySelector("select");
-    if (!column.value) {
-      a.style.display = "none";
+    return Math.max(max, filterRowNumberFromName(column && column.name));
+  }, 0) + 1;
+}
+
+function setFilterRowNumber(row, number) {
+  row.querySelector("select").name = `_filter_column_${number}`;
+  row.querySelector(".filter-op select").name = `_filter_op_${number}`;
+  row.querySelector("input.filter-value").name = `_filter_value_${number}`;
+}
+
+function resetFilterRow(row) {
+  row.querySelector("select").value = "";
+  row.querySelector(".filter-op select").value = "exact";
+  row.querySelector("input.filter-value").value = "";
+}
+
+function updateFilterRowButtons(manager) {
+  var rows = filterRowsWithControls(manager);
+  rows.forEach((row, index) => {
+    var removeButton = row.querySelector(".filter-row-remove");
+    var addButton = row.querySelector(".filter-row-add");
+    var column = row.querySelector("select");
+    if (removeButton) {
+      removeButton.hidden = index === 0;
+    }
+    if (addButton) {
+      addButton.hidden = index !== rows.length - 1 || !column.value;
+    }
+    var visibleButtonCount = [removeButton, addButton].filter(function (button) {
+      return button && !button.hidden;
+    }).length;
+    row.classList.toggle(
+      "filter-controls-row-has-buttons",
+      visibleButtonCount > 0,
+    );
+    row.classList.toggle(
+      "filter-controls-row-one-button",
+      visibleButtonCount === 1,
+    );
+    row.classList.toggle(
+      "filter-controls-row-two-buttons",
+      visibleButtonCount === 2,
+    );
+  });
+}
+
+function cloneFilterRow(row) {
+  var clone = row.cloneNode(true);
+  clone.querySelector("select").name = "_filter_column";
+  clone.querySelector(".filter-op select").name = "_filter_op";
+  clone.querySelector("input.filter-value").name = "_filter_value";
+  resetFilterRow(clone);
+  clone.querySelectorAll(".filter-row-icon").forEach((button) => button.remove());
+  return clone;
+}
+
+var FILTER_REMOVE_ICON_SVG = `<svg class="filter-row-remove-icon" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.1" stroke-linecap="round" stroke-linejoin="round">
+  <path d="M3 6h18"></path>
+  <path d="M8 6V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"></path>
+  <path d="M19 6l-1 14a2 2 0 0 1-2 2H8a2 2 0 0 1-2-2L5 6"></path>
+  <path d="M10 11v6"></path>
+  <path d="M14 11v6"></path>
+</svg>`;
+
+var FILTER_ADD_ICON_SVG = `<svg class="filter-row-add-icon" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="3" stroke-linecap="round" stroke-linejoin="round">
+  <path d="M5 12h14"></path>
+  <path d="M12 5v14"></path>
+</svg>`;
+
+function addFilterRowButtons(row, manager) {
+  var removeButton = document.createElement("button");
+  removeButton.type = "button";
+  removeButton.className = "filter-row-icon filter-row-remove";
+  removeButton.setAttribute("aria-label", "Remove this filter");
+  removeButton.title = "Remove this filter";
+  removeButton.tabIndex = 0;
+  removeButton.innerHTML = FILTER_REMOVE_ICON_SVG;
+  removeButton.addEventListener("click", (ev) => {
+    var row = ev.currentTarget.closest(filterRowSelector(manager));
+    var rows = filterRowsWithControls(manager);
+    var rowIndex = rows.indexOf(row);
+    var focusRow = rows[rowIndex + 1] || rows[rowIndex - 1] || null;
+    row.remove();
+    updateFilterRowButtons(manager);
+    if (focusRow) {
+      var focusTarget =
+        focusRow.querySelector(".filter-row-add:not([hidden])") ||
+        focusRow.querySelector("select");
+      if (focusTarget) {
+        focusTarget.focus();
+      }
     }
   });
+  row.appendChild(removeButton);
+
+  var addButton = document.createElement("button");
+  addButton.type = "button";
+  addButton.className = "filter-row-icon filter-row-add";
+  addButton.setAttribute("aria-label", "Add another filter");
+  addButton.title = "Add another filter";
+  addButton.tabIndex = 0;
+  addButton.innerHTML = FILTER_ADD_ICON_SVG;
+  addButton.addEventListener("click", (ev) => {
+    var row = ev.currentTarget.closest(filterRowSelector(manager));
+    if (row.querySelector("select").name === "_filter_column") {
+      setFilterRowNumber(row, nextFilterRowNumber(manager));
+    }
+    var clone = cloneFilterRow(row);
+    addFilterRowButtons(clone, manager);
+    row.parentNode.insertBefore(clone, row.nextSibling);
+    updateFilterRowButtons(manager);
+    clone.querySelector("select").focus();
+  });
+  row.appendChild(addButton);
+
+  row.querySelector("select").addEventListener("change", () => {
+    updateFilterRowButtons(manager);
+  });
+}
+
+/* Add buttons to the filter rows */
+function addButtonsToFilterRows(manager) {
+  var rows = filterRowsWithControls(manager);
+  rows.forEach((row) => {
+    addFilterRowButtons(row, manager);
+  });
+  updateFilterRowButtons(manager);
 }
 
 /* Set up datalist autocomplete for filter values */
@@ -687,11 +806,11 @@ function initAutocompleteForFilterValues(manager) {
     });
   }
   createDataLists();
-  // When any select with name=_filter_column changes, update the datalist
+  // When any filter column select changes, update the datalist
   document.body.addEventListener("change", function (event) {
-    if (event.target.name === "_filter_column") {
+    if (event.target.name && event.target.name.startsWith("_filter_column")) {
       event.target
-        .closest(manager.selectors.filterRow)
+        .closest(filterRowSelector(manager))
         .querySelector(".filter-value")
         .setAttribute("list", "datalist-" + event.target.value);
     }
diff --git a/datasette/stored_queries.py b/datasette/stored_queries.py
index a6123daa..db3c6548 100644
--- a/datasette/stored_queries.py
+++ b/datasette/stored_queries.py
@@ -1,8 +1,9 @@
 from __future__ import annotations
 
-from dataclasses import dataclass
 import json
-from typing import Any, Iterable
+from collections.abc import Iterable
+from dataclasses import dataclass
+from typing import Any
 
 from .utils import tilde_encode, urlsafe_components
 
@@ -62,7 +63,6 @@ def stored_query_to_dict(query: StoredQuery) -> dict[str, Any]:
         "description_html": query.description_html,
         "hide_sql": query.hide_sql,
         "fragment": query.fragment,
-        "params": list(query.parameters),
         "parameters": list(query.parameters),
         "is_write": query.is_write,
         "is_private": query.is_private,
@@ -84,7 +84,6 @@ def stored_query_page_to_dict(page: StoredQueryPage) -> dict[str, Any]:
     return {
         "queries": [stored_query_to_dict(query) for query in page.queries],
         "next": page.next,
-        "has_more": page.has_more,
         "limit": page.limit,
     }
 
@@ -388,7 +387,7 @@ async def count_queries(
                 OR q.sql LIKE :query_search
             )
             """)
-        params["query_search"] = "%{}%".format(q)
+        params["query_search"] = f"%{q}%"
     if is_write is not None:
         where_clauses.append("q.is_write = :query_is_write")
         params["query_is_write"] = int(bool(is_write))
@@ -464,7 +463,7 @@ async def list_queries(
         except ValueError:
             components = []
         if database is None and len(components) == 3:
-            where_clauses.append("""
+            where_clauses.append(f"""
                 (
                     q.database_name > :cursor_database
                     OR (
@@ -478,12 +477,12 @@ async def list_queries(
                         )
                     )
                 )
-                """.format(sort_key_sql=sort_key_sql))
+                """)
             params["cursor_database"] = components[0]
             params["cursor_sort_key"] = components[1]
             params["cursor_name"] = components[2]
         elif database is not None and len(components) == 2:
-            where_clauses.append("""
+            where_clauses.append(f"""
                 (
                     {sort_key_sql} > :cursor_sort_key
                     OR (
@@ -491,7 +490,7 @@ async def list_queries(
                         AND q.name > :cursor_name
                     )
                 )
-                """.format(sort_key_sql=sort_key_sql))
+                """)
             params["cursor_sort_key"] = components[0]
             params["cursor_name"] = components[1]
 
@@ -504,7 +503,7 @@ async def list_queries(
                 OR q.sql LIKE :query_search
             )
             """)
-        params["query_search"] = "%{}%".format(q)
+        params["query_search"] = f"%{q}%"
     if is_write is not None:
         where_clauses.append("q.is_write = :query_is_write")
         params["query_is_write"] = int(bool(is_write))
diff --git a/datasette/template_contexts.py b/datasette/template_contexts.py
new file mode 100644
index 00000000..232eb051
--- /dev/null
+++ b/datasette/template_contexts.py
@@ -0,0 +1,40 @@
+"""
+Index of the documented template contexts for Datasette's core HTML pages.
+
+This module deliberately contains no documentation strings of its own -
+the documentation lives next to the code it describes:
+
+- Every page renders a Context dataclass defined in its view module
+  (DatabaseContext, QueryContext in views/database.py, TableContext in
+  views/table.py, RowContext in views/row.py). Fields added by view code
+  carry ``help`` metadata; fields declared with from_extra() take their
+  documentation from the description on the matching Extra class in
+  views/table_extras.py.
+- The keys render_template() adds to every page are documented in
+  TEMPLATE_BASE_CONTEXT in datasette/app.py, next to the code that adds
+  them.
+
+The contract tests in tests/test_template_context.py assert that the real
+rendered context for each page exactly matches what is documented, and
+docs/template_context_doc.py generates docs/template_context.rst from the
+same classes.
+"""
+
+from datasette.app import TEMPLATE_BASE_CONTEXT
+from datasette.views.database import DatabaseContext, QueryContext
+from datasette.views.row import RowContext
+from datasette.views.table import TableContext
+
+PAGES = {
+    "database": DatabaseContext,
+    "query": QueryContext,
+    "table": TableContext,
+    "row": RowContext,
+}
+
+
+def documented_context_keys(page_name):
+    "Set of every documented key for the named page, including base context keys"
+    return set(TEMPLATE_BASE_CONTEXT) | {
+        f.name for f in PAGES[page_name].documented_fields()
+    }
diff --git a/datasette/templates/_codemirror.html b/datasette/templates/_codemirror.html
index c4629aeb..75c16168 100644
--- a/datasette/templates/_codemirror.html
+++ b/datasette/templates/_codemirror.html
@@ -1,5 +1,5 @@
-<script src="{{ base_url }}-/static/sql-formatter-2.3.3.min.js" defer></script>
-<script src="{{ base_url }}-/static/cm-editor-6.0.1.bundle.js"></script>
+<script src="{{ static('sql-formatter-2.3.3.min.js') }}" defer></script>
+<script src="{{ static('cm-editor-6.0.1.bundle.js') }}"></script>
 <style>
   .cm-editor {
     resize: both;
diff --git a/datasette/templates/_permission_ui_styles.html b/datasette/templates/_permission_ui_styles.html
index 53a824f1..21a2ea8f 100644
--- a/datasette/templates/_permission_ui_styles.html
+++ b/datasette/templates/_permission_ui_styles.html
@@ -6,8 +6,20 @@
     padding: 1.5em;
     margin-bottom: 2em;
 }
+.permission-form form {
+    max-width: 60rem;
+}
+.permission-form-grid {
+    display: grid;
+    gap: 1.5rem;
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+}
+.permission-form-result {
+    margin-top: 1rem;
+    max-width: 60rem;
+}
 .form-section {
-    margin-bottom: 1em;
+    margin-bottom: 1.25em;
 }
 .form-section label {
     display: block;
@@ -15,22 +27,51 @@
     font-weight: bold;
 }
 .form-section input[type="text"],
-.form-section select {
-    width: 100%;
-    max-width: 500px;
-    padding: 0.5em;
+.form-section input[type="number"],
+.form-section select,
+.permission-textarea {
+    background-color: #fff;
+    border: 1px solid #aaa;
+    border-radius: 4px;
     box-sizing: border-box;
-    border: 1px solid #ccc;
-    border-radius: 3px;
+    box-shadow: inset 0 1px 2px rgba(0, 0, 0, 0.08);
+    color: #222;
+    font-family: inherit;
+    font-size: 1rem;
+    line-height: 1.4;
+    max-width: none;
+    width: 100%;
+}
+.form-section input[type="text"] {
+    height: 3rem;
+    padding: 0.6rem 0.75rem;
+}
+.form-section input[type="number"] {
+    height: 3rem;
+    max-width: 7rem;
+    padding: 0.6rem 0.75rem;
+}
+.form-section select {
+    height: 3rem;
+    padding: 0.6rem 0.75rem;
+}
+.permission-textarea {
+    font-family: monospace;
+    min-height: 12rem;
+    padding: 0.75rem;
+    resize: vertical;
 }
 .form-section input[type="text"]:focus,
-.form-section select:focus {
-    outline: 2px solid #0066cc;
+.form-section input[type="number"]:focus,
+.form-section select:focus,
+.permission-textarea:focus {
     border-color: #0066cc;
+    box-shadow: 0 0 0 3px rgba(0, 102, 204, 0.18);
+    outline: none;
 }
 .form-section small {
     display: block;
-    margin-top: 0.3em;
+    margin-top: 0.45em;
     color: #666;
 }
 .form-actions {
@@ -142,4 +183,9 @@
     text-align: center;
     color: #666;
 }
+@media only screen and (max-width: 576px) {
+    .permission-form-grid {
+        grid-template-columns: minmax(0, 1fr);
+    }
+}
 </style>
diff --git a/datasette/templates/_permissions_debug_tabs.html b/datasette/templates/_permissions_debug_tabs.html
index d7203c1e..8e0f486e 100644
--- a/datasette/templates/_permissions_debug_tabs.html
+++ b/datasette/templates/_permissions_debug_tabs.html
@@ -44,10 +44,10 @@
 </style>
 
 <nav class="permissions-debug-tabs">
-    <a href="{{ urls.path('-/permissions') }}" {% if current_tab == "permissions" %}class="active"{% endif %}>Playground</a>
-    <a href="{{ urls.path('-/check') }}{{ query_string }}" {% if current_tab == "check" %}class="active"{% endif %}>Check</a>
-    <a href="{{ urls.path('-/allowed') }}{{ query_string }}" {% if current_tab == "allowed" %}class="active"{% endif %}>Allowed</a>
-    <a href="{{ urls.path('-/rules') }}{{ query_string }}" {% if current_tab == "rules" %}class="active"{% endif %}>Rules</a>
+    <a href="{{ urls.path('-/check') }}{{ query_string }}" {% if current_tab == "check" %}class="active"{% endif %}>Explain</a>
+    <a href="{{ urls.path('-/allowed') }}{{ query_string }}" {% if current_tab == "allowed" %}class="active"{% endif %}>Access map</a>
+    <a href="{{ urls.path('-/rules') }}{{ query_string }}" {% if current_tab == "rules" %}class="active"{% endif %}>Rule explorer</a>
+    <a href="{{ urls.path('-/permissions') }}" {% if current_tab == "permissions" %}class="active"{% endif %}>Activity</a>
     <a href="{{ urls.path('-/actions') }}" {% if current_tab == "actions" %}class="active"{% endif %}>Actions</a>
     <a href="{{ urls.path('-/allow-debug') }}" {% if current_tab == "allow_debug" %}class="active"{% endif %}>Allow debug</a>
 </nav>
diff --git a/datasette/templates/allow_debug.html b/datasette/templates/allow_debug.html
index 1ecc92df..fda4032c 100644
--- a/datasette/templates/allow_debug.html
+++ b/datasette/templates/allow_debug.html
@@ -3,29 +3,11 @@
 {% block title %}Debug allow rules{% endblock %}
 
 {% block extra_head %}
+{% include "_permission_ui_styles.html" %}
 <style>
-textarea {
-    height: 10em;
-    width: 95%;
-    box-sizing: border-box;
-    padding: 0.5em;
-    border: 2px dotted black;
-}
-.two-col {
-    display: inline-block;
-    width: 48%;
-}
-.two-col label {
-    width: 48%;
-}
 p.message-warning {
     white-space: pre-wrap;
 }
-@media only screen and (max-width: 576px) {
-    .two-col {
-        width: 100%;
-    }
-}
 </style>
 {% endblock %}
 
@@ -38,24 +20,28 @@ p.message-warning {
 
 <p>Use this tool to try out different actor and allow combinations. See <a href="https://docs.datasette.io/en/stable/authentication.html#defining-permissions-with-allow-blocks">Defining permissions with "allow" blocks</a> for documentation.</p>
 
-<form class="core" action="{{ urls.path('-/allow-debug') }}" method="get" style="margin-bottom: 1em">
-    <div class="two-col">
-        <p><label>Allow block</label></p>
-        <textarea name="allow">{{ allow_input }}</textarea>
-    </div>
-    <div class="two-col">
-        <p><label>Actor</label></p>
-        <textarea name="actor">{{ actor_input }}</textarea>
-    </div>
-    <div style="margin-top: 1em;">
-        <input type="submit" value="Apply allow block to actor">
-    </div>
-</form>
+<div class="permission-form">
+    <form class="core" action="{{ urls.path('-/allow-debug') }}" method="get">
+        <div class="permission-form-grid">
+            <div class="form-section">
+                <label for="allow-block">Allow block</label>
+                <textarea class="permission-textarea" id="allow-block" name="allow">{{ allow_input }}</textarea>
+            </div>
+            <div class="form-section">
+                <label for="allow-actor">Actor</label>
+                <textarea class="permission-textarea" id="allow-actor" name="actor">{{ actor_input }}</textarea>
+            </div>
+        </div>
+        <div class="form-actions">
+            <button type="submit" class="submit-btn">Apply allow block to actor</button>
+        </div>
+    </form>
 
-{% if error %}<p class="message-warning">{{ error }}</p>{% endif %}
+    {% if error %}<p class="message-warning permission-form-result">{{ error }}</p>{% endif %}
 
-{% if result == "True" %}<p class="message-info">Result: allow</p>{% endif %}
+    {% if result == "True" %}<p class="message-info permission-form-result">Result: allow</p>{% endif %}
 
-{% if result == "False" %}<p class="message-error">Result: deny</p>{% endif %}
+    {% if result == "False" %}<p class="message-error permission-form-result">Result: deny</p>{% endif %}
+</div>
 
 {% endblock %}
diff --git a/datasette/templates/api_explorer.html b/datasette/templates/api_explorer.html
index 58e2a88c..4927cb8d 100644
--- a/datasette/templates/api_explorer.html
+++ b/datasette/templates/api_explorer.html
@@ -3,7 +3,7 @@
 {% block title %}API Explorer{% endblock %}
 
 {% block extra_head %}
-<script src="{{ base_url }}-/static/json-format-highlight-1.0.1.js"></script>
+<script src="{{ static('json-format-highlight-1.0.1.js') }}"></script>
 {% endblock %}
 
 {% block content %}
diff --git a/datasette/templates/base.html b/datasette/templates/base.html
index 82ab48dd..18288439 100644
--- a/datasette/templates/base.html
+++ b/datasette/templates/base.html
@@ -2,13 +2,13 @@
 <html lang="en">
 <head>
     <title>{% block title %}{% endblock %}</title>
-    <link rel="stylesheet" href="{{ urls.static('app.css') }}?{{ app_css_hash }}">
+    <link rel="stylesheet" href="{{ static('app.css') }}">
     <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
 {% for url in extra_css_urls %}
     <link rel="stylesheet" href="{{ url.url }}"{% if url.get("sri") %} integrity="{{ url.sri }}" crossorigin="anonymous"{% endif %}>
 {% endfor %}
 <script>window.datasetteVersion = '{{ datasette_version }}';</script>
-<script src="{{ urls.static('datasette-manager.js') }}" defer></script>
+<script src="{{ static('datasette-manager.js') }}" defer></script>
 {% for url in extra_js_urls %}
     <script {% if url.module %}type="module" {% endif %}src="{{ url.url }}"{% if url.get("sri") %} integrity="{{ url.sri }}" crossorigin="anonymous"{% endif %}></script>
 {% endfor %}
@@ -70,7 +70,7 @@
 {% endfor %}
 
 {% if select_templates %}<!-- Templates considered: {{ select_templates|join(", ") }} -->{% endif %}
-<script src="{{ urls.static('navigation-search.js') }}" defer></script>
+<script src="{{ static('navigation-search.js') }}" defer></script>
 <navigation-search url="{{ urls.path("/-/jump") }}"></navigation-search>
 </body>
 </html>
diff --git a/datasette/templates/database.html b/datasette/templates/database.html
index 371f6a22..a9fad8dd 100644
--- a/datasette/templates/database.html
+++ b/datasette/templates/database.html
@@ -6,6 +6,10 @@
 {{- super() -}}
 {% include "_codemirror.html" %}
 {% include "_sql_parameter_styles.html" %}
+{% if database_page_data.createTable %}
+<script>window._datasetteDatabaseData = {{ database_page_data|tojson }};</script>
+<script src="{{ static('edit-tools.js') }}" defer></script>
+{% endif %}
 {% endblock %}
 
 {% block body_class %}db db-{{ database|to_css_class }}{% endblock %}
@@ -72,7 +76,7 @@
 <div class="db-table">
     <h3><a href="{{ urls.table(database, table.name) }}">{{ table.name }}</a>{% if table.private %} 🔒{% endif %}{% if table.hidden %}<em> (hidden)</em>{% endif %}</h3>
     <p><em>{% for column in table.columns %}{{ column }}{% if not loop.last %}, {% endif %}{% endfor %}</em></p>
-    <p>{% if table.count is none %}Many rows{% elif table.count == count_limit + 1 %}&gt;{{ "{:,}".format(count_limit) }} rows{% else %}{{ "{:,}".format(table.count) }} row{% if table.count == 1 %}{% else %}s{% endif %}{% endif %}</p>
+    <p>{% if table.count is none %}Many rows{% elif table.count_truncated %}&gt;{{ "{:,}".format(table.count - 1) }} rows{% else %}{{ "{:,}".format(table.count) }} row{% if table.count == 1 %}{% else %}s{% endif %}{% endif %}</p>
 </div>
 {% endif %}
 {% endfor %}
diff --git a/datasette/templates/debug_actions.html b/datasette/templates/debug_actions.html
index 0ef7b329..c9dccaaa 100644
--- a/datasette/templates/debug_actions.html
+++ b/datasette/templates/debug_actions.html
@@ -9,7 +9,7 @@
 {% include "_permissions_debug_tabs.html" %}
 
 <p style="margin-bottom: 2em;">
-  This Datasette instance has registered {{ data|length }} action{{ data|length != 1 and "s" or "" }}.
+  This Datasette instance has registered {{ data.actions|length }} action{{ data.actions|length != 1 and "s" or "" }}.
   Actions are used by the permission system to control access to different features.
 </p>
 
@@ -26,7 +26,7 @@
     </tr>
   </thead>
   <tbody>
-    {% for action in data %}
+    {% for action in data.actions %}
     <tr>
       <td><strong>{{ action.name }}</strong></td>
       <td>{% if action.abbr %}<code>{{ action.abbr }}</code>{% endif %}</td>
diff --git a/datasette/templates/debug_allowed.html b/datasette/templates/debug_allowed.html
index add3154a..80249d9c 100644
--- a/datasette/templates/debug_allowed.html
+++ b/datasette/templates/debug_allowed.html
@@ -3,7 +3,7 @@
 {% block title %}Allowed Resources{% endblock %}
 
 {% block extra_head %}
-<script src="{{ base_url }}-/static/json-format-highlight-1.0.1.js"></script>
+<script src="{{ static('json-format-highlight-1.0.1.js') }}"></script>
 {% include "_permission_ui_styles.html" %}
 {% include "_debug_common_functions.html" %}
 {% endblock %}
@@ -49,7 +49,7 @@
 
         <div class="form-section">
             <label for="page_size">Page size:</label>
-            <input type="number" id="page_size" name="page_size" value="50" min="1" max="200" style="max-width: 100px;">
+            <input type="number" id="page_size" name="_size" value="50" min="1" max="200">
             <small>Number of results per page (max 200)</small>
         </div>
 
@@ -88,7 +88,7 @@ const hasDebugPermission = {{ 'true' if has_debug_permission else 'false' }};
 (function() {
     const params = populateFormFromURL();
     const action = params.get('action');
-    const page = params.get('page');
+    const page = params.get('_page');
     if (action) {
         fetchResults(page ? parseInt(page) : 1);
     }
@@ -102,14 +102,14 @@ async function fetchResults(page = 1) {
     const params = new URLSearchParams();
 
     for (const [key, value] of formData.entries()) {
-        if (value && key !== 'page_size') {
+        if (value && key !== '_size' && key !== '_page') {
             params.append(key, value);
         }
     }
 
     const pageSize = document.getElementById('page_size').value || '50';
-    params.append('page', page.toString());
-    params.append('page_size', pageSize);
+    params.append('_page', page.toString());
+    params.append('_size', pageSize);
 
     try {
         const response = await fetch('{{ urls.path("-/allowed.json") }}?' + params.toString(), {
diff --git a/datasette/templates/debug_autocomplete.html b/datasette/templates/debug_autocomplete.html
index 84dbc14f..380639a3 100644
--- a/datasette/templates/debug_autocomplete.html
+++ b/datasette/templates/debug_autocomplete.html
@@ -4,7 +4,7 @@
 
 {% block extra_head %}
 {{ super() }}
-<script src="{{ urls.static('autocomplete.js') }}" defer></script>
+<script src="{{ static('autocomplete.js') }}" defer></script>
 {% endblock %}
 
 {% block content %}
diff --git a/datasette/templates/debug_check.html b/datasette/templates/debug_check.html
index c2e7997f..b9fc636a 100644
--- a/datasette/templates/debug_check.html
+++ b/datasette/templates/debug_check.html
@@ -1,9 +1,9 @@
 {% extends "base.html" %}
 
-{% block title %}Permission Check{% endblock %}
+{% block title %}Explain a permission decision{% endblock %}
 
 {% block extra_head %}
-<script src="{{ base_url }}-/static/json-format-highlight-1.0.1.js"></script>
+<script src="{{ static('json-format-highlight-1.0.1.js') }}"></script>
 {% include "_permission_ui_styles.html" %}
 {% include "_debug_common_functions.html" %}
 <style>
@@ -13,29 +13,35 @@
     border-radius: 5px;
 }
 #output.allowed {
-    background-color: #e8f5e9;
+    background-color: #f3fbf4;
     border: 2px solid #4caf50;
 }
 #output.denied {
-    background-color: #ffebee;
+    background-color: #fff7f7;
     border: 2px solid #f44336;
 }
 #output h2 {
     margin-top: 0;
 }
-#output .result-badge {
+#output h3 {
+    margin-bottom: 0.5em;
+}
+#output .result-badge,
+.effect-badge,
+.rule-status {
     display: inline-block;
-    padding: 0.3em 0.8em;
+    padding: 0.2em 0.5em;
     border-radius: 3px;
     font-weight: bold;
-    font-size: 1.1em;
 }
-#output .allowed-badge {
-    background-color: #4caf50;
+#output .allowed-badge,
+.effect-allow {
+    background-color: #2e7d32;
     color: white;
 }
-#output .denied-badge {
-    background-color: #f44336;
+#output .denied-badge,
+.effect-deny {
+    background-color: #c62828;
     color: white;
 }
 .details-section {
@@ -48,70 +54,130 @@
 .details-section dd {
     margin-left: 1em;
 }
+.explanation-section {
+    background: rgba(255, 255, 255, 0.75);
+    border: 1px solid #ddd;
+    border-radius: 4px;
+    margin-top: 1em;
+    padding: 0 1em 1em;
+}
+.rules-table {
+    border-collapse: collapse;
+    width: 100%;
+}
+.rules-table th,
+.rules-table td {
+    border-bottom: 1px solid #ddd;
+    padding: 0.5em;
+    text-align: left;
+    vertical-align: top;
+}
+.rule-status {
+    background: #e8f5e9;
+    color: #1b5e20;
+}
+.rule-ignored {
+    background: #eee;
+    color: #555;
+    font-weight: normal;
+}
+.requirement-allowed {
+    color: #1b5e20;
+}
+.requirement-denied {
+    color: #b71c1c;
+}
+@media only screen and (max-width: 576px) {
+    .rules-table,
+    .rules-table tbody,
+    .rules-table tr,
+    .rules-table td {
+        display: block;
+    }
+    .rules-table thead {
+        display: none;
+    }
+    .rules-table td::before {
+        content: attr(data-label) ": ";
+        font-weight: bold;
+    }
+}
 </style>
 {% endblock %}
 
 {% block content %}
-<h1>Permission check</h1>
+<h1>Explain a permission decision</h1>
 
 {% set current_tab = "check" %}
 {% include "_permissions_debug_tabs.html" %}
 
-<p>Use this tool to test permission checks for the current actor. It queries the <code>/-/check.json</code> API endpoint.</p>
-
-{% if request.actor %}
-<p>Current actor: <strong>{{ request.actor.get("id", "anonymous") }}</strong></p>
-{% else %}
-<p>Current actor: <strong>anonymous (not logged in)</strong></p>
-{% endif %}
+<p>Test an actor, action and resource. The result explains which rules matched, which specificity level won, and whether actor restrictions or required actions changed the verdict.</p>
 
 <div class="permission-form">
-    <form id="check-form" method="get" action="{{ urls.path("-/check") }}">
+    <form id="check-form" method="get" action="{{ urls.path('-/check') }}">
         <div class="form-section">
-            <label for="action">Action (permission name):</label>
+            <label for="actor">Actor JSON:</label>
+            <textarea class="permission-textarea" id="actor" name="actor">{{ actor_json }}</textarea>
+            <small>Use <code>null</code> for an anonymous actor. This actor is simulated; it does not change who you are signed in as.</small>
+        </div>
+
+        <div class="form-section">
+            <label for="action">Action:</label>
             <select id="action" name="action" required>
                 <option value="">Select an action...</option>
-                {% for action_name in sorted_actions %}
-                <option value="{{ action_name }}">{{ action_name }}</option>
+                {% for action in actions %}
+                <option value="{{ action.name }}">{{ action.name }}{% if action.description %} — {{ action.description }}{% endif %}</option>
                 {% endfor %}
             </select>
-            <small>The permission action to check</small>
+            <small id="action-help">The operation to evaluate</small>
         </div>
 
-        <div class="form-section">
-            <label for="parent">Parent resource (optional):</label>
+        <div class="form-section" id="parent-section">
+            <label for="parent">Parent resource:</label>
             <input type="text" id="parent" name="parent" placeholder="e.g., database name">
-            <small>For database-level permissions, specify the database name</small>
+            <small>The database or other parent resource</small>
         </div>
 
-        <div class="form-section">
-            <label for="child">Child resource (optional):</label>
-            <input type="text" id="child" name="child" placeholder="e.g., table name">
-            <small>For table-level permissions, specify the table name (requires parent)</small>
+        <div class="form-section" id="child-section">
+            <label for="child">Child resource:</label>
+            <input type="text" id="child" name="child" placeholder="e.g., table or query name">
+            <small>The table, query or other child resource</small>
         </div>
 
         <div class="form-actions">
-            <button type="submit" class="submit-btn" id="submit-btn">Check Permission</button>
+            <button type="submit" class="submit-btn" id="submit-btn">Explain decision</button>
         </div>
     </form>
 </div>
 
 <div id="output" style="display: none;">
     <h2>Result: <span class="result-badge" id="result-badge"></span></h2>
+    <p id="result-summary"></p>
 
     <dl class="details-section">
+        <dt>Actor:</dt>
+        <dd><code id="result-actor"></code></dd>
         <dt>Action:</dt>
-        <dd id="result-action"></dd>
-
-        <dt>Resource Path:</dt>
-        <dd id="result-resource"></dd>
-
-        <dt>Actor ID:</dt>
-        <dd id="result-actor"></dd>
-
-        <div id="additional-details"></div>
+        <dd><code id="result-action"></code></dd>
+        <dt>Resource:</dt>
+        <dd><code id="result-resource"></code></dd>
     </dl>
 
+    <section class="explanation-section">
+        <h3>Matching rules</h3>
+        <div id="matching-rules"></div>
+    </section>
+
+    <section class="explanation-section" id="restrictions-section">
+        <h3>Actor restrictions</h3>
+        <div id="restriction-results"></div>
+    </section>
+
+    <section class="explanation-section" id="requirements-section">
+        <h3>Required actions</h3>
+        <div id="requirement-results"></div>
+    </section>
+
     <details style="margin-top: 1em;">
         <summary style="cursor: pointer; font-weight: bold;">Raw JSON response</summary>
         <pre id="raw-json" style="margin-top: 1em; padding: 1em; background-color: #f5f5f5; border: 1px solid #ddd; border-radius: 3px; overflow-x: auto;"></pre>
@@ -119,152 +185,134 @@
 </div>
 
 <script>
+const actions = Object.fromEntries({{ actions|tojson }}.map(action => [action.name, action]));
 const form = document.getElementById('check-form');
 const output = document.getElementById('output');
 const submitBtn = document.getElementById('submit-btn');
+const actionSelect = document.getElementById('action');
+
+function updateResourceFields() {
+    const action = actions[actionSelect.value];
+    document.getElementById('parent-section').style.display = action && action.takes_parent ? 'block' : 'none';
+    document.getElementById('child-section').style.display = action && action.takes_child ? 'block' : 'none';
+    let help = action && action.description ? action.description : 'The operation to evaluate';
+    if (action && action.also_requires) {
+        help += `; also requires ${action.also_requires}`;
+    }
+    document.getElementById('action-help').textContent = help;
+}
 
 async function performCheck() {
     submitBtn.disabled = true;
-    submitBtn.textContent = 'Checking...';
-
-    const formData = new FormData(form);
-    const params = new URLSearchParams();
-
-    for (const [key, value] of formData.entries()) {
-        if (value) {
-            params.append(key, value);
-        }
-    }
+    submitBtn.textContent = 'Explaining...';
+    const params = new URLSearchParams(new FormData(form));
 
     try {
         const response = await fetch('{{ urls.path("-/check.json") }}?' + params.toString(), {
-            method: 'GET',
-            headers: {
-                'Accept': 'application/json',
-            }
+            headers: {'Accept': 'application/json'}
         });
-
         const data = await response.json();
-
         if (response.ok) {
             displayResult(data);
         } else {
             displayError(data);
         }
     } catch (error) {
-        alert('Error: ' + error.message);
+        displayError({error: error.message});
     } finally {
         submitBtn.disabled = false;
-        submitBtn.textContent = 'Check Permission';
+        submitBtn.textContent = 'Explain decision';
     }
 }
 
-// Populate form on initial load
-(function() {
-    const params = populateFormFromURL();
-    const action = params.get('action');
-    if (action) {
-        performCheck();
-    }
-})();
-
 function displayResult(data) {
     output.style.display = 'block';
-
-    // Set badge and styling
     const resultBadge = document.getElementById('result-badge');
-    if (data.allowed) {
-        output.className = 'allowed';
-        resultBadge.className = 'result-badge allowed-badge';
-        resultBadge.textContent = 'ALLOWED ✓';
-    } else {
-        output.className = 'denied';
-        resultBadge.className = 'result-badge denied-badge';
-        resultBadge.textContent = 'DENIED ✗';
-    }
-
-    // Basic details
-    document.getElementById('result-action').textContent = data.action || 'N/A';
-    document.getElementById('result-resource').textContent = data.resource?.path || '/';
-    document.getElementById('result-actor').textContent = data.actor_id || 'anonymous';
-
-    // Additional details
-    const additionalDetails = document.getElementById('additional-details');
-    additionalDetails.innerHTML = '';
-
-    if (data.reason !== undefined) {
-        const dt = document.createElement('dt');
-        dt.textContent = 'Reason:';
-        const dd = document.createElement('dd');
-        dd.textContent = data.reason || 'N/A';
-        additionalDetails.appendChild(dt);
-        additionalDetails.appendChild(dd);
-    }
-
-    if (data.source_plugin !== undefined) {
-        const dt = document.createElement('dt');
-        dt.textContent = 'Source Plugin:';
-        const dd = document.createElement('dd');
-        dd.textContent = data.source_plugin || 'N/A';
-        additionalDetails.appendChild(dt);
-        additionalDetails.appendChild(dd);
-    }
-
-    if (data.used_default !== undefined) {
-        const dt = document.createElement('dt');
-        dt.textContent = 'Used Default:';
-        const dd = document.createElement('dd');
-        dd.textContent = data.used_default ? 'Yes' : 'No';
-        additionalDetails.appendChild(dt);
-        additionalDetails.appendChild(dd);
-    }
-
-    if (data.depth !== undefined) {
-        const dt = document.createElement('dt');
-        dt.textContent = 'Depth:';
-        const dd = document.createElement('dd');
-        dd.textContent = data.depth;
-        additionalDetails.appendChild(dt);
-        additionalDetails.appendChild(dd);
-    }
-
-    // Raw JSON
+    output.className = data.allowed ? 'allowed' : 'denied';
+    resultBadge.className = `result-badge ${data.allowed ? 'allowed-badge' : 'denied-badge'}`;
+    resultBadge.textContent = data.allowed ? 'ALLOWED ✓' : 'DENIED ✗';
+    document.getElementById('result-summary').textContent = data.explanation.summary;
+    document.getElementById('result-actor').textContent = data.actor === null ? 'anonymous' : JSON.stringify(data.actor);
+    document.getElementById('result-action').textContent = data.action;
+    document.getElementById('result-resource').textContent = data.resource.path;
+    displayRules(data.explanation);
+    displayRestrictions(data.explanation.restrictions);
+    displayRequirements(data.explanation.required_actions);
     document.getElementById('raw-json').innerHTML = jsonFormatHighlight(data);
+}
 
-    // Scroll to output
-    output.scrollIntoView({ behavior: 'smooth', block: 'nearest' });
+function displayRules(explanation) {
+    const container = document.getElementById('matching-rules');
+    if (!explanation.matched_rules.length) {
+        container.innerHTML = '<p>No rules matched. Datasette denies access when there is no matching rule.</p>';
+        return;
+    }
+    let html = '<table class="rules-table"><thead><tr><th>Effect</th><th>Scope</th><th>Source</th><th>Reason</th><th>Role in decision</th></tr></thead><tbody>';
+    for (const rule of explanation.matched_rules) {
+        const status = rule.decisive
+            ? '<span class="rule-status">Decisive</span>'
+            : `<span class="rule-status rule-ignored">${escapeHtml(rule.ignored_because)}</span>`;
+        html += '<tr>';
+        html += `<td data-label="Effect"><span class="effect-badge effect-${rule.effect}">${rule.effect.toUpperCase()}</span></td>`;
+        html += `<td data-label="Scope">${escapeHtml(rule.scope)}</td>`;
+        html += `<td data-label="Source"><code>${escapeHtml(rule.source || 'unknown')}</code></td>`;
+        html += `<td data-label="Reason">${escapeHtml(rule.reason || 'No reason supplied')}</td>`;
+        html += `<td data-label="Role in decision">${status}</td>`;
+        html += '</tr>';
+    }
+    container.innerHTML = html + '</tbody></table>';
+}
+
+function displayRestrictions(restrictions) {
+    const section = document.getElementById('restrictions-section');
+    const container = document.getElementById('restriction-results');
+    section.style.display = restrictions.length ? 'block' : 'none';
+    container.innerHTML = restrictions.map(restriction => {
+        const className = restriction.allowed ? 'requirement-allowed' : 'requirement-denied';
+        const verdict = restriction.allowed ? 'INCLUDED ✓' : 'EXCLUDED ✗';
+        return `<p class="${className}"><strong>${verdict}</strong> by <code>${escapeHtml(restriction.source || 'unknown')}</code>: ${escapeHtml(restriction.reason)}</p>`;
+    }).join('');
+}
+
+function displayRequirements(requirements) {
+    const section = document.getElementById('requirements-section');
+    const container = document.getElementById('requirement-results');
+    section.style.display = requirements.length ? 'block' : 'none';
+    container.innerHTML = requirements.map(requirement => {
+        const className = requirement.allowed ? 'requirement-allowed' : 'requirement-denied';
+        const verdict = requirement.allowed ? 'ALLOWED ✓' : 'DENIED ✗';
+        return `<p class="${className}"><strong>${escapeHtml(requirement.action)}: ${verdict}</strong> — ${escapeHtml(requirement.summary)}</p>`;
+    }).join('');
 }
 
 function displayError(data) {
     output.style.display = 'block';
     output.className = 'denied';
-
     const resultBadge = document.getElementById('result-badge');
     resultBadge.className = 'result-badge denied-badge';
     resultBadge.textContent = 'ERROR';
-
-    document.getElementById('result-action').textContent = 'N/A';
-    document.getElementById('result-resource').textContent = 'N/A';
-    document.getElementById('result-actor').textContent = 'N/A';
-
-    const additionalDetails = document.getElementById('additional-details');
-    additionalDetails.innerHTML = '<dt>Error:</dt><dd>' + (data.error || 'Unknown error') + '</dd>';
-
+    document.getElementById('result-summary').textContent = data.error || 'Unknown error';
+    document.getElementById('result-actor').textContent = '—';
+    document.getElementById('result-action').textContent = '—';
+    document.getElementById('result-resource').textContent = '—';
+    document.getElementById('matching-rules').innerHTML = '';
+    document.getElementById('restrictions-section').style.display = 'none';
+    document.getElementById('requirements-section').style.display = 'none';
     document.getElementById('raw-json').innerHTML = jsonFormatHighlight(data);
-
-    output.scrollIntoView({ behavior: 'smooth', block: 'nearest' });
 }
 
-// Disable child input if parent is empty
-const parentInput = document.getElementById('parent');
-const childInput = document.getElementById('child');
-
-childInput.addEventListener('focus', () => {
-    if (!parentInput.value) {
-        alert('Please specify a parent resource first before adding a child resource.');
-        parentInput.focus();
-    }
+form.addEventListener('submit', event => {
+    event.preventDefault();
+    performCheck();
 });
-</script>
+actionSelect.addEventListener('change', updateResourceFields);
 
+(function initializeFromUrl() {
+    const params = populateFormFromURL();
+    updateResourceFields();
+    if (params.get('action')) {
+        performCheck();
+    }
+})();
+</script>
 {% endblock %}
diff --git a/datasette/templates/debug_permissions_playground.html b/datasette/templates/debug_permissions_playground.html
index 4410a677..8b0cbbcf 100644
--- a/datasette/templates/debug_permissions_playground.html
+++ b/datasette/templates/debug_permissions_playground.html
@@ -1,6 +1,6 @@
 {% extends "base.html" %}
 
-{% block title %}Debug permissions{% endblock %}
+{% block title %}Permission activity{% endblock %}
 
 {% block extra_head %}
 {% include "_permission_ui_styles.html" %}
@@ -20,60 +20,45 @@
 .check-action, .check-when, .check-result {
     font-size: 1.3em;
 }
-textarea {
-    height: 10em;
-    width: 95%;
-    box-sizing: border-box;
-    padding: 0.5em;
-    border: 2px dotted black;
-}
-.two-col {
-    display: inline-block;
-    width: 48%;
-}
-.two-col label {
-    width: 48%;
-}
-@media only screen and (max-width: 576px) {
-    .two-col {
-        width: 100%;
-    }
-}
 </style>
 {% endblock %}
 
 {% block content %}
-<h1>Permission playground</h1>
+<h1>Permission activity</h1>
 
 {% set current_tab = "permissions" %}
 {% include "_permissions_debug_tabs.html" %}
 
-<p>This tool lets you simulate an actor and a permission check for that actor.</p>
+<h2>Raw simulator</h2>
+
+<p>This form runs a hypothetical permission check and returns its raw explanation JSON. Use the <a href="{{ urls.path('-/check') }}">Explain tool</a> for a visual explanation of the same decision.</p>
 
 <div class="permission-form">
     <form action="{{ urls.path('-/permissions') }}" id="debug-post" method="post">
-        <div class="two-col">
-            <div class="form-section">
-                <label>Actor</label>
-                <textarea name="actor">{% if actor_input %}{{ actor_input }}{% else %}{"id": "root"}{% endif %}</textarea>
+        <div class="permission-form-grid">
+            <div>
+                <div class="form-section">
+                    <label for="activity-actor">Actor</label>
+                    <textarea class="permission-textarea" id="activity-actor" name="actor">{% if actor_input %}{{ actor_input }}{% else %}{"id": "root"}{% endif %}</textarea>
+                </div>
             </div>
-        </div>
-        <div class="two-col" style="vertical-align: top">
-            <div class="form-section">
-                <label for="permission">Action</label>
-                <select name="permission" id="permission">
-                    {% for permission in permissions %}
-                        <option value="{{ permission.name }}">{{ permission.name }}</option>
-                    {% endfor %}
-                </select>
-            </div>
-            <div class="form-section">
-                <label for="resource_1">Parent</label>
-                <input type="text" id="resource_1" name="resource_1" placeholder="e.g., database name">
-            </div>
-            <div class="form-section">
-                <label for="resource_2">Child</label>
-                <input type="text" id="resource_2" name="resource_2" placeholder="e.g., table name">
+            <div>
+                <div class="form-section">
+                    <label for="permission">Action</label>
+                    <select name="permission" id="permission">
+                        {% for permission in permissions %}
+                            <option value="{{ permission.name }}">{{ permission.name }}</option>
+                        {% endfor %}
+                    </select>
+                </div>
+                <div class="form-section">
+                    <label for="resource_1">Parent</label>
+                    <input type="text" id="resource_1" name="resource_1" placeholder="e.g., database name">
+                </div>
+                <div class="form-section">
+                    <label for="resource_2">Child</label>
+                    <input type="text" id="resource_2" name="resource_2" placeholder="e.g., table name">
+                </div>
             </div>
         </div>
         <div class="form-actions">
@@ -125,7 +110,7 @@ debugPost.addEventListener('submit', function(ev) {
 });
 </script>
 
-<h1>Recent permissions checks</h1>
+<h2>Recent permission checks</h2>
 
 <p>
     {% if filter != "all" %}<a href="?filter=all">All</a>{% else %}<strong>All</strong>{% endif %},
diff --git a/datasette/templates/debug_rules.html b/datasette/templates/debug_rules.html
index 9a290803..233c0e94 100644
--- a/datasette/templates/debug_rules.html
+++ b/datasette/templates/debug_rules.html
@@ -3,7 +3,7 @@
 {% block title %}Permission Rules{% endblock %}
 
 {% block extra_head %}
-<script src="{{ base_url }}-/static/json-format-highlight-1.0.1.js"></script>
+<script src="{{ static('json-format-highlight-1.0.1.js') }}"></script>
 {% include "_permission_ui_styles.html" %}
 {% include "_debug_common_functions.html" %}
 {% endblock %}
@@ -37,7 +37,7 @@
 
         <div class="form-section">
             <label for="page_size">Page size:</label>
-            <input type="number" id="page_size" name="page_size" value="50" min="1" max="200" style="max-width: 100px;">
+            <input type="number" id="page_size" name="_size" value="50" min="1" max="200">
             <small>Number of results per page (max 200)</small>
         </div>
 
@@ -75,7 +75,7 @@ const submitBtn = document.getElementById('submit-btn');
 (function() {
     const params = populateFormFromURL();
     const action = params.get('action');
-    const page = params.get('page');
+    const page = params.get('_page');
     if (action) {
         fetchResults(page ? parseInt(page) : 1);
     }
@@ -89,14 +89,14 @@ async function fetchResults(page = 1) {
     const params = new URLSearchParams();
 
     for (const [key, value] of formData.entries()) {
-        if (value && key !== 'page_size') {
+        if (value && key !== '_size' && key !== '_page') {
             params.append(key, value);
         }
     }
 
     const pageSize = document.getElementById('page_size').value || '50';
-    params.append('page', page.toString());
-    params.append('page_size', pageSize);
+    params.append('_page', page.toString());
+    params.append('_size', pageSize);
 
     try {
         const response = await fetch('{{ urls.path("-/rules.json") }}?' + params.toString(), {
diff --git a/datasette/templates/patterns.html b/datasette/templates/patterns.html
index a46478a7..075c0117 100644
--- a/datasette/templates/patterns.html
+++ b/datasette/templates/patterns.html
@@ -2,7 +2,7 @@
 <html lang="en">
 <head>
     <title>Datasette: Pattern Portfolio</title>
-    <link rel="stylesheet" href="{{ base_url }}-/static/app.css?{{ app_css_hash }}">
+    <link rel="stylesheet" href="{{ static('app.css') }}">
     <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
     <meta name="robots" content="noindex">
     <style></style>
@@ -202,9 +202,9 @@
     <h3>3 rows
         where characteristic_id = 2
     </h3>
-    <form class="filters" action="{{ base_url }}fixtures/roadside_attraction_characteristics" method="get">
+    <form class="core filters" action="{{ base_url }}fixtures/roadside_attraction_characteristics" method="get">
     <div class="search-row"><label for="_search">Search:</label><input id="_search" type="search" name="_search" value=""></div>
-        <div class="filter-row">
+        <div class="filter-row filter-controls-row">
             <div class="select-wrapper">
                 <select name="_filter_column_1">
                     <option value="">- remove filter -</option>
@@ -238,7 +238,7 @@
                 </select>
             </div><input type="text" name="_filter_value_1" class="filter-value" value="2">
         </div>
-    <div class="filter-row">
+    <div class="filter-row filter-controls-row">
         <div class="select-wrapper">
             <select name="_filter_column">
                 <option value="">- column -</option>
@@ -272,8 +272,8 @@
             </select>
         </div><input type="text" name="_filter_value" class="filter-value">
     </div>
-    <div class="filter-row">
-            <div class="select-wrapper small-screen-only">
+    <div class="filter-row filter-actions-row">
+            <div class="select-wrapper">
                 <select name="_sort" id="sort_by">
                     <option value="">Sort...</option>
                     <option value="rowid" selected>Sort by rowid</option>
@@ -281,8 +281,8 @@
                     <option value="characteristic_id">Sort by characteristic_id</option>
                 </select>
             </div>
-            <label class="sort_by_desc small-screen-only"><input type="checkbox" name="_sort_by_desc"> descending</label>
-        <input type="submit" value="Apply">
+            <label class="sort_by_desc"><input type="checkbox" name="_sort_by_desc"> descending</label>
+        <input type="submit" value="Apply filters">
     </div>
   </form>
 
diff --git a/datasette/templates/row.html b/datasette/templates/row.html
index 5e483d34..aa1f0ecd 100644
--- a/datasette/templates/row.html
+++ b/datasette/templates/row.html
@@ -7,9 +7,9 @@
 {% if row_mutation_ui %}
 <script>window._datasetteTableData = {{ table_page_data|tojson }};</script>
 {% if table_page_data.foreignKeys %}
-<script src="{{ urls.static('autocomplete.js') }}" defer></script>
+<script src="{{ static('autocomplete.js') }}" defer></script>
 {% endif %}
-<script src="{{ urls.static('edit-tools.js') }}?hash={{ edit_tools_js_hash }}" defer></script>
+<script src="{{ static('edit-tools.js') }}" defer></script>
 {% endif %}
 <style>
 @media only screen and (max-width: 576px) {
diff --git a/datasette/templates/table.html b/datasette/templates/table.html
index 86b6a6ed..c2131360 100644
--- a/datasette/templates/table.html
+++ b/datasette/templates/table.html
@@ -1,17 +1,17 @@
 {% extends "base.html" %}
 
-{% block title %}{{ database }}: {{ table }}: {% if count or count == 0 %}{{ "{:,}".format(count) }} row{% if count == 1 %}{% else %}s{% endif %}{% endif %}{% if human_description_en %} {{ human_description_en }}{% endif %}{% endblock %}
+{% block title %}{{ database }}: {{ table }}: {% if count_truncated %}&gt;{{ "{:,}".format(count - 1) }} rows{% elif count or count == 0 %}{{ "{:,}".format(count) }} row{% if count == 1 %}{% else %}s{% endif %}{% endif %}{% if human_description_en %} {{ human_description_en }}{% endif %}{% endblock %}
 
 {% block extra_head %}
 {{- super() -}}
 <script>window._datasetteTableData = {{ table_page_data|tojson }};</script>
-<script src="{{ urls.static('column-chooser.js') }}" defer></script>
+<script src="{{ static('column-chooser.js') }}" defer></script>
 {% if table_page_data.foreignKeys %}
-<script src="{{ urls.static('autocomplete.js') }}" defer></script>
+<script src="{{ static('autocomplete.js') }}" defer></script>
 {% endif %}
-<script src="{{ urls.static('edit-tools.js') }}?hash={{ edit_tools_js_hash }}" defer></script>
-<script src="{{ urls.static('table.js') }}?hash={{ table_js_hash }}" defer></script>
-<script src="{{ urls.static('mobile-column-actions.js') }}" defer></script>
+<script src="{{ static('edit-tools.js') }}" defer></script>
+<script src="{{ static('table.js') }}" defer></script>
+<script src="{{ static('mobile-column-actions.js') }}" defer></script>
 <script>DATASETTE_ALLOW_FACET = {{ datasette_allow_facet }};</script>
 <style>
 @media only screen and (max-width: 576px) {
@@ -48,19 +48,19 @@
 
 {% if count or human_description_en %}
     <h3>
-        {% if count == count_limit + 1 %}&gt;{{ "{:,}".format(count_limit) }} rows
+        {% if count_truncated %}&gt;{{ "{:,}".format(count - 1) }} rows
         {% if allow_execute_sql and query.sql %} <a class="count-sql" style="font-size: 0.8em;" href="{{ urls.database_query(database, count_sql) }}">count all</a>{% endif %}
         {% elif count or count == 0 %}{{ "{:,}".format(count) }} row{% if count == 1 %}{% else %}s{% endif %}{% endif %}
         {% if human_description_en %}{{ human_description_en }}{% endif %}
     </h3>
 {% endif %}
 
-<form class="core" class="filters" action="{{ urls.table(database, table) }}" method="get">
+<form class="core filters" action="{{ urls.table(database, table) }}" method="get">
     {% if supports_search %}
         <div class="search-row"><label for="_search">Search:</label><input id="_search" type="search" name="_search" value="{{ search }}"></div>
     {% endif %}
     {% for column, lookup, value in filters.selections() %}
-        <div class="filter-row">
+        <div class="filter-row filter-controls-row">
             <div class="select-wrapper">
                 <select name="_filter_column_{{ loop.index }}">
                     <option value="">- remove filter -</option>
@@ -77,7 +77,7 @@
             </div><input type="text" name="_filter_value_{{ loop.index }}" class="filter-value" value="{{ value }}">
         </div>
     {% endfor %}
-    <div class="filter-row">
+    <div class="filter-row filter-controls-row">
         <div class="select-wrapper">
             <select name="_filter_column">
                 <option value="">- column -</option>
@@ -93,9 +93,9 @@
             </select>
         </div><input type="text" name="_filter_value" class="filter-value">
     </div>
-    <div class="filter-row">
+    <div class="filter-row filter-actions-row">
         {% if is_sortable %}
-            <div class="select-wrapper small-screen-only">
+            <div class="select-wrapper">
                 <select name="_sort" id="sort_by">
                     <option value="">Sort...</option>
                     {% for column in display_columns %}
@@ -105,12 +105,12 @@
                     {% endfor %}
                 </select>
             </div>
-            <label class="sort_by_desc small-screen-only"><input type="checkbox" name="_sort_by_desc"{% if sort_desc %} checked{% endif %}> descending</label>
+            <label class="sort_by_desc"><input type="checkbox" name="_sort_by_desc" tabindex="0"{% if sort_desc %} checked{% endif %}> descending</label>
         {% endif %}
         {% for key, value in form_hidden_args %}
             <input type="hidden" name="{{ key }}" value="{{ value }}">
         {% endfor %}
-        <input type="submit" value="Apply">
+        <input type="submit" value="Apply filters" tabindex="0">
     </div>
 </form>
 
diff --git a/datasette/tokens.py b/datasette/tokens.py
index 38a55529..79f840d2 100644
--- a/datasette/tokens.py
+++ b/datasette/tokens.py
@@ -10,7 +10,7 @@ from __future__ import annotations
 
 import dataclasses
 import time
-from typing import TYPE_CHECKING, Optional
+from typing import TYPE_CHECKING
 
 import itsdangerous
 
@@ -18,6 +18,21 @@ if TYPE_CHECKING:
     from datasette.app import Datasette
 
 
+class TokenInvalid(Exception):
+    """
+    Raised by a TokenHandler when a token it recognizes is invalid -
+    for example a bad signature, malformed payload or expired token.
+
+    Datasette responds to this with an HTTP 401 error. Handlers should
+    return None instead for tokens they do not recognize at all, so that
+    other registered handlers get a chance to verify them.
+    """
+
+    def __init__(self, message="Invalid token"):
+        self.message = message
+        super().__init__(message)
+
+
 @dataclasses.dataclass
 class TokenRestrictions:
     """
@@ -35,24 +50,24 @@ class TokenRestrictions:
     database: dict[str, list[str]] = dataclasses.field(default_factory=dict)
     resource: dict[str, dict[str, list[str]]] = dataclasses.field(default_factory=dict)
 
-    def allow_all(self, action: str) -> "TokenRestrictions":
+    def allow_all(self, action: str) -> TokenRestrictions:
         """Allow an action across all databases and resources."""
         self.all.append(action)
         return self
 
-    def allow_database(self, database: str, action: str) -> "TokenRestrictions":
+    def allow_database(self, database: str, action: str) -> TokenRestrictions:
         """Allow an action on a specific database."""
         self.database.setdefault(database, []).append(action)
         return self
 
     def allow_resource(
         self, database: str, resource: str, action: str
-    ) -> "TokenRestrictions":
+    ) -> TokenRestrictions:
         """Allow an action on a specific resource within a database."""
         self.resource.setdefault(database, {}).setdefault(resource, []).append(action)
         return self
 
-    def abbreviated(self, datasette: "Datasette") -> Optional[dict]:
+    def abbreviated(self, datasette: Datasette) -> dict | None:
         """
         Return the abbreviated ``_r`` dictionary shape for this set of
         restrictions, using action abbreviations registered with ``datasette``.
@@ -97,19 +112,23 @@ class TokenHandler:
 
     async def create_token(
         self,
-        datasette: "Datasette",
+        datasette: Datasette,
         actor_id: str,
         *,
-        expires_after: Optional[int] = None,
-        restrictions: Optional[TokenRestrictions] = None,
+        expires_after: int | None = None,
+        restrictions: TokenRestrictions | None = None,
     ) -> str:
         """Create and return a token string for the given actor."""
         raise NotImplementedError
 
-    async def verify_token(self, datasette: "Datasette", token: str) -> Optional[dict]:
+    async def verify_token(self, datasette: Datasette, token: str) -> dict | None:
         """
-        Verify a token and return an actor dict, or None if this handler
-        does not recognize the token.
+        Verify a token and return an actor dict.
+
+        Return None if this handler does not recognize the token at all,
+        so other handlers can try it. Raise TokenInvalid if the token is
+        recognized but invalid (bad signature, malformed, expired) - the
+        request will fail with a 401 error.
         """
         raise NotImplementedError
 
@@ -123,11 +142,11 @@ class SignedTokenHandler(TokenHandler):
 
     async def create_token(
         self,
-        datasette: "Datasette",
+        datasette: Datasette,
         actor_id: str,
         *,
-        expires_after: Optional[int] = None,
-        restrictions: Optional[TokenRestrictions] = None,
+        expires_after: int | None = None,
+        restrictions: TokenRestrictions | None = None,
     ) -> str:
         if not datasette.setting("allow_signed_tokens"):
             raise ValueError(
@@ -144,32 +163,35 @@ class SignedTokenHandler(TokenHandler):
                 token["_r"] = abbreviated
         return "dstok_{}".format(datasette.sign(token, namespace="token"))
 
-    async def verify_token(self, datasette: "Datasette", token: str) -> Optional[dict]:
+    async def verify_token(self, datasette: Datasette, token: str) -> dict | None:
         prefix = "dstok_"
 
-        if not datasette.setting("allow_signed_tokens"):
+        if not token.startswith(prefix):
+            # Not one of our tokens - leave it for other handlers
             return None
 
+        if not datasette.setting("allow_signed_tokens"):
+            raise TokenInvalid(
+                "Signed tokens are not enabled for this Datasette instance"
+            )
+
         max_signed_tokens_ttl = datasette.setting("max_signed_tokens_ttl")
 
-        if not token.startswith(prefix):
-            return None
-
         raw = token[len(prefix) :]
         try:
             decoded = datasette.unsign(raw, namespace="token")
         except itsdangerous.BadSignature:
-            return None
+            raise TokenInvalid("Invalid token signature")
 
         if "t" not in decoded:
-            return None
+            raise TokenInvalid("Invalid token: no timestamp")
         created = decoded["t"]
         if not isinstance(created, int):
-            return None
+            raise TokenInvalid("Invalid token: invalid timestamp")
 
         duration = decoded.get("d")
         if duration is not None and not isinstance(duration, int):
-            return None
+            raise TokenInvalid("Invalid token: invalid duration")
 
         if (duration is None and max_signed_tokens_ttl) or (
             duration is not None
@@ -178,9 +200,8 @@ class SignedTokenHandler(TokenHandler):
         ):
             duration = max_signed_tokens_ttl
 
-        if duration:
-            if time.time() - created > duration:
-                return None
+        if duration and time.time() - created > duration:
+            raise TokenInvalid("Token has expired")
 
         actor = {"id": decoded["a"], "token": "dstok"}
 
diff --git a/datasette/tracer.py b/datasette/tracer.py
index 28f3cc09..1fbda6f9 100644
--- a/datasette/tracer.py
+++ b/datasette/tracer.py
@@ -1,10 +1,11 @@
 import asyncio
+import json
+import time
+import traceback
 from contextlib import contextmanager
 from contextvars import ContextVar
+
 from markupsafe import escape
-import time
-import json
-import traceback
 
 tracers = {}
 
@@ -132,17 +133,17 @@ class AsgiTracer:
                     "num_traces": len(traces),
                     "traces": traces,
                 }
-                try:
-                    content_type = [
+                content_type = next(
+                    (
                         v.decode("utf8")
                         for k, v in response_headers
                         if k.lower() == b"content-type"
-                    ][0]
-                except IndexError:
-                    content_type = ""
+                    ),
+                    "",
+                )
                 if "text/html" in content_type and b"</body>" in accumulated_body:
                     extra = escape(json.dumps(trace_info, indent=2))
-                    extra_html = f"<pre>{extra}</pre></body>".encode("utf8")
+                    extra_html = f"<pre>{extra}</pre></body>".encode()
                     accumulated_body = accumulated_body.replace(b"</body>", extra_html)
                 elif "json" in content_type and accumulated_body.startswith(b"{"):
                     data = json.loads(accumulated_body.decode("utf8"))
diff --git a/datasette/url_builder.py b/datasette/url_builder.py
index 16b3d42b..f8da20f3 100644
--- a/datasette/url_builder.py
+++ b/datasette/url_builder.py
@@ -1,6 +1,7 @@
-from .utils import tilde_encode, path_with_format, PrefixedUrlString
 import urllib
 
+from .utils import PrefixedUrlString, path_with_format, tilde_encode
+
 
 class Urls:
     def __init__(self, ds):
@@ -8,8 +9,7 @@ class Urls:
 
     def path(self, path, format=None):
         if not isinstance(path, PrefixedUrlString):
-            if path.startswith("/"):
-                path = path[1:]
+            path = path.removeprefix("/")
             path = self.ds.setting("base_url") + path
         if format is not None:
             path = path_with_format(path=path, format=format)
@@ -56,6 +56,7 @@ class Urls:
         return PrefixedUrlString(path)
 
     def row_blob(self, database, table, row_path, column):
-        return self.table(database, table) + "/{}.blob?_blob_column={}".format(
-            row_path, urllib.parse.quote_plus(column)
+        return (
+            self.table(database, table)
+            + f"/{row_path}.blob?_blob_column={urllib.parse.quote_plus(column)}"
         )
diff --git a/datasette/utils/__init__.py b/datasette/utils/__init__.py
index 55e539b9..eb46d549 100644
--- a/datasette/utils/__init__.py
+++ b/datasette/utils/__init__.py
@@ -1,28 +1,31 @@
 import asyncio
-from contextlib import contextmanager
-import aiofiles
-import click
-from collections import OrderedDict, namedtuple, Counter
+import base64
+import binascii
 import copy
 import dataclasses
-import base64
 import hashlib
 import inspect
 import json
-import markupsafe
-import mergedeep
 import os
 import re
+import secrets
 import shlex
+import shutil
 import tempfile
-import typing
 import time
 import types
-import secrets
-import shutil
-from typing import Iterable, List, Tuple
+import typing
 import urllib
+from collections import Counter, OrderedDict, namedtuple
+from collections.abc import Iterable
+from contextlib import contextmanager
+
+import aiofiles
+import click
+import markupsafe
+import mergedeep
 import yaml
+
 from .shutil_backport import copytree
 from .sqlite import sqlite3, supports_table_xinfo
 
@@ -35,7 +38,7 @@ if typing.TYPE_CHECKING:
 class PaginatedResources:
     """Paginated results from allowed_resources query."""
 
-    resources: List["Resource"]
+    resources: list["Resource"]
     next: str | None  # Keyset token for next page (None if no more results)
     _datasette: typing.Any = dataclasses.field(default=None, repr=False)
     _action: str = dataclasses.field(default=None, repr=False)
@@ -82,22 +85,132 @@ class PaginatedResources:
 
 
 # From https://www.sqlite.org/lang_keywords.html
-reserved_words = set(
-    (
-        "abort action add after all alter analyze and as asc attach autoincrement "
-        "before begin between by cascade case cast check collate column commit "
-        "conflict constraint create cross current_date current_time "
-        "current_timestamp database default deferrable deferred delete desc detach "
-        "distinct drop each else end escape except exclusive exists explain fail "
-        "for foreign from full glob group having if ignore immediate in index "
-        "indexed initially inner insert instead intersect into is isnull join key "
-        "left like limit match natural no not notnull null of offset on or order "
-        "outer plan pragma primary query raise recursive references regexp reindex "
-        "release rename replace restrict right rollback row savepoint select set "
-        "table temp temporary then to transaction trigger union unique update using "
-        "vacuum values view virtual when where with without"
-    ).split()
-)
+reserved_words = {
+    "abort",
+    "action",
+    "add",
+    "after",
+    "all",
+    "alter",
+    "analyze",
+    "and",
+    "as",
+    "asc",
+    "attach",
+    "autoincrement",
+    "before",
+    "begin",
+    "between",
+    "by",
+    "cascade",
+    "case",
+    "cast",
+    "check",
+    "collate",
+    "column",
+    "commit",
+    "conflict",
+    "constraint",
+    "create",
+    "cross",
+    "current_date",
+    "current_time",
+    "current_timestamp",
+    "database",
+    "default",
+    "deferrable",
+    "deferred",
+    "delete",
+    "desc",
+    "detach",
+    "distinct",
+    "drop",
+    "each",
+    "else",
+    "end",
+    "escape",
+    "except",
+    "exclusive",
+    "exists",
+    "explain",
+    "fail",
+    "for",
+    "foreign",
+    "from",
+    "full",
+    "glob",
+    "group",
+    "having",
+    "if",
+    "ignore",
+    "immediate",
+    "in",
+    "index",
+    "indexed",
+    "initially",
+    "inner",
+    "insert",
+    "instead",
+    "intersect",
+    "into",
+    "is",
+    "isnull",
+    "join",
+    "key",
+    "left",
+    "like",
+    "limit",
+    "match",
+    "natural",
+    "no",
+    "not",
+    "notnull",
+    "null",
+    "of",
+    "offset",
+    "on",
+    "or",
+    "order",
+    "outer",
+    "plan",
+    "pragma",
+    "primary",
+    "query",
+    "raise",
+    "recursive",
+    "references",
+    "regexp",
+    "reindex",
+    "release",
+    "rename",
+    "replace",
+    "restrict",
+    "right",
+    "rollback",
+    "row",
+    "savepoint",
+    "select",
+    "set",
+    "table",
+    "temp",
+    "temporary",
+    "then",
+    "to",
+    "transaction",
+    "trigger",
+    "union",
+    "unique",
+    "update",
+    "using",
+    "vacuum",
+    "values",
+    "view",
+    "virtual",
+    "when",
+    "where",
+    "with",
+    "without",
+}
 
 APT_GET_DOCKERFILE_EXTRAS = r"""
 RUN apt-get update && \
@@ -157,7 +270,7 @@ functions_marked_as_documented = []
 
 def documented(fn=None, *, label=None):
     def decorate(fn):
-        fn._datasette_docs_label = label or "internals_utils_{}".format(fn.__name__)
+        fn._datasette_docs_label = label or f"internals_utils_{fn.__name__}"
         functions_marked_as_documented.append(fn)
         return fn
 
@@ -224,24 +337,71 @@ def compound_keys_after_sql(pks, start_index=0):
     return "({})".format("\n  or\n".join(or_clauses))
 
 
+@documented
 class CustomJSONEncoder(json.JSONEncoder):
+    """
+    The CustomJSONEncoder class handles serialization for objects commonly used by Datasette,
+    including SQLite cursors and binary blobs. Datasette uses it internally to serve .json endpoints,
+    and plugins that return JSON can use it to match Datasette's own handling.
+
+    Built-in types (text, numbers, lists, etc) are encoded the same as Python's built-in ``json`` module.
+
+    - ``sqlite3.Row`` becomes a tuple
+    - ``sqlite3.Cursor`` becomes a list
+
+    Binary blobs are encoded as an object, with the actual data base64-encoded,
+    like so: ::
+
+        {
+            "$base64": True,
+            "encoded": ...,
+        }
+
+    Example: https://latest.datasette.io/fixtures/binary_data.json
+    """
+
     def default(self, obj):
         if isinstance(obj, sqlite3.Row):
             return tuple(obj)
         if isinstance(obj, sqlite3.Cursor):
             return list(obj)
         if isinstance(obj, bytes):
-            # Does it encode to utf8?
-            try:
-                return obj.decode("utf8")
-            except UnicodeDecodeError:
-                return {
-                    "$base64": True,
-                    "encoded": base64.b64encode(obj).decode("latin1"),
-                }
+            return {
+                "$base64": True,
+                "encoded": base64.b64encode(obj).decode("latin1"),
+            }
         return json.JSONEncoder.default(self, obj)
 
 
+class WriteJsonValueError(ValueError):
+    pass
+
+
+def decode_write_json_cell(value):
+    if not isinstance(value, dict):
+        return value
+    keys = set(value.keys())
+    if keys == {"$raw"}:
+        return value["$raw"]
+    if keys == {"$base64", "encoded"} and value.get("$base64") is True:
+        encoded = value["encoded"]
+        if not isinstance(encoded, str):
+            raise WriteJsonValueError("$base64 encoded value must be a string")
+        try:
+            return base64.b64decode(encoded, validate=True)
+        except binascii.Error as ex:
+            raise WriteJsonValueError("Invalid $base64 encoded value") from ex
+    return value
+
+
+def decode_write_json_row(row):
+    return {key: decode_write_json_cell(value) for key, value in row.items()}
+
+
+def decode_write_json_rows(rows):
+    return [decode_write_json_row(row) for row in rows]
+
+
 @contextmanager
 def sqlite_timelimit(conn, ms):
     deadline = time.perf_counter() + (ms / 1000)
@@ -312,7 +472,7 @@ disallawed_sql_res = [
     (
         re.compile(f"pragma(?!_({'|'.join(allowed_pragmas)}))"),
         "Statement contained a disallowed PRAGMA. Allowed pragma functions are {}".format(
-            ", ".join("pragma_{}()".format(pragma) for pragma in allowed_pragmas)
+            ", ".join(f"pragma_{pragma}()" for pragma in allowed_pragmas)
         ),
     )
 ]
@@ -410,12 +570,7 @@ def escape_css_string(s):
 def escape_sqlite(s):
     if _boring_keyword_re.match(s) and (s.lower() not in reserved_words):
         return s
-    elif "]" in s:
-        # SQLite does not support escaping ] inside [bracket] quoting, so fall
-        # back to double-quote quoting (doubling any embedded ") - #2677
-        return '"{}"'.format(s.replace('"', '""'))
-    else:
-        return f"[{s}]"
+    return '"{}"'.format(s.replace('"', '""'))
 
 
 def make_dockerfile(
@@ -491,10 +646,7 @@ CMD {cmd}""".format(
             else ""
         ),
         environment_variables="\n".join(
-            [
-                "ENV {} '{}'".format(key, value)
-                for key, value in environment_variables.items()
-            ]
+            [f"ENV {key} '{value}'" for key, value in environment_variables.items()]
         ),
         install_from=" ".join(install),
         files=" ".join(files),
@@ -593,11 +745,11 @@ def detect_primary_keys(conn, table):
 
 
 def get_outbound_foreign_keys(conn, table):
-    infos = conn.execute(f"PRAGMA foreign_key_list([{table}])").fetchall()
+    infos = conn.execute(f"PRAGMA foreign_key_list({escape_sqlite(table)})").fetchall()
     fks = []
     for info in infos:
         if info is not None:
-            id, seq, table_name, from_, to_, on_update, on_delete, match = info
+            id, seq, table_name, from_, to_, _on_update, _on_delete, _match = info
             fks.append(
                 {
                     "column": from_,
@@ -698,7 +850,7 @@ def detect_json1(conn=None):
     try:
         conn.execute("SELECT json('{}')")
         return True
-    except Exception:
+    except sqlite3.Error:
         return False
     finally:
         if close_conn:
@@ -778,9 +930,7 @@ def is_url(value):
     if not value.startswith("http://") and not value.startswith("https://"):
         return False
     # Any whitespace at all is invalid
-    if whitespace_re.search(value):
-        return False
-    return True
+    return not whitespace_re.search(value)
 
 
 css_class_re = re.compile(r"^[a-zA-Z]+[_a-zA-Z0-9-]*$")
@@ -833,7 +983,9 @@ def module_from_path(path, name):
     mod.__file__ = path
     with open(path, "r") as file:
         code = compile(file.read(), path, "exec", dont_inherit=True)
-    exec(code, mod.__dict__)
+    # Executing the file is the whole point - this is how --plugins-dir loads
+    # plugins and how metadata/config .py files are evaluated
+    exec(code, mod.__dict__)  # noqa: S102
     return mod
 
 
@@ -990,9 +1142,7 @@ def escape_fts(query):
         query += '"'
     bits = _escape_fts_re.split(query)
     bits = [b for b in bits if b and b != '""']
-    return " ".join(
-        '"{}"'.format(bit) if not bit.startswith('"') else bit for bit in bits
-    )
+    return " ".join(f'"{bit}"' if not bit.startswith('"') else bit for bit in bits)
 
 
 class MultiParams:
@@ -1004,7 +1154,7 @@ class MultiParams:
                     data[key], (list, tuple)
                 ), "dictionary data should be a dictionary of key => [list]"
             self._data = data
-        elif isinstance(data, list) or isinstance(data, tuple):
+        elif isinstance(data, (list, tuple)):
             new_data = {}
             for item in data:
                 assert (
@@ -1094,9 +1244,7 @@ def _gather_arguments(fn, kwargs):
     for parameter in parameters:
         if parameter not in kwargs:
             raise TypeError(
-                "{} requires parameters {}, missing: {}".format(
-                    fn, tuple(parameters), set(parameters) - set(kwargs.keys())
-                )
+                f"{fn} requires parameters {tuple(parameters)}, missing: {set(parameters) - set(kwargs.keys())}"
             )
         call_with.append(kwargs[parameter])
     return call_with
@@ -1165,9 +1313,9 @@ def resolve_env_secrets(config, environ):
     """Create copy that recursively replaces {"$env": "NAME"} with values from environ"""
     if isinstance(config, dict):
         if list(config.keys()) == ["$env"]:
-            return environ.get(list(config.values())[0])
+            return environ.get(next(iter(config.values())))
         elif list(config.keys()) == ["$file"]:
-            with open(list(config.values())[0]) as fp:
+            with open(next(iter(config.values()))) as fp:
                 return fp.read()
         else:
             return {
@@ -1245,29 +1393,38 @@ class StartupError(Exception):
     pass
 
 
-_single_line_comment_re = re.compile(r"--.*")
-_multi_line_comment_re = re.compile(r"/\*.*?\*/", re.DOTALL)
-_single_quote_re = re.compile(r"'(?:''|[^'])*'")
-_double_quote_re = re.compile(r'"(?:\"\"|[^"])*"')
+# Comments and string literals, matched in a single pass so that whichever
+# construct starts first "wins" - this ensures a comment marker inside a string
+# literal (or a quote inside a comment) does not confuse the parameter scan.
+_comments_and_strings_re = re.compile(
+    r"""
+    --[^\n]*            # single line comment
+    | /\*.*?(?:\*/|\Z)  # multi line comment, possibly to end-of-input
+    | '(?:''|[^'])*'    # single quoted string ('' escapes a quote)
+    | "(?:""|[^"])*"    # double quoted identifier ("" escapes a quote)
+    | \[(?:[^\]])*\]    # square-bracket quoted identifier
+    | `(?:``|[^`])*`    # backtick quoted identifier
+    """,
+    re.DOTALL | re.VERBOSE,
+)
 _named_param_re = re.compile(r":(\w+)")
 
 
 @documented
-def named_parameters(sql: str) -> List[str]:
+def named_parameters(sql: str) -> list[str]:
     """
     Given a SQL statement, return a list of named parameters that are used in the statement
 
     e.g. for ``select * from foo where id=:id`` this would return ``["id"]``
     """
-    sql = _single_line_comment_re.sub("", sql)
-    sql = _multi_line_comment_re.sub("", sql)
-    sql = _single_quote_re.sub("", sql)
-    sql = _double_quote_re.sub("", sql)
+    # Strip comments and string literals first so that any ":name" sequences
+    # inside them are not mistaken for named parameters
+    sql = _comments_and_strings_re.sub("", sql)
     # Extract parameters from what is left
     return _named_param_re.findall(sql)
 
 
-async def derive_named_parameters(db: "Database", sql: str) -> List[str]:
+async def derive_named_parameters(db: "Database", sql: str) -> list[str]:
     """
     This undocumented but stable method exists for backwards compatibility
     with plugins that were using it before it switched to named_parameters()
@@ -1275,6 +1432,54 @@ async def derive_named_parameters(db: "Database", sql: str) -> List[str]:
     return named_parameters(sql)
 
 
+def parse_size_limit(value, default, maximum, name="_size"):
+    """
+    Parse a page-size parameter using the same semantics as the table
+    view's ?_size=: blank means default, "max" means maximum, integers
+    must be 0 or greater and no larger than maximum. Raises ValueError
+    with a message suitable for a 400 response.
+    """
+    if value in (None, ""):
+        return default
+    if value == "max":
+        return maximum
+    try:
+        size = int(value)
+        if size < 0:
+            raise ValueError
+    except ValueError:
+        raise ValueError(f"{name} must be a positive integer")
+    if size > maximum:
+        raise ValueError(f"{name} must be <= {maximum}")
+    return size
+
+
+UNSTABLE_API_MESSAGE = (
+    "This API is not part of Datasette's stable interface and may change at any time"
+)
+
+
+def error_body(messages, status):
+    """
+    The canonical JSON error body used by every Datasette JSON error response:
+
+        {"ok": False, "error": "...", "errors": ["...", ...], "status": 400}
+
+    "error" is all of the messages joined with "; ", "errors" is the full
+    list, "status" matches the HTTP status code. Callers may add extra
+    context keys to the returned dictionary but must not remove these four.
+    """
+    if isinstance(messages, str):
+        messages = [messages]
+    messages = [str(message) for message in messages]
+    return {
+        "ok": False,
+        "error": "; ".join(messages),
+        "errors": messages,
+        "status": status,
+    }
+
+
 def add_cors_headers(headers):
     headers["Access-Control-Allow-Origin"] = "*"
     headers["Access-Control-Allow-Headers"] = "Authorization, Content-Type"
@@ -1303,7 +1508,7 @@ class TildeEncoder(dict):
         elif b == _space:
             res = "+"
         else:
-            res = "~{:02X}".format(b)
+            res = f"~{b:02X}"
         self[b] = res
         return res
 
@@ -1398,7 +1603,7 @@ def _combine(base: dict, update: dict) -> dict:
     return base
 
 
-def pairs_to_nested_config(pairs: typing.List[typing.Tuple[str, typing.Any]]) -> dict:
+def pairs_to_nested_config(pairs: list[tuple[str, typing.Any]]) -> dict:
     """
     Parse a list of key-value pairs into a nested dictionary.
     """
@@ -1413,7 +1618,7 @@ def make_slot_function(name, datasette, request, **kwargs):
     from datasette.plugins import pm
 
     method = getattr(pm.hook, name, None)
-    assert method is not None, "No hook found for {}".format(name)
+    assert method is not None, f"No hook found for {name}"
 
     async def inner():
         html_bits = []
@@ -1437,7 +1642,7 @@ def prune_empty_dicts(d: dict):
                 d.pop(key, None)
 
 
-def move_plugins_and_allow(source: dict, destination: dict) -> Tuple[dict, dict]:
+def move_plugins_and_allow(source: dict, destination: dict) -> tuple[dict, dict]:
     """
     Move 'plugins' and 'allow' keys from source to destination dictionary. Creates
     hierarchy in destination if needed. After moving, recursively remove any keys
@@ -1548,6 +1753,17 @@ def md5_not_usedforsecurity(s):
 _etag_cache = {}
 
 
+def sha256_file(filepath, chunk_size=4096):
+    hasher = hashlib.sha256()
+    with open(filepath, "rb") as fp:
+        while True:
+            chunk = fp.read(chunk_size)
+            if not chunk:
+                break
+            hasher.update(chunk)
+    return hasher.hexdigest()
+
+
 async def calculate_etag(filepath, chunk_size=4096):
     if filepath in _etag_cache:
         return _etag_cache[filepath]
diff --git a/datasette/utils/actions_sql.py b/datasette/utils/actions_sql.py
index c7137e6b..d767e391 100644
--- a/datasette/utils/actions_sql.py
+++ b/datasette/utils/actions_sql.py
@@ -252,88 +252,62 @@ async def _build_single_action_sql(
                 ]
             )
 
-    # Continue with the cascading logic
-    query_parts.extend(
-        [
-            "child_lvl AS (",
-            "  SELECT b.parent, b.child,",
-            "         MAX(CASE WHEN ar.allow = 0 THEN 1 ELSE 0 END) AS any_deny,",
-            "         MAX(CASE WHEN ar.allow = 1 THEN 1 ELSE 0 END) AS any_allow,",
-            "         json_group_array(CASE WHEN ar.allow = 0 THEN ar.source_plugin || ': ' || ar.reason END) AS deny_reasons,",
-            "         json_group_array(CASE WHEN ar.allow = 1 THEN ar.source_plugin || ': ' || ar.reason END) AS allow_reasons",
-            "  FROM base b",
-            "  LEFT JOIN all_rules ar ON ar.parent = b.parent AND ar.child = b.child",
-            "  GROUP BY b.parent, b.child",
-            "),",
-            "parent_lvl AS (",
-            "  SELECT b.parent, b.child,",
-            "         MAX(CASE WHEN ar.allow = 0 THEN 1 ELSE 0 END) AS any_deny,",
-            "         MAX(CASE WHEN ar.allow = 1 THEN 1 ELSE 0 END) AS any_allow,",
-            "         json_group_array(CASE WHEN ar.allow = 0 THEN ar.source_plugin || ': ' || ar.reason END) AS deny_reasons,",
-            "         json_group_array(CASE WHEN ar.allow = 1 THEN ar.source_plugin || ': ' || ar.reason END) AS allow_reasons",
-            "  FROM base b",
-            "  LEFT JOIN all_rules ar ON ar.parent = b.parent AND ar.child IS NULL",
-            "  GROUP BY b.parent, b.child",
-            "),",
-            "global_lvl AS (",
-            "  SELECT b.parent, b.child,",
-            "         MAX(CASE WHEN ar.allow = 0 THEN 1 ELSE 0 END) AS any_deny,",
-            "         MAX(CASE WHEN ar.allow = 1 THEN 1 ELSE 0 END) AS any_allow,",
-            "         json_group_array(CASE WHEN ar.allow = 0 THEN ar.source_plugin || ': ' || ar.reason END) AS deny_reasons,",
-            "         json_group_array(CASE WHEN ar.allow = 1 THEN ar.source_plugin || ': ' || ar.reason END) AS allow_reasons",
-            "  FROM base b",
-            "  LEFT JOIN all_rules ar ON ar.parent IS NULL AND ar.child IS NULL",
-            "  GROUP BY b.parent, b.child",
-            "),",
+    # Continue with the cascading logic.
+    # Aggregate the RULES by cascade level (small), rather than grouping
+    # base x rules (which scales with the number of resources).
+    def _agg(select_key, where, group_by):
+        parts = [
+            f"  SELECT {select_key}",
+            "         MAX(CASE WHEN allow = 0 THEN 1 ELSE 0 END) AS any_deny,",
+            "         MAX(CASE WHEN allow = 1 THEN 1 ELSE 0 END) AS any_allow,",
+            "         json_group_array(CASE WHEN allow = 0 THEN source_plugin || ': ' || reason END) AS deny_reasons,",
+            "         json_group_array(CASE WHEN allow = 1 THEN source_plugin || ': ' || reason END) AS allow_reasons",
+            f"  FROM all_rules WHERE {where}",
         ]
+        if group_by:
+            parts.append(f"  GROUP BY {group_by}")
+        return parts
+
+    query_parts.extend(
+        ["child_agg AS ("]
+        + _agg(
+            "parent, child,",
+            "parent IS NOT NULL AND child IS NOT NULL",
+            "parent, child",
+        )
+        + ["),", "parent_agg AS ("]
+        + _agg("parent,", "parent IS NOT NULL AND child IS NULL", "parent")
+        + ["),", "global_agg AS ("]
+        + _agg("", "parent IS NULL AND child IS NULL", None)
+        + ["),"]
     )
 
     # Add anonymous decision logic if needed
     if include_is_private:
-        query_parts.extend(
-            [
-                "anon_child_lvl AS (",
-                "  SELECT b.parent, b.child,",
-                "         MAX(CASE WHEN ar.allow = 0 THEN 1 ELSE 0 END) AS any_deny,",
-                "         MAX(CASE WHEN ar.allow = 1 THEN 1 ELSE 0 END) AS any_allow",
-                "  FROM base b",
-                "  LEFT JOIN anon_rules ar ON ar.parent = b.parent AND ar.child = b.child",
-                "  GROUP BY b.parent, b.child",
-                "),",
-                "anon_parent_lvl AS (",
-                "  SELECT b.parent, b.child,",
-                "         MAX(CASE WHEN ar.allow = 0 THEN 1 ELSE 0 END) AS any_deny,",
-                "         MAX(CASE WHEN ar.allow = 1 THEN 1 ELSE 0 END) AS any_allow",
-                "  FROM base b",
-                "  LEFT JOIN anon_rules ar ON ar.parent = b.parent AND ar.child IS NULL",
-                "  GROUP BY b.parent, b.child",
-                "),",
-                "anon_global_lvl AS (",
-                "  SELECT b.parent, b.child,",
-                "         MAX(CASE WHEN ar.allow = 0 THEN 1 ELSE 0 END) AS any_deny,",
-                "         MAX(CASE WHEN ar.allow = 1 THEN 1 ELSE 0 END) AS any_allow",
-                "  FROM base b",
-                "  LEFT JOIN anon_rules ar ON ar.parent IS NULL AND ar.child IS NULL",
-                "  GROUP BY b.parent, b.child",
-                "),",
-                "anon_decisions AS (",
-                "  SELECT",
-                "    b.parent, b.child,",
-                "    CASE",
-                "      WHEN acl.any_deny = 1 THEN 0",
-                "      WHEN acl.any_allow = 1 THEN 1",
-                "      WHEN apl.any_deny = 1 THEN 0",
-                "      WHEN apl.any_allow = 1 THEN 1",
-                "      WHEN agl.any_deny = 1 THEN 0",
-                "      WHEN agl.any_allow = 1 THEN 1",
-                "      ELSE 0",
-                "    END AS anon_is_allowed",
-                "  FROM base b",
-                "  JOIN anon_child_lvl acl ON b.parent = acl.parent AND (b.child = acl.child OR (b.child IS NULL AND acl.child IS NULL))",
-                "  JOIN anon_parent_lvl apl ON b.parent = apl.parent AND (b.child = apl.child OR (b.child IS NULL AND apl.child IS NULL))",
-                "  JOIN anon_global_lvl agl ON b.parent = agl.parent AND (b.child = agl.child OR (b.child IS NULL AND agl.child IS NULL))",
-                "),",
+
+        def _anon_agg(select_key, where, group_by):
+            parts = [
+                f"  SELECT {select_key}",
+                "         MAX(CASE WHEN allow = 0 THEN 1 ELSE 0 END) AS any_deny,",
+                "         MAX(CASE WHEN allow = 1 THEN 1 ELSE 0 END) AS any_allow",
+                f"  FROM anon_rules WHERE {where}",
             ]
+            if group_by:
+                parts.append(f"  GROUP BY {group_by}")
+            return parts
+
+        query_parts.extend(
+            ["anon_child_agg AS ("]
+            + _anon_agg(
+                "parent, child,",
+                "parent IS NOT NULL AND child IS NOT NULL",
+                "parent, child",
+            )
+            + ["),", "anon_parent_agg AS ("]
+            + _anon_agg("parent,", "parent IS NOT NULL AND child IS NULL", "parent")
+            + ["),", "anon_global_agg AS ("]
+            + _anon_agg("", "parent IS NULL AND child IS NULL", None)
+            + ["),"]
         )
 
     # Final decisions
@@ -342,31 +316,28 @@ async def _build_single_action_sql(
             "decisions AS (",
             "  SELECT",
             "    b.parent, b.child,",
-            "    -- Cascading permission logic: child → parent → global, DENY beats ALLOW at each level",
+            "    -- Cascading permission logic: child -> parent -> global, DENY beats ALLOW at each level",
             "    -- Priority order:",
-            "    --   1. Child-level deny (most specific, blocks access)",
-            "    --   2. Child-level allow (most specific, grants access)",
-            "    --   3. Parent-level deny (intermediate, blocks access)",
-            "    --   4. Parent-level allow (intermediate, grants access)",
-            "    --   5. Global-level deny (least specific, blocks access)",
-            "    --   6. Global-level allow (least specific, grants access)",
+            "    --   1. Child-level deny  2. Child-level allow",
+            "    --   3. Parent-level deny 4. Parent-level allow",
+            "    --   5. Global-level deny 6. Global-level allow",
             "    --   7. Default deny (no rules match)",
             "    CASE",
-            "      WHEN cl.any_deny = 1 THEN 0",
-            "      WHEN cl.any_allow = 1 THEN 1",
-            "      WHEN pl.any_deny = 1 THEN 0",
-            "      WHEN pl.any_allow = 1 THEN 1",
-            "      WHEN gl.any_deny = 1 THEN 0",
-            "      WHEN gl.any_allow = 1 THEN 1",
+            "      WHEN ca.any_deny = 1 THEN 0",
+            "      WHEN ca.any_allow = 1 THEN 1",
+            "      WHEN pa.any_deny = 1 THEN 0",
+            "      WHEN pa.any_allow = 1 THEN 1",
+            "      WHEN ga.any_deny = 1 THEN 0",
+            "      WHEN ga.any_allow = 1 THEN 1",
             "      ELSE 0",
             "    END AS is_allowed,",
             "    CASE",
-            "      WHEN cl.any_deny = 1 THEN cl.deny_reasons",
-            "      WHEN cl.any_allow = 1 THEN cl.allow_reasons",
-            "      WHEN pl.any_deny = 1 THEN pl.deny_reasons",
-            "      WHEN pl.any_allow = 1 THEN pl.allow_reasons",
-            "      WHEN gl.any_deny = 1 THEN gl.deny_reasons",
-            "      WHEN gl.any_allow = 1 THEN gl.allow_reasons",
+            "      WHEN ca.any_deny = 1 THEN ca.deny_reasons",
+            "      WHEN ca.any_allow = 1 THEN ca.allow_reasons",
+            "      WHEN pa.any_deny = 1 THEN pa.deny_reasons",
+            "      WHEN pa.any_allow = 1 THEN pa.allow_reasons",
+            "      WHEN ga.any_deny = 1 THEN ga.deny_reasons",
+            "      WHEN ga.any_allow = 1 THEN ga.allow_reasons",
             "      ELSE '[]'",
             "    END AS reason",
         ]
@@ -374,21 +345,34 @@ async def _build_single_action_sql(
 
     if include_is_private:
         query_parts.append(
-            "    , CASE WHEN ad.anon_is_allowed = 0 THEN 1 ELSE 0 END AS is_private"
+            "    , CASE WHEN ("
+            "CASE"
+            " WHEN aca.any_deny = 1 THEN 0"
+            " WHEN aca.any_allow = 1 THEN 1"
+            " WHEN apa.any_deny = 1 THEN 0"
+            " WHEN apa.any_allow = 1 THEN 1"
+            " WHEN aga.any_deny = 1 THEN 0"
+            " WHEN aga.any_allow = 1 THEN 1"
+            " ELSE 0 END"
+            ") = 0 THEN 1 ELSE 0 END AS is_private"
         )
 
     query_parts.extend(
         [
             "  FROM base b",
-            "  JOIN child_lvl cl ON b.parent = cl.parent AND (b.child = cl.child OR (b.child IS NULL AND cl.child IS NULL))",
-            "  JOIN parent_lvl pl ON b.parent = pl.parent AND (b.child = pl.child OR (b.child IS NULL AND pl.child IS NULL))",
-            "  JOIN global_lvl gl ON b.parent = gl.parent AND (b.child = gl.child OR (b.child IS NULL AND gl.child IS NULL))",
+            "  LEFT JOIN child_agg ca ON ca.parent = b.parent AND ca.child = b.child",
+            "  LEFT JOIN parent_agg pa ON pa.parent = b.parent",
+            "  CROSS JOIN global_agg ga",
         ]
     )
 
     if include_is_private:
-        query_parts.append(
-            "  JOIN anon_decisions ad ON b.parent = ad.parent AND (b.child = ad.child OR (b.child IS NULL AND ad.child IS NULL))"
+        query_parts.extend(
+            [
+                "  LEFT JOIN anon_child_agg aca ON aca.parent = b.parent AND aca.child = b.child",
+                "  LEFT JOIN anon_parent_agg apa ON apa.parent = b.parent",
+                "  CROSS JOIN anon_global_agg aga",
+            ]
         )
 
     query_parts.append(")")
@@ -400,8 +384,28 @@ async def _build_single_action_sql(
         restriction_intersect = "\nINTERSECT\n".join(
             f"SELECT * FROM ({sql})" for sql in restriction_sqls
         )
+        # Decompose by NULL-pattern so the final filter can use pure-equality
+        # EXISTS lookups (satisfiable via automatic indexes) instead of a
+        # correlated OR-scan over the whole list.
         query_parts.extend(
-            [",", "restriction_list AS (", f"  {restriction_intersect}", ")"]
+            [
+                ",",
+                "restriction_list AS (",
+                f"  {restriction_intersect}",
+                "),",
+                "restriction_exact AS (",
+                "  SELECT parent, child FROM restriction_list WHERE parent IS NOT NULL AND child IS NOT NULL",
+                "),",
+                "restriction_parent_any AS (",
+                "  SELECT DISTINCT parent FROM restriction_list WHERE parent IS NOT NULL AND child IS NULL",
+                "),",
+                "restriction_child_any AS (",
+                "  SELECT DISTINCT child FROM restriction_list WHERE parent IS NULL AND child IS NOT NULL",
+                "),",
+                "restriction_all AS (",
+                "  SELECT 1 AS matched FROM restriction_list WHERE parent IS NULL AND child IS NULL LIMIT 1",
+                ")",
+            ]
         )
 
     # Final SELECT
@@ -416,10 +420,11 @@ async def _build_single_action_sql(
     # Add restriction filter if there are restrictions
     if restriction_sqls:
         query_parts.append("""
-  AND EXISTS (
-    SELECT 1 FROM restriction_list r
-    WHERE (r.parent = decisions.parent OR r.parent IS NULL)
-      AND (r.child = decisions.child OR r.child IS NULL)
+  AND (
+    EXISTS (SELECT 1 FROM restriction_all)
+    OR EXISTS (SELECT 1 FROM restriction_parent_any r WHERE r.parent = decisions.parent)
+    OR EXISTS (SELECT 1 FROM restriction_child_any r WHERE r.child = decisions.child)
+    OR EXISTS (SELECT 1 FROM restriction_exact r WHERE r.parent = decisions.parent AND r.child = decisions.child)
   )""")
 
     # Add parent filter if specified
@@ -673,3 +678,239 @@ async def check_permission_for_resource(
         child=child,
     )
     return results[action]
+
+
+async def explain_permission_for_resource(
+    *,
+    datasette: "Datasette",
+    actor: dict | None,
+    action: str,
+    parent: str | None,
+    child: str | None,
+) -> dict:
+    """Explain a permission decision for one action and resource.
+
+    This is intended for Datasette's permission debugging tools. It uses the
+    same ``permission_resources_sql`` hook results and the same resolution
+    rules as :func:`check_permissions_for_actions`, but also returns the
+    matching rules, actor restriction results and ``also_requires`` chain.
+
+    The returned dictionary is part of Datasette's unstable debugging API.
+    """
+
+    action_obj = datasette.actions.get(action)
+    if action_obj is None:
+        raise ValueError(f"Unknown action: {action}")
+
+    explanation = await _explain_single_action(
+        datasette=datasette,
+        actor=actor,
+        action=action,
+        parent=parent,
+        child=child,
+    )
+
+    required_actions = []
+    if action_obj.also_requires:
+        required = await explain_permission_for_resource(
+            datasette=datasette,
+            actor=actor,
+            action=action_obj.also_requires,
+            parent=parent,
+            child=child,
+        )
+        required_actions.append(required)
+
+    explanation["required_actions"] = required_actions
+    explanation["allowed"] = bool(
+        explanation["rule_allowed"]
+        and explanation["restriction_allowed"]
+        and all(required["allowed"] for required in required_actions)
+    )
+    explanation["summary"] = _permission_explanation_summary(explanation)
+    return explanation
+
+
+async def _explain_single_action(
+    *,
+    datasette: "Datasette",
+    actor: dict | None,
+    action: str,
+    parent: str | None,
+    child: str | None,
+) -> dict:
+    """Return matching rules and restrictions for a single action."""
+    from datasette.utils.permissions import SKIP_PERMISSION_CHECKS
+
+    permission_sqls = await gather_permission_sql_from_hooks(
+        datasette=datasette,
+        actor=actor,
+        action=action,
+    )
+
+    if permission_sqls is SKIP_PERMISSION_CHECKS:
+        return {
+            "action": action,
+            "rule_allowed": True,
+            "restriction_allowed": True,
+            "winning_scope": "global",
+            "matched_rules": [
+                {
+                    "scope": "global",
+                    "effect": "allow",
+                    "source": "skip_permission_checks",
+                    "reason": "Permission checks were explicitly skipped",
+                    "decisive": True,
+                    "ignored_because": None,
+                }
+            ],
+            "restrictions": [],
+        }
+
+    db = datasette.get_internal_database()
+    matched_rules = []
+    restrictions = []
+
+    for permission_sql in permission_sqls:
+        params = dict(permission_sql.params or {})
+        parent_param = _unused_parameter_name(params, "_explain_parent")
+        params[parent_param] = parent
+        child_param = _unused_parameter_name(params, "_explain_child")
+        params[child_param] = child
+
+        if permission_sql.sql:
+            rows = await db.execute(
+                f"""
+                SELECT parent, child, allow, reason
+                FROM ({permission_sql.sql}) AS permission_rules
+                WHERE (parent IS NULL OR parent = :{parent_param})
+                  AND (child IS NULL OR child = :{child_param})
+                """,
+                params,
+            )
+            for row in rows:
+                specificity = (
+                    2
+                    if row["child"] is not None
+                    else 1 if row["parent"] is not None else 0
+                )
+                matched_rules.append(
+                    {
+                        "scope": ("resource", "parent", "global")[2 - specificity],
+                        "effect": "allow" if row["allow"] else "deny",
+                        "source": permission_sql.source,
+                        "reason": row["reason"],
+                        "_specificity": specificity,
+                    }
+                )
+
+        if permission_sql.restriction_sql:
+            restriction_row = (
+                await db.execute(
+                    f"""
+                    SELECT EXISTS(
+                        SELECT 1 FROM ({permission_sql.restriction_sql}) AS restriction_rules
+                        WHERE (parent IS NULL OR parent = :{parent_param})
+                          AND (child IS NULL OR child = :{child_param})
+                    ) AS resource_is_in_allowlist
+                    """,
+                    params,
+                )
+            ).first()
+            restriction_allowed = bool(restriction_row[0])
+            restrictions.append(
+                {
+                    "source": permission_sql.source,
+                    "allowed": restriction_allowed,
+                    "reason": params.get("deny")
+                    or (
+                        "Resource is included in this restriction allowlist"
+                        if restriction_allowed
+                        else "Resource is not included in this restriction allowlist"
+                    ),
+                }
+            )
+
+    matched_rules.sort(
+        key=lambda rule: (
+            -rule["_specificity"],
+            0 if rule["effect"] == "deny" else 1,
+            rule["source"] or "",
+            rule["reason"] or "",
+        )
+    )
+
+    if matched_rules:
+        winning_specificity = matched_rules[0]["_specificity"]
+        winning_rules = [
+            rule
+            for rule in matched_rules
+            if rule["_specificity"] == winning_specificity
+        ]
+        rule_allowed = not any(rule["effect"] == "deny" for rule in winning_rules)
+        winning_scope = winning_rules[0]["scope"]
+    else:
+        winning_specificity = None
+        rule_allowed = False
+        winning_scope = None
+
+    for rule in matched_rules:
+        specificity = rule.pop("_specificity")
+        if specificity != winning_specificity:
+            rule["decisive"] = False
+            rule["ignored_because"] = "A more specific rule matched"
+        elif not rule_allowed and rule["effect"] == "allow":
+            rule["decisive"] = False
+            rule["ignored_because"] = "A deny rule matched at the same scope"
+        else:
+            rule["decisive"] = True
+            rule["ignored_because"] = None
+
+    return {
+        "action": action,
+        "rule_allowed": rule_allowed,
+        "restriction_allowed": all(
+            restriction["allowed"] for restriction in restrictions
+        ),
+        "winning_scope": winning_scope,
+        "matched_rules": matched_rules,
+        "restrictions": restrictions,
+    }
+
+
+def _unused_parameter_name(params: dict, preferred: str) -> str:
+    """Return a SQL parameter name that is not already in ``params``."""
+    candidate = preferred
+    suffix = 2
+    while candidate in params:
+        candidate = f"{preferred}_{suffix}"
+        suffix += 1
+    return candidate
+
+
+def _permission_explanation_summary(explanation: dict) -> str:
+    denied_requirement = next(
+        (
+            required
+            for required in explanation["required_actions"]
+            if not required["allowed"]
+        ),
+        None,
+    )
+    if denied_requirement:
+        return (
+            f"Denied because {explanation['action']} also requires "
+            f"{denied_requirement['action']}, which was denied."
+        )
+    if not explanation["matched_rules"]:
+        return "Denied because no permission rule matched this actor and resource."
+    if not explanation["rule_allowed"]:
+        return (
+            f"Denied by a {explanation['winning_scope']}-level rule. "
+            "Deny rules take precedence over allow rules at the same scope."
+        )
+    if not explanation["restriction_allowed"]:
+        return (
+            "Denied because the resource is not included in the actor's restrictions."
+        )
+    return f"Allowed by the matching {explanation['winning_scope']}-level rule."
diff --git a/datasette/utils/asgi.py b/datasette/utils/asgi.py
index 93084365..812194fd 100644
--- a/datasette/utils/asgi.py
+++ b/datasette/utils/asgi.py
@@ -1,28 +1,29 @@
 import json
-from typing import Optional
-from datasette.utils import MultiParams, calculate_etag
+import re
+from http.cookies import Morsel, SimpleCookie
+from mimetypes import guess_type
+from pathlib import Path
+from urllib.parse import parse_qs, parse_qsl, urlunparse
+
+import aiofiles
+import aiofiles.os
+
+from datasette.utils import MultiParams, calculate_etag, error_body, sha256_file
 from datasette.utils.multipart import (
-    parse_form_data,
-    MultipartParseError,
-    FormData,
-    DEFAULT_MAX_FILE_SIZE,
-    DEFAULT_MAX_REQUEST_SIZE,
-    DEFAULT_MAX_FIELDS,
-    DEFAULT_MAX_FILES,
-    DEFAULT_MAX_PARTS,
     DEFAULT_MAX_FIELD_SIZE,
+    DEFAULT_MAX_FIELDS,
+    DEFAULT_MAX_FILE_SIZE,
+    DEFAULT_MAX_FILES,
     DEFAULT_MAX_MEMORY_FILE_SIZE,
     DEFAULT_MAX_PART_HEADER_BYTES,
     DEFAULT_MAX_PART_HEADER_LINES,
+    DEFAULT_MAX_PARTS,
+    DEFAULT_MAX_REQUEST_SIZE,
     DEFAULT_MIN_FREE_DISK_BYTES,
+    FormData,
+    MultipartParseError,
+    parse_form_data,
 )
-from mimetypes import guess_type
-from urllib.parse import parse_qs, urlunparse, parse_qsl
-from pathlib import Path
-from http.cookies import SimpleCookie, Morsel
-import aiofiles
-import aiofiles.os
-import re
 
 # Workaround for adding samesite support to pre 3.8 python
 Morsel._reserved["samesite"] = "SameSite"
@@ -67,16 +68,28 @@ class BadRequest(Base400):
     status = 400
 
 
+class PayloadTooLarge(Base400):
+    status = 413
+
+
 SAMESITE_VALUES = ("strict", "lax", "none")
 
+# Bodies read fully into memory (post_body/post_vars/json) are capped at this
+# size unless the max_post_body_bytes setting says otherwise. Kept deliberately
+# far below multipart's DEFAULT_MAX_REQUEST_SIZE: that parser streams to disk,
+# while these bodies are held in RAM and json.loads() can multiply their
+# footprint several times over.
+DEFAULT_MAX_POST_BODY_BYTES = 2 * 1024 * 1024  # 2MB
+
 
 class Request:
-    def __init__(self, scope, receive):
+    def __init__(self, scope, receive, max_post_body_bytes=DEFAULT_MAX_POST_BODY_BYTES):
         self.scope = scope
         self.receive = receive
+        self.max_post_body_bytes = max_post_body_bytes
 
     def __repr__(self):
-        return '<asgi.Request method="{}" url="{}">'.format(self.method, self.url)
+        return f'<asgi.Request method="{self.method}" url="{self.url}">'
 
     @property
     def method(self):
@@ -141,15 +154,43 @@ class Request:
     def actor(self):
         return self.scope.get("actor", None)
 
-    async def post_body(self):
-        body = b""
+    async def post_body(self, max_bytes=None):
+        """
+        Read the request body fully into memory.
+
+        The body is capped at max_bytes - or self.max_post_body_bytes
+        (default 2MB, set from the max_post_body_bytes setting for requests
+        created by Datasette) if max_bytes is not provided. Pass max_bytes=0
+        to disable the limit. Raises PayloadTooLarge (HTTP 413) if exceeded -
+        oversized bodies are rejected as soon as the limit is passed, without
+        buffering the rest.
+        """
+        if max_bytes is None:
+            max_bytes = self.max_post_body_bytes
+        too_large = PayloadTooLarge(
+            f"Request body exceeded maximum size of {max_bytes} bytes"
+        )
+        if max_bytes:
+            # Reject early if the client declares an oversized body
+            try:
+                if int(self.headers.get("content-length", "")) > max_bytes:
+                    raise too_large
+            except ValueError:
+                # Missing or malformed - the streaming check below still applies
+                pass
+        chunks = []
+        received = 0
         more_body = True
         while more_body:
             message = await self.receive()
             assert message["type"] == "http.request", message
-            body += message.get("body", b"")
+            chunk = message.get("body", b"")
+            received += len(chunk)
+            if max_bytes and received > max_bytes:
+                raise too_large
+            chunks.append(chunk)
             more_body = message.get("more_body", False)
-        return body
+        return b"".join(chunks)
 
     async def post_vars(self):
         body = await self.post_body()
@@ -166,7 +207,7 @@ class Request:
         max_request_size: int = DEFAULT_MAX_REQUEST_SIZE,
         max_fields: int = DEFAULT_MAX_FIELDS,
         max_files: int = DEFAULT_MAX_FILES,
-        max_parts: Optional[int] = DEFAULT_MAX_PARTS,
+        max_parts: int | None = DEFAULT_MAX_PARTS,
         max_field_size: int = DEFAULT_MAX_FIELD_SIZE,
         max_memory_file_size: int = DEFAULT_MAX_MEMORY_FILE_SIZE,
         max_part_header_bytes: int = DEFAULT_MAX_PART_HEADER_BYTES,
@@ -397,6 +438,9 @@ async def asgi_send_file(
             )
 
 
+HASHED_STATIC_CACHE_CONTROL = "max-age=31536000, immutable, public"
+
+
 def asgi_static(root_path, chunk_size=4096, headers=None, content_type=None):
     root_path = Path(root_path)
     static_headers = {}
@@ -423,11 +467,17 @@ def asgi_static(root_path, chunk_size=4096, headers=None, content_type=None):
             return
         try:
             # Calculate ETag for filepath
+            hash_value = request.args.get("_hash")
+            if (
+                hash_value
+                and hash_value == sha256_file(full_path, chunk_size=chunk_size)[:12]
+            ):
+                headers["Cache-Control"] = HASHED_STATIC_CACHE_CONTROL
             etag = await calculate_etag(full_path, chunk_size=chunk_size)
             headers["ETag"] = etag
             if_none_match = request.headers.get("if-none-match")
             if if_none_match and if_none_match == etag:
-                return await asgi_send(send, "", 304)
+                return await asgi_send(send, "", 304, headers=headers)
             await asgi_send_file(
                 send, full_path, chunk_size=chunk_size, headers=headers
             )
@@ -480,9 +530,9 @@ class Response:
         httponly=False,
         samesite="lax",
     ):
-        assert samesite in SAMESITE_VALUES, "samesite should be one of {}".format(
-            SAMESITE_VALUES
-        )
+        assert (
+            samesite in SAMESITE_VALUES
+        ), f"samesite should be one of {SAMESITE_VALUES}"
         cookie = SimpleCookie()
         cookie[key] = value
         for prop_name, prop_value in (
@@ -526,6 +576,18 @@ class Response:
             content_type="application/json; charset=utf-8",
         )
 
+    @classmethod
+    def error(cls, messages, status=400, headers=None):
+        """
+        A JSON error response using Datasette's standard error format.
+
+        messages can be a single string or a list of strings. For errors
+        that should content-negotiate between JSON and HTML, raise
+        Forbidden, NotFound, BadRequest or DatasetteError instead and let
+        Datasette's error handling hooks build the response.
+        """
+        return cls.json(error_body(messages, status), status=status, headers=headers)
+
     @classmethod
     def redirect(cls, path, status=302, headers=None):
         headers = headers or {}
diff --git a/datasette/utils/baseconv.py b/datasette/utils/baseconv.py
index c4b64908..0469d7a8 100644
--- a/datasette/utils/baseconv.py
+++ b/datasette/utils/baseconv.py
@@ -13,7 +13,7 @@ Originally shared here: https://www.djangosnippets.org/snippets/1431/
 """
 
 
-class BaseConverter(object):
+class BaseConverter:
     decimal_digits = "0123456789"
 
     def __init__(self, digits):
diff --git a/datasette/utils/check_callable.py b/datasette/utils/check_callable.py
index a0997d20..e21a769b 100644
--- a/datasette/utils/check_callable.py
+++ b/datasette/utils/check_callable.py
@@ -1,6 +1,6 @@
 import inspect
 import types
-from typing import NamedTuple, Any
+from typing import Any, NamedTuple
 
 
 class CallableStatus(NamedTuple):
@@ -19,7 +19,7 @@ def check_callable(obj: Any) -> CallableStatus:
     if isinstance(obj, types.FunctionType):
         return CallableStatus(True, inspect.iscoroutinefunction(obj))
 
-    if hasattr(obj, "__call__"):
+    if callable(obj):
         return CallableStatus(True, inspect.iscoroutinefunction(obj.__call__))
 
-    assert False, "obj {} is somehow callable with no __call__ method".format(repr(obj))
+    assert False, f"obj {obj!r} is somehow callable with no __call__ method"
diff --git a/datasette/utils/internal_db.py b/datasette/utils/internal_db.py
index bf172667..0ddeb847 100644
--- a/datasette/utils/internal_db.py
+++ b/datasette/utils/internal_db.py
@@ -1,9 +1,30 @@
 import textwrap
-from datasette.utils import table_column_details
 
+from sqlite_utils import Database as SQLiteUtilsDatabase
+from sqlite_utils import Migrations
 
-async def init_internal_db(db):
-    create_tables_sql = textwrap.dedent("""
+from datasette.utils import escape_sqlite, table_column_details
+
+INTERNAL_DB_SCHEMA_TABLES = {
+    "catalog_databases",
+    "catalog_tables",
+    "catalog_views",
+    "catalog_columns",
+    "catalog_indexes",
+    "catalog_foreign_keys",
+    "metadata_instance",
+    "metadata_databases",
+    "metadata_resources",
+    "metadata_columns",
+    "column_types",
+    "queries",
+}
+
+INTERNAL_DB_SCHEMA_INDEXES = {
+    "queries_owner_idx",
+}
+
+INTERNAL_DB_SCHEMA_SQL = textwrap.dedent("""
     CREATE TABLE IF NOT EXISTS catalog_databases (
         database_name TEXT PRIMARY KEY,
         path TEXT,
@@ -67,99 +88,101 @@ async def init_internal_db(db):
         FOREIGN KEY (database_name) REFERENCES catalog_databases(database_name),
         FOREIGN KEY (database_name, table_name) REFERENCES catalog_tables(database_name, table_name)
     );
+
+    CREATE TABLE IF NOT EXISTS metadata_instance (
+        key text,
+        value text,
+        unique(key)
+    );
+
+    CREATE TABLE IF NOT EXISTS metadata_databases (
+        database_name text,
+        key text,
+        value text,
+        unique(database_name, key)
+    );
+
+    CREATE TABLE IF NOT EXISTS metadata_resources (
+        database_name text,
+        resource_name text,
+        key text,
+        value text,
+        unique(database_name, resource_name, key)
+    );
+
+    CREATE TABLE IF NOT EXISTS metadata_columns (
+        database_name text,
+        resource_name text,
+        column_name text,
+        key text,
+        value text,
+        unique(database_name, resource_name, column_name, key)
+    );
+
+    CREATE TABLE IF NOT EXISTS column_types (
+        database_name TEXT NOT NULL,
+        resource_name TEXT NOT NULL,
+        column_name TEXT NOT NULL,
+        column_type TEXT NOT NULL,
+        config TEXT,
+        PRIMARY KEY (database_name, resource_name, column_name)
+    );
+
+    CREATE TABLE IF NOT EXISTS queries (
+        database_name TEXT NOT NULL,
+        name TEXT NOT NULL,
+        sql TEXT NOT NULL,
+        title TEXT,
+        description TEXT,
+        description_html TEXT,
+        options TEXT NOT NULL DEFAULT '{}',
+        parameters TEXT NOT NULL DEFAULT '[]',
+        is_write INTEGER NOT NULL DEFAULT 0 CHECK (is_write IN (0, 1)),
+        is_private INTEGER NOT NULL DEFAULT 0 CHECK (is_private IN (0, 1)),
+        is_trusted INTEGER NOT NULL DEFAULT 0 CHECK (is_trusted IN (0, 1)),
+        source TEXT NOT NULL DEFAULT 'user',
+        owner_id TEXT,
+        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        PRIMARY KEY (database_name, name)
+    );
+
+    CREATE INDEX IF NOT EXISTS queries_owner_idx
+        ON queries(owner_id);
     """).strip()
-    await db.execute_write_script(create_tables_sql)
-    await initialize_metadata_tables(db)
 
 
-async def initialize_metadata_tables(db):
-    await db.execute_write_script(textwrap.dedent("""
-        CREATE TABLE IF NOT EXISTS metadata_instance (
-            key text,
-            value text,
-            unique(key)
-        );
-
-        CREATE TABLE IF NOT EXISTS metadata_databases (
-            database_name text,
-            key text,
-            value text,
-            unique(database_name, key)
-        );
-
-        CREATE TABLE IF NOT EXISTS metadata_resources (
-            database_name text,
-            resource_name text,
-            key text,
-            value text,
-            unique(database_name, resource_name, key)
-        );
-
-        CREATE TABLE IF NOT EXISTS metadata_columns (
-            database_name text,
-            resource_name text,
-            column_name text,
-            key text,
-            value text,
-            unique(database_name, resource_name, column_name, key)
-        );
-
-        CREATE TABLE IF NOT EXISTS column_types (
-            database_name TEXT NOT NULL,
-            resource_name TEXT NOT NULL,
-            column_name TEXT NOT NULL,
-            column_type TEXT NOT NULL,
-            config TEXT,
-            PRIMARY KEY (database_name, resource_name, column_name)
-        );
-
-        CREATE TABLE IF NOT EXISTS queries (
-            database_name TEXT NOT NULL,
-            name TEXT NOT NULL,
-            sql TEXT NOT NULL,
-            title TEXT,
-            description TEXT,
-            description_html TEXT,
-            options TEXT NOT NULL DEFAULT '{}',
-            parameters TEXT NOT NULL DEFAULT '[]',
-            is_write INTEGER NOT NULL DEFAULT 0 CHECK (is_write IN (0, 1)),
-            is_private INTEGER NOT NULL DEFAULT 0 CHECK (is_private IN (0, 1)),
-            is_trusted INTEGER NOT NULL DEFAULT 0 CHECK (is_trusted IN (0, 1)),
-            source TEXT NOT NULL DEFAULT 'user',
-            owner_id TEXT,
-            created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
-            updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
-            PRIMARY KEY (database_name, name)
-        );
-
-        CREATE INDEX IF NOT EXISTS queries_owner_idx
-            ON queries(owner_id);
-            """))
+internal_migrations = Migrations("datasette_internal")
 
 
-async def populate_schema_tables(internal_db, db):
+def _internal_schema_exists(db):
+    table_names = set(db.table_names())
+    if not INTERNAL_DB_SCHEMA_TABLES.issubset(table_names):
+        return False
+    index_names = {
+        row[0]
+        for row in db.execute("select name from sqlite_master where type = 'index'")
+    }
+    return INTERNAL_DB_SCHEMA_INDEXES.issubset(index_names)
+
+
+@internal_migrations(name="0001_initial")
+def initial_internal_schema(db):
+    if _internal_schema_exists(db):
+        return
+    db.executescript(INTERNAL_DB_SCHEMA_SQL)
+
+
+async def init_internal_db(db):
+    def apply_migrations(conn):
+        internal_migrations.apply(SQLiteUtilsDatabase(conn, execute_plugins=False))
+
+    await db.execute_write_fn(apply_migrations, transaction=False)
+
+
+async def populate_schema_tables(internal_db, db, schema_version):
     database_name = db.name
 
-    def delete_everything(conn):
-        conn.execute(
-            "DELETE FROM catalog_tables WHERE database_name = ?", [database_name]
-        )
-        conn.execute(
-            "DELETE FROM catalog_views WHERE database_name = ?", [database_name]
-        )
-        conn.execute(
-            "DELETE FROM catalog_columns WHERE database_name = ?", [database_name]
-        )
-        conn.execute(
-            "DELETE FROM catalog_foreign_keys WHERE database_name = ?",
-            [database_name],
-        )
-        conn.execute(
-            "DELETE FROM catalog_indexes WHERE database_name = ?", [database_name]
-        )
-
-    await internal_db.execute_write_fn(delete_everything)
-
     tables = (await db.execute("select * from sqlite_master WHERE type = 'table'")).rows
     views = (await db.execute("select * from sqlite_master WHERE type = 'view'")).rows
 
@@ -184,25 +207,30 @@ async def populate_schema_tables(internal_db, db):
             columns = table_column_details(conn, table_name)
             columns_to_insert.extend(
                 {
-                    **{"database_name": database_name, "table_name": table_name},
+                    "database_name": database_name,
+                    "table_name": table_name,
                     **column._asdict(),
                 }
                 for column in columns
             )
             foreign_keys = conn.execute(
-                f"PRAGMA foreign_key_list([{table_name}])"
+                f"PRAGMA foreign_key_list({escape_sqlite(table_name)})"
             ).fetchall()
             foreign_keys_to_insert.extend(
                 {
-                    **{"database_name": database_name, "table_name": table_name},
+                    "database_name": database_name,
+                    "table_name": table_name,
                     **dict(foreign_key),
                 }
                 for foreign_key in foreign_keys
             )
-            indexes = conn.execute(f"PRAGMA index_list([{table_name}])").fetchall()
+            indexes = conn.execute(
+                f"PRAGMA index_list({escape_sqlite(table_name)})"
+            ).fetchall()
             indexes_to_insert.extend(
                 {
-                    **{"database_name": database_name, "table_name": table_name},
+                    "database_name": database_name,
+                    "table_name": table_name,
                     **dict(index),
                 }
                 for index in indexes
@@ -223,47 +251,76 @@ async def populate_schema_tables(internal_db, db):
         indexes_to_insert,
     ) = await db.execute_fn(collect_info)
 
-    await internal_db.execute_write_many(
-        """
-        INSERT INTO catalog_tables (database_name, table_name, rootpage, sql)
-        values (?, ?, ?, ?)
-    """,
-        tables_to_insert,
-    )
-    await internal_db.execute_write_many(
-        """
-        INSERT INTO catalog_views (database_name, view_name, rootpage, sql)
-        values (?, ?, ?, ?)
-    """,
-        views_to_insert,
-    )
-    await internal_db.execute_write_many(
-        """
-        INSERT INTO catalog_columns (
-            database_name, table_name, cid, name, type, "notnull", default_value, is_pk, hidden
-        ) VALUES (
-            :database_name, :table_name, :cid, :name, :type, :notnull, :default_value, :is_pk, :hidden
+    def replace_catalog(conn):
+        # Delete child rows before their catalog_tables parents so this also
+        # works if a prepare_connection plugin enables foreign key enforcement.
+        for table in (
+            "catalog_columns",
+            "catalog_foreign_keys",
+            "catalog_indexes",
+            "catalog_views",
+            "catalog_tables",
+        ):
+            conn.execute(
+                f"DELETE FROM {table} WHERE database_name = ?",
+                [database_name],
+            )
+        conn.execute(
+            """
+            INSERT OR REPLACE INTO catalog_databases (
+                database_name, path, is_memory, schema_version
+            ) VALUES (?, ?, ?, ?)
+            """,
+            [
+                database_name,
+                str(db.path) if db.path is not None else None,
+                db.is_memory,
+                schema_version,
+            ],
         )
-    """,
-        columns_to_insert,
-    )
-    await internal_db.execute_write_many(
-        """
-        INSERT INTO catalog_foreign_keys (
-            database_name, table_name, "id", seq, "table", "from", "to", on_update, on_delete, match
-        ) VALUES (
-            :database_name, :table_name, :id, :seq, :table, :from, :to, :on_update, :on_delete, :match
+        conn.executemany(
+            """
+            INSERT INTO catalog_tables (database_name, table_name, rootpage, sql)
+            values (?, ?, ?, ?)
+            """,
+            tables_to_insert,
         )
-    """,
-        foreign_keys_to_insert,
-    )
-    await internal_db.execute_write_many(
-        """
-        INSERT INTO catalog_indexes (
-            database_name, table_name, seq, name, "unique", origin, partial
-        ) VALUES (
-            :database_name, :table_name, :seq, :name, :unique, :origin, :partial
+        conn.executemany(
+            """
+            INSERT INTO catalog_views (database_name, view_name, rootpage, sql)
+            values (?, ?, ?, ?)
+            """,
+            views_to_insert,
         )
-    """,
-        indexes_to_insert,
-    )
+        conn.executemany(
+            """
+            INSERT INTO catalog_columns (
+                database_name, table_name, cid, name, type, "notnull", default_value, is_pk, hidden
+            ) VALUES (
+                :database_name, :table_name, :cid, :name, :type, :notnull, :default_value, :is_pk, :hidden
+            )
+            """,
+            columns_to_insert,
+        )
+        conn.executemany(
+            """
+            INSERT INTO catalog_foreign_keys (
+                database_name, table_name, "id", seq, "table", "from", "to", on_update, on_delete, match
+            ) VALUES (
+                :database_name, :table_name, :id, :seq, :table, :from, :to, :on_update, :on_delete, :match
+            )
+            """,
+            foreign_keys_to_insert,
+        )
+        conn.executemany(
+            """
+            INSERT INTO catalog_indexes (
+                database_name, table_name, seq, name, "unique", origin, partial
+            ) VALUES (
+                :database_name, :table_name, :seq, :name, :unique, :origin, :partial
+            )
+            """,
+            indexes_to_insert,
+        )
+
+    await internal_db.execute_write_fn(replace_catalog)
diff --git a/datasette/utils/multipart.py b/datasette/utils/multipart.py
index cfa77486..13289b1c 100644
--- a/datasette/utils/multipart.py
+++ b/datasette/utils/multipart.py
@@ -11,15 +11,10 @@ Supports:
 import asyncio
 import shutil
 import tempfile
+from collections.abc import Callable
 from dataclasses import dataclass, field
 from typing import (
     Any,
-    Callable,
-    Dict,
-    List,
-    Optional,
-    Tuple,
-    Union,
 )
 from urllib.parse import parse_qsl
 
@@ -29,7 +24,7 @@ DEFAULT_MAX_REQUEST_SIZE = 100 * 1024 * 1024  # 100MB
 DEFAULT_MAX_FIELDS = 1000
 DEFAULT_MAX_FILES = 100
 # If max_parts is not specified, it defaults to max_fields + max_files
-DEFAULT_MAX_PARTS: Optional[int] = None
+DEFAULT_MAX_PARTS: int | None = None
 DEFAULT_MAX_FIELD_SIZE = 100 * 1024  # 100KB
 DEFAULT_MAX_MEMORY_FILE_SIZE = 1024 * 1024  # 1MB
 DEFAULT_MAX_PART_HEADER_BYTES = 16 * 1024  # 16KB
@@ -40,8 +35,6 @@ DEFAULT_MIN_FREE_DISK_BYTES = 50 * 1024 * 1024  # 50MB
 class MultipartParseError(Exception):
     """Raised when multipart parsing fails."""
 
-    pass
-
 
 @dataclass
 class UploadedFile:
@@ -57,7 +50,7 @@ class UploadedFile:
 
     name: str
     filename: str
-    content_type: Optional[str]
+    content_type: str | None
     size: int
     _file: tempfile.SpooledTemporaryFile = field(repr=False)
 
@@ -86,7 +79,8 @@ class UploadedFile:
     def __del__(self):
         try:
             self._file.close()
-        except Exception:
+        except Exception:  # noqa: BLE001, S110
+            # __del__ must never raise
             pass
 
 
@@ -98,27 +92,27 @@ class FormData:
     """
 
     def __init__(self):
-        self._data: List[Tuple[str, Union[str, UploadedFile]]] = []
+        self._data: list[tuple[str, str | UploadedFile]] = []
 
-    def append(self, key: str, value: Union[str, UploadedFile]) -> None:
+    def append(self, key: str, value: str | UploadedFile) -> None:
         """Add a key-value pair."""
         self._data.append((key, value))
 
-    def __getitem__(self, key: str) -> Union[str, UploadedFile]:
+    def __getitem__(self, key: str) -> str | UploadedFile:
         """Get the first value for a key."""
         for k, v in self._data:
             if k == key:
                 return v
         raise KeyError(key)
 
-    def get(self, key: str, default: Any = None) -> Optional[Union[str, UploadedFile]]:
+    def get(self, key: str, default: Any = None) -> str | UploadedFile | None:
         """Get the first value for a key, or default if not found."""
         try:
             return self[key]
         except KeyError:
             return default
 
-    def getlist(self, key: str) -> List[Union[str, UploadedFile]]:
+    def getlist(self, key: str) -> list[str | UploadedFile]:
         """Get all values for a key."""
         return [v for k, v in self._data if k == key]
 
@@ -142,15 +136,15 @@ class FormData:
         """Return unique keys."""
         return list(self)
 
-    def items(self) -> List[Tuple[str, Union[str, UploadedFile]]]:
+    def items(self) -> list[tuple[str, str | UploadedFile]]:
         """Return all key-value pairs."""
         return list(self._data)
 
-    def values(self) -> List[Union[str, UploadedFile]]:
+    def values(self) -> list[str | UploadedFile]:
         """Return all values."""
         return [v for _, v in self._data]
 
-    def _uploaded_files(self) -> List[UploadedFile]:
+    def _uploaded_files(self) -> list[UploadedFile]:
         """Return UploadedFile instances contained in this form."""
         return [v for _, v in self._data if isinstance(v, UploadedFile)]
 
@@ -163,7 +157,7 @@ class FormData:
         for uploaded in self._uploaded_files():
             try:
                 uploaded.close_sync()
-            except Exception:
+            except Exception:  # noqa: BLE001, S110
                 # Best-effort cleanup; ignore close errors
                 pass
 
@@ -172,7 +166,7 @@ class FormData:
         for uploaded in self._uploaded_files():
             try:
                 await uploaded.close()
-            except Exception:
+            except Exception:  # noqa: BLE001, S110
                 # Best-effort cleanup; ignore close errors
                 pass
 
@@ -189,13 +183,13 @@ class FormData:
         await self.aclose()
 
 
-def parse_content_disposition(header: str) -> Dict[str, Optional[str]]:
+def parse_content_disposition(header: str) -> dict[str, str | None]:
     """
     Parse Content-Disposition header value.
 
     Returns dict with 'name', 'filename' keys (filename may be None).
     """
-    result: Dict[str, Optional[str]] = {"name": None, "filename": None}
+    result: dict[str, str | None] = {"name": None, "filename": None}
 
     # Split on semicolons, handling quoted strings
     parts = []
@@ -238,7 +232,8 @@ def parse_content_disposition(header: str) -> Dict[str, Optional[str]]:
                         from urllib.parse import unquote
 
                         result["filename"] = unquote(encoded, encoding="utf-8")
-                    except Exception:
+                    except Exception:  # noqa: BLE001, S110
+                        # Malformed RFC 5987 filename* - fall back to the plain filename
                         pass
             continue
 
@@ -250,20 +245,19 @@ def parse_content_disposition(header: str) -> Dict[str, Optional[str]]:
 
         if key == "name":
             result["name"] = value
-        elif key == "filename":
-            # Only set if filename* hasn't already set it
-            if result["filename"] is None:
-                # Strip path components (security)
-                # Handle both Unix and Windows paths
-                value = value.replace("\\", "/")
-                if "/" in value:
-                    value = value.rsplit("/", 1)[-1]
-                result["filename"] = value
+        # Only set filename if filename* hasn't already set it
+        elif key == "filename" and result["filename"] is None:
+            # Strip path components (security)
+            # Handle both Unix and Windows paths
+            value = value.replace("\\", "/")
+            if "/" in value:
+                value = value.rsplit("/", 1)[-1]
+            result["filename"] = value
 
     return result
 
 
-def parse_content_type(header: str) -> Tuple[str, Dict[str, str]]:
+def parse_content_type(header: str) -> tuple[str, dict[str, str]]:
     """
     Parse Content-Type header value.
 
@@ -307,7 +301,7 @@ class MultipartParser:
         max_request_size: int = DEFAULT_MAX_REQUEST_SIZE,
         max_fields: int = DEFAULT_MAX_FIELDS,
         max_files: int = DEFAULT_MAX_FILES,
-        max_parts: Optional[int] = DEFAULT_MAX_PARTS,
+        max_parts: int | None = DEFAULT_MAX_PARTS,
         max_field_size: int = DEFAULT_MAX_FIELD_SIZE,
         max_memory_file_size: int = DEFAULT_MAX_MEMORY_FILE_SIZE,
         max_part_header_bytes: int = DEFAULT_MAX_PART_HEADER_BYTES,
@@ -348,12 +342,12 @@ class MultipartParser:
         self._tempdir = tempfile.gettempdir()
 
         # Current part state
-        self.current_headers: Dict[str, str] = {}
-        self.current_file: Optional[tempfile.SpooledTemporaryFile] = None
+        self.current_headers: dict[str, str] = {}
+        self.current_file: tempfile.SpooledTemporaryFile | None = None
         self.current_body = bytearray()
-        self.current_name: Optional[str] = None
-        self.current_filename: Optional[str] = None
-        self.current_content_type: Optional[str] = None
+        self.current_name: str | None = None
+        self.current_filename: str | None = None
+        self.current_content_type: str | None = None
 
     def feed(self, chunk: bytes) -> None:
         """Feed a chunk of data to the parser."""
@@ -454,7 +448,7 @@ class MultipartParser:
             # Parse header
             try:
                 line_str = line.decode("utf-8", errors="replace")
-            except Exception:
+            except UnicodeDecodeError:
                 line_str = line.decode("latin-1")
 
             if ":" in line_str:
@@ -481,7 +475,9 @@ class MultipartParser:
             if self.file_count > self.max_files:
                 raise MultipartParseError("Too many files")
             if self.handle_files:
-                self.current_file = tempfile.SpooledTemporaryFile(
+                # Outlives this method - it is filled in across parser callbacks
+                # and then handed to the UploadedFile the caller consumes
+                self.current_file = tempfile.SpooledTemporaryFile(  # noqa: SIM115
                     max_size=self.max_memory_file_size
                 )
             else:
@@ -644,7 +640,7 @@ async def parse_form_data(
     max_request_size: int = DEFAULT_MAX_REQUEST_SIZE,
     max_fields: int = DEFAULT_MAX_FIELDS,
     max_files: int = DEFAULT_MAX_FILES,
-    max_parts: Optional[int] = DEFAULT_MAX_PARTS,
+    max_parts: int | None = DEFAULT_MAX_PARTS,
     max_field_size: int = DEFAULT_MAX_FIELD_SIZE,
     max_memory_file_size: int = DEFAULT_MAX_MEMORY_FILE_SIZE,
     max_part_header_bytes: int = DEFAULT_MAX_PART_HEADER_BYTES,
diff --git a/datasette/utils/permissions.py b/datasette/utils/permissions.py
index fd1e41a1..5a8ee8e2 100644
--- a/datasette/utils/permissions.py
+++ b/datasette/utils/permissions.py
@@ -2,8 +2,9 @@
 from __future__ import annotations
 
 import json
-from typing import Any, Dict, Iterable, List, Sequence, Tuple
 import sqlite3
+from collections.abc import Iterable, Sequence
+from typing import Any
 
 from datasette.permissions import PermissionSQL
 from datasette.plugins import pm
@@ -15,7 +16,7 @@ SKIP_PERMISSION_CHECKS = object()
 
 async def gather_permission_sql_from_hooks(
     *, datasette, actor: dict | None, action: str
-) -> List[PermissionSQL] | object:
+) -> list[PermissionSQL] | object:
     """Collect PermissionSQL objects from the permission_resources_sql hook.
 
     Ensures that each returned PermissionSQL has a populated ``source``.
@@ -34,7 +35,7 @@ async def gather_permission_sql_from_hooks(
     hookimpls = hook_caller.get_hookimpls()
     hook_results = list(hook_caller(datasette=datasette, actor=actor, action=action))
 
-    collected: List[PermissionSQL] = []
+    collected: list[PermissionSQL] = []
     actor_json = json.dumps(actor) if actor is not None else None
     actor_id = actor.get("id") if isinstance(actor, dict) else None
 
@@ -71,7 +72,7 @@ def _iter_permission_sql_from_result(
     if isinstance(result, PermissionSQL):
         return [result]
     if isinstance(result, (list, tuple)):
-        collected: List[PermissionSQL] = []
+        collected: list[PermissionSQL] = []
         for item in result:
             collected.extend(_iter_permission_sql_from_result(item, action=action))
         return collected
@@ -90,7 +91,7 @@ def _iter_permission_sql_from_result(
 
 def build_rules_union(
     actor: dict | None, plugins: Sequence[PermissionSQL]
-) -> Tuple[str, Dict[str, Any]]:
+) -> tuple[str, dict[str, Any]]:
     """
     Compose plugin SQL into a UNION ALL.
 
@@ -102,10 +103,10 @@ def build_rules_union(
     The system reserves these parameter names: :actor, :actor_id, :action, :filter_parent
     Plugin parameters should be prefixed with a unique identifier (e.g., source name).
     """
-    parts: List[str] = []
+    parts: list[str] = []
     actor_json = json.dumps(actor) if actor else None
     actor_id = actor.get("id") if actor else None
-    params: Dict[str, Any] = {"actor": actor_json, "actor_id": actor_id}
+    params: dict[str, Any] = {"actor": actor_json, "actor_id": actor_id}
 
     for p in plugins:
         # No namespacing - just use plugin params as-is
@@ -141,10 +142,10 @@ async def resolve_permissions_from_catalog(
     plugins: Sequence[Any],
     action: str,
     candidate_sql: str,
-    candidate_params: Dict[str, Any] | None = None,
+    candidate_params: dict[str, Any] | None = None,
     *,
     implicit_deny: bool = True,
-) -> List[Dict[str, Any]]:
+) -> list[dict[str, Any]]:
     """
     Resolve permissions by embedding the provided *candidate_sql* in a CTE.
 
@@ -168,8 +169,8 @@ async def resolve_permissions_from_catalog(
       - parent, child, allow, reason, source_plugin, depth
       - resource (rendered "/parent/child" or "/parent" or "/")
     """
-    resolved_plugins: List[PermissionSQL] = []
-    restriction_sqls: List[str] = []
+    resolved_plugins: list[PermissionSQL] = []
+    restriction_sqls: list[str] = []
 
     for plugin in plugins:
         if callable(plugin) and not isinstance(plugin, PermissionSQL):
@@ -398,11 +399,11 @@ async def resolve_permissions_with_candidates(
     db,
     actor: dict | None,
     plugins: Sequence[Any],
-    candidates: List[Tuple[str, str | None]],
+    candidates: list[tuple[str, str | None]],
     action: str,
     *,
     implicit_deny: bool = True,
-) -> List[Dict[str, Any]]:
+) -> list[dict[str, Any]]:
     """
     Resolve permissions without any external candidate table by embedding
     the candidates as a UNION of parameterized SELECTs in a CTE.
@@ -411,8 +412,8 @@ async def resolve_permissions_with_candidates(
     actor: actor dict (or None), made available as :actor (JSON), :actor_id, and :action
     """
     # Build a small CTE for candidates.
-    cand_rows_sql: List[str] = []
-    cand_params: Dict[str, Any] = {}
+    cand_rows_sql: list[str] = []
+    cand_params: dict[str, Any] = {}
     for i, (parent, child) in enumerate(candidates):
         pkey = f"cand_p_{i}"
         ckey = f"cand_c_{i}"
diff --git a/datasette/utils/shutil_backport.py b/datasette/utils/shutil_backport.py
index d1fd1bd7..d323f5d6 100644
--- a/datasette/utils/shutil_backport.py
+++ b/datasette/utils/shutil_backport.py
@@ -6,7 +6,7 @@ https://github.com/python/cpython/blob/v3.8.3/LICENSE
 """
 
 import os
-from shutil import copy, copy2, copystat, Error
+from shutil import Error, copy, copy2, copystat
 
 
 def _copytree(
diff --git a/datasette/utils/sql_analysis.py b/datasette/utils/sql_analysis.py
index 0a3a947c..334545bd 100644
--- a/datasette/utils/sql_analysis.py
+++ b/datasette/utils/sql_analysis.py
@@ -150,7 +150,6 @@ _SQLITE_INTERNAL_SCHEMA_FUNCTIONS = {
     "sqlite_rename_test",
     "substr",
 }
-
 _AUTHORIZER_ACTION_NAMES = {
     getattr(sqlite3, name): name
     for name in (
@@ -391,6 +390,10 @@ def analyze_sql_tables(
             )
             return sqlite3.SQLITE_OK
 
+        if action == sqlite3.SQLITE_RECURSIVE:
+            # Recursive CTE bookkeeping; table reads are reported separately.
+            return sqlite3.SQLITE_OK
+
         if action == sqlite3.SQLITE_FUNCTION and arg2 is not None:
             record(
                 "function",
@@ -410,12 +413,12 @@ def analyze_sql_tables(
                 database=None,
                 table=None,
                 sqlite_schema=sqlite_schema,
-                target="{} {}".format(arg1, arg2) if arg2 is not None else arg1,
+                target=f"{arg1} {arg2}" if arg2 is not None else arg1,
                 source=source,
             )
             return sqlite3.SQLITE_OK
 
-        action_name = _AUTHORIZER_ACTION_NAMES.get(action, "SQLITE_{}".format(action))
+        action_name = _AUTHORIZER_ACTION_NAMES.get(action, f"SQLITE_{action}")
         record(
             "unknown",
             "unknown",
@@ -485,17 +488,17 @@ def analyze_sql_tables(
         and key.operation in {"create", "alter", "drop"}
         for key in operations
     )
-    dropped_tables = {
+    dropped_tables_and_views = {
         (key.database, key.table)
         for key in operations
-        if key.operation == "drop" and key.target_type == "table"
+        if key.operation == "drop" and key.target_type in {"table", "view"}
     }
 
     def key_is_drop_table_delete(key: OperationKey) -> bool:
         return (
             key.operation == "delete"
             and key.target_type == "table"
-            and (key.database, key.table) in dropped_tables
+            and (key.database, key.table) in dropped_tables_and_views
         )
 
     has_user_table_access_in_schema_operation = any(
@@ -518,9 +521,7 @@ def analyze_sql_tables(
             and key.target in _SQLITE_INTERNAL_SCHEMA_FUNCTIONS
         ):
             return True
-        if key_is_drop_table_delete(key):
-            return True
-        return False
+        return bool(key_is_drop_table_delete(key))
 
     def table_kind_for(key: OperationKey) -> SQLiteTableType | None:
         if (
diff --git a/datasette/utils/sqlite.py b/datasette/utils/sqlite.py
index 4743ae4c..d3926f6f 100644
--- a/datasette/utils/sqlite.py
+++ b/datasette/utils/sqlite.py
@@ -100,7 +100,7 @@ def sqlite_hidden_table_names(conn, *, schema: str | None = "main") -> list[str]
     schema_table = _sqlite_schema_table(schema)
     try:
         rows = conn.execute(
-            "select name, sql from {} where type = 'table'".format(schema_table)
+            f"select name, sql from {schema_table} where type = 'table'"
         ).fetchall()
     except sqlite3.DatabaseError:
         return []
@@ -127,7 +127,7 @@ def _sqlite_table_type_from_schema(
     schema_table = _sqlite_schema_table(schema)
     try:
         row = conn.execute(
-            "select type, sql from {} where name = ?".format(schema_table),
+            f"select type, sql from {schema_table} where name = ?",
             (table,),
         ).fetchone()
     except sqlite3.DatabaseError:
@@ -155,7 +155,7 @@ def _is_known_shadow_table(
     schema_table = _sqlite_schema_table(schema)
     try:
         rows = conn.execute(
-            "select name, sql from {} where type = 'table'".format(schema_table)
+            f"select name, sql from {schema_table} where type = 'table'"
         ).fetchall()
     except sqlite3.DatabaseError:
         return False
@@ -174,7 +174,7 @@ def _sqlite_schema_table(schema: str | None) -> str:
         return "sqlite_master"
     if schema == "temp":
         return "sqlite_temp_master"
-    return "{}.sqlite_master".format(_quote_identifier(schema))
+    return f"{_quote_identifier(schema)}.sqlite_master"
 
 
 def _quote_identifier(value: str) -> str:
diff --git a/datasette/utils/testing.py b/datasette/utils/testing.py
index de7e94af..a8be47bf 100644
--- a/datasette/utils/testing.py
+++ b/datasette/utils/testing.py
@@ -1,6 +1,7 @@
-from asgiref.sync import async_to_sync
-from urllib.parse import urlencode
 import json
+from urllib.parse import urlencode
+
+from asgiref.sync import async_to_sync
 
 # These wrapper classes pre-date the introduction of
 # datasette.client and httpx to Datasette. They could
diff --git a/datasette/version.py b/datasette/version.py
index 12fa170e..8e238ab5 100644
--- a/datasette/version.py
+++ b/datasette/version.py
@@ -1,2 +1,2 @@
-__version__ = "1.0a34"
+__version__ = "1.0a37"
 __version_info__ = tuple(__version__.split("."))
diff --git a/datasette/views/__init__.py b/datasette/views/__init__.py
index 88106737..bac3b39e 100644
--- a/datasette/views/__init__.py
+++ b/datasette/views/__init__.py
@@ -1,2 +1,87 @@
+import dataclasses
+import types
+import typing
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class ContextField:
+    name: str
+    type_name: str
+    help: str
+    from_extra: bool = False
+
+
+def _type_name(type_):
+    if type_ is type(None):
+        return "None"
+    origin = typing.get_origin(type_)
+    args = typing.get_args(type_)
+    if origin in (typing.Union, types.UnionType):
+        return " | ".join(_type_name(arg) for arg in args)
+    if origin is not None:
+        name = getattr(origin, "__name__", str(origin).removeprefix("typing."))
+        return "{}[{}]".format(name, ", ".join(_type_name(arg) for arg in args))
+    return getattr(type_, "__name__", str(type_).removeprefix("typing."))
+
+
+def from_extra():
+    """
+    Declare a Context dataclass field whose value comes from a registered
+    Extra of the same name - its documentation is the Extra description,
+    so the doc string lives next to the resolve() code rather than being
+    duplicated on the dataclass.
+    """
+    return dataclasses.field(metadata={"from_extra": True})
+
+
 class Context:
     "Base class for all documented contexts"
+
+    # Set on subclasses whose from_extra() fields should be resolved
+    # against the extras registry for this scope
+    extras_scope = None
+
+    @classmethod
+    def documented_fields(cls):
+        "List of ContextField describing the documented fields of this context"
+        documented = []
+        for f in dataclasses.fields(cls):
+            if f.name.startswith("_"):
+                continue
+            is_from_extra = bool(f.metadata.get("from_extra"))
+            if is_from_extra:
+                help_text = cls._extra_description(f.name)
+            else:
+                help_text = f.metadata.get("help", "")
+            documented.append(
+                ContextField(
+                    name=f.name,
+                    type_name=_type_name(f.type),
+                    help=help_text,
+                    from_extra=is_from_extra,
+                )
+            )
+        return documented
+
+    @classmethod
+    def _extra_description(cls, name):
+        # Imported lazily - table_extras is not needed just to define
+        # Context subclasses
+        from datasette.views.table_extras import table_extra_registry
+
+        try:
+            extra_class = table_extra_registry.classes_by_name[name]
+        except KeyError:
+            raise KeyError(
+                f"{cls.__name__}.{name} is declared with from_extra() but there is no "
+                "registered extra of that name"
+            )
+        if cls.extras_scope is not None and not extra_class.available_for(
+            cls.extras_scope
+        ):
+            raise ValueError(
+                f"{cls.__name__}.{name} is declared with from_extra() but the {name} extra is "
+                f"not available for scope {cls.extras_scope}"
+            )
+        return extra_class.description or ""
diff --git a/datasette/views/base.py b/datasette/views/base.py
index 2e2a5443..48108cec 100644
--- a/datasette/views/base.py
+++ b/datasette/views/base.py
@@ -1,33 +1,21 @@
-import asyncio
 import csv
 import hashlib
 import sys
-import textwrap
-import time
-import urllib
-from markupsafe import escape
 
-
-from datasette.database import QueryInterrupted
-from datasette.utils.asgi import Request
 from datasette.utils import (
-    add_cors_headers,
-    await_me_maybe,
     EscapeHtmlWriter,
     InvalidSql,
     LimitedWriter,
-    call_with_supported_arguments,
+    add_cors_headers,
     path_from_row_pks,
-    path_with_added_args,
-    path_with_removed_args,
     path_with_format,
     sqlite3,
 )
 from datasette.utils.asgi import (
     AsgiStream,
-    NotFound,
-    Response,
     BadRequest,
+    Request,
+    Response,
 )
 
 
@@ -40,12 +28,15 @@ class DatasetteError(Exception):
         status=500,
         template=None,
         message_is_html=False,
+        plain_message=None,
     ):
         self.message = message
         self.title = title
         self.error_dict = error_dict or {}
         self.status = status
         self.message_is_html = message_is_html
+        # Plain text used for JSON error responses when message is HTML
+        self.plain_message = plain_message
 
 
 class View:
@@ -61,9 +52,7 @@ class View:
             request.path.endswith(".json")
             or request.headers.get("content-type") == "application/json"
         ):
-            response = Response.json(
-                {"ok": False, "error": "Method not allowed"}, status=405
-            )
+            response = Response.error("Method not allowed", 405)
         else:
             response = Response.text("Method not allowed", status=405)
         return response
@@ -102,9 +91,7 @@ class BaseView:
             request.path.endswith(".json")
             or request.headers.get("content-type") == "application/json"
         ):
-            response = Response.json(
-                {"ok": False, "error": "Method not allowed"}, status=405
-            )
+            response = Response.error("Method not allowed", 405)
         else:
             response = Response.text("Method not allowed", status=405)
         return response
@@ -142,12 +129,10 @@ class BaseView:
         template = environment.select_template(templates)
         template_context = {
             **context,
-            **{
-                "select_templates": [
-                    f"{'*' if template_name == template.name else ''}{template_name}"
-                    for template_name in templates
-                ],
-            },
+            "select_templates": [
+                f"{'*' if template_name == template.name else ''}{template_name}"
+                for template_name in templates
+            ],
         }
         headers = {}
         if self.has_json_alternate:
@@ -164,9 +149,7 @@ class BaseView:
             template_context["alternate_url_json"] = alternate_url_json
             headers.update(
                 {
-                    "Link": '<{}>; rel="alternate"; type="application/json+datasette"'.format(
-                        alternate_url_json
-                    )
+                    "Link": f'<{alternate_url_json}>; rel="alternate"; type="application/json+datasette"'
                 }
             )
         return Response.html(
@@ -192,239 +175,12 @@ class BaseView:
         return view
 
 
-class DataView(BaseView):
-    name = ""
-
-    def redirect(self, request, path, forward_querystring=True, remove_args=None):
-        if request.query_string and "?" not in path and forward_querystring:
-            path = f"{path}?{request.query_string}"
-        if remove_args:
-            path = path_with_removed_args(request, remove_args, path=path)
-        r = Response.redirect(path)
-        r.headers["Link"] = f"<{path}>; rel=preload"
-        if self.ds.cors:
-            add_cors_headers(r.headers)
-        return r
-
-    async def data(self, request):
-        raise NotImplementedError
-
-    async def as_csv(self, request, database):
-        return await stream_csv(self.ds, self.data, request, database)
-
-    async def get(self, request):
-        db = await self.ds.resolve_database(request)
-        database = db.name
-        database_route = db.route
-
-        _format = request.url_vars["format"]
-        data_kwargs = {}
-
-        if _format == "csv":
-            return await self.as_csv(request, database_route)
-
-        if _format is None:
-            # HTML views default to expanding all foreign key labels
-            data_kwargs["default_labels"] = True
-
-        extra_template_data = {}
-        start = time.perf_counter()
-        status_code = None
-        templates = []
-        try:
-            response_or_template_contexts = await self.data(request, **data_kwargs)
-            if isinstance(response_or_template_contexts, Response):
-                return response_or_template_contexts
-            # If it has four items, it includes an HTTP status code
-            if len(response_or_template_contexts) == 4:
-                (
-                    data,
-                    extra_template_data,
-                    templates,
-                    status_code,
-                ) = response_or_template_contexts
-            else:
-                data, extra_template_data, templates = response_or_template_contexts
-        except QueryInterrupted as ex:
-            raise DatasetteError(
-                textwrap.dedent("""
-                <p>SQL query took too long. The time limit is controlled by the
-                <a href="https://docs.datasette.io/en/stable/settings.html#sql-time-limit-ms">sql_time_limit_ms</a>
-                configuration option.</p>
-                <textarea style="width: 90%">{}</textarea>
-                <script>
-                let ta = document.querySelector("textarea");
-                ta.style.height = ta.scrollHeight + "px";
-                </script>
-            """.format(escape(ex.sql))).strip(),
-                title="SQL Interrupted",
-                status=400,
-                message_is_html=True,
-            )
-        except (sqlite3.OperationalError, InvalidSql) as e:
-            raise DatasetteError(str(e), title="Invalid SQL", status=400)
-
-        except sqlite3.OperationalError as e:
-            raise DatasetteError(str(e))
-
-        except DatasetteError:
-            raise
-
-        end = time.perf_counter()
-        data["query_ms"] = (end - start) * 1000
-
-        # Special case for .jsono extension - redirect to _shape=objects
-        if _format == "jsono":
-            return self.redirect(
-                request,
-                path_with_added_args(
-                    request,
-                    {"_shape": "objects"},
-                    path=request.path.rsplit(".jsono", 1)[0] + ".json",
-                ),
-                forward_querystring=False,
-            )
-
-        if _format in self.ds.renderers.keys():
-            # Dispatch request to the correct output format renderer
-            # (CSV is not handled here due to streaming)
-            result = call_with_supported_arguments(
-                self.ds.renderers[_format][0],
-                datasette=self.ds,
-                columns=data.get("columns") or [],
-                rows=data.get("rows") or [],
-                sql=data.get("query", {}).get("sql", None),
-                query_name=data.get("query_name"),
-                database=database,
-                table=data.get("table"),
-                request=request,
-                view_name=self.name,
-                truncated=False,  # TODO: support this
-                error=data.get("error"),
-                # These will be deprecated in Datasette 1.0:
-                args=request.args,
-                data=data,
-            )
-            if asyncio.iscoroutine(result):
-                result = await result
-            if result is None:
-                raise NotFound("No data")
-            if isinstance(result, dict):
-                r = Response(
-                    body=result.get("body"),
-                    status=result.get("status_code", status_code or 200),
-                    content_type=result.get("content_type", "text/plain"),
-                    headers=result.get("headers"),
-                )
-            elif isinstance(result, Response):
-                r = result
-                if status_code is not None:
-                    # Over-ride the status code
-                    r.status = status_code
-            else:
-                assert False, f"{result} should be dict or Response"
-        else:
-            extras = {}
-            if callable(extra_template_data):
-                extras = extra_template_data()
-                if asyncio.iscoroutine(extras):
-                    extras = await extras
-            else:
-                extras = extra_template_data
-            url_labels_extra = {}
-            if data.get("expandable_columns"):
-                url_labels_extra = {"_labels": "on"}
-
-            renderers = {}
-            for key, (_, can_render) in self.ds.renderers.items():
-                it_can_render = call_with_supported_arguments(
-                    can_render,
-                    datasette=self.ds,
-                    columns=data.get("columns") or [],
-                    rows=data.get("rows") or [],
-                    sql=data.get("query", {}).get("sql", None),
-                    query_name=data.get("query_name"),
-                    database=database,
-                    table=data.get("table"),
-                    request=request,
-                    view_name=self.name,
-                )
-                it_can_render = await await_me_maybe(it_can_render)
-                if it_can_render:
-                    renderers[key] = self.ds.urls.path(
-                        path_with_format(
-                            request=request,
-                            path=request.scope.get("route_path"),
-                            format=key,
-                            extra_qs={**url_labels_extra},
-                        )
-                    )
-
-            url_csv_args = {"_size": "max", **url_labels_extra}
-            url_csv = self.ds.urls.path(
-                path_with_format(
-                    request=request,
-                    path=request.scope.get("route_path"),
-                    format="csv",
-                    extra_qs=url_csv_args,
-                )
-            )
-            url_csv_path = url_csv.split("?")[0]
-            context = {
-                **data,
-                **extras,
-                **{
-                    "renderers": renderers,
-                    "url_csv": url_csv,
-                    "url_csv_path": url_csv_path,
-                    "url_csv_hidden_args": [
-                        (key, value)
-                        for key, value in urllib.parse.parse_qsl(request.query_string)
-                        if key not in ("_labels", "_facet", "_size")
-                    ]
-                    + [("_size", "max")],
-                    "settings": self.ds.settings_dict(),
-                },
-            }
-            if "metadata" not in context:
-                context["metadata"] = await self.ds.get_instance_metadata()
-            r = await self.render(templates, request=request, context=context)
-            if status_code is not None:
-                r.status = status_code
-
-        ttl = request.args.get("_ttl", None)
-        if ttl is None or not ttl.isdigit():
-            ttl = self.ds.setting("default_cache_ttl")
-
-        return self.set_response_headers(r, ttl)
-
-    def set_response_headers(self, response, ttl):
-        # Set far-future cache expiry
-        if self.ds.cache_headers and response.status == 200:
-            ttl = int(ttl)
-            if ttl == 0:
-                ttl_header = "no-cache"
-            else:
-                ttl_header = f"max-age={ttl}"
-            response.headers["Cache-Control"] = ttl_header
-        response.headers["Referrer-Policy"] = "no-referrer"
-        if self.ds.cors:
-            add_cors_headers(response.headers)
-        return response
-
-
-def _error(messages, status=400):
-    return Response.json({"ok": False, "errors": messages}, status=status)
-
-
 async def stream_csv(datasette, fetch_data, request, database):
     kwargs = {}
     stream = request.args.get("_stream")
     # Do not calculate facets or counts:
     extra_parameters = [
-        "{}=1".format(key)
-        for key in ("_nofacet", "_nocount")
-        if not request.args.get(key)
+        f"{key}=1" for key in ("_nofacet", "_nocount") if not request.args.get(key)
     ]
     if extra_parameters:
         # Replace request object with a new one with modified scope
@@ -454,9 +210,6 @@ async def stream_csv(datasette, fetch_data, request, database):
     except (sqlite3.OperationalError, InvalidSql) as e:
         raise DatasetteError(str(e), title="Invalid SQL", status=400)
 
-    except sqlite3.OperationalError as e:
-        raise DatasetteError(str(e))
-
     except DatasetteError:
         raise
 
@@ -563,8 +316,9 @@ async def stream_csv(datasette, fetch_data, request, database):
                             else:
                                 new_row.append(cell)
                         await writer.writerow(new_row)
-            except Exception as ex:
-                sys.stderr.write("Caught this error: {}\n".format(ex))
+            except Exception as ex:  # noqa: BLE001
+                # Streaming CSV: report the error into the response body and stop
+                sys.stderr.write(f"Caught this error: {ex}\n")
                 sys.stderr.flush()
                 await r.write(str(ex))
                 return
diff --git a/datasette/views/database.py b/datasette/views/database.py
index cd9565c6..f54ffd38 100644
--- a/datasette/views/database.py
+++ b/datasette/views/database.py
@@ -1,50 +1,75 @@
-from dataclasses import dataclass, field
-from urllib.parse import parse_qsl, urlencode
 import asyncio
 import hashlib
 import itertools
 import json
-import markupsafe
 import os
-import re
-import sqlite_utils
 import textwrap
+from dataclasses import asdict, dataclass, field
+from urllib.parse import parse_qsl, urlencode
+
+import markupsafe
 
-from datasette.events import AlterTableEvent, CreateTableEvent, InsertRowsEvent
-from datasette.extras import extra_names_from_request
 from datasette.database import QueryInterrupted
+from datasette.extras import ExtraScope, extra_names_from_request
+from datasette.plugins import pm
 from datasette.resources import DatabaseResource, QueryResource
-from datasette.stored_queries import stored_query_to_dict
-from datasette.write_sql import QueryWriteRejected
+from datasette.stored_queries import StoredQuery, stored_query_to_dict
 from datasette.utils import (
+    InvalidSql,
     add_cors_headers,
     await_me_maybe,
     call_with_supported_arguments,
-    named_parameters as derive_named_parameters,
+    error_body,
     format_bytes,
-    make_slot_function,
-    tilde_decode,
-    to_css_class,
-    validate_sql_select,
     is_url,
+    make_slot_function,
     path_with_added_args,
     path_with_format,
     path_with_removed_args,
     sqlite3,
+    tilde_decode,
+    to_css_class,
     truncate_url,
-    InvalidSql,
+    validate_sql_select,
 )
-from datasette.utils.asgi import AsgiFileDownload, NotFound, Response, Forbidden
-from datasette.plugins import pm
+from datasette.utils import (
+    named_parameters as derive_named_parameters,
+)
+from datasette.utils.asgi import AsgiFileDownload, Forbidden, NotFound, Response
+from datasette.write_sql import QueryWriteRejected
 
-from .base import BaseView, DatasetteError, View, _error, stream_csv
+from . import Context
+from .base import DatasetteError, View, stream_csv
 from .query_helpers import _ensure_stored_query_execution_permissions, _table_columns
+from .table_create_alter import _create_table_ui_context
 from .table_extras import (
     QueryExtraContext,
     resolve_query_extras,
     table_extra_registry,
 )
-from . import Context
+
+
+@dataclass
+class DatabaseTable:
+    "Summary of a table or view shown on database and query pages."
+
+    name: str
+    columns: list[str]
+    primary_keys: list[str]
+    count: int | None
+    count_truncated: bool
+    hidden: bool
+    fts_table: str | None
+    foreign_keys: dict[str, list[dict[str, str]]]
+    private: bool
+
+
+@dataclass
+class DatabaseViewInfo:
+    "Summary of a SQLite view shown on the database page."
+
+    name: str
+    private: bool
 
 
 class DatabaseView(View):
@@ -78,7 +103,7 @@ class DatabaseView(View):
             return response
 
         if format_ not in ("html", "json"):
-            raise NotFound("Invalid format: {}".format(format_))
+            raise NotFound(f"Invalid format: {format_}")
 
         metadata = await datasette.get_database_metadata(database)
 
@@ -96,7 +121,7 @@ class DatabaseView(View):
         # Filter to just views
         view_names_set = set(await db.view_names())
         sql_views = [
-            {"name": name, "private": allowed_dict[name].private}
+            DatabaseViewInfo(name=name, private=allowed_dict[name].private)
             for name in allowed_dict
             if name in view_names_set
         ]
@@ -117,21 +142,36 @@ class DatabaseView(View):
             else len(stored_queries)
         )
 
+        # Resolve the registered database-level actions for this database in
+        # one batched query, seeding the request permission cache so allowed()
+        # calls made inside plugin hooks below are served from the cache.
+        database_action_permissions = await datasette.allowed_many(
+            actions=[
+                name
+                for name, action in datasette.actions.items()
+                if action.resource_class is DatabaseResource
+            ],
+            resource=DatabaseResource(database),
+            actor=request.actor,
+        )
+        create_table_ui = await _create_table_ui_context(
+            datasette, request, db, database, database_action_permissions
+        )
+
         async def database_actions():
-            # Resolve the registered database-level actions for this
-            # database in one batched query, seeding the request permission
-            # cache so that allowed() calls made inside the plugin hooks
-            # below are served from the cache
-            await datasette.allowed_many(
-                actions=[
-                    name
-                    for name, action in datasette.actions.items()
-                    if action.resource_class is DatabaseResource
-                ],
-                resource=DatabaseResource(database),
-                actor=request.actor,
-            )
             links = []
+            if create_table_ui:
+                links.append(
+                    {
+                        "type": "button",
+                        "label": "Create table",
+                        "description": "Create a new table in this database.",
+                        "attrs": {
+                            "aria-label": f"Create table in {database}",
+                            "data-database-action": "create-table",
+                        },
+                    }
+                )
             for hook in pm.hook.database_actions(
                 datasette=datasette,
                 database=database,
@@ -156,9 +196,9 @@ class DatabaseView(View):
             "private": private,
             "path": datasette.urls.database(database),
             "size": db.size,
-            "tables": tables,
-            "hidden_count": len([t for t in tables if t["hidden"]]),
-            "views": sql_views,
+            "tables": [asdict(table) for table in tables],
+            "hidden_count": len([table for table in tables if table.hidden]),
+            "views": [asdict(view) for view in sql_views],
             "queries": [stored_query_to_dict(query) for query in stored_queries],
             "queries_more": queries_more,
             "queries_count": queries_count,
@@ -198,7 +238,7 @@ class DatabaseView(View):
                     path=datasette.urls.database(database),
                     size=db.size,
                     tables=tables,
-                    hidden_count=len([t for t in tables if t["hidden"]]),
+                    hidden_count=len([table for table in tables if table.hidden]),
                     views=sql_views,
                     queries=stored_queries,
                     queries_more=queries_more,
@@ -211,10 +251,12 @@ class DatabaseView(View):
                     ),
                     metadata=metadata,
                     database_color=db.color,
+                    database_page_data=(
+                        {"createTable": create_table_ui} if create_table_ui else {}
+                    ),
                     database_actions=database_actions,
                     show_hidden=request.args.get("_show_hidden"),
                     editable=True,
-                    count_limit=db.count_limit,
                     allow_download=datasette.setting("allow_download")
                     and not db.is_mutable
                     and not db.is_memory,
@@ -232,25 +274,39 @@ class DatabaseView(View):
                 view_name="database",
             ),
             headers={
-                "Link": '<{}>; rel="alternate"; type="application/json+datasette"'.format(
-                    alternate_url_json
-                )
+                "Link": f'<{alternate_url_json}>; rel="alternate"; type="application/json+datasette"'
             },
         )
 
 
 @dataclass
 class DatabaseContext(Context):
+    "The page listing the tables, views and queries in a database, e.g. /fixtures."
+
+    documented_template = "database.html"
+
     database: str = field(metadata={"help": "The name of the database"})
     private: bool = field(
         metadata={"help": "Boolean indicating if this is a private database"}
     )
     path: str = field(metadata={"help": "The URL path to this database"})
     size: int = field(metadata={"help": "The size of the database in bytes"})
-    tables: list = field(metadata={"help": "List of table objects in the database"})
+    tables: list[DatabaseTable] = field(
+        metadata={
+            "help": "List of ``DatabaseTable`` objects describing tables in the database. Each item has ``name``, ``columns``, ``primary_keys``, ``count``, ``count_truncated``, ``hidden``, ``fts_table``, ``foreign_keys`` and ``private`` attributes. ``count_truncated`` is true if ``count`` is a capped lower bound rather than an exact total."
+        }
+    )
     hidden_count: int = field(metadata={"help": "Count of hidden tables"})
-    views: list = field(metadata={"help": "List of view objects in the database"})
-    queries: list = field(metadata={"help": "List of stored query objects"})
+    views: list[DatabaseViewInfo] = field(
+        metadata={
+            "help": "List of ``DatabaseViewInfo`` objects describing SQLite views in the database. Each item has ``name`` and ``private`` attributes."
+        }
+    )
+    queries: list[StoredQuery] = field(
+        metadata={
+            "help": "List of ``StoredQuery`` objects. Each has attributes including ``name``, ``sql``, ``title``, ``description``, ``description_html``, ``hide_sql``, ``fragment``, ``parameters``, ``is_write`` and ``private``."
+        }
+    )
     queries_more: bool = field(
         metadata={"help": "Boolean indicating if more stored queries are available"}
     )
@@ -259,45 +315,65 @@ class DatabaseContext(Context):
         metadata={"help": "Boolean indicating if custom SQL can be executed"}
     )
     table_columns: dict = field(
-        metadata={"help": "Dictionary mapping table names to their column lists"}
+        metadata={
+            "help": "Dictionary mapping table names to lists of column names, used to power SQL autocomplete."
+        }
+    )
+    metadata: dict = field(
+        metadata={
+            "help": "Metadata dictionary for the database, such as ``title``, ``description``, ``license`` and ``source`` values from Datasette metadata."
+        }
     )
-    metadata: dict = field(metadata={"help": "Metadata for the database"})
     database_color: str = field(metadata={"help": "The color assigned to the database"})
+    database_page_data: dict = field(
+        metadata={
+            "help": 'JSON data used by JavaScript on the database page. Currently ``{}`` or ``{"createTable": {...}}`` where ``createTable`` includes ``path``, ``foreignKeyTargetsPath``, ``databaseName``, ``columnTypes``, ``defaultExpressions``, ``canInsertRows`` and optional ``customColumnTypes``.'
+        }
+    )
     database_actions: callable = field(
         metadata={
-            "help": "Callable returning list of action links for the database menu"
+            "help": 'Async callable returning action items for the database menu. Each item is either a link with ``href``, ``label`` and optional ``description`` keys, or a button with ``type: "button"``, ``label``, optional ``description`` and optional ``attrs``. See :ref:`plugin_actions` and :ref:`plugin_hook_database_actions`.'
         }
     )
     show_hidden: str = field(metadata={"help": "Value of _show_hidden query parameter"})
     editable: bool = field(
         metadata={"help": "Boolean indicating if the database is editable"}
     )
-    count_limit: int = field(metadata={"help": "The maximum number of rows to count"})
     allow_download: bool = field(
         metadata={"help": "Boolean indicating if database download is allowed"}
     )
     attached_databases: list = field(
-        metadata={"help": "List of names of attached databases"}
+        metadata={
+            "help": "List of names of databases attached to this SQLite connection. This is only populated for the special ``/_memory`` database when Datasette is started with ``--crossdb`` for :ref:`cross_database_queries`."
+        }
     )
     alternate_url_json: str = field(
         metadata={"help": "URL for the alternate JSON version of this page"}
     )
     select_templates: list = field(
         metadata={
-            "help": "List of templates that were considered for rendering this page"
+            "help": "List of template names that were considered for this page, with the selected template prefixed by ``*``."
         }
     )
     top_database: callable = field(
-        metadata={"help": "Callable to render the top_database slot"}
+        metadata={
+            "help": "Async callable that renders the ``top_database`` plugin slot for this database and returns HTML."
+        }
     )
 
 
 @dataclass
 class QueryContext(Context):
+    "The page for arbitrary SQL queries (/database/-/query?sql=...) and stored queries (/database/query-name)."
+
+    documented_template = "query.html"
+
     database: str = field(metadata={"help": "The name of the database being queried"})
     database_color: str = field(metadata={"help": "The color of the database"})
     query: dict = field(
-        metadata={"help": "The SQL query object containing the `sql` string"}
+        metadata={
+            "help": "Dictionary describing the SQL query being executed, with ``sql`` and ``params`` keys."
+        }
     )
     stored_query: str = field(
         metadata={"help": "The name of the stored query if this is a stored query"}
@@ -314,7 +390,9 @@ class QueryContext(Context):
         }
     )
     metadata: dict = field(
-        metadata={"help": "Metadata about the database or the stored query"}
+        metadata={
+            "help": "Metadata dictionary for the database or stored query. Stored query metadata may include options such as ``hide_sql``, ``on_success_message`` and ``on_error_redirect``."
+        }
     )
     db_is_immutable: bool = field(
         metadata={"help": "Boolean indicating if this database is immutable"}
@@ -338,22 +416,44 @@ class QueryContext(Context):
     save_query_url: str = field(
         metadata={"help": "URL to save the current arbitrary SQL as a query"}
     )
-    tables: list = field(metadata={"help": "List of table objects in the database"})
+    tables: list[DatabaseTable] = field(
+        metadata={
+            "help": "List of ``DatabaseTable`` objects describing tables in the database. Each item has ``name``, ``columns``, ``primary_keys``, ``count``, ``count_truncated``, ``hidden``, ``fts_table``, ``foreign_keys`` and ``private`` attributes. ``count_truncated`` is true if ``count`` is a capped lower bound rather than an exact total."
+        }
+    )
     named_parameter_values: dict = field(
-        metadata={"help": "Dictionary of parameter names/values"}
+        metadata={
+            "help": "Dictionary of named SQL parameter values, keyed by parameter name without the leading ``:``."
+        }
     )
     edit_sql_url: str = field(
         metadata={"help": "URL to edit the SQL for a stored query"}
     )
-    display_rows: list = field(metadata={"help": "List of result rows to display"})
-    columns: list = field(metadata={"help": "List of column names"})
-    renderers: dict = field(metadata={"help": "Dictionary of renderer name to URL"})
+    display_rows: list = field(
+        metadata={
+            "help": "List of result rows formatted for HTML display. Each row is a list of rendered cell values in the same order as ``columns``."
+        }
+    )
+    columns: list = field(
+        metadata={
+            "help": "List of result column names in the order they appear in ``display_rows`` and ``rows``."
+        }
+    )
+    renderers: dict = field(
+        metadata={
+            "help": "Dictionary mapping output format names such as ``json`` to URLs for this query in that format."
+        }
+    )
     url_csv: str = field(metadata={"help": "URL for CSV export"})
     show_hide_hidden: str = field(
-        metadata={"help": "Hidden input field for the _show_sql parameter"}
+        metadata={
+            "help": "Rendered hidden ``<input>`` HTML preserving the current ``_hide_sql`` or ``_show_sql`` state."
+        }
     )
     table_columns: dict = field(
-        metadata={"help": "Dictionary of table name to list of column names"}
+        metadata={
+            "help": "Dictionary mapping table names to lists of column names, used to power SQL autocomplete."
+        }
     )
     alternate_url_json: str = field(
         metadata={"help": "URL for alternate JSON version of this page"}
@@ -361,23 +461,27 @@ class QueryContext(Context):
     # TODO: refactor this to somewhere else, probably ds.render_template()
     select_templates: list = field(
         metadata={
-            "help": "List of templates that were considered for rendering this page"
+            "help": "List of template names that were considered for this page, with the selected template prefixed by ``*``."
         }
     )
     top_query: callable = field(
-        metadata={"help": "Callable to render the top_query slot"}
+        metadata={
+            "help": "Async callable that renders the ``top_query`` plugin slot for this query and returns HTML."
+        }
     )
     top_stored_query: callable = field(
-        metadata={"help": "Callable to render the top_stored_query slot"}
+        metadata={
+            "help": "Async callable that renders the ``top_stored_query`` plugin slot for stored queries and returns HTML."
+        }
     )
     query_actions: callable = field(
         metadata={
-            "help": "Callable returning a list of links for the query action menu"
+            "help": 'Async callable returning action items for the query menu. Each item is either a link with ``href``, ``label`` and optional ``description`` keys, or a button with ``type: "button"``, ``label``, optional ``description`` and optional ``attrs``. See :ref:`plugin_actions` and :ref:`plugin_hook_query_actions`.'
         }
     )
 
 
-async def get_tables(datasette, request, db, allowed_dict):
+async def get_tables(datasette, request, db, allowed_dict) -> list[DatabaseTable]:
     """
     Get list of tables with metadata for the database view.
 
@@ -398,21 +502,36 @@ async def get_tables(datasette, request, db, allowed_dict):
 
         table_columns = await db.table_columns(table)
         tables.append(
-            {
-                "name": table,
-                "columns": table_columns,
-                "primary_keys": await db.primary_keys(table),
-                "count": table_counts[table],
-                "hidden": table in hidden_table_names,
-                "fts_table": await db.fts_table(table),
-                "foreign_keys": all_foreign_keys[table],
-                "private": allowed_dict[table].private,
-            }
+            DatabaseTable(
+                name=table,
+                columns=table_columns,
+                primary_keys=await db.primary_keys(table),
+                count=table_counts[table],
+                count_truncated=_table_count_truncated(
+                    datasette, db, table, table_counts[table]
+                ),
+                hidden=table in hidden_table_names,
+                fts_table=await db.fts_table(table),
+                foreign_keys=all_foreign_keys[table],
+                private=allowed_dict[table].private,
+            )
         )
-    tables.sort(key=lambda t: (t["hidden"], t["name"]))
+    tables.sort(key=lambda table: (table.hidden, table.name))
     return tables
 
 
+def _table_count_truncated(datasette, db, table, count):
+    if count != db.count_limit + 1:
+        return False
+    if not db.is_mutable and datasette.inspect_data:
+        try:
+            datasette.inspect_data[db.name]["tables"][table]["count"]
+            return False
+        except KeyError:
+            pass
+    return True
+
+
 async def database_download(request, datasette):
     from datasette.resources import DatabaseResource
 
@@ -438,7 +557,7 @@ async def database_download(request, datasette):
     if datasette.cors:
         add_cors_headers(headers)
     if db.hash:
-        etag = '"{}"'.format(db.hash)
+        etag = f'"{db.hash}"'
         headers["Etag"] = etag
         # Has user seen this already?
         if_none_match = request.headers.get("if-none-match")
@@ -490,11 +609,7 @@ class QueryView(View):
                 "_json"
             ):
                 return Response.json(
-                    {
-                        "ok": False,
-                        "message": ex.message,
-                        "redirect": None,
-                    },
+                    dict(error_body([ex.message], 403), redirect=None),
                     status=403,
                 )
             datasette.add_message(request, ex.message, datasette.ERROR)
@@ -529,8 +644,15 @@ class QueryView(View):
         ok = None
         redirect_url = None
         try:
+            execute_write_kwargs = {"request": request}
+            if stored_query.is_trusted:
+                analysis = await db.analyze_sql(stored_query.sql, params_for_query)
+                if any(
+                    operation.operation == "vacuum" for operation in analysis.operations
+                ):
+                    execute_write_kwargs["transaction"] = False
             cursor = await db.execute_write(
-                stored_query.sql, params_for_query, request=request
+                stored_query.sql, params_for_query, **execute_write_kwargs
             )
             # success message can come from on_success_message or on_success_message_sql
             message = None
@@ -543,8 +665,9 @@ class QueryView(View):
                     ).first()
                     if message_result:
                         message = message_result[0]
-                except Exception as ex:
-                    message = "Error running on_success_message_sql: {}".format(ex)
+                except Exception as ex:  # noqa: BLE001
+                    # Stored-query on_success_message_sql is user-authored
+                    message = f"Error running on_success_message_sql: {ex}"
                     message_type = datasette.ERROR
             if not message:
                 if stored_query.on_success_message:
@@ -558,18 +681,24 @@ class QueryView(View):
 
             redirect_url = stored_query.on_success_redirect
             ok = True
-        except Exception as ex:
+        except Exception as ex:  # noqa: BLE001
+            # Stored-query execution is user-authored SQL
             message = stored_query.on_error_message or str(ex)
             message_type = datasette.ERROR
             redirect_url = stored_query.on_error_redirect
             ok = False
         if should_return_json:
+            if ok:
+                return Response.json(
+                    {
+                        "ok": True,
+                        "message": message,
+                        "redirect": redirect_url,
+                    }
+                )
             return Response.json(
-                {
-                    "ok": ok,
-                    "message": message,
-                    "redirect": redirect_url,
-                }
+                dict(error_body([message], 400), redirect=redirect_url),
+                status=400,
             )
         else:
             datasette.add_message(request, message, message_type)
@@ -687,19 +816,23 @@ class QueryView(View):
                 rows = results.rows
             except QueryInterrupted as ex:
                 raise DatasetteError(
-                    textwrap.dedent("""
+                    textwrap.dedent(f"""
                     <p>SQL query took too long. The time limit is controlled by the
                     <a href="https://docs.datasette.io/en/stable/settings.html#sql-time-limit-ms">sql_time_limit_ms</a>
                     configuration option.</p>
-                    <textarea style="width: 90%">{}</textarea>
+                    <textarea style="width: 90%">{markupsafe.escape(ex.sql)}</textarea>
                     <script>
                     let ta = document.querySelector("textarea");
                     ta.style.height = ta.scrollHeight + "px";
                     </script>
-                """.format(markupsafe.escape(ex.sql))).strip(),
+                """).strip(),
                     title="SQL Interrupted",
                     status=400,
                     message_is_html=True,
+                    plain_message=(
+                        "SQL query took too long. The time limit is"
+                        " controlled by the sql_time_limit_ms setting."
+                    ),
                 )
             except sqlite3.DatabaseError as ex:
                 query_error = str(ex)
@@ -708,8 +841,6 @@ class QueryView(View):
                 columns = []
             except (sqlite3.OperationalError, InvalidSql) as ex:
                 raise DatasetteError(str(ex), title="Invalid SQL", status=400)
-            except sqlite3.OperationalError as ex:
-                raise DatasetteError(str(ex))
             except DatasetteError:
                 raise
 
@@ -731,9 +862,12 @@ class QueryView(View):
                 return data, None, None
 
             return await stream_csv(datasette, fetch_data_for_csv, request, db.name)
-        elif format_ in datasette.renderers.keys():
+        elif format_ in datasette.renderers:
+            if not sql:
+                raise DatasetteError("?sql= is required", status=400)
             data = {"ok": True, "rows": rows, "columns": columns}
             extras = extra_names_from_request(request)
+            table_extra_registry.validate_requested(extras, ExtraScope.QUERY)
             if extras:
                 query_extra_context = QueryExtraContext(
                     datasette=datasette,
@@ -820,9 +954,7 @@ class QueryView(View):
             }
             headers.update(
                 {
-                    "Link": '<{}>; rel="alternate"; type="application/json+datasette"'.format(
-                        alternate_url_json
-                    )
+                    "Link": f'<{alternate_url_json}>; rel="alternate"; type="application/json+datasette"'
                 }
             )
             metadata = await query_metadata()
@@ -903,9 +1035,7 @@ class QueryView(View):
                         + "?"
                         + urlencode(
                             {
-                                **{
-                                    "sql": sql,
-                                },
+                                "sql": sql,
                                 **named_parameter_values,
                             }
                         )
@@ -1007,7 +1137,7 @@ class QueryView(View):
                 headers=headers,
             )
         else:
-            assert False, "Invalid format: {}".format(format_)
+            assert False, f"Invalid format: {format_}"
         if datasette.cors:
             add_cors_headers(r.headers)
         return r
@@ -1055,260 +1185,6 @@ class MagicParameters(dict):
             return super().__getitem__(key)
 
 
-class TableCreateView(BaseView):
-    name = "table-create"
-
-    _valid_keys = {
-        "table",
-        "rows",
-        "row",
-        "columns",
-        "pk",
-        "pks",
-        "ignore",
-        "replace",
-        "alter",
-    }
-    _supported_column_types = {
-        "text",
-        "integer",
-        "float",
-        "blob",
-    }
-    # Any string that does not contain a newline or start with sqlite_
-    _table_name_re = re.compile(r"^(?!sqlite_)[^\n]+$")
-
-    def __init__(self, datasette):
-        self.ds = datasette
-
-    async def post(self, request):
-        db = await self.ds.resolve_database(request)
-        database_name = db.name
-
-        # Must have create-table permission
-        if not await self.ds.allowed(
-            action="create-table",
-            resource=DatabaseResource(database=database_name),
-            actor=request.actor,
-        ):
-            return _error(["Permission denied"], 403)
-
-        try:
-            data = await request.json()
-        except json.JSONDecodeError as e:
-            return _error(["Invalid JSON: {}".format(e)])
-
-        if not isinstance(data, dict):
-            return _error(["JSON must be an object"])
-
-        invalid_keys = set(data.keys()) - self._valid_keys
-        if invalid_keys:
-            return _error(["Invalid keys: {}".format(", ".join(invalid_keys))])
-
-        # ignore and replace are mutually exclusive
-        if data.get("ignore") and data.get("replace"):
-            return _error(["ignore and replace are mutually exclusive"])
-
-        # ignore and replace only allowed with row or rows
-        if "ignore" in data or "replace" in data:
-            if not data.get("row") and not data.get("rows"):
-                return _error(["ignore and replace require row or rows"])
-
-        # ignore and replace require pk or pks
-        if "ignore" in data or "replace" in data:
-            if not data.get("pk") and not data.get("pks"):
-                return _error(["ignore and replace require pk or pks"])
-
-        ignore = data.get("ignore")
-        replace = data.get("replace")
-
-        if replace:
-            # Must have update-row permission
-            if not await self.ds.allowed(
-                action="update-row",
-                resource=DatabaseResource(database=database_name),
-                actor=request.actor,
-            ):
-                return _error(["Permission denied: need update-row"], 403)
-
-        table_name = data.get("table")
-        if not table_name:
-            return _error(["Table is required"])
-
-        if not self._table_name_re.match(table_name):
-            return _error(["Invalid table name"])
-
-        table_exists = await db.table_exists(data["table"])
-        columns = data.get("columns")
-        rows = data.get("rows")
-        row = data.get("row")
-        if not columns and not rows and not row:
-            return _error(["columns, rows or row is required"])
-
-        if rows and row:
-            return _error(["Cannot specify both rows and row"])
-
-        if rows or row:
-            # Must have insert-row permission
-            if not await self.ds.allowed(
-                action="insert-row",
-                resource=DatabaseResource(database=database_name),
-                actor=request.actor,
-            ):
-                return _error(["Permission denied: need insert-row"], 403)
-
-        alter = False
-        if rows or row:
-            if not table_exists:
-                # if table is being created for the first time, alter=True
-                alter = True
-            else:
-                # alter=True only if they request it AND they have permission
-                if data.get("alter"):
-                    if not await self.ds.allowed(
-                        action="alter-table",
-                        resource=DatabaseResource(database=database_name),
-                        actor=request.actor,
-                    ):
-                        return _error(["Permission denied: need alter-table"], 403)
-                    alter = True
-
-        if columns:
-            if rows or row:
-                return _error(["Cannot specify columns with rows or row"])
-            if not isinstance(columns, list):
-                return _error(["columns must be a list"])
-            for column in columns:
-                if not isinstance(column, dict):
-                    return _error(["columns must be a list of objects"])
-                if not column.get("name") or not isinstance(column.get("name"), str):
-                    return _error(["Column name is required"])
-                if not column.get("type"):
-                    column["type"] = "text"
-                if column["type"] not in self._supported_column_types:
-                    return _error(
-                        ["Unsupported column type: {}".format(column["type"])]
-                    )
-            # No duplicate column names
-            dupes = {c["name"] for c in columns if columns.count(c) > 1}
-            if dupes:
-                return _error(["Duplicate column name: {}".format(", ".join(dupes))])
-
-        if row:
-            rows = [row]
-
-        if rows:
-            if not isinstance(rows, list):
-                return _error(["rows must be a list"])
-            for row in rows:
-                if not isinstance(row, dict):
-                    return _error(["rows must be a list of objects"])
-
-        pk = data.get("pk")
-        pks = data.get("pks")
-
-        if pk and pks:
-            return _error(["Cannot specify both pk and pks"])
-        if pk:
-            if not isinstance(pk, str):
-                return _error(["pk must be a string"])
-        if pks:
-            if not isinstance(pks, list):
-                return _error(["pks must be a list"])
-            for pk in pks:
-                if not isinstance(pk, str):
-                    return _error(["pks must be a list of strings"])
-
-        # If table exists already, read pks from that instead
-        if table_exists:
-            actual_pks = await db.primary_keys(table_name)
-            # if pk passed and table already exists check it does not change
-            bad_pks = False
-            if len(actual_pks) == 1 and data.get("pk") and data["pk"] != actual_pks[0]:
-                bad_pks = True
-            elif (
-                len(actual_pks) > 1
-                and data.get("pks")
-                and set(data["pks"]) != set(actual_pks)
-            ):
-                bad_pks = True
-            if bad_pks:
-                return _error(["pk cannot be changed for existing table"])
-            pks = actual_pks
-
-        initial_schema = None
-        if table_exists:
-            initial_schema = await db.execute_fn(
-                lambda conn: sqlite_utils.Database(conn)[table_name].schema
-            )
-
-        def create_table(conn):
-            table = sqlite_utils.Database(conn)[table_name]
-            if rows:
-                table.insert_all(
-                    rows, pk=pks or pk, ignore=ignore, replace=replace, alter=alter
-                )
-            else:
-                table.create(
-                    {c["name"]: c["type"] for c in columns},
-                    pk=pks or pk,
-                )
-            return table.schema
-
-        try:
-            schema = await db.execute_write_fn(create_table, request=request)
-        except Exception as e:
-            return _error([str(e)])
-
-        if initial_schema is not None and initial_schema != schema:
-            await self.ds.track_event(
-                AlterTableEvent(
-                    request.actor,
-                    database=database_name,
-                    table=table_name,
-                    before_schema=initial_schema,
-                    after_schema=schema,
-                )
-            )
-
-        table_url = self.ds.absolute_url(
-            request, self.ds.urls.table(db.name, table_name)
-        )
-        table_api_url = self.ds.absolute_url(
-            request, self.ds.urls.table(db.name, table_name, format="json")
-        )
-        details = {
-            "ok": True,
-            "database": db.name,
-            "table": table_name,
-            "table_url": table_url,
-            "table_api_url": table_api_url,
-            "schema": schema,
-        }
-        if rows:
-            details["row_count"] = len(rows)
-
-        if not table_exists:
-            # Only log creation if we created a table
-            await self.ds.track_event(
-                CreateTableEvent(
-                    request.actor, database=db.name, table=table_name, schema=schema
-                )
-            )
-        if rows:
-            await self.ds.track_event(
-                InsertRowsEvent(
-                    request.actor,
-                    database=db.name,
-                    table=table_name,
-                    num_rows=len(rows),
-                    ignore=ignore,
-                    replace=replace,
-                )
-            )
-        return Response.json(details, status=201)
-
-
 async def display_rows(datasette, database, request, rows, columns):
     display_rows = []
     truncate_cells = datasette.setting("truncate_cells_html")
@@ -1362,7 +1238,7 @@ async def display_rows(datasette, database, request, rows, columns):
                         '<a class="blob-download" href="{}"{}>&lt;Binary:&nbsp;{:,}&nbsp;byte{}&gt;</a>'.format(
                             blob_url,
                             (
-                                ' title="{}"'.format(formatted)
+                                f' title="{formatted}"'
                                 if "bytes" not in formatted
                                 else ""
                             ),
diff --git a/datasette/views/execute_write.py b/datasette/views/execute_write.py
index b7e8288e..3dfb810c 100644
--- a/datasette/views/execute_write.py
+++ b/datasette/views/execute_write.py
@@ -2,14 +2,14 @@ import re
 from urllib.parse import urlencode
 
 from datasette.resources import DatabaseResource
-from datasette.utils import sqlite3
+from datasette.utils import UNSTABLE_API_MESSAGE, sqlite3
 from datasette.utils.asgi import Response
 
-from .base import BaseView, _error
+from .base import BaseView
 from .database import display_rows as display_query_rows
 from .query_helpers import (
-    QueryValidationError,
     SQL_PARAMETER_FORM_PREFIX,
+    QueryValidationError,
     _analysis_is_write,
     _analysis_rows,
     _analysis_rows_with_permissions,
@@ -31,15 +31,7 @@ WRITE_TEMPLATE_LABELS = {
     "delete": "Delete rows",
 }
 WRITE_TEMPLATE_OPERATIONS = tuple(WRITE_TEMPLATE_LABELS)
-CREATE_TABLE_TEMPLATE_SQL = "\n".join(
-    (
-        "create table new_table (",
-        "  id integer primary key,",
-        "  name text",
-        "  -- created text default (datetime('now'))",
-        ")",
-    )
-)
+CREATE_TABLE_TEMPLATE_SQL = "create table new_table (\n  id integer primary key,\n  name text\n  -- created text default (datetime('now'))\n)"
 
 
 def _parameter_names(columns):
@@ -49,11 +41,11 @@ def _parameter_names(columns):
         base = re.sub(r"[^a-z0-9_]+", "_", column.lower())
         base = base.strip("_") or "value"
         if base[0].isdigit():
-            base = "p_{}".format(base)
+            base = f"p_{base}"
         name = base
         index = 2
         while name in seen:
-            name = "{}_{}".format(base, index)
+            name = f"{base}_{index}"
             index += 1
         seen.add(name)
         names[column] = name
@@ -65,7 +57,7 @@ def _quote_identifier(identifier):
 
 
 def _preferred_where_column(table, columns):
-    lower_table_id = "{}_id".format(table.lower())
+    lower_table_id = f"{table.lower()}_id"
     return (
         next((column for column in columns if column.lower() == "id"), None)
         or next(
@@ -90,17 +82,15 @@ def _insert_template_sql(table, columns):
     auto_pk = _auto_incrementing_primary_key(columns)
     insert_columns = [column for column in column_names if column != auto_pk]
     if not insert_columns:
-        return "insert into {}\ndefault values".format(_quote_identifier(table))
+        return f"insert into {_quote_identifier(table)}\ndefault values"
     names = _parameter_names(insert_columns)
     return "\n".join(
         (
-            "insert into {} (".format(_quote_identifier(table)),
-            ",\n".join(
-                "  {}".format(_quote_identifier(column)) for column in insert_columns
-            ),
+            f"insert into {_quote_identifier(table)} (",
+            ",\n".join(f"  {_quote_identifier(column)}" for column in insert_columns),
             ")",
             "values (",
-            ",\n".join("  :{}".format(names[column]) for column in insert_columns),
+            ",\n".join(f"  :{names[column]}" for column in insert_columns),
             ")",
         )
     )
@@ -114,18 +104,14 @@ def _update_template_sql(table, columns):
     if not set_columns:
         return "\n".join(
             (
-                "update {}".format(_quote_identifier(table)),
-                "set {} = :new_{}".format(
-                    _quote_identifier(where_column), names[where_column]
-                ),
-                "where {} = :{}".format(
-                    _quote_identifier(where_column), names[where_column]
-                ),
+                f"update {_quote_identifier(table)}",
+                f"set {_quote_identifier(where_column)} = :new_{names[where_column]}",
+                f"where {_quote_identifier(where_column)} = :{names[where_column]}",
             )
         )
     return "\n".join(
         (
-            "update {}".format(_quote_identifier(table)),
+            f"update {_quote_identifier(table)}",
             "set "
             + ",\n".join(
                 "{}{} = :{}".format(
@@ -135,9 +121,7 @@ def _update_template_sql(table, columns):
                 )
                 for index, column in enumerate(set_columns)
             ),
-            "where {} = :{}".format(
-                _quote_identifier(where_column), names[where_column]
-            ),
+            f"where {_quote_identifier(where_column)} = :{names[where_column]}",
         )
     )
 
@@ -148,10 +132,8 @@ def _delete_template_sql(table, columns):
     where_column = _preferred_where_column(table, column_names)
     return "\n".join(
         (
-            "delete from {}".format(_quote_identifier(table)),
-            "where {} = :{}".format(
-                _quote_identifier(where_column), names[where_column]
-            ),
+            f"delete from {_quote_identifier(table)}",
+            f"where {_quote_identifier(where_column)} = :{names[where_column]}",
         )
     )
 
@@ -348,7 +330,7 @@ class ExecuteWriteView(BaseView):
         )
         if not db.is_mutable:
             return _block_framing(
-                _error(
+                Response.error(
                     ["Cannot execute write SQL because this database is immutable."],
                     403,
                 )
@@ -367,10 +349,10 @@ class ExecuteWriteView(BaseView):
             actor=request.actor,
         ):
             return _block_framing(
-                _error(["Permission denied: need execute-write-sql"], 403)
+                Response.error(["Permission denied: need execute-write-sql"], 403)
             )
         if not db.is_mutable:
-            return _block_framing(_error(["Database is immutable"], 403))
+            return _block_framing(Response.error(["Database is immutable"], 403))
 
         data = {}
         is_json = request.headers.get("content-type", "").startswith("application/json")
@@ -384,7 +366,7 @@ class ExecuteWriteView(BaseView):
             )
         except QueryValidationError as ex:
             if _wants_json(request, is_json, data):
-                return _block_framing(_error([ex.message], ex.status))
+                return _block_framing(Response.error([ex.message], ex.status))
             if ex.flash:
                 self.ds.add_message(request, ex.message, self.ds.ERROR)
             return await self._render_form(
@@ -405,7 +387,7 @@ class ExecuteWriteView(BaseView):
         except sqlite3.DatabaseError as ex:
             message = str(ex)
             if wants_json:
-                return _block_framing(_error([message], 400))
+                return _block_framing(Response.error([message], 400))
             return await self._render_form(
                 request,
                 db,
@@ -488,20 +470,18 @@ class ExecuteWriteAnalyzeView(BaseView):
             actor=request.actor,
         ):
             return _block_framing(
-                _error(["Permission denied: need execute-write-sql"], 403)
+                Response.error(["Permission denied: need execute-write-sql"], 403)
             )
 
         invalid_keys = set(request.args) - {"sql"}
         if invalid_keys:
             return _block_framing(
-                _error(
+                Response.error(
                     ["Invalid keys: {}".format(", ".join(sorted(invalid_keys)))],
                     400,
                 )
             )
         sql = request.args.get("sql") or ""
-        return _block_framing(
-            Response.json(
-                await _execute_write_analysis_data(self.ds, db, sql, request.actor)
-            )
-        )
+        analysis = await _execute_write_analysis_data(self.ds, db, sql, request.actor)
+        analysis["unstable"] = UNSTABLE_API_MESSAGE
+        return _block_framing(Response.json(analysis))
diff --git a/datasette/views/index.py b/datasette/views/index.py
index 6a9462ac..f73ee38a 100644
--- a/datasette/views/index.py
+++ b/datasette/views/index.py
@@ -2,10 +2,11 @@ import json
 
 from datasette.plugins import pm
 from datasette.utils import (
+    UNSTABLE_API_MESSAGE,
+    CustomJSONEncoder,
     add_cors_headers,
     await_me_maybe,
     make_slot_function,
-    CustomJSONEncoder,
 )
 from datasette.utils.asgi import Response
 from datasette.version import __version__
@@ -45,15 +46,15 @@ class IndexView(BaseView):
 
         databases = []
         # Iterate over allowed databases instead of all databases
-        for name in allowed_db_dict.keys():
+        for name, allowed_db in allowed_db_dict.items():
             db = self.ds.databases[name]
-            database_private = allowed_db_dict[name].private
+            database_private = allowed_db.private
 
             # Get allowed tables/views for this database
             allowed_for_db = tables_by_db.get(name, {})
 
             # Get table names from allowed set instead of db.table_names()
-            table_names = [child_name for child_name in allowed_for_db.keys()]
+            table_names = [child_name for child_name in allowed_for_db]
 
             hidden_table_names = set(await db.hidden_table_names())
 
@@ -98,7 +99,7 @@ class IndexView(BaseView):
                 # We will be sorting by number of relationships, so populate that field
                 all_foreign_keys = await db.get_all_foreign_keys()
                 for table, foreign_keys in all_foreign_keys.items():
-                    if table in tables.keys():
+                    if table in tables:
                         count = len(foreign_keys["incoming"] + foreign_keys["outgoing"])
                         tables[table]["num_relationships_for_sorting"] = count
 
@@ -120,8 +121,7 @@ class IndexView(BaseView):
             # Only add views if this is less than TRUNCATE_AT
             if len(tables_and_views_truncated) < TRUNCATE_AT:
                 num_views_to_add = TRUNCATE_AT - len(tables_and_views_truncated)
-                for view in views[:num_views_to_add]:
-                    tables_and_views_truncated.append(view)
+                tables_and_views_truncated.extend(views[:num_views_to_add])
 
             databases.append(
                 {
@@ -151,7 +151,9 @@ class IndexView(BaseView):
             return Response(
                 json.dumps(
                     {
-                        "databases": {db["name"]: db for db in databases},
+                        "ok": True,
+                        "unstable": UNSTABLE_API_MESSAGE,
+                        "databases": databases,
                         "metadata": await self.ds.get_instance_metadata(),
                     },
                     cls=CustomJSONEncoder,
diff --git a/datasette/views/query_helpers.py b/datasette/views/query_helpers.py
index 026a999f..725d9cdb 100644
--- a/datasette/views/query_helpers.py
+++ b/datasette/views/query_helpers.py
@@ -5,6 +5,19 @@ from datasette.resources import DatabaseResource
 from datasette.stored_queries import (
     StoredQuery,
 )
+from datasette.utils import (
+    InvalidSql,
+    escape_sqlite,
+    parse_size_limit,
+    path_from_row_pks,
+    sqlite3,
+    validate_sql_select,
+)
+from datasette.utils import (
+    named_parameters as derive_named_parameters,
+)
+from datasette.utils.asgi import Forbidden
+from datasette.utils.sql_analysis import Operation, SQLAnalysis
 from datasette.write_sql import (
     IgnoreWriteSqlOperation,
     QueryWriteRejected,
@@ -12,16 +25,6 @@ from datasette.write_sql import (
     decision_for_write_sql_operation,
     operation_is_write,
 )
-from datasette.utils import (
-    named_parameters as derive_named_parameters,
-    escape_sqlite,
-    path_from_row_pks,
-    sqlite3,
-    validate_sql_select,
-    InvalidSql,
-)
-from datasette.utils.asgi import Forbidden
-from datasette.utils.sql_analysis import Operation, SQLAnalysis
 
 _query_name_re = re.compile(r"^[^/\.\n]+$")
 
@@ -32,7 +35,6 @@ _query_fields = {
     "hide_sql",
     "fragment",
     "parameters",
-    "params",
     "is_private",
     "on_success_message",
     "on_success_redirect",
@@ -91,16 +93,14 @@ def _as_optional_bool(value, name):
             return True
         if lowered in {"0", "false", "f", "no", "off"}:
             return False
-    raise QueryValidationError("{} must be 0 or 1".format(name))
+    raise QueryValidationError(f"{name} must be 0 or 1")
 
 
-def _query_list_limit(value, default=50):
-    if value in (None, ""):
-        return default
+def _query_list_limit(value, default, maximum):
     try:
-        return min(max(1, int(value)), 1000)
+        return parse_size_limit(value, default, maximum)
     except ValueError as ex:
-        raise QueryValidationError("_size must be an integer") from ex
+        raise QueryValidationError(str(ex)) from ex
 
 
 def _derived_query_parameters(sql):
@@ -173,7 +173,7 @@ async def _json_or_form_payload(request):
         try:
             return json.loads(body or b"{}"), True
         except json.JSONDecodeError as e:
-            raise QueryValidationError("Invalid JSON: {}".format(e))
+            raise QueryValidationError(f"Invalid JSON: {e}")
     return await request.post_vars(), False
 
 
@@ -194,7 +194,7 @@ async def _analyze_user_query(datasette, db, sql, *, actor):
     try:
         analysis = await db.analyze_sql(sql, params)
     except sqlite3.DatabaseError as ex:
-        raise QueryValidationError("Could not analyze query: {}".format(ex)) from ex
+        raise QueryValidationError(f"Could not analyze query: {ex}") from ex
 
     is_write = _analysis_is_write(analysis)
     if is_write:
@@ -295,8 +295,7 @@ def _coerce_execute_write_payload(data, is_json):
         for key, value in data.items():
             if key in {"sql", "csrftoken", "_json"}:
                 continue
-            if key.startswith(SQL_PARAMETER_FORM_PREFIX):
-                key = key[len(SQL_PARAMETER_FORM_PREFIX) :]
+            key = key.removeprefix(SQL_PARAMETER_FORM_PREFIX)
             params[key] = value
     if not isinstance(params, dict):
         raise QueryValidationError("params must be a dictionary")
@@ -316,7 +315,7 @@ async def _prepare_execute_write(datasette, db, sql, params, actor):
     try:
         analysis = await db.analyze_sql(sql, params)
     except sqlite3.DatabaseError as ex:
-        raise QueryValidationError("Could not analyze query: {}".format(ex)) from ex
+        raise QueryValidationError(f"Could not analyze query: {ex}") from ex
     if not _analysis_is_write(analysis):
         raise QueryValidationError(
             "Use /-/query for read-only SQL; this endpoint only executes writes"
@@ -498,7 +497,7 @@ async def _inserted_row_url(datasette, db, analysis, cursor):
     )
     try:
         result = await db.execute(
-            "select {} from {} where rowid = ?".format(select, escape_sqlite(table)),
+            f"select {select} from {escape_sqlite(table)} where rowid = ?",
             [lastrowid],
         )
     except sqlite3.DatabaseError:
@@ -541,7 +540,7 @@ async def _prepare_query_create(datasette, request, db, data):
         raise QueryValidationError("Writable query fields require writable SQL")
 
     parameters = _coerce_query_parameters(
-        data.get("parameters", data.get("params")),
+        data.get("parameters"),
         derived,
     )
     return {
@@ -586,9 +585,9 @@ async def _prepare_query_update(datasette, request, db, existing: StoredQuery, u
             actor=request.actor,
         )
 
-    if "parameters" in update or "params" in update:
+    if "parameters" in update:
         parameters = _coerce_query_parameters(
-            update.get("parameters", update.get("params")),
+            update.get("parameters"),
             derived,
         )
     elif "sql" in update:
diff --git a/datasette/views/row.py b/datasette/views/row.py
index 4d61eb91..b1388299 100644
--- a/datasette/views/row.py
+++ b/datasette/views/row.py
@@ -1,32 +1,395 @@
-from datasette.utils.asgi import NotFound, Forbidden, Response
-from datasette.database import QueryInterrupted
-from datasette.events import UpdateRowEvent, DeleteRowEvent
-from datasette.resources import TableResource
-from .base import DataView, BaseView, _error
-from datasette.utils import (
-    await_me_maybe,
-    CustomRow,
-    make_slot_function,
-    path_from_row_pks,
-    to_css_class,
-    escape_sqlite,
-)
-from datasette.plugins import pm
+import asyncio
 import json
+import textwrap
+import time
+import urllib.parse
+from dataclasses import dataclass, field
+
 import markupsafe
 import sqlite_utils
-from datasette.extras import extra_names_from_request
+
+from datasette.database import QueryInterrupted
+from datasette.events import DeleteRowEvent, UpdateRowEvent
+from datasette.extras import ExtraScope, extra_names_from_request
+from datasette.plugins import pm
+from datasette.resources import TableResource
+from datasette.utils import (
+    CustomJSONEncoder,
+    CustomRow,
+    InvalidSql,
+    WriteJsonValueError,
+    add_cors_headers,
+    await_me_maybe,
+    call_with_supported_arguments,
+    decode_write_json_row,
+    escape_sqlite,
+    make_slot_function,
+    path_from_row_pks,
+    path_with_format,
+    path_with_removed_args,
+    sqlite3,
+    to_css_class,
+)
+from datasette.utils.asgi import Forbidden, NotFound, PayloadTooLarge, Response
+
+from . import Context, from_extra
+from .base import BaseView, DatasetteError, stream_csv
 from .table import (
-    display_columns_and_rows,
     _table_page_data,
+    display_columns_and_rows,
     row_label_from_label_column,
 )
 from .table_extras import RowExtraContext, resolve_row_extras, table_extra_registry
 
 
-class RowView(DataView):
+@dataclass
+class RowContext(Context):
+    "The page showing an individual row, e.g. /fixtures/facetable/1."
+
+    documented_template = "row.html"
+    extras_scope = ExtraScope.ROW
+
+    # Fields resolved by registered extras - their documentation comes
+    # from the description on each Extra class in table_extras.py
+    columns: list = from_extra()
+    database: str = from_extra()
+    database_color: str = from_extra()
+    foreign_key_tables: list = from_extra()
+    metadata: dict = from_extra()
+    primary_keys: list = from_extra()
+    private: bool = from_extra()
+    table: str = from_extra()
+
+    # Fields added by the view code
+    ok: bool = field(
+        metadata={"help": "True if the data for this page was retrieved without errors"}
+    )
+    rows: list = field(
+        metadata={
+            "help": "A single-item list containing this row as a dictionary mapping column name to raw value."
+        }
+    )
+    primary_key_values: list = field(
+        metadata={"help": "Values of the primary keys for this row, from the URL"}
+    )
+    query_ms: float = field(
+        metadata={
+            "help": "Time taken by the SQL queries for this page, in milliseconds"
+        }
+    )
+    display_columns: list = field(
+        metadata={
+            "help": "Column metadata used by the HTML table display. Each item includes ``name``, ``sortable``, ``is_pk``, ``type``, ``notnull``, ``description``, ``column_type`` and ``column_type_config`` keys."
+        }
+    )
+    display_rows: list = field(
+        metadata={
+            "help": "Rows formatted for the HTML table display. Each row is iterable and contains cell dictionaries with ``column``, ``value``, ``raw`` and ``value_type`` keys."
+        }
+    )
+    custom_table_templates: list = field(
+        metadata={
+            "help": "Custom template names that were considered for displaying this row's table, in lookup order."
+        }
+    )
+    row_actions: list = field(
+        metadata={
+            "help": 'Row actions made available by core and plugin hooks. Each item is either a link with ``href``, ``label`` and optional ``description`` keys, or a button with ``type: "button"``, ``label``, optional ``description`` and optional ``attrs``. See :ref:`plugin_actions` and :ref:`plugin_hook_row_actions`.'
+        }
+    )
+    row_mutation_ui: bool = field(
+        metadata={"help": "True if the row edit/delete JavaScript UI should be enabled"}
+    )
+    table_page_data: dict = field(
+        metadata={
+            "help": "JSON data used by JavaScript on the row page. Includes ``database``, ``table`` and ``tableUrl``, plus optional ``foreignKeys`` mapping column names to autocomplete URLs."
+        }
+    )
+    top_row: callable = field(
+        metadata={
+            "help": "Async callable that renders the ``top_row`` plugin slot for this row and returns HTML."
+        }
+    )
+    renderers: dict = field(
+        metadata={
+            "help": "Dictionary mapping output format names such as ``json`` to URLs for this row in that format."
+        }
+    )
+    url_csv: str = field(metadata={"help": "URL for the CSV export of this page"})
+    url_csv_path: str = field(metadata={"help": "Path portion of the CSV export URL"})
+    url_csv_hidden_args: list = field(
+        metadata={
+            "help": "List of ``(name, value)`` pairs for hidden form fields used by the CSV export form, preserving current options while forcing ``_size=max``."
+        }
+    )
+    settings: dict = field(
+        metadata={
+            "help": "Dictionary of Datasette's current settings, keyed by setting name."
+        }
+    )
+    select_templates: list = field(
+        metadata={
+            "help": "List of template names that were considered for this page, with the selected template prefixed by ``*``."
+        }
+    )
+    alternate_url_json: str = field(
+        metadata={"help": "URL for the JSON version of this page"}
+    )
+
+
+class RowView(BaseView):
     name = "row"
 
+    def redirect(self, request, path, forward_querystring=True, remove_args=None):
+        if request.query_string and "?" not in path and forward_querystring:
+            path = f"{path}?{request.query_string}"
+        if remove_args:
+            path = path_with_removed_args(request, remove_args, path=path)
+        response = Response.redirect(path)
+        response.headers["Link"] = f"<{path}>; rel=preload"
+        if self.ds.cors:
+            add_cors_headers(response.headers)
+        return response
+
+    async def as_csv(self, request, database):
+        return await stream_csv(self.ds, self.data, request, database)
+
+    async def get(self, request):
+        db = await self.ds.resolve_database(request)
+        database = db.name
+        database_route = db.route
+        format_ = request.url_vars.get("format") or "html"
+        data_kwargs = {}
+
+        if format_ == "csv":
+            return await self.as_csv(request, database_route)
+
+        if format_ == "html":
+            # HTML views default to expanding all foreign key labels
+            data_kwargs["default_labels"] = True
+
+        extra_template_data = {}
+        start = time.perf_counter()
+        status_code = None
+        templates = ()
+        try:
+            response_or_template_contexts = await self.data(request, **data_kwargs)
+            if isinstance(response_or_template_contexts, Response):
+                return response_or_template_contexts
+            # If it has four items, it includes an HTTP status code
+            if len(response_or_template_contexts) == 4:
+                (
+                    data,
+                    extra_template_data,
+                    templates,
+                    status_code,
+                ) = response_or_template_contexts
+            else:
+                data, extra_template_data, templates = response_or_template_contexts
+        except QueryInterrupted as ex:
+            raise DatasetteError(
+                textwrap.dedent(f"""
+                <p>SQL query took too long. The time limit is controlled by the
+                <a href="https://docs.datasette.io/en/stable/settings.html#sql-time-limit-ms">sql_time_limit_ms</a>
+                configuration option.</p>
+                <textarea style="width: 90%">{markupsafe.escape(ex.sql)}</textarea>
+                <script>
+                let ta = document.querySelector("textarea");
+                ta.style.height = ta.scrollHeight + "px";
+                </script>
+            """).strip(),
+                title="SQL Interrupted",
+                status=400,
+                message_is_html=True,
+                plain_message=(
+                    "SQL query took too long. The time limit is"
+                    " controlled by the sql_time_limit_ms setting."
+                ),
+            )
+        except (sqlite3.OperationalError, InvalidSql) as e:
+            raise DatasetteError(str(e), title="Invalid SQL", status=400)
+        except DatasetteError:
+            raise
+
+        end = time.perf_counter()
+        data["query_ms"] = (end - start) * 1000
+
+        if format_ in self.ds.renderers:
+            # Dispatch request to the correct output format renderer
+            # (CSV is not handled here due to streaming)
+            result = call_with_supported_arguments(
+                self.ds.renderers[format_][0],
+                datasette=self.ds,
+                columns=data.get("columns") or [],
+                rows=data.get("rows") or [],
+                sql=data.get("query", {}).get("sql", None),
+                query_name=data.get("query_name"),
+                database=database,
+                table=data.get("table"),
+                request=request,
+                view_name=self.name,
+                truncated=False,  # TODO: support this
+                error=data.get("error"),
+                # These will be deprecated in Datasette 1.0:
+                args=request.args,
+                data=data,
+            )
+            if asyncio.iscoroutine(result):
+                result = await result
+            if result is None:
+                raise NotFound("No data")
+            if isinstance(result, dict):
+                response = Response(
+                    body=result.get("body"),
+                    status=result.get("status_code", status_code or 200),
+                    content_type=result.get("content_type", "text/plain"),
+                    headers=result.get("headers"),
+                )
+            elif isinstance(result, Response):
+                response = result
+                if status_code is not None:
+                    # Over-ride the status code
+                    response.status = status_code
+            else:
+                assert False, f"{result} should be dict or Response"
+        elif format_ == "html":
+            response = await self.html(request, data, extra_template_data, templates)
+            if status_code is not None:
+                response.status = status_code
+        else:
+            raise NotFound(f"Invalid format: {format_}")
+
+        ttl = request.args.get("_ttl", None)
+        if ttl is None or not ttl.isdigit():
+            ttl = self.ds.setting("default_cache_ttl")
+
+        return self.set_response_headers(response, ttl)
+
+    async def html(self, request, data, extra_template_data, templates):
+        extras = {}
+        if callable(extra_template_data):
+            extras = extra_template_data()
+            if asyncio.iscoroutine(extras):
+                extras = await extras
+        else:
+            extras = extra_template_data
+
+        url_labels_extra = {}
+        if data.get("expandable_columns"):
+            url_labels_extra = {"_labels": "on"}
+
+        renderers = {}
+        for key, (_, can_render) in self.ds.renderers.items():
+            it_can_render = call_with_supported_arguments(
+                can_render,
+                datasette=self.ds,
+                columns=data.get("columns") or [],
+                rows=data.get("rows") or [],
+                sql=data.get("query", {}).get("sql", None),
+                query_name=data.get("query_name"),
+                database=data.get("database"),
+                table=data.get("table"),
+                request=request,
+                view_name=self.name,
+            )
+            it_can_render = await await_me_maybe(it_can_render)
+            if it_can_render:
+                renderers[key] = self.ds.urls.path(
+                    path_with_format(
+                        request=request,
+                        path=request.scope.get("route_path"),
+                        format=key,
+                        extra_qs={**url_labels_extra},
+                    )
+                )
+
+        url_csv_args = {"_size": "max", **url_labels_extra}
+        url_csv = self.ds.urls.path(
+            path_with_format(
+                request=request,
+                path=request.scope.get("route_path"),
+                format="csv",
+                extra_qs=url_csv_args,
+            )
+        )
+        url_csv_path = url_csv.split("?")[0]
+        context = {**data, **extras}
+        if "metadata" not in context:
+            context["metadata"] = await self.ds.get_instance_metadata()
+
+        environment = self.ds.get_jinja_environment(request)
+        template = environment.select_template(templates)
+        alternate_url_json = self.ds.absolute_url(
+            request,
+            self.ds.urls.path(
+                path_with_format(
+                    request=request,
+                    path=request.scope.get("route_path"),
+                    format="json",
+                )
+            ),
+        )
+        return Response.html(
+            await self.ds.render_template(
+                template,
+                RowContext(
+                    columns=context["columns"],
+                    database=context["database"],
+                    database_color=context["database_color"],
+                    foreign_key_tables=context["foreign_key_tables"],
+                    metadata=context["metadata"],
+                    primary_keys=context["primary_keys"],
+                    private=context["private"],
+                    table=context["table"],
+                    ok=context["ok"],
+                    rows=context["rows"],
+                    primary_key_values=context["primary_key_values"],
+                    query_ms=context["query_ms"],
+                    display_columns=context["display_columns"],
+                    display_rows=context["display_rows"],
+                    custom_table_templates=context["custom_table_templates"],
+                    row_actions=context["row_actions"],
+                    row_mutation_ui=context["row_mutation_ui"],
+                    table_page_data=context["table_page_data"],
+                    top_row=context["top_row"],
+                    renderers=renderers,
+                    url_csv=url_csv,
+                    url_csv_path=url_csv_path,
+                    url_csv_hidden_args=[
+                        (key, value)
+                        for key, value in urllib.parse.parse_qsl(request.query_string)
+                        if key not in ("_labels", "_facet", "_size")
+                    ]
+                    + [("_size", "max")],
+                    settings=self.ds.settings_dict(),
+                    select_templates=[
+                        f"{'*' if template_name == template.name else ''}{template_name}"
+                        for template_name in templates
+                    ],
+                    alternate_url_json=alternate_url_json,
+                ),
+                request=request,
+                view_name=self.name,
+            ),
+            headers={
+                "Link": f'<{alternate_url_json}>; rel="alternate"; type="application/json+datasette"'
+            },
+        )
+
+    def set_response_headers(self, response, ttl):
+        # Set far-future cache expiry
+        if self.ds.cache_headers and response.status == 200:
+            ttl = int(ttl)
+            if ttl == 0:
+                ttl_header = "no-cache"
+            else:
+                ttl_header = f"max-age={ttl}"
+            response.headers["Cache-Control"] = ttl_header
+        response.headers["Referrer-Policy"] = "no-referrer"
+        if self.ds.cors:
+            add_cors_headers(response.headers)
+        return response
+
     async def data(self, request, default_labels=False):
         resolved = await self.ds.resolve_row(request)
         db = resolved.db
@@ -134,7 +497,7 @@ class RowView(DataView):
 
             row_action_label = pk_path
             if row_label and row_label != pk_path:
-                row_action_label = "{} {}".format(pk_path, row_label)
+                row_action_label = f"{pk_path} {row_label}"
 
             row_action_permissions = {}
             if is_table and db.is_mutable:
@@ -147,7 +510,7 @@ class RowView(DataView):
             row_actions = []
             if row_action_permissions.get("update-row"):
                 attrs = {
-                    "aria-label": "Edit row {}".format(row_action_label),
+                    "aria-label": f"Edit row {row_action_label}",
                     "data-row": row_path,
                     "data-row-action": "edit",
                 }
@@ -163,7 +526,7 @@ class RowView(DataView):
                 )
             if row_action_permissions.get("delete-row"):
                 attrs = {
-                    "aria-label": "Delete row {}".format(row_action_label),
+                    "aria-label": f"Delete row {row_action_label}",
                     "data-row": row_path,
                     "data-row-action": "delete",
                 }
@@ -205,13 +568,14 @@ class RowView(DataView):
                 ],
                 "row_mutation_ui": any(row_action_permissions.values()),
                 "table_page_data": await _table_page_data(
-                    self.ds,
-                    request,
-                    db,
-                    database,
-                    table,
-                    not is_table,
-                    None,
+                    datasette=self.ds,
+                    request=request,
+                    db=db,
+                    database_name=database,
+                    table_name=table,
+                    is_view=not is_table,
+                    table_insert_ui=None,
+                    table_alter_ui=None,
                 ),
                 "row_actions": row_actions,
                 "top_row": make_slot_function(
@@ -236,6 +600,9 @@ class RowView(DataView):
         }
 
         extras = extra_names_from_request(request)
+        if request.url_vars.get("format"):
+            # Data formats reject unknown extras; HTML ignores them
+            table_extra_registry.validate_requested(extras, ExtraScope.ROW)
 
         # Process extras
         row_extra_context = RowExtraContext(
@@ -309,7 +676,7 @@ class RowView(DataView):
                 key,
                 ",".join(pk_values),
             )
-            foreign_key_tables.append({**fk, **{"count": count, "link": link}})
+            foreign_key_tables.append({**fk, "count": count, "link": link})
         return foreign_key_tables
 
 
@@ -335,21 +702,21 @@ async def _row_flash_message(db, action, resolved, row=None):
     if label:
         label = _truncated_row_flash_label(label)
     if label and label != pk_label:
-        return "{} row {} ({})".format(action, pk_label, label)
-    return "{} row {}".format(action, pk_label)
+        return f"{action} row {pk_label} ({label})"
+    return f"{action} row {pk_label}"
 
 
 async def _resolve_row_and_check_permission(datasette, request, permission):
-    from datasette.app import DatabaseNotFound, TableNotFound, RowNotFound
+    from datasette.app import DatabaseNotFound, RowNotFound, TableNotFound
 
     try:
         resolved = await datasette.resolve_row(request)
     except DatabaseNotFound as e:
-        return False, _error(["Database not found: {}".format(e.database_name)], 404)
+        return False, Response.error([f"Database not found: {e.database_name}"], 404)
     except TableNotFound as e:
-        return False, _error(["Table not found: {}".format(e.table)], 404)
+        return False, Response.error([f"Table not found: {e.table}"], 404)
     except RowNotFound as e:
-        return False, _error(["Record not found: {}".format(e.pk_values)], 404)
+        return False, Response.error([f"Record not found: {e.pk_values}"], 404)
 
     # Ensure user has permission to delete this row
     if not await datasette.allowed(
@@ -357,7 +724,7 @@ async def _resolve_row_and_check_permission(datasette, request, permission):
         resource=TableResource(database=resolved.db.name, table=resolved.table),
         actor=request.actor,
     ):
-        return False, _error(["Permission denied"], 403)
+        return False, Response.error(["Permission denied"], 403)
 
     return True, resolved
 
@@ -381,8 +748,9 @@ class RowDeleteView(BaseView):
 
         try:
             await resolved.db.execute_write_fn(delete_row, request=request)
-        except Exception as e:
-            return _error([str(e)], 500)
+        except Exception as e:  # noqa: BLE001
+            # TODO: narrow to expected write errors so Datasette bugs surface as 500s
+            return Response.error([str(e)], 400)
 
         await self.ds.track_event(
             DeleteRowEvent(
@@ -421,18 +789,24 @@ class RowUpdateView(BaseView):
         try:
             data = await request.json()
         except json.JSONDecodeError as e:
-            return _error(["Invalid JSON: {}".format(e)])
+            return Response.error([f"Invalid JSON: {e}"])
+        except PayloadTooLarge as e:
+            return Response.error([str(e)], 413)
 
         if not isinstance(data, dict):
-            return _error(["JSON must be a dictionary"])
+            return Response.error(["JSON must be a dictionary"])
         if "update" not in data or not isinstance(data["update"], dict):
-            return _error(["JSON must contain an update dictionary"])
+            return Response.error(["JSON must contain an update dictionary"])
 
         invalid_keys = set(data.keys()) - {"update", "return", "alter"}
         if invalid_keys:
-            return _error(["Invalid keys: {}".format(", ".join(invalid_keys))])
+            return Response.error(["Invalid keys: {}".format(", ".join(invalid_keys))])
 
         update = data["update"]
+        try:
+            update = decode_write_json_row(update)
+        except WriteJsonValueError as e:
+            return Response.error([str(e)], 400)
 
         # Validate column types
         from datasette.views.table import _validate_column_types
@@ -441,7 +815,7 @@ class RowUpdateView(BaseView):
             self.ds, resolved.db.name, resolved.table, [update]
         )
         if ct_errors:
-            return _error(ct_errors, 400)
+            return Response.error(ct_errors, 400)
 
         alter = data.get("alter")
         if alter and not await self.ds.allowed(
@@ -449,7 +823,7 @@ class RowUpdateView(BaseView):
             resource=TableResource(database=resolved.db.name, table=resolved.table),
             actor=request.actor,
         ):
-            return _error(["Permission denied for alter-table"], 403)
+            return Response.error(["Permission denied for alter-table"], 403)
 
         def update_row(conn):
             sqlite_utils.Database(conn)[resolved.table].update(
@@ -458,8 +832,9 @@ class RowUpdateView(BaseView):
 
         try:
             await resolved.db.execute_write_fn(update_row, request=request)
-        except Exception as e:
-            return _error([str(e)], 400)
+        except Exception as e:  # noqa: BLE001
+            # TODO: narrow to expected write errors so Datasette bugs surface as 500s
+            return Response.error([str(e)], 400)
 
         result = {"ok": True}
         returned_row = None
@@ -468,7 +843,7 @@ class RowUpdateView(BaseView):
                 resolved.sql, resolved.params, truncate=True
             )
             returned_row = results.dicts()[0]
-            result["row"] = returned_row
+            result["rows"] = [returned_row]
 
         await self.ds.track_event(
             UpdateRowEvent(
@@ -494,4 +869,4 @@ class RowUpdateView(BaseView):
                 self.ds.INFO,
             )
 
-        return Response.json(result, status=200)
+        return Response.json(result, status=200, default=CustomJSONEncoder().default)
diff --git a/datasette/views/special.py b/datasette/views/special.py
index 3245bc13..a77f221f 100644
--- a/datasette/views/special.py
+++ b/datasette/views/special.py
@@ -1,20 +1,25 @@
 import json
 import logging
+import secrets
+import urllib
+
+from datasette.events import CreateTokenEvent, LoginEvent, LogoutEvent
 from datasette.jump import JumpSQL, namespace_sql_params
 from datasette.plugins import pm
-from datasette.events import LogoutEvent, LoginEvent, CreateTokenEvent
 from datasette.resources import DatabaseResource, TableResource
-from datasette.utils.asgi import Response, Forbidden
 from datasette.utils import (
+    UNSTABLE_API_MESSAGE,
     actor_matches_allow,
     add_cors_headers,
     await_me_maybe,
-    tilde_encode,
+    error_body,
+    parse_size_limit,
     tilde_decode,
+    tilde_encode,
 )
+from datasette.utils.asgi import Forbidden, Response
+
 from .base import BaseView, View
-import secrets
-import urllib
 
 logger = logging.getLogger(__name__)
 
@@ -52,9 +57,9 @@ class JsonDataView(BaseView):
         if self.permission:
             await self.ds.ensure_permission(action=self.permission, actor=request.actor)
         if self.needs_request:
-            data = self.data_callback(request)
+            data = await await_me_maybe(self.data_callback(request))
         else:
-            data = self.data_callback()
+            data = await await_me_maybe(self.data_callback())
 
         # Return JSON or HTML depending on format parameter
         as_format = request.url_vars.get("format")
@@ -62,6 +67,8 @@ class JsonDataView(BaseView):
             headers = {}
             if self.ds.cors:
                 add_cors_headers(headers)
+            if isinstance(data, dict):
+                data = {"ok": True, **data}
             return Response.json(data, headers=headers)
         else:
             context = {
@@ -174,9 +181,7 @@ class AutocompleteDebugView(BaseView):
                     )
                     context.update(
                         {
-                            "autocomplete_url": "{}/-/autocomplete".format(
-                                self.ds.urls.table(database_name, table_name)
-                            ),
+                            "autocomplete_url": f"{self.ds.urls.table(database_name, table_name)}/-/autocomplete",
                             "label_column": await db.label_column_for_table(table_name),
                         }
                     )
@@ -292,6 +297,12 @@ class PermissionsDebugView(BaseView):
         response, status = await _check_permission_for_actor(
             self.ds, permission, parent, child, actor
         )
+        if response.get("ok"):
+            response = {
+                "ok": True,
+                "unstable": UNSTABLE_API_MESSAGE,
+                **response,
+            }
         return Response.json(response, status=status)
 
 
@@ -348,29 +359,32 @@ class AllowedResourcesView(BaseView):
     async def _allowed_payload(self, request, has_debug_permission):
         action = request.args.get("action")
         if not action:
-            return {"error": "action parameter is required"}, 400
+            return error_body("action parameter is required", 400), 400
         if action not in self.ds.actions:
-            return {"error": f"Unknown action: {action}"}, 404
+            return error_body(f"Unknown action: {action}", 404), 404
 
         actor = request.actor if isinstance(request.actor, dict) else None
         actor_id = actor.get("id") if actor else None
         parent_filter = request.args.get("parent")
         child_filter = request.args.get("child")
         if child_filter and not parent_filter:
-            return {"error": "parent must be provided when child is specified"}, 400
+            return (
+                error_body("parent must be provided when child is specified", 400),
+                400,
+            )
 
         try:
-            page = int(request.args.get("page", "1"))
-            page_size = int(request.args.get("page_size", "50"))
+            page = int(request.args.get("_page", "1"))
+            if page < 1:
+                raise ValueError
         except ValueError:
-            return {"error": "page and page_size must be integers"}, 400
-        if page < 1:
-            return {"error": "page must be >= 1"}, 400
-        if page_size < 1:
-            return {"error": "page_size must be >= 1"}, 400
-        max_page_size = 200
-        if page_size > max_page_size:
-            page_size = max_page_size
+            return error_body("_page must be a positive integer", 400), 400
+        try:
+            page_size = parse_size_limit(
+                request.args.get("_size"), default=50, maximum=200
+            )
+        except ValueError as ex:
+            return error_body(str(ex), 400), 400
         offset = (page - 1) * page_size
 
         # Use the simplified allowed_resources method
@@ -406,10 +420,14 @@ class AllowedResourcesView(BaseView):
                     row["reason"] = resource.reasons
 
                 allowed_rows.append(row)
-        except Exception:
-            # If catalog tables don't exist yet, return empty results
+        except Exception:  # noqa: BLE001
+            # Returns empty results if the catalog tables don't exist yet, but
+            # also swallows the AttributeError raised for instance-level actions
+            # such as view-instance, which have no resource_class.
+            # TODO: handle that case explicitly and narrow this to sqlite3.Error
             return (
                 {
+                    "ok": True,
                     "action": action,
                     "actor_id": actor_id,
                     "page": page,
@@ -434,16 +452,17 @@ class AllowedResourcesView(BaseView):
         def build_page_url(page_number):
             pairs = []
             for key in request.args:
-                if key in {"page", "page_size"}:
+                if key in {"_page", "_size"}:
                     continue
                 for value in request.args.getlist(key):
                     pairs.append((key, value))
-            pairs.append(("page", str(page_number)))
-            pairs.append(("page_size", str(page_size)))
+            pairs.append(("_page", str(page_number)))
+            pairs.append(("_size", str(page_size)))
             query = urllib.parse.urlencode(pairs)
             return f"{request.path}?{query}"
 
         response = {
+            "ok": True,
             "action": action,
             "actor_id": actor_id,
             "page": page,
@@ -485,31 +504,29 @@ class PermissionRulesView(BaseView):
         # JSON API - action parameter is required
         action = request.args.get("action")
         if not action:
-            return Response.json({"error": "action parameter is required"}, status=400)
+            return Response.error("action parameter is required", 400)
         if action not in self.ds.actions:
-            return Response.json({"error": f"Unknown action: {action}"}, status=404)
+            return Response.error(f"Unknown action: {action}", 404)
 
         actor = request.actor if isinstance(request.actor, dict) else None
 
         try:
-            page = int(request.args.get("page", "1"))
-            page_size = int(request.args.get("page_size", "50"))
+            page = int(request.args.get("_page", "1"))
+            if page < 1:
+                raise ValueError
         except ValueError:
-            return Response.json(
-                {"error": "page and page_size must be integers"}, status=400
+            return Response.error("_page must be a positive integer", 400)
+        try:
+            page_size = parse_size_limit(
+                request.args.get("_size"), default=50, maximum=200
             )
-        if page < 1:
-            return Response.json({"error": "page must be >= 1"}, status=400)
-        if page_size < 1:
-            return Response.json({"error": "page_size must be >= 1"}, status=400)
-        max_page_size = 200
-        if page_size > max_page_size:
-            page_size = max_page_size
+        except ValueError as ex:
+            return Response.error(str(ex), 400)
         offset = (page - 1) * page_size
 
         from datasette.utils.actions_sql import build_permission_rules_sql
 
-        union_sql, union_params, restriction_sqls = await build_permission_rules_sql(
+        union_sql, union_params, _restriction_sqls = await build_permission_rules_sql(
             self.ds, actor, action
         )
         await self.ds.refresh_schemas()
@@ -555,16 +572,17 @@ class PermissionRulesView(BaseView):
         def build_page_url(page_number):
             pairs = []
             for key in request.args:
-                if key in {"page", "page_size"}:
+                if key in {"_page", "_size"}:
                     continue
                 for value in request.args.getlist(key):
                     pairs.append((key, value))
-            pairs.append(("page", str(page_number)))
-            pairs.append(("page_size", str(page_size)))
+            pairs.append(("_page", str(page_number)))
+            pairs.append(("_size", str(page_size)))
             query = urllib.parse.urlencode(pairs)
             return f"{request.path}?{query}"
 
         response = {
+            "ok": True,
             "action": action,
             "actor_id": (actor or {}).get("id") if actor else None,
             "page": page,
@@ -585,17 +603,17 @@ class PermissionRulesView(BaseView):
 
 
 async def _check_permission_for_actor(ds, action, parent, child, actor):
-    """Shared logic for checking permissions. Returns a dict with check results."""
+    """Shared logic for checking and explaining a permission decision."""
     if action not in ds.actions:
-        return {"error": f"Unknown action: {action}"}, 404
+        return error_body(f"Unknown action: {action}", 404), 404
 
     if child and not parent:
-        return {"error": "parent is required when child is provided"}, 400
+        return error_body("parent is required when child is provided", 400), 400
 
     # Use the action's properties to create the appropriate resource object
     action_obj = ds.actions.get(action)
     if not action_obj:
-        return {"error": f"Unknown action: {action}"}, 400
+        return error_body(f"Unknown action: {action}", 400), 400
 
     # Global actions (no resource_class) don't have a resource
     if action_obj.resource_class is None:
@@ -610,18 +628,32 @@ async def _check_permission_for_actor(ds, action, parent, child, actor):
         resource_obj = action_obj.resource_class(parent)
     else:
         # This shouldn't happen given validation in Action.__post_init__
-        return {"error": f"Invalid action configuration: {action}"}, 500
+        return error_body(f"Invalid action configuration: {action}", 500), 500
 
     allowed = await ds.allowed(action=action, resource=resource_obj, actor=actor)
 
+    from datasette.utils.actions_sql import explain_permission_for_resource
+
+    explanation = await explain_permission_for_resource(
+        datasette=ds,
+        actor=actor,
+        action=action,
+        parent=parent,
+        child=child,
+    )
+
     response = {
+        "ok": True,
+        "unstable": UNSTABLE_API_MESSAGE,
         "action": action,
         "allowed": bool(allowed),
+        "actor": actor,
         "resource": {
             "parent": parent,
             "child": child,
             "path": _resource_path(parent, child),
         },
+        "explanation": explanation,
     }
 
     if actor and "id" in actor:
@@ -639,11 +671,25 @@ class PermissionCheckView(BaseView):
         as_format = request.url_vars.get("format")
 
         if not as_format:
+            actions = [
+                {
+                    "name": action.name,
+                    "description": action.description,
+                    "takes_parent": action.takes_parent,
+                    "takes_child": action.takes_child,
+                    "also_requires": action.also_requires,
+                }
+                for action in sorted(
+                    self.ds.actions.values(), key=lambda action: action.name
+                )
+            ]
             return await self.render(
                 ["debug_check.html"],
                 request,
                 {
-                    "sorted_actions": sorted(self.ds.actions.keys()),
+                    "actions": actions,
+                    "actor_json": request.args.get("actor")
+                    or json.dumps(request.actor, indent=2),
                     "has_debug_permission": True,
                 },
             )
@@ -651,13 +697,22 @@ class PermissionCheckView(BaseView):
         # JSON API - action parameter is required
         action = request.args.get("action")
         if not action:
-            return Response.json({"error": "action parameter is required"}, status=400)
+            return Response.error("action parameter is required", 400)
 
         parent = request.args.get("parent")
         child = request.args.get("child")
+        actor = request.actor
+        actor_json = request.args.get("actor")
+        if actor_json is not None:
+            try:
+                actor = json.loads(actor_json)
+            except json.JSONDecodeError as ex:
+                return Response.error(f"Invalid actor JSON: {ex}", 400)
+            if actor is not None and not isinstance(actor, dict):
+                return Response.error("actor must be a JSON object or null", 400)
 
         response, status = await _check_permission_for_actor(
-            self.ds, action, parent, child, request.actor
+            self.ds, action, parent, child, actor
         )
         return Response.json(response, status=status)
 
@@ -884,7 +939,7 @@ class ApiExplorerView(BaseView):
                 tables.append({"name": table, "links": table_links})
                 table_links.append(
                     {
-                        "label": "Get rows for {}".format(table),
+                        "label": f"Get rows for {table}",
                         "method": "GET",
                         "path": self.ds.urls.table(name, table, format="json"),
                     }
@@ -904,7 +959,7 @@ class ApiExplorerView(BaseView):
                             {
                                 "path": self.ds.urls.table(name, table) + "/-/insert",
                                 "method": "POST",
-                                "label": "Insert rows into {}".format(table),
+                                "label": f"Insert rows into {table}",
                                 "json": {
                                     "rows": [
                                         {
@@ -918,7 +973,7 @@ class ApiExplorerView(BaseView):
                             {
                                 "path": self.ds.urls.table(name, table) + "/-/upsert",
                                 "method": "POST",
-                                "label": "Upsert rows into {}".format(table),
+                                "label": f"Upsert rows into {table}",
                                 "json": {
                                     "rows": [
                                         {
@@ -948,7 +1003,7 @@ class ApiExplorerView(BaseView):
                     table_links.append(
                         {
                             "path": self.ds.urls.table(name, table) + "/-/drop",
-                            "label": "Drop table {}".format(table),
+                            "label": f"Drop table {table}",
                             "json": {"confirm": False},
                             "method": "POST",
                         }
@@ -965,7 +1020,7 @@ class ApiExplorerView(BaseView):
                 database_links.append(
                     {
                         "path": self.ds.urls.database(name) + "/-/create",
-                        "label": "Create table in {}".format(name),
+                        "label": f"Create table in {name}",
                         "json": {
                             "table": "new_table",
                             "columns": [
@@ -1198,7 +1253,7 @@ class JumpView(BaseView):
                 match["display_name"] = row["display_name"]
             matches.append(match)
 
-        return Response.json({"matches": matches, "truncated": truncated})
+        return Response.json({"ok": True, "matches": matches, "truncated": truncated})
 
 
 class SchemaBaseView(BaseView):
@@ -1220,7 +1275,7 @@ class SchemaBaseView(BaseView):
         headers = {}
         if self.ds.cors:
             add_cors_headers(headers)
-        return Response.json(data, headers=headers)
+        return Response.json({"ok": True, **data}, headers=headers)
 
     def format_error_response(self, error_message, format_, status=404):
         """Format error response based on requested format."""
@@ -1229,7 +1284,7 @@ class SchemaBaseView(BaseView):
             if self.ds.cors:
                 add_cors_headers(headers)
             return Response.json(
-                {"ok": False, "error": error_message}, status=status, headers=headers
+                error_body(error_message, status), status=status, headers=headers
             )
         else:
             return Response.text(error_message, status=status)
@@ -1305,17 +1360,17 @@ class DatabaseSchemaView(SchemaBaseView):
         database_name = request.url_vars["database"]
         format_ = request.url_vars.get("format") or "html"
 
-        # Check if database exists
-        if database_name not in self.ds.databases:
-            return self.format_error_response("Database not found", format_)
-
-        # Check view-database permission
+        # Permission check comes first, so actors without view-database
+        # cannot distinguish existing databases from missing ones
         await self.ds.ensure_permission(
             action="view-database",
             resource=DatabaseResource(database=database_name),
             actor=request.actor,
         )
 
+        if database_name not in self.ds.databases:
+            return self.format_error_response("Database not found", format_)
+
         schema = await self.get_database_schema(database_name)
 
         if format_ == "json":
@@ -1349,6 +1404,9 @@ class TableSchemaView(SchemaBaseView):
             actor=request.actor,
         )
 
+        if database_name not in self.ds.databases:
+            return self.format_error_response("Database not found", format_)
+
         # Get schema for the table
         db = self.ds.databases[database_name]
         result = await db.execute(
diff --git a/datasette/views/stored_queries.py b/datasette/views/stored_queries.py
index 2753f876..0bbe9f38 100644
--- a/datasette/views/stored_queries.py
+++ b/datasette/views/stored_queries.py
@@ -2,10 +2,10 @@ from urllib.parse import parse_qsl, urlencode
 
 from datasette.resources import DatabaseResource, QueryResource
 from datasette.stored_queries import stored_query_to_dict
-from datasette.utils import sqlite3, tilde_decode
+from datasette.utils import UNSTABLE_API_MESSAGE, sqlite3, tilde_decode
 from datasette.utils.asgi import Response
 
-from .base import BaseView, _error
+from .base import BaseView
 from .query_helpers import (
     QueryValidationError,
     _as_bool,
@@ -34,12 +34,14 @@ class QueryParametersView(BaseView):
             resource=DatabaseResource(db.name),
             actor=request.actor,
         ):
-            return _block_framing(_error(["Permission denied: need execute-sql"], 403))
+            return _block_framing(
+                Response.error(["Permission denied: need execute-sql"], 403)
+            )
 
         invalid_keys = set(request.args) - {"sql"}
         if invalid_keys:
             return _block_framing(
-                _error(
+                Response.error(
                     ["Invalid keys: {}".format(", ".join(sorted(invalid_keys)))],
                     400,
                 )
@@ -47,8 +49,16 @@ class QueryParametersView(BaseView):
         try:
             parameters = _derived_query_parameters(request.args.get("sql") or "")
         except QueryValidationError as ex:
-            return _block_framing(_error([ex.message], ex.status))
-        return _block_framing(Response.json({"ok": True, "parameters": parameters}))
+            return _block_framing(Response.error([ex.message], ex.status))
+        return _block_framing(
+            Response.json(
+                {
+                    "ok": True,
+                    "unstable": UNSTABLE_API_MESSAGE,
+                    "parameters": parameters,
+                }
+            )
+        )
 
 
 def _query_list_url(path, query_string, *, set_args=None, remove_args=None):
@@ -82,11 +92,12 @@ class QueryListView(BaseView):
             limit = _query_list_limit(
                 request.args.get("_size"),
                 default=20 if format_ == "html" else 50,
+                maximum=self.ds.max_returned_rows,
             )
             is_write = _as_optional_bool(request.args.get("is_write"), "is_write")
             is_private = _as_optional_bool(request.args.get("is_private"), "is_private")
         except QueryValidationError as ex:
-            return _error([ex.message], ex.status)
+            return Response.error([ex.message], ex.status)
 
         page = await self.ds.list_queries(
             database,
@@ -111,9 +122,9 @@ class QueryListView(BaseView):
                 if key != "_next"
             ]
             pairs.append(("_next", page.next))
-            next_url = "{}?{}".format(
-                query_list_path,
-                urlencode(pairs),
+            next_url = self.ds.absolute_url(
+                request,
+                f"{request.path}?{urlencode(pairs)}",
             )
 
         current_filters = {
@@ -199,7 +210,6 @@ class QueryListView(BaseView):
             "queries": page.queries,
             "next": page.next,
             "next_url": next_url,
-            "has_more": page.has_more,
             "limit": page.limit,
             "show_private_note": any(query.is_private for query in page.queries),
             "show_trusted_note": any(query.is_trusted for query in page.queries),
@@ -298,28 +308,30 @@ class QueryCreateAnalyzeView(BaseView):
             resource=DatabaseResource(db.name),
             actor=request.actor,
         ):
-            return _block_framing(_error(["Permission denied: need execute-sql"], 403))
+            return _block_framing(
+                Response.error(["Permission denied: need execute-sql"], 403)
+            )
         if not await self.ds.allowed(
             action="store-query",
             resource=DatabaseResource(db.name),
             actor=request.actor,
         ):
-            return _block_framing(_error(["Permission denied: need store-query"], 403))
+            return _block_framing(
+                Response.error(["Permission denied: need store-query"], 403)
+            )
 
         invalid_keys = set(request.args) - {"sql"}
         if invalid_keys:
             return _block_framing(
-                _error(
+                Response.error(
                     ["Invalid keys: {}".format(", ".join(sorted(invalid_keys)))],
                     400,
                 )
             )
         sql = request.args.get("sql") or ""
-        return _block_framing(
-            Response.json(
-                await _query_create_analysis_data(self.ds, db, sql, request.actor)
-            )
-        )
+        analysis = await _query_create_analysis_data(self.ds, db, sql, request.actor)
+        analysis["unstable"] = UNSTABLE_API_MESSAGE
+        return _block_framing(Response.json(analysis))
 
 
 class QueryStoreView(QueryCreateView):
@@ -346,13 +358,13 @@ class QueryStoreView(QueryCreateView):
             resource=DatabaseResource(db.name),
             actor=request.actor,
         ):
-            return _error(["Permission denied: need execute-sql"], 403)
+            return Response.error(["Permission denied: need execute-sql"], 403)
         if not await self.ds.allowed(
             action="store-query",
             resource=DatabaseResource(db.name),
             actor=request.actor,
         ):
-            return _error(["Permission denied: need store-query"], 403)
+            return Response.error(["Permission denied: need store-query"], 403)
 
         is_json = False
         query_data = {}
@@ -369,7 +381,7 @@ class QueryStoreView(QueryCreateView):
                 return await self._error_response(
                     request, db, query_data, ex.message, ex.status
                 )
-            return _error([ex.message], ex.status)
+            return Response.error([ex.message], ex.status)
 
         prepared.pop("analysis")
         name = prepared.pop("name")
@@ -378,13 +390,18 @@ class QueryStoreView(QueryCreateView):
         except sqlite3.IntegrityError as ex:
             if not is_json and isinstance(query_data, dict):
                 return await self._error_response(request, db, query_data, str(ex), 400)
-            return _error([str(ex)], 400)
+            return Response.error([str(ex)], 400)
 
         query = await self.ds.get_query(db.name, name)
         assert query is not None
         if is_json:
             return Response.json(
-                {"ok": True, "query": stored_query_to_dict(query)}, status=201
+                {
+                    "ok": True,
+                    "unstable": UNSTABLE_API_MESSAGE,
+                    "query": stored_query_to_dict(query),
+                },
+                status=201,
             )
         self.ds.add_message(request, "Query saved", self.ds.INFO)
         return Response.redirect(self.ds.urls.path(self.ds.urls.table(db.name, name)))
@@ -398,14 +415,20 @@ class QueryDefinitionView(BaseView):
         query_name = tilde_decode(request.url_vars["query"])
         query = await self.ds.get_query(db.name, query_name)
         if query is None:
-            return _error(["Query not found: {}".format(query_name)], 404)
+            return Response.error([f"Query not found: {query_name}"], 404)
         if not await self.ds.allowed(
             action="view-query",
             resource=QueryResource(db.name, query_name),
             actor=request.actor,
         ):
-            return _error(["Permission denied"], 403)
-        return Response.json({"ok": True, "query": stored_query_to_dict(query)})
+            return Response.error(["Permission denied"], 403)
+        return Response.json(
+            {
+                "ok": True,
+                "unstable": UNSTABLE_API_MESSAGE,
+                "query": stored_query_to_dict(query),
+            }
+        )
 
 
 class QueryUpdateView(BaseView):
@@ -416,15 +439,17 @@ class QueryUpdateView(BaseView):
         query_name = tilde_decode(request.url_vars["query"])
         existing = await self.ds.get_query(db.name, query_name)
         if existing is None:
-            return _error(["Query not found: {}".format(query_name)], 404)
+            return Response.error([f"Query not found: {query_name}"], 404)
         if not await self.ds.allowed(
             action="update-query",
             resource=QueryResource(db.name, query_name),
             actor=request.actor,
         ):
-            return _error(["Permission denied: need update-query"], 403)
+            return Response.error(["Permission denied: need update-query"], 403)
         if existing.is_trusted:
-            return _error(["Trusted queries cannot be updated using the API"], 403)
+            return Response.error(
+                ["Trusted queries cannot be updated using the API"], 403
+            )
 
         try:
             data, _ = await _json_or_form_payload(request)
@@ -450,7 +475,7 @@ class QueryUpdateView(BaseView):
                 self.ds, request, db, existing, update
             )
         except QueryValidationError as ex:
-            return _error([ex.message], ex.status)
+            return Response.error([ex.message], ex.status)
 
         await self.ds.update_query(db.name, query_name, **update_kwargs)
         if data.get("return"):
@@ -507,32 +532,32 @@ class QueryEditView(BaseView):
     async def get(self, request):
         db, query_name, existing = await self._load(request)
         if existing is None:
-            return _error(["Query not found: {}".format(query_name)], 404)
+            return Response.error([f"Query not found: {query_name}"], 404)
         await self.ds.ensure_permission(
             action="update-query",
             resource=QueryResource(db.name, query_name),
             actor=request.actor,
         )
         if existing.is_trusted:
-            return _error(["Trusted queries cannot be edited"], 403)
+            return Response.error(["Trusted queries cannot be edited"], 403)
         return await self._render_form(request, db, existing)
 
     async def post(self, request):
         db, query_name, existing = await self._load(request)
         if existing is None:
-            return _error(["Query not found: {}".format(query_name)], 404)
+            return Response.error([f"Query not found: {query_name}"], 404)
         if not await self.ds.allowed(
             action="update-query",
             resource=QueryResource(db.name, query_name),
             actor=request.actor,
         ):
-            return _error(["Permission denied: need update-query"], 403)
+            return Response.error(["Permission denied: need update-query"], 403)
         if existing.is_trusted:
-            return _error(["Trusted queries cannot be edited"], 403)
+            return Response.error(["Trusted queries cannot be edited"], 403)
 
         data, _ = await _json_or_form_payload(request)
         if not isinstance(data, dict):
-            return _error(["Invalid form submission"], 400)
+            return Response.error(["Invalid form submission"], 400)
         sql = data.get("sql")
         sql = existing.sql if sql is None else sql.strip()
         title = data.get("title") or ""
@@ -604,12 +629,16 @@ class QueryDeleteView(BaseView):
     async def get(self, request):
         db, query_name, existing = await self._load(request)
         if existing is None:
-            return _error(["Query not found: {}".format(query_name)], 404)
+            return Response.error([f"Query not found: {query_name}"], 404)
         await self.ds.ensure_permission(
             action="delete-query",
             resource=QueryResource(db.name, query_name),
             actor=request.actor,
         )
+        if existing.is_trusted:
+            return Response.error(
+                ["Trusted queries cannot be deleted using the API"], 403
+            )
         return await self.render(
             ["query_delete.html"],
             request,
@@ -624,21 +653,25 @@ class QueryDeleteView(BaseView):
     async def post(self, request):
         db, query_name, existing = await self._load(request)
         if existing is None:
-            return _error(["Query not found: {}".format(query_name)], 404)
+            return Response.error([f"Query not found: {query_name}"], 404)
         if not await self.ds.allowed(
             action="delete-query",
             resource=QueryResource(db.name, query_name),
             actor=request.actor,
         ):
-            return _error(["Permission denied: need delete-query"], 403)
+            return Response.error(["Permission denied: need delete-query"], 403)
+        if existing.is_trusted:
+            return Response.error(
+                ["Trusted queries cannot be deleted using the API"], 403
+            )
 
-        data, is_json = await _json_or_form_payload(request)
+        _data, is_json = await _json_or_form_payload(request)
         await self.ds.remove_query(db.name, query_name)
         if is_json:
             return Response.json({"ok": True})
         self.ds.add_message(
             request,
-            "Query “{}” deleted".format(existing.title or query_name),
+            f"Query “{existing.title or query_name}” deleted",
             self.ds.INFO,
         )
         return Response.redirect(self.ds.urls.path(self.ds.urls.database(db.name)))
diff --git a/datasette/views/table.py b/datasette/views/table.py
index c5448c85..3eb80854 100644
--- a/datasette/views/table.py
+++ b/datasette/views/table.py
@@ -3,58 +3,232 @@ import itertools
 import json
 import urllib
 import urllib.parse
+from dataclasses import dataclass, field
 
 import markupsafe
+import sqlite_utils
 
+from datasette import tracer
 from datasette.column_types import SQLiteType
-from datasette.extras import extra_names_from_request
-from datasette.plugins import pm
+from datasette.database import QueryInterrupted
 from datasette.events import (
     AlterTableEvent,
     DropTableEvent,
     InsertRowsEvent,
     UpsertRowsEvent,
 )
-from datasette.database import QueryInterrupted
-from datasette import tracer
+from datasette.extras import ExtraScope, extra_names_from_request
+from datasette.filters import Filters
+from datasette.plugins import pm
 from datasette.resources import DatabaseResource, TableResource
 from datasette.utils import (
+    CustomJSONEncoder,
+    CustomRow,
+    InvalidSql,
+    WriteJsonValueError,
     add_cors_headers,
+    append_querystring,
     await_me_maybe,
     call_with_supported_arguments,
-    CustomRow,
-    append_querystring,
     compound_keys_after_sql,
-    format_bytes,
-    make_slot_function,
-    tilde_encode,
+    decode_write_json_rows,
     escape_sqlite,
     filters_should_redirect,
+    format_bytes,
     is_url,
+    make_slot_function,
     path_from_row_pks,
     path_with_added_args,
     path_with_format,
     path_with_removed_args,
     path_with_replaced_args,
+    sqlite3,
+    tilde_encode,
     to_css_class,
     truncate_url,
     urlsafe_components,
     value_as_boolean,
-    InvalidSql,
-    sqlite3,
 )
-from datasette.utils.asgi import BadRequest, Forbidden, NotFound, Request, Response
-from datasette.filters import Filters
-import sqlite_utils
-from .base import BaseView, DatasetteError, _error, stream_csv
+from datasette.utils.asgi import (
+    BadRequest,
+    Forbidden,
+    NotFound,
+    PayloadTooLarge,
+    Request,
+    Response,
+)
+
+from . import Context, from_extra
+from .base import BaseView, DatasetteError, stream_csv
 from .database import QueryView
+from .table_create_alter import (
+    ALTER_TABLE_COLUMN_TYPES,
+    ALTER_TABLE_TYPE_FOR_SQLITE_TYPE,
+    _custom_column_type_options_for_create_table,
+    default_expr_for_sql,
+    default_expression_options,
+)
 from .table_extras import (
     TABLE_EXTRA_BUNDLES,
     TableExtraContext,
+    count_is_truncated,
+    precompute_database_action_permissions,
+    precompute_table_action_permissions,
     resolve_table_extras,
     table_extra_registry,
 )
 
+
+@dataclass
+class TableContext(Context):
+    "The page showing the rows in a table or SQL view, e.g. /fixtures/facetable."
+
+    documented_template = "table.html"
+    extras_scope = ExtraScope.TABLE
+
+    # Fields resolved by registered extras - their documentation comes
+    # from the description on each Extra class in table_extras.py
+    actions: callable = from_extra()
+    all_columns: list = from_extra()
+    columns: list = from_extra()
+    count: int = from_extra()
+    count_sql: str = from_extra()
+    custom_table_templates: list = from_extra()
+    database: str = from_extra()
+    database_color: str = from_extra()
+    display_columns: list = from_extra()
+    display_rows: list = from_extra()
+    expandable_columns: list = from_extra()
+    facet_results: dict = from_extra()
+    facets_timed_out: list = from_extra()
+    filters: Filters = from_extra()
+    form_hidden_args: list = from_extra()
+    human_description_en: str = from_extra()
+    is_view: bool = from_extra()
+    metadata: dict = from_extra()
+    primary_keys: list = from_extra()
+    private: bool = from_extra()
+    query: dict = from_extra()
+    renderers: dict = from_extra()
+    set_column_type_ui: dict = from_extra()
+    sorted_facet_results: list = from_extra()
+    suggested_facets: list = from_extra()
+    table: str = from_extra()
+    table_definition: str = from_extra()
+    view_definition: str = from_extra()
+
+    # Fields added by the view code
+    ok: bool = field(
+        metadata={"help": "True if the data for this page was retrieved without errors"}
+    )
+    next: str = field(metadata={"help": "Pagination token for the next page, or None"})
+    next_url: str = field(
+        metadata={
+            "help": "Full URL for the next page of results, or None if there are no more pages. See :ref:`json_api_pagination`."
+        }
+    )
+    count_truncated: bool = field(
+        metadata={
+            "help": "True if ``count`` is a capped lower bound rather than an exact total, because Datasette stopped counting after its configured row-count limit."
+        }
+    )
+    rows: list = field(
+        metadata={
+            "help": "The rows for this page, as a list of dictionaries mapping column name to raw value."
+        }
+    )
+    filter_columns: list = field(
+        metadata={
+            "help": "List of column names offered by the filter interface, including currently displayed columns and any hidden columns that can still be filtered."
+        }
+    )
+    supports_search: bool = field(
+        metadata={"help": "True if this table has full-text search configured"}
+    )
+    extra_wheres_for_ui: list = field(
+        metadata={
+            "help": "Extra where clauses from ``?_where=`` for display in the UI. Each item has ``text`` for the SQL fragment and ``remove_url`` for a URL that removes that fragment."
+        }
+    )
+    url_csv: str = field(metadata={"help": "URL for the CSV export of this page"})
+    url_csv_path: str = field(metadata={"help": "Path portion of the CSV export URL"})
+    url_csv_hidden_args: list = field(
+        metadata={
+            "help": "List of ``(name, value)`` pairs for hidden form fields used by the CSV export form, preserving current filters while forcing ``_size=max``."
+        }
+    )
+    sort: str = field(metadata={"help": "Column the page is sorted by, or None"})
+    sort_desc: str = field(
+        metadata={"help": "Column the page is sorted by in descending order, or None"}
+    )
+    append_querystring: callable = field(
+        metadata={
+            "help": "Function ``append_querystring(url, querystring)`` that appends additional query string arguments to a URL, using ``?`` or ``&`` as appropriate."
+        }
+    )
+    path_with_replaced_args: callable = field(
+        metadata={
+            "help": "Function for building the current path with modified query string arguments. Pass the current ``request`` and a dictionary of argument names to replacement values, using ``None`` to remove an argument."
+        }
+    )
+    fix_path: callable = field(
+        metadata={
+            "help": "Function that applies the configured ``base_url`` prefix to a path."
+        }
+    )
+    settings: dict = field(
+        metadata={
+            "help": "Dictionary of Datasette's current settings, keyed by setting name."
+        }
+    )
+    alternate_url_json: str = field(
+        metadata={"help": "URL for the JSON version of this page"}
+    )
+    datasette_allow_facet: str = field(
+        metadata={
+            "help": 'The string "true" or "false" reflecting the allow_facet setting'
+        }
+    )
+    is_sortable: bool = field(
+        metadata={"help": "True if any of the displayed columns can be used to sort"}
+    )
+    allow_execute_sql: bool = field(
+        metadata={
+            "help": "True if the current actor can execute custom SQL against this database"
+        }
+    )
+    query_ms: float = field(
+        metadata={
+            "help": "Time taken by the SQL queries for this page, in milliseconds"
+        }
+    )
+    select_templates: list = field(
+        metadata={
+            "help": "List of template names that were considered for this page, with the selected template prefixed by ``*``."
+        }
+    )
+    top_table: callable = field(
+        metadata={
+            "help": "Async callable that renders the ``top_table`` plugin slot for this table or view and returns HTML."
+        }
+    )
+    table_page_data: dict = field(
+        metadata={
+            "help": "JSON data used by JavaScript on the table page. Includes ``database``, ``table`` and ``tableUrl``, plus optional ``foreignKeys`` mapping column names to autocomplete URLs, optional ``insertRow`` data and optional ``alterTable`` data."
+        }
+    )
+    table_insert_ui: dict = field(
+        metadata={
+            "help": "Information needed to enable the row insertion UI, or ``None`` if row insertion is not available to the current actor. When present it has ``path``, ``tableName``, ``columns``, ``bulkColumns``, ``primaryKeys`` and ``maxInsertRows`` keys, plus optional ``upsertPath`` if the current actor has permission to update rows. ``columns`` lists columns for the single-row insert form, while ``bulkColumns`` lists columns for the bulk insert form. Each column includes ``name``, ``sqlite_type``, ``notnull``, ``default``, ``has_default``, ``is_pk``, ``is_auto_pk``, ``value_kind`` and ``column_type`` keys."
+        }
+    )
+    table_alter_ui: dict = field(
+        metadata={
+            "help": "Information needed to enable the alter table UI, or ``None`` if altering this table is not available to the current actor. When present it has ``path``, ``tableName``, ``columns``, ``primaryKeys``, ``columnTypes``, ``defaultExpressions`` and ``foreignKeyTargetsPath`` keys, plus optional ``customColumnTypes`` and ``dropPath`` keys."
+        }
+    )
+
+
 LINK_WITH_LABEL = (
     '<a href="{base_url}{database}/{table}/{link_id}">{label}</a>&nbsp;<em>{id}</em>'
 )
@@ -280,7 +454,14 @@ async def _foreign_key_autocomplete_urls(
 
 
 async def _table_page_data(
-    datasette, request, db, database_name, table_name, is_view, table_insert_ui
+    datasette,
+    request,
+    db,
+    database_name,
+    table_name,
+    is_view,
+    table_insert_ui,
+    table_alter_ui,
 ):
     data = {
         "database": database_name,
@@ -289,6 +470,8 @@ async def _table_page_data(
     }
     if table_insert_ui:
         data["insertRow"] = table_insert_ui
+    if table_alter_ui:
+        data["alterTable"] = table_alter_ui
     if not is_view:
         foreign_keys = await _foreign_key_autocomplete_urls(
             datasette, request, db, database_name, table_name
@@ -311,8 +494,15 @@ async def _table_insert_ui(
     ):
         return None
 
+    can_update = await datasette.allowed(
+        action="update-row",
+        resource=TableResource(database=database_name, table=table_name),
+        actor=request.actor,
+    )
+
     column_types_map = await datasette.get_column_types(database_name, table_name)
     columns = []
+    bulk_columns = []
     column_details = await db.table_column_details(table_name)
     for column in column_details:
         if column.hidden:
@@ -323,32 +513,124 @@ async def _table_insert_ui(
             and len(pks) == 1
             and SQLiteType.from_declared_type(column.type) == SQLiteType.INTEGER
         )
+        column_type = column_types_map.get(column.name)
+        column_data = {
+            "name": column.name,
+            "sqlite_type": _column_sqlite_type_for_insert_form(column),
+            "notnull": column.notnull,
+            "default": column.default_value,
+            "has_default": column.default_value is not None,
+            "is_pk": is_pk,
+            "is_auto_pk": is_auto_pk,
+            "value_kind": _column_value_kind_for_insert_form(column),
+            "column_type": (
+                {"type": column_type.name, "config": column_type.config}
+                if column_type is not None
+                else None
+            ),
+        }
+        bulk_columns.append(column_data)
         if is_auto_pk:
             continue
-        column_type = column_types_map.get(column.name)
-        columns.append(
-            {
-                "name": column.name,
-                "sqlite_type": _column_sqlite_type_for_insert_form(column),
-                "notnull": column.notnull,
-                "default": column.default_value,
-                "has_default": column.default_value is not None,
-                "is_pk": is_pk,
-                "value_kind": _column_value_kind_for_insert_form(column),
-                "column_type": (
-                    {"type": column_type.name, "config": column_type.config}
-                    if column_type is not None
-                    else None
-                ),
-            }
-        )
+        columns.append(column_data)
 
-    return {
-        "path": "{}/-/insert".format(datasette.urls.table(database_name, table_name)),
+    data = {
+        "path": f"{datasette.urls.table(database_name, table_name)}/-/insert",
+        "tableName": table_name,
+        "columns": columns,
+        "bulkColumns": bulk_columns,
+        "primaryKeys": pks,
+        "maxInsertRows": datasette.setting("max_insert_rows"),
+    }
+    if can_update:
+        data["upsertPath"] = (
+            f"{datasette.urls.table(database_name, table_name)}/-/upsert"
+        )
+    return data
+
+
+async def _table_alter_ui(
+    datasette, request, db, database_name, table_name, is_view, pks
+):
+    if is_view or not db.is_mutable:
+        return None
+
+    if not await datasette.allowed(
+        action="alter-table",
+        resource=TableResource(database=database_name, table=table_name),
+        actor=request.actor,
+    ):
+        return None
+
+    column_types_map = await datasette.get_column_types(database_name, table_name)
+    foreign_keys_by_column = {}
+    for fk in await db.foreign_keys_for_table(table_name):
+        other_column = fk["other_column"]
+        if other_column is None and await db.table_exists(fk["other_table"]):
+            other_pks = await db.primary_keys(fk["other_table"])
+            if len(other_pks) == 1:
+                other_column = other_pks[0]
+        if other_column is None:
+            continue
+        foreign_keys_by_column[fk["column"]] = {
+            "fk_table": fk["other_table"],
+            "fk_column": other_column,
+        }
+    columns = []
+    for column in await db.table_column_details(table_name):
+        if column.hidden:
+            continue
+        sqlite_type = SQLiteType.from_declared_type(column.type)
+        column_type = column_types_map.get(column.name)
+        default_expr = default_expr_for_sql(column.default_value)
+        column_data = {
+            "name": column.name,
+            "type": ALTER_TABLE_TYPE_FOR_SQLITE_TYPE.get(sqlite_type, "text"),
+            "sqlite_type": sqlite_type.value,
+            "notnull": column.notnull,
+            "default": None if default_expr else column.default_value,
+            "has_default": column.default_value is not None,
+            "is_pk": column.name in pks,
+            "foreign_key": foreign_keys_by_column.get(column.name),
+            "column_type": (
+                {"type": column_type.name, "config": column_type.config}
+                if column_type is not None
+                else None
+            ),
+        }
+        if default_expr:
+            column_data["default_expr"] = default_expr
+        columns.append(column_data)
+
+    data = {
+        "path": f"{datasette.urls.table(database_name, table_name)}/-/alter",
         "tableName": table_name,
         "columns": columns,
         "primaryKeys": pks,
+        "columnTypes": ALTER_TABLE_COLUMN_TYPES,
+        "defaultExpressions": default_expression_options(),
+        "foreignKeyTargetsPath": "{}/-/foreign-key-targets?table={}".format(
+            datasette.urls.database(database_name),
+            urllib.parse.quote(table_name, safe=""),
+        ),
     }
+    can_set_column_type = await datasette.allowed(
+        action="set-column-type",
+        resource=TableResource(database=database_name, table=table_name),
+        actor=request.actor,
+    )
+    if can_set_column_type:
+        data["customColumnTypes"] = _custom_column_type_options_for_create_table(
+            datasette
+        )
+    can_drop_table = await datasette.allowed(
+        action="drop-table",
+        resource=TableResource(database=database_name, table=table_name),
+        actor=request.actor,
+    )
+    if can_drop_table:
+        data["dropPath"] = f"{datasette.urls.table(database_name, table_name)}/-/drop"
+    return data
 
 
 async def display_columns_and_rows(
@@ -443,20 +725,18 @@ async def display_columns_and_rows(
             row_label = row_label_from_label_column(row, label_column)
             row_action_label = pk_path
             if row_label and row_label != pk_path:
-                row_action_label = "{} {}".format(pk_path, row_label)
+                row_action_label = f"{pk_path} {row_label}"
             table_path = datasette.urls.table(database_name, table_name)
-            row_link = '<a href="{table_path}/{flat_pks_quoted}">{flat_pks}</a>'.format(
-                table_path=table_path,
-                flat_pks=str(markupsafe.escape(pk_path)),
-                flat_pks_quoted=row_path,
+            row_link = (
+                f'<a href="{table_path}/{row_path}">{markupsafe.escape(pk_path)!s}</a>'
             )
             edit_icon = (
                 '<svg class="row-inline-action-icon" aria-hidden="true" '
                 'xmlns="http://www.w3.org/2000/svg" width="14" height="14" '
                 'viewBox="0 0 24 24" fill="none" stroke="currentColor" '
                 'stroke-width="2" stroke-linecap="round" stroke-linejoin="round">'
-                '<path d="M12 20h9"></path>'
-                '<path d="M16.5 3.5a2.1 2.1 0 0 1 3 3L7 19l-4 1 1-4Z"></path>'
+                '<path d="M11 4H4a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2v-7"></path>'
+                '<path d="M18.5 2.5a2.12 2.12 0 0 1 3 3L12 15l-4 1 1-4 9.5-9.5z"></path>'
                 "</svg>"
             )
             delete_icon = (
@@ -475,22 +755,16 @@ async def display_columns_and_rows(
             if row_action_permissions.get("update-row"):
                 row_actions.append(
                     '<button type="button" class="row-inline-action row-inline-action-edit" '
-                    'aria-label="Edit row {row_label}" title="Edit row" '
+                    f'aria-label="Edit row {markupsafe.escape(row_action_label)}" title="Edit row" '
                     'data-row-action="edit">'
-                    "{edit_icon}</button>".format(
-                        edit_icon=edit_icon,
-                        row_label=markupsafe.escape(row_action_label),
-                    )
+                    f"{edit_icon}</button>"
                 )
             if row_action_permissions.get("delete-row"):
                 row_actions.append(
                     '<button type="button" class="row-inline-action row-inline-action-delete" '
-                    'aria-label="Delete row {row_label}" title="Delete row" '
+                    f'aria-label="Delete row {markupsafe.escape(row_action_label)}" title="Delete row" '
                     'data-row-action="delete">'
-                    "{delete_icon}</button>".format(
-                        delete_icon=delete_icon,
-                        row_label=markupsafe.escape(row_action_label),
-                    )
+                    f"{delete_icon}</button>"
                 )
             if row_actions:
                 row_link = (
@@ -558,11 +832,7 @@ async def display_columns_and_rows(
                             path_from_row_pks(row, pks, not pks),
                             column,
                         ),
-                        (
-                            ' title="{}"'.format(formatted)
-                            if "bytes" not in formatted
-                            else ""
-                        ),
+                        (f' title="{formatted}"' if "bytes" not in formatted else ""),
                         len(value),
                         "" if len(value) == 1 else "s",
                     )
@@ -670,13 +940,11 @@ class TableInsertView(BaseView):
         def _errors(errors):
             return None, errors, {}
 
-        if not request.headers.get("content-type").startswith("application/json"):
-            # TODO: handle form-encoded data
-            return _errors(["Invalid content-type, must be application/json"])
+        # The body is parsed as JSON regardless of the Content-Type header
         try:
             data = await request.json()
         except json.JSONDecodeError as e:
-            return _errors(["Invalid JSON: {}".format(e)])
+            return _errors([f"Invalid JSON: {e}"])
         if not isinstance(data, dict):
             return _errors(["JSON must be a dictionary"])
         keys = data.keys()
@@ -704,9 +972,7 @@ class TableInsertView(BaseView):
         # Does this exceed max_insert_rows?
         max_insert_rows = self.ds.setting("max_insert_rows")
         if len(rows) > max_insert_rows:
-            return _errors(
-                ["Too many rows, maximum allowed is {}".format(max_insert_rows)]
-            )
+            return _errors([f"Too many rows, maximum allowed is {max_insert_rows}"])
 
         # Validate other parameters
         extras = {
@@ -756,7 +1022,7 @@ class TableInsertView(BaseView):
         try:
             resolved = await self.ds.resolve_table(request)
         except NotFound as e:
-            return _error([e.args[0]], 404)
+            return Response.error([e.args[0]], 404)
         db = resolved.db
         database_name = db.name
         table_name = resolved.table
@@ -764,7 +1030,7 @@ class TableInsertView(BaseView):
         # Table must exist (may handle table creation in the future)
         db = self.ds.get_database(database_name)
         if not await db.table_exists(table_name):
-            return _error(["Table not found: {}".format(table_name)], 404)
+            return Response.error([f"Table not found: {table_name}"], 404)
 
         if upsert:
             # Must have insert-row AND upsert-row permissions
@@ -780,7 +1046,7 @@ class TableInsertView(BaseView):
                     actor=request.actor,
                 )
             ):
-                return _error(
+                return Response.error(
                     ["Permission denied: need both insert-row and update-row"], 403
                 )
         else:
@@ -790,25 +1056,32 @@ class TableInsertView(BaseView):
                 resource=TableResource(database=database_name, table=table_name),
                 actor=request.actor,
             ):
-                return _error(["Permission denied"], 403)
+                return Response.error(["Permission denied"], 403)
 
         if not db.is_mutable:
-            return _error(["Database is immutable"], 403)
+            return Response.error(["Database is immutable"], 403)
 
         pks = await db.primary_keys(table_name)
 
-        rows, errors, extras = await self._validate_data(
-            request, db, table_name, pks, upsert
-        )
+        try:
+            rows, errors, extras = await self._validate_data(
+                request, db, table_name, pks, upsert
+            )
+        except PayloadTooLarge as e:
+            return Response.error([str(e)], 413)
         if errors:
-            return _error(errors, 400)
+            return Response.error(errors, 400)
+        try:
+            rows = decode_write_json_rows(rows)
+        except WriteJsonValueError as e:
+            return Response.error([str(e)], 400)
 
         # Validate column types
         ct_errors = await _validate_column_types(
             self.ds, database_name, table_name, rows
         )
         if ct_errors:
-            return _error(ct_errors, 400)
+            return Response.error(ct_errors, 400)
 
         num_rows = len(rows)
 
@@ -822,14 +1095,16 @@ class TableInsertView(BaseView):
         alter = extras.get("alter")
 
         if upsert and (ignore or replace):
-            return _error(["Upsert does not support ignore or replace"], 400)
+            return Response.error(["Upsert does not support ignore or replace"], 400)
 
         if replace and not await self.ds.allowed(
             action="update-row",
             resource=TableResource(database=database_name, table=table_name),
             actor=request.actor,
         ):
-            return _error(['Permission denied: need update-row to use "replace"'], 403)
+            return Response.error(
+                ['Permission denied: need update-row to use "replace"'], 403
+            )
 
         initial_schema = None
         if alter:
@@ -839,7 +1114,7 @@ class TableInsertView(BaseView):
                 resource=TableResource(database=database_name, table=table_name),
                 actor=request.actor,
             ):
-                return _error(["Permission denied for alter-table"], 403)
+                return Response.error(["Permission denied for alter-table"], 403)
             # Track initial schema to check if it changed later
             initial_schema = await db.execute_fn(
                 lambda conn: sqlite_utils.Database(conn)[table_name].schema
@@ -878,14 +1153,15 @@ class TableInsertView(BaseView):
 
         try:
             rows = await db.execute_write_fn(insert_or_upsert_rows, request=request)
-        except Exception as e:
-            return _error([str(e)])
+        except Exception as e:  # noqa: BLE001
+            # TODO: narrow to expected write errors so Datasette bugs surface as 500s
+            return Response.error([str(e)])
         result = {"ok": True}
         if should_return:
             if upsert:
                 # Fetch based on initial input IDs
                 where_clause = " OR ".join(
-                    ["({})".format(" AND ".join("{} = ?".format(pk) for pk in pks))]
+                    ["({})".format(" AND ".join(f"{pk} = ?" for pk in pks))]
                     * len(row_pk_values_for_later)
                 )
                 args = list(itertools.chain.from_iterable(row_pk_values_for_later))
@@ -936,7 +1212,11 @@ class TableInsertView(BaseView):
                     )
                 )
 
-        return Response.json(result, status=200 if upsert else 201)
+        return Response.json(
+            result,
+            status=200 if upsert else 201,
+            default=CustomJSONEncoder().default,
+        )
 
 
 class TableUpsertView(TableInsertView):
@@ -956,7 +1236,7 @@ class TableSetColumnTypeView(BaseView):
         try:
             resolved = await self.ds.resolve_table(request)
         except NotFound as e:
-            return _error([e.args[0]], 404)
+            return Response.error([e.args[0]], 404)
 
         database_name = resolved.db.name
         table_name = resolved.table
@@ -966,41 +1246,39 @@ class TableSetColumnTypeView(BaseView):
             resource=TableResource(database=database_name, table=table_name),
             actor=request.actor,
         ):
-            return _error(["Permission denied"], 403)
-
-        content_type = request.headers.get("content-type") or ""
-        if not content_type.startswith("application/json"):
-            return _error(["Invalid content-type, must be application/json"], 400)
+            return Response.error(["Permission denied"], 403)
 
         try:
             data = await request.json()
         except json.JSONDecodeError as e:
-            return _error(["Invalid JSON: {}".format(e)], 400)
+            return Response.error([f"Invalid JSON: {e}"], 400)
+        except PayloadTooLarge as e:
+            return Response.error([str(e)], 413)
 
         if not isinstance(data, dict):
-            return _error(["JSON must be a dictionary"], 400)
+            return Response.error(["JSON must be a dictionary"], 400)
 
         invalid_keys = set(data.keys()) - {"column", "column_type"}
         if invalid_keys:
-            return _error(
+            return Response.error(
                 ['Invalid parameter: "{}"'.format('", "'.join(sorted(invalid_keys)))],
                 400,
             )
 
         if "column" not in data:
-            return _error(['"column" is required'], 400)
+            return Response.error(['"column" is required'], 400)
         column = data["column"]
         if not isinstance(column, str):
-            return _error(['"column" must be a string'], 400)
+            return Response.error(['"column" must be a string'], 400)
 
         if "column_type" not in data:
-            return _error(['"column_type" is required'], 400)
+            return Response.error(['"column_type" is required'], 400)
 
         column_details = await self.ds._get_resource_column_details(
             database_name, table_name
         )
         if column not in column_details:
-            return _error(["Column not found: {}".format(column)], 400)
+            return Response.error([f"Column not found: {column}"], 400)
 
         column_type_data = data["column_type"]
         if column_type_data is None:
@@ -1017,11 +1295,11 @@ class TableSetColumnTypeView(BaseView):
             )
 
         if not isinstance(column_type_data, dict):
-            return _error(['"column_type" must be an object or null'], 400)
+            return Response.error(['"column_type" must be an object or null'], 400)
 
         invalid_column_type_keys = set(column_type_data.keys()) - {"type", "config"}
         if invalid_column_type_keys:
-            return _error(
+            return Response.error(
                 [
                     'Invalid column_type parameter: "{}"'.format(
                         '", "'.join(sorted(invalid_column_type_keys))
@@ -1031,24 +1309,24 @@ class TableSetColumnTypeView(BaseView):
             )
 
         if "type" not in column_type_data:
-            return _error(['"column_type.type" is required'], 400)
+            return Response.error(['"column_type.type" is required'], 400)
         column_type = column_type_data["type"]
         if not isinstance(column_type, str):
-            return _error(['"column_type.type" must be a string'], 400)
+            return Response.error(['"column_type.type" must be a string'], 400)
 
         config = column_type_data.get("config")
         if config is not None and not isinstance(config, dict):
-            return _error(['"column_type.config" must be a dictionary'], 400)
+            return Response.error(['"column_type.config" must be a dictionary'], 400)
 
         if column_type not in self.ds._column_types:
-            return _error(["Unknown column type: {}".format(column_type)], 400)
+            return Response.error([f"Unknown column type: {column_type}"], 400)
 
         try:
             await self.ds.set_column_type(
                 database_name, table_name, column, column_type, config
             )
         except ValueError as e:
-            return _error([str(e)], 400)
+            return Response.error([str(e)], 400)
 
         return Response.json(
             {
@@ -1072,28 +1350,30 @@ class TableDropView(BaseView):
         try:
             resolved = await self.ds.resolve_table(request)
         except NotFound as e:
-            return _error([e.args[0]], 404)
+            return Response.error([e.args[0]], 404)
         db = resolved.db
         database_name = db.name
         table_name = resolved.table
         # Table must exist
         db = self.ds.get_database(database_name)
         if not await db.table_exists(table_name):
-            return _error(["Table not found: {}".format(table_name)], 404)
+            return Response.error([f"Table not found: {table_name}"], 404)
         if not await self.ds.allowed(
             action="drop-table",
             resource=TableResource(database=database_name, table=table_name),
             actor=request.actor,
         ):
-            return _error(["Permission denied"], 403)
+            return Response.error(["Permission denied"], 403)
         if not db.is_mutable:
-            return _error(["Database is immutable"], 403)
+            return Response.error(["Database is immutable"], 403)
         confirm = False
         try:
             data = await request.json()
             confirm = data.get("confirm")
         except json.JSONDecodeError:
             pass
+        except PayloadTooLarge as e:
+            return Response.error([str(e)], 413)
 
         if not confirm:
             return Response.json(
@@ -1102,7 +1382,7 @@ class TableDropView(BaseView):
                     "database": database_name,
                     "table": table_name,
                     "row_count": (
-                        await db.execute("select count(*) from [{}]".format(table_name))
+                        await db.execute(f"select count(*) from [{table_name}]")
                     ).single_value(),
                     "message": 'Pass "confirm": true to confirm',
                 },
@@ -1119,6 +1399,11 @@ class TableDropView(BaseView):
                 actor=request.actor, database=database_name, table=table_name
             )
         )
+        self.ds.add_message(
+            request,
+            f"Table {table_name} dropped",
+            self.ds.WARNING,
+        )
         return Response.json({"ok": True}, status=200)
 
 
@@ -1151,7 +1436,6 @@ class TableFragmentView(BaseView):
                 path_with_replaced_args=path_with_replaced_args,
                 fix_path=self.ds.urls.path,
                 settings=self.ds.settings_dict(),
-                count_limit=resolved.db.count_limit,
             ),
             request=request,
             view_name="table",
@@ -1177,32 +1461,28 @@ def _prefix_range_end(value):
 
 
 def _autocomplete_like(column):
-    return "{} like :like escape char(92)".format(escape_sqlite(column))
+    return f"{escape_sqlite(column)} like :like escape char(92)"
 
 
 def _autocomplete_prefix_like(column):
-    return "{} like :prefix escape char(92)".format(escape_sqlite(column))
+    return f"{escape_sqlite(column)} like :prefix escape char(92)"
 
 
 def _autocomplete_order_by(pks, label_column, exact_pk, label_matches_first=True):
     clauses = []
     if exact_pk:
         clauses.append(
-            "case when cast({} as text) = :q then 0 else 1 end".format(
-                escape_sqlite(pks[0])
-            )
+            f"case when cast({escape_sqlite(pks[0])} as text) = :q then 0 else 1 end"
         )
     if label_column:
         label_like = _autocomplete_like(label_column)
         if label_matches_first:
-            clauses.append("case when {} then 0 else 1 end".format(label_like))
+            clauses.append(f"case when {label_like} then 0 else 1 end")
         clauses.append(
-            "case when {} then length(cast({} as text)) end".format(
-                label_like, escape_sqlite(label_column)
-            )
+            f"case when {label_like} then length(cast({escape_sqlite(label_column)} as text)) end"
         )
     else:
-        clauses.append("length(cast({} as text))".format(escape_sqlite(pks[0])))
+        clauses.append(f"length(cast({escape_sqlite(pks[0])} as text))")
     clauses.extend(escape_sqlite(pk) for pk in pks)
     return ", ".join(clauses)
 
@@ -1266,11 +1546,11 @@ class TableAutocompleteView(BaseView):
             and value_as_boolean(initial_arg)
         )
         if not q and not initial:
-            return Response.json({"rows": []})
+            return Response.json({"ok": True, "rows": []})
         params = {
             "q": q,
-            "like": "%{}%".format(_escape_like(q)),
-            "prefix": "{}%".format(_escape_like(q)),
+            "like": f"%{_escape_like(q)}%",
+            "prefix": f"{_escape_like(q)}%",
         }
 
         like_columns = pks[:]
@@ -1284,18 +1564,13 @@ class TableAutocompleteView(BaseView):
             where_sql = "1 = 1"
             order_by = _autocomplete_initial_order_by(pks)
 
-        sql = """
+        sql = f"""
             select {select_sql}
-            from {table}
-            where {where}
+            from {escape_sqlite(table_name)}
+            where {where_sql}
             order by {order_by}
             limit 10
-        """.format(
-            select_sql=select_sql,
-            table=escape_sqlite(table_name),
-            where=where_sql,
-            order_by=order_by,
-        )
+        """
 
         try:
             results = await db.execute(
@@ -1307,21 +1582,14 @@ class TableAutocompleteView(BaseView):
             if prefix_end:
                 params["prefix_end"] = prefix_end
                 first_pk = escape_sqlite(pks[0])
-                fallback_where = (
-                    "{first_pk} >= :q and {first_pk} < :prefix_end and {like}"
-                ).format(first_pk=first_pk, like=fallback_where)
-            fallback_sql = """
+                fallback_where = f"{first_pk} >= :q and {first_pk} < :prefix_end and {fallback_where}"
+            fallback_sql = f"""
                 select {select_sql}
-                from {table}
-                where {where}
-                order by {order_by}
+                from {escape_sqlite(table_name)}
+                where {fallback_where}
+                order by {_autocomplete_pk_order_by(pks)}
                 limit 10
-            """.format(
-                select_sql=select_sql,
-                table=escape_sqlite(table_name),
-                where=fallback_where,
-                order_by=_autocomplete_pk_order_by(pks),
-            )
+            """
             try:
                 results = await db.execute(
                     fallback_sql,
@@ -1329,10 +1597,13 @@ class TableAutocompleteView(BaseView):
                     custom_time_limit=AUTOCOMPLETE_TIME_LIMIT_MS,
                 )
             except QueryInterrupted:
-                return Response.json({"rows": []})
+                return Response.json({"ok": True, "rows": []})
 
         return Response.json(
-            {"rows": _autocomplete_response_rows(results.rows, pks, label_column)}
+            {
+                "ok": True,
+                "rows": _autocomplete_response_rows(results.rows, pks, label_column),
+            }
         )
 
 
@@ -1347,8 +1618,8 @@ async def _columns_to_select(table_columns, pks, request):
                 "_col={} - invalid columns".format(", ".join(bad_columns)),
                 status=400,
             )
-        # De-duplicate maintaining order:
-        columns.extend(dict.fromkeys(_cols))
+        # De-duplicate maintaining order, skipping columns already added (pks):
+        columns.extend(c for c in dict.fromkeys(_cols) if c not in columns)
     if "_nocol" in request.args:
         # Return all columns EXCEPT these
         bad_columns = [
@@ -1474,7 +1745,7 @@ async def table_view_traced(datasette, request):
     )
     if isinstance(view_data, Response):
         return view_data
-    data, rows, columns, expanded_columns, sql, next_url = view_data
+    data, rows, columns, _expanded_columns, sql, next_url = view_data
 
     # Handle formats from plugins
     if format_ == "csv":
@@ -1485,8 +1756,8 @@ async def table_view_traced(datasette, request):
                 rows,
                 columns,
                 expanded_columns,
-                sql,
-                next_url,
+                _sql,
+                _next_url,
             ) = await table_view_data(
                 datasette,
                 request,
@@ -1503,7 +1774,7 @@ async def table_view_traced(datasette, request):
             return data, None, None
 
         return await stream_csv(datasette, fetch_data, request, resolved.db.name)
-    elif format_ in datasette.renderers.keys():
+    elif format_ in datasette.renderers:
         # Dispatch request to the correct output format renderer
         # (CSV is not handled here due to streaming)
         result = call_with_supported_arguments(
@@ -1561,52 +1832,92 @@ async def table_view_traced(datasette, request):
         )
         headers.update(
             {
-                "Link": '<{}>; rel="alternate"; type="application/json+datasette"'.format(
-                    alternate_url_json
-                )
+                "Link": f'<{alternate_url_json}>; rel="alternate"; type="application/json+datasette"'
             }
         )
+        table_context = TableContext(
+            actions=data["actions"],
+            all_columns=data["all_columns"],
+            columns=data["columns"],
+            count=data["count"],
+            count_sql=data["count_sql"],
+            custom_table_templates=data["custom_table_templates"],
+            database=data["database"],
+            database_color=data["database_color"],
+            display_columns=data["display_columns"],
+            display_rows=data["display_rows"],
+            expandable_columns=data["expandable_columns"],
+            facet_results=data["facet_results"],
+            facets_timed_out=data["facets_timed_out"],
+            filters=data["filters"],
+            form_hidden_args=data["form_hidden_args"],
+            human_description_en=data["human_description_en"],
+            is_view=data["is_view"],
+            metadata=data["metadata"],
+            next_url=data["next_url"],
+            primary_keys=data["primary_keys"],
+            private=data["private"],
+            query=data["query"],
+            renderers=data["renderers"],
+            set_column_type_ui=data["set_column_type_ui"],
+            sorted_facet_results=data["sorted_facet_results"],
+            suggested_facets=data["suggested_facets"],
+            table=data["table"],
+            table_definition=data["table_definition"],
+            view_definition=data["view_definition"],
+            ok=data["ok"],
+            next=data["next"],
+            count_truncated=data["count_truncated"],
+            rows=data["rows"],
+            filter_columns=data["filter_columns"],
+            supports_search=data["supports_search"],
+            extra_wheres_for_ui=data["extra_wheres_for_ui"],
+            url_csv=data["url_csv"],
+            url_csv_path=data["url_csv_path"],
+            url_csv_hidden_args=data["url_csv_hidden_args"],
+            sort=data["sort"],
+            sort_desc=data["sort_desc"],
+            append_querystring=append_querystring,
+            path_with_replaced_args=path_with_replaced_args,
+            fix_path=datasette.urls.path,
+            settings=datasette.settings_dict(),
+            alternate_url_json=alternate_url_json,
+            datasette_allow_facet=(
+                "true" if datasette.setting("allow_facet") else "false"
+            ),
+            is_sortable=any(c["sortable"] for c in data["display_columns"]),
+            allow_execute_sql=await datasette.allowed(
+                action="execute-sql",
+                resource=DatabaseResource(database=resolved.db.name),
+                actor=request.actor,
+            ),
+            query_ms=1.2,
+            select_templates=[
+                f"{'*' if template_name == template.name else ''}{template_name}"
+                for template_name in templates
+            ],
+            top_table=make_slot_function(
+                "top_table",
+                datasette,
+                request,
+                database=resolved.db.name,
+                table=resolved.table,
+            ),
+            table_page_data=data["table_page_data"],
+            table_insert_ui=data["table_insert_ui"],
+            table_alter_ui=data["table_alter_ui"],
+        )
         r = Response.html(
             await datasette.render_template(
                 template,
-                dict(
-                    data,
-                    append_querystring=append_querystring,
-                    path_with_replaced_args=path_with_replaced_args,
-                    fix_path=datasette.urls.path,
-                    settings=datasette.settings_dict(),
-                    # TODO: review up all of these hacks:
-                    alternate_url_json=alternate_url_json,
-                    datasette_allow_facet=(
-                        "true" if datasette.setting("allow_facet") else "false"
-                    ),
-                    is_sortable=any(c["sortable"] for c in data["display_columns"]),
-                    allow_execute_sql=await datasette.allowed(
-                        action="execute-sql",
-                        resource=DatabaseResource(database=resolved.db.name),
-                        actor=request.actor,
-                    ),
-                    query_ms=1.2,
-                    select_templates=[
-                        f"{'*' if template_name == template.name else ''}{template_name}"
-                        for template_name in templates
-                    ],
-                    top_table=make_slot_function(
-                        "top_table",
-                        datasette,
-                        request,
-                        database=resolved.db.name,
-                        table=resolved.table,
-                    ),
-                    count_limit=resolved.db.count_limit,
-                ),
+                table_context,
                 request=request,
                 view_name="table",
             ),
             headers=headers,
         )
     else:
-        assert False, "Invalid format: {}".format(format_)
+        assert False, f"Invalid format: {format_}"
     if next_url:
         r.headers["link"] = f'<{next_url}>; rel="next"'
     return r
@@ -1642,6 +1953,15 @@ async def table_view_data(
     if redirect_response:
         return redirect_response
 
+    if context_for_html_hack:
+        await precompute_database_action_permissions(
+            datasette, request.actor, database_name
+        )
+        if not is_view:
+            await precompute_table_action_permissions(
+                datasette, request.actor, database_name, table_name
+            )
+
     # Introspect columns and primary keys for table
     pks = await db.primary_keys(table_name)
     table_columns = await db.table_columns(table_name)
@@ -1788,9 +2108,7 @@ async def table_view_data(
                             extra_desc_only=(
                                 ""
                                 if sort
-                                else " or {column2} is null".format(
-                                    column2=escape_sqlite(sort or sort_desc)
-                                )
+                                else f" or {escape_sqlite(sort or sort_desc)} is null"
                             ),
                             next_clauses=" and ".join(next_by_pk_clauses),
                         )
@@ -1832,22 +2150,11 @@ async def table_view_data(
 
     # Facets are calculated against SQL without order by or limit
     sql_no_order_no_limit = (
-        "select {select_all_columns} from {table_name} {where}".format(
-            select_all_columns=select_all_columns,
-            table_name=escape_sqlite(table_name),
-            where=where_clause,
-        )
+        f"select {select_all_columns} from {escape_sqlite(table_name)} {where_clause}"
     )
 
     # This is the SQL that populates the main table on the page
-    sql = "select {select_specified_columns} from {table_name} {where}{order_by} limit {page_size}{offset}".format(
-        select_specified_columns=select_specified_columns,
-        table_name=escape_sqlite(table_name),
-        where=where_clause,
-        order_by=order_by,
-        page_size=page_size + 1,
-        offset=offset,
-    )
+    sql = f"select {select_specified_columns} from {escape_sqlite(table_name)} {where_clause}{order_by} limit {page_size + 1}{offset}"
 
     if request.args.get("_timelimit"):
         extra_args["custom_time_limit"] = int(request.args.get("_timelimit"))
@@ -1858,9 +2165,6 @@ async def table_view_data(
     except (sqlite3.OperationalError, InvalidSql) as e:
         raise DatasetteError(str(e), title="Invalid SQL", status=400)
 
-    except sqlite3.OperationalError as e:
-        raise DatasetteError(str(e))
-
     columns = [r[0] for r in results.description]
     rows = list(results.rows)
 
@@ -1907,7 +2211,8 @@ async def table_view_data(
             new_rows = []
             for row in rows:
                 new_row = CustomRow(columns)
-                for column in row.keys():
+                # CustomRow/sqlite3.Row iterate over values, so .keys() is required
+                for column in row.keys():  # noqa: SIM118
                     value = row[column]
                     if (column, value) in expanded_labels and value is not None:
                         new_row[column] = {
@@ -1940,10 +2245,16 @@ async def table_view_data(
 
     # Resolve extras
     extras = extra_names_from_request(request)
-    if any(k for k in request.args.keys() if k == "_facet" or k.startswith("_facet_")):
+    if not extra_extras:
+        # Data formats reject unknown extras; the HTML path (which passes
+        # extra_extras={"_html"}) resolves internal extras of its own
+        table_extra_registry.validate_requested(extras, ExtraScope.TABLE)
+    if any(k for k in request.args if k == "_facet" or k.startswith("_facet_")):
         extras.add("facet_results")
     if request.args.get("_shape") == "object":
         extras.add("primary_keys")
+    if "count" in extras:
+        extras.add("count_truncated")
     if extra_extras:
         extras.update(extra_extras)
 
@@ -1998,6 +2309,7 @@ async def table_view_data(
     data = {
         "ok": True,
         "next": next_value and str(next_value) or None,
+        "next_url": next_url,
     }
     data.update(
         await resolve_table_extras(
@@ -2022,6 +2334,9 @@ async def table_view_data(
     data["rows"] = transformed_rows
 
     if context_for_html_hack:
+        data["count_truncated"] = count_is_truncated(
+            datasette, db, database_name, table_name, count_sql, data.get("count")
+        )
         data.update(extra_context_from_filters)
         # filter_columns combine the columns we know are available
         # in the table with any additional columns (such as rowid)
@@ -2068,15 +2383,20 @@ async def table_view_data(
         table_insert_ui = await _table_insert_ui(
             datasette, request, db, database_name, table_name, is_view, pks
         )
+        table_alter_ui = await _table_alter_ui(
+            datasette, request, db, database_name, table_name, is_view, pks
+        )
         data["table_insert_ui"] = table_insert_ui
+        data["table_alter_ui"] = table_alter_ui
         data["table_page_data"] = await _table_page_data(
-            datasette,
-            request,
-            db,
-            database_name,
-            table_name,
-            is_view,
-            table_insert_ui,
+            datasette=datasette,
+            request=request,
+            db=db,
+            database_name=database_name,
+            table_name=table_name,
+            is_view=is_view,
+            table_insert_ui=table_insert_ui,
+            table_alter_ui=table_alter_ui,
         )
 
     return data, rows[:page_size], columns, expanded_columns, sql, next_url
@@ -2110,20 +2430,13 @@ async def _next_value_and_url(
             except IndexError:
                 # sort/sort_desc column missing from SELECT - look up value by PK instead
                 prefix_where_clause = " and ".join(
-                    "[{}] = :pk{}".format(pk, i) for i, pk in enumerate(pks)
-                )
-                prefix_lookup_sql = "select [{}] from [{}] where {}".format(
-                    sort or sort_desc, table_name, prefix_where_clause
+                    f"[{pk}] = :pk{i}" for i, pk in enumerate(pks)
                 )
+                prefix_lookup_sql = f"select [{sort or sort_desc}] from [{table_name}] where {prefix_where_clause}"
                 prefix = (
                     await db.execute(
                         prefix_lookup_sql,
-                        {
-                            **{
-                                "pk{}".format(i): rows[-2][pk]
-                                for i, pk in enumerate(pks)
-                            }
-                        },
+                        {**{f"pk{i}": rows[-2][pk] for i, pk in enumerate(pks)}},
                     )
                 ).single_value()
             if isinstance(prefix, dict) and "value" in prefix:
diff --git a/datasette/views/table_create_alter.py b/datasette/views/table_create_alter.py
new file mode 100644
index 00000000..56b28877
--- /dev/null
+++ b/datasette/views/table_create_alter.py
@@ -0,0 +1,1365 @@
+import json
+import re
+import time
+from typing import Annotated, Any, Literal
+
+import sqlite_utils
+from pydantic import (
+    BaseModel,
+    ConfigDict,
+    Field,
+    ValidationError,
+    field_validator,
+    model_validator,
+)
+from pydantic_core import PydanticCustomError
+from sqlite_utils.db import DEFAULT as SQLITE_UTILS_DEFAULT
+
+from datasette.column_types import SQLiteType
+from datasette.database import QueryInterrupted
+from datasette.events import AlterTableEvent, CreateTableEvent, InsertRowsEvent
+from datasette.resources import DatabaseResource, TableResource
+from datasette.utils import (
+    WriteJsonValueError,
+    decode_write_json_rows,
+    escape_sqlite,
+    get_outbound_foreign_keys,
+    table_column_details,
+)
+from datasette.utils.asgi import NotFound, PayloadTooLarge, Response
+from datasette.utils.sqlite import sqlite_hidden_table_names
+
+from .base import BaseView
+
+CREATE_TABLE_COLUMN_TYPES = ["text", "integer", "float", "blob"]
+CREATE_TABLE_SQLITE_TYPES = {
+    "text": SQLiteType.TEXT,
+    "integer": SQLiteType.INTEGER,
+    "float": SQLiteType.REAL,
+    "blob": SQLiteType.BLOB,
+}
+CREATE_TABLE_TYPE_FOR_SQLITE_TYPE = {
+    sqlite_type: column_type
+    for column_type, sqlite_type in CREATE_TABLE_SQLITE_TYPES.items()
+}
+TABLE_NAME_RE = re.compile(r"^(?!sqlite_)[^\n]+$")
+ALTER_TABLE_COLUMN_TYPES = CREATE_TABLE_COLUMN_TYPES
+ALTER_TABLE_TYPE_FOR_SQLITE_TYPE = {
+    SQLiteType.TEXT: "text",
+    SQLiteType.INTEGER: "integer",
+    SQLiteType.REAL: "float",
+    SQLiteType.BLOB: "blob",
+}
+FOREIGN_KEY_SUGGESTION_ROW_LIMIT = 500
+FOREIGN_KEY_SUGGESTION_TIME_LIMIT_MS = 50
+FOREIGN_KEY_SUGGESTION_TOTAL_TIME_LIMIT_MS = 200
+FOREIGN_KEY_TARGETS_SQL = """
+select
+  m.name as fk_table,
+  p.name as fk_column,
+  case
+    when upper(coalesce(p.type, '')) like '%INT%' then 'integer'
+    when upper(coalesce(p.type, '')) like '%CHAR%'
+      or upper(coalesce(p.type, '')) like '%CLOB%'
+      or upper(coalesce(p.type, '')) like '%TEXT%' then 'text'
+    when upper(coalesce(p.type, '')) like '%BLOB%'
+      or coalesce(p.type, '') = '' then 'blob'
+    when upper(coalesce(p.type, '')) like '%REAL%'
+      or upper(coalesce(p.type, '')) like '%FLOA%'
+      or upper(coalesce(p.type, '')) like '%' || 'DOU' || 'B' || '%' then 'real'
+    else 'numeric'
+  end as type
+from sqlite_master as m
+cross join pragma_table_info(m.name) as p
+where m.type = 'table'
+  and m.name not like 'sqlite_%'
+  and p.pk > 0
+  and (
+    select count(*)
+    from pragma_table_info(m.name) as p2
+    where p2.pk > 0
+  ) = 1
+order by m.name
+"""
+
+
+class ForeignKeySuggestionTimedOut(Exception):
+    pass
+
+
+def _sqlite_type_affinity(type_name):
+    type_name = (type_name or "").upper()
+    if "INT" in type_name:
+        return "integer"
+    if any(token in type_name for token in ("CHAR", "CLOB", "TEXT")):
+        return "text"
+    if "BLOB" in type_name or not type_name:
+        return "blob"
+    if any(
+        token in type_name
+        for token in ("REAL", "FLOA", "DOUB")  # codespell:ignore doub
+    ):
+        return "real"
+    return "numeric"
+
+
+def _foreign_key_type_compatible(source_affinity, target_affinity):
+    if source_affinity == target_affinity:
+        return True
+    numeric_affinities = {"integer", "real", "numeric"}
+    if source_affinity == "numeric":
+        return target_affinity in numeric_affinities
+    if target_affinity == "numeric":
+        return source_affinity in numeric_affinities
+    return False
+
+
+def _public_foreign_key_target(target):
+    return {
+        "fk_table": target["fk_table"],
+        "fk_column": target["fk_column"],
+        "type": target["type"],
+    }
+
+
+def _singular(name):
+    if name.endswith("ies") and len(name) > 3:
+        return name[:-3] + "y"
+    if name.endswith("s") and len(name) > 1:
+        return name[:-1]
+    return name
+
+
+def _foreign_key_name_reasons(source_column, target):
+    source = source_column.lower()
+    table = target["fk_table"].lower()
+    singular_table = _singular(table)
+    column = target["fk_column"].lower()
+    possible_names = {
+        f"{table}_{column}",
+        f"{singular_table}_{column}",
+    }
+    if column == "id":
+        possible_names.update(
+            {
+                f"{table}_id",
+                f"{singular_table}_id",
+            }
+        )
+    return ["name_match"] if source in possible_names else []
+
+
+def _foreign_key_option_sort_key(source_column, target):
+    has_name_match = bool(_foreign_key_name_reasons(source_column, target))
+    return (
+        0 if has_name_match else 1,
+        target["fk_table"],
+        target["fk_column"],
+    )
+
+
+def _foreign_key_suggestion_metadata(conn, table_name):
+    hidden_tables = set(sqlite_hidden_table_names(conn))
+    source_columns = [
+        {
+            "column": column.name,
+            "type": (column.type or "").upper(),
+            "affinity": _sqlite_type_affinity(column.type),
+        }
+        for column in table_column_details(conn, table_name)
+        if not column.hidden
+    ]
+    current_by_column = {
+        fk["column"]: {
+            "fk_table": fk["other_table"],
+            "fk_column": fk["other_column"],
+        }
+        for fk in get_outbound_foreign_keys(conn, table_name)
+    }
+    table_names = [
+        row[0]
+        for row in conn.execute(
+            "select name from sqlite_master where type = 'table' order by name"
+        ).fetchall()
+        if not row[0].startswith("sqlite_")
+    ]
+    targets = []
+    for candidate_table in table_names:
+        if candidate_table == table_name or candidate_table in hidden_tables:
+            continue
+        columns = [column for column in table_column_details(conn, candidate_table)]
+        pks = [column for column in columns if column.is_pk and not column.hidden]
+        pks.sort(key=lambda column: column.is_pk)
+        if len(pks) != 1:
+            continue
+        pk = pks[0]
+        targets.append(
+            {
+                "fk_table": candidate_table,
+                "fk_column": pk.name,
+                "type": (pk.type or "").upper(),
+                "affinity": _sqlite_type_affinity(pk.type),
+            }
+        )
+    return source_columns, targets, current_by_column
+
+
+async def _foreign_key_suggestion_samples(db, table_name, columns):
+    if not columns:
+        return 0, {}
+    sql = "select {} from {} limit {}".format(
+        ", ".join(escape_sqlite(column) for column in columns),
+        escape_sqlite(table_name),
+        FOREIGN_KEY_SUGGESTION_ROW_LIMIT,
+    )
+    try:
+        results = await db.execute(
+            sql,
+            custom_time_limit=FOREIGN_KEY_SUGGESTION_TIME_LIMIT_MS,
+            log_sql_errors=False,
+        )
+    except QueryInterrupted as e:
+        raise ForeignKeySuggestionTimedOut from e
+    values_by_column = {column: [] for column in columns}
+    seen_by_column = {column: set() for column in columns}
+    for row in results.rows:
+        for column in columns:
+            value = row[column]
+            if value is None or value in seen_by_column[column]:
+                continue
+            seen_by_column[column].add(value)
+            values_by_column[column].append(value)
+    return len(results.rows), values_by_column
+
+
+async def _foreign_key_suggestion_values_exist(db, target, values, time_limit_ms):
+    if not values:
+        return False
+    sql = "select {} from {} where {} in ({})".format(
+        escape_sqlite(target["fk_column"]),
+        escape_sqlite(target["fk_table"]),
+        escape_sqlite(target["fk_column"]),
+        ", ".join("?" for _ in values),
+    )
+    try:
+        results = await db.execute(
+            sql,
+            params=values,
+            custom_time_limit=time_limit_ms,
+            log_sql_errors=False,
+        )
+    except QueryInterrupted as e:
+        raise ForeignKeySuggestionTimedOut from e
+    found = {row[0] for row in results.rows}
+    return all(value in found for value in values)
+
+
+async def _create_table_ui_context(
+    datasette, request, db, database_name, database_action_permissions
+):
+    if not db.is_mutable:
+        return None
+    if not database_action_permissions.get("create-table"):
+        return None
+    data = {
+        "path": f"{datasette.urls.database(database_name)}/-/create",
+        "foreignKeyTargetsPath": f"{datasette.urls.database(database_name)}/-/foreign-key-targets",
+        "databaseName": database_name,
+        "columnTypes": CREATE_TABLE_COLUMN_TYPES,
+        "defaultExpressions": default_expression_options(),
+        "canInsertRows": await datasette.allowed(
+            action="insert-row",
+            resource=DatabaseResource(database=database_name),
+            actor=request.actor,
+        ),
+    }
+    can_set_column_type = await datasette.allowed(
+        action="set-column-type",
+        resource=TableResource(database=database_name, table="__new_table__"),
+        actor=request.actor,
+    )
+    if can_set_column_type:
+        data["customColumnTypes"] = _custom_column_type_options_for_create_table(
+            datasette
+        )
+    return data
+
+
+def _custom_column_type_options_for_create_table(datasette):
+    options = []
+    for name, ct_cls in sorted(datasette._column_types.items()):
+        sqlite_types = getattr(ct_cls, "sqlite_types", None)
+        if sqlite_types is None:
+            option_sqlite_types = CREATE_TABLE_COLUMN_TYPES[:]
+        else:
+            option_sqlite_types = [
+                create_table_type
+                for create_table_type, sqlite_type in CREATE_TABLE_SQLITE_TYPES.items()
+                if sqlite_type in sqlite_types
+            ]
+        if not option_sqlite_types:
+            continue
+        option = {
+            "name": name,
+            "description": ct_cls.description,
+            "sqliteTypes": option_sqlite_types,
+        }
+        if sqlite_types is not None and len(sqlite_types) == 1:
+            fixed_sqlite_type = CREATE_TABLE_TYPE_FOR_SQLITE_TYPE.get(sqlite_types[0])
+            if fixed_sqlite_type is not None:
+                option["fixedSqliteType"] = fixed_sqlite_type
+        options.append(option)
+    return options
+
+
+SqliteApiType = Literal["text", "integer", "float", "blob"]
+DEFAULT_EXPRESSIONS = {
+    "current_timestamp": {
+        "sql": "CURRENT_TIMESTAMP",
+        "label": "Current timestamp in UTC, e.g. 2026-05-01 13:34:00",
+        "sqliteType": "text",
+    },
+    "current_date": {
+        "sql": "CURRENT_DATE",
+        "label": "Current date in UTC, e.g. 2026-05-01",
+        "sqliteType": "text",
+    },
+    "current_time": {
+        "sql": "CURRENT_TIME",
+        "label": "Current time in UTC, e.g. 13:34:00",
+        "sqliteType": "text",
+    },
+    "current_unixtime": {
+        "sql": "(CAST(strftime('%s', 'now') AS INTEGER))",
+        "label": "Current Unix time, integer seconds since the epoch",
+        "sqliteType": "integer",
+    },
+    "current_unixtime_ms": {
+        "sql": "(CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER))",
+        "label": "Current Unix time, integer milliseconds since the epoch",
+        "sqliteType": "integer",
+    },
+}
+DefaultExpr = str
+DEFAULT_EXPR_SQL = {
+    name: metadata["sql"] for name, metadata in DEFAULT_EXPRESSIONS.items()
+}
+
+
+def _strip_wrapping_parentheses(expression):
+    expression = expression.strip()
+    while expression.startswith("(") and expression.endswith(")"):
+        depth = 0
+        in_single_quote = False
+        wraps_whole_expression = True
+        i = 0
+        while i < len(expression):
+            char = expression[i]
+            if char == "'":
+                if (
+                    in_single_quote
+                    and i + 1 < len(expression)
+                    and expression[i + 1] == "'"
+                ):
+                    i += 2
+                    continue
+                in_single_quote = not in_single_quote
+            elif not in_single_quote:
+                if char == "(":
+                    depth += 1
+                elif char == ")":
+                    depth -= 1
+                    if depth == 0 and i != len(expression) - 1:
+                        wraps_whole_expression = False
+                        break
+            i += 1
+        if not wraps_whole_expression or depth != 0 or in_single_quote:
+            break
+        expression = expression[1:-1].strip()
+    return expression
+
+
+def _default_expression_lookup_key(expression):
+    return re.sub(r"\s+", " ", _strip_wrapping_parentheses(expression)).lower()
+
+
+DEFAULT_EXPR_BY_SQL = {
+    _default_expression_lookup_key(sql): name for name, sql in DEFAULT_EXPR_SQL.items()
+}
+
+
+def default_expr_for_sql(expression):
+    if expression is None:
+        return None
+    return DEFAULT_EXPR_BY_SQL.get(_default_expression_lookup_key(expression))
+
+
+def _quoted_options(options):
+    if len(options) == 1:
+        return f"'{options[0]}'"
+    return "{} or '{}'".format(
+        ", ".join(f"'{option}'" for option in options[:-1]),
+        options[-1],
+    )
+
+
+def _default_expr_error_message():
+    return f"Input should be {_quoted_options(list(DEFAULT_EXPRESSIONS))}"
+
+
+def default_expression_options():
+    return [
+        {
+            "value": value,
+            "label": metadata["label"],
+            "sqliteType": metadata["sqliteType"],
+        }
+        for value, metadata in DEFAULT_EXPRESSIONS.items()
+    ]
+
+
+class _StrictPydanticModel(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+
+class _DefaultArgsMixin(_StrictPydanticModel):
+    default: Any | None = None
+    default_expr: DefaultExpr | None = None
+
+    @field_validator("default_expr")
+    @classmethod
+    def validate_default_expr_value(cls, value):
+        if value is not None and value not in DEFAULT_EXPRESSIONS:
+            raise PydanticCustomError("default_expr", _default_expr_error_message())
+        return value
+
+    @model_validator(mode="after")
+    def validate_default_fields(self):
+        has_default = "default" in self.model_fields_set
+        has_default_expr = "default_expr" in self.model_fields_set
+        if has_default and has_default_expr:
+            raise ValueError("default and default_expr cannot both be provided")
+        if has_default_expr and self.default_expr is None:
+            raise ValueError("default_expr cannot be null")
+        return self
+
+
+class CreateTableColumn(_DefaultArgsMixin):
+
+    name: Any = None
+    type: Any = "text"
+    fk_table: str | None = None
+    fk_column: str | None = None
+    not_null: bool = False
+
+    @model_validator(mode="after")
+    def validate_column(self):
+        if not self.name or not isinstance(self.name, str):
+            raise PydanticCustomError("create_table", "Column name is required")
+        if not self.type:
+            self.type = "text"
+        elif self.type not in CREATE_TABLE_COLUMN_TYPES:
+            raise PydanticCustomError(
+                "create_table", "Unsupported column type: {type}", {"type": self.type}
+            )
+        if self.fk_column and not self.fk_table:
+            raise PydanticCustomError(
+                "create_table_with_location",
+                "fk_column requires fk_table",
+            )
+        return self
+
+
+class CreateTableRequest(_StrictPydanticModel):
+    table: Any = None
+    rows: Any = None
+    row: Any = None
+    columns: list[CreateTableColumn] | None = None
+    pk: Any = None
+    pks: Any = None
+    ignore: bool | None = None
+    replace: bool | None = None
+    alter: bool | None = None
+
+    @field_validator("columns", mode="before")
+    @classmethod
+    def validate_columns_list(cls, value):
+        if value is None:
+            return value
+        if not isinstance(value, list):
+            raise PydanticCustomError("create_table", "columns must be a list")
+        if not all(isinstance(column, dict) for column in value):
+            raise PydanticCustomError(
+                "create_table", "columns must be a list of objects"
+            )
+        return value
+
+    @model_validator(mode="after")
+    def validate_request(self):
+        if not self.table:
+            raise PydanticCustomError("create_table", "Table is required")
+        if not isinstance(self.table, str) or not TABLE_NAME_RE.match(self.table):
+            raise PydanticCustomError("create_table", "Invalid table name")
+        if not self.columns and not self.rows and not self.row:
+            raise PydanticCustomError(
+                "create_table", "columns, rows or row is required"
+            )
+        if self.rows and self.row:
+            raise PydanticCustomError(
+                "create_table", "Cannot specify both rows and row"
+            )
+        if self.columns and (self.rows or self.row):
+            raise PydanticCustomError(
+                "create_table", "Cannot specify columns with rows or row"
+            )
+        if self.columns is not None:
+            seen = set()
+            duplicates = []
+            for column in self.columns:
+                if column.name in seen and column.name not in duplicates:
+                    duplicates.append(column.name)
+                seen.add(column.name)
+            if duplicates:
+                raise PydanticCustomError(
+                    "create_table",
+                    "Duplicate column name: {names}",
+                    {"names": ", ".join(duplicates)},
+                )
+        if self.rows is not None:
+            if not isinstance(self.rows, list):
+                raise PydanticCustomError("create_table", "rows must be a list")
+            if not all(isinstance(row, dict) for row in self.rows):
+                raise PydanticCustomError(
+                    "create_table", "rows must be a list of objects"
+                )
+        if self.pk is not None and not isinstance(self.pk, str):
+            raise PydanticCustomError("create_table", "pk must be a string")
+        if self.pk and self.pks:
+            raise PydanticCustomError("create_table", "Cannot specify both pk and pks")
+        if self.pks is not None:
+            if not isinstance(self.pks, list):
+                raise PydanticCustomError("create_table", "pks must be a list")
+            if not all(isinstance(pk, str) for pk in self.pks):
+                raise PydanticCustomError(
+                    "create_table", "pks must be a list of strings"
+                )
+        if self.ignore and self.replace:
+            raise PydanticCustomError(
+                "create_table", "ignore and replace are mutually exclusive"
+            )
+        if {"ignore", "replace"} & self.model_fields_set:
+            if not self.row and not self.rows:
+                raise PydanticCustomError(
+                    "create_table", "ignore and replace require row or rows"
+                )
+            if not self.pk and not self.pks:
+                raise PydanticCustomError(
+                    "create_table", "ignore and replace require pk or pks"
+                )
+        return self
+
+    @property
+    def rows_list(self):
+        return [self.row] if self.row else self.rows
+
+    @property
+    def foreign_keys(self):
+        if not self.columns:
+            return None
+        foreign_keys = []
+        for column in self.columns:
+            if column.fk_table and column.fk_column:
+                foreign_keys.append((column.name, column.fk_table, column.fk_column))
+            elif column.fk_table:
+                foreign_keys.append((column.name, column.fk_table))
+        return foreign_keys or None
+
+
+class AddColumnArgs(_DefaultArgsMixin):
+    name: str
+    type: SqliteApiType = "text"
+    not_null: bool = False
+
+
+class RenameColumnArgs(_StrictPydanticModel):
+    name: str
+    to: str
+
+
+class RenameTableArgs(_StrictPydanticModel):
+    to: str
+
+    @field_validator("to")
+    @classmethod
+    def validate_table_name(cls, v):
+        if not TABLE_NAME_RE.match(v):
+            raise PydanticCustomError(
+                "alter_table_rename_table",
+                "Invalid table name",
+            )
+        return v
+
+
+class AlterColumnArgs(_DefaultArgsMixin):
+    name: str
+    type: SqliteApiType | None = None
+    not_null: bool | None = None
+
+    @model_validator(mode="after")
+    def require_change(self):
+        if not (
+            {"type", "not_null", "default", "default_expr"} & self.model_fields_set
+        ):
+            raise ValueError(
+                "At least one of type, not_null, default or default_expr must be provided"
+            )
+        return self
+
+
+class DropColumnArgs(_StrictPydanticModel):
+    name: str
+
+
+class SetPrimaryKeyArgs(_StrictPydanticModel):
+    columns: list[str] = Field(min_length=1)
+
+
+class ReorderColumnsArgs(_StrictPydanticModel):
+    columns: list[str] = Field(min_length=1)
+
+
+class ForeignKeyArgs(_StrictPydanticModel):
+    column: str
+    fk_table: str | None = None
+    fk_column: str | None = None
+
+    @model_validator(mode="after")
+    def validate_foreign_key(self):
+        if self.fk_column and not self.fk_table:
+            raise PydanticCustomError(
+                "alter_table_foreign_key",
+                "fk_column requires fk_table",
+            )
+        if not self.fk_table:
+            raise PydanticCustomError(
+                "alter_table_foreign_key",
+                "fk_table is required",
+            )
+        return self
+
+    @property
+    def tuple(self):
+        if self.fk_column:
+            return (self.column, self.fk_table, self.fk_column)
+        return (self.column, self.fk_table)
+
+
+class DropForeignKeyArgs(_StrictPydanticModel):
+    column: str
+
+
+class SetForeignKeysArgs(_StrictPydanticModel):
+    foreign_keys: list[ForeignKeyArgs]
+
+
+class AddColumnOperation(_StrictPydanticModel):
+    op: Literal["add_column"]
+    args: AddColumnArgs
+
+
+class RenameColumnOperation(_StrictPydanticModel):
+    op: Literal["rename_column"]
+    args: RenameColumnArgs
+
+
+class RenameTableOperation(_StrictPydanticModel):
+    op: Literal["rename_table"]
+    args: RenameTableArgs
+
+
+class AlterColumnOperation(_StrictPydanticModel):
+    op: Literal["alter_column"]
+    args: AlterColumnArgs
+
+
+class DropColumnOperation(_StrictPydanticModel):
+    op: Literal["drop_column"]
+    args: DropColumnArgs
+
+
+class SetPrimaryKeyOperation(_StrictPydanticModel):
+    op: Literal["set_primary_key"]
+    args: SetPrimaryKeyArgs
+
+
+class ReorderColumnsOperation(_StrictPydanticModel):
+    op: Literal["reorder_columns"]
+    args: ReorderColumnsArgs
+
+
+class AddForeignKeyOperation(_StrictPydanticModel):
+    op: Literal["add_foreign_key"]
+    args: ForeignKeyArgs
+
+
+class DropForeignKeyOperation(_StrictPydanticModel):
+    op: Literal["drop_foreign_key"]
+    args: DropForeignKeyArgs
+
+
+class SetForeignKeysOperation(_StrictPydanticModel):
+    op: Literal["set_foreign_keys"]
+    args: SetForeignKeysArgs
+
+
+AlterTableOperation = Annotated[
+    AddColumnOperation
+    | RenameColumnOperation
+    | RenameTableOperation
+    | AlterColumnOperation
+    | DropColumnOperation
+    | SetPrimaryKeyOperation
+    | ReorderColumnsOperation
+    | AddForeignKeyOperation
+    | DropForeignKeyOperation
+    | SetForeignKeysOperation,
+    Field(discriminator="op"),
+]
+
+
+class AlterTableRequest(_StrictPydanticModel):
+    operations: list[AlterTableOperation] = Field(min_length=1)
+
+
+def _pydantic_errors(validation_error):
+    errors = []
+    for error in validation_error.errors():
+        location = ".".join(str(item) for item in error["loc"])
+        message = error["msg"]
+        errors.append(f"{location}: {message}" if location else message)
+    return errors
+
+
+def _create_table_pydantic_errors(validation_error):
+    errors = validation_error.errors()
+    invalid_keys = sorted(
+        str(error["loc"][0])
+        for error in errors
+        if error["type"] == "extra_forbidden" and len(error["loc"]) == 1
+    )
+    if invalid_keys:
+        return ["Invalid keys: {}".format(", ".join(invalid_keys))]
+
+    output = []
+    for error in errors:
+        message = error["msg"]
+        if error["type"] == "create_table":
+            output.append(message)
+            continue
+        location = ".".join(str(item) for item in error["loc"])
+        output.append(f"{location}: {message}" if location else message)
+    return output
+
+
+def _table_schema_from_conn(conn, table_name):
+    row = conn.execute(
+        "select sql from sqlite_master where type = 'table' and name = ?",
+        [table_name],
+    ).fetchone()
+    return row[0] if row else None
+
+
+def _primary_key_value(columns):
+    if len(columns) == 1:
+        return columns[0]
+    return tuple(columns)
+
+
+def _default_expression_sql(default_expr):
+    return DEFAULT_EXPR_SQL[default_expr]
+
+
+def _literal_default(db, value):
+    if isinstance(value, str):
+        return db.quote(value)
+    return value
+
+
+class TableCreateView(BaseView):
+    name = "table-create"
+
+    def __init__(self, datasette):
+        self.ds = datasette
+
+    async def post(self, request):
+        db = await self.ds.resolve_database(request)
+        database_name = db.name
+
+        # Must have create-table permission
+        if not await self.ds.allowed(
+            action="create-table",
+            resource=DatabaseResource(database=database_name),
+            actor=request.actor,
+        ):
+            return Response.error(["Permission denied"], 403)
+
+        try:
+            data = await request.json()
+        except json.JSONDecodeError as e:
+            return Response.error([f"Invalid JSON: {e}"])
+        except PayloadTooLarge as e:
+            return Response.error([str(e)], 413)
+
+        if not isinstance(data, dict):
+            return Response.error(["JSON must be an object"])
+
+        try:
+            create_request = CreateTableRequest.model_validate(data)
+        except ValidationError as e:
+            return Response.error(_create_table_pydantic_errors(e))
+
+        ignore = create_request.ignore
+        replace = create_request.replace
+
+        # Replacing rows requires update-row permission
+        if replace and not await self.ds.allowed(
+            action="update-row",
+            resource=DatabaseResource(database=database_name),
+            actor=request.actor,
+        ):
+            return Response.error(["Permission denied: need update-row"], 403)
+
+        table_name = create_request.table
+        table_exists = await db.table_exists(table_name)
+        columns = create_request.columns
+        rows = create_request.rows_list
+
+        if rows:
+            # Must have insert-row permission
+            if not await self.ds.allowed(
+                action="insert-row",
+                resource=DatabaseResource(database=database_name),
+                actor=request.actor,
+            ):
+                return Response.error(["Permission denied: need insert-row"], 403)
+            try:
+                rows = decode_write_json_rows(rows)
+            except WriteJsonValueError as e:
+                return Response.error([str(e)], 400)
+
+        alter = False
+        if rows:
+            if not table_exists:
+                # if table is being created for the first time, alter=True
+                alter = True
+            else:
+                # alter=True only if they request it AND they have permission
+                if create_request.alter:
+                    if not await self.ds.allowed(
+                        action="alter-table",
+                        resource=DatabaseResource(database=database_name),
+                        actor=request.actor,
+                    ):
+                        return Response.error(
+                            ["Permission denied: need alter-table"], 403
+                        )
+                    alter = True
+
+        pk = create_request.pk
+        pks = create_request.pks
+
+        # If table exists already, read pks from that instead
+        if table_exists:
+            actual_pks = await db.primary_keys(table_name)
+            # if pk passed and table already exists check it does not change
+            bad_pks = False
+            if (
+                len(actual_pks) == 1
+                and pk
+                and pk != actual_pks[0]
+                or len(actual_pks) > 1
+                and pks
+                and set(pks) != set(actual_pks)
+            ):
+                bad_pks = True
+            if bad_pks:
+                return Response.error(["pk cannot be changed for existing table"])
+            pks = actual_pks
+
+        initial_schema = None
+        if table_exists:
+            initial_schema = await db.execute_fn(
+                lambda conn: sqlite_utils.Database(conn)[table_name].schema
+            )
+
+        def create_table(conn):
+            db_for_write = sqlite_utils.Database(conn)
+            table = db_for_write[table_name]
+            if rows:
+                table.insert_all(
+                    rows, pk=pks or pk, ignore=ignore, replace=replace, alter=alter
+                )
+            else:
+                not_null = [column.name for column in columns if column.not_null]
+                defaults = {}
+                for column in columns:
+                    if "default_expr" in column.model_fields_set:
+                        defaults[column.name] = _default_expression_sql(
+                            column.default_expr
+                        )
+                    elif (
+                        "default" in column.model_fields_set
+                        and column.default is not None
+                    ):
+                        defaults[column.name] = _literal_default(
+                            db_for_write, column.default
+                        )
+                table.create(
+                    {column.name: column.type for column in columns},
+                    pk=pks or pk,
+                    foreign_keys=create_request.foreign_keys,
+                    not_null=not_null or None,
+                    defaults=defaults or None,
+                )
+            return table.schema
+
+        try:
+            schema = await db.execute_write_fn(create_table, request=request)
+        except Exception as e:  # noqa: BLE001
+            # TODO: narrow to expected write errors so Datasette bugs surface as 500s
+            return Response.error([str(e)])
+
+        if initial_schema is not None and initial_schema != schema:
+            await self.ds.track_event(
+                AlterTableEvent(
+                    request.actor,
+                    database=database_name,
+                    table=table_name,
+                    before_schema=initial_schema,
+                    after_schema=schema,
+                )
+            )
+
+        table_url = self.ds.absolute_url(
+            request, self.ds.urls.table(db.name, table_name)
+        )
+        table_api_url = self.ds.absolute_url(
+            request, self.ds.urls.table(db.name, table_name, format="json")
+        )
+        details = {
+            "ok": True,
+            "database": db.name,
+            "table": table_name,
+            "table_url": table_url,
+            "table_api_url": table_api_url,
+            "schema": schema,
+        }
+        if rows:
+            details["row_count"] = len(rows)
+
+        if not table_exists:
+            # Only log creation if we created a table
+            await self.ds.track_event(
+                CreateTableEvent(
+                    request.actor, database=db.name, table=table_name, schema=schema
+                )
+            )
+        if rows:
+            await self.ds.track_event(
+                InsertRowsEvent(
+                    request.actor,
+                    database=db.name,
+                    table=table_name,
+                    num_rows=len(rows),
+                    ignore=ignore,
+                    replace=replace,
+                )
+            )
+        return Response.json(details, status=201)
+
+
+class DatabaseForeignKeyTargetsView(BaseView):
+    name = "database-foreign-key-targets"
+
+    def __init__(self, datasette):
+        self.ds = datasette
+
+    async def get(self, request):
+        db = await self.ds.resolve_database(request)
+        database_name = db.name
+
+        table_name = request.args.get("table")
+        can_create_table = await self.ds.allowed(
+            action="create-table",
+            resource=DatabaseResource(database=database_name),
+            actor=request.actor,
+        )
+        can_alter_table = False
+        if table_name and await db.table_exists(table_name):
+            can_alter_table = await self.ds.allowed(
+                action="alter-table",
+                resource=TableResource(database=database_name, table=table_name),
+                actor=request.actor,
+            )
+        if not (can_create_table or can_alter_table):
+            return Response.error(["Permission denied: need create-table"], 403)
+
+        hidden_tables = await db.execute_fn(
+            lambda conn: set(sqlite_hidden_table_names(conn))
+        )
+        targets = [
+            target
+            for target in (await db.execute(FOREIGN_KEY_TARGETS_SQL)).dicts()
+            if target["fk_table"] not in hidden_tables
+        ]
+        return Response.json(
+            {
+                "ok": True,
+                "database": database_name,
+                "targets": targets,
+            }
+        )
+
+
+class TableForeignKeySuggestionsView(BaseView):
+    name = "table-foreign-key-suggestions"
+
+    def __init__(self, datasette):
+        self.ds = datasette
+
+    async def get(self, request):
+        try:
+            resolved = await self.ds.resolve_table(request)
+        except NotFound as e:
+            return Response.error([e.args[0]], 404)
+
+        db = resolved.db
+        database_name = db.name
+        table_name = resolved.table
+
+        if resolved.is_view:
+            return Response.error(["Cannot suggest foreign keys for a view"], 400)
+
+        if not await self.ds.allowed(
+            action="alter-table",
+            resource=TableResource(database=database_name, table=table_name),
+            actor=request.actor,
+        ):
+            return Response.error(["Permission denied: need alter-table"], 403)
+
+        source_columns, targets, current_by_column = await db.execute_fn(
+            lambda conn: _foreign_key_suggestion_metadata(conn, table_name)
+        )
+
+        columns = []
+        options_by_column = {}
+        for source_column in source_columns:
+            options = sorted(
+                [
+                    target
+                    for target in targets
+                    if _foreign_key_type_compatible(
+                        source_column["affinity"], target["affinity"]
+                    )
+                ],
+                key=lambda target: _foreign_key_option_sort_key(
+                    source_column["column"], target
+                ),
+            )
+            options_by_column[source_column["column"]] = options
+            columns.append(
+                {
+                    "column": source_column["column"],
+                    "type": source_column["type"],
+                    "affinity": source_column["affinity"],
+                    "current": current_by_column.get(source_column["column"]),
+                    "suggestions": [],
+                    "options": [
+                        _public_foreign_key_target(option) for option in options
+                    ],
+                }
+            )
+
+        columns_to_sample = [
+            column["column"]
+            for column in columns
+            if options_by_column[column["column"]]
+        ]
+        row_check = {
+            "attempted": bool(columns_to_sample),
+            "status": "completed" if columns_to_sample else "skipped",
+            "row_limit": FOREIGN_KEY_SUGGESTION_ROW_LIMIT,
+            "sampled_rows": 0,
+            "checked_options": 0,
+        }
+
+        try:
+            sampled_rows, values_by_column = await _foreign_key_suggestion_samples(
+                db, table_name, columns_to_sample
+            )
+            row_check["sampled_rows"] = sampled_rows
+            deadline = time.perf_counter() + (
+                FOREIGN_KEY_SUGGESTION_TOTAL_TIME_LIMIT_MS / 1000
+            )
+            for column_info in columns:
+                values = values_by_column.get(column_info["column"]) or []
+                if not values:
+                    continue
+                for option in options_by_column[column_info["column"]]:
+                    remaining_ms = int((deadline - time.perf_counter()) * 1000)
+                    if remaining_ms <= 0:
+                        raise ForeignKeySuggestionTimedOut
+                    if await _foreign_key_suggestion_values_exist(
+                        db,
+                        option,
+                        values,
+                        min(FOREIGN_KEY_SUGGESTION_TIME_LIMIT_MS, remaining_ms),
+                    ):
+                        reasons = [
+                            "type_match",
+                            "sample_values_exist",
+                        ] + _foreign_key_name_reasons(column_info["column"], option)
+                        column_info["suggestions"].append(
+                            {
+                                "fk_table": option["fk_table"],
+                                "fk_column": option["fk_column"],
+                                "confidence": "sampled",
+                                "sampled_values": len(values),
+                                "reasons": reasons,
+                            }
+                        )
+                    row_check["checked_options"] += 1
+        except ForeignKeySuggestionTimedOut:
+            row_check["status"] = "timed_out"
+
+        return Response.json(
+            {
+                "ok": True,
+                "database": database_name,
+                "table": table_name,
+                "row_check": row_check,
+                "columns": columns,
+            }
+        )
+
+
+class TableAlterView(BaseView):
+    name = "table-alter"
+
+    def __init__(self, datasette):
+        self.ds = datasette
+
+    async def post(self, request):
+        try:
+            resolved = await self.ds.resolve_table(request)
+        except NotFound as e:
+            return Response.error([e.args[0]], 404)
+
+        db = resolved.db
+        database_name = db.name
+        table_name = resolved.table
+
+        if not await self.ds.allowed(
+            action="alter-table",
+            resource=TableResource(database=database_name, table=table_name),
+            actor=request.actor,
+        ):
+            return Response.error(["Permission denied: need alter-table"], 403)
+
+        if not db.is_mutable:
+            return Response.error(["Database is immutable"], 403)
+
+        try:
+            data = await request.json()
+        except json.JSONDecodeError as e:
+            return Response.error([f"Invalid JSON: {e}"], 400)
+        except PayloadTooLarge as e:
+            return Response.error([str(e)], 413)
+
+        if not isinstance(data, dict):
+            return Response.error(["JSON must be a dictionary"], 400)
+
+        try:
+            alter_request = AlterTableRequest.model_validate(data)
+        except ValidationError as e:
+            return Response.error(_pydantic_errors(e), 400)
+
+        def alter_table(conn):
+            before_schema = _table_schema_from_conn(conn, table_name)
+
+            def apply_operations(operation_conn):
+                db_for_write = sqlite_utils.Database(operation_conn)
+                table = db_for_write[table_name]
+                current_table_name = table_name
+
+                add_columns = []
+                types = {}
+                rename = {}
+                rename_table_to = None
+                drop = set()
+                not_null = {}
+                defaults = {}
+                column_order = None
+                pk = SQLITE_UTILS_DEFAULT
+                add_foreign_keys = []
+                drop_foreign_keys = []
+                foreign_keys = None
+
+                for operation in alter_request.operations:
+                    args = operation.args
+                    if operation.op == "add_column":
+                        if args.not_null and not (
+                            (
+                                "default" in args.model_fields_set
+                                and args.default is not None
+                            )
+                            or "default_expr" in args.model_fields_set
+                        ):
+                            raise ValueError(
+                                "add_column args.default or args.default_expr is required when not_null is true"
+                            )
+                        add_columns.append(args)
+                        if "default" in args.model_fields_set and not args.not_null:
+                            defaults[args.name] = _literal_default(
+                                db_for_write, args.default
+                            )
+                        if (
+                            "default_expr" in args.model_fields_set
+                            and not args.not_null
+                        ):
+                            defaults[args.name] = _default_expression_sql(
+                                args.default_expr
+                            )
+                    elif operation.op == "rename_table":
+                        rename_table_to = args.to
+                    elif operation.op == "rename_column":
+                        rename[args.name] = args.to
+                    elif operation.op == "alter_column":
+                        if args.type is not None:
+                            types[args.name] = args.type
+                        if args.not_null is not None:
+                            not_null[args.name] = args.not_null
+                        if "default" in args.model_fields_set:
+                            defaults[args.name] = (
+                                None
+                                if args.default is None
+                                else _literal_default(db_for_write, args.default)
+                            )
+                        if "default_expr" in args.model_fields_set:
+                            defaults[args.name] = _default_expression_sql(
+                                args.default_expr
+                            )
+                    elif operation.op == "drop_column":
+                        drop.add(args.name)
+                    elif operation.op == "set_primary_key":
+                        pk = _primary_key_value(args.columns)
+                    elif operation.op == "reorder_columns":
+                        column_order = args.columns
+                    elif operation.op == "add_foreign_key":
+                        add_foreign_keys.append(args.tuple)
+                    elif operation.op == "drop_foreign_key":
+                        drop_foreign_keys.append(args.column)
+                    elif operation.op == "set_foreign_keys":
+                        foreign_keys = [fk.tuple for fk in args.foreign_keys]
+
+                with operation_conn:
+                    for column in add_columns:
+                        not_null_default = None
+                        if column.not_null:
+                            if "default_expr" in column.model_fields_set:
+                                not_null_default = _default_expression_sql(
+                                    column.default_expr
+                                )
+                            else:
+                                not_null_default = _literal_default(
+                                    db_for_write, column.default
+                                )
+                        table.add_column(
+                            column.name,
+                            column.type,
+                            not_null_default=not_null_default,
+                        )
+
+                    should_transform = any(
+                        (
+                            types,
+                            rename,
+                            drop,
+                            not_null,
+                            defaults,
+                            column_order is not None,
+                            pk is not SQLITE_UTILS_DEFAULT,
+                            add_foreign_keys,
+                            drop_foreign_keys,
+                            foreign_keys is not None,
+                        )
+                    )
+                    if should_transform:
+                        table.transform(
+                            types=types or None,
+                            rename=rename or None,
+                            drop=drop or None,
+                            pk=pk,
+                            not_null=not_null or None,
+                            defaults=defaults or None,
+                            column_order=column_order,
+                            add_foreign_keys=add_foreign_keys or None,
+                            drop_foreign_keys=drop_foreign_keys or None,
+                            foreign_keys=foreign_keys,
+                        )
+                    if (
+                        rename_table_to is not None
+                        and rename_table_to != current_table_name
+                    ):
+                        operation_conn.execute(
+                            f"alter table {escape_sqlite(current_table_name)} rename to {escape_sqlite(rename_table_to)}"
+                        )
+                        current_table_name = rename_table_to
+
+                return current_table_name, _table_schema_from_conn(
+                    operation_conn, current_table_name
+                )
+
+            after_table_name, after_schema = apply_operations(conn)
+            return before_schema, after_schema, after_table_name
+
+        try:
+            before_schema, after_schema, after_table_name = await db.execute_write_fn(
+                alter_table, request=request
+            )
+        except Exception as e:  # noqa: BLE001
+            # TODO: narrow to expected write errors so Datasette bugs surface as 500s
+            return Response.error([str(e)], 400)
+
+        altered = before_schema != after_schema
+        if altered:
+            await self.ds.track_event(
+                AlterTableEvent(
+                    request.actor,
+                    database=database_name,
+                    table=after_table_name,
+                    before_schema=before_schema,
+                    after_schema=after_schema,
+                )
+            )
+
+        table_url = self.ds.absolute_url(
+            request, self.ds.urls.table(database_name, after_table_name)
+        )
+        table_api_url = self.ds.absolute_url(
+            request, self.ds.urls.table(database_name, after_table_name, format="json")
+        )
+        return Response.json(
+            {
+                "ok": True,
+                "database": database_name,
+                "table": after_table_name,
+                "table_url": table_url,
+                "table_api_url": table_api_url,
+                "altered": altered,
+                "schema": after_schema,
+                "before_schema": before_schema,
+                "operations_applied": len(alter_request.operations),
+            },
+            status=200,
+        )
diff --git a/datasette/views/table_extras.py b/datasette/views/table_extras.py
index a0308e49..3d8cad5e 100644
--- a/datasette/views/table_extras.py
+++ b/datasette/views/table_extras.py
@@ -1,6 +1,8 @@
 import itertools
 from dataclasses import dataclass
+from typing import ClassVar
 
+from datasette.column_types import SQLiteType
 from datasette.database import QueryInterrupted
 from datasette.extras import Extra, ExtraExample, ExtraRegistry, ExtraScope, Provider
 from datasette.plugins import pm
@@ -98,9 +100,9 @@ class QueryExtraContext:
 
 
 class CountSqlExtra(Extra):
-    description = "SQL query used to calculate the total count"
+    description = "SQL query string used to calculate the total count for the current table view, including active filters."
     example = ExtraExample("/fixtures/facetable.json?_size=0&_extra=count_sql")
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
 
     async def resolve(self, context):
         return context.count_sql
@@ -109,7 +111,7 @@ class CountSqlExtra(Extra):
 class CountExtra(Extra):
     description = "Total count of rows matching these filters"
     example = ExtraExample("/fixtures/facetable.json?_extra=count")
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
     expensive = True
 
     async def resolve(self, context):
@@ -127,9 +129,7 @@ class CountExtra(Extra):
                 pass
 
         if context.count_sql and count is None and not context.nocount:
-            count_sql_limited = (
-                f"select count(*) from (select * {context.from_sql} limit 10001)"
-            )
+            count_sql_limited = f"select count(*) from (select * {context.from_sql} limit {context.db.count_limit + 1})"
             try:
                 count_rows = list(
                     await context.db.execute(count_sql_limited, context.from_sql_params)
@@ -140,8 +140,41 @@ class CountExtra(Extra):
         return count
 
 
+def count_is_truncated(datasette, db, database_name, table_name, count_sql, count):
+    if count != db.count_limit + 1:
+        return False
+    if (
+        not db.is_mutable
+        and datasette.inspect_data
+        and count_sql == f"select count(*) from {table_name} "
+    ):
+        try:
+            datasette.inspect_data[database_name]["tables"][table_name]["count"]
+            return False
+        except KeyError:
+            pass
+    return True
+
+
+class CountTruncatedExtra(Extra):
+    description = "True if the count hit Datasette's counting limit, meaning the real number of matching rows is at least the reported count."
+    example = ExtraExample("/fixtures/facetable.json?_extra=count,count_truncated")
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
+    expensive = True
+
+    async def resolve(self, context, count):
+        return count_is_truncated(
+            context.datasette,
+            context.db,
+            context.database_name,
+            context.table_name,
+            context.count_sql,
+            count,
+        )
+
+
 class FacetInstancesProvider(Provider):
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
 
     async def resolve(self, context, count):
         facet_instances = []
@@ -165,7 +198,7 @@ class FacetInstancesProvider(Provider):
 
 
 class FacetResultsExtra(Extra):
-    description = "Results of facets calculated against this data"
+    description = "Results of facets calculated against this data. A dictionary with ``results`` and ``timed_out`` keys: ``results`` maps facet names to facet dictionaries with ``name``, ``type``, ``results`` and URL keys, and each facet result item includes ``value``, ``label``, ``count`` and ``toggle_url``."
     example = ExtraExample(
         value={
             "results": {
@@ -182,7 +215,7 @@ class FacetResultsExtra(Extra):
         },
         note="Shape abbreviated from /fixtures/facetable.json?_facet=state&_extra=facet_results.",
     )
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
     expensive = True
     docs_note = "See :ref:`facets` for details of how facets work."
 
@@ -214,7 +247,9 @@ class FacetResultsExtra(Extra):
 
 
 class FacetsTimedOutExtra(Extra):
-    description = "Facet calculations that timed out"
+    description = (
+        "List of names of facet calculations that exceeded the facet time limit."
+    )
     example = ExtraExample(
         "/fixtures/facetable.json?_facet=state&_extra=facets_timed_out",
         note=(
@@ -223,14 +258,14 @@ class FacetsTimedOutExtra(Extra):
             "if every facet calculation completed."
         ),
     )
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
 
     async def resolve(self, context, facet_results):
         return facet_results["timed_out"]
 
 
 class SuggestedFacetsExtra(Extra):
-    description = "Suggestions for facets that might return interesting results"
+    description = "Suggestions for facets that might return interesting results. Each item is a dictionary with ``name`` and ``toggle_url`` keys, and may include extra keys such as ``type`` or ``label`` depending on the facet class."
     example = ExtraExample(
         value=[
             {
@@ -240,7 +275,7 @@ class SuggestedFacetsExtra(Extra):
         ],
         note="Shape abbreviated from /fixtures/facetable.json?_extra=suggested_facets.",
     )
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
     expensive = True
     docs_note = (
         "Suggestions are controlled by the :ref:`setting_suggest_facets` setting."
@@ -268,7 +303,7 @@ class HumanDescriptionEnExtra(Extra):
     example = ExtraExample(
         "/fixtures/facetable.json?state=CA&_sort=pk&_extra=human_description_en"
     )
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
 
     async def resolve(self, context):
         human_description_en = context.filters.human_description_en(
@@ -285,25 +320,10 @@ class HumanDescriptionEnExtra(Extra):
         return human_description_en
 
 
-class NextUrlExtra(Extra):
-    description = "Full URL for the next page of results"
-    example = ExtraExample(
-        "/fixtures/facetable.json?_size=1&_extra=next_url",
-        note=(
-            "``null`` if there are no more pages of results. "
-            "See :ref:`json_api_pagination`."
-        ),
-    )
-    scopes = {ExtraScope.TABLE}
-
-    async def resolve(self, context):
-        return context.next_url
-
-
 class ColumnsExtra(Extra):
-    description = "Column names returned by this query"
+    description = "List of column names returned by this table, row or query."
     example = ExtraExample("/fixtures/facetable.json?_extra=columns")
-    examples = {
+    examples: ClassVar[dict[ExtraScope, ExtraExample | list[ExtraExample]]] = {
         ExtraScope.ROW: ExtraExample(
             "/fixtures/simple_primary_key/1.json?_extra=columns"
         ),
@@ -311,38 +331,91 @@ class ColumnsExtra(Extra):
             "/fixtures/-/query.json?sql=select+1+as+one&_extra=columns"
         ),
     }
-    scopes = {ExtraScope.TABLE, ExtraScope.ROW, ExtraScope.QUERY}
+    scopes: ClassVar[set[ExtraScope]] = {
+        ExtraScope.TABLE,
+        ExtraScope.ROW,
+        ExtraScope.QUERY,
+    }
 
     async def resolve(self, context):
         return context.columns
 
 
 class AllColumnsExtra(Extra):
-    description = "All columns in the table, regardless of _col/_nocol filtering"
+    description = "List of all column names in the table, regardless of ``_col=`` or ``_nocol=`` filtering."
     example = ExtraExample("/fixtures/facetable.json?_col=pk&_extra=all_columns")
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
 
     async def resolve(self, context):
         return list(context.table_columns)
 
 
 class PrimaryKeysExtra(Extra):
-    description = "Primary keys for this table"
+    description = "List of primary key column names for this table, or an empty list if the table has no explicit primary key."
     example = ExtraExample("/fixtures/facetable.json?_extra=primary_keys")
-    examples = {
+    examples: ClassVar[dict[ExtraScope, ExtraExample | list[ExtraExample]]] = {
         ExtraScope.ROW: ExtraExample(
             "/fixtures/simple_primary_key/1.json?_extra=primary_keys"
         )
     }
-    scopes = {ExtraScope.TABLE, ExtraScope.ROW}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE, ExtraScope.ROW}
 
     async def resolve(self, context):
         return context.pks
 
 
+def column_detail_as_json(column):
+    return {
+        "type": column.type,
+        "sqlite_type": SQLiteType.from_declared_type(column.type).value,
+        "notnull": bool(column.notnull),
+        "default": column.default_value,
+        "is_pk": bool(column.is_pk),
+        "pk_position": column.is_pk,
+        "hidden": column.hidden,
+    }
+
+
+class ColumnDetailsExtra(Extra):
+    description = (
+        "SQLite schema details for columns in this table. The dictionary maps "
+        "column names to objects describing the schema for each column."
+    )
+    docs_note = (
+        "Each object has ``type`` as the declared type string returned by "
+        'SQLite, or ``""`` if no type was declared; ``sqlite_type`` as the '
+        "normalized SQLite affinity, one of ``TEXT``, ``INTEGER``, ``REAL``, "
+        "``BLOB`` or ``NUMERIC``; ``notnull`` as a boolean; ``default`` "
+        'as the raw SQL default expression string, such as ``"42"``, '
+        "``\"'hello'\"`` or ``\"datetime('now')\"``, or ``null`` if there is "
+        "no default; ``is_pk`` as a boolean; ``pk_position`` as the integer "
+        "primary key position reported by SQLite, or ``0`` for columns that "
+        "are not part of the primary key; and ``hidden`` as the integer value "
+        "reported by SQLite's ``PRAGMA table_xinfo``. ``hidden`` is ``0`` for "
+        "normal columns, ``1`` for hidden virtual table columns, ``2`` for "
+        "virtual generated columns and ``3`` for stored generated columns."
+    )
+    example = ExtraExample("/fixtures/binary_data.json?_size=0&_extra=column_details")
+    examples: ClassVar[dict[ExtraScope, ExtraExample | list[ExtraExample]]] = {
+        ExtraScope.ROW: ExtraExample(
+            "/fixtures/binary_data/1.json?_extra=column_details"
+        )
+    }
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE, ExtraScope.ROW}
+
+    async def resolve(self, context):
+        column_details = await context.datasette._get_resource_column_details(
+            context.database_name, context.table_name
+        )
+        return {
+            column_name: column_detail_as_json(column)
+            for column_name, column in column_details.items()
+        }
+
+
 class ActionsExtra(Extra):
-    description = "Table or view actions made available by plugin hooks"
-    scopes = {ExtraScope.TABLE}
+    description = 'Async callable returning table or view actions made available by core and plugin hooks. Each item is either a link with ``href``, ``label`` and optional ``description`` keys, or a button with ``type: "button"``, ``label``, optional ``description`` and optional ``attrs``. See :ref:`plugin_actions`, :ref:`plugin_hook_table_actions` and :ref:`plugin_hook_view_actions`.'
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
     # Returns an async function for the HTML templates - not JSON serializable
     public = False
 
@@ -367,23 +440,14 @@ class ActionsExtra(Extra):
                 # that allowed() calls made inside the plugin hooks below
                 # are served from the cache
                 datasette = context.datasette
-                await datasette.allowed_many(
-                    actions=[
-                        name
-                        for name, action in datasette.actions.items()
-                        if action.resource_class is TableResource
-                    ],
-                    resource=TableResource(context.database_name, context.table_name),
-                    actor=context.request.actor,
+                await precompute_table_action_permissions(
+                    datasette,
+                    context.request.actor,
+                    context.database_name,
+                    context.table_name,
                 )
-                await datasette.allowed_many(
-                    actions=[
-                        name
-                        for name, action in datasette.actions.items()
-                        if action.resource_class is DatabaseResource
-                    ],
-                    resource=DatabaseResource(context.database_name),
-                    actor=context.request.actor,
+                await precompute_database_action_permissions(
+                    datasette, context.request.actor, context.database_name
                 )
             for hook in method(**kwargs):
                 extra_links = await await_me_maybe(hook)
@@ -394,23 +458,49 @@ class ActionsExtra(Extra):
         return actions
 
 
+async def precompute_table_action_permissions(
+    datasette, actor, database_name, table_name
+):
+    await datasette.allowed_many(
+        actions=[
+            name
+            for name, action in datasette.actions.items()
+            if action.resource_class is TableResource
+        ],
+        resource=TableResource(database_name, table_name),
+        actor=actor,
+    )
+
+
+async def precompute_database_action_permissions(datasette, actor, database_name):
+    await datasette.allowed_many(
+        actions=[
+            name
+            for name, action in datasette.actions.items()
+            if action.resource_class is DatabaseResource
+        ],
+        resource=DatabaseResource(database_name),
+        actor=actor,
+    )
+
+
 class IsViewExtra(Extra):
     description = "Whether this resource is a view instead of a table"
     example = ExtraExample("/fixtures/simple_view.json?_extra=is_view")
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
 
     async def resolve(self, context):
         return context.is_view
 
 
 class DebugExtra(Extra):
-    description = "Extra debug information"
+    description = "Extra debug information dictionary. This is intended for development only and its shape is not part of the stable template contract."
     docs_note = (
         "The contents of this block are not a stable part of the Datasette "
         "API and may change without warning."
     )
     example = ExtraExample("/fixtures/facetable.json?_extra=debug")
-    examples = {
+    examples: ClassVar[dict[ExtraScope, ExtraExample | list[ExtraExample]]] = {
         ExtraScope.ROW: ExtraExample(
             "/fixtures/simple_primary_key/1.json?_extra=debug"
         ),
@@ -418,7 +508,11 @@ class DebugExtra(Extra):
             "/fixtures/-/query.json?sql=select+1+as+one&_extra=debug"
         ),
     }
-    scopes = {ExtraScope.TABLE, ExtraScope.ROW, ExtraScope.QUERY}
+    scopes: ClassVar[set[ExtraScope]] = {
+        ExtraScope.TABLE,
+        ExtraScope.ROW,
+        ExtraScope.QUERY,
+    }
 
     async def resolve(self, context):
         debug = {
@@ -440,9 +534,9 @@ class DebugExtra(Extra):
 
 
 class RequestExtra(Extra):
-    description = "Full information about the request"
+    description = "Dictionary with request details: ``url``, ``path``, ``full_path``, ``host`` and ``args`` where ``args`` maps query string parameter names to their values."
     example = ExtraExample("/fixtures/facetable.json?_extra=request")
-    examples = {
+    examples: ClassVar[dict[ExtraScope, ExtraExample | list[ExtraExample]]] = {
         ExtraScope.ROW: ExtraExample(
             "/fixtures/simple_primary_key/1.json?_extra=request"
         ),
@@ -450,7 +544,11 @@ class RequestExtra(Extra):
             "/fixtures/-/query.json?sql=select+1+as+one&_extra=request"
         ),
     }
-    scopes = {ExtraScope.TABLE, ExtraScope.ROW, ExtraScope.QUERY}
+    scopes: ClassVar[set[ExtraScope]] = {
+        ExtraScope.TABLE,
+        ExtraScope.ROW,
+        ExtraScope.QUERY,
+    }
 
     async def resolve(self, context):
         return {
@@ -463,7 +561,7 @@ class RequestExtra(Extra):
 
 
 class DisplayColumnsAndRowsProvider(Provider):
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
 
     async def resolve(self, context):
         display_columns, display_rows = await context.display_columns_and_rows(
@@ -484,7 +582,7 @@ class DisplayColumnsAndRowsProvider(Provider):
 
 
 class DisplayColumnsExtra(Extra):
-    description = "Column metadata used by the HTML table display"
+    description = "Column metadata used by the HTML table display. Each item includes ``name``, ``sortable``, ``is_pk``, ``type``, ``notnull``, ``description``, ``column_type`` and ``column_type_config`` keys."
     example = ExtraExample(
         value=[
             {
@@ -507,15 +605,15 @@ class DisplayColumnsExtra(Extra):
         ],
         note="Shape abbreviated from /fixtures/facetable.json?_size=1&_extra=display_columns.",
     )
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
 
     async def resolve(self, context, display_columns_and_rows):
         return display_columns_and_rows["columns"]
 
 
 class DisplayRowsExtra(Extra):
-    description = "Row data formatted for the HTML table display"
-    scopes = {ExtraScope.TABLE}
+    description = "Rows formatted for the HTML table display. Each row is iterable and contains cell dictionaries with ``column``, ``value``, ``raw`` and ``value_type`` keys; table pages may also provide ``pk_path``, ``row_path`` and ``row_label`` attributes on each row object."
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
     # Contains markupsafe/sqlite3.Row values - not JSON serializable
     public = False
 
@@ -546,7 +644,7 @@ class RenderCellExtra(Extra):
             "whose rendered value differs from the default are included."
         ),
     )
-    examples = {
+    examples: ClassVar[dict[ExtraScope, ExtraExample | list[ExtraExample]]] = {
         ExtraScope.ROW: ExtraExample(
             value={
                 "rows": [{"id": 4, "content": "RENDER_CELL_DEMO"}],
@@ -571,7 +669,11 @@ class RenderCellExtra(Extra):
             ),
         ),
     }
-    scopes = {ExtraScope.TABLE, ExtraScope.ROW, ExtraScope.QUERY}
+    scopes: ClassVar[set[ExtraScope]] = {
+        ExtraScope.TABLE,
+        ExtraScope.ROW,
+        ExtraScope.QUERY,
+    }
 
     async def resolve(self, context):
         table_name = context.table_name
@@ -623,9 +725,9 @@ class RenderCellExtra(Extra):
 
 
 class QueryExtra(Extra):
-    description = "Details of the underlying SQL query"
+    description = "Details of the underlying SQL query as a dictionary with ``sql`` and ``params`` keys."
     example = ExtraExample("/fixtures/facetable.json?_size=1&_extra=query")
-    examples = {
+    examples: ClassVar[dict[ExtraScope, ExtraExample | list[ExtraExample]]] = {
         ExtraScope.ROW: ExtraExample(
             "/fixtures/simple_primary_key/1.json?_extra=query"
         ),
@@ -634,7 +736,11 @@ class QueryExtra(Extra):
             ExtraExample("/fixtures/neighborhood_search.json?text=town&_extra=query"),
         ],
     }
-    scopes = {ExtraScope.TABLE, ExtraScope.ROW, ExtraScope.QUERY}
+    scopes: ClassVar[set[ExtraScope]] = {
+        ExtraScope.TABLE,
+        ExtraScope.ROW,
+        ExtraScope.QUERY,
+    }
 
     async def resolve(self, context):
         return {
@@ -644,7 +750,7 @@ class QueryExtra(Extra):
 
 
 class ColumnTypesExtra(Extra):
-    description = "Column type assignments for this table"
+    description = 'Column type assignments for this table. A dictionary mapping column names to ``{"type": type_name, "config": config}`` dictionaries.'
     docs_note = (
         "An empty object if no column types have been assigned. Column types "
         "can be assigned in :ref:`configuration "
@@ -658,7 +764,7 @@ class ColumnTypesExtra(Extra):
             "been assigned the ``json`` column type."
         ),
     )
-    examples = {
+    examples: ClassVar[dict[ExtraScope, ExtraExample | list[ExtraExample]]] = {
         ExtraScope.ROW: ExtraExample(
             "/fixtures/facetable/1.json?_extra=column_types",
             note=(
@@ -667,7 +773,7 @@ class ColumnTypesExtra(Extra):
             ),
         )
     }
-    scopes = {ExtraScope.TABLE, ExtraScope.ROW}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE, ExtraScope.ROW}
 
     async def resolve(self, context):
         ct_map = await context.datasette.get_column_types(
@@ -683,7 +789,7 @@ class ColumnTypesExtra(Extra):
 
 
 class SetColumnTypeUiExtra(Extra):
-    description = "Information needed to build an interface for assigning column types"
+    description = "Information needed to build an interface for assigning column types, or ``None`` if unavailable. When present it has ``path`` and ``columns`` keys; ``columns`` maps column names to ``current`` and ``options`` values."
     docs_note = (
         "``null`` unless the current actor is allowed to use the :ref:`set "
         "column type API <TableSetColumnTypeView>` for this table."
@@ -717,7 +823,7 @@ class SetColumnTypeUiExtra(Extra):
             "types that could be assigned to it."
         ),
     )
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
 
     async def resolve(self, context):
         if context.is_view:
@@ -759,15 +865,13 @@ class SetColumnTypeUiExtra(Extra):
                 ],
             }
         return {
-            "path": "{}/-/set-column-type".format(
-                context.datasette.urls.table(context.database_name, context.table_name)
-            ),
+            "path": f"{context.datasette.urls.table(context.database_name, context.table_name)}/-/set-column-type",
             "columns": columns,
         }
 
 
 class MetadataExtra(Extra):
-    description = "Metadata about the table, database or stored query"
+    description = "Metadata dictionary for the table, database or stored query. Table and row metadata include a ``columns`` dictionary mapping column names to descriptions; stored query metadata returns the stored query configuration."
     docs_note = "See :ref:`metadata` for how to attach metadata to tables."
     example = ExtraExample(
         "/fixtures/facetable.json?_extra=metadata",
@@ -779,7 +883,7 @@ class MetadataExtra(Extra):
             "descriptions."
         ),
     )
-    examples = {
+    examples: ClassVar[dict[ExtraScope, ExtraExample | list[ExtraExample]]] = {
         ExtraScope.ROW: ExtraExample(
             "/fixtures/simple_primary_key/1.json?_extra=metadata",
             note=(
@@ -797,7 +901,11 @@ class MetadataExtra(Extra):
             ),
         ),
     }
-    scopes = {ExtraScope.TABLE, ExtraScope.ROW, ExtraScope.QUERY}
+    scopes: ClassVar[set[ExtraScope]] = {
+        ExtraScope.TABLE,
+        ExtraScope.ROW,
+        ExtraScope.QUERY,
+    }
 
     async def resolve(self, context):
         if context.scope == ExtraScope.QUERY:
@@ -826,7 +934,7 @@ class MetadataExtra(Extra):
 class DatabaseExtra(Extra):
     description = "Database name"
     example = ExtraExample("/fixtures/facetable.json?_extra=database")
-    examples = {
+    examples: ClassVar[dict[ExtraScope, ExtraExample | list[ExtraExample]]] = {
         ExtraScope.ROW: ExtraExample(
             "/fixtures/simple_primary_key/1.json?_extra=database"
         ),
@@ -834,7 +942,11 @@ class DatabaseExtra(Extra):
             "/fixtures/-/query.json?sql=select+1+as+one&_extra=database"
         ),
     }
-    scopes = {ExtraScope.TABLE, ExtraScope.ROW, ExtraScope.QUERY}
+    scopes: ClassVar[set[ExtraScope]] = {
+        ExtraScope.TABLE,
+        ExtraScope.ROW,
+        ExtraScope.QUERY,
+    }
 
     async def resolve(self, context):
         return context.database_name
@@ -843,10 +955,10 @@ class DatabaseExtra(Extra):
 class TableExtra(Extra):
     description = "Table name"
     example = ExtraExample("/fixtures/facetable.json?_extra=table")
-    examples = {
+    examples: ClassVar[dict[ExtraScope, ExtraExample | list[ExtraExample]]] = {
         ExtraScope.ROW: ExtraExample("/fixtures/simple_primary_key/1.json?_extra=table")
     }
-    scopes = {ExtraScope.TABLE, ExtraScope.ROW}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE, ExtraScope.ROW}
 
     async def resolve(self, context):
         return context.table_name
@@ -859,7 +971,7 @@ class DatabaseColorExtra(Extra):
         "a hash of the database name and used in the Datasette interface."
     )
     example = ExtraExample("/fixtures/facetable.json?_extra=database_color")
-    examples = {
+    examples: ClassVar[dict[ExtraScope, ExtraExample | list[ExtraExample]]] = {
         ExtraScope.ROW: ExtraExample(
             "/fixtures/simple_primary_key/1.json?_extra=database_color"
         ),
@@ -867,18 +979,22 @@ class DatabaseColorExtra(Extra):
             "/fixtures/-/query.json?sql=select+1+as+one&_extra=database_color"
         ),
     }
-    scopes = {ExtraScope.TABLE, ExtraScope.ROW, ExtraScope.QUERY}
+    scopes: ClassVar[set[ExtraScope]] = {
+        ExtraScope.TABLE,
+        ExtraScope.ROW,
+        ExtraScope.QUERY,
+    }
 
     async def resolve(self, context):
         return context.db.color
 
 
 class FormHiddenArgsExtra(Extra):
-    description = "Hidden form arguments used by the HTML table interface"
+    description = "List of ``(name, value)`` pairs for hidden form fields used by the HTML table interface to preserve current query string options."
     example = ExtraExample(
         "/fixtures/facetable.json?_facet=state&_size=1&_extra=form_hidden_args"
     )
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
 
     async def resolve(self, context):
         form_hidden_args = []
@@ -894,8 +1010,8 @@ class FormHiddenArgsExtra(Extra):
 
 
 class FiltersExtra(Extra):
-    description = "Filters object used by the HTML table interface"
-    scopes = {ExtraScope.TABLE}
+    description = "``Filters`` object used by the HTML table interface. Useful methods include ``filters.human_description_en()``; this is not JSON serializable."
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
     # Returns a Filters instance for the HTML templates - not JSON serializable
     public = False
 
@@ -904,14 +1020,14 @@ class FiltersExtra(Extra):
 
 
 class CustomTableTemplatesExtra(Extra):
-    description = "Custom template names considered for this table"
+    description = "List of custom template names considered for rendering table rows, in lookup order."
     docs_note = (
         "The first template in this list that exists will be used to render "
         "the table on the HTML version of this page. See "
         ":ref:`customization_custom_templates`."
     )
     example = ExtraExample("/fixtures/facetable.json?_extra=custom_table_templates")
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
 
     async def resolve(self, context):
         return [
@@ -922,7 +1038,7 @@ class CustomTableTemplatesExtra(Extra):
 
 
 class SortedFacetResultsExtra(Extra):
-    description = "Facet results sorted for display"
+    description = "Facet result dictionaries sorted for display. Each item has the same shape as an entry from ``facet_results['results']``."
     docs_note = (
         "The same data as ``facet_results``, as a list in the order used by "
         "the HTML interface: facets from :ref:`facet configuration "
@@ -932,7 +1048,7 @@ class SortedFacetResultsExtra(Extra):
     example = ExtraExample(
         "/fixtures/facetable.json?_facet=state&_extra=sorted_facet_results"
     )
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
 
     async def resolve(self, context, facet_results):
         facet_configs = context.table_metadata.get("facets", [])
@@ -942,7 +1058,7 @@ class SortedFacetResultsExtra(Extra):
                 if isinstance(fc, str):
                     metadata_facet_names.append(fc)
                 elif isinstance(fc, dict):
-                    metadata_facet_names.append(list(fc.values())[0])
+                    metadata_facet_names.append(next(iter(fc.values())))
             metadata_order = {name: i for i, name in enumerate(metadata_facet_names)}
             metadata_facets = []
             request_facets = []
@@ -968,7 +1084,7 @@ class SortedFacetResultsExtra(Extra):
 class TableDefinitionExtra(Extra):
     description = "SQL definition for this table"
     example = ExtraExample("/fixtures/facetable.json?_extra=table_definition")
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
 
     async def resolve(self, context):
         return await context.db.get_table_definition(context.table_name)
@@ -977,14 +1093,14 @@ class TableDefinitionExtra(Extra):
 class ViewDefinitionExtra(Extra):
     description = "SQL definition for this view"
     example = ExtraExample("/fixtures/simple_view.json?_extra=view_definition")
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
 
     async def resolve(self, context):
         return await context.db.get_view_definition(context.table_name)
 
 
 class RenderersExtra(Extra):
-    description = "Alternative output renderers available for this table"
+    description = "Dictionary mapping output format names such as ``json`` or plugin-provided renderer names to URLs for this data in that format."
     example = ExtraExample(
         "/fixtures/facetable.json?_extra=renderers",
         note=(
@@ -994,7 +1110,7 @@ class RenderersExtra(Extra):
             "<plugin_register_output_renderer>`."
         ),
     )
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
 
     async def resolve(self, context, expandable_columns, query):
         renderers = {}
@@ -1036,7 +1152,7 @@ class PrivateExtra(Extra):
         "anonymous user could not. See :ref:`authentication_permissions`."
     )
     example = ExtraExample("/fixtures/facetable.json?_extra=private")
-    examples = {
+    examples: ClassVar[dict[ExtraScope, ExtraExample | list[ExtraExample]]] = {
         ExtraScope.ROW: ExtraExample(
             "/fixtures/simple_primary_key/1.json?_extra=private"
         ),
@@ -1044,14 +1160,18 @@ class PrivateExtra(Extra):
             "/fixtures/-/query.json?sql=select+1+as+one&_extra=private"
         ),
     }
-    scopes = {ExtraScope.TABLE, ExtraScope.ROW, ExtraScope.QUERY}
+    scopes: ClassVar[set[ExtraScope]] = {
+        ExtraScope.TABLE,
+        ExtraScope.ROW,
+        ExtraScope.QUERY,
+    }
 
     async def resolve(self, context):
         return context.private
 
 
 class ExpandableColumnsExtra(Extra):
-    description = "Foreign key columns that can be expanded with labels"
+    description = "List of foreign key columns that can be expanded with labels. Each item is a ``(foreign_key, label_column)`` pair where ``foreign_key`` is the SQLite foreign key dictionary and ``label_column`` is the label column in the referenced table, or ``None``."
     docs_note = "See :ref:`expand_foreign_keys` for how to expand these labels."
     example = ExtraExample(
         "/fixtures/facetable.json?_extra=expandable_columns",
@@ -1061,7 +1181,7 @@ class ExpandableColumnsExtra(Extra):
             "that would be used as the label for each expanded value."
         ),
     )
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
 
     async def resolve(self, context):
         expandables = []
@@ -1073,7 +1193,7 @@ class ExpandableColumnsExtra(Extra):
 
 
 class ForeignKeyTablesExtra(Extra):
-    description = "Tables that link to this row using foreign keys"
+    description = "List of tables that link to this row using foreign keys. Each item includes the foreign key fields plus ``count`` for matching rows and ``link`` for the filtered table URL."
     example = ExtraExample(
         "/fixtures/simple_primary_key/1.json?_extra=foreign_key_tables",
         note=(
@@ -1081,7 +1201,7 @@ class ForeignKeyTablesExtra(Extra):
             "reference this row, and ``link`` is a URL to browse those rows."
         ),
     )
-    scopes = {ExtraScope.ROW}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.ROW}
     expensive = True
 
     async def resolve(self, context):
@@ -1091,7 +1211,7 @@ class ForeignKeyTablesExtra(Extra):
 
 
 class ExtrasExtra(Extra):
-    description = "List of ?_extra= blocks that can be used on this page"
+    description = "List of ``?_extra=`` blocks that can be used on this page. Each item has ``name``, ``description``, ``toggle_url`` and ``selected`` keys."
     example = ExtraExample(
         value=[
             {
@@ -1115,7 +1235,11 @@ class ExtrasExtra(Extra):
             "the current request."
         ),
     )
-    scopes = {ExtraScope.TABLE, ExtraScope.ROW, ExtraScope.QUERY}
+    scopes: ClassVar[set[ExtraScope]] = {
+        ExtraScope.TABLE,
+        ExtraScope.ROW,
+        ExtraScope.QUERY,
+    }
 
     async def resolve(self, context):
         all_extras = [
@@ -1148,7 +1272,6 @@ TABLE_EXTRA_BUNDLES = {
         "count",
         "count_sql",
         "human_description_en",
-        "next_url",
         "metadata",
         "query",
         "columns",
@@ -1177,16 +1300,17 @@ TABLE_EXTRA_BUNDLES = {
 
 TABLE_EXTRA_CLASSES = [
     CountExtra,
+    CountTruncatedExtra,
     CountSqlExtra,
     FacetResultsExtra,
     FacetsTimedOutExtra,
     SuggestedFacetsExtra,
     FacetInstancesProvider,
     HumanDescriptionEnExtra,
-    NextUrlExtra,
     ColumnsExtra,
     AllColumnsExtra,
     PrimaryKeysExtra,
+    ColumnDetailsExtra,
     DisplayColumnsAndRowsProvider,
     DisplayColumnsExtra,
     DisplayRowsExtra,
diff --git a/datasette/write_sql.py b/datasette/write_sql.py
index cdc0c6d3..ca144a72 100644
--- a/datasette/write_sql.py
+++ b/datasette/write_sql.py
@@ -138,6 +138,33 @@ def decision_for_write_sql_operation(
                 ),
             )
         )
+    if operation.operation == "create" and operation.target_type == "view":
+        if operation.database is None:
+            return UnsupportedWriteSqlOperation(unsupported_message)
+        return RequireWriteSqlPermissions(
+            (
+                PermissionRequirement(
+                    action="create-view",
+                    resource=DatabaseResource(database=operation.database),
+                ),
+            )
+        )
+    if (
+        operation.operation == "drop"
+        and operation.target_type == "view"
+        and operation.database is not None
+        and operation.table is not None
+    ):
+        return RequireWriteSqlPermissions(
+            (
+                PermissionRequirement(
+                    action="drop-view",
+                    resource=TableResource(
+                        database=operation.database, table=operation.table
+                    ),
+                ),
+            )
+        )
     if (
         operation.operation == "alter"
         and operation.target_type == "table"
diff --git a/docs/Makefile b/docs/Makefile
index 2b092179..a0d17c81 100644
--- a/docs/Makefile
+++ b/docs/Makefile
@@ -20,4 +20,4 @@ help:
 	@$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
 
 livehtml:
-	sphinx-autobuild -b html "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(0)
+	sphinx-autobuild -b html --watch ../datasette "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(0)
diff --git a/docs/authentication.rst b/docs/authentication.rst
index 5d831da0..d720c4db 100644
--- a/docs/authentication.rst
+++ b/docs/authentication.rst
@@ -21,6 +21,23 @@ The actor dictionary can be any shape - the design of that data structure is lef
 
 Plugins can use the :ref:`plugin_hook_actor_from_request` hook to implement custom logic for authenticating an actor based on the incoming HTTP request.
 
+.. _authentication_actor_display:
+
+How actors are displayed
+------------------------
+
+In a number of places - such as the navigation menu and the ``/-/logout`` page - Datasette needs to display a short label representing the currently authenticated actor.
+
+To decide what to show, Datasette looks through the following keys in the actor dictionary and uses the value of the first one that is present and not empty:
+
+* ``display``
+* ``name``
+* ``username``
+* ``login``
+* ``id``
+
+If none of those keys have a value the actor dictionary is displayed as a string instead.
+
 .. _authentication_root:
 
 Using the "root" actor
@@ -28,12 +45,12 @@ Using the "root" actor
 
 Datasette currently leaves almost all forms of authentication to plugins - `datasette-auth-github <https://github.com/simonw/datasette-auth-github>`__ for example.
 
-The one exception is the "root" account, which you can sign into while using Datasette on your local machine. The root user has **all permissions** - they can perform any action regardless of other permission rules.
+The one exception is the "root" account, which you can sign into while using Datasette on your local machine. The root user starts with **all permissions**: Datasette contributes a global allow rule for every action. More specific deny rules can still override that global rule.
 
 The ``--root`` flag is designed for local development and testing. When you start Datasette with ``--root``, the root user automatically receives every permission, including:
 
 * All view permissions (``view-instance``, ``view-database``, ``view-table``, etc.)
-* All write permissions (``insert-row``, ``update-row``, ``delete-row``, ``create-table``, ``alter-table``, ``set-column-type``, ``drop-table``)
+* All write permissions (``insert-row``, ``update-row``, ``delete-row``, ``create-table``, ``create-view``, ``alter-table``, ``set-column-type``, ``drop-table``, ``drop-view``)
 * Debug permissions (``permissions-debug``, ``debug-menu``)
 * Any custom permissions defined by plugins
 
@@ -67,12 +84,12 @@ Click on that link and then visit ``http://127.0.0.1:8001/-/actor`` to confirm t
 Permissions
 ===========
 
-Datasette's permissions system is built around SQL queries. Datasette and its plugins construct SQL queries to resolve the list of resources that an actor cas access.
-
 The key question the permissions system answers is this:
 
     Is this **actor** allowed to perform this **action**, optionally against this particular **resource**?
 
+Every permission decision can be understood in terms of those three values. Datasette implements the decisions using SQL, but you do not need to understand the generated SQL to configure or debug permissions.
+
 **Actors** are :ref:`described above <authentication_actor>`.
 
 An **action** is a string describing the action the actor would like to perform. A full list is :ref:`provided below <actions>` - examples include ``view-table`` and ``execute-sql``.
@@ -121,7 +138,51 @@ This configuration will deny access to everyone except the user with ``id`` of `
 How permissions are resolved
 ----------------------------
 
-Datasette performs permission checks using the internal :ref:`datasette_allowed`, method which accepts keyword arguments for ``action``, ``resource`` and an optional ``actor``.
+Permission rules describe an effect (``allow`` or ``deny``) at one of three levels:
+
+``resource``
+    A specific child resource, such as the ``analytics/sales`` table.
+
+``parent``
+    A parent resource, such as the ``analytics`` database. A parent rule also applies to its child resources.
+
+``global``
+    Every resource for that action.
+
+Datasette resolves matching rules from most specific to least specific:
+
+#. Resource rules take precedence over parent and global rules.
+#. Parent rules take precedence over global rules.
+#. If both allow and deny rules match at the same level, deny takes precedence.
+#. If no rule matches, access is denied.
+
+This means a resource-level allow can provide an exception to a parent-level deny. It also means that two plugins which disagree at the same level resolve to deny.
+
+.. list-table:: Permission rule examples
+   :header-rows: 1
+
+   * - Matching rules
+     - Result
+     - Explanation
+   * - Global allow
+     - Allow
+     - The global rule is the most specific matching rule.
+   * - Global allow, parent deny
+     - Deny
+     - The parent rule is more specific.
+   * - Parent deny, resource allow
+     - Allow
+     - The resource rule is more specific.
+   * - Resource allow and resource deny
+     - Deny
+     - Deny takes precedence at the same level.
+   * - No matching rules
+     - Deny
+     - Permissions default to deny when no rule applies.
+
+The built-in public defaults are global allow rules for actions such as ``view-instance``, ``view-database`` and ``view-table``. They follow the same precedence rules as configuration and plugin rules. The ``--default-deny`` option prevents Datasette from contributing those default allow rules.
+
+Datasette performs checks using :ref:`datasette_allowed`, which accepts keyword arguments for ``action``, ``resource`` and an optional ``actor``.
 
 ``resource`` should be an instance of the appropriate ``Resource`` subclass from :mod:`datasette.resources`—for example ``InstanceResource()``, ``DatabaseResource(database="...``)`` or ``TableResource(database="...", table="...")``. This defaults to ``InstanceResource()`` if not specified.
 
@@ -132,12 +193,12 @@ resources were allowed or denied. The combined sources are:
 
 * ``allow`` blocks configured in :ref:`datasette.yaml <authentication_permissions_config>`.
 * :ref:`Actor restrictions <authentication_cli_create_token_restrict>` encoded into the actor dictionary or API token.
-* The "root" user shortcut when ``--root`` (or :attr:`Datasette.root_enabled <datasette.app.Datasette.root_enabled>`) is active, replying ``True`` to all permission chucks unless configuration rules deny them at a more specific level.
+* The "root" user rule when ``--root`` (or :attr:`Datasette.root_enabled <datasette.app.Datasette.root_enabled>`) is active. This is a global allow rule, so a more specific configuration deny can override it.
 * Any additional SQL provided by plugins implementing :ref:`plugin_hook_permission_resources_sql`.
 
-Datasette evaluates the SQL to determine if the requested ``resource`` is
-included. Explicit deny rules returned by configuration or plugins will block
-access even if other rules allowed it.
+Actor restrictions are applied after the allow/deny rules. They act as an additional allowlist: a restriction can remove access but cannot grant access that the actor did not already have. See :ref:`authentication_cli_create_token_restrict`.
+
+Some actions have dependencies on other actions. These are evaluated as an ``AND`` condition. For example, ``execute-sql`` also requires ``view-database``: both decisions must be allowed for the final result to be allowed.
 
 .. _authentication_permissions_allow:
 
@@ -974,7 +1035,9 @@ The ``/-/create-token`` page cannot be accessed by actors that are authenticated
 
 Datasette plugins that implement their own form of API token authentication should follow this convention.
 
-You can disable the signed token feature entirely using the :ref:`allow_signed_tokens <setting_allow_signed_tokens>` setting.
+If a request presents a token that a token handler recognizes but rejects - an invalid signature, a malformed payload or an expired token - Datasette responds with a ``401`` status, the :ref:`standard JSON error format <json_api_errors>` and a ``WWW-Authenticate: Bearer error="invalid_token"`` header. This means API clients can distinguish "your token needs to be renewed" (``401``) from "your token does not grant this permission" (``403``). A ``Bearer`` token that no registered handler recognizes at all is ignored, since it may be intended for an authentication plugin.
+
+You can disable the signed token feature entirely using the :ref:`allow_signed_tokens <setting_allow_signed_tokens>` setting. Requests presenting a ``dstok_`` token while the feature is disabled receive a ``401``.
 
 .. _authentication_cli_create_token:
 
@@ -1126,11 +1189,23 @@ The debug tool at ``/-/permissions`` is available to any actor with the ``permis
 
     datasette -s permissions.permissions-debug true data.db
 
-The page shows the permission checks that have been carried out by the Datasette instance.
+The permission debug tools answer four different questions:
 
-It also provides an interface for running hypothetical permission checks against a hypothetical actor. This is a useful way of confirming that your configured permissions work in the way you expect.
+Why was this decision allowed or denied?
+    Use :ref:`PermissionCheckView`. It shows every matching rule, identifies the winning specificity level, applies actor restrictions and evaluates any required actions.
 
-This is designed to help administrators and plugin authors understand exactly how permission checks are being carried out, in order to effectively configure Datasette's permission system.
+Which resources can the current actor access?
+    Use :ref:`AllowedResourcesView` to view an access map for a selected action.
+
+Which raw rules did Datasette and its plugins contribute?
+    Use :ref:`PermissionRulesView` to inspect the rules before they are resolved into decisions.
+
+Which checks has this Datasette instance performed recently?
+    Use ``/-/permissions`` to view recent permission activity.
+
+These tools are designed to help administrators and plugin authors understand and confirm the effective permissions configuration.
+
+These debug endpoints are exempt from the :ref:`JSON API stability promise <json_api_stability>` - their JSON shapes may change in future releases.
 
 .. _AllowedResourcesView:
 
@@ -1141,7 +1216,7 @@ The ``/-/allowed`` endpoint displays resources that the current actor can access
 
 This endpoint provides an interactive HTML form interface. Add ``.json`` to the URL path (e.g. ``/-/allowed.json``) to get the raw JSON response instead.
 
-Pass ``?action=view-table`` (or another action) to select the action. Optional ``parent=`` and ``child=`` query parameters can narrow the results to a specific database/table pair.
+Pass ``?action=view-table`` (or another action) to select the action. Optional ``parent=`` and ``child=`` query parameters can narrow the results to a specific database/table pair. Results are paginated: ``?_size=`` sets the page size (default 50, maximum 200, ``max`` for the maximum) and ``?_page=`` selects a page.
 
 This endpoint is publicly accessible to help users understand their own permissions. The potentially sensitive ``reason`` field is only shown to users with the ``permissions-debug`` permission - it shows the plugins and explanatory reasons that were responsible for each decision.
 
@@ -1154,7 +1229,7 @@ The ``/-/rules`` endpoint displays all permission rules (both allow and deny) fo
 
 This endpoint provides an interactive HTML form interface. Add ``.json`` to the URL path (e.g. ``/-/rules.json?action=view-table``) to get the raw JSON response instead.
 
-Pass ``?action=`` as a query parameter to specify which action to check.
+Pass ``?action=`` as a query parameter to specify which action to check. The ``?_size=`` and ``?_page=`` pagination parameters work the same as on ``/-/allowed``.
 
 This endpoint requires the ``permissions-debug`` permission.
 
@@ -1163,11 +1238,20 @@ This endpoint requires the ``permissions-debug`` permission.
 Permission check view
 ---------------------
 
-The ``/-/check`` endpoint evaluates a single action/resource pair and returns information indicating whether the access was allowed along with diagnostic information.
+The ``/-/check`` endpoint evaluates and explains a single actor, action and resource decision. The explanation includes:
+
+* Every matching allow and deny rule, with its source and reason.
+* The winning resource, parent or global scope.
+* Rules ignored because a more specific rule matched, or because a deny won at the same scope.
+* Actor restriction allowlists that included or excluded the resource.
+* Additional actions required by the requested action.
+* An explicit default-deny explanation when no rule matched.
 
 This endpoint provides an interactive HTML form interface. Add ``.json`` to the URL path (e.g. ``/-/check.json?action=view-instance``) to get the raw JSON response instead.
 
-Pass ``?action=`` to specify the action to check, and optional ``?parent=`` and ``?child=`` parameters to specify the resource.
+Pass ``?action=`` to specify the action to check, and optional ``?parent=`` and ``?child=`` parameters to specify the resource. The interactive form also accepts actor JSON, allowing a hypothetical actor to be tested without signing in as that actor. The JSON endpoint accepts the same value using the ``actor`` query string parameter. Use ``actor=null`` to represent an anonymous actor.
+
+This endpoint requires the ``permissions-debug`` permission. The hypothetical actor is used only for the decision being explained; access to the debug tool is checked against the actor who is actually signed in.
 
 .. _authentication_ds_actor:
 
@@ -1369,6 +1453,16 @@ create-table
 
 Actor is allowed to create a database table.
 
+``resource`` - ``datasette.resources.DatabaseResource(database)``
+    ``database`` is the name of the database (string)
+
+.. _actions_create_view:
+
+create-view
+-----------
+
+Actor is allowed to create a database view.
+
 ``resource`` - ``datasette.resources.DatabaseResource(database)``
     ``database`` is the name of the database (string)
 
@@ -1408,6 +1502,18 @@ Actor is allowed to drop a database table.
 
     ``table`` is the name of the table (string)
 
+.. _actions_drop_view:
+
+drop-view
+---------
+
+Actor is allowed to drop a database view.
+
+``resource`` - ``datasette.resources.TableResource(database, table)``
+    ``database`` is the name of the database (string)
+
+    ``table`` is the name of the view (string)
+
 .. _actions_execute_sql:
 
 execute-sql
diff --git a/docs/binary_data.rst b/docs/binary_data.rst
index 0c890fe5..d41e36be 100644
--- a/docs/binary_data.rst
+++ b/docs/binary_data.rst
@@ -12,7 +12,12 @@ Datasette includes special handling for these binary values. The Datasette inter
    :width: 311px
    :alt: Screenshot showing download links next to binary data in the table view
 
-Binary data is represented in ``.json`` exports using Base64 encoding.
+.. _binary_json_format:
+
+Binary values in JSON
+---------------------
+
+Binary data is represented in ``.json`` exports using Base64 encoding. Datasette uses this representation for every ``BLOB`` value, including binary values that could also be decoded as UTF-8 text.
 
 https://latest.datasette.io/fixtures/binary_data.json?_shape=array
 
@@ -39,6 +44,48 @@ https://latest.datasette.io/fixtures/binary_data.json?_shape=array
         }
     ]
 
+The same format can be used with the :ref:`JSON write API <json_api_write>`.
+If a column value in a ``row``, ``rows`` or ``update`` object is a JSON object with exactly ``"$base64"`` set to ``true`` and an ``"encoded"`` string, Datasette will decode that Base64 string and store the resulting bytes:
+
+.. code-block:: json
+
+    {
+        "data": {
+            "$base64": true,
+            "encoded": "FRwCx60F/g=="
+        }
+    }
+
+This works for inserts, upserts and updates. It also works when creating a table from example ``row`` or ``rows`` data: Datasette decodes the value before inferring the schema, allowing that column to be created as a ``BLOB`` column.
+
+To store a JSON object with that exact shape literally, wrap it in a ``"$raw"`` object:
+
+.. code-block:: json
+
+    {
+        "data": {
+            "$raw": {
+                "$base64": true,
+                "encoded": "FRwCx60F/g=="
+            }
+        }
+    }
+
+``"$raw"`` unwraps exactly one layer. To store a literal ``"$raw"`` object containing a Base64 object, wrap it again:
+
+.. code-block:: json
+
+    {
+        "data": {
+            "$raw": {
+                "$raw": {
+                    "$base64": true,
+                    "encoded": "FRwCx60F/g=="
+                }
+            }
+        }
+    }
+
 .. _binary_linking:
 
 Linking to binary downloads
diff --git a/docs/changelog.rst b/docs/changelog.rst
index 1516604e..670166bb 100644
--- a/docs/changelog.rst
+++ b/docs/changelog.rst
@@ -4,6 +4,96 @@
 Changelog
 =========
 
+.. _v1_0_a37:
+
+1.0a37 (2026-07-14)
+-------------------
+
+Performance improvement for SQL-backed permission checks, plus an improved permission debugging interface.
+
+- SQL used to resolve permission checks now aggregates permission rules before joining them to resources, improving performance on instances with large schemas. (:issue:`2832`)
+- The :ref:`PermissionCheckView` permission debugger now explains why a decision was allowed or denied, including the matching rules. The interactive form can also test a hypothetical actor supplied as JSON, and the :ref:`permissions documentation <authentication_permissions_explained>` now describes resolution rules in more detail. (:issue:`2841`)
+- :ref:`db.execute_write(sql, ..., transaction=True) <database_execute_write>` has a new ``transaction=`` parameter, which can be set to ``False`` for statements such as ``VACUUM`` that cannot run inside a transaction. Write tasks now start their transactions using ``BEGIN IMMEDIATE``, which also ensures that writes are rolled back if the task fails. (:issue:`2831`)
+- Refreshing a database's schema in Datasette's internal catalog is now performed as a single atomic operation. (:issue:`2831`)
+- Fixed schema introspection, table pages, facets and table counts for tables with names containing a ``]`` character. Thanks, `TowyTowy <https://github.com/TowyTowy>`__. (:issue:`2431`, :pr:`2846`)
+- ``/-/plugins.json`` once again returns a top-level JSON array of plugin objects, reverting the object envelope introduced in 1.0a36. This should fix a large number of trivial test failures in existing plugins. (:issue:`2842`, :pr:`2843`)
+
+.. _v1_0_a36:
+
+1.0a36 (2026-07-07)
+-------------------
+
+The signature features of this alpha are new UIs for **inserting multiple rows at once** (from TSV, CSV or JSON) and for **creating a table from rows**, plus a large number of small **JSON API consistency fixes** in preparation for a 1.0 stable release.
+
+- Table pages now offer an "Insert multiple rows" mode in the row insertion dialog. This accepts pasted TSV, CSV or JSON, previews the parsed rows before inserting them, validates unknown columns as data is pasted and displays omitted auto integer primary keys as ``auto`` in the preview. (:pr:`2813`)
+- The bulk insert UI can skip rows with existing primary keys, or update existing rows and insert new rows using the existing ``/<database>/<table>/-/upsert`` API when the actor has both :ref:`insert-row <actions_insert_row>` and :ref:`update-row <actions_update_row>` permissions. (:pr:`2813`)
+- The "Create table" dialog now includes a "Create table from data" mode. Paste TSV, CSV or JSON rows to preview inferred columns and types, choose the table name and primary key, then create the table and insert those rows in one step. (:pr:`2813`)
+- Datasette's JSON APIs now consistently encode every ``BLOB`` value using the documented :ref:`binary value JSON format <binary_json_format>`, even when the bytes could be decoded as UTF-8 text. (:issue:`2806`, :pr:`2822`)
+- The insert and edit row dialogs now provide a dedicated control for ``BLOB`` values. Existing binary values are shown by byte size, image values under 10MB are previewed as thumbnails, and replacements can be attached, dropped or pasted into the control. (:issue:`2806`, :pr:`2822`)
+- The table and row JSON APIs now support ``?_extra=column_details`` for returning SQLite schema details for columns, including declared type, SQLite affinity, primary key, ``NOT NULL``, default and hidden-column metadata.
+- POST bodies that Datasette reads fully into memory - such as JSON submitted to the write API - are now capped by the new :ref:`setting_max_post_body_bytes` setting, defaulting to 2MB. Oversized requests are rejected with an HTTP 413 error as soon as the limit is exceeded, protecting smaller servers from memory exhaustion. File uploads are unaffected - ``request.form()`` streams those to disk and has its own separate limits. (:issue:`2823`)
+- Row pages for tables with compound primary keys now return a ``400`` error instead of a ``500`` error when the URL row identifier does not contain the correct number of primary key values. Thanks, `Zain Dana Harper <https://github.com/HarperZ9>`__. (:issue:`2811`, :pr:`2815`)
+- The :ref:`execute-write-sql <actions_execute_write_sql>` interface now supports ``CREATE VIEW`` and ``DROP VIEW`` statements, gated by the new :ref:`create-view <actions_create_view>` and :ref:`drop-view <actions_drop_view>` permissions. (:issue:`2819`, :pr:`2818`)
+- Saved-query SQL analysis now handles recursive CTEs, fixing a bug where storing a valid read-only recursive query could be disabled by SQLite's internal ``SQLITE_RECURSIVE`` authorizer callback. (:issue:`2809`, :pr:`2812`)
+- ``named_parameters()`` now correctly ignores SQLite comment markers that appear inside string literals, so query forms no longer drop later ``:named`` parameters from SQL such as ``select '--' || :name``. Thanks, `JSap0914 <https://github.com/JSap0914>`__. (:pr:`2783`)
+- Datasette's internal database schema is now managed using `sqlite-utils migrations <https://sqlite-utils.datasette.io/en/stable/python-api.html#migrations>`__, using the new dependency on ``sqlite-utils>=4.0``. (:issue:`2827`)
+- ``datasette.utils.CustomJSONEncoder`` is now documented as a public API for plugins that need to serialize Datasette values to JSON. Thanks, `Chris Amico <https://github.com/eyeseast>`__. (:issue:`1983`, :pr:`1996`)
+
+This release also includes the results of a `detailed consistency review <https://github.com/simonw/datasette/pull/2824>`__ of Datasette's JSON API in preparation for the 1.0 stable release. Several of these changes are backwards-incompatible with previous 1.0 alphas. The new :ref:`API stability documentation <json_api_stability>` describes exactly which parts of the JSON API are covered by the 1.0 stability promise.
+
+JSON API: breaking changes
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+- JSON error responses now use a single canonical format across every endpoint: ``{"ok": false, "error": "...", "errors": [...], "status": 400}``. The ``error`` key joins all error messages together, ``errors`` is the full list of messages and ``status`` always matches the HTTP status code. The legacy ``title`` key is no longer included in JSON errors (it remains available to the HTML error template), and endpoints that previously returned bare ``{"error": ...}`` objects have been updated. See :ref:`json_api_errors`.
+- Every JSON object success response now includes ``"ok": true``, including introspection endpoints such as ``/-/versions`` and ``/-/settings``.
+- ``/-/plugins.json``, ``/-/databases.json`` and ``/-/actions.json`` now return objects - ``{"ok": true, "plugins": [...]}`` and equivalents - instead of top-level JSON arrays, so these responses can gain additional keys in the future without a breaking change. The ``datasette plugins`` CLI command still outputs a plain array.
+- ``/-/databases`` now only lists databases the current actor is allowed to view. It previously listed every attached database, including their filesystem paths, to any actor with ``view-instance``.
+- Requests with an invalid or expired ``Authorization: Bearer`` token now receive a ``401`` status with the standard error body and a ``WWW-Authenticate: Bearer error="invalid_token"`` header, instead of being silently treated as unauthenticated. Bearer tokens that no registered token handler recognizes are still ignored, so authentication plugins with their own token formats keep working. Plugin :ref:`token handlers <plugin_hook_register_token_handler>` can raise the new ``datasette.TokenInvalid`` exception to trigger the same behavior.
+- Permission errors for JSON requests now return the standard JSON error format with a ``403`` status. The default forbidden handling previously rendered an HTML error page even for ``.json`` requests.
+- ``POST`` to a write canned query now returns a ``400`` error when the SQL fails to execute, instead of a ``200`` status with ``"ok": false`` in the body. The error response includes the standard error keys plus a ``"redirect"`` key.
+- The :ref:`row update API <RowUpdateView>` with ``"return": true`` now responds with a ``"rows"`` list, matching insert and upsert, instead of a singular ``"row"`` object.
+- Row delete write failures - such as a constraint violation raised by a trigger - now return ``400`` instead of ``500``, matching the other write endpoints.
+- ``/<database>/-/query.json`` with a missing or blank ``?sql=`` parameter now returns a ``400`` error, as the CSV format already did, instead of a ``200`` with empty rows.
+- Unknown ``?_extra=`` names now return a ``400`` error for JSON and other data formats, instead of being silently ignored. HTML pages continue to ignore unknown names.
+- Table JSON responses now include ``next_url`` alongside ``next`` by default - both are ``null`` on the final page. The now-redundant ``?_extra=next_url`` parameter has been removed.
+- The stored query list JSON no longer includes ``has_more`` - ``"next": null`` is the end-of-results signal across the whole API. This change also uncovered and fixed a bug where the query list ``next_url`` pointed at the HTML page and was a relative path; it is now an absolute URL that preserves the requested format.
+- Stored query JSON objects no longer duplicate the list of parameter names as both ``params`` and ``parameters`` - only ``parameters`` remains. The query create and update APIs no longer accept ``params`` as an input alias either; ``params`` is still the documented key for :ref:`queries defined in configuration <queries_named_parameters>`.
+- Page size parameters are now consistent across the API: the stored query lists accept ``?_size=max`` and return a ``400`` error for values over the maximum instead of silently clamping them, and the ``/-/allowed`` and ``/-/rules`` permission debug endpoints renamed their ``page`` and ``page_size`` parameters to ``_page`` and ``_size``, matching the underscore grammar used by every other Datasette system parameter.
+- ``/-/threads`` now requires the ``permissions-debug`` permission, since it exposes runtime internals such as file paths. It previously only required ``view-instance``.
+- Trusted stored queries - those defined in configuration - can no longer be deleted through the JSON API or web interface, matching the existing restriction on editing them.
+- The ``/<database>/-/schema`` endpoints now check the ``view-database`` permission before checking whether the database exists, so unauthorized actors can no longer probe for the existence of databases.
+- SQL time limit errors in JSON responses are now a plain text message. The error string previously embedded an HTML fragment.
+- The undocumented homepage JSON at ``/.json`` now returns ``databases`` as a list of objects rather than an object keyed by database name, matching every other collection in the API.
+- The legacy ``.jsono`` format extension, long since superseded by ``?_shape=``, has been removed.
+
+JSON API: other improvements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+- The :ref:`write API <json_api_write>` endpoints now parse the request body as JSON regardless of the ``Content-Type`` header, so ``curl -d`` invocations work without remembering to set it. Invalid JSON is a ``400`` error. Cross-site request forgery remains prevented by Datasette's ``Origin`` and ``Sec-Fetch-Site`` checks. This also fixes a ``500`` error from the insert API when the ``Content-Type`` header was missing entirely.
+- New ``Response.error(messages, status=400)`` helper for plugins that need to return a JSON error in Datasette's standard format. See :ref:`internals_response`.
+- New ``count_truncated`` extra for table JSON, included automatically whenever ``count`` is requested. ``true`` means the count reached Datasette's counting limit and the real number of rows may be higher. See :ref:`json_api_extra`.
+- JSON endpoints that are not part of the documented stable API now declare themselves with an ``"unstable"`` key in their responses.
+- New documentation covering the grammar for :ref:`boolean query string arguments <json_api_table_arguments>`, the reason :ref:`upsert <TableUpsertView>` returns ``200`` where insert returns ``201``, and advice for plugin authors on :ref:`naming secret configuration keys <plugins_configuration_secret>` so that ``/-/config`` redacts them automatically.
+
+.. _v1_0_a35:
+
+1.0a35 (2026-06-23)
+-------------------
+
+This release adds UI for **creating tables** and **altering tables**, to complement the insert and update row interfaces added in :ref:`v1_0_a34`.
+
+- New "Create table" interface in the database actions menu, backed by the ``/<database>/-/create`` :ref:`JSON API <TableCreateView>`. It can define columns, primary keys, custom column types, ``NOT NULL`` constraints, literal defaults, expression defaults and single-column foreign keys. (:issue:`2787`)
+- New "Alter table" table action and ``/<database>/<table>/-/alter`` :ref:`JSON API <TableAlterView>` for changing existing tables: add, rename, reorder and drop columns; change column types, defaults, ``NOT NULL`` constraints, primary keys and foreign keys; and rename the table. The alter table dialog also includes a "Drop table" button. (:issue:`2788`)
+- New ``/<database>/-/foreign-key-targets`` and ``/<database>/<table>/-/foreign-key-suggestions`` JSON APIs for discovering valid single-column foreign key targets and suggested relationships.
+- New :ref:`template_context` documentation listing the variables available to custom templates for Datasette's core pages. Variables documented there are treated as a stable API for custom templates until Datasette 2.0. The documentation is generated from dataclass definitions next to the view code, with tests that compare the documented fields against the actual contexts rendered by the database, table, query and row pages. (:issue:`1510`, :issue:`2127`, :issue:`1477`, :pr:`2803`)
+- The "Write to this database" page now includes a Create table starter template, alongside the existing Insert, Update and Delete templates. (:pr:`2794`)
+- New ``static()`` template function and ``datasette.static()`` method for generating cache-busting static asset URLs based on the file contents. Static assets served with a matching ``?_hash=`` parameter now receive far-future immutable cache headers. This works for Datasette's bundled static assets, plugin static assets and directories mounted using ``--static``. See :ref:`customization_static_files`.
+- Database and table pages now use the ``count_truncated`` template context value to display capped row counts as ``>N rows``.
+- Significant visual improvements to the table filter form UI, plus working add/remove filter buttons. (:issue:`2798`)
+- Improved edit row icon on table pages. (:issue:`2796`)
+- Documentation covers how actors are displayed. Thanks, `Sebastian Cao <https://github.com/cycsmail>`__. (:issue:`2002`)
+- Fix for bug where appending ``?_col=pk`` resulted in duplicate primary key columns in the response. Thanks, `Ritesh Kewlani <https://github.com/riteshkew>`__. (:issue:`1975`)
+
 .. _v1_0_a34:
 
 1.0a34 (2026-06-16)
diff --git a/docs/cli-reference.rst b/docs/cli-reference.rst
index 7ca88c4e..2302f742 100644
--- a/docs/cli-reference.rst
+++ b/docs/cli-reference.rst
@@ -244,6 +244,9 @@ These can be passed to ``datasette serve`` using ``datasette serve --setting nam
                                    custom query (default=1000)
       max_insert_rows              Maximum rows that can be inserted at a time using
                                    the bulk insert API (default=100)
+      max_post_body_bytes          Maximum size in bytes for a POST body read into
+                                   memory, e.g. JSON API requests - set 0 to disable
+                                   this limit (default=2097152)
       num_sql_threads              Number of threads in the thread pool for
                                    executing SQLite queries (default=3)
       sql_time_limit_ms            Time limit for a SQL query in milliseconds
diff --git a/docs/conf.py b/docs/conf.py
index 5dd06b57..2a5c1439 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 #
 # Datasette documentation build configuration file, created by
 # sphinx-quickstart on Thu Nov 16 06:50:13 2017.
diff --git a/docs/contributing.rst b/docs/contributing.rst
index 3b45834c..692f94c8 100644
--- a/docs/contributing.rst
+++ b/docs/contributing.rst
@@ -157,6 +157,9 @@ If you want to change Datasette's Python code you can use the ``--reload`` optio
 
     uv run datasette --reload fixtures.db
 
+This also enables development mode for static asset cache busting, described in
+:ref:`customization_static_files`.
+
 You can also use the ``fixtures.py`` script to recreate the testing version of ``metadata.json`` used by the unit tests. To do that::
 
     uv run python tests/fixtures.py fixtures.db fixtures-metadata.json
@@ -309,6 +312,19 @@ To update these pages, run the following command::
 
     uv run cog -r docs/*.rst
 
+.. _contributing_template_contexts:
+
+Documented template contexts
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Datasette's documented template contexts are part of the public API for custom templates. They are defined as dataclasses next to the view code that renders them, for example ``DatabaseContext`` and ``QueryContext`` in ``datasette/views/database.py``.
+
+Every documented context class inherits from ``datasette.views.Context``. Fields that are added directly by view code should be declared as dataclass fields with ``help`` metadata, which is used to generate :ref:`template_context`. Fields resolved through the page extras system should use ``from_extra()`` so their documentation comes from the matching ``Extra`` class.
+
+Use ``documented_template`` on each context class to record the canonical template named in the generated documentation. This should be a string such as ``"database.html"``. Runtime template selection still happens in the view code, since most pages consider more specific template names before falling back to the canonical one.
+
+When a context field contains repeated structured data, prefer a small nested dataclass over an anonymous dictionary. For example, a field containing table summaries should be annotated as ``list[DatabaseTable]`` where ``DatabaseTable`` is a dataclass describing the keys and value types. This keeps the Python contract and generated documentation clear. JSON responses and ``?_context=1`` debug output will convert nested dataclasses back to JSON objects at the response boundary.
+
 .. _contributing_continuous_deployment:
 
 Continuously deployed demo instances
diff --git a/docs/custom_templates.rst b/docs/custom_templates.rst
index 8851a841..50c23b3e 100644
--- a/docs/custom_templates.rst
+++ b/docs/custom_templates.rst
@@ -94,11 +94,55 @@ The ``core`` class is particularly useful - you can apply this directly to a ``<
 
 .. _customization_static_files:
 
-Serving static files
-~~~~~~~~~~~~~~~~~~~~
+Linking to static assets
+~~~~~~~~~~~~~~~~~~~~~~~~
 
-Datasette can serve static files for you, using the ``--static`` option.
-Consider the following directory structure::
+Use the ``static()`` template function to create cache-busting URLs to static
+assets from your custom templates. It returns a URL with a ``?_hash=`` parameter
+based on the file contents and takes the ``base_url`` setting into account.
+
+When the hash in the URL matches the current file contents, Datasette will serve
+the static asset with a far-future immutable ``Cache-Control`` header.
+
+When Datasette is run using ``--reload``, the file contents are hashed every time
+the template is rendered, so edits to static files will update their URLs
+without restarting Datasette. Without ``--reload``, the hash is cached for the
+lifetime of the Datasette process.
+
+For Datasette's bundled static assets, pass the path to the asset:
+
+.. code-block:: html+jinja
+
+    <link rel="stylesheet" href="{{ static('app.css') }}">
+
+For plugin static assets, pass the plugin name using ``plugin=`` and a path
+relative to the plugin's ``static/`` directory:
+
+.. code-block:: html+jinja
+
+    <script src="{{ static('plugin.js', plugin='datasette_plugin_name') }}" defer></script>
+
+For files served from a directory mounted using ``--static assets:static-files/``,
+pass the mount point name using ``mount=`` and a path relative to that mounted
+directory:
+
+.. code-block:: html+jinja
+
+    <link rel="stylesheet" href="{{ static('styles.css', mount='assets') }}">
+    <script src="{{ static('app.js', mount='assets') }}" defer></script>
+
+You can also use ``urls.path()`` if you want to link to a mounted file without
+adding a content hash:
+
+.. code-block:: html+jinja
+
+    <link rel="stylesheet" href="{{ urls.path('/assets/styles.css') }}">
+
+Serving files from a directory
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Datasette can serve static files from a directory for you, using the ``--static``
+option. Consider the following directory structure::
 
     metadata.json
     static-files/styles.css
@@ -177,6 +221,11 @@ this::
 Datasette will now first look for templates in that directory, and fall back on
 the defaults if no matches are found.
 
+The variables made available to each template are documented on the
+:ref:`template_context` page. Variables documented there are a stable API:
+custom templates that use them will keep working in future Datasette
+releases, up until the next major version.
+
 It is also possible to over-ride templates on a per-database, per-row or per-
 table basis.
 
diff --git a/docs/index.rst b/docs/index.rst
index c76969bc..d494fd17 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -58,6 +58,7 @@ Contents
    settings
    introspection
    custom_templates
+   template_context
    plugins
    writing_plugins
    javascript_plugins
diff --git a/docs/installation.rst b/docs/installation.rst
index 33d3d6a1..ceec7f23 100644
--- a/docs/installation.rst
+++ b/docs/installation.rst
@@ -17,13 +17,6 @@ If you want to start making contributions to the Datasette project by installing
 Basic installation
 ==================
 
-.. _installation_datasette_desktop:
-
-Datasette Desktop for Mac
--------------------------
-
-`Datasette Desktop <https://datasette.io/desktop>`__ is a packaged Mac application which bundles Datasette together with Python and allows you to install and run Datasette directly on your laptop. This is the best option for local installation if you are not comfortable using the command line.
-
 .. _installation_homebrew:
 
 Using Homebrew
diff --git a/docs/internals.rst b/docs/internals.rst
index 06027f42..d2bd46ef 100644
--- a/docs/internals.rst
+++ b/docs/internals.rst
@@ -52,6 +52,9 @@ The request object is passed to various plugin hooks. It represents an incoming
 ``.actor`` - dictionary (str -> Any) or None
     The currently authenticated actor (see :ref:`actors <authentication_actor>`), or ``None`` if the request is unauthenticated.
 
+``.max_post_body_bytes`` - integer
+    The maximum number of bytes ``await request.post_body()`` will read into memory, or ``0`` for no limit. Set from the :ref:`setting_max_post_body_bytes` setting (default 2MB) for requests created by Datasette. Can be passed to the ``Request`` constructor as a keyword argument.
+
 The object also has the following awaitable methods:
 
 ``await request.form(files=False, ...)`` - FormData
@@ -109,9 +112,11 @@ The object also has the following awaitable methods:
 ``await request.json()`` - Any
     Returns the parsed JSON body of a request submitted by ``POST``.
 
-``await request.post_body()`` - bytes
+``await request.post_body(max_bytes=None)`` - bytes
     Returns the un-parsed body of a request submitted by ``POST`` - useful for things like incoming JSON data.
 
+    The body is read fully into memory, capped at ``request.max_post_body_bytes`` - which Datasette sets from the :ref:`setting_max_post_body_bytes` setting (default 2MB). Bodies that exceed the limit raise a ``datasette.PayloadTooLarge`` exception, which Datasette turns into an HTTP 413 error response. Pass ``max_bytes=`` to override the limit for a specific call, or ``max_bytes=0`` to disable it. ``request.post_vars()`` and ``request.json()`` read the body through this method, so the same limit applies to them.
+
 And a class method that can be used to create fake request objects for use in tests:
 
 ``fake(path_with_query_string, method="GET", scheme="http", url_vars=None)``
@@ -279,7 +284,7 @@ For example:
         content_type="application/xml; charset=utf-8",
     )
 
-The quickest way to create responses is using the ``Response.text(...)``, ``Response.html(...)``, ``Response.json(...)`` or ``Response.redirect(...)`` helper methods:
+The quickest way to create responses is using the ``Response.text(...)``, ``Response.html(...)``, ``Response.json(...)``, ``Response.error(...)`` or ``Response.redirect(...)`` helper methods:
 
 .. code-block:: python
 
@@ -290,6 +295,8 @@ The quickest way to create responses is using the ``Response.text(...)``, ``Resp
     text_response = Response.text(
         "This will become utf-8 encoded text"
     )
+    # A JSON error in Datasette's standard error format:
+    error_response = Response.error("Cannot do that", 400)
     # Redirects are served as 302, unless you pass status=301:
     redirect_response = Response.redirect(
         "https://latest.datasette.io/"
@@ -299,6 +306,8 @@ Each of these responses will use the correct corresponding content-type - ``text
 
 Each of the helper methods take optional ``status=`` and ``headers=`` arguments, documented above.
 
+``Response.error(messages, status=400)`` returns a JSON error in the :ref:`standard Datasette error format <json_api_errors>`. ``messages`` can be a single string or a list of strings. Use this for JSON-only endpoints; if your error should content-negotiate between JSON and HTML, raise ``Forbidden``, ``NotFound``, ``BadRequest`` or ``DatasetteError`` instead and Datasette's error handling will build the appropriate response.
+
 .. _internals_response_asgi_send:
 
 Returning a response with .asgi_send(send)
@@ -451,6 +460,52 @@ await .render_template(template, context=None, request=None)
 
 Renders a `Jinja template <https://jinja.palletsprojects.com/en/2.11.x/>`__ using Datasette's preconfigured instance of Jinja and returns the resulting string. The template will have access to Datasette's default template functions and any functions that have been made available by other plugins.
 
+.. _datasette_static:
+
+.static(path, plugin=None, mount=None)
+--------------------------------------
+
+``path`` - string
+    The path to the static asset, relative to the selected static directory.
+
+``plugin`` - string, optional
+    The plugin name, for linking to an asset in that plugin's ``static/``
+    directory.
+
+``mount`` - string, optional
+    The ``--static`` mount name, for linking to an asset in a directory mounted
+    using ``datasette --static mount_name:directory``.
+
+Returns a URL for a static asset with a ``?_hash=`` parameter based on the file
+contents. That URL takes the ``base_url`` setting into account.
+
+When the ``?_hash=`` parameter matches the current file contents, Datasette will
+serve the asset with ``Cache-Control: max-age=31536000, immutable, public``.
+
+Call this with just ``path`` for one of Datasette's bundled static assets:
+
+.. code-block:: python
+
+    datasette.static("app.css")
+
+Use ``plugin=`` for plugin static assets:
+
+.. code-block:: python
+
+    datasette.static(
+        "plugin.js", plugin="datasette_plugin_name"
+    )
+
+Use ``mount=`` for static directories mounted using the ``--static`` option:
+
+.. code-block:: python
+
+    datasette.static("styles.css", mount="assets")
+
+``plugin`` and ``mount`` are mutually exclusive. The same feature is available
+to Jinja templates as the ``static()`` template function, described in
+:ref:`customization_static_files`.
+
 .. _datasette_actors_from_ids:
 
 await .actors_from_ids(actor_ids)
@@ -1968,8 +2023,8 @@ Example usage:
 
 .. _database_execute_write:
 
-await db.execute_write(sql, params=None, block=True, request=None, return_all=False, returning_limit=10)
---------------------------------------------------------------------------------------------------------
+await db.execute_write(sql, params=None, block=True, request=None, return_all=False, returning_limit=10, transaction=True)
+--------------------------------------------------------------------------------------------------------------------------
 
 SQLite only allows one database connection to write at a time. Datasette handles this for you by maintaining a queue of writes to be executed against a given database. Plugins can submit write operations to this queue and they will be executed in the order in which they are received.
 
@@ -2004,7 +2059,9 @@ If you need to retrieve every row returned by a statement, pass ``return_all=Tru
 
 If you pass ``block=False`` this behavior changes to "fire and forget" - queries will be added to the write queue and executed in a separate thread while your code can continue to do other things. The method will return a UUID representing the queued task.
 
-Each call to ``execute_write()`` will be executed inside a transaction.
+Each call to ``execute_write()`` will be executed inside a transaction. Pass
+``transaction=False`` for statements such as ``VACUUM`` that cannot run inside
+a transaction.
 
 .. _database_execute_write_script:
 
@@ -2308,6 +2365,14 @@ The internal database schema is as follows:
 
 .. code-block:: sql
 
+    CREATE TABLE "_sqlite_migrations" (
+       "id" INTEGER PRIMARY KEY,
+       "migration_set" TEXT,
+       "name" TEXT,
+       "applied_at" TEXT
+    );
+    CREATE UNIQUE INDEX "idx__sqlite_migrations_migration_set_name"
+        ON "_sqlite_migrations" ("migration_set", "name");
     CREATE TABLE catalog_databases (
         database_name TEXT PRIMARY KEY,
         path TEXT,
@@ -2533,6 +2598,13 @@ Async version of :ref:`call_with_supported_arguments <internals_utils_call_with_
 
 .. _internals_tracer:
 
+JSON encoding
+-------------
+
+.. _internals_utils_CustomJSONEncoder:
+
+.. autoclass:: datasette.utils.CustomJSONEncoder
+
 datasette.tracer
 ================
 
diff --git a/docs/introspection.rst b/docs/introspection.rst
index 4834f441..14b6249f 100644
--- a/docs/introspection.rst
+++ b/docs/introspection.rst
@@ -7,6 +7,10 @@ Datasette includes some pages and JSON API endpoints for introspecting the curre
 
 Each of these pages can be viewed in your browser. Add ``.json`` to the URL to get back the contents as JSON.
 
+JSON responses that return an object include an ``"ok": true`` key, consistent with the rest of the :ref:`JSON API <json_api>`.
+
+The introspection endpoints documented on this page are covered by the :ref:`JSON API stability promise <json_api_stability>`, with the exception of the debug endpoints ``/-/threads`` and ``/-/actions``, whose shapes may change in future releases.
+
 .. _JsonDataView_metadata:
 
 /-/metadata
@@ -37,6 +41,7 @@ Shows the version of Datasette, Python and SQLite. `Versions example <https://la
 .. code-block:: json
 
     {
+        "ok": true,
         "datasette": {
             "version": "0.60"
         },
@@ -97,6 +102,7 @@ Shows the :ref:`settings` for this instance of Datasette. `Settings example <htt
 .. code-block:: json
 
     {
+        "ok": true,
         "default_facet_size": 30,
         "default_page_size": 100,
         "facet_suggest_time_limit_ms": 50,
@@ -115,6 +121,7 @@ Shows the :ref:`configuration <configuration>` for this instance of Datasette. T
 .. code-block:: json
 
     {
+        "ok": true,
         "settings": {
             "template_debug": true,
             "trace_debug": true,
@@ -129,20 +136,47 @@ Any keys that include the one of the following substrings in their names will be
 /-/databases
 ------------
 
-Shows currently attached databases. `Databases example <https://latest.datasette.io/-/databases>`_:
+Shows currently attached databases that the current actor is allowed to view, based on the ``view-database`` permission. `Databases example <https://latest.datasette.io/-/databases>`_:
 
 .. code-block:: json
 
-    [
-        {
-            "hash": null,
-            "is_memory": false,
-            "is_mutable": true,
-            "name": "fixtures",
-            "path": "fixtures.db",
-            "size": 225280
-        }
-    ]
+    {
+        "ok": true,
+        "databases": [
+            {
+                "hash": null,
+                "is_memory": false,
+                "is_mutable": true,
+                "name": "fixtures",
+                "path": "fixtures.db",
+                "size": 225280
+            }
+        ]
+    }
+
+.. _JsonDataView_actions:
+
+/-/actions
+----------
+
+Shows all actions registered with the permission system, including those added by plugins. Requires the ``permissions-debug`` permission.
+
+.. code-block:: json
+
+    {
+        "ok": true,
+        "actions": [
+            {
+                "name": "view-instance",
+                "abbr": "vi",
+                "description": "View Datasette instance",
+                "takes_parent": false,
+                "takes_child": false,
+                "resource_class": null,
+                "also_requires": null
+            }
+        ]
+    }
 
 .. _JumpView:
 
@@ -160,6 +194,7 @@ The endpoint supports a ``?q=`` query parameter for filtering items by name.
 .. code-block:: json
 
     {
+        "ok": true,
         "matches": [
             {
                 "name": "fixtures",
@@ -188,6 +223,7 @@ Search example with ``?q=facet`` returns only items matching ``.*facet.*``:
 .. code-block:: json
 
     {
+        "ok": true,
         "matches": [
             {
                 "name": "fixtures: facetable",
@@ -215,11 +251,12 @@ Without those query string arguments, the page lists up to five tables with dete
 /-/threads
 ----------
 
-Shows details of threads and ``asyncio`` tasks. `Threads example <https://latest.datasette.io/-/threads>`_:
+Shows details of threads and ``asyncio`` tasks. This endpoint requires the ``permissions-debug`` permission, since it exposes runtime internals. `Threads example <https://latest.datasette.io/-/threads>`_:
 
 .. code-block:: json
 
     {
+        "ok": true,
         "num_threads": 2,
         "threads": [
             {
@@ -251,6 +288,7 @@ Shows the currently authenticated actor. Useful for debugging Datasette authenti
 .. code-block:: json
 
     {
+        "ok": true,
         "actor": {
             "id": 1,
             "username": "some-user"
diff --git a/docs/json_api.rst b/docs/json_api.rst
index f7a0caae..a96fd73d 100644
--- a/docs/json_api.rst
+++ b/docs/json_api.rst
@@ -9,6 +9,53 @@ through the Datasette user interface can also be accessed as JSON via the API.
 To access the API for a page, either click on the ``.json`` link on that page or
 edit the URL and add a ``.json`` extension to it.
 
+.. _json_api_stability:
+
+API stability
+-------------
+
+Datasette 1.0 makes a stability promise for its JSON API: the endpoints,
+parameters and response keys documented here and on the pages this
+documentation links to will not change in backwards-incompatible ways for
+the duration of the 1.x release series.
+
+Stability means:
+
+- Documented endpoints will keep their URLs, methods, parameters and
+  permission requirements.
+- Documented response keys will keep their names and types. New keys may be
+  **added** in any release - clients should ignore keys they do not
+  recognize.
+- The documented ``?_extra=`` names, ``?_shape=`` values and
+  :ref:`column filter operators <table_arguments>` are stable.
+- Pagination tokens - the ``"next"`` key and ``?_next=`` parameter - are
+  **opaque strings**. Pass them back exactly as you received them; their
+  internal structure is not part of the API and can change at any time.
+- The :ref:`standard error format <json_api_errors>` and the
+  :ref:`API token format and restriction semantics <CreateTokenView>` are
+  stable, including the action abbreviations stored inside signed tokens.
+
+Some JSON endpoints are **exempt** from this promise:
+
+- Endpoints that are not documented include this marker key in their
+  responses and can change at any time::
+
+      "unstable": "This API is not part of Datasette's stable interface and may change at any time"
+
+  This currently covers the instance homepage (``/.json``), the stored
+  query ``analyze``/``store``/``definition`` endpoints, ``/-/query/parameters``,
+  ``/-/execute-write/analyze`` and the JSON returned by the ``/-/permissions``
+  debug playground.
+- Debug and support endpoints are documented so you can use them, but their
+  JSON shapes are not frozen: :ref:`/-/threads <JsonDataView_threads>`,
+  :ref:`/-/actions <JsonDataView_actions>`,
+  the :ref:`permission debug endpoints <PermissionsDebugView>`
+  (``/-/allowed``, ``/-/rules``, ``/-/check``) and the
+  :ref:`table autocomplete endpoint <TableAutocompleteView>`.
+- Response keys explicitly labeled as unstable in this documentation, such
+  as the ``"analysis"`` block returned by :ref:`execute-write <ExecuteWriteView>`
+  and the ``debug`` and ``request`` extras.
+
 .. _json_api_default:
 
 Default representation
@@ -42,13 +89,49 @@ looks like this:
       "truncated": false
     }
 
-``"ok"`` is always ``true`` if an error did not occur.
+``"ok"`` is always ``true`` if an error did not occur. Every Datasette JSON endpoint that returns an object includes this key on success.
 
-The ``"rows"`` key is a list of objects, each one representing a row. 
+The ``"rows"`` key is a list of objects, each one representing a row.
 
 The ``"truncated"`` key lets you know if the query was truncated. This can happen if a SQL query returns more than 1,000 results (or the :ref:`setting_max_returned_rows` setting).
 
-For table pages, an additional key ``"next"`` may be present. This indicates that the next page in the pagination set can be retrieved using ``?_next=VALUE``.
+For table pages, two additional keys are present: ``"next"``, an opaque token that can be used to retrieve the next page using ``?_next=TOKEN``, and ``"next_url"``, the full URL of that next page. Both are ``null`` on the final page. See :ref:`json_api_pagination`.
+
+.. _json_api_errors:
+
+Error responses
+---------------
+
+Every JSON error response from Datasette uses the same format:
+
+.. code-block:: json
+
+    {
+        "ok": false,
+        "error": "Table not found",
+        "errors": [
+            "Table not found"
+        ],
+        "status": 404
+    }
+
+- ``"ok"`` is always ``false`` for an error.
+- ``"errors"`` is a list of one or more error message strings. Endpoints that
+  validate multiple things at once - such as the :ref:`insert API <TableInsertView>` -
+  may return several messages here.
+- ``"error"`` is all of those messages joined with ``"; "``, for
+  convenience when displaying a single string.
+- ``"status"`` matches the HTTP status code of the response.
+
+Some endpoints add extra context keys. For example, a SQL error from a
+:ref:`custom query <json_api_custom_sql>` also includes the empty
+``"rows"`` and ``"truncated"`` keys of the response it was unable to
+produce.
+
+Permission errors use the same format: a request that fails a permission
+check receives a ``403`` with this JSON error body when the URL ends in
+``.json`` or the request sends an ``Accept: application/json`` or
+``Content-Type: application/json`` header.
 
 .. _json_api_custom_sql:
 
@@ -92,6 +175,7 @@ options:
     {
       "ok": true,
       "next": null,
+      "next_url": null,
       "rows": [
         [3, "Detroit"],
         [2, "Los Angeles"],
@@ -192,6 +276,10 @@ Here is an example Python function built using `requests <https://requests.readt
 Special JSON arguments
 ----------------------
 
+Boolean query string arguments - such as ``?_labels=`` and
+``?_json_infinity=`` - accept ``on``, ``true`` or ``1`` for true and
+``off``, ``false`` or ``0`` for false.
+
 Every Datasette endpoint that can return JSON also accepts the following
 query string arguments:
 
@@ -245,7 +333,9 @@ These can be repeated or comma-separated:
 
 ::
 
-    ?_extra=columns&_extra=count,next_url
+    ?_extra=columns&_extra=count,count_sql
+
+Requesting an ``_extra`` name that does not exist returns a ``400`` error in the :ref:`standard error format <json_api_errors>`, for example ``{"ok": false, "error": "Unknown _extra: nope", ...}``.
 
 .. [[[cog
     from json_api_doc import table_extras
@@ -266,8 +356,17 @@ The available table extras are listed below.
 
         15
 
+``count_truncated``
+    True if the count hit Datasette's counting limit, meaning the real number of matching rows is at least the reported count. (May execute additional queries.)
+
+    ``GET /fixtures/facetable.json?_extra=count,count_truncated``
+
+    .. code-block:: json
+
+        false
+
 ``count_sql``
-    SQL query used to calculate the total count
+    SQL query string used to calculate the total count for the current table view, including active filters.
 
     ``GET /fixtures/facetable.json?_size=0&_extra=count_sql``
 
@@ -276,7 +375,7 @@ The available table extras are listed below.
         "select count(*) from facetable "
 
 ``facet_results``
-    Results of facets calculated against this data (May execute additional queries. See :ref:`facets` for details of how facets work.)
+    Results of facets calculated against this data. A dictionary with ``results`` and ``timed_out`` keys: ``results`` maps facet names to facet dictionaries with ``name``, ``type``, ``results`` and URL keys, and each facet result item includes ``value``, ``label``, ``count`` and ``toggle_url``. (May execute additional queries. See :ref:`facets` for details of how facets work.)
 
     Shape abbreviated from /fixtures/facetable.json?_facet=state&_extra=facet_results.
 
@@ -305,7 +404,7 @@ The available table extras are listed below.
         }
 
 ``facets_timed_out``
-    Facet calculations that timed out
+    List of names of facet calculations that exceeded the facet time limit.
 
     ``GET /fixtures/facetable.json?_facet=state&_extra=facets_timed_out``
 
@@ -316,7 +415,7 @@ The available table extras are listed below.
         []
 
 ``suggested_facets``
-    Suggestions for facets that might return interesting results (May execute additional queries. Suggestions are controlled by the :ref:`setting_suggest_facets` setting.)
+    Suggestions for facets that might return interesting results. Each item is a dictionary with ``name`` and ``toggle_url`` keys, and may include extra keys such as ``type`` or ``label`` depending on the facet class. (May execute additional queries. Suggestions are controlled by the :ref:`setting_suggest_facets` setting.)
 
     Shape abbreviated from /fixtures/facetable.json?_extra=suggested_facets.
 
@@ -338,19 +437,8 @@ The available table extras are listed below.
 
         "where state = \"CA\" sorted by pk"
 
-``next_url``
-    Full URL for the next page of results
-
-    ``GET /fixtures/facetable.json?_size=1&_extra=next_url``
-
-    ``null`` if there are no more pages of results. See :ref:`json_api_pagination`.
-
-    .. code-block:: json
-
-        "http://localhost/fixtures/facetable.json?_size=1&_extra=next_url&_next=1"
-
 ``columns``
-    Column names returned by this query
+    List of column names returned by this table, row or query.
 
     ``GET /fixtures/facetable.json?_extra=columns``
 
@@ -371,7 +459,7 @@ The available table extras are listed below.
         ]
 
 ``all_columns``
-    All columns in the table, regardless of _col/_nocol filtering
+    List of all column names in the table, regardless of ``_col=`` or ``_nocol=`` filtering.
 
     ``GET /fixtures/facetable.json?_col=pk&_extra=all_columns``
 
@@ -392,7 +480,7 @@ The available table extras are listed below.
         ]
 
 ``primary_keys``
-    Primary keys for this table
+    List of primary key column names for this table, or an empty list if the table has no explicit primary key.
 
     ``GET /fixtures/facetable.json?_extra=primary_keys``
 
@@ -402,8 +490,27 @@ The available table extras are listed below.
           "pk"
         ]
 
+``column_details``
+    SQLite schema details for columns in this table. The dictionary maps column names to objects describing the schema for each column. (Each object has ``type`` as the declared type string returned by SQLite, or ``""`` if no type was declared; ``sqlite_type`` as the normalized SQLite affinity, one of ``TEXT``, ``INTEGER``, ``REAL``, ``BLOB`` or ``NUMERIC``; ``notnull`` as a boolean; ``default`` as the raw SQL default expression string, such as ``"42"``, ``"'hello'"`` or ``"datetime('now')"``, or ``null`` if there is no default; ``is_pk`` as a boolean; ``pk_position`` as the integer primary key position reported by SQLite, or ``0`` for columns that are not part of the primary key; and ``hidden`` as the integer value reported by SQLite's ``PRAGMA table_xinfo``. ``hidden`` is ``0`` for normal columns, ``1`` for hidden virtual table columns, ``2`` for virtual generated columns and ``3`` for stored generated columns.)
+
+    ``GET /fixtures/binary_data.json?_size=0&_extra=column_details``
+
+    .. code-block:: json
+
+        {
+          "data": {
+            "type": "BLOB",
+            "sqlite_type": "BLOB",
+            "notnull": false,
+            "default": null,
+            "is_pk": false,
+            "pk_position": 0,
+            "hidden": 0
+          }
+        }
+
 ``display_columns``
-    Column metadata used by the HTML table display
+    Column metadata used by the HTML table display. Each item includes ``name``, ``sortable``, ``is_pk``, ``type``, ``notnull``, ``description``, ``column_type`` and ``column_type_config`` keys.
 
     Shape abbreviated from /fixtures/facetable.json?_size=1&_extra=display_columns.
 
@@ -456,7 +563,7 @@ The available table extras are listed below.
         }
 
 ``debug``
-    Extra debug information (The contents of this block are not a stable part of the Datasette API and may change without warning.)
+    Extra debug information dictionary. This is intended for development only and its shape is not part of the stable template contract. (The contents of this block are not a stable part of the Datasette API and may change without warning.)
 
     ``GET /fixtures/facetable.json?_extra=debug``
 
@@ -474,7 +581,7 @@ The available table extras are listed below.
         }
 
 ``request``
-    Full information about the request
+    Dictionary with request details: ``url``, ``path``, ``full_path``, ``host`` and ``args`` where ``args`` maps query string parameter names to their values.
 
     ``GET /fixtures/facetable.json?_extra=request``
 
@@ -493,7 +600,7 @@ The available table extras are listed below.
         }
 
 ``query``
-    Details of the underlying SQL query
+    Details of the underlying SQL query as a dictionary with ``sql`` and ``params`` keys.
 
     ``GET /fixtures/facetable.json?_size=1&_extra=query``
 
@@ -505,7 +612,7 @@ The available table extras are listed below.
         }
 
 ``column_types``
-    Column type assignments for this table (An empty object if no column types have been assigned. Column types can be assigned in :ref:`configuration <table_configuration_column_types>` or using the :ref:`set column type API <TableSetColumnTypeView>`.)
+    Column type assignments for this table. A dictionary mapping column names to ``{"type": type_name, "config": config}`` dictionaries. (An empty object if no column types have been assigned. Column types can be assigned in :ref:`configuration <table_configuration_column_types>` or using the :ref:`set column type API <TableSetColumnTypeView>`.)
 
     ``GET /fixtures/facetable.json?_size=0&_extra=column_types``
 
@@ -521,7 +628,7 @@ The available table extras are listed below.
         }
 
 ``set_column_type_ui``
-    Information needed to build an interface for assigning column types (``null`` unless the current actor is allowed to use the :ref:`set column type API <TableSetColumnTypeView>` for this table.)
+    Information needed to build an interface for assigning column types, or ``None`` if unavailable. When present it has ``path`` and ``columns`` keys; ``columns`` maps column names to ``current`` and ``options`` values. (``null`` unless the current actor is allowed to use the :ref:`set column type API <TableSetColumnTypeView>` for this table.)
 
     Shape abbreviated to two columns, as seen by an actor with ``set-column-type`` permission. ``current`` is the column type currently assigned to each column and ``options`` lists the types that could be assigned to it.
 
@@ -571,7 +678,7 @@ The available table extras are listed below.
         }
 
 ``metadata``
-    Metadata about the table, database or stored query (See :ref:`metadata` for how to attach metadata to tables.)
+    Metadata dictionary for the table, database or stored query. Table and row metadata include a ``columns`` dictionary mapping column names to descriptions; stored query metadata returns the stored query configuration. (See :ref:`metadata` for how to attach metadata to tables.)
 
     ``GET /fixtures/facetable.json?_extra=metadata``
 
@@ -587,7 +694,7 @@ The available table extras are listed below.
         }
 
 ``extras``
-    List of ?_extra= blocks that can be used on this page
+    List of ``?_extra=`` blocks that can be used on this page. Each item has ``name``, ``description``, ``toggle_url`` and ``selected`` keys.
 
     Shape abbreviated from /fixtures/facetable.json?_extra=extras - the full response lists every extra described on this page. ``toggle_url`` is the current URL with that extra added or removed, and ``selected`` is ``true`` for extras included in the current request.
 
@@ -636,7 +743,7 @@ The available table extras are listed below.
         "9403e5"
 
 ``renderers``
-    Alternative output renderers available for this table
+    Dictionary mapping output format names such as ``json`` or plugin-provided renderer names to URLs for this data in that format.
 
     ``GET /fixtures/facetable.json?_extra=renderers``
 
@@ -649,7 +756,7 @@ The available table extras are listed below.
         }
 
 ``custom_table_templates``
-    Custom template names considered for this table (The first template in this list that exists will be used to render the table on the HTML version of this page. See :ref:`customization_custom_templates`.)
+    List of custom template names considered for rendering table rows, in lookup order. (The first template in this list that exists will be used to render the table on the HTML version of this page. See :ref:`customization_custom_templates`.)
 
     ``GET /fixtures/facetable.json?_extra=custom_table_templates``
 
@@ -662,7 +769,7 @@ The available table extras are listed below.
         ]
 
 ``sorted_facet_results``
-    Facet results sorted for display (The same data as ``facet_results``, as a list in the order used by the HTML interface: facets from :ref:`facet configuration <facets_metadata>` first, then other facets ordered by their number of results.)
+    Facet result dictionaries sorted for display. Each item has the same shape as an entry from ``facet_results['results']``. (The same data as ``facet_results``, as a list in the order used by the HTML interface: facets from :ref:`facet configuration <facets_metadata>` first, then other facets ordered by their number of results.)
 
     ``GET /fixtures/facetable.json?_facet=state&_extra=sorted_facet_results``
 
@@ -738,7 +845,7 @@ The available table extras are listed below.
         false
 
 ``expandable_columns``
-    Foreign key columns that can be expanded with labels (See :ref:`expand_foreign_keys` for how to expand these labels.)
+    List of foreign key columns that can be expanded with labels. Each item is a ``(foreign_key, label_column)`` pair where ``foreign_key`` is the SQLite foreign key dictionary and ``label_column`` is the label column in the referenced table, or ``None``. (See :ref:`expand_foreign_keys` for how to expand these labels.)
 
     ``GET /fixtures/facetable.json?_extra=expandable_columns``
 
@@ -758,7 +865,7 @@ The available table extras are listed below.
         ]
 
 ``form_hidden_args``
-    Hidden form arguments used by the HTML table interface
+    List of ``(name, value)`` pairs for hidden form fields used by the HTML table interface to preserve current query string options.
 
     ``GET /fixtures/facetable.json?_facet=state&_size=1&_extra=form_hidden_args``
 
@@ -785,7 +892,7 @@ Row JSON responses
 The following extras are available for row JSON responses.
 
 ``columns``
-    Column names returned by this query
+    List of column names returned by this table, row or query.
 
     ``GET /fixtures/simple_primary_key/1.json?_extra=columns``
 
@@ -797,7 +904,7 @@ The following extras are available for row JSON responses.
         ]
 
 ``primary_keys``
-    Primary keys for this table
+    List of primary key column names for this table, or an empty list if the table has no explicit primary key.
 
     ``GET /fixtures/simple_primary_key/1.json?_extra=primary_keys``
 
@@ -807,6 +914,25 @@ The following extras are available for row JSON responses.
           "id"
         ]
 
+``column_details``
+    SQLite schema details for columns in this table. The dictionary maps column names to objects describing the schema for each column. (Each object has ``type`` as the declared type string returned by SQLite, or ``""`` if no type was declared; ``sqlite_type`` as the normalized SQLite affinity, one of ``TEXT``, ``INTEGER``, ``REAL``, ``BLOB`` or ``NUMERIC``; ``notnull`` as a boolean; ``default`` as the raw SQL default expression string, such as ``"42"``, ``"'hello'"`` or ``"datetime('now')"``, or ``null`` if there is no default; ``is_pk`` as a boolean; ``pk_position`` as the integer primary key position reported by SQLite, or ``0`` for columns that are not part of the primary key; and ``hidden`` as the integer value reported by SQLite's ``PRAGMA table_xinfo``. ``hidden`` is ``0`` for normal columns, ``1`` for hidden virtual table columns, ``2`` for virtual generated columns and ``3`` for stored generated columns.)
+
+    ``GET /fixtures/binary_data/1.json?_extra=column_details``
+
+    .. code-block:: json
+
+        {
+          "data": {
+            "type": "BLOB",
+            "sqlite_type": "BLOB",
+            "notnull": false,
+            "default": null,
+            "is_pk": false,
+            "pk_position": 0,
+            "hidden": 0
+          }
+        }
+
 ``render_cell``
     Rendered HTML for each cell using the render_cell plugin hook (See the :ref:`render_cell() plugin hook <plugin_hook_render_cell>` documentation.)
 
@@ -829,7 +955,7 @@ The following extras are available for row JSON responses.
         }
 
 ``debug``
-    Extra debug information (The contents of this block are not a stable part of the Datasette API and may change without warning.)
+    Extra debug information dictionary. This is intended for development only and its shape is not part of the stable template contract. (The contents of this block are not a stable part of the Datasette API and may change without warning.)
 
     ``GET /fixtures/simple_primary_key/1.json?_extra=debug``
 
@@ -858,7 +984,7 @@ The following extras are available for row JSON responses.
         }
 
 ``request``
-    Full information about the request
+    Dictionary with request details: ``url``, ``path``, ``full_path``, ``host`` and ``args`` where ``args`` maps query string parameter names to their values.
 
     ``GET /fixtures/simple_primary_key/1.json?_extra=request``
 
@@ -877,7 +1003,7 @@ The following extras are available for row JSON responses.
         }
 
 ``query``
-    Details of the underlying SQL query
+    Details of the underlying SQL query as a dictionary with ``sql`` and ``params`` keys.
 
     ``GET /fixtures/simple_primary_key/1.json?_extra=query``
 
@@ -891,7 +1017,7 @@ The following extras are available for row JSON responses.
         }
 
 ``column_types``
-    Column type assignments for this table (An empty object if no column types have been assigned. Column types can be assigned in :ref:`configuration <table_configuration_column_types>` or using the :ref:`set column type API <TableSetColumnTypeView>`.)
+    Column type assignments for this table. A dictionary mapping column names to ``{"type": type_name, "config": config}`` dictionaries. (An empty object if no column types have been assigned. Column types can be assigned in :ref:`configuration <table_configuration_column_types>` or using the :ref:`set column type API <TableSetColumnTypeView>`.)
 
     ``GET /fixtures/facetable/1.json?_extra=column_types``
 
@@ -907,7 +1033,7 @@ The following extras are available for row JSON responses.
         }
 
 ``metadata``
-    Metadata about the table, database or stored query (See :ref:`metadata` for how to attach metadata to tables.)
+    Metadata dictionary for the table, database or stored query. Table and row metadata include a ``columns`` dictionary mapping column names to descriptions; stored query metadata returns the stored query configuration. (See :ref:`metadata` for how to attach metadata to tables.)
 
     ``GET /fixtures/simple_primary_key/1.json?_extra=metadata``
 
@@ -920,7 +1046,7 @@ The following extras are available for row JSON responses.
         }
 
 ``extras``
-    List of ?_extra= blocks that can be used on this page
+    List of ``?_extra=`` blocks that can be used on this page. Each item has ``name``, ``description``, ``toggle_url`` and ``selected`` keys.
 
     Shape abbreviated from /fixtures/facetable.json?_extra=extras - the full response lists every extra described on this page. ``toggle_url`` is the current URL with that extra added or removed, and ``selected`` is ``true`` for extras included in the current request.
 
@@ -978,7 +1104,7 @@ The following extras are available for row JSON responses.
         false
 
 ``foreign_key_tables``
-    Tables that link to this row using foreign keys (May execute additional queries.)
+    List of tables that link to this row using foreign keys. Each item includes the foreign key fields plus ``count`` for matching rows and ``link`` for the filtered table URL. (May execute additional queries.)
 
     ``GET /fixtures/simple_primary_key/1.json?_extra=foreign_key_tables``
 
@@ -1030,7 +1156,7 @@ Query JSON responses
 The following extras are available for arbitrary SQL query responses and stored, named query responses.
 
 ``columns``
-    Column names returned by this query
+    List of column names returned by this table, row or query.
 
     ``GET /fixtures/-/query.json?sql=select+1+as+one&_extra=columns``
 
@@ -1061,7 +1187,7 @@ The following extras are available for arbitrary SQL query responses and stored,
         }
 
 ``debug``
-    Extra debug information (The contents of this block are not a stable part of the Datasette API and may change without warning.)
+    Extra debug information dictionary. This is intended for development only and its shape is not part of the stable template contract. (The contents of this block are not a stable part of the Datasette API and may change without warning.)
 
     ``GET /fixtures/-/query.json?sql=select+1+as+one&_extra=debug``
 
@@ -1075,7 +1201,7 @@ The following extras are available for arbitrary SQL query responses and stored,
         }
 
 ``request``
-    Full information about the request
+    Dictionary with request details: ``url``, ``path``, ``full_path``, ``host`` and ``args`` where ``args`` maps query string parameter names to their values.
 
     ``GET /fixtures/-/query.json?sql=select+1+as+one&_extra=request``
 
@@ -1097,7 +1223,7 @@ The following extras are available for arbitrary SQL query responses and stored,
         }
 
 ``query``
-    Details of the underlying SQL query
+    Details of the underlying SQL query as a dictionary with ``sql`` and ``params`` keys.
 
     ``GET /fixtures/-/query.json?sql=select+1+as+one&_extra=query``
 
@@ -1120,7 +1246,7 @@ The following extras are available for arbitrary SQL query responses and stored,
         }
 
 ``metadata``
-    Metadata about the table, database or stored query (See :ref:`metadata` for how to attach metadata to tables.)
+    Metadata dictionary for the table, database or stored query. Table and row metadata include a ``columns`` dictionary mapping column names to descriptions; stored query metadata returns the stored query configuration. (See :ref:`metadata` for how to attach metadata to tables.)
 
     ``GET /fixtures/neighborhood_search.json?text=town&_extra=metadata``
 
@@ -1137,7 +1263,6 @@ The following extras are available for arbitrary SQL query responses and stored,
           "description_html": null,
           "hide_sql": false,
           "fragment": null,
-          "params": [],
           "parameters": [],
           "is_write": false,
           "is_private": false,
@@ -1151,7 +1276,7 @@ The following extras are available for arbitrary SQL query responses and stored,
         }
 
 ``extras``
-    List of ?_extra= blocks that can be used on this page
+    List of ``?_extra=`` blocks that can be used on this page. Each item has ``name``, ``description``, ``toggle_url`` and ``selected`` keys.
 
     Shape abbreviated from /fixtures/facetable.json?_extra=extras - the full response lists every extra described on this page. ``toggle_url`` is the current URL with that extra added or removed, and ``selected`` is ``true`` for extras included in the current request.
 
@@ -1532,6 +1657,10 @@ The JSON write API
 
 Datasette provides a write API for JSON data. This is a POST-only API that requires an authenticated API token, see :ref:`CreateTokenView`. The token will need to have the specified :ref:`authentication_permissions`.
 
+The request body is always parsed as JSON, regardless of the request's ``Content-Type`` header - a body that is not valid JSON returns a ``400`` error. Cross-site request forgery is prevented by Datasette's ``Origin`` and ``Sec-Fetch-Site`` header checks rather than by content type requirements.
+
+The row-based write APIs can write :ref:`binary values in JSON <binary_json_format>` using Datasette's Base64 representation for BLOB data.
+
 .. _ExecuteWriteView:
 
 Executing write SQL
@@ -1565,7 +1694,7 @@ Unsupported SQL operations are rejected by default. ``VACUUM`` is not allowed in
 A successful response includes a message, the SQLite ``rowcount``, a ``"rows"``
 list, a ``"truncated"`` flag and a summary of the operations that were executed:
 
-The shape of the ``"analysis"`` block is not yet considered a stable API and may change in future Datasette releases.
+The shape of the ``"analysis"`` block is not part of the :ref:`stable API <json_api_stability>` and may change in future Datasette releases.
 
 .. code-block:: json
 
@@ -1625,15 +1754,17 @@ the execute-write returning row limit, which defaults to 10:
         ]
     }
 
-Errors use the standard Datasette error format:
+Errors use the :ref:`standard Datasette error format <json_api_errors>`:
 
 .. code-block:: json
 
     {
         "ok": false,
+        "error": "Permission denied: need execute-write-sql",
         "errors": [
             "Permission denied: need execute-write-sql"
-        ]
+        ],
+        "status": 403
     }
 
 .. _TableInsertView:
@@ -1660,6 +1791,8 @@ A single row can be inserted using the ``"row"`` key:
         }
     }
 
+Column values can use the :ref:`binary value JSON format <binary_json_format>` to write BLOB data.
+
 If successful, this will return a ``201`` status code and the newly inserted row, for example:
 
 .. code-block:: json
@@ -1727,9 +1860,11 @@ If any of your rows have a primary key that is already in use, you will get an e
 
     {
         "ok": false,
+        "error": "UNIQUE constraint failed: new_table.id",
         "errors": [
             "UNIQUE constraint failed: new_table.id"
-        ]
+        ],
+        "status": 400
     }
 
 Pass ``"ignore": true`` to ignore these errors and insert the other rows:
@@ -1765,6 +1900,8 @@ An upsert is an insert or update operation. If a row with a matching primary key
 
 The upsert API is mostly the same shape as the :ref:`insert API <TableInsertView>`. It requires both the :ref:`actions_insert_row` and :ref:`actions_update_row` permissions.
 
+It also accepts the same :ref:`binary value JSON format <binary_json_format>`.
+
 ::
 
     POST /<database>/<table>/-/upsert
@@ -1802,7 +1939,7 @@ The above example will:
 
 Similar to ``/-/insert``, a ``row`` key with an object can be used instead of a ``rows`` array to upsert a single row.
 
-If successful, this will return a ``200`` status code and a ``{"ok": true}`` response body.
+If successful, this will return a ``200`` status code and a ``{"ok": true}`` response body. This is deliberately different from the ``201`` returned by :ref:`insert <TableInsertView>`: an upsert may update existing rows without creating anything, so it does not claim resource creation.
 
 Add ``"return": true`` to the request body to return full copies of the affected rows after they have been inserted or updated:
 
@@ -1859,9 +1996,11 @@ When using upsert you must provide the primary key column (or columns if the tab
 
     {
         "ok": false,
+        "error": "Row 0 is missing primary key column(s): \"id\"",
         "errors": [
             "Row 0 is missing primary key column(s): \"id\""
-        ]
+        ],
+        "status": 400
     }
 
 If your table does not have an explicit primary key you should pass the SQLite ``rowid`` key instead.
@@ -1895,6 +2034,8 @@ To update a row, make a ``POST`` to ``/<database>/<table>/<row-pks>/-/update``.
 
 You only need to pass the columns you want to update. Any other columns will be left unchanged.
 
+Updated values can use the :ref:`binary value JSON format <binary_json_format>`.
+
 If successful, this will return a ``200`` status code and a ``{"ok": true}`` response body.
 
 Add ``"return": true`` to the request body to return the updated row:
@@ -1914,14 +2055,16 @@ The returned JSON will look like this:
 
     {
         "ok": true,
-        "row": {
-            "id": 1,
-            "title": "New title",
-            "other_column": "Will be present here too"
-        }
+        "rows": [
+            {
+                "id": 1,
+                "title": "New title",
+                "other_column": "Will be present here too"
+            }
+        ]
     }
 
-Any errors will return ``{"errors": ["... descriptive message ..."], "ok": false}``, and a ``400`` status code for a bad input or a ``403`` status code for an authentication or permission error.
+Any errors will use the :ref:`standard error format <json_api_errors>`, with a ``400`` status code for a bad input or a ``403`` status code for an authentication or permission error.
 
 Pass ``"alter: true`` to automatically add any missing columns to the table. This requires the :ref:`actions_alter_table` permission.
 
@@ -1942,7 +2085,7 @@ To delete a row, make a ``POST`` to ``/<database>/<table>/<row-pks>/-/delete``.
 
 If successful, this will return a ``200`` status code and a ``{"ok": true}`` response body.
 
-Any errors will return ``{"errors": ["... descriptive message ..."], "ok": false}``, and a ``400`` status code for a bad input or a ``403`` status code for an authentication or permission error.
+Any errors will use the :ref:`standard error format <json_api_errors>`, with a ``400`` status code for a bad input or a ``403`` status code for an authentication or permission error.
 
 .. _TableCreateView:
 
@@ -1968,7 +2111,14 @@ To create a table, make a ``POST`` to ``/<database>/-/create``. This requires th
             },
             {
                 "name": "title",
-                "type": "text"
+                "type": "text",
+                "not_null": true,
+                "default": "Untitled"
+            },
+            {
+                "name": "created",
+                "type": "text",
+                "default_expr": "current_timestamp"
             }
         ],
         "pk": "id"
@@ -1981,6 +2131,10 @@ The JSON here describes the table that will be created:
 
   - ``name`` is the name of the column. This is required.
   - ``type`` is the type of the column. This is optional - if not provided, ``text`` will be assumed. The valid types are ``text``, ``integer``, ``float`` and ``blob``.
+  - ``not_null`` can be set to ``true`` to create this column with a ``NOT NULL`` constraint.
+  - ``default`` can be used to set a literal default value for this column.
+  - ``default_expr`` can be used instead of ``default`` to set a SQLite default expression. See :ref:`default_expr values <json_api_default_expr_values>`.
+  - ``fk_table`` can be used to create a single-column foreign key constraint referencing another table. ``fk_column`` is optional and can be used to specify the referenced column - if omitted, Datasette will use the single primary key of ``fk_table``.
 
 * ``pk`` is the primary key for the table. This is optional - if not provided, Datasette will create a SQLite table with a hidden ``rowid`` column.
 
@@ -1993,6 +2147,56 @@ The JSON here describes the table that will be created:
 * ``replace`` can be set to ``true`` to replace existing rows by primary key if the table already exists. This requires the :ref:`actions_update_row` permission.
 * ``alter`` can be set to ``true`` if you want to automatically add any missing columns to the table. This requires the :ref:`actions_alter_table` permission.
 
+.. _json_api_default_expr_values:
+
+``default_expr`` accepts these values:
+
+.. list-table::
+   :header-rows: 1
+
+   * - Value
+     - Recommended column type
+     - Example inserted value
+   * - ``current_timestamp``
+     - ``text``
+     - ``2026-05-01 13:34:00``
+   * - ``current_date``
+     - ``text``
+     - ``2026-05-01``
+   * - ``current_time``
+     - ``text``
+     - ``13:34:00``
+   * - ``current_unixtime``
+     - ``integer``
+     - ``1777642440``
+   * - ``current_unixtime_ms``
+     - ``integer``
+     - ``1777642440000``
+
+This example creates a foreign key from ``projects.owner_id`` to the single primary key of ``owners``:
+
+.. code-block:: json
+
+    {
+        "table": "projects",
+        "columns": [
+            {
+                "name": "id",
+                "type": "integer"
+            },
+            {
+                "name": "owner_id",
+                "type": "integer",
+                "fk_table": "owners"
+            },
+            {
+                "name": "title",
+                "type": "text"
+            }
+        ],
+        "pk": "id"
+    }
+
 If the table is successfully created this will return a ``201`` status code and the following response:
 
 .. code-block:: json
@@ -2003,7 +2207,7 @@ If the table is successfully created this will return a ``201`` status code and
         "table": "name_of_new_table",
         "table_url": "http://127.0.0.1:8001/data/name_of_new_table",
         "table_api_url": "http://127.0.0.1:8001/data/name_of_new_table.json",
-        "schema": "CREATE TABLE [name_of_new_table] (\n   [id] INTEGER PRIMARY KEY,\n   [title] TEXT\n)"
+        "schema": "CREATE TABLE [name_of_new_table] (\n   [id] INTEGER PRIMARY KEY,\n   [title] TEXT NOT NULL DEFAULT 'Untitled',\n   [created] TEXT DEFAULT CURRENT_TIMESTAMP\n)"
     }
 
 .. _TableCreateView_example:
@@ -2037,6 +2241,8 @@ Datasette will create a table with a schema that matches those rows and insert t
         "pk": "id"
     }
 
+Example rows can use the :ref:`binary value JSON format <binary_json_format>`, allowing Datasette to infer ``BLOB`` columns.
+
 Doing this requires both the :ref:`actions_create_table` and :ref:`actions_insert_row` permissions.
 
 The ``201`` response here will be similar to the ``columns`` form, but will also include the number of rows that were inserted as ``row_count``:
@@ -2061,9 +2267,11 @@ If you pass a row to the create endpoint with a primary key that already exists
 
     {
         "ok": false,
+        "error": "UNIQUE constraint failed: creatures.id",
         "errors": [
             "UNIQUE constraint failed: creatures.id"
-        ]
+        ],
+        "status": 400
     }
 
 You can avoid this error by passing the same ``"ignore": true`` or ``"replace": true`` options to the create endpoint as you can to the :ref:`insert endpoint <TableInsertView>`.
@@ -2072,6 +2280,235 @@ To use the ``"replace": true`` option you will also need the :ref:`actions_updat
 
 Pass ``"alter": true`` to automatically add any missing columns to the existing table that are present in the rows you are submitting. This requires the :ref:`actions_alter_table` permission.
 
+.. _DatabaseForeignKeyTargetsView:
+
+Database foreign key targets
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The ``/<database>/-/foreign-key-targets`` endpoint returns the list of tables in a database that can be referenced by a single-column foreign key. This requires the :ref:`actions_create_table` permission.
+
+::
+
+    GET /<database>/-/foreign-key-targets
+
+The response includes only tables with exactly one primary key column. Hidden tables, tables with compound primary keys and tables with no explicit primary key are omitted.
+
+Each target includes the normalized SQLite type affinity for the primary key column in ``type``. The type is calculated using SQLite's documented affinity rules: ``INT`` maps to ``integer``; ``CHAR``, ``CLOB`` or ``TEXT`` maps to ``text``; ``BLOB`` or no type maps to ``blob``; ``REAL`` and floating-point declared types map to ``real``; everything else maps to ``numeric``.
+
+.. code-block:: json
+
+    {
+        "ok": true,
+        "database": "data",
+        "targets": [
+            {
+                "fk_table": "owners",
+                "fk_column": "id",
+                "type": "integer"
+            },
+            {
+                "fk_table": "categories",
+                "fk_column": "slug",
+                "type": "text"
+            }
+        ]
+    }
+
+.. _TableForeignKeySuggestionsView:
+
+Table foreign key suggestions
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The ``/<database>/<table>/-/foreign-key-suggestions`` endpoint suggests possible single-column foreign key relationships for a table. This requires the :ref:`actions_alter_table` permission.
+
+::
+
+    GET /<database>/<table>/-/foreign-key-suggestions
+
+The response includes every type-compatible single-column primary key target for each column in ``options``. Datasette also performs a bounded data check against up to 500 rows in the table: if the sampled non-null values for a column all exist in a target primary key, that target is included in ``suggestions``.
+
+If the bounded check takes too long, the endpoint fails open. It still returns the type-compatible ``options`` for each column, but ``row_check.status`` will be ``"timed_out"`` and there may be no ``suggestions``.
+
+.. code-block:: json
+
+    {
+        "ok": true,
+        "database": "data",
+        "table": "projects",
+        "row_check": {
+            "attempted": true,
+            "status": "completed",
+            "row_limit": 500,
+            "sampled_rows": 3,
+            "checked_options": 4
+        },
+        "columns": [
+            {
+                "column": "owner_id",
+                "type": "INTEGER",
+                "affinity": "integer",
+                "current": null,
+                "suggestions": [
+                    {
+                        "fk_table": "owners",
+                        "fk_column": "id",
+                        "confidence": "sampled",
+                        "sampled_values": 3,
+                        "reasons": [
+                            "type_match",
+                            "sample_values_exist",
+                            "name_match"
+                        ]
+                    }
+                ],
+                "options": [
+                    {
+                        "fk_table": "owners",
+                        "fk_column": "id",
+                        "type": "INTEGER"
+                    }
+                ]
+            }
+        ]
+    }
+
+.. _TableAlterView:
+
+Altering tables
+~~~~~~~~~~~~~~~
+
+To alter an existing table, make a ``POST`` to ``/<database>/<table>/-/alter``. This requires the :ref:`actions_alter_table` permission.
+
+::
+
+    POST /<database>/<table>/-/alter
+    Content-Type: application/json
+    Authorization: Bearer dstok_<rest-of-token>
+
+The request body should include an ``operations`` array. Each operation has the same top-level shape: an ``op`` string and an ``args`` object.
+
+.. code-block:: json
+
+    {
+        "operations": [
+            {
+                "op": "add_column",
+                "args": {
+                    "name": "slug",
+                    "type": "text",
+                    "not_null": true,
+                    "default": ""
+                }
+            },
+            {
+                "op": "add_column",
+                "args": {
+                    "name": "created",
+                    "type": "text",
+                    "default_expr": "current_timestamp"
+                }
+            },
+            {
+                "op": "rename_column",
+                "args": {
+                    "name": "title",
+                    "to": "headline"
+                }
+            },
+            {
+                "op": "rename_table",
+                "args": {
+                    "to": "published_posts"
+                }
+            },
+            {
+                "op": "alter_column",
+                "args": {
+                    "name": "score",
+                    "type": "float"
+                }
+            },
+            {
+                "op": "drop_column",
+                "args": {
+                    "name": "draft_notes"
+                }
+            },
+            {
+                "op": "set_primary_key",
+                "args": {
+                    "columns": ["id"]
+                }
+            },
+            {
+                "op": "add_foreign_key",
+                "args": {
+                    "column": "owner_id",
+                    "fk_table": "owners"
+                }
+            },
+            {
+                "op": "drop_foreign_key",
+                "args": {
+                    "column": "old_owner_id"
+                }
+            },
+            {
+                "op": "set_foreign_keys",
+                "args": {
+                    "foreign_keys": [
+                        {
+                            "column": "owner_id",
+                            "fk_table": "owners",
+                            "fk_column": "id"
+                        }
+                    ]
+                }
+            },
+            {
+                "op": "reorder_columns",
+                "args": {
+                    "columns": ["id", "headline", "slug", "created", "score"]
+                }
+            }
+        ]
+    }
+
+Supported operations:
+
+* ``add_column`` adds a new column. ``args`` accepts ``name``, optional ``type`` of ``text``, ``integer``, ``float`` or ``blob``, optional ``not_null``, optional literal ``default`` and optional ``default_expr``. If ``not_null`` is ``true`` either a non-null ``default`` or ``default_expr`` is required.
+* ``rename_column`` renames a column. ``args`` accepts ``name`` and ``to``.
+* ``rename_table`` renames the table. ``args`` accepts ``to``, the new table name. If combined with other operations, Datasette applies the column, primary key, foreign key and column order changes before renaming the table.
+* ``alter_column`` changes column properties. ``args`` accepts ``name`` and at least one of ``type``, ``not_null``, literal ``default`` or ``default_expr``. Passing ``"default": null`` removes an existing default.
+* ``drop_column`` drops a column. ``args`` accepts ``name``.
+* ``set_primary_key`` changes the table primary key. ``args`` accepts ``columns``, a list of one or more column names.
+* ``add_foreign_key`` adds a single-column foreign key constraint. ``args`` accepts ``column``, ``fk_table`` and optional ``fk_column``. If ``fk_column`` is omitted, Datasette will use the single primary key of ``fk_table``.
+* ``drop_foreign_key`` removes the foreign key constraint for a column. ``args`` accepts ``column``.
+* ``set_foreign_keys`` replaces all foreign key constraints on the table. ``args`` accepts ``foreign_keys``, a list of objects that each have ``column``, ``fk_table`` and optional ``fk_column``. An empty list removes all foreign key constraints.
+* ``reorder_columns`` reorders columns. ``args`` accepts ``columns``, a list of one or more column names. Columns omitted from this list will appear afterwards in their existing order.
+
+``default`` is always treated as a literal value. ``default_expr`` accepts the values shown in :ref:`default_expr values <json_api_default_expr_values>` and is rendered as the corresponding SQLite default expression.
+
+For foreign key operations that omit ``fk_column``, the referenced ``fk_table`` must have a single-column primary key. Datasette will return an error if it cannot identify a single primary key column for that table.
+
+A successful response returns the new schema and the previous schema. If the request used ``rename_table``, ``table``, ``table_url`` and ``table_api_url`` will use the new table name. Renaming a table through this endpoint triggers the :class:`~datasette.events.RenameTableEvent` event.
+
+.. code-block:: json
+
+    {
+        "ok": true,
+        "database": "data",
+        "table": "published_posts",
+        "table_url": "http://127.0.0.1:8001/data/published_posts",
+        "table_api_url": "http://127.0.0.1:8001/data/published_posts.json",
+        "altered": true,
+        "schema": "CREATE TABLE ...",
+        "before_schema": "CREATE TABLE ...",
+        "operations_applied": 11
+    }
+
+Any errors will use the :ref:`standard error format <json_api_errors>`, with a ``400`` status code for a bad input or a ``403`` status code for an authentication or permission error.
+
 .. _TableSetColumnTypeView:
 
 Setting a column type
@@ -2134,7 +2571,7 @@ To clear an existing column type assignment, set ``column_type`` to ``null``:
 
 This API stores the assignment in Datasette's internal database, so it can be used with immutable databases as well as mutable ones.
 
-Any errors will return ``{"errors": ["... descriptive message ..."], "ok": false}``, and a ``400`` status code for a bad input or a ``403`` status code for an authentication or permission error.
+Any errors will use the :ref:`standard error format <json_api_errors>`, with a ``400`` status code for a bad input or a ``403`` status code for an authentication or permission error.
 
 .. _TableDropView:
 
@@ -2171,4 +2608,4 @@ If you pass the following POST body:
 
 Then the table will be dropped and a status ``200`` response of ``{"ok": true}`` will be returned.
 
-Any errors will return ``{"errors": ["... descriptive message ..."], "ok": false}``, and a ``400`` status code for a bad input or a ``403`` status code for an authentication or permission error.
+Any errors will use the :ref:`standard error format <json_api_errors>`, with a ``400`` status code for a bad input or a ``403`` status code for an authentication or permission error.
diff --git a/docs/json_api_doc.py b/docs/json_api_doc.py
index 422e67f4..9a4dba23 100644
--- a/docs/json_api_doc.py
+++ b/docs/json_api_doc.py
@@ -46,7 +46,7 @@ def table_extras(cog):
     cog.out("\n")
     for scope, heading, intro, classes in classes_by_scope:
         cog.out("{}\n{}\n\n".format(heading, "~" * len(heading)))
-        cog.out("{}\n\n".format(intro))
+        cog.out(f"{intro}\n\n")
         for cls in classes:
             examples = _examples_for_scope(cls, scope)
             description = cls.description or ""
@@ -58,16 +58,16 @@ def table_extras(cog):
             if notes:
                 description = "{} ({})".format(description, " ".join(notes)).strip()
 
-            cog.out("``{}``\n".format(cls.key()))
-            cog.out("    {}\n\n".format(description))
+            cog.out(f"``{cls.key()}``\n")
+            cog.out(f"    {description}\n\n")
             for example in examples:
                 if example.path:
                     value = live_examples[(example.path, example.key or cls.key())]
-                    cog.out("    ``GET {}``\n\n".format(example.path))
+                    cog.out(f"    ``GET {example.path}``\n\n")
                 else:
                     value = example.value
                 if example.note:
-                    cog.out("    {}\n\n".format(example.note))
+                    cog.out(f"    {example.note}\n\n")
                 cog.out("    .. code-block:: json\n\n")
                 cog.out(textwrap.indent(json.dumps(value, indent=2), "        "))
                 cog.out("\n\n")
@@ -139,7 +139,7 @@ async def _fetch_live_examples(scoped_classes):
                     response = await datasette.client.get(example.path)
                     assert response.status_code == 200, example.path
                     data = response.json()
-                    assert key in data, "{} missing from {}".format(key, example.path)
+                    assert key in data, f"{key} missing from {example.path}"
                     examples[(example.path, key)] = data[key]
         finally:
             for db in datasette.databases.values():
diff --git a/docs/metadata_doc.py b/docs/metadata_doc.py
index 031b3ddd..1bf17f8e 100644
--- a/docs/metadata_doc.py
+++ b/docs/metadata_doc.py
@@ -1,7 +1,8 @@
 import json
 import textwrap
-from yaml import safe_dump
+
 from ruamel.yaml import YAML
+from yaml import safe_dump
 
 
 def metadata_example(cog, data=None, yaml=None):
@@ -33,10 +34,10 @@ def config_example(
     else:
         data = input
         output_yaml = safe_dump(input, sort_keys=False)
-    cog.out("\n.. tab:: {}\n\n".format(yaml_title))
+    cog.out(f"\n.. tab:: {yaml_title}\n\n")
     cog.out("    .. code-block:: yaml\n\n")
     cog.out(textwrap.indent(output_yaml, "        "))
-    cog.out("\n\n.. tab:: {}\n\n".format(json_title))
+    cog.out(f"\n\n.. tab:: {json_title}\n\n")
     cog.out("    .. code-block:: json\n\n")
     cog.out(textwrap.indent(json.dumps(data, indent=2), "        "))
     cog.out("\n")
@@ -44,9 +45,11 @@ def config_example(
 
 def internal_schema(cog):
     import asyncio
-    from datasette.app import Datasette
+
     from sqlite_utils import Database
 
+    from datasette.app import Datasette
+
     ds = Datasette()
     db = ds.get_internal_database()
 
diff --git a/docs/pages.rst b/docs/pages.rst
index ce88be12..65c03a49 100644
--- a/docs/pages.rst
+++ b/docs/pages.rst
@@ -95,7 +95,7 @@ Use the :ref:`ExecuteWriteView` JSON API to execute writable SQL programmaticall
 Stored query browsers
 ---------------------
 
-The ``/-/queries`` page lists stored queries across every database visible to the current actor. The ``/database-name/-/queries`` page lists stored queries for a single database.
+The ``/-/queries`` page lists stored queries across every database visible to the current actor. The ``/database-name/-/queries`` page lists stored queries for a single database. The JSON versions accept ``?_size=`` (default 50, ``max`` for the :ref:`setting_max_returned_rows` limit) and a ``?_next=`` pagination token.
 
 These pages support search, pagination and filters for read-only or writable queries and private or public queries. Adding a ``.json`` extension to either URL returns the same list as JSON.
 
@@ -169,11 +169,13 @@ Use ``/-/schema.json`` to get the same information as JSON, which looks like thi
 .. code-block:: json
 
     {
+      "ok": true,
       "schemas": [
         {
           "database": "content",
           "schema": "create table posts ..."
         }
+      ]
     }
 
 .. _DatabaseSchemaView:
@@ -181,11 +183,11 @@ Use ``/-/schema.json`` to get the same information as JSON, which looks like thi
 Database schema
 ---------------
 
-Use ``/database-name/-/schema`` to see the complete schema for a specific database. The ``.md`` and ``.json`` extensions work here too. The JSON returns an object with ``"database"`` and ``"schema"`` keys.
+Use ``/database-name/-/schema`` to see the complete schema for a specific database. The ``.md`` and ``.json`` extensions work here too. The JSON returns an object with ``"ok"``, ``"database"`` and ``"schema"`` keys.
 
 .. _TableSchemaView:
 
 Table schema
 ------------
 
-Use ``/database-name/table-name/-/schema`` to see the schema for a specific table. The ``.md`` and ``.json`` extensions work here too. The JSON returns an object with ``"database"``, ``"table"``, and ``"schema"`` keys.
+Use ``/database-name/table-name/-/schema`` to see the schema for a specific table. The ``.md`` and ``.json`` extensions work here too. The JSON returns an object with ``"ok"``, ``"database"``, ``"table"``, and ``"schema"`` keys.
diff --git a/docs/plugin_hooks.rst b/docs/plugin_hooks.rst
index d2f87e27..049cb292 100644
--- a/docs/plugin_hooks.rst
+++ b/docs/plugin_hooks.rst
@@ -230,6 +230,10 @@ Function that returns an awaitable function that returns a dictionary
 
 Datasette runs Jinja2 in `async mode <https://jinja.palletsprojects.com/en/2.10.x/api/#async-support>`__, which means you can add awaitable functions to the template scope and they will be automatically awaited when they are rendered by the template.
 
+.. warning::
+
+   Be careful not to accidentally define a variable that conflicts with one that Datasette is already using for something else. Check :ref:`the template context documentation <template_context>` to see the variables defined by Datasette core.
+
 Here's an example plugin that adds a ``"user_agent"`` variable to the template context containing the current request's User-Agent header:
 
 .. code-block:: python
@@ -1681,6 +1685,8 @@ forbidden(datasette, request, message)
 
 Plugins can use this to customize how Datasette responds when a 403 Forbidden error occurs - usually because a page failed a permission check, see :ref:`authentication_permissions`.
 
+Datasette's default behavior returns the :ref:`standard JSON error format <json_api_errors>` with a 403 status when the request path ends in ``.json`` or the request has an ``Accept: application/json`` or ``Content-Type: application/json`` header; other requests get an HTML error page.
+
 If a plugin hook wishes to react to the error, it should return a :ref:`Response object <internals_response>`.
 
 This example returns a redirect to a ``/-/login`` page:
@@ -1964,9 +1970,8 @@ Here is a minimal plugin example that adds a button to a table page and loads Ja
     @hookimpl
     def extra_js_urls(datasette):
         return [
-            datasette.urls.static_plugins(
-                "datasette_show_table",
-                "show-table.js",
+            datasette.static(
+                "show-table.js", plugin="datasette_show_table"
             )
         ]
 
@@ -2541,6 +2546,10 @@ The default ``SignedTokenHandler`` uses itsdangerous signed tokens (``dstok_`` p
 
         async def verify_token(self, datasette, token):
             # Look up token in database, return actor dict or None
+            # if this handler does not recognize the token. Raise
+            # datasette.TokenInvalid for a token this handler
+            # recognizes but rejects (revoked, expired) - Datasette
+            # will respond with a 401 error.
             ...
 
 
diff --git a/docs/plugins.rst b/docs/plugins.rst
index c2eb282a..d32a9fe6 100644
--- a/docs/plugins.rst
+++ b/docs/plugins.rst
@@ -280,6 +280,15 @@ If you run ``datasette plugins --all`` it will include default plugins that ship
                 "query_actions"
             ]
         },
+        {
+            "name": "datasette.default_table_actions",
+            "static": false,
+            "templates": false,
+            "version": null,
+            "hooks": [
+                "table_actions"
+            ]
+        },
         {
             "name": "datasette.events",
             "static": false,
@@ -450,6 +459,8 @@ Secret configuration values
 
 Some plugins may need configuration that should stay secret - API keys for example. There are two ways in which you can store secret configuration values.
 
+The :ref:`/-/config <JsonDataView_config>` introspection endpoint redacts the values of any configuration keys whose names contain one of these substrings: ``secret``, ``key``, ``password``, ``token``, ``hash`` or ``dsn``. Name your plugin's secret configuration keys accordingly - for example ``api_key`` or ``client_secret`` - so they are automatically redacted there.
+
 **As environment variables**. If your secret lives in an environment variable that is available to the Datasette process, you can indicate that the configuration value should be read from that environment variable like so:
 
 .. [[[cog
diff --git a/docs/settings.rst b/docs/settings.rst
index 5cd49113..9c114e4a 100644
--- a/docs/settings.rst
+++ b/docs/settings.rst
@@ -125,6 +125,23 @@ You can increase or decrease this limit like so::
 
     datasette mydatabase.db --setting max_insert_rows 1000
 
+.. _setting_max_post_body_bytes:
+
+max_post_body_bytes
+~~~~~~~~~~~~~~~~~~~
+
+Maximum size in bytes for a POST body that Datasette reads fully into memory, such as JSON submitted to the :ref:`write API <json_api_write>`. Requests with larger bodies are rejected with an HTTP 413 error. Defaults to 2,097,152 (2MB).
+
+This limit exists to protect against memory exhaustion: unlike file uploads handled by ``request.form()``, which stream to disk, these bodies are held entirely in memory and parsing them as JSON can multiply their memory footprint several times over.
+
+If you increase :ref:`setting_max_insert_rows` to support larger bulk inserts you may need to increase this limit as well::
+
+    datasette mydatabase.db --setting max_post_body_bytes 10485760
+
+Set it to 0 to disable the limit entirely::
+
+    datasette mydatabase.db --setting max_post_body_bytes 0
+
 .. _setting_num_sql_threads:
 
 num_sql_threads
diff --git a/docs/sql_queries.rst b/docs/sql_queries.rst
index 371348fb..4c6e4426 100644
--- a/docs/sql_queries.rst
+++ b/docs/sql_queries.rst
@@ -657,7 +657,7 @@ There are three options for specifying that you would like the response to your
 - Include ``?_json=1`` in the URL that you POST to
 - Include ``"_json": 1`` in your JSON body, or ``&_json=1`` in your form encoded body
 
-The JSON response will look like this:
+A successful JSON response will look like this:
 
 .. code-block:: json
 
@@ -667,7 +667,21 @@ The JSON response will look like this:
         "redirect": "/data/add_name"
     }
 
-The ``"message"`` and ``"redirect"`` values here will take into account ``on_success_message``, ``on_success_message_sql``,  ``on_success_redirect``, ``on_error_message`` and ``on_error_redirect``, if they have been set.
+If the SQL fails to execute - for example a constraint violation - the response uses the :ref:`standard error format <json_api_errors>` with a ``400`` status, plus the ``"redirect"`` key from the query configuration:
+
+.. code-block:: json
+
+    {
+        "ok": false,
+        "error": "UNIQUE constraint failed: docs.id",
+        "errors": [
+            "UNIQUE constraint failed: docs.id"
+        ],
+        "status": 400,
+        "redirect": null
+    }
+
+The ``"message"``, ``"error"`` and ``"redirect"`` values here take into account ``on_success_message``, ``on_success_message_sql``, ``on_success_redirect``, ``on_error_message`` and ``on_error_redirect``, if they have been set.
 
 .. _pagination:
 
diff --git a/docs/template_context.rst b/docs/template_context.rst
new file mode 100644
index 00000000..e445b335
--- /dev/null
+++ b/docs/template_context.rst
@@ -0,0 +1,497 @@
+.. _template_context:
+
+Template context
+================
+
+This page documents the variables that are available to custom templates
+for each of Datasette's core pages. See :ref:`customization_custom_templates`
+for how to provide your own templates.
+
+The variables documented here are a stable contract: custom templates that
+use them will continue to work across Datasette releases, up until the next
+major version (Datasette 2.0). Anything present in the template context but
+not documented on this page is not part of that contract and may change or
+be removed in any release.
+
+You can inspect the full context for any page by starting Datasette with
+``--setting template_debug 1`` and adding ``?_context=1`` to the page URL.
+
+.. [[[cog
+    from template_context_doc import template_context
+    template_context(cog)
+.. ]]]
+
+Base context
+------------
+
+These variables are available on every page rendered by Datasette, including pages rendered by plugins that use :ref:`datasette.render_template() <datasette_render_template>`. Plugins can add additional variables using the :ref:`plugin_hook_extra_template_vars` hook.
+
+``request``
+    The current :ref:`Request object <internals_request>`, or None. Common properties include ``request.path``, ``request.args``, ``request.actor``, ``request.url_vars`` and ``request.host``.
+
+``crumb_items``
+    Async function returning breadcrumb navigation items for the current page. Call it with ``request=request`` plus optional ``database=`` and ``table=`` arguments; it returns a list of ``{"href": url, "label": label}`` dictionaries.
+
+``urls``
+    Object with methods for constructing URLs within Datasette. Common methods include ``urls.instance()``, ``urls.database(database)``, ``urls.table(database, table)``, ``urls.query(database, query)``, ``urls.row(database, table, row_path)`` and ``urls.static(path)`` - see :ref:`internals_datasette_urls`.
+
+``actor``
+    The currently authenticated actor dictionary, or None. Actors usually include an ``id`` key and may include any other keys supplied by authentication plugins.
+
+``menu_links``
+    Async function returning links for the Datasette application menu, including links added by plugins. Each item is a link dictionary with ``href`` and ``label`` keys. See :ref:`plugin_hook_menu_links`; for page action menus that can also include JavaScript-backed buttons, see :ref:`plugin_actions`.
+
+``display_actor``
+    Function that accepts an actor dictionary and returns the display string used in the navigation menu.
+
+``show_logout``
+    True if the logout link should be shown in the navigation menu
+
+``zip``
+    Python's ``zip()`` builtin, made available to template logic
+
+``body_scripts``
+    List of JavaScript snippets contributed by plugins using :ref:`plugin_hook_extra_body_script`. Each item is a dictionary with ``script`` containing JavaScript source and ``module`` indicating whether Datasette will wrap it in ``<script type="module">``; otherwise Datasette wraps it in a regular ``<script>`` block.
+
+``format_bytes``
+    Function that accepts a byte count integer and returns a human-readable string such as ``1.2 MB``.
+
+``show_messages``
+    Function returning any messages set for the current user, clearing them in the process. Returns a list of ``(message, type)`` pairs, where ``type`` is one of Datasette's ``INFO``, ``WARNING`` or ``ERROR`` constants.
+
+``extra_css_urls``
+    List of extra CSS stylesheets to include on the page. Each item is a dictionary with ``url`` and optional ``sri`` keys, from plugins and configuration.
+
+``extra_js_urls``
+    List of extra JavaScript URLs to include on the page. Each item is a dictionary with ``url`` plus optional ``sri`` and ``module`` keys, from plugins and configuration.
+
+``base_url``
+    The configured :ref:`setting_base_url` setting
+
+``datasette_version``
+    The version of Datasette that is running
+
+Database page
+-------------
+
+The page listing the tables, views and queries in a database, e.g. /fixtures. Rendered using the ``database.html`` template.
+
+``allow_download`` - ``bool``
+    Boolean indicating if database download is allowed
+
+``allow_execute_sql`` - ``bool``
+    Boolean indicating if custom SQL can be executed
+
+``alternate_url_json`` - ``str``
+    URL for the alternate JSON version of this page
+
+``attached_databases`` - ``list``
+    List of names of databases attached to this SQLite connection. This is only populated for the special ``/_memory`` database when Datasette is started with ``--crossdb`` for :ref:`cross_database_queries`.
+
+``database`` - ``str``
+    The name of the database
+
+``database_actions`` - ``callable``
+    Async callable returning action items for the database menu. Each item is either a link with ``href``, ``label`` and optional ``description`` keys, or a button with ``type: "button"``, ``label``, optional ``description`` and optional ``attrs``. See :ref:`plugin_actions` and :ref:`plugin_hook_database_actions`.
+
+``database_color`` - ``str``
+    The color assigned to the database
+
+``database_page_data`` - ``dict``
+    JSON data used by JavaScript on the database page. Currently ``{}`` or ``{"createTable": {...}}`` where ``createTable`` includes ``path``, ``foreignKeyTargetsPath``, ``databaseName``, ``columnTypes``, ``defaultExpressions``, ``canInsertRows`` and optional ``customColumnTypes``.
+
+``editable`` - ``bool``
+    Boolean indicating if the database is editable
+
+``hidden_count`` - ``int``
+    Count of hidden tables
+
+``metadata`` - ``dict``
+    Metadata dictionary for the database, such as ``title``, ``description``, ``license`` and ``source`` values from Datasette metadata.
+
+``path`` - ``str``
+    The URL path to this database
+
+``private`` - ``bool``
+    Boolean indicating if this is a private database
+
+``queries`` - ``list[StoredQuery]``
+    List of ``StoredQuery`` objects. Each has attributes including ``name``, ``sql``, ``title``, ``description``, ``description_html``, ``hide_sql``, ``fragment``, ``parameters``, ``is_write`` and ``private``.
+
+``queries_count`` - ``int``
+    Count of visible stored queries
+
+``queries_more`` - ``bool``
+    Boolean indicating if more stored queries are available
+
+``select_templates`` - ``list``
+    List of template names that were considered for this page, with the selected template prefixed by ``*``.
+
+``show_hidden`` - ``str``
+    Value of _show_hidden query parameter
+
+``size`` - ``int``
+    The size of the database in bytes
+
+``table_columns`` - ``dict``
+    Dictionary mapping table names to lists of column names, used to power SQL autocomplete.
+
+``tables`` - ``list[DatabaseTable]``
+    List of ``DatabaseTable`` objects describing tables in the database. Each item has ``name``, ``columns``, ``primary_keys``, ``count``, ``count_truncated``, ``hidden``, ``fts_table``, ``foreign_keys`` and ``private`` attributes. ``count_truncated`` is true if ``count`` is a capped lower bound rather than an exact total.
+
+``top_database`` - ``callable``
+    Async callable that renders the ``top_database`` plugin slot for this database and returns HTML.
+
+``views`` - ``list[DatabaseViewInfo]``
+    List of ``DatabaseViewInfo`` objects describing SQLite views in the database. Each item has ``name`` and ``private`` attributes.
+
+Query page
+----------
+
+The page for arbitrary SQL queries (/database/-/query?sql=...) and stored queries (/database/query-name). Rendered using the ``query.html`` template.
+
+``allow_execute_sql`` - ``bool``
+    Boolean indicating if custom SQL can be executed
+
+``alternate_url_json`` - ``str``
+    URL for alternate JSON version of this page
+
+``columns`` - ``list``
+    List of result column names in the order they appear in ``display_rows`` and ``rows``.
+
+``database`` - ``str``
+    The name of the database being queried
+
+``database_color`` - ``str``
+    The color of the database
+
+``db_is_immutable`` - ``bool``
+    Boolean indicating if this database is immutable
+
+``display_rows`` - ``list``
+    List of result rows formatted for HTML display. Each row is a list of rendered cell values in the same order as ``columns``.
+
+``edit_sql_url`` - ``str``
+    URL to edit the SQL for a stored query
+
+``editable`` - ``bool``
+    Boolean indicating if the SQL can be edited
+
+``error`` - ``str``
+    Any query error message
+
+``hide_sql`` - ``bool``
+    Boolean indicating if the SQL should be hidden
+
+``metadata`` - ``dict``
+    Metadata dictionary for the database or stored query. Stored query metadata may include options such as ``hide_sql``, ``on_success_message`` and ``on_error_redirect``.
+
+``named_parameter_values`` - ``dict``
+    Dictionary of named SQL parameter values, keyed by parameter name without the leading ``:``.
+
+``private`` - ``bool``
+    Boolean indicating if this is a private database
+
+``query`` - ``dict``
+    Dictionary describing the SQL query being executed, with ``sql`` and ``params`` keys.
+
+``query_actions`` - ``callable``
+    Async callable returning action items for the query menu. Each item is either a link with ``href``, ``label`` and optional ``description`` keys, or a button with ``type: "button"``, ``label``, optional ``description`` and optional ``attrs``. See :ref:`plugin_actions` and :ref:`plugin_hook_query_actions`.
+
+``renderers`` - ``dict``
+    Dictionary mapping output format names such as ``json`` to URLs for this query in that format.
+
+``save_query_url`` - ``str``
+    URL to save the current arbitrary SQL as a query
+
+``select_templates`` - ``list``
+    List of template names that were considered for this page, with the selected template prefixed by ``*``.
+
+``show_hide_hidden`` - ``str``
+    Rendered hidden ``<input>`` HTML preserving the current ``_hide_sql`` or ``_show_sql`` state.
+
+``show_hide_link`` - ``str``
+    The URL to toggle showing/hiding the SQL
+
+``show_hide_text`` - ``str``
+    The text for the show/hide SQL link
+
+``stored_query`` - ``str``
+    The name of the stored query if this is a stored query
+
+``stored_query_write`` - ``bool``
+    Boolean indicating if this is a stored query that allows writes
+
+``table_columns`` - ``dict``
+    Dictionary mapping table names to lists of column names, used to power SQL autocomplete.
+
+``tables`` - ``list[DatabaseTable]``
+    List of ``DatabaseTable`` objects describing tables in the database. Each item has ``name``, ``columns``, ``primary_keys``, ``count``, ``count_truncated``, ``hidden``, ``fts_table``, ``foreign_keys`` and ``private`` attributes. ``count_truncated`` is true if ``count`` is a capped lower bound rather than an exact total.
+
+``top_query`` - ``callable``
+    Async callable that renders the ``top_query`` plugin slot for this query and returns HTML.
+
+``top_stored_query`` - ``callable``
+    Async callable that renders the ``top_stored_query`` plugin slot for stored queries and returns HTML.
+
+``url_csv`` - ``str``
+    URL for CSV export
+
+Table page
+----------
+
+The page showing the rows in a table or SQL view, e.g. /fixtures/facetable. Rendered using the ``table.html`` template.
+
+Many of these keys are shared with the :ref:`JSON API <json_api>` for this page.
+
+``actions`` - ``callable``
+    Async callable returning table or view actions made available by core and plugin hooks. Each item is either a link with ``href``, ``label`` and optional ``description`` keys, or a button with ``type: "button"``, ``label``, optional ``description`` and optional ``attrs``. See :ref:`plugin_actions`, :ref:`plugin_hook_table_actions` and :ref:`plugin_hook_view_actions`.
+
+``all_columns`` - ``list``
+    List of all column names in the table, regardless of ``_col=`` or ``_nocol=`` filtering.
+
+``allow_execute_sql`` - ``bool``
+    True if the current actor can execute custom SQL against this database
+
+``alternate_url_json`` - ``str``
+    URL for the JSON version of this page
+
+``append_querystring`` - ``callable``
+    Function ``append_querystring(url, querystring)`` that appends additional query string arguments to a URL, using ``?`` or ``&`` as appropriate.
+
+``columns`` - ``list``
+    List of column names returned by this table, row or query.
+
+``count`` - ``int``
+    Total count of rows matching these filters
+
+``count_sql`` - ``str``
+    SQL query string used to calculate the total count for the current table view, including active filters.
+
+``count_truncated`` - ``bool``
+    True if ``count`` is a capped lower bound rather than an exact total, because Datasette stopped counting after its configured row-count limit.
+
+``custom_table_templates`` - ``list``
+    List of custom template names considered for rendering table rows, in lookup order.
+
+``database`` - ``str``
+    Database name
+
+``database_color`` - ``str``
+    Color assigned to the database
+
+``datasette_allow_facet`` - ``str``
+    The string "true" or "false" reflecting the allow_facet setting
+
+``display_columns`` - ``list``
+    Column metadata used by the HTML table display. Each item includes ``name``, ``sortable``, ``is_pk``, ``type``, ``notnull``, ``description``, ``column_type`` and ``column_type_config`` keys.
+
+``display_rows`` - ``list``
+    Rows formatted for the HTML table display. Each row is iterable and contains cell dictionaries with ``column``, ``value``, ``raw`` and ``value_type`` keys; table pages may also provide ``pk_path``, ``row_path`` and ``row_label`` attributes on each row object.
+
+``expandable_columns`` - ``list``
+    List of foreign key columns that can be expanded with labels. Each item is a ``(foreign_key, label_column)`` pair where ``foreign_key`` is the SQLite foreign key dictionary and ``label_column`` is the label column in the referenced table, or ``None``.
+
+``extra_wheres_for_ui`` - ``list``
+    Extra where clauses from ``?_where=`` for display in the UI. Each item has ``text`` for the SQL fragment and ``remove_url`` for a URL that removes that fragment.
+
+``facet_results`` - ``dict``
+    Results of facets calculated against this data. A dictionary with ``results`` and ``timed_out`` keys: ``results`` maps facet names to facet dictionaries with ``name``, ``type``, ``results`` and URL keys, and each facet result item includes ``value``, ``label``, ``count`` and ``toggle_url``.
+
+``facets_timed_out`` - ``list``
+    List of names of facet calculations that exceeded the facet time limit.
+
+``filter_columns`` - ``list``
+    List of column names offered by the filter interface, including currently displayed columns and any hidden columns that can still be filtered.
+
+``filters`` - ``Filters``
+    ``Filters`` object used by the HTML table interface. Useful methods include ``filters.human_description_en()``; this is not JSON serializable.
+
+``fix_path`` - ``callable``
+    Function that applies the configured ``base_url`` prefix to a path.
+
+``form_hidden_args`` - ``list``
+    List of ``(name, value)`` pairs for hidden form fields used by the HTML table interface to preserve current query string options.
+
+``human_description_en`` - ``str``
+    Human-readable description of the filters
+
+``is_sortable`` - ``bool``
+    True if any of the displayed columns can be used to sort
+
+``is_view`` - ``bool``
+    Whether this resource is a view instead of a table
+
+``metadata`` - ``dict``
+    Metadata dictionary for the table, database or stored query. Table and row metadata include a ``columns`` dictionary mapping column names to descriptions; stored query metadata returns the stored query configuration.
+
+``next`` - ``str``
+    Pagination token for the next page, or None
+
+``next_url`` - ``str``
+    Full URL for the next page of results, or None if there are no more pages. See :ref:`json_api_pagination`.
+
+``ok`` - ``bool``
+    True if the data for this page was retrieved without errors
+
+``path_with_replaced_args`` - ``callable``
+    Function for building the current path with modified query string arguments. Pass the current ``request`` and a dictionary of argument names to replacement values, using ``None`` to remove an argument.
+
+``primary_keys`` - ``list``
+    List of primary key column names for this table, or an empty list if the table has no explicit primary key.
+
+``private`` - ``bool``
+    Whether this resource is private to the current actor
+
+``query`` - ``dict``
+    Details of the underlying SQL query as a dictionary with ``sql`` and ``params`` keys.
+
+``query_ms`` - ``float``
+    Time taken by the SQL queries for this page, in milliseconds
+
+``renderers`` - ``dict``
+    Dictionary mapping output format names such as ``json`` or plugin-provided renderer names to URLs for this data in that format.
+
+``rows`` - ``list``
+    The rows for this page, as a list of dictionaries mapping column name to raw value.
+
+``select_templates`` - ``list``
+    List of template names that were considered for this page, with the selected template prefixed by ``*``.
+
+``set_column_type_ui`` - ``dict``
+    Information needed to build an interface for assigning column types, or ``None`` if unavailable. When present it has ``path`` and ``columns`` keys; ``columns`` maps column names to ``current`` and ``options`` values.
+
+``settings`` - ``dict``
+    Dictionary of Datasette's current settings, keyed by setting name.
+
+``sort`` - ``str``
+    Column the page is sorted by, or None
+
+``sort_desc`` - ``str``
+    Column the page is sorted by in descending order, or None
+
+``sorted_facet_results`` - ``list``
+    Facet result dictionaries sorted for display. Each item has the same shape as an entry from ``facet_results['results']``.
+
+``suggested_facets`` - ``list``
+    Suggestions for facets that might return interesting results. Each item is a dictionary with ``name`` and ``toggle_url`` keys, and may include extra keys such as ``type`` or ``label`` depending on the facet class.
+
+``supports_search`` - ``bool``
+    True if this table has full-text search configured
+
+``table`` - ``str``
+    Table name
+
+``table_alter_ui`` - ``dict``
+    Information needed to enable the alter table UI, or ``None`` if altering this table is not available to the current actor. When present it has ``path``, ``tableName``, ``columns``, ``primaryKeys``, ``columnTypes``, ``defaultExpressions`` and ``foreignKeyTargetsPath`` keys, plus optional ``customColumnTypes`` and ``dropPath`` keys.
+
+``table_definition`` - ``str``
+    SQL definition for this table
+
+``table_insert_ui`` - ``dict``
+    Information needed to enable the row insertion UI, or ``None`` if row insertion is not available to the current actor. When present it has ``path``, ``tableName``, ``columns``, ``bulkColumns``, ``primaryKeys`` and ``maxInsertRows`` keys, plus optional ``upsertPath`` if the current actor has permission to update rows. ``columns`` lists columns for the single-row insert form, while ``bulkColumns`` lists columns for the bulk insert form. Each column includes ``name``, ``sqlite_type``, ``notnull``, ``default``, ``has_default``, ``is_pk``, ``is_auto_pk``, ``value_kind`` and ``column_type`` keys.
+
+``table_page_data`` - ``dict``
+    JSON data used by JavaScript on the table page. Includes ``database``, ``table`` and ``tableUrl``, plus optional ``foreignKeys`` mapping column names to autocomplete URLs, optional ``insertRow`` data and optional ``alterTable`` data.
+
+``top_table`` - ``callable``
+    Async callable that renders the ``top_table`` plugin slot for this table or view and returns HTML.
+
+``url_csv`` - ``str``
+    URL for the CSV export of this page
+
+``url_csv_hidden_args`` - ``list``
+    List of ``(name, value)`` pairs for hidden form fields used by the CSV export form, preserving current filters while forcing ``_size=max``.
+
+``url_csv_path`` - ``str``
+    Path portion of the CSV export URL
+
+``view_definition`` - ``str``
+    SQL definition for this view
+
+Row page
+--------
+
+The page showing an individual row, e.g. /fixtures/facetable/1. Rendered using the ``row.html`` template.
+
+Many of these keys are shared with the :ref:`JSON API <json_api>` for this page.
+
+``alternate_url_json`` - ``str``
+    URL for the JSON version of this page
+
+``columns`` - ``list``
+    List of column names returned by this table, row or query.
+
+``custom_table_templates`` - ``list``
+    Custom template names that were considered for displaying this row's table, in lookup order.
+
+``database`` - ``str``
+    Database name
+
+``database_color`` - ``str``
+    Color assigned to the database
+
+``display_columns`` - ``list``
+    Column metadata used by the HTML table display. Each item includes ``name``, ``sortable``, ``is_pk``, ``type``, ``notnull``, ``description``, ``column_type`` and ``column_type_config`` keys.
+
+``display_rows`` - ``list``
+    Rows formatted for the HTML table display. Each row is iterable and contains cell dictionaries with ``column``, ``value``, ``raw`` and ``value_type`` keys.
+
+``foreign_key_tables`` - ``list``
+    List of tables that link to this row using foreign keys. Each item includes the foreign key fields plus ``count`` for matching rows and ``link`` for the filtered table URL.
+
+``metadata`` - ``dict``
+    Metadata dictionary for the table, database or stored query. Table and row metadata include a ``columns`` dictionary mapping column names to descriptions; stored query metadata returns the stored query configuration.
+
+``ok`` - ``bool``
+    True if the data for this page was retrieved without errors
+
+``primary_key_values`` - ``list``
+    Values of the primary keys for this row, from the URL
+
+``primary_keys`` - ``list``
+    List of primary key column names for this table, or an empty list if the table has no explicit primary key.
+
+``private`` - ``bool``
+    Whether this resource is private to the current actor
+
+``query_ms`` - ``float``
+    Time taken by the SQL queries for this page, in milliseconds
+
+``renderers`` - ``dict``
+    Dictionary mapping output format names such as ``json`` to URLs for this row in that format.
+
+``row_actions`` - ``list``
+    Row actions made available by core and plugin hooks. Each item is either a link with ``href``, ``label`` and optional ``description`` keys, or a button with ``type: "button"``, ``label``, optional ``description`` and optional ``attrs``. See :ref:`plugin_actions` and :ref:`plugin_hook_row_actions`.
+
+``row_mutation_ui`` - ``bool``
+    True if the row edit/delete JavaScript UI should be enabled
+
+``rows`` - ``list``
+    A single-item list containing this row as a dictionary mapping column name to raw value.
+
+``select_templates`` - ``list``
+    List of template names that were considered for this page, with the selected template prefixed by ``*``.
+
+``settings`` - ``dict``
+    Dictionary of Datasette's current settings, keyed by setting name.
+
+``table`` - ``str``
+    Table name
+
+``table_page_data`` - ``dict``
+    JSON data used by JavaScript on the row page. Includes ``database``, ``table`` and ``tableUrl``, plus optional ``foreignKeys`` mapping column names to autocomplete URLs.
+
+``top_row`` - ``callable``
+    Async callable that renders the ``top_row`` plugin slot for this row and returns HTML.
+
+``url_csv`` - ``str``
+    URL for the CSV export of this page
+
+``url_csv_hidden_args`` - ``list``
+    List of ``(name, value)`` pairs for hidden form fields used by the CSV export form, preserving current options while forcing ``_size=max``.
+
+``url_csv_path`` - ``str``
+    Path portion of the CSV export URL
+
+.. [[[end]]]
diff --git a/docs/template_context_doc.py b/docs/template_context_doc.py
new file mode 100644
index 00000000..95b8a366
--- /dev/null
+++ b/docs/template_context_doc.py
@@ -0,0 +1,43 @@
+"""
+Cog helpers for generating docs/template_context.rst from the Context
+dataclasses and TEMPLATE_BASE_CONTEXT - same pattern as json_api_doc.py.
+"""
+
+
+def template_context(cog):
+    from datasette.app import TEMPLATE_BASE_CONTEXT
+    from datasette.template_contexts import PAGES
+
+    cog.out("\n")
+    _section(
+        cog,
+        "Base context",
+        (
+            "These variables are available on every page rendered by "
+            "Datasette, including pages rendered by plugins that use "
+            ":ref:`datasette.render_template() <datasette_render_template>`. "
+            "Plugins can add additional variables using the "
+            ":ref:`plugin_hook_extra_template_vars` hook."
+        ),
+    )
+    for name, doc in TEMPLATE_BASE_CONTEXT.items():
+        cog.out(f"``{name}``\n")
+        cog.out(f"    {doc}\n\n")
+
+    for klass in PAGES.values():
+        title = "{} page".format(klass.__name__.removesuffix("Context"))
+        intro = f"{klass.__doc__} Rendered using the ``{klass.documented_template}`` template."
+        _section(cog, title, intro)
+        if klass.extras_scope is not None:
+            cog.out(
+                "Many of these keys are shared with the :ref:`JSON API "
+                "<json_api>` for this page.\n\n"
+            )
+        for f in sorted(klass.documented_fields(), key=lambda f: f.name):
+            cog.out(f"``{f.name}`` - ``{f.type_name}``\n")
+            cog.out(f"    {f.help}\n\n")
+
+
+def _section(cog, title, intro):
+    cog.out("{}\n{}\n\n".format(title, "-" * len(title)))
+    cog.out(f"{intro}\n\n")
diff --git a/docs/writing_plugins.rst b/docs/writing_plugins.rst
index cd165a3f..d1e5e75a 100644
--- a/docs/writing_plugins.rst
+++ b/docs/writing_plugins.rst
@@ -145,7 +145,16 @@ If your plugin has a ``static/`` directory, Datasette will automatically configu
 
     /-/static-plugins/NAME_OF_PLUGIN_PACKAGE/yourfile.js
 
-Use the ``datasette.urls.static_plugins(plugin_name, path)`` method to generate URLs to that asset that take the ``base_url`` setting into account, see :ref:`internals_datasette_urls`.
+Use the ``datasette.static(path, plugin=plugin_name)`` method to generate
+cache-busting URLs to those assets that take the ``base_url`` setting into
+account, see :ref:`datasette_static`.
+
+This can also be used from plugin templates as the ``static()`` template
+function:
+
+.. code-block:: html+jinja
+
+    <script src="{{ static('plugin.js', plugin='datasette_plugin_name') }}" defer></script>
 
 To bundle the static assets for a plugin in the package that you publish to PyPI, add the following to the plugin's ``setup.py``:
 
diff --git a/pyproject.toml b/pyproject.toml
index a19dc957..cf5db905 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -35,10 +35,11 @@ dependencies = [
     "PyYAML>=5.3",
     "mergedeep>=1.1.1",
     "itsdangerous>=1.1",
-    "sqlite-utils>=3.30",
+    "sqlite-utils>=4.0",
     "asyncinject>=0.7",
     "setuptools",
     "pip",
+    "pydantic>=2",
 ]
 
 [project.urls]
@@ -68,7 +69,7 @@ dev = [
     "trustme>=0.7",
     "cogapp>=3.3.0",
     "multipart-form-data-conformance==0.1a0",
-    "ruff>=0.9",
+    "ruff>=0.16.0",
     # docs
     "Sphinx==7.4.7",
     "furo==2025.9.25",
@@ -101,9 +102,5 @@ datasette = ["templates/*.html"]
 [tool.setuptools.dynamic]
 version = {attr = "datasette.version.__version__"}
 
-[tool.ruff]
-line-length = 160
-select = ["E", "F", "W"]
-
 [tool.uv]
 package = true
diff --git a/ruff.toml b/ruff.toml
index 74447a8c..3c4345bf 100644
--- a/ruff.toml
+++ b/ruff.toml
@@ -1,2 +1,7 @@
 line-length = 160
-target-version = "py310"
\ No newline at end of file
+target-version = "py310"
+
+[lint.flake8-bugbear]
+# from_extra() returns a dataclasses.field(), so it is safe as a dataclass
+# default - ruff cannot see through the wrapper (RUF009)
+extend-immutable-calls = ["datasette.views.from_extra"]
\ No newline at end of file
diff --git a/test-in-pyodide-with-shot-scraper.sh b/test-in-pyodide-with-shot-scraper.sh
index 4d1c4968..8d7fa08e 100755
--- a/test-in-pyodide-with-shot-scraper.sh
+++ b/test-in-pyodide-with-shot-scraper.sh
@@ -1,40 +1,37 @@
 #!/bin/bash
-set -e
-# So the script fails if there are any errors
+set -euo pipefail
+
+read -r -a PYTHON_CMD <<< "${PYTHON:-python3}"
+read -r -a SHOT_SCRAPER_CMD <<< "${SHOT_SCRAPER:-shot-scraper}"
 
 # Build the wheel
-python3 -m build
+"${PYTHON_CMD[@]}" -m build
 
-# Find name of wheel, strip off the dist/
-wheel=$(basename $(ls dist/*.whl) | head -n 1)
+# Find name of most recently built wheel, strip off the dist/
+wheel=$(basename "$(ls -t dist/*.whl | head -n 1)")
 
 # Create a blank index page
 echo '
-<script src="https://cdn.jsdelivr.net/pyodide/v0.20.0/full/pyodide.js"></script>
+<script src="https://cdn.jsdelivr.net/pyodide/v314.0.0/full/pyodide.js"></script>
 ' > dist/index.html
 
 # Run a server for that dist/ folder
-cd dist
-python3 -m http.server 8529 &
-cd ..
+"${PYTHON_CMD[@]}" -m http.server 8529 --directory dist &
+server_pid=$!
 
 # Register the kill_server function to be called on script exit
 kill_server() {
-  pkill -f 'http.server 8529'
+  kill "$server_pid" 2>/dev/null || true
 }
 trap kill_server EXIT
 
 
-shot-scraper javascript http://localhost:8529/ "
+"${SHOT_SCRAPER_CMD[@]}" javascript http://localhost:8529/ "
 async () => {
   let pyodide = await loadPyodide();
-  await pyodide.loadPackage(['micropip', 'ssl', 'setuptools']);
+  await pyodide.loadPackage(['micropip', 'setuptools']);
   let output = await pyodide.runPythonAsync(\`
     import micropip
-    await micropip.install('h11==0.12.0')
-    await micropip.install('httpx==0.23')
-    # To avoid 'from typing_extensions import deprecated' error:
-    await micropip.install('typing-extensions>=4.12.2')
     await micropip.install('http://localhost:8529/$wheel')
     import ssl
     import setuptools
diff --git a/tests/conftest.py b/tests/conftest.py
index 55110a42..a2e6aba2 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -1,14 +1,17 @@
-import httpx
+import importlib.metadata
 import os
 import pathlib
-import pytest
-import pytest_asyncio
 import re
 import subprocess
 import sys
 import tempfile
 import time
 from dataclasses import dataclass
+
+import httpx
+import pytest
+import pytest_asyncio
+
 from datasette import Event, hookimpl
 
 try:
@@ -37,7 +40,7 @@ def wait_until_responds(url, timeout=5.0, client=httpx, **kwargs):
             return
         except httpx.ConnectError:
             time.sleep(0.1)
-    raise AssertionError("Timed out waiting for {} to respond".format(url))
+    raise AssertionError(f"Timed out waiting for {url} to respond")
 
 
 @pytest.fixture
@@ -53,10 +56,12 @@ def bare_ds():
 
 @pytest_asyncio.fixture(scope="session")
 async def ds_client():
+    import secrets
+
     from datasette.app import Datasette
     from datasette.database import Database
+
     from .fixtures import CONFIG, METADATA, PLUGINS_DIR
-    import secrets
 
     ds = Datasette(
         metadata=METADATA,
@@ -93,7 +98,11 @@ def pytest_report_header(config):
     conn = sqlite3.connect(":memory:")
     version = conn.execute("select sqlite_version()").fetchone()[0]
     conn.close()
-    headers = ["SQLite: {}".format(version)]
+    sqlite_utils_version = importlib.metadata.version("sqlite-utils")
+    headers = [
+        f"SQLite: {version}",
+        f"sqlite-utils: {sqlite_utils_version}",
+    ]
     if config.getoption("--playwright"):
         try:
             browsers = config.getoption("--browser")
@@ -170,8 +179,8 @@ def restore_working_directory(tmpdir, request):
 
 @pytest.fixture(scope="session", autouse=True)
 def check_actions_are_documented():
-    from datasette.plugins import pm
     from datasette.default_actions import register_actions as default_register_actions
+    from datasette.plugins import pm
 
     content = (
         pathlib.Path(__file__).parent.parent / "docs" / "authentication.rst"
@@ -197,7 +206,7 @@ def check_actions_are_documented():
             if kwargs["action"] in core_actions:
                 assert (
                     action in documented_actions
-                ), "Undocumented permission action: {}".format(action)
+                ), f"Undocumented permission action: {action}"
 
     pm.add_hookcall_monitoring(
         before=before, after=lambda outcome, hook_name, hook_impls, kwargs: None
@@ -255,8 +264,12 @@ def ds_unix_domain_socket_server(tmp_path_factory):
     # This used to use tmp_path_factory.mktemp("uds") but that turned out to
     # produce paths that were too long to use as UDS on macOS, see
     # https://github.com/simonw/datasette/issues/1407 - so I switched to
-    # using tempfile.gettempdir()
-    uds = str(pathlib.Path(tempfile.gettempdir()) / "datasette.sock")
+    # using tempfile.gettempdir() with a per-process filename.
+    uds = str(pathlib.Path(tempfile.gettempdir()) / f"datasette-{os.getpid()}.sock")
+    try:
+        os.unlink(uds)
+    except FileNotFoundError:
+        pass
     ds_proc = subprocess.Popen(
         [sys.executable, "-m", "datasette", "--memory", "--uds", uds],
         stdout=subprocess.PIPE,
@@ -266,16 +279,31 @@ def ds_unix_domain_socket_server(tmp_path_factory):
     # Poll until available
     transport = httpx.HTTPTransport(uds=uds)
     client = httpx.Client(transport=transport)
-    wait_until_responds("http://localhost/_memory.json", client=client)
-    # Check it started successfully
-    assert not ds_proc.poll(), ds_proc.stdout.read().decode("utf-8")
-    yield ds_proc, uds
-    # Shut it down at the end of the pytest session
-    ds_proc.terminate()
+    try:
+        wait_until_responds(
+            "http://localhost/_memory.json", timeout=30.0, client=client
+        )
+        # Check it started successfully
+        assert not ds_proc.poll(), ds_proc.stdout.read().decode("utf-8")
+        yield ds_proc, uds
+    finally:
+        client.close()
+        # Shut it down at the end of the pytest session
+        ds_proc.terminate()
+        try:
+            ds_proc.wait(timeout=5)
+        except subprocess.TimeoutExpired:
+            ds_proc.kill()
+            ds_proc.wait()
+        try:
+            os.unlink(uds)
+        except FileNotFoundError:
+            pass
 
 
 # Import fixtures from fixtures.py to make them available
-from .fixtures import (  # noqa: E402, F401
+from .fixtures import (  # noqa: F401
+    TEMP_PLUGIN_SECRET_FILE,
     app_client,
     app_client_base_url_prefix,
     app_client_conflicting_database_names,
@@ -292,5 +320,4 @@ from .fixtures import (  # noqa: E402, F401
     app_client_with_dot,
     app_client_with_trace,
     make_app_client,
-    TEMP_PLUGIN_SECRET_FILE,
 )
diff --git a/tests/fixtures.py b/tests/fixtures.py
index 8ab3633f..83607c1a 100644
--- a/tests/fixtures.py
+++ b/tests/fixtures.py
@@ -1,3 +1,13 @@
+import contextlib
+import json
+import os
+import pathlib
+import tempfile
+import textwrap
+
+import click
+import pytest
+
 from datasette.app import Datasette
 from datasette.fixtures import (
     EXTRA_DATABASE_SQL,
@@ -5,14 +15,6 @@ from datasette.fixtures import (
     write_fixture_database,
 )
 from datasette.utils.testing import TestClient
-import click
-import contextlib
-import json
-import os
-import pathlib
-import pytest
-import tempfile
-import textwrap
 
 # This temp file is used by one of the plugin config tests
 TEMP_PLUGIN_SECRET_FILE = os.path.join(tempfile.gettempdir(), "plugin-secret")
diff --git a/tests/plugins/my_plugin.py b/tests/plugins/my_plugin.py
index c89ad0a3..baf20a77 100644
--- a/tests/plugins/my_plugin.py
+++ b/tests/plugins/my_plugin.py
@@ -1,16 +1,16 @@
 import asyncio
-from datasette import hookimpl
-from datasette.facets import Facet
-from datasette.tokens import TokenHandler
-from datasette import tracer
-from datasette.permissions import Action
-from datasette.resources import DatabaseResource
-from datasette.utils import path_with_added_args
-from datasette.utils.asgi import asgi_send_json, Response
 import base64
 import json
 import urllib.parse
 
+from datasette import hookimpl, tracer
+from datasette.facets import Facet
+from datasette.permissions import Action
+from datasette.resources import DatabaseResource
+from datasette.tokens import TokenHandler
+from datasette.utils import path_with_added_args
+from datasette.utils.asgi import Response, asgi_send_json
+
 
 @hookimpl
 def prepare_connection(conn, database, datasette):
@@ -305,11 +305,7 @@ def startup(datasette):
     datasette._startup_hook_fired = True
 
     # And test some import shortcuts too
-    from datasette import Response
-    from datasette import Forbidden
-    from datasette import NotFound
-    from datasette import hookimpl
-    from datasette import actor_matches_allow
+    from datasette import Forbidden, NotFound, Response, actor_matches_allow, hookimpl
 
     _ = (Response, Forbidden, NotFound, hookimpl, actor_matches_allow)
 
@@ -373,7 +369,7 @@ def table_actions(datasette, database, table, actor, request):
                     "label": "Plugin button",
                     "description": "Runs JavaScript from a plugin",
                     "attrs": {
-                        "aria-label": "Plugin button for {}".format(table),
+                        "aria-label": f"Plugin button for {table}",
                         "data-plugin-action": "plugin-button",
                         "data-database": database,
                         "data-table": table,
diff --git a/tests/plugins/my_plugin_2.py b/tests/plugins/my_plugin_2.py
index 864637a6..26e45a5b 100644
--- a/tests/plugins/my_plugin_2.py
+++ b/tests/plugins/my_plugin_2.py
@@ -1,8 +1,10 @@
+import json
+from functools import wraps
+
+import markupsafe
+
 from datasette import hookimpl
 from datasette.utils.asgi import Response
-from functools import wraps
-import markupsafe
-import json
 
 
 @hookimpl
@@ -33,11 +35,7 @@ def render_cell(value, database):
     if set(data.keys()) != {"href", "label"}:
         return None
     href = data["href"]
-    if not (
-        href.startswith("/")
-        or href.startswith("http://")
-        or href.startswith("https://")
-    ):
+    if not (href.startswith(("/", "http://", "https://"))):
         return None
     return markupsafe.Markup(
         '<a data-database="{database}" href="{href}">{label}</a>'.format(
@@ -54,7 +52,7 @@ def extra_template_vars(template, database, table, view_name, request, datasette
     datasette._last_request = request
 
     async def query_database(sql):
-        first_db = list(datasette.databases.keys())[0]
+        first_db = next(iter(datasette.databases.keys()))
         return (await datasette.execute(first_db, sql)).rows[0][0]
 
     async def inner():
@@ -172,10 +170,10 @@ def register_routes(datasette):
     path = config["path"]
 
     def new_table(request):
-        return Response.text("/db/table: {}".format(sorted(request.url_vars.items())))
+        return Response.text(f"/db/table: {sorted(request.url_vars.items())}")
 
     return [
-        (r"/{}/$".format(path), lambda: Response.text(path.upper())),
+        (rf"/{path}/$", lambda: Response.text(path.upper())),
         # Also serves to demonstrate over-ride of default paths:
         (r"/(?P<db_name>[^/]+)/(?P<table_and_format>[^/]+?$)", new_table),
     ]
diff --git a/tests/plugins/register_output_renderer.py b/tests/plugins/register_output_renderer.py
index cfe15215..671f2d1e 100644
--- a/tests/plugins/register_output_renderer.py
+++ b/tests/plugins/register_output_renderer.py
@@ -1,6 +1,7 @@
+import json
+
 from datasette import hookimpl
 from datasette.utils.asgi import Response
-import json
 
 
 async def can_render(
@@ -18,9 +19,7 @@ async def can_render(
         "request": request,
         "view_name": view_name,
     }
-    if request.args.get("_no_can_render"):
-        return False
-    return True
+    return not request.args.get("_no_can_render")
 
 
 async def render_test_all_parameters(
diff --git a/tests/plugins/sleep_sql_function.py b/tests/plugins/sleep_sql_function.py
index d4b32a09..2fca1d66 100644
--- a/tests/plugins/sleep_sql_function.py
+++ b/tests/plugins/sleep_sql_function.py
@@ -1,6 +1,7 @@
-from datasette import hookimpl
 import time
 
+from datasette import hookimpl
+
 
 @hookimpl
 def prepare_connection(conn):
diff --git a/tests/test_actions_sql.py b/tests/test_actions_sql.py
index a1fca971..76320bd1 100644
--- a/tests/test_actions_sql.py
+++ b/tests/test_actions_sql.py
@@ -10,10 +10,11 @@ These tests verify:
 
 import pytest
 import pytest_asyncio
+
+from datasette import hookimpl
 from datasette.app import Datasette
 from datasette.permissions import PermissionSQL
 from datasette.resources import DatabaseResource, QueryResource, TableResource
-from datasette import hookimpl
 
 
 def test_resource_string_representations():
@@ -90,7 +91,7 @@ async def test_allowed_resources_global_allow(test_ds):
         assert all(isinstance(t, TableResource) for t in tables)
 
         # Check specific tables are present
-        table_set = set((t.parent, t.child) for t in tables)
+        table_set = {(t.parent, t.child) for t in tables}
         assert ("analytics", "events") in table_set
         assert ("analytics", "users") in table_set
         assert ("analytics", "sensitive") in table_set
diff --git a/tests/test_actor_restriction_bug.py b/tests/test_actor_restriction_bug.py
index 0bfc9e1e..6e633ff6 100644
--- a/tests/test_actor_restriction_bug.py
+++ b/tests/test_actor_restriction_bug.py
@@ -6,6 +6,7 @@ config allow blocks can bypass table-level restrictions.
 """
 
 import pytest
+
 from datasette.app import Datasette
 from datasette.resources import TableResource
 
diff --git a/tests/test_allowed_many.py b/tests/test_allowed_many.py
index 08b952fb..2f20e8e8 100644
--- a/tests/test_allowed_many.py
+++ b/tests/test_allowed_many.py
@@ -10,6 +10,8 @@ Layer 3: table/database views precompute all registered actions before
 
 import pytest
 import pytest_asyncio
+
+from datasette import hookimpl
 from datasette.app import Datasette
 from datasette.permissions import (
     Action,
@@ -18,7 +20,6 @@ from datasette.permissions import (
     _permission_check_cache,
 )
 from datasette.resources import DatabaseResource, TableResource
-from datasette import hookimpl
 
 
 class CountingRulesPlugin:
@@ -114,7 +115,7 @@ async def test_allowed_not_memoized_without_cache(counting_ds):
 async def test_cache_keyed_on_full_actor_identity(counting_ds):
     """Interleaved checks for different actors never share cache entries."""
     # Uses drop-table because default permissions deny it to non-root actors
-    ds, plugin = counting_ds
+    ds, _plugin = counting_ds
     resource = TableResource("analytics", "users")
     token = _permission_check_cache.set({})
     try:
@@ -180,7 +181,7 @@ async def test_cache_keyed_on_resource(counting_ds):
 
 @pytest.mark.asyncio
 async def test_skip_permission_checks_bypasses_cache(counting_ds):
-    ds, plugin = counting_ds
+    ds, _plugin = counting_ds
     resource = TableResource("analytics", "users")
     token = _permission_check_cache.set({})
     try:
diff --git a/tests/test_allowed_resources.py b/tests/test_allowed_resources.py
index e247aa78..e251deab 100644
--- a/tests/test_allowed_resources.py
+++ b/tests/test_allowed_resources.py
@@ -7,9 +7,10 @@ based on permission rules from plugins and configuration.
 
 import pytest
 import pytest_asyncio
+
+from datasette import hookimpl
 from datasette.app import Datasette
 from datasette.permissions import PermissionSQL
-from datasette import hookimpl
 
 
 # Test plugin that provides permission rules
diff --git a/tests/test_api.py b/tests/test_api.py
index f57d0206..76c30e46 100644
--- a/tests/test_api.py
+++ b/tests/test_api.py
@@ -1,12 +1,15 @@
+import pathlib
+import urllib
+
+import pytest
+
 from datasette.app import Datasette
 from datasette.plugins import DEFAULT_PLUGINS
+from datasette.utils import UNSTABLE_API_MESSAGE, escape_sqlite, tilde_encode
 from datasette.utils.sqlite import sqlite_version
 from datasette.version import __version__
-from .fixtures import make_app_client, EXPECTED_PLUGINS
-import pathlib
-import pytest
-import sys
-import urllib
+
+from .fixtures import EXPECTED_PLUGINS, make_app_client
 
 
 @pytest.mark.asyncio
@@ -15,7 +18,7 @@ async def test_homepage(ds_client):
     assert response.status_code == 200
     assert "application/json; charset=utf-8" == response.headers["content-type"]
     data = response.json()
-    assert sorted(list(data.get("metadata").keys())) == [
+    assert sorted(data.get("metadata").keys()) == [
         "about",
         "about_url",
         "description_html",
@@ -26,8 +29,9 @@ async def test_homepage(ds_client):
         "title",
     ]
     databases = data.get("databases")
-    assert databases.keys() == {"fixtures": 0}.keys()
-    d = databases["fixtures"]
+    assert isinstance(databases, list)
+    assert [d["name"] for d in databases] == ["fixtures"]
+    d = databases[0]
     assert d["name"] == "fixtures"
     assert isinstance(d["tables_count"], int)
     assert isinstance(len(d["tables_and_views_truncated"]), int)
@@ -42,8 +46,7 @@ async def test_homepage_sort_by_relationships(ds_client):
     response = await ds_client.get("/.json?_sort=relationships")
     assert response.status_code == 200
     tables = [
-        t["name"]
-        for t in response.json()["databases"]["fixtures"]["tables_and_views_truncated"]
+        t["name"] for t in response.json()["databases"][0]["tables_and_views_truncated"]
     ]
     assert tables == [
         "simple_primary_key",
@@ -250,8 +253,10 @@ def test_no_files_uses_memory_database(app_client_no_files):
     response = app_client_no_files.get("/.json")
     assert response.status == 200
     assert {
-        "databases": {
-            "_memory": {
+        "ok": True,
+        "unstable": UNSTABLE_API_MESSAGE,
+        "databases": [
+            {
                 "name": "_memory",
                 "hash": None,
                 "color": "a6c7b9",
@@ -266,7 +271,7 @@ def test_no_files_uses_memory_database(app_client_no_files):
                 "views_count": 0,
                 "private": False,
             },
-        },
+        ],
         "metadata": {},
     } == response.json
     # Try that SQL query
@@ -323,20 +328,15 @@ def test_sql_time_limit(app_client_shorter_time_limit):
         "/fixtures/-/query.json?sql=select+sleep(0.5)",
     )
     assert 400 == response.status
+    expected_message = (
+        "SQL query took too long. The time limit is"
+        " controlled by the sql_time_limit_ms setting."
+    )
     assert response.json == {
         "ok": False,
-        "error": (
-            "<p>SQL query took too long. The time limit is controlled by the\n"
-            '<a href="https://docs.datasette.io/en/stable/settings.html#sql-time-limit-ms">sql_time_limit_ms</a>\n'
-            "configuration option.</p>\n"
-            '<textarea style="width: 90%">select sleep(0.5)</textarea>\n'
-            "<script>\n"
-            'let ta = document.querySelector("textarea");\n'
-            'ta.style.height = ta.scrollHeight + "px";\n'
-            "</script>"
-        ),
+        "error": expected_message,
+        "errors": [expected_message],
         "status": 400,
-        "title": "SQL Interrupted",
     }
 
 
@@ -350,7 +350,7 @@ async def test_custom_sql_time_limit(ds_client):
         "/fixtures/-/query.json?sql=select+sleep(0.01)&_timelimit=5",
     )
     assert response.status_code == 400
-    assert response.json()["title"] == "SQL Interrupted"
+    assert response.json()["error"].startswith("SQL query took too long.")
 
 
 @pytest.mark.asyncio
@@ -371,6 +371,38 @@ async def test_row(ds_client):
     assert response.json()["rows"] == [{"id": 1, "content": "hello"}]
 
 
+@pytest.mark.asyncio
+@pytest.mark.parametrize("suffix", ("", ".json"))
+@pytest.mark.parametrize(
+    "row_path",
+    (
+        "a",  # too few components for a two-column primary key
+        "a,b,c",  # too many components for a two-column primary key
+    ),
+)
+async def test_row_pk_arity_mismatch_returns_400(ds_client, row_path, suffix):
+    # A row URL with the wrong number of comma-separated primary key
+    # components used to raise an uncaught sqlite3.ProgrammingError (HTTP 500)
+    # because the SQL had one bind placeholder per PK column but params were
+    # only bound for the supplied components. It should be a 400 instead,
+    # mirroring the existing guard in datasette/views/table.py.
+    response = await ds_client.get(f"/fixtures/compound_primary_key/{row_path}{suffix}")
+    assert response.status_code == 400
+    if suffix == ".json":
+        assert response.json()["ok"] is False
+        assert response.json()["status"] == 400
+
+
+@pytest.mark.asyncio
+async def test_row_compound_pk_correct_arity(ds_client):
+    # The valid two-component URL still resolves the row.
+    response = await ds_client.get(
+        "/fixtures/compound_primary_key/a,b.json?_shape=objects"
+    )
+    assert response.status_code == 200
+    assert response.json()["rows"] == [{"pk1": "a", "pk2": "b", "content": "c"}]
+
+
 @pytest.mark.asyncio
 async def test_row_strange_table_name(ds_client):
     response = await ds_client.get(
@@ -429,7 +461,7 @@ async def test_row_foreign_key_tables(ds_client):
 @pytest.mark.asyncio
 async def test_row_extras(ds_client):
     response = await ds_client.get(
-        "/fixtures/simple_primary_key/1.json?_extra=database,table,primary_keys,query,request,debug,foreign_key_tables"
+        "/fixtures/simple_primary_key/1.json?_extra=database,table,primary_keys,query,request,debug,foreign_key_tables,column_details"
     )
     assert response.status_code == 200
     data = response.json()
@@ -446,6 +478,45 @@ async def test_row_extras(ds_client):
         "format": "json",
     }
     assert len(data["foreign_key_tables"]) == 5
+    id_detail = data["column_details"]["id"]
+    assert id_detail["type"].lower() == "integer"
+    assert id_detail == {
+        "type": id_detail["type"],
+        "sqlite_type": "INTEGER",
+        "notnull": False,
+        "default": None,
+        "is_pk": True,
+        "pk_position": 1,
+        "hidden": 0,
+    }
+    content_detail = data["column_details"]["content"]
+    assert content_detail["type"].lower() == "text"
+    assert content_detail == {
+        "type": content_detail["type"],
+        "sqlite_type": "TEXT",
+        "notnull": False,
+        "default": None,
+        "is_pk": False,
+        "pk_position": 0,
+        "hidden": 0,
+    }
+
+
+@pytest.mark.asyncio
+async def test_column_details_extra_row_for_null_blob(ds_client):
+    response = await ds_client.get("/fixtures/binary_data/3.json?_extra=column_details")
+    assert response.status_code == 200
+    data_detail = response.json()["column_details"]["data"]
+    assert data_detail["type"].lower() == "blob"
+    assert data_detail == {
+        "type": data_detail["type"],
+        "sqlite_type": "BLOB",
+        "notnull": False,
+        "default": None,
+        "is_pk": False,
+        "pk_position": 0,
+        "hidden": 0,
+    }
 
 
 @pytest.mark.asyncio
@@ -507,7 +578,7 @@ async def test_row_extra_render_cell():
 
 def test_databases_json(app_client_two_attached_databases_one_immutable):
     response = app_client_two_attached_databases_one_immutable.get("/-/databases.json")
-    databases = response.json
+    databases = response.json["databases"]
     assert 2 == len(databases)
     extra_database, fixtures_database = databases
     assert "extra database" == extra_database["name"]
@@ -523,10 +594,13 @@ def test_databases_json(app_client_two_attached_databases_one_immutable):
 
 @pytest.mark.asyncio
 async def test_threads_json(ds_client):
-    response = await ds_client.get("/-/threads.json")
-    expected_keys = {"threads", "num_threads"}
-    if sys.version_info >= (3, 7, 0):
-        expected_keys.update({"tasks", "num_tasks"})
+    ds_client.ds.root_enabled = True
+    try:
+        response = await ds_client.get("/-/threads.json", actor={"id": "root"})
+    finally:
+        ds_client.ds.root_enabled = False
+    expected_keys = {"ok", "threads", "num_threads"}
+    expected_keys.update({"tasks", "num_tasks"})
     data = response.json()
     assert set(data.keys()) == expected_keys
     # Should be at least one _execute_writes thread for __INTERNAL__
@@ -577,7 +651,7 @@ async def test_actions_json(ds_client):
     try:
         ds_client.ds.root_enabled = True
         response = await ds_client.get("/-/actions.json", actor={"id": "root"})
-        data = response.json()
+        data = response.json()["actions"]
     finally:
         ds_client.ds.root_enabled = original_root_enabled
     assert isinstance(data, list)
@@ -609,6 +683,7 @@ async def test_actions_json(ds_client):
 async def test_settings_json(ds_client):
     response = await ds_client.get("/-/settings.json")
     assert response.json() == {
+        "ok": True,
         "default_page_size": 50,
         "default_facet_size": 30,
         "default_allow_sql": True,
@@ -616,6 +691,7 @@ async def test_settings_json(ds_client):
         "facet_time_limit_ms": 200,
         "max_returned_rows": 100,
         "max_insert_rows": 100,
+        "max_post_body_bytes": 2 * 1024 * 1024,
         "sql_time_limit_ms": 200,
         "allow_download": True,
         "allow_signed_tokens": True,
@@ -677,7 +753,7 @@ def test_config_cache_size(app_client_larger_cache_size):
 def test_config_force_https_urls():
     with make_app_client(settings={"force_https_urls": True}) as client:
         response = client.get(
-            "/fixtures/facetable.json?_size=3&_facet=state&_extra=next_url,suggested_facets"
+            "/fixtures/facetable.json?_size=3&_facet=state&_extra=suggested_facets"
         )
         assert response.json["next_url"].startswith("https://")
         assert response.json["facet_results"]["results"]["state"]["results"][0][
@@ -772,7 +848,9 @@ def test_common_prefix_database_names(app_client_conflicting_database_names):
     # https://github.com/simonw/datasette/issues/597
     assert ["foo-bar", "foo", "fixtures"] == [
         d["name"]
-        for d in app_client_conflicting_database_names.get("/-/databases.json").json
+        for d in app_client_conflicting_database_names.get("/-/databases.json").json[
+            "databases"
+        ]
     ]
     for db_name, path in (("foo", "/foo.json"), ("foo-bar", "/foo-bar.json")):
         data = app_client_conflicting_database_names.get(path).json
@@ -843,13 +921,41 @@ async def test_tilde_encoded_database_names(db_name):
     ds = Datasette()
     ds.add_memory_database(db_name)
     response = await ds.client.get("/.json")
-    assert db_name in response.json()["databases"].keys()
-    path = response.json()["databases"][db_name]["path"]
+    databases_by_name = {d["name"]: d for d in response.json()["databases"]}
+    assert db_name in databases_by_name
+    path = databases_by_name[db_name]["path"]
     # And the JSON for that database
     response2 = await ds.client.get(path + ".json")
     assert response2.status_code == 200
 
 
+@pytest.mark.asyncio
+@pytest.mark.parametrize("table_name", ("[foo]", "foo]", "[foo]/bar"))
+async def test_table_with_reserved_characters_in_name(table_name):
+    # Table names containing characters such as "]" that cannot be escaped
+    # using SQLite [bracket] quoting used to break schema introspection and
+    # the table page - https://github.com/simonw/datasette/issues/2431
+    ds = Datasette()
+    db = ds.add_memory_database("test_reserved_table_names")
+    await db.execute_write(
+        f"create table {escape_sqlite(table_name)} (id integer primary key, name text)"
+    )
+    await db.execute_write(
+        f"insert into {escape_sqlite(table_name)} (id, name) values (1, 'one')"
+    )
+    # Schema introspection (populate_schema_tables) must not crash:
+    db_response = await ds.client.get("/test_reserved_table_names.json")
+    assert db_response.status_code == 200
+    tables = {t["name"]: t for t in db_response.json()["tables"]}
+    assert tables[table_name]["count"] == 1
+    # And the table page itself must load and return the row:
+    table_response = await ds.client.get(
+        f"/test_reserved_table_names/{tilde_encode(table_name)}.json?_shape=array"
+    )
+    assert table_response.status_code == 200
+    assert table_response.json() == [{"id": 1, "name": "one"}]
+
+
 @pytest.mark.asyncio
 @pytest.mark.parametrize(
     "config,expected",
@@ -883,7 +989,7 @@ async def test_config_json(config, expected):
     "/-/config.json should return redacted configuration"
     ds = Datasette(config=config)
     response = await ds.client.get("/-/config.json")
-    assert response.json() == expected
+    assert response.json() == {"ok": True, **expected}
 
 
 @pytest.mark.asyncio
@@ -979,7 +1085,7 @@ async def test_config_json(config, expected):
 async def test_upgrade_metadata(metadata, expected_config, expected_metadata):
     ds = Datasette(metadata=metadata)
     response = await ds.client.get("/-/config.json")
-    assert response.json() == expected_config
+    assert response.json() == {"ok": True, **expected_config}
     response2 = await ds.client.get("/-/metadata.json")
     assert response2.json() == expected_metadata
 
diff --git a/tests/test_api_write.py b/tests/test_api_write.py
index b7ceb6b2..7801d0a3 100644
--- a/tests/test_api_write.py
+++ b/tests/test_api_write.py
@@ -1,9 +1,25 @@
-from datasette.app import Datasette
-from datasette.utils import sqlite3
-from .utils import last_event
-import pytest
 import time
 
+import pytest
+
+from datasette.app import Datasette
+from datasette.events import RenameTableEvent
+from datasette.utils import error_body, escape_sqlite, sqlite3
+
+from .utils import last_event
+
+
+def assert_schema_contains(fragment, schema):
+    assert (
+        fragment in schema
+    ), f"Expected schema to contain {fragment!r}, got {schema!r}"
+
+
+def assert_schema_not_contains(fragment, schema):
+    assert (
+        fragment not in schema
+    ), f"Expected schema not to contain {fragment!r}, got {schema!r}"
+
 
 @pytest.fixture
 def ds_write(tmp_path_factory):
@@ -34,11 +50,149 @@ def write_token(ds, actor_id="root", permissions=None):
 
 def _headers(token):
     return {
-        "Authorization": "Bearer {}".format(token),
+        "Authorization": f"Bearer {token}",
         "Content-Type": "application/json",
     }
 
 
+def _insert_and_fetch_created(conn, table, insert_sql):
+    cursor = conn.execute(insert_sql)
+    return conn.execute(
+        f"select created, typeof(created) from {escape_sqlite(table)} where rowid = ?",
+        (cursor.lastrowid,),
+    ).fetchone()
+
+
+BASE64_WRITE_API_VALUE = {"$base64": True, "encoded": "AAEC/f7/"}
+BASE64_WRITE_API_LITERAL = '{"$base64": true, "encoded": "AAEC/f7/"}'
+
+
+@pytest.mark.asyncio
+async def test_base64_write_api_create_table_infers_blob_and_raw_escapes(ds_write):
+    token = write_token(ds_write)
+    response = await ds_write.client.post(
+        "/data/-/create",
+        json={
+            "table": "binary_create",
+            "row": {
+                "id": 1,
+                "data": BASE64_WRITE_API_VALUE,
+                "literal": {"$raw": BASE64_WRITE_API_VALUE},
+                "double_raw": {"$raw": {"$raw": BASE64_WRITE_API_VALUE}},
+            },
+            "pk": "id",
+        },
+        headers=_headers(token),
+    )
+    assert response.status_code == 201
+    assert_schema_contains('"data" BLOB', response.json()["schema"])
+    assert_schema_contains('"literal" TEXT', response.json()["schema"])
+
+    rows = (await ds_write.get_database("data").execute("""
+            select
+              typeof(data) as data_type,
+              hex(data) as data_hex,
+              typeof(literal) as literal_type,
+              literal,
+              typeof(double_raw) as double_raw_type,
+              double_raw
+            from binary_create
+            """)).dicts()
+    assert rows == [
+        {
+            "data_type": "blob",
+            "data_hex": "000102FDFEFF",
+            "literal_type": "text",
+            "literal": BASE64_WRITE_API_LITERAL,
+            "double_raw_type": "text",
+            "double_raw": '{"$raw": {"$base64": true, "encoded": "AAEC/f7/"}}',
+        }
+    ]
+
+
+@pytest.mark.asyncio
+async def test_base64_write_api_insert_upsert_update_decode_blobs(ds_write):
+    token = write_token(ds_write)
+    db = ds_write.get_database("data")
+    await db.execute_write(
+        "create table binary_api (id integer primary key, data blob, literal text)"
+    )
+
+    insert_response = await ds_write.client.post(
+        "/data/binary_api/-/insert",
+        json={
+            "row": {
+                "id": 1,
+                "data": BASE64_WRITE_API_VALUE,
+                "literal": {"$raw": BASE64_WRITE_API_VALUE},
+            }
+        },
+        headers=_headers(token),
+    )
+    assert insert_response.status_code == 201
+    assert insert_response.json()["rows"][0]["data"] == BASE64_WRITE_API_VALUE
+
+    upsert_response = await ds_write.client.post(
+        "/data/binary_api/-/upsert",
+        json={
+            "rows": [
+                {
+                    "id": 2,
+                    "data": BASE64_WRITE_API_VALUE,
+                    "literal": {"$raw": BASE64_WRITE_API_VALUE},
+                }
+            ]
+        },
+        headers=_headers(token),
+    )
+    assert upsert_response.status_code == 200
+    assert upsert_response.json() == {"ok": True}
+
+    update_response = await ds_write.client.post(
+        "/data/binary_api/1/-/update",
+        json={
+            "update": {
+                "data": {"$base64": True, "encoded": "/wAB"},
+                "literal": {"$raw": {"$raw": BASE64_WRITE_API_VALUE}},
+            },
+            "return": True,
+        },
+        headers=_headers(token),
+    )
+    assert update_response.status_code == 200
+    assert update_response.json()["rows"][0]["data"] == {
+        "$base64": True,
+        "encoded": "/wAB",
+    }
+
+    rows = (await db.execute("""
+            select
+              id,
+              typeof(data) as data_type,
+              hex(data) as data_hex,
+              typeof(literal) as literal_type,
+              literal
+            from binary_api
+            order by id
+            """)).dicts()
+    assert rows == [
+        {
+            "id": 1,
+            "data_type": "blob",
+            "data_hex": "FF0001",
+            "literal_type": "text",
+            "literal": '{"$raw": {"$base64": true, "encoded": "AAEC/f7/"}}',
+        },
+        {
+            "id": 2,
+            "data_type": "blob",
+            "data_hex": "000102FDFEFF",
+            "literal_type": "text",
+            "literal": BASE64_WRITE_API_LITERAL,
+        },
+    ]
+
+
 @pytest.mark.asyncio
 async def test_api_explorer_upsert_example_json(ds_write):
     response = await ds_write.client.get("/-/api", actor={"id": "root"})
@@ -88,7 +242,7 @@ async def test_insert_row(ds_write, content_type):
         "/data/docs/-/insert",
         json={"row": {"title": "Test", "score": 1.2, "age": 5}},
         headers={
-            "Authorization": "Bearer {}".format(token),
+            "Authorization": f"Bearer {token}",
             "Content-Type": content_type,
         },
     )
@@ -133,11 +287,7 @@ async def test_insert_row_alter(ds_write):
 @pytest.mark.parametrize("return_rows", (True, False))
 async def test_insert_rows(ds_write, return_rows):
     token = write_token(ds_write)
-    data = {
-        "rows": [
-            {"title": "Test {}".format(i), "score": 1.0, "age": 5} for i in range(20)
-        ]
-    }
+    data = {"rows": [{"title": f"Test {i}", "score": 1.0, "age": 5} for i in range(20)]}
     if return_rows:
         data["return"] = True
     response = await ds_write.client.post(
@@ -161,14 +311,41 @@ async def test_insert_rows(ds_write, return_rows):
     ).dicts()
     assert len(actual_rows) == 20
     assert actual_rows == [
-        {"id": i + 1, "title": "Test {}".format(i), "score": 1.0, "age": 5}
-        for i in range(20)
+        {"id": i + 1, "title": f"Test {i}", "score": 1.0, "age": 5} for i in range(20)
     ]
     assert response.json()["ok"] is True
     if return_rows:
         assert response.json()["rows"] == actual_rows
 
 
+@pytest.mark.asyncio
+async def test_insert_rows_post_body_too_large(tmp_path_factory):
+    db_path = str(tmp_path_factory.mktemp("dbs") / "data.db")
+    conn = sqlite3.connect(db_path)
+    conn.execute("create table docs (id integer primary key, title text)")
+    conn.close()
+    ds = Datasette([db_path], settings={"max_post_body_bytes": 100})
+    ds.root_enabled = True
+    token = write_token(ds)
+    response = await ds.client.post(
+        "/data/docs/-/insert",
+        json={"rows": [{"title": "x" * 200}]},
+        headers=_headers(token),
+    )
+    assert response.status_code == 413
+    assert response.json() == error_body(
+        ["Request body exceeded maximum size of 100 bytes"], 413
+    )
+    # A small body should still work
+    response2 = await ds.client.post(
+        "/data/docs/-/insert",
+        json={"row": {"title": "hi"}},
+        headers=_headers(token),
+    )
+    assert response2.status_code == 201
+    ds.close()
+
+
 @pytest.mark.asyncio
 @pytest.mark.parametrize(
     "path,input,special_case,expected_status,expected_errors",
@@ -191,8 +368,8 @@ async def test_insert_rows(ds_write, return_rows):
             "/data/docs/-/insert",
             {"rows": [{"title": "Test"} for i in range(10)]},
             "bad_token",
-            403,
-            ["Permission denied"],
+            401,
+            ["Invalid token signature"],
         ),
         (
             "/data/docs/-/insert",
@@ -203,13 +380,6 @@ async def test_insert_rows(ds_write, return_rows):
                 "Invalid JSON: Expecting property name enclosed in double quotes: line 1 column 2 (char 1)"
             ],
         ),
-        (
-            "/data/docs/-/insert",
-            {},
-            "invalid_content_type",
-            400,
-            ["Invalid content-type, must be application/json"],
-        ),
         (
             "/data/docs/-/insert",
             [],
@@ -387,24 +557,21 @@ async def test_insert_or_upsert_row_errors(
         )
     if special_case == "bad_token":
         token += "bad"
-    kwargs = dict(
-        json=input,
-        headers={
-            "Authorization": "Bearer {}".format(token),
-            "Content-Type": (
-                "text/plain"
-                if special_case == "invalid_content_type"
-                else "application/json"
-            ),
+    kwargs = {
+        "json": input,
+        "headers": {
+            "Authorization": f"Bearer {token}",
+            "Content-Type": "application/json",
         },
-    )
+    }
 
-    actor_response = (
-        await ds_write.client.get("/-/actor.json", headers=kwargs["headers"])
-    ).json()
-    assert set((actor_response["actor"] or {}).get("_r", {}).get("a") or []) == set(
-        token_permissions
-    )
+    if special_case != "bad_token":
+        actor_response = (
+            await ds_write.client.get("/-/actor.json", headers=kwargs["headers"])
+        ).json()
+        assert set((actor_response["actor"] or {}).get("_r", {}).get("a") or []) == set(
+            token_permissions
+        )
 
     if special_case == "invalid_json":
         del kwargs["json"]
@@ -451,7 +618,7 @@ async def test_upsert_permissions_per_table(ds_write, allowed):
         "/data/docs/-/upsert",
         json={"rows": [{"id": 1, "title": "One"}]},
         headers={
-            "Authorization": "Bearer {}".format(token),
+            "Authorization": f"Bearer {token}",
         },
     )
     if allowed:
@@ -688,9 +855,7 @@ async def test_delete_row(ds_write, table, row_for_create, pks, delete_path):
     # Should be a single row
     assert (
         await ds_write.client.get(
-            "/data/-/query.json?_shape=arrayfirst&sql=select+count(*)+from+{}".format(
-                table
-            )
+            f"/data/-/query.json?_shape=arrayfirst&sql=select+count(*)+from+{table}"
         )
     ).json() == [1]
     # Now delete the row
@@ -698,14 +863,12 @@ async def test_delete_row(ds_write, table, row_for_create, pks, delete_path):
         # Special case for that rowid table
         delete_path = (
             await ds_write.client.get(
-                "/data/-/query.json?_shape=arrayfirst&sql=select+rowid+from+{}".format(
-                    table
-                )
+                f"/data/-/query.json?_shape=arrayfirst&sql=select+rowid+from+{table}"
             )
         ).json()[0]
 
     delete_response = await ds_write.client.post(
-        "/data/{}/{}/-/delete".format(table, delete_path),
+        f"/data/{table}/{delete_path}/-/delete",
         headers=_headers(write_token(ds_write)),
     )
     assert delete_response.status_code == 200
@@ -718,9 +881,7 @@ async def test_delete_row(ds_write, table, row_for_create, pks, delete_path):
     assert event.pks == str(delete_path).split(",")
     assert (
         await ds_write.client.get(
-            "/data/-/query.json?_shape=arrayfirst&sql=select+count(*)+from+{}".format(
-                table
-            )
+            f"/data/-/query.json?_shape=arrayfirst&sql=select+count(*)+from+{table}"
         )
     ).json() == [0]
 
@@ -770,21 +931,26 @@ async def test_update_row_invalid_key(ds_write):
 
     pk = await _insert_row(ds_write)
 
-    path = "/data/docs/{}/-/update".format(pk)
+    path = f"/data/docs/{pk}/-/update"
     response = await ds_write.client.post(
         path,
         json={"update": {"title": "New title"}, "bad_key": 1},
         headers=_headers(token),
     )
     assert response.status_code == 400
-    assert response.json() == {"ok": False, "errors": ["Invalid keys: bad_key"]}
+    assert response.json() == {
+        "ok": False,
+        "error": "Invalid keys: bad_key",
+        "errors": ["Invalid keys: bad_key"],
+        "status": 400,
+    }
 
 
 @pytest.mark.asyncio
 async def test_update_row_alter(ds_write):
     token = write_token(ds_write, permissions=["ur", "at"])
     pk = await _insert_row(ds_write)
-    path = "/data/docs/{}/-/update".format(pk)
+    path = f"/data/docs/{pk}/-/update"
     response = await ds_write.client.post(
         path,
         json={"update": {"title": "New title", "extra": "extra"}, "alter": True},
@@ -794,6 +960,607 @@ async def test_update_row_alter(ds_write):
     assert response.json() == {"ok": True}
 
 
+@pytest.mark.asyncio
+async def test_alter_table_operations(ds_write):
+    token = write_token(ds_write, permissions=["at"])
+    db = ds_write.get_database("data")
+    before_schema = await db.execute_fn(
+        lambda conn: conn.execute(
+            "select sql from sqlite_master where type = 'table' and name = 'docs'"
+        ).fetchone()[0]
+    )
+
+    response = await ds_write.client.post(
+        "/data/docs/-/alter",
+        json={
+            "operations": [
+                {
+                    "op": "add_column",
+                    "args": {
+                        "name": "slug",
+                        "type": "text",
+                        "not_null": True,
+                        "default": "",
+                    },
+                },
+                {
+                    "op": "add_column",
+                    "args": {
+                        "name": "created",
+                        "type": "text",
+                        "default_expr": "current_timestamp",
+                    },
+                },
+                {
+                    "op": "add_column",
+                    "args": {
+                        "name": "literal_default",
+                        "type": "text",
+                        "default": "hello)",
+                    },
+                },
+                {"op": "rename_column", "args": {"name": "title", "to": "headline"}},
+                {
+                    "op": "alter_column",
+                    "args": {"name": "age", "type": "text", "default": "0"},
+                },
+                {"op": "drop_column", "args": {"name": "score"}},
+                {
+                    "op": "reorder_columns",
+                    "args": {
+                        "columns": [
+                            "id",
+                            "headline",
+                            "slug",
+                            "created",
+                            "literal_default",
+                            "age",
+                        ]
+                    },
+                },
+                {"op": "set_primary_key", "args": {"columns": ["id"]}},
+            ]
+        },
+        headers=_headers(token),
+    )
+
+    assert response.status_code == 200, response.text
+    data = response.json()
+    assert data["ok"] is True
+    assert data["database"] == "data"
+    assert data["table"] == "docs"
+    assert data["altered"] is True
+    assert data["operations_applied"] == 8
+    assert data["before_schema"] == before_schema
+    assert "headline" in data["schema"]
+    assert "score" not in data["schema"]
+    assert "DEFAULT CURRENT_TIMESTAMP" in data["schema"]
+    assert "DEFAULT 'hello)'" in data["schema"]
+
+    columns = (
+        await db.execute("select * from pragma_table_info('docs') order by cid")
+    ).dicts()
+    assert [column["name"] for column in columns] == [
+        "id",
+        "headline",
+        "slug",
+        "created",
+        "literal_default",
+        "age",
+    ]
+    assert columns[0]["pk"] == 1
+    assert columns[2]["notnull"] == 1
+    assert columns[2]["dflt_value"] == "''"
+    assert columns[3]["dflt_value"] == "CURRENT_TIMESTAMP"
+    assert columns[4]["dflt_value"] == "'hello)'"
+    assert columns[5]["type"] == "TEXT"
+    assert columns[5]["dflt_value"] == "'0'"
+
+    event = last_event(ds_write)
+    assert event.name == "alter-table"
+    assert event.database == "data"
+    assert event.table == "docs"
+    assert event.before_schema == before_schema
+    assert event.after_schema == data["schema"]
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "default_expr,minimum_value,expected_schema",
+    (
+        (
+            "current_unixtime",
+            1_600_000_000,
+            "strftime('%s', 'now')",
+        ),
+        (
+            "current_unixtime_ms",
+            1_600_000_000_000,
+            "julianday('now')",
+        ),
+    ),
+)
+async def test_alter_table_integer_default_expr(
+    ds_write, default_expr, minimum_value, expected_schema
+):
+    token = write_token(ds_write, permissions=["at"])
+    db = ds_write.get_database("data")
+    response = await ds_write.client.post(
+        "/data/docs/-/alter",
+        json={
+            "operations": [
+                {
+                    "op": "add_column",
+                    "args": {
+                        "name": "created",
+                        "type": "integer",
+                        "default_expr": default_expr,
+                    },
+                }
+            ]
+        },
+        headers=_headers(token),
+    )
+    assert response.status_code == 200, response.text
+    data = response.json()
+    assert expected_schema in data["schema"]
+
+    columns = await db.execute("select * from pragma_table_info('docs')")
+    created_column = next(
+        column for column in columns.dicts() if column["name"] == "created"
+    )
+    assert created_column["type"] == "INTEGER"
+    assert expected_schema in created_column["dflt_value"]
+
+    row = await db.execute_write_fn(
+        lambda conn: _insert_and_fetch_created(
+            conn, "docs", "insert into docs (title) values ('with default')"
+        )
+    )
+    assert row[0] > minimum_value
+    assert row[1] == "integer"
+
+
+@pytest.mark.asyncio
+async def test_alter_table_rename_table(ds_write):
+    token = write_token(ds_write, permissions=["at"])
+    db = ds_write.get_database("data")
+    before_schema = await db.execute_fn(
+        lambda conn: conn.execute(
+            "select sql from sqlite_master where type = 'table' and name = 'docs'"
+        ).fetchone()[0]
+    )
+
+    response = await ds_write.client.post(
+        "/data/docs/-/alter",
+        json={
+            "operations": [
+                {"op": "rename_table", "args": {"to": "documents"}},
+            ]
+        },
+        headers=_headers(token),
+    )
+
+    assert response.status_code == 200, response.text
+    data = response.json()
+    assert data["ok"] is True
+    assert data["database"] == "data"
+    assert data["table"] == "documents"
+    assert data["table_url"].endswith("/data/documents")
+    assert data["table_api_url"].endswith("/data/documents.json")
+    assert data["altered"] is True
+    assert data["operations_applied"] == 1
+    assert data["before_schema"] == before_schema
+    assert 'CREATE TABLE "documents"' in data["schema"]
+
+    tables = (
+        await db.execute(
+            "select name from sqlite_master where type = 'table' order by name"
+        )
+    ).dicts()
+    table_names = [table["name"] for table in tables]
+    assert "docs" not in table_names
+    assert "documents" in table_names
+
+    rename_events = [
+        event
+        for event in ds_write._tracked_events
+        if isinstance(event, RenameTableEvent)
+    ]
+    assert len(rename_events) == 1
+    assert rename_events[0].database == "data"
+    assert rename_events[0].old_table == "docs"
+    assert rename_events[0].new_table == "documents"
+
+
+@pytest.mark.asyncio
+async def test_alter_table_foreign_key_operations(ds_write):
+    token = write_token(ds_write, permissions=["at"])
+    db = ds_write.get_database("data")
+    await db.execute_write("create table owners (id integer primary key)")
+    await db.execute_write("create table categories (id integer primary key)")
+
+    response = await ds_write.client.post(
+        "/data/docs/-/alter",
+        json={
+            "operations": [
+                {"op": "add_column", "args": {"name": "owner_id", "type": "integer"}},
+                {
+                    "op": "add_foreign_key",
+                    "args": {"column": "owner_id", "fk_table": "owners"},
+                },
+            ]
+        },
+        headers=_headers(token),
+    )
+    assert response.status_code == 200, response.text
+    data = response.json()
+    assert data["operations_applied"] == 2
+    assert_schema_contains(
+        '"owner_id" INTEGER REFERENCES "owners"("id")', data["schema"]
+    )
+
+    response = await ds_write.client.post(
+        "/data/docs/-/alter",
+        json={
+            "operations": [{"op": "drop_foreign_key", "args": {"column": "owner_id"}}]
+        },
+        headers=_headers(token),
+    )
+    assert response.status_code == 200, response.text
+    data = response.json()
+    assert_schema_not_contains('"owner_id" INTEGER REFERENCES', data["schema"])
+
+    response = await ds_write.client.post(
+        "/data/docs/-/alter",
+        json={
+            "operations": [
+                {
+                    "op": "set_foreign_keys",
+                    "args": {
+                        "foreign_keys": [
+                            {
+                                "column": "owner_id",
+                                "fk_table": "categories",
+                                "fk_column": "id",
+                            }
+                        ]
+                    },
+                }
+            ]
+        },
+        headers=_headers(token),
+    )
+    assert response.status_code == 200, response.text
+    data = response.json()
+    assert_schema_contains(
+        '"owner_id" INTEGER REFERENCES "categories"("id")', data["schema"]
+    )
+
+    response = await ds_write.client.post(
+        "/data/docs/-/alter",
+        json={"operations": [{"op": "set_foreign_keys", "args": {"foreign_keys": []}}]},
+        headers=_headers(token),
+    )
+    assert response.status_code == 200, response.text
+    data = response.json()
+    assert_schema_not_contains('"owner_id" INTEGER REFERENCES', data["schema"])
+
+
+@pytest.mark.asyncio
+async def test_alter_table_foreign_key_requires_fk_table_for_fk_column(ds_write):
+    response = await ds_write.client.post(
+        "/data/docs/-/alter",
+        json={
+            "operations": [
+                {
+                    "op": "add_foreign_key",
+                    "args": {"column": "age", "fk_column": "id"},
+                }
+            ]
+        },
+        headers=_headers(write_token(ds_write, permissions=["at"])),
+    )
+    assert response.status_code == 400
+    assert response.json() == error_body(
+        ["operations.0.add_foreign_key.args: fk_column requires fk_table"], 400
+    )
+
+
+@pytest.mark.asyncio
+async def test_alter_table_foreign_key_without_fk_column_requires_single_pk(ds_write):
+    token = write_token(ds_write, permissions=["at"])
+    db = ds_write.get_database("data")
+    await db.execute_write(
+        "create table accounts (tenant_id integer, id integer, primary key (tenant_id, id))"
+    )
+
+    response = await ds_write.client.post(
+        "/data/docs/-/alter",
+        json={
+            "operations": [
+                {
+                    "op": "add_foreign_key",
+                    "args": {"column": "age", "fk_table": "accounts"},
+                }
+            ]
+        },
+        headers=_headers(token),
+    )
+    assert response.status_code == 400
+    assert response.json() == error_body(
+        ["Could not detect single primary key for table 'accounts'"], 400
+    )
+
+
+@pytest.mark.asyncio
+async def test_foreign_key_suggestions(ds_write):
+    token = write_token(ds_write, permissions=["at"])
+    db = ds_write.get_database("data")
+    await db.execute_write("create table owners (id integer primary key)")
+    await db.execute_write("insert into owners (id) values (1), (2), (3)")
+    await db.execute_write("create table categories (slug text primary key)")
+    await db.execute_write("insert into categories (slug) values ('one'), ('two')")
+    await db.execute_write("create table numbers (id integer primary key)")
+    await db.execute_write("insert into numbers (id) values (10), (20)")
+    await db.execute_write("create table weights (id real primary key)")
+    await db.execute_write("insert into weights (id) values (1.5), (2.5)")
+    await db.execute_write(
+        "insert into docs (id, title, score, age) values "
+        "(1, 'one', 1.5, 1), (2, 'two', 999.5, 2), (3, null, null, null)"
+    )
+
+    response = await ds_write.client.get(
+        "/data/docs/-/foreign-key-suggestions",
+        headers=_headers(token),
+    )
+    assert response.status_code == 200, response.text
+    data = response.json()
+    assert data["ok"] is True
+    assert data["database"] == "data"
+    assert data["table"] == "docs"
+    assert data["row_check"]["attempted"] is True
+    assert data["row_check"]["status"] == "completed"
+    assert data["row_check"]["row_limit"] == 500
+    assert data["row_check"]["sampled_rows"] == 3
+
+    columns = {column["column"]: column for column in data["columns"]}
+    assert columns["age"]["options"] == [
+        {"fk_table": "numbers", "fk_column": "id", "type": "INTEGER"},
+        {"fk_table": "owners", "fk_column": "id", "type": "INTEGER"},
+    ]
+    assert columns["age"]["suggestions"] == [
+        {
+            "fk_table": "owners",
+            "fk_column": "id",
+            "confidence": "sampled",
+            "sampled_values": 2,
+            "reasons": ["type_match", "sample_values_exist"],
+        }
+    ]
+    assert columns["title"]["options"] == [
+        {"fk_table": "categories", "fk_column": "slug", "type": "TEXT"}
+    ]
+    assert columns["title"]["suggestions"][0]["fk_table"] == "categories"
+    assert columns["score"]["options"] == [
+        {"fk_table": "weights", "fk_column": "id", "type": "REAL"}
+    ]
+    assert columns["score"]["suggestions"] == []
+
+
+@pytest.mark.asyncio
+async def test_foreign_key_suggestions_permission_denied(ds_write):
+    token = write_token(ds_write, permissions=["ir"])
+    response = await ds_write.client.get(
+        "/data/docs/-/foreign-key-suggestions",
+        headers=_headers(token),
+    )
+    assert response.status_code == 403
+    assert response.json() == error_body(["Permission denied: need alter-table"], 403)
+
+
+@pytest.mark.asyncio
+async def test_foreign_key_suggestions_fail_open(ds_write, monkeypatch):
+    token = write_token(ds_write, permissions=["at"])
+    db = ds_write.get_database("data")
+    await db.execute_write("create table owners (id integer primary key)")
+
+    async def raise_timeout(*args, **kwargs):
+        raise table_create_alter.ForeignKeySuggestionTimedOut
+
+    from datasette.views import table_create_alter
+
+    monkeypatch.setattr(
+        table_create_alter,
+        "_foreign_key_suggestion_samples",
+        raise_timeout,
+    )
+
+    response = await ds_write.client.get(
+        "/data/docs/-/foreign-key-suggestions",
+        headers=_headers(token),
+    )
+    assert response.status_code == 200, response.text
+    data = response.json()
+    assert data["row_check"]["status"] == "timed_out"
+    columns = {column["column"]: column for column in data["columns"]}
+    assert columns["age"]["options"] == [
+        {"fk_table": "owners", "fk_column": "id", "type": "INTEGER"}
+    ]
+    assert columns["age"]["suggestions"] == []
+
+
+@pytest.mark.asyncio
+async def test_foreign_key_targets(ds_write):
+    token = write_token(ds_write, permissions=["ct"])
+    db = ds_write.get_database("data")
+    await db.execute_write("create table owners (id integer primary key)")
+    await db.execute_write("create table categories (slug varchar(30) primary key)")
+    await db.execute_write("create table blob_things (hash blob primary key)")
+    await db.execute_write(
+        "create table numeric_codes (code decimal(10,5) primary key)"
+    )
+    await db.execute_write(
+        'create table floating_point (value "FLOATING POINT" primary key)'
+    )
+    await db.execute_write(
+        "create table compound (a integer, b integer, primary key (a, b))"
+    )
+    await db.execute_write("create table no_pk (name text)")
+    try:
+        await db.execute_write("create virtual table search_docs using fts5(body)")
+    except Exception:  # noqa: BLE001, S110
+        # FTS5 is not available in every SQLite build
+        pass
+
+    response = await ds_write.client.get(
+        "/data/-/foreign-key-targets",
+        headers=_headers(token),
+    )
+    assert response.status_code == 200, response.text
+    assert response.json() == {
+        "ok": True,
+        "database": "data",
+        "targets": [
+            {
+                "fk_table": "blob_things",
+                "fk_column": "hash",
+                "type": "blob",
+            },
+            {
+                "fk_table": "categories",
+                "fk_column": "slug",
+                "type": "text",
+            },
+            {
+                "fk_table": "docs",
+                "fk_column": "id",
+                "type": "integer",
+            },
+            {
+                "fk_table": "floating_point",
+                "fk_column": "value",
+                "type": "integer",
+            },
+            {
+                "fk_table": "numeric_codes",
+                "fk_column": "code",
+                "type": "numeric",
+            },
+            {
+                "fk_table": "owners",
+                "fk_column": "id",
+                "type": "integer",
+            },
+        ],
+    }
+    assert not any(
+        target["fk_table"].startswith("search_docs_")
+        for target in response.json()["targets"]
+    )
+
+
+@pytest.mark.asyncio
+async def test_foreign_key_targets_permission_denied(ds_write):
+    token = write_token(ds_write, permissions=["ir"])
+    response = await ds_write.client.get(
+        "/data/-/foreign-key-targets",
+        headers=_headers(token),
+    )
+    assert response.status_code == 403
+    assert response.json() == error_body(["Permission denied: need create-table"], 403)
+
+
+@pytest.mark.asyncio
+async def test_foreign_key_targets_allowed_for_alter_table(ds_write):
+    token = write_token(ds_write, permissions=["at"])
+    response = await ds_write.client.get(
+        "/data/-/foreign-key-targets?table=docs",
+        headers=_headers(token),
+    )
+    assert response.status_code == 200, response.text
+    assert response.json()["ok"] is True
+
+
+@pytest.mark.asyncio
+async def test_alter_table_permission_denied(ds_write):
+    token = write_token(ds_write, permissions=["ir"])
+    response = await ds_write.client.post(
+        "/data/docs/-/alter",
+        json={"operations": [{"op": "add_column", "args": {"name": "slug"}}]},
+        headers=_headers(token),
+    )
+    assert response.status_code == 403
+    assert response.json() == error_body(["Permission denied: need alter-table"], 403)
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "body,expected_error",
+    (
+        (
+            {
+                "dry_run": True,
+                "operations": [
+                    {"op": "add_column", "args": {"name": "slug", "type": "text"}}
+                ],
+            },
+            "dry_run: Extra inputs are not permitted",
+        ),
+        (
+            {"operations": [{"op": "add_column", "args": {"type": "text"}}]},
+            "operations.0.add_column.args.name: Field required",
+        ),
+        (
+            {
+                "operations": [
+                    {"op": "add_column", "args": {"name": "x", "type": "bad"}}
+                ]
+            },
+            "operations.0.add_column.args.type: Input should be 'text', 'integer', 'float' or 'blob'",
+        ),
+        (
+            {
+                "operations": [
+                    {
+                        "op": "add_column",
+                        "args": {
+                            "name": "x",
+                            "default_expr": "datetime('now')",
+                        },
+                    }
+                ]
+            },
+            "operations.0.add_column.args.default_expr: Input should be 'current_timestamp', 'current_date', 'current_time', 'current_unixtime' or 'current_unixtime_ms'",
+        ),
+        (
+            {
+                "operations": [
+                    {
+                        "op": "add_column",
+                        "args": {
+                            "name": "x",
+                            "default": "x",
+                            "default_expr": "current_timestamp",
+                        },
+                    }
+                ]
+            },
+            "operations.0.add_column.args: Value error, default and default_expr cannot both be provided",
+        ),
+    ),
+)
+async def test_alter_table_validation_errors(ds_write, body, expected_error):
+    response = await ds_write.client.post(
+        "/data/docs/-/alter",
+        json=body,
+        headers=_headers(write_token(ds_write, permissions=["at"])),
+    )
+    assert response.status_code == 400
+    assert response.json()["ok"] is False
+    assert response.json()["errors"] == [expected_error]
+
+
 @pytest.mark.asyncio
 async def test_execute_write_form_parameter_called_sql():
     ds = Datasette(memory=True, default_deny=True)
@@ -849,7 +1616,7 @@ async def test_update_row(ds_write, input, expected_errors, use_return):
     token = write_token(ds_write)
     pk = await _insert_row(ds_write)
 
-    path = "/data/docs/{}/-/update".format(pk)
+    path = f"/data/docs/{pk}/-/update"
 
     data = {"update": input}
     if use_return:
@@ -868,9 +1635,9 @@ async def test_update_row(ds_write, input, expected_errors, use_return):
 
     assert response.json()["ok"] is True
     if not use_return:
-        assert "row" not in response.json()
+        assert "rows" not in response.json()
     else:
-        returned_row = response.json()["row"]
+        returned_row = response.json()["rows"][0]
         assert returned_row["id"] == pk
         for k, v in input.items():
             assert returned_row[k] == v
@@ -884,7 +1651,7 @@ async def test_update_row(ds_write, input, expected_errors, use_return):
 
     # And fetch the row to check it's updated
     response = await ds_write.client.get(
-        "/data/docs/{}.json?_shape=array".format(pk),
+        f"/data/docs/{pk}.json?_shape=array",
     )
     assert response.status_code == 200
     row = response.json()[0]
@@ -1005,12 +1772,12 @@ async def test_drop_table(ds_write, scenario):
                 "table_url": "http://localhost/data/one",
                 "table_api_url": "http://localhost/data/one.json",
                 "schema": (
-                    "CREATE TABLE [one] (\n"
-                    "   [id] INTEGER PRIMARY KEY,\n"
-                    "   [title] TEXT,\n"
-                    "   [score] INTEGER,\n"
-                    "   [weight] FLOAT,\n"
-                    "   [thumbnail] BLOB\n"
+                    'CREATE TABLE "one" (\n'
+                    '   "id" INTEGER PRIMARY KEY,\n'
+                    '   "title" TEXT,\n'
+                    '   "score" INTEGER,\n'
+                    '   "weight" REAL,\n'
+                    '   "thumbnail" BLOB\n'
                     ")"
                 ),
             },
@@ -1042,10 +1809,10 @@ async def test_drop_table(ds_write, scenario):
                 "table_url": "http://localhost/data/two",
                 "table_api_url": "http://localhost/data/two.json",
                 "schema": (
-                    "CREATE TABLE [two] (\n"
-                    "   [id] INTEGER PRIMARY KEY,\n"
-                    "   [title] TEXT,\n"
-                    "   [score] FLOAT\n"
+                    'CREATE TABLE "two" (\n'
+                    '   "id" INTEGER PRIMARY KEY,\n'
+                    '   "title" TEXT,\n'
+                    '   "score" REAL\n'
                     ")"
                 ),
                 "row_count": 2,
@@ -1071,10 +1838,10 @@ async def test_drop_table(ds_write, scenario):
                 "table_url": "http://localhost/data/three",
                 "table_api_url": "http://localhost/data/three.json",
                 "schema": (
-                    "CREATE TABLE [three] (\n"
-                    "   [id] INTEGER PRIMARY KEY,\n"
-                    "   [title] TEXT,\n"
-                    "   [score] FLOAT\n"
+                    'CREATE TABLE "three" (\n'
+                    '   "id" INTEGER PRIMARY KEY,\n'
+                    '   "title" TEXT,\n'
+                    '   "score" REAL\n'
                     ")"
                 ),
                 "row_count": 1,
@@ -1096,7 +1863,7 @@ async def test_drop_table(ds_write, scenario):
                 "table": "four",
                 "table_url": "http://localhost/data/four",
                 "table_api_url": "http://localhost/data/four.json",
-                "schema": ("CREATE TABLE [four] (\n" "   [name] TEXT\n" ")"),
+                "schema": ('CREATE TABLE "four" (\n' '   "name" TEXT\n' ")"),
                 "row_count": 1,
             },
             ["create-table", "insert-rows"],
@@ -1116,8 +1883,8 @@ async def test_drop_table(ds_write, scenario):
                 "table_url": "http://localhost/data/five",
                 "table_api_url": "http://localhost/data/five.json",
                 "schema": (
-                    "CREATE TABLE [five] (\n   [type] TEXT,\n   [key] INTEGER,\n"
-                    "   [title] TEXT,\n   PRIMARY KEY ([type], [key])\n)"
+                    'CREATE TABLE "five" (\n   "type" TEXT,\n   "key" INTEGER,\n'
+                    '   "title" TEXT,\n   PRIMARY KEY ("type", "key")\n)'
                 ),
                 "row_count": 1,
             },
@@ -1403,12 +2170,259 @@ async def test_create_table(
     )
     assert response.status_code == expected_status
     data = response.json()
+    if expected_response.get("ok") is False:
+        # Error expectations list their messages; derive the canonical envelope
+        expected_response = error_body(expected_response["errors"], expected_status)
+    if isinstance(expected_response, dict) and "schema" in expected_response:
+        assert data.get("schema") == expected_response["schema"]
+        expected_response = dict(expected_response, schema=data.get("schema"))
     assert data == expected_response
     # Should have tracked the expected events
     events = ds_write._tracked_events
     assert [e.name for e in events] == expected_events
 
 
+@pytest.mark.asyncio
+async def test_create_table_with_foreign_key(ds_write):
+    token = write_token(ds_write)
+    response = await ds_write.client.post(
+        "/data/-/create",
+        json={
+            "table": "owners",
+            "columns": [
+                {"name": "id", "type": "integer"},
+                {"name": "name", "type": "text"},
+            ],
+            "pk": "id",
+        },
+        headers=_headers(token),
+    )
+    assert response.status_code == 201
+
+    response = await ds_write.client.post(
+        "/data/-/create",
+        json={
+            "table": "projects",
+            "columns": [
+                {"name": "id", "type": "integer"},
+                {
+                    "name": "owner_id",
+                    "type": "integer",
+                    "fk_table": "owners",
+                },
+                {"name": "title", "type": "text"},
+            ],
+            "pk": "id",
+        },
+        headers=_headers(token),
+    )
+    assert response.status_code == 201
+    data = response.json()
+    assert_schema_contains(
+        '"owner_id" INTEGER REFERENCES "owners"("id")', data["schema"]
+    )
+
+
+@pytest.mark.asyncio
+async def test_create_table_with_column_constraints(ds_write):
+    token = write_token(ds_write)
+    response = await ds_write.client.post(
+        "/data/-/create",
+        json={
+            "table": "constrained",
+            "columns": [
+                {"name": "id", "type": "integer"},
+                {
+                    "name": "title",
+                    "type": "text",
+                    "not_null": True,
+                    "default": "Untitled",
+                },
+                {
+                    "name": "created",
+                    "type": "text",
+                    "default_expr": "current_timestamp",
+                },
+                {"name": "score", "type": "integer", "default": 0},
+                {"name": "literal_default", "type": "text", "default": "hello)"},
+            ],
+            "pk": "id",
+        },
+        headers=_headers(token),
+    )
+    assert response.status_code == 201, response.text
+    data = response.json()
+    assert data["ok"] is True
+    assert "NOT NULL DEFAULT 'Untitled'" in data["schema"]
+    assert "DEFAULT CURRENT_TIMESTAMP" in data["schema"]
+    assert "DEFAULT 0" in data["schema"]
+    assert "DEFAULT 'hello)'" in data["schema"]
+
+    db = ds_write.get_database("data")
+    columns = (
+        await db.execute("select * from pragma_table_info('constrained') order by cid")
+    ).dicts()
+    assert [column["name"] for column in columns] == [
+        "id",
+        "title",
+        "created",
+        "score",
+        "literal_default",
+    ]
+    assert columns[0]["pk"] == 1
+    assert columns[1]["notnull"] == 1
+    assert columns[1]["dflt_value"] == "'Untitled'"
+    assert columns[2]["dflt_value"] == "CURRENT_TIMESTAMP"
+    assert columns[3]["dflt_value"] == "0"
+    assert columns[4]["dflt_value"] == "'hello)'"
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "default_expr,minimum_value,expected_schema",
+    (
+        (
+            "current_unixtime",
+            1_600_000_000,
+            "strftime('%s', 'now')",
+        ),
+        (
+            "current_unixtime_ms",
+            1_600_000_000_000,
+            "julianday('now')",
+        ),
+    ),
+)
+async def test_create_table_integer_default_expr(
+    ds_write, default_expr, minimum_value, expected_schema
+):
+    token = write_token(ds_write)
+    table = f"default_{default_expr}"
+    response = await ds_write.client.post(
+        "/data/-/create",
+        json={
+            "table": table,
+            "columns": [
+                {"name": "id", "type": "integer"},
+                {
+                    "name": "created",
+                    "type": "integer",
+                    "default_expr": default_expr,
+                },
+            ],
+            "pk": "id",
+        },
+        headers=_headers(token),
+    )
+    assert response.status_code == 201, response.text
+    data = response.json()
+    assert expected_schema in data["schema"]
+
+    db = ds_write.get_database("data")
+    columns = (await db.execute("select * from pragma_table_info(?)", [table])).dicts()
+    assert columns[1]["type"] == "INTEGER"
+    assert expected_schema in columns[1]["dflt_value"]
+
+    row = await db.execute_write_fn(
+        lambda conn: _insert_and_fetch_created(
+            conn, table, f"insert into {escape_sqlite(table)} default values"
+        )
+    )
+    assert row[0] > minimum_value
+    assert row[1] == "integer"
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "column,expected_error",
+    (
+        (
+            {"name": "owner_id", "type": "integer", "fk_table": "owners"},
+            None,
+        ),
+        (
+            {"name": "owner_id", "type": "integer", "fk_column": "id"},
+            "columns.0: fk_column requires fk_table",
+        ),
+        (
+            {
+                "name": "created",
+                "type": "text",
+                "default_expr": "datetime('now')",
+            },
+            "columns.0.default_expr: Input should be 'current_timestamp', 'current_date', 'current_time', 'current_unixtime' or 'current_unixtime_ms'",
+        ),
+        (
+            {
+                "name": "created",
+                "type": "text",
+                "default": "x",
+                "default_expr": "current_timestamp",
+            },
+            "columns.0: Value error, default and default_expr cannot both be provided",
+        ),
+    ),
+)
+async def test_create_table_column_validation(ds_write, column, expected_error):
+    token = write_token(ds_write)
+    response = await ds_write.client.post(
+        "/data/-/create",
+        json={
+            "table": "projects",
+            "columns": [column],
+        },
+        headers=_headers(token),
+    )
+    if expected_error:
+        assert response.status_code == 400
+        assert response.json() == error_body([expected_error], 400)
+    else:
+        assert response.status_code == 400
+        assert response.json() == error_body(
+            ["Could not detect single primary key for table 'owners'"], 400
+        )
+
+
+@pytest.mark.asyncio
+async def test_create_table_foreign_key_without_fk_column_requires_single_pk(ds_write):
+    token = write_token(ds_write)
+    response = await ds_write.client.post(
+        "/data/-/create",
+        json={
+            "table": "accounts",
+            "columns": [
+                {"name": "tenant_id", "type": "integer"},
+                {"name": "id", "type": "integer"},
+                {"name": "name", "type": "text"},
+            ],
+            "pks": ["tenant_id", "id"],
+        },
+        headers=_headers(token),
+    )
+    assert response.status_code == 201
+
+    response = await ds_write.client.post(
+        "/data/-/create",
+        json={
+            "table": "projects",
+            "columns": [
+                {"name": "id", "type": "integer"},
+                {
+                    "name": "account_id",
+                    "type": "integer",
+                    "fk_table": "accounts",
+                },
+            ],
+            "pk": "id",
+        },
+        headers=_headers(token),
+    )
+    assert response.status_code == 400
+    assert response.json() == error_body(
+        ["Could not detect single primary key for table 'accounts'"], 400
+    )
+
+
 @pytest.mark.asyncio
 @pytest.mark.parametrize(
     "permissions,body,expected_status,expected_errors",
@@ -1556,10 +2570,9 @@ async def test_create_table_error_if_pk_changed(ds_write):
         headers=_headers(token),
     )
     assert second_response.status_code == 400
-    assert second_response.json() == {
-        "ok": False,
-        "errors": ["pk cannot be changed for existing table"],
-    }
+    assert second_response.json() == error_body(
+        ["pk cannot be changed for existing table"], 400
+    )
 
 
 @pytest.mark.asyncio
@@ -1583,10 +2596,9 @@ async def test_create_table_error_rows_twice_with_duplicates(ds_write):
         headers=_headers(token),
     )
     assert second_response.status_code == 400
-    assert second_response.json() == {
-        "ok": False,
-        "errors": ["UNIQUE constraint failed: test_create_twice.id"],
-    }
+    assert second_response.json() == error_body(
+        ["UNIQUE constraint failed: test_create_twice.id"], 400
+    )
 
 
 @pytest.mark.asyncio
@@ -1609,6 +2621,8 @@ async def test_method_not_allowed(ds_write, path):
     assert response.json() == {
         "ok": False,
         "error": "Method not allowed",
+        "errors": ["Method not allowed"],
+        "status": 405,
     }
 
 
@@ -1676,10 +2690,9 @@ async def test_create_using_alter_against_existing_table(
     )
     if not has_alter_permission:
         assert response2.status_code == 403
-        assert response2.json() == {
-            "ok": False,
-            "errors": ["Permission denied: need alter-table"],
-        }
+        assert response2.json() == error_body(
+            ["Permission denied: need alter-table"], 403
+        )
     else:
         assert response2.status_code == 201
 
diff --git a/tests/test_auth.py b/tests/test_auth.py
index 5868a21c..e7a5402e 100644
--- a/tests/test_auth.py
+++ b/tests/test_auth.py
@@ -1,14 +1,17 @@
+import time
+
+import pytest
 from bs4 import BeautifulSoup as Soup
-from .utils import cookie_was_deleted, last_event
 from click.testing import CliRunner
-from datasette.utils import baseconv
+
 from datasette.cli import cli
 from datasette.resources import (
     DatabaseResource,
     TableResource,
 )
-import pytest
-import time
+from datasette.utils import baseconv
+
+from .utils import cookie_was_deleted, last_event
 
 
 @pytest.mark.asyncio
@@ -204,7 +207,7 @@ def test_auth_create_token(
     assert response2.status == 200
     if errors:
         for error in errors:
-            assert '<p class="message-error">{}</p>'.format(error) in response2.text
+            assert f'<p class="message-error">{error}</p>' in response2.text
     else:
         # Check create-token event
         event = last_event(app_client.ds)
@@ -228,7 +231,7 @@ def test_auth_create_token(
         # And test that token
         response3 = app_client.get(
             "/-/actor.json",
-            headers={"Authorization": "Bearer {}".format("dstok_{}".format(token))},
+            headers={"Authorization": "Bearer {}".format(f"dstok_{token}")},
         )
         assert response3.status == 200
         assert response3.json["actor"]["id"] == "test"
@@ -236,10 +239,12 @@ def test_auth_create_token(
 
 @pytest.mark.asyncio
 async def test_auth_create_token_not_allowed_for_tokens(ds_client):
-    ds_tok = ds_client.ds.sign({"a": "test", "token": "dstok"}, "token")
+    ds_tok = ds_client.ds.sign(
+        {"a": "test", "token": "dstok", "t": int(time.time())}, "token"
+    )
     response = await ds_client.get(
         "/-/create-token",
-        headers={"Authorization": "Bearer dstok_{}".format(ds_tok)},
+        headers={"Authorization": f"Bearer dstok_{ds_tok}"},
     )
     assert response.status_code == 403
 
@@ -284,17 +289,17 @@ async def test_auth_with_dstok_token(ds_client, scenario, should_work):
     elif scenario == "invalid_token":
         token = "invalid"
     if token:
-        token = "dstok_{}".format(token)
+        token = f"dstok_{token}"
     if scenario == "allow_signed_tokens_off":
         ds_client.ds._settings["allow_signed_tokens"] = False
     headers = {}
     if token:
-        headers["Authorization"] = "Bearer {}".format(token)
+        headers["Authorization"] = f"Bearer {token}"
     response = await ds_client.get("/-/actor.json", headers=headers)
     try:
         if should_work:
             data = response.json()
-            assert data.keys() == {"actor"}
+            assert data.keys() == {"ok", "actor"}
             actor = data["actor"]
             expected_keys = {"id", "token"}
             if scenario != "valid_unlimited_token":
@@ -304,8 +309,16 @@ async def test_auth_with_dstok_token(ds_client, scenario, should_work):
             assert actor["token"] == "dstok"
             if scenario != "valid_unlimited_token":
                 assert isinstance(actor["token_expires"], int)
+        elif scenario == "no_token":
+            # No credentials presented - request proceeds as anonymous
+            assert response.json() == {"ok": True, "actor": None}
         else:
-            assert response.json() == {"actor": None}
+            # Invalid credentials presented - hard 401
+            assert response.status_code == 401
+            data = response.json()
+            assert data["ok"] is False
+            assert data["status"] == 401
+            assert response.headers["www-authenticate"].startswith("Bearer")
     finally:
         ds_client.ds._settings["allow_signed_tokens"] = True
 
@@ -328,7 +341,7 @@ def test_cli_create_token(app_client, expires):
     assert details.keys() == expected_keys
     assert details["a"] == "test"
     response = app_client.get(
-        "/-/actor.json", headers={"Authorization": "Bearer {}".format(token)}
+        "/-/actor.json", headers={"Authorization": f"Bearer {token}"}
     )
     if expires is None or expires > 0:
         expected_actor = {
@@ -337,10 +350,11 @@ def test_cli_create_token(app_client, expires):
         }
         if expires and expires > 0:
             expected_actor["token_expires"] = details["t"] + expires
-        assert response.json == {"actor": expected_actor}
+        assert response.json == {"ok": True, "actor": expected_actor}
     else:
-        expected_actor = None
-    assert response.json == {"actor": expected_actor}
+        # Expired token - hard 401
+        assert response.status == 401
+        assert response.json["ok"] is False
 
 
 @pytest.mark.asyncio
diff --git a/tests/test_autocomplete.py b/tests/test_autocomplete.py
index 76b9c902..194fcf01 100644
--- a/tests/test_autocomplete.py
+++ b/tests/test_autocomplete.py
@@ -25,13 +25,14 @@ async def test_autocomplete_single_pk_exact_match_and_label_order():
 
     assert response.status_code == 200
     assert response.json() == {
+        "ok": True,
         "rows": [
             {"pks": {"id": 2}, "label": "Longer non-label pk match"},
             {"pks": {"id": 20}, "label": "2"},
             {"pks": {"id": 21}, "label": "22"},
             {"pks": {"id": 3}, "label": "A label containing 2"},
             {"pks": {"id": 200}, "label": "A"},
-        ]
+        ],
     }
 
 
@@ -52,12 +53,12 @@ async def test_autocomplete_blank_q_returns_no_results():
     response = await ds.client.get("/autocomplete_blank/people/-/autocomplete?q=")
 
     assert response.status_code == 200
-    assert response.json() == {"rows": []}
+    assert response.json() == {"ok": True, "rows": []}
 
     response = await ds.client.get("/autocomplete_blank/people/-/autocomplete")
 
     assert response.status_code == 200
-    assert response.json() == {"rows": []}
+    assert response.json() == {"ok": True, "rows": []}
 
 
 @pytest.mark.asyncio
@@ -81,11 +82,12 @@ async def test_autocomplete_initial_returns_latest_rows():
 
     assert response.status_code == 200
     assert response.json() == {
+        "ok": True,
         "rows": [
             {"pks": {"id": 3}, "label": "Cleo"},
             {"pks": {"id": 2}, "label": "Bob"},
             {"pks": {"id": 1}, "label": "Alice"},
-        ]
+        ],
     }
 
     response = await ds.client.get(
@@ -94,11 +96,12 @@ async def test_autocomplete_initial_returns_latest_rows():
 
     assert response.status_code == 200
     assert response.json() == {
+        "ok": True,
         "rows": [
             {"pks": {"id": 3}, "label": "Cleo"},
             {"pks": {"id": 2}, "label": "Bob"},
             {"pks": {"id": 1}, "label": "Alice"},
-        ]
+        ],
     }
 
 
@@ -121,9 +124,10 @@ async def test_autocomplete_escapes_like_characters():
 
     assert response.status_code == 200
     assert response.json() == {
+        "ok": True,
         "rows": [
             {"pks": {"id": 1}, "label": "100% real"},
-        ]
+        ],
     }
 
 
@@ -149,11 +153,12 @@ async def test_autocomplete_compound_pk_searches_all_pk_columns():
 
     assert response.status_code == 200
     assert response.json() == {
+        "ok": True,
         "rows": [
             {"pks": {"country": "mx", "code": "ca"}, "label": "Campeche"},
             {"pks": {"country": "us", "code": "ca"}, "label": "California"},
             {"pks": {"country": "ca", "code": "bc"}, "label": "British Columbia"},
-        ]
+        ],
     }
 
 
@@ -184,9 +189,10 @@ async def test_autocomplete_primary_key_called_label():
 
     assert response.status_code == 200
     assert response.json() == {
+        "ok": True,
         "rows": [
             {"pks": {"label": "abc"}, "label": "Display value"},
-        ]
+        ],
     }
 
 
@@ -246,8 +252,9 @@ async def test_autocomplete_timeout_uses_prefix_fallback(monkeypatch):
     assert timeout_was_simulated
     data = response.json()
     assert data == {
+        "ok": True,
         "rows": [
             {"pks": {"id": f"item-1999{i:02d}"}, "label": f"name 1999{i:02d}"}
             for i in range(10)
-        ]
+        ],
     }
diff --git a/tests/test_base_view.py b/tests/test_base_view.py
index 2cd4d601..b46f7ce1 100644
--- a/tests/test_base_view.py
+++ b/tests/test_base_view.py
@@ -1,8 +1,10 @@
-from datasette.views.base import View
+import json
+
+import pytest
+
 from datasette import Request, Response
 from datasette.app import Datasette
-import json
-import pytest
+from datasette.views.base import View
 
 
 class GetView(View):
@@ -53,6 +55,8 @@ async def test_get_view():
     assert json.loads(post_json_response.body) == {
         "ok": False,
         "error": "Method not allowed",
+        "errors": ["Method not allowed"],
+        "status": 405,
     }
     assert post_json_response.status == 405
 
diff --git a/tests/test_cli.py b/tests/test_cli.py
index f86d6909..fbd4a8a9 100644
--- a/tests/test_cli.py
+++ b/tests/test_cli.py
@@ -1,23 +1,28 @@
-from .fixtures import (
-    make_app_client,
-    TestClient as _TestClient,
-    EXPECTED_PLUGINS,
-)
-from datasette.app import SETTINGS
-from datasette.plugins import DEFAULT_PLUGINS, pm
-from datasette.cli import cli, serve
-from datasette.version import __version__
-from datasette.utils import tilde_encode
-from datasette.utils.sqlite import sqlite3
-from click.testing import CliRunner
 import io
 import json
 import pathlib
-import pytest
 import sys
 import textwrap
 from unittest import mock
 
+import pytest
+from click.testing import CliRunner
+
+from datasette.app import SETTINGS
+from datasette.cli import cli, serve
+from datasette.plugins import DEFAULT_PLUGINS, pm
+from datasette.utils import tilde_encode
+from datasette.utils.sqlite import sqlite3
+from datasette.version import __version__
+
+from .fixtures import (
+    EXPECTED_PLUGINS,
+    make_app_client,
+)
+from .fixtures import (
+    TestClient as _TestClient,
+)
+
 
 def test_inspect_cli(app_client):
     runner = CliRunner()
@@ -385,7 +390,9 @@ def test_setting_boolean_validation_false_values(value):
     )
     # Should be forbidden (setting is false)
     assert result.exit_code == 1, result.output
-    assert "Forbidden" in result.output
+    error = json.loads(result.output)
+    assert error["ok"] is False
+    assert error["status"] == 403
 
 
 @pytest.mark.parametrize("value", ("on", "true", "1"))
@@ -425,8 +432,9 @@ def test_setting_default_allow_sql(default_allow_sql):
         assert json.loads(result.output)["rows"][0] == {"21": 21}
     else:
         assert result.exit_code == 1, result.output
-        # This isn't JSON at the moment, maybe it should be though
-        assert "Forbidden" in result.output
+        error = json.loads(result.output)
+        assert error["ok"] is False
+        assert error["status"] == 403
 
 
 def test_sql_errors_logged_to_stderr():
@@ -444,7 +452,7 @@ def test_serve_create(tmpdir):
         cli, [str(db_path), "--create", "--get", "/-/databases.json"]
     )
     assert result.exit_code == 0, result.output
-    databases = json.loads(result.output)
+    databases = json.loads(result.output)["databases"]
     assert {
         "name": "does_not_exist_yet",
         "is_mutable": True,
@@ -457,7 +465,7 @@ def test_serve_create(tmpdir):
 @pytest.mark.parametrize("argument", ("-c", "--config"))
 @pytest.mark.parametrize("format_", ("json", "yaml"))
 def test_serve_config(tmpdir, argument, format_):
-    config_path = tmpdir / "datasette.{}".format(format_)
+    config_path = tmpdir / f"datasette.{format_}"
     config_path.write_text(
         (
             "settings:\n  default_page_size: 5\n"
@@ -493,7 +501,7 @@ def test_serve_duplicate_database_names(tmpdir):
         conn.close()
     result = runner.invoke(cli, [db_1_path, db_2_path, "--get", "/-/databases.json"])
     assert result.exit_code == 0, result.output
-    databases = json.loads(result.output)
+    databases = json.loads(result.output)["databases"]
     assert {db["name"] for db in databases} == {"db", "db_2"}
 
 
@@ -510,13 +518,13 @@ def test_weird_database_names(tmpdir, filename):
     result1 = runner.invoke(cli, [db_path, "--get", "/"])
     assert result1.exit_code == 0, result1.output
     filename_no_stem = filename.rsplit(".", 1)[0]
-    expected_link = '<a href="/{}">{}</a>'.format(
-        tilde_encode(filename_no_stem), filename_no_stem
+    expected_link = (
+        f'<a href="/{tilde_encode(filename_no_stem)}">{filename_no_stem}</a>'
     )
     assert expected_link in result1.output
     # Now try hitting that database page
     result2 = runner.invoke(
-        cli, [db_path, "--get", "/{}".format(tilde_encode(filename_no_stem))]
+        cli, [db_path, "--get", f"/{tilde_encode(filename_no_stem)}"]
     )
     assert result2.exit_code == 0, result2.output
 
@@ -585,7 +593,7 @@ def test_duplicate_database_files_error(tmpdir):
         cli, ["serve", other_db_path, str(config_dir), "--get", "/-/databases.json"]
     )
     assert result4.exit_code == 0
-    databases = json.loads(result4.output)
+    databases = json.loads(result4.output)["databases"]
     assert {db["name"] for db in databases} == {"other", "data"}
 
     # Test that multiple directories raise an error
diff --git a/tests/test_cli_serve_get.py b/tests/test_cli_serve_get.py
index dc852201..01b84f59 100644
--- a/tests/test_cli_serve_get.py
+++ b/tests/test_cli_serve_get.py
@@ -1,8 +1,10 @@
+import json
+import textwrap
+
+from click.testing import CliRunner
+
 from datasette.cli import cli
 from datasette.plugins import pm
-from click.testing import CliRunner
-import textwrap
-import json
 
 
 def test_serve_with_get(tmp_path_factory):
@@ -44,9 +46,9 @@ def test_serve_with_get(tmp_path_factory):
 
     # Annoyingly that new test plugin stays resident - we need
     # to manually unregister it to avoid conflict with other tests
-    to_unregister = [
+    to_unregister = next(
         p for p in pm.get_plugins() if p.__name__ == "init_for_serve_with_get.py"
-    ][0]
+    )
     pm.unregister(to_unregister)
 
 
@@ -95,7 +97,10 @@ def test_serve_with_get_and_token():
         ],
     )
     assert 0 == result2.exit_code, result2.output
-    assert json.loads(result2.output) == {"actor": {"id": "root", "token": "dstok"}}
+    assert json.loads(result2.output) == {
+        "ok": True,
+        "actor": {"id": "root", "token": "dstok"},
+    }
 
 
 def test_serve_with_get_exit_code_for_error():
@@ -130,8 +135,9 @@ def test_serve_get_actor():
     )
     assert result.exit_code == 0
     assert json.loads(result.output) == {
+        "ok": True,
         "actor": {
             "id": "root",
             "extra": "x",
-        }
+        },
     }
diff --git a/tests/test_cli_serve_server.py b/tests/test_cli_serve_server.py
index 47f23c08..b7604bb8 100644
--- a/tests/test_cli_serve_server.py
+++ b/tests/test_cli_serve_server.py
@@ -1,6 +1,7 @@
+import socket
+
 import httpx
 import pytest
-import socket
 
 
 @pytest.mark.serial
diff --git a/tests/test_column_types.py b/tests/test_column_types.py
index 45a9e7d1..50c6daed 100644
--- a/tests/test_column_types.py
+++ b/tests/test_column_types.py
@@ -1,7 +1,11 @@
 import json
 import logging
+import time
 
+import markupsafe
+import pytest
 from bs4 import BeautifulSoup as Soup
+
 from datasette.app import Datasette
 from datasette.column_types import (
     ColumnType,
@@ -9,11 +13,7 @@ from datasette.column_types import (
 )
 from datasette.hookspecs import hookimpl
 from datasette.plugins import pm
-from datasette.utils import sqlite3
-from datasette.utils import StartupError
-import markupsafe
-import pytest
-import time
+from datasette.utils import StartupError, error_body, sqlite3
 
 
 @pytest.fixture
@@ -104,7 +104,7 @@ def write_token(ds, actor_id="root", permissions=None):
 
 def _headers(token):
     return {
-        "Authorization": "Bearer {}".format(token),
+        "Authorization": f"Bearer {token}",
         "Content-Type": "application/json",
     }
 
@@ -322,12 +322,6 @@ async def test_clear_column_type_api(ds_ct):
                 "Invalid JSON: Expecting property name enclosed in double quotes: line 1 column 2 (char 1)"
             ],
         ),
-        (
-            {"column": "title", "column_type": {"type": "email"}},
-            "invalid_content_type",
-            400,
-            ["Invalid content-type, must be application/json"],
-        ),
         (
             [],
             None,
@@ -413,11 +407,7 @@ async def test_set_column_type_api_errors(
     kwargs = {
         "headers": {
             "Authorization": f"Bearer {token}",
-            "Content-Type": (
-                "text/plain"
-                if special_case == "invalid_content_type"
-                else "application/json"
-            ),
+            "Content-Type": "application/json",
         }
     }
     if special_case == "invalid_json":
@@ -426,7 +416,7 @@ async def test_set_column_type_api_errors(
         kwargs["json"] = body
     response = await ds_ct.client.post("/data/posts/-/set-column-type", **kwargs)
     assert response.status_code == expected_status
-    assert response.json() == {"ok": False, "errors": expected_errors}
+    assert response.json() == error_body(expected_errors, expected_status)
 
 
 @pytest.mark.asyncio
diff --git a/tests/test_config_dir.py b/tests/test_config_dir.py
index 0a9b30d8..00540464 100644
--- a/tests/test_config_dir.py
+++ b/tests/test_config_dir.py
@@ -1,10 +1,12 @@
 import json
 import pathlib
+
 import pytest
 
 from datasette.app import Datasette
-from datasette.utils.sqlite import sqlite3
 from datasette.utils import StartupError
+from datasette.utils.sqlite import sqlite3
+
 from .fixtures import TestClient as _TestClient
 
 PLUGIN = """
@@ -109,9 +111,10 @@ def test_settings(config_dir_client):
 def test_plugins(config_dir_client):
     response = config_dir_client.get("/-/plugins.json")
     assert 200 == response.status
-    assert "hooray.py" in {p["name"] for p in response.json}
-    assert "non_py_file.txt" not in {p["name"] for p in response.json}
-    assert "mypy_cache" not in {p["name"] for p in response.json}
+    plugins = response.json
+    assert "hooray.py" in {p["name"] for p in plugins}
+    assert "non_py_file.txt" not in {p["name"] for p in plugins}
+    assert "mypy_cache" not in {p["name"] for p in plugins}
 
 
 def test_templates_and_plugin(config_dir_client):
@@ -136,7 +139,7 @@ def test_static_directory_browsing_not_allowed(config_dir_client):
 def test_databases(config_dir_client):
     response = config_dir_client.get("/-/databases.json")
     assert 200 == response.status
-    databases = response.json
+    databases = response.json["databases"]
     assert 4 == len(databases)
     databases.sort(key=lambda d: d["name"])
     for db, expected_name in zip(databases, ("demo", "immutable", "j", "k")):
diff --git a/tests/test_crossdb.py b/tests/test_crossdb.py
index 11e53224..ffd0870c 100644
--- a/tests/test_crossdb.py
+++ b/tests/test_crossdb.py
@@ -1,7 +1,9 @@
-from datasette.cli import cli
-from click.testing import CliRunner
-import urllib
 import sqlite3
+import urllib
+
+from click.testing import CliRunner
+
+from datasette.cli import cli
 
 
 def test_crossdb_join(app_client_two_attached_databases_crossdb_enabled):
@@ -40,7 +42,7 @@ def test_crossdb_warning_if_too_many_databases(tmp_path_factory):
     db_dir = tmp_path_factory.mktemp("dbs")
     dbs = []
     for i in range(11):
-        path = str(db_dir / "db_{}.db".format(i))
+        path = str(db_dir / f"db_{i}.db")
         conn = sqlite3.connect(path)
         conn.execute("vacuum")
         conn.close()
diff --git a/tests/test_csrf_middleware.py b/tests/test_csrf_middleware.py
index 2fcfb216..6c78f69d 100644
--- a/tests/test_csrf_middleware.py
+++ b/tests/test_csrf_middleware.py
@@ -44,7 +44,7 @@ async def _run_middleware(scope):
     await mw(scope, None, send)
     if inner_called:
         return ("allowed",)
-    start = [m for m in sent if m["type"] == "http.response.start"][0]
+    start = next(m for m in sent if m["type"] == "http.response.start")
     return ("blocked", start["status"])
 
 
diff --git a/tests/test_csv.py b/tests/test_csv.py
index a2f03776..7758a3c0 100644
--- a/tests/test_csv.py
+++ b/tests/test_csv.py
@@ -1,8 +1,10 @@
-from datasette.app import Datasette
-from bs4 import BeautifulSoup as Soup
-import pytest
 import urllib.parse
 
+import pytest
+from bs4 import BeautifulSoup as Soup
+
+from datasette.app import Datasette
+
 EXPECTED_TABLE_CSV = """id,content
 1,hello
 2,world
diff --git a/tests/test_custom_pages.py b/tests/test_custom_pages.py
index 86cdcc6b..32cfc43d 100644
--- a/tests/test_custom_pages.py
+++ b/tests/test_custom_pages.py
@@ -1,5 +1,7 @@
 import pathlib
+
 import pytest
+
 from .fixtures import make_app_client
 
 TEST_TEMPLATE_DIRS = str(pathlib.Path(__file__).parent / "test_templates")
diff --git a/tests/test_datasette_https_server.sh b/tests/test_datasette_https_server.sh
index aee262cc..a544b9a8 100755
--- a/tests/test_datasette_https_server.sh
+++ b/tests/test_datasette_https_server.sh
@@ -40,22 +40,23 @@ curl -f --cacert client.pem $test_url
 curl_exit_code=$?
 
 # Shut down the server
-kill $server_pid
-waiting=0
-#         show all pids
-#         |       find just the $server_pid
-#         |       |                  don’t match on the previous grep
-#         |       |                  |            we don’t need the output
-#         |       |                  |            |
-until ( ! ps ax | grep $server_pid | grep -v grep > /dev/null ); do
-    if [ $waiting -eq 4 ]; then
-        echo "$server_pid does still exist, server failed to stop"
-        cleanup
-        exit 1
+kill $server_pid 2>/dev/null || true
+(
+    sleep 5
+    if kill -0 $server_pid 2>/dev/null; then
+        kill -9 $server_pid 2>/dev/null || true
     fi
-    let waiting=waiting+1
-    sleep 1
-done
+) &
+killer_pid=$!
+wait_status=0
+wait $server_pid 2>/dev/null || wait_status=$?
+kill $killer_pid 2>/dev/null || true
+wait $killer_pid 2>/dev/null || true
+if [ $wait_status -eq 137 ]; then
+    echo "$server_pid did not stop after SIGTERM, server failed to stop"
+    cleanup
+    exit 1
+fi
 
 # Clean up the certificates
 cleanup
diff --git a/tests/test_default_deny.py b/tests/test_default_deny.py
index f1e43064..f456a17f 100644
--- a/tests/test_default_deny.py
+++ b/tests/test_default_deny.py
@@ -1,4 +1,5 @@
 import pytest
+
 from datasette.app import Datasette
 from datasette.resources import DatabaseResource, TableResource
 
diff --git a/tests/test_docs.py b/tests/test_docs.py
index 13b3a549..16df6a46 100644
--- a/tests/test_docs.py
+++ b/tests/test_docs.py
@@ -2,20 +2,22 @@
 Tests to ensure certain things are documented.
 """
 
-from datasette import app, utils
+import re
+from pathlib import Path
+
+import pytest
+
 import datasette.fixtures  # noqa: F401
+from datasette import app, utils
 from datasette.app import Datasette
 from datasette.filters import Filters
-from pathlib import Path
-import pytest
-import re
 
 docs_path = Path(__file__).parent.parent / "docs"
 label_re = re.compile(r"\.\. _([^\s:]+):")
 
 
 def get_headings(content, underline="-"):
-    heading_re = re.compile(r"(\w+)(\([^)]*\))?\n\{}+\n".format(underline))
+    heading_re = re.compile(rf"(\w+)(\([^)]*\))?\n\{underline}+\n")
     return {h[0] for h in heading_re.findall(content)}
 
 
@@ -248,7 +250,7 @@ async def test_homepage():
 async def test_actor_is_null():
     ds = Datasette(memory=True)
     response = await ds.client.get("/-/actor.json")
-    assert response.json() == {"actor": None}
+    assert response.json() == {"ok": True, "actor": None}
 # -- end test_actor_is_null --
 
 
@@ -258,5 +260,5 @@ async def test_signed_cookie_actor():
     ds = Datasette(memory=True)
     cookies = {"ds_actor": ds.client.actor_cookie({"id": "root"})}
     response = await ds.client.get("/-/actor.json", cookies=cookies)
-    assert response.json() == {"actor": {"id": "root"}}
+    assert response.json() == {"ok": True, "actor": {"id": "root"}}
 # -- end test_signed_cookie_actor --
diff --git a/tests/test_docs_plugins.py b/tests/test_docs_plugins.py
index 613160ac..4a0014b4 100644
--- a/tests/test_docs_plugins.py
+++ b/tests/test_docs_plugins.py
@@ -1,10 +1,11 @@
 # fmt: off
 # -- start datasette_with_plugin_fixture --
-from datasette import hookimpl
-from datasette.app import Datasette
 import pytest
 import pytest_asyncio
 
+from datasette import hookimpl
+from datasette.app import Datasette
+
 
 @pytest_asyncio.fixture
 async def datasette_with_plugin():
diff --git a/tests/test_error_shape.py b/tests/test_error_shape.py
new file mode 100644
index 00000000..94c9a7c9
--- /dev/null
+++ b/tests/test_error_shape.py
@@ -0,0 +1,751 @@
+"""
+Tests for the canonical JSON error shape.
+
+Every JSON error response from Datasette should use one shape:
+
+    {
+        "ok": false,
+        "error": "<all messages joined with '; '>",
+        "errors": ["<message>", ...],
+        "status": <int matching the HTTP status code>
+    }
+
+Additional context keys (for example "rows" and "truncated" on SQL errors)
+are permitted, but "ok", "error", "errors" and "status" must always be
+present and the legacy "title" key must not be.
+
+https://github.com/simonw/datasette/issues - 1.0 API consistency
+"""
+
+import time
+
+import pytest
+
+from datasette.app import Datasette
+from datasette.utils import sqlite3
+
+
+def assert_canonical_error(response, expected_status):
+    assert response.status_code == expected_status
+    data = response.json()
+    assert data["ok"] is False
+    assert isinstance(data["error"], str)
+    assert data["error"]
+    assert isinstance(data["errors"], list)
+    assert data["errors"]
+    assert all(isinstance(message, str) for message in data["errors"])
+    assert data["error"] == "; ".join(data["errors"])
+    assert data["status"] == expected_status
+    assert "title" not in data
+    return data
+
+
+@pytest.fixture
+def ds_error_shape(tmp_path_factory):
+    db_directory = tmp_path_factory.mktemp("dbs")
+    db_path = str(db_directory / "data.db")
+    conn = sqlite3.connect(db_path)
+    conn.execute("vacuum")
+    conn.execute("create table docs (id integer primary key, title text)")
+    conn.close()
+    ds = Datasette([db_path])
+    ds.root_enabled = True
+    yield ds
+    ds.close()
+
+
+# Shape 1: the exception handler (handle_exception.py)
+
+
+@pytest.mark.asyncio
+async def test_not_found_error_shape(ds_client):
+    response = await ds_client.get("/fixtures/no_such_table.json")
+    assert_canonical_error(response, 404)
+
+
+@pytest.mark.asyncio
+async def test_datasette_error_with_title_omits_title_key(ds_client):
+    # DatasetteError(title="Invalid SQL") previously leaked a "title" key
+    response = await ds_client.get(
+        "/fixtures/-/query.json?sql=update+facetable+set+state+=+1"
+    )
+    data = assert_canonical_error(response, 400)
+    assert data["errors"] == ["Statement must be a SELECT"]
+
+
+# Shape 2: the _error() helper (views/base.py) - write API and friends
+
+
+@pytest.mark.asyncio
+async def test_write_api_validation_error_shape(ds_error_shape):
+    token = "dstok_{}".format(
+        ds_error_shape.sign(
+            {"a": "root", "token": "dstok", "t": 0},
+            namespace="token",
+        )
+    )
+    response = await ds_error_shape.client.post(
+        "/data/docs/-/insert",
+        json={"rows": [{"nope": 1}, {"also_nope": 2}]},
+        headers={
+            "Authorization": f"Bearer {token}",
+            "Content-Type": "application/json",
+        },
+    )
+    data = assert_canonical_error(response, 400)
+    # Multiple messages: errors keeps them all, error joins them
+    assert len(data["errors"]) == 2
+    assert data["errors"][0].startswith("Row 0")
+    assert data["errors"][1].startswith("Row 1")
+
+
+@pytest.mark.asyncio
+async def test_write_api_permission_denied_shape(ds_error_shape):
+    response = await ds_error_shape.client.post(
+        "/data/docs/-/insert",
+        json={"rows": [{"title": "hello"}]},
+        headers={"Content-Type": "application/json"},
+    )
+    assert_canonical_error(response, 403)
+
+
+# Shape 3: the JSON renderer (renderer.py)
+
+
+@pytest.mark.asyncio
+async def test_sql_error_shape_keeps_context_keys(ds_client):
+    response = await ds_client.get(
+        "/fixtures/-/query.json?sql=select+*+from+no_such_table"
+    )
+    data = assert_canonical_error(response, 400)
+    # Renderer errors keep their context keys
+    assert data["rows"] == []
+    assert "truncated" in data
+
+
+@pytest.mark.asyncio
+async def test_invalid_shape_error_shape(ds_client):
+    response = await ds_client.get("/fixtures/-/query.json?sql=select+1&_shape=bananas")
+    data = assert_canonical_error(response, 400)
+    assert data["errors"] == ["Invalid _shape: bananas"]
+
+
+@pytest.mark.asyncio
+async def test_shape_object_on_query_is_a_400_error(ds_client):
+    # Previously returned HTTP 200 with an ok: false body
+    response = await ds_client.get("/fixtures/-/query.json?sql=select+1&_shape=object")
+    data = assert_canonical_error(response, 400)
+    assert data["errors"] == ["_shape=object is only available on tables"]
+
+
+# Shape 4: bare {"error": ...} from the permission debug endpoints
+
+
+@pytest.mark.asyncio
+async def test_allowed_missing_action_error_shape(ds_client):
+    response = await ds_client.get("/-/allowed.json")
+    data = assert_canonical_error(response, 400)
+    assert data["errors"] == ["action parameter is required"]
+
+
+@pytest.mark.asyncio
+async def test_allowed_unknown_action_error_shape(ds_client):
+    response = await ds_client.get("/-/allowed.json?action=no_such_action")
+    assert_canonical_error(response, 404)
+
+
+@pytest.mark.asyncio
+async def test_check_unknown_action_error_shape(ds_error_shape):
+    response = await ds_error_shape.client.get(
+        "/-/check.json?action=no_such_action",
+        actor={"id": "root"},
+    )
+    assert_canonical_error(response, 404)
+
+
+@pytest.mark.asyncio
+async def test_rules_missing_action_error_shape(ds_error_shape):
+    response = await ds_error_shape.client.get(
+        "/-/rules.json",
+        actor={"id": "root"},
+    )
+    data = assert_canonical_error(response, 400)
+    assert data["errors"] == ["action parameter is required"]
+
+
+# Other stragglers
+
+
+@pytest.mark.asyncio
+async def test_method_not_allowed_error_shape(ds_client):
+    response = await ds_client.post("/fixtures.json")
+    assert_canonical_error(response, 405)
+
+
+@pytest.mark.asyncio
+async def test_schema_unknown_database_error_shape(ds_client):
+    response = await ds_client.get("/no_such_db/-/schema.json")
+    assert_canonical_error(response, 404)
+
+
+# Forbidden responses (the default forbidden() hook)
+
+
+@pytest.fixture
+def ds_forbidden(tmp_path_factory):
+    db_directory = tmp_path_factory.mktemp("dbs")
+    db_path = str(db_directory / "data.db")
+    conn = sqlite3.connect(db_path)
+    conn.execute("vacuum")
+    conn.execute("create table docs (id integer primary key, title text)")
+    conn.close()
+    ds = Datasette(
+        [db_path],
+        config={"databases": {"data": {"tables": {"docs": {"allow": {"id": "root"}}}}}},
+    )
+    ds.root_enabled = True
+    yield ds
+    ds.close()
+
+
+@pytest.mark.asyncio
+async def test_forbidden_json_path_returns_canonical_json(ds_forbidden):
+    response = await ds_forbidden.client.get("/data/docs.json")
+    data = assert_canonical_error(response, 403)
+    assert "permission" in data["error"].lower()
+
+
+@pytest.mark.asyncio
+async def test_forbidden_accept_json_returns_canonical_json(ds_forbidden):
+    response = await ds_forbidden.client.get(
+        "/data/docs", headers={"Accept": "application/json"}
+    )
+    assert_canonical_error(response, 403)
+
+
+@pytest.mark.asyncio
+async def test_forbidden_html_path_still_returns_html(ds_forbidden):
+    response = await ds_forbidden.client.get("/data/docs")
+    assert response.status_code == 403
+    assert response.headers["content-type"].startswith("text/html")
+
+
+@pytest.mark.asyncio
+async def test_forbidden_json_path_allowed_actor_still_works(ds_forbidden):
+    response = await ds_forbidden.client.get("/data/docs.json", actor={"id": "root"})
+    assert response.status_code == 200
+    assert response.json()["ok"] is True
+
+
+# Write canned queries: SQL failures must not return HTTP 200
+
+
+@pytest.fixture
+def ds_write_query(tmp_path_factory):
+    db_directory = tmp_path_factory.mktemp("dbs")
+    db_path = str(db_directory / "data.db")
+    conn = sqlite3.connect(db_path)
+    conn.execute("vacuum")
+    conn.execute("create table docs (id integer primary key, title text)")
+    conn.close()
+    ds = Datasette(
+        [db_path],
+        config={
+            "databases": {
+                "data": {
+                    "queries": {
+                        "add_doc": {
+                            "sql": (
+                                "insert into docs (id, title)" " values (:id, :title)"
+                            ),
+                            "write": True,
+                        },
+                        "add_doc_custom_error": {
+                            "sql": (
+                                "insert into docs (id, title)" " values (:id, :title)"
+                            ),
+                            "write": True,
+                            "on_error_message": "Custom error message",
+                            "on_error_redirect": "/data",
+                        },
+                    }
+                }
+            }
+        },
+    )
+    yield ds
+    ds.close()
+
+
+@pytest.mark.asyncio
+async def test_write_query_success_returns_200(ds_write_query):
+    response = await ds_write_query.client.post(
+        "/data/add_doc",
+        json={"id": 1, "title": "One"},
+        headers={"Accept": "application/json"},
+    )
+    assert response.status_code == 200
+    data = response.json()
+    assert data["ok"] is True
+    assert data["message"] == "Query executed, 1 row affected"
+    assert data["redirect"] is None
+
+
+@pytest.mark.asyncio
+async def test_write_query_sql_failure_returns_400(ds_write_query):
+    for _ in range(2):
+        response = await ds_write_query.client.post(
+            "/data/add_doc",
+            json={"id": 1, "title": "One"},
+            headers={"Accept": "application/json"},
+        )
+    data = assert_canonical_error(response, 400)
+    assert "UNIQUE constraint failed" in data["error"]
+    # The redirect context key from the canned query flow is preserved
+    assert data["redirect"] is None
+
+
+@pytest.mark.asyncio
+async def test_write_query_failure_uses_on_error_message_and_redirect(
+    ds_write_query,
+):
+    for _ in range(2):
+        response = await ds_write_query.client.post(
+            "/data/add_doc_custom_error",
+            json={"id": 1, "title": "One"},
+            headers={"Accept": "application/json"},
+        )
+    data = assert_canonical_error(response, 400)
+    assert data["error"] == "Custom error message"
+    assert data["redirect"] == "/data"
+
+
+@pytest.mark.asyncio
+async def test_write_query_forbidden_is_canonical_403(ds_write_query):
+    # An untrusted write query run by an actor without execute-write-sql
+    # raises Forbidden, handled by the forbidden() hook
+    await ds_write_query.invoke_startup()
+    await ds_write_query.add_query(
+        "data",
+        name="untrusted_add",
+        sql="insert into docs (id, title) values (:id, :title)",
+        is_write=True,
+        is_trusted=False,
+        source="user",
+        owner_id="someone",
+    )
+    response = await ds_write_query.client.post(
+        "/data/untrusted_add",
+        json={"id": 5, "title": "Five"},
+        headers={"Accept": "application/json"},
+        actor={"id": "someone"},
+    )
+    assert_canonical_error(response, 403)
+
+
+@pytest.mark.asyncio
+async def test_write_query_rejected_operation_is_canonical_403(ds_write_query):
+    # A rejected operation (VACUUM) raises QueryWriteRejected, handled by
+    # the dedicated branch in QueryView.post - root has execute-write-sql
+    ds_write_query.root_enabled = True
+    await ds_write_query.invoke_startup()
+    await ds_write_query.add_query(
+        "data",
+        name="vacuum_it",
+        sql="vacuum",
+        is_write=True,
+        is_trusted=False,
+        source="user",
+        owner_id="root",
+    )
+    response = await ds_write_query.client.post(
+        "/data/vacuum_it",
+        json={},
+        headers={"Accept": "application/json"},
+        actor={"id": "root"},
+    )
+    data = assert_canonical_error(response, 403)
+    assert data["redirect"] is None
+
+
+# Row delete write failures must be 400, matching row update
+
+
+@pytest.mark.asyncio
+async def test_row_delete_write_failure_is_400(tmp_path_factory):
+    db_directory = tmp_path_factory.mktemp("dbs")
+    db_path = str(db_directory / "data.db")
+    conn = sqlite3.connect(db_path)
+    conn.execute("vacuum")
+    conn.execute("create table docs (id integer primary key, title text)")
+    conn.execute("insert into docs (id, title) values (1, 'One')")
+    conn.execute(
+        "create trigger no_delete before delete on docs "
+        "begin select raise(abort, 'deletes are blocked'); end"
+    )
+    conn.commit()
+    conn.close()
+    ds = Datasette([db_path])
+    ds.root_enabled = True
+    try:
+        response = await ds.client.post(
+            "/data/docs/1/-/delete",
+            json={},
+            headers={"Content-Type": "application/json"},
+            actor={"id": "root"},
+        )
+        data = assert_canonical_error(response, 400)
+        assert "deletes are blocked" in data["error"]
+    finally:
+        ds.close()
+
+
+# Invalid bearer tokens must produce 401, not silent anonymous access
+
+
+@pytest.mark.asyncio
+async def test_expired_token_returns_401(ds_error_shape):
+    token = "dstok_{}".format(
+        ds_error_shape.sign(
+            {"a": "root", "t": int(time.time()) - 2000, "d": 1000},
+            namespace="token",
+        )
+    )
+    response = await ds_error_shape.client.get(
+        "/-/actor.json", headers={"Authorization": f"Bearer {token}"}
+    )
+    data = assert_canonical_error(response, 401)
+    assert "expired" in data["error"].lower()
+    assert response.headers["www-authenticate"].startswith("Bearer")
+
+
+@pytest.mark.asyncio
+async def test_bad_signature_token_returns_401(ds_error_shape):
+    response = await ds_error_shape.client.get(
+        "/-/actor.json", headers={"Authorization": "Bearer dstok_garbage"}
+    )
+    assert_canonical_error(response, 401)
+    assert response.headers["www-authenticate"].startswith("Bearer")
+
+
+@pytest.mark.asyncio
+async def test_unrecognized_token_prefix_stays_anonymous(ds_error_shape):
+    # No registered handler claims this token - it might belong to a
+    # plugin's actor_from_request hook, so it must not hard-fail
+    response = await ds_error_shape.client.get(
+        "/-/actor.json", headers={"Authorization": "Bearer sometoken_abc"}
+    )
+    assert response.status_code == 200
+    assert response.json() == {"ok": True, "actor": None}
+
+
+@pytest.mark.asyncio
+async def test_valid_token_still_authenticates(ds_error_shape):
+    token = "dstok_{}".format(
+        ds_error_shape.sign(
+            {"a": "root", "t": int(time.time())},
+            namespace="token",
+        )
+    )
+    response = await ds_error_shape.client.get(
+        "/-/actor.json", headers={"Authorization": f"Bearer {token}"}
+    )
+    assert response.status_code == 200
+    assert response.json()["actor"]["id"] == "root"
+
+
+@pytest.mark.asyncio
+async def test_bad_token_beats_valid_cookie(ds_error_shape):
+    # A malformed Authorization header is a hard error even if a valid
+    # ds_actor cookie is also present
+    response = await ds_error_shape.client.get(
+        "/-/actor.json",
+        headers={"Authorization": "Bearer dstok_garbage"},
+        cookies={"ds_actor": ds_error_shape.client.actor_cookie({"id": "root"})},
+    )
+    assert_canonical_error(response, 401)
+
+
+@pytest.mark.asyncio
+async def test_token_when_signed_tokens_disabled_returns_401(tmp_path_factory):
+    db_directory = tmp_path_factory.mktemp("dbs")
+    db_path = str(db_directory / "data.db")
+    conn = sqlite3.connect(db_path)
+    conn.execute("vacuum")
+    conn.close()
+    ds = Datasette([db_path], settings={"allow_signed_tokens": False})
+    try:
+        token = "dstok_{}".format(
+            ds.sign({"a": "root", "t": int(time.time())}, namespace="token")
+        )
+        response = await ds.client.get(
+            "/-/actor.json", headers={"Authorization": f"Bearer {token}"}
+        )
+        data = assert_canonical_error(response, 401)
+        assert "not enabled" in data["error"]
+    finally:
+        ds.close()
+
+
+# GET /db/-/query without SQL: 400 for data formats, HTML editor stays 200
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "path",
+    (
+        "/fixtures/-/query.json",
+        "/fixtures/-/query.json?sql=",
+    ),
+)
+async def test_query_json_without_sql_is_400(ds_client, path):
+    response = await ds_client.get(path)
+    data = assert_canonical_error(response, 400)
+    assert data["errors"] == ["?sql= is required"]
+
+
+@pytest.mark.asyncio
+async def test_query_html_without_sql_is_still_the_editor(ds_client):
+    response = await ds_client.get("/fixtures/-/query")
+    assert response.status_code == 200
+    assert response.headers["content-type"].startswith("text/html")
+
+
+# Write API return:true responses use "rows" consistently
+
+
+@pytest.mark.asyncio
+async def test_row_update_return_uses_rows_list(ds_error_shape):
+    await ds_error_shape.client.post(
+        "/data/docs/-/insert",
+        json={"row": {"id": 1, "title": "One"}},
+        headers={"Content-Type": "application/json"},
+        actor={"id": "root"},
+    )
+    response = await ds_error_shape.client.post(
+        "/data/docs/1/-/update",
+        json={"update": {"title": "Updated"}, "return": True},
+        headers={"Content-Type": "application/json"},
+        actor={"id": "root"},
+    )
+    assert response.status_code == 200
+    data = response.json()
+    assert data["ok"] is True
+    assert "row" not in data
+    assert data["rows"] == [{"id": 1, "title": "Updated"}]
+
+
+# Schema endpoints: no existence oracle, no 500 on unknown database
+
+
+@pytest.mark.asyncio
+async def test_schema_endpoints_no_existence_oracle(tmp_path_factory):
+    db_directory = tmp_path_factory.mktemp("dbs")
+    db_path = str(db_directory / "data.db")
+    conn = sqlite3.connect(db_path)
+    conn.execute("vacuum")
+    conn.execute("create table docs (id integer primary key)")
+    conn.close()
+    ds = Datasette([db_path], default_deny=True)
+    ds.root_enabled = True
+    try:
+        # An actor without view-database cannot distinguish an existing
+        # database from a missing one
+        denied_existing = await ds.client.get("/data/-/schema.json")
+        denied_missing = await ds.client.get("/nope/-/schema.json")
+        assert denied_existing.status_code == denied_missing.status_code == 403
+
+        # An authorized actor sees the real thing
+        root_existing = await ds.client.get("/data/-/schema.json", actor={"id": "root"})
+        assert root_existing.status_code == 200
+        root_missing = await ds.client.get("/nope/-/schema.json", actor={"id": "root"})
+        assert root_missing.status_code == 404
+    finally:
+        ds.close()
+
+
+@pytest.mark.asyncio
+async def test_table_schema_unknown_database_is_404_not_500(ds_client):
+    response = await ds_client.get("/no_such_db/some_table/-/schema.json")
+    assert_canonical_error(response, 404)
+
+
+# Unknown _extra names are a 400, not silently ignored
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "path",
+    (
+        "/fixtures/facetable.json?_extra=nope",
+        "/fixtures/facetable.json?_extra=count,nope",
+        "/fixtures/simple_primary_key/1.json?_extra=nope",
+        "/fixtures/-/query.json?sql=select+1&_extra=nope",
+    ),
+)
+async def test_unknown_extra_is_400(ds_client, path):
+    response = await ds_client.get(path)
+    data = assert_canonical_error(response, 400)
+    assert data["errors"] == ["Unknown _extra: nope"]
+
+
+@pytest.mark.asyncio
+async def test_html_only_extra_via_json_is_400(ds_client):
+    # display_rows exists for the HTML view but is not part of the JSON API
+    response = await ds_client.get("/fixtures/facetable.json?_extra=display_rows")
+    data = assert_canonical_error(response, 400)
+    assert data["errors"] == ["Unknown _extra: display_rows"]
+
+
+@pytest.mark.asyncio
+async def test_unknown_extra_ignored_on_html_pages(ds_client):
+    response = await ds_client.get("/fixtures/facetable?_extra=nope")
+    assert response.status_code == 200
+    assert response.headers["content-type"].startswith("text/html")
+
+
+# /-/threads exposes runtime internals and requires permissions-debug
+
+
+@pytest.mark.asyncio
+async def test_threads_requires_permissions_debug(ds_error_shape):
+    denied = await ds_error_shape.client.get("/-/threads.json")
+    assert_canonical_error(denied, 403)
+    allowed = await ds_error_shape.client.get("/-/threads.json", actor={"id": "root"})
+    assert allowed.status_code == 200
+    assert allowed.json()["ok"] is True
+
+
+# _size is the one page-size parameter, with uniform validation
+
+
+@pytest.mark.asyncio
+async def test_query_list_size_supports_max_keyword(ds_client):
+    response = await ds_client.get("/fixtures/-/queries.json?_size=max")
+    assert response.status_code == 200
+    # ds_client runs with max_returned_rows=100
+    assert response.json()["limit"] == 100
+
+
+@pytest.mark.asyncio
+async def test_query_list_size_rejects_out_of_range(ds_client):
+    response = await ds_client.get("/fixtures/-/queries.json?_size=5000")
+    data = assert_canonical_error(response, 400)
+    assert data["errors"] == ["_size must be <= 100"]
+
+
+@pytest.mark.asyncio
+async def test_query_list_size_rejects_non_integer(ds_client):
+    response = await ds_client.get("/fixtures/-/queries.json?_size=bananas")
+    data = assert_canonical_error(response, 400)
+    assert data["errors"] == ["_size must be a positive integer"]
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("endpoint", ("allowed", "rules"))
+async def test_debug_endpoints_use_size_and_page_parameters(ds_error_shape, endpoint):
+    base = f"/-/{endpoint}.json?action=view-instance"
+    ok = await ds_error_shape.client.get(
+        base + "&_size=1&_page=1", actor={"id": "root"}
+    )
+    assert ok.status_code == 200
+    assert ok.json()["page_size"] == 1
+
+    max_size = await ds_error_shape.client.get(
+        base + "&_size=max", actor={"id": "root"}
+    )
+    assert max_size.status_code == 200
+    assert max_size.json()["page_size"] == 200
+
+    too_big = await ds_error_shape.client.get(base + "&_size=500", actor={"id": "root"})
+    data = assert_canonical_error(too_big, 400)
+    assert data["errors"] == ["_size must be <= 200"]
+
+    bad_page = await ds_error_shape.client.get(base + "&_page=0", actor={"id": "root"})
+    data = assert_canonical_error(bad_page, 400)
+    assert data["errors"] == ["_page must be a positive integer"]
+
+
+# Write endpoints parse the body as JSON regardless of Content-Type
+
+
+@pytest.mark.asyncio
+async def test_insert_works_without_content_type_header(ds_error_shape):
+    # Previously a 500 AttributeError
+    response = await ds_error_shape.client.post(
+        "/data/docs/-/insert",
+        content='{"row": {"id": 1, "title": "One"}}',
+        actor={"id": "root"},
+    )
+    assert response.status_code == 201
+    assert response.json()["rows"][0]["title"] == "One"
+
+
+@pytest.mark.asyncio
+async def test_insert_works_with_form_content_type(ds_error_shape):
+    # Previously 400 "Invalid content-type, must be application/json"
+    response = await ds_error_shape.client.post(
+        "/data/docs/-/insert",
+        content='{"row": {"id": 2, "title": "Two"}}',
+        headers={"Content-Type": "application/x-www-form-urlencoded"},
+        actor={"id": "root"},
+    )
+    assert response.status_code == 201
+
+
+@pytest.mark.asyncio
+async def test_insert_form_encoded_body_is_invalid_json(ds_error_shape):
+    response = await ds_error_shape.client.post(
+        "/data/docs/-/insert",
+        content="title=Three",
+        headers={"Content-Type": "application/x-www-form-urlencoded"},
+        actor={"id": "root"},
+    )
+    data = assert_canonical_error(response, 400)
+    assert data["errors"][0].startswith("Invalid JSON:")
+
+
+@pytest.mark.asyncio
+async def test_alter_and_set_column_type_ignore_content_type(ds_error_shape):
+    alter = await ds_error_shape.client.post(
+        "/data/docs/-/alter",
+        content='{"operations": [{"op": "add_column", "args": {"name": "extra"}}]}',
+        actor={"id": "root"},
+    )
+    assert alter.status_code == 200, alter.text
+    sct = await ds_error_shape.client.post(
+        "/data/docs/-/set-column-type",
+        content='{"column": "title", "column_type": {"type": "textarea"}}',
+        actor={"id": "root"},
+    )
+    assert sct.status_code == 200, sct.text
+
+
+# SQL Interrupted errors carry plain text in JSON, not an HTML fragment
+
+
+@pytest.mark.asyncio
+async def test_sql_interrupted_json_error_is_plain_text(ds_client):
+    response = await ds_client.get(
+        "/fixtures/-/query.json?sql=select+sleep(0.01)&_timelimit=5"
+    )
+    data = assert_canonical_error(response, 400)
+    assert "<" not in data["error"]
+    assert data["error"].startswith("SQL query took too long.")
+
+
+@pytest.mark.asyncio
+async def test_sql_interrupted_html_page_keeps_rich_error(ds_client):
+    response = await ds_client.get(
+        "/fixtures/-/query?sql=select+sleep(0.01)&_timelimit=5"
+    )
+    assert response.status_code == 400
+    assert "<textarea" in response.text
+
+
+@pytest.mark.asyncio
+async def test_next_url_extra_no_longer_exists(ds_client):
+    # next_url is always present in table JSON; the extra was removed
+    response = await ds_client.get("/fixtures/facetable.json?_extra=next_url")
+    data = assert_canonical_error(response, 400)
+    assert data["errors"] == ["Unknown _extra: next_url"]
diff --git a/tests/test_extras.py b/tests/test_extras.py
index ad8a9f00..4e008926 100644
--- a/tests/test_extras.py
+++ b/tests/test_extras.py
@@ -1,4 +1,5 @@
 import asyncio
+from typing import ClassVar
 
 import pytest
 
@@ -7,7 +8,7 @@ from datasette.extras import Extra, ExtraRegistry, ExtraScope
 
 class SlowValueExtra(Extra):
     description = "Returns context['value'], optionally slowly"
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
 
     async def resolve(self, context):
         if context["slow"]:
@@ -17,12 +18,44 @@ class SlowValueExtra(Extra):
 
 class DependentExtra(Extra):
     description = "Depends on slow_value"
-    scopes = {ExtraScope.TABLE}
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
 
     async def resolve(self, context, slow_value):
         return slow_value + 1
 
 
+class InternalOnlyExtra(Extra):
+    description = "Internal extra for HTML templates only"
+    scopes: ClassVar[set[ExtraScope]] = {ExtraScope.TABLE}
+    public = False
+
+    async def resolve(self, context):
+        return "internal"
+
+
+def test_internal_classes_for_scope():
+    registry = ExtraRegistry([SlowValueExtra, DependentExtra, InternalOnlyExtra])
+    assert registry.internal_classes_for_scope(ExtraScope.TABLE) == [InternalOnlyExtra]
+    assert registry.public_classes_for_scope(ExtraScope.TABLE) == [
+        SlowValueExtra,
+        DependentExtra,
+    ]
+
+
+def _registered_extra_classes():
+    # Plain Providers are internal dependency plumbing, only Extra
+    # subclasses surface as documented JSON/template keys
+    from datasette.views.table_extras import table_extra_registry
+
+    return [cls for cls in table_extra_registry.classes if issubclass(cls, Extra)]
+
+
+@pytest.mark.parametrize("cls", _registered_extra_classes(), ids=lambda cls: cls.key())
+def test_registered_extras_have_descriptions(cls):
+    # Every registered extra is part of the documented template/JSON contract
+    assert cls.description, f"{cls.__name__} is missing a description"
+
+
 def test_registry_is_built_once_per_scope():
     registry = ExtraRegistry([SlowValueExtra, DependentExtra])
     first = registry._registry_for_scope(ExtraScope.TABLE)
diff --git a/tests/test_facets.py b/tests/test_facets.py
index 8c22ffce..b8eb6e61 100644
--- a/tests/test_facets.py
+++ b/tests/test_facets.py
@@ -1,11 +1,14 @@
+import json
+
+import pytest
+
 from datasette.app import Datasette
 from datasette.database import Database
-from datasette.facets import Facet, ColumnFacet, ArrayFacet, DateFacet
-from datasette.utils.asgi import Request
+from datasette.facets import ArrayFacet, ColumnFacet, DateFacet, Facet
 from datasette.utils import detect_json1
+from datasette.utils.asgi import Request
+
 from .fixtures import make_app_client
-import json
-import pytest
 
 
 @pytest.mark.asyncio
@@ -537,7 +540,7 @@ async def test_facet_size():
         for j in range(1, 4):
             await db.execute_write(
                 "insert into neighbourhoods (city, neighbourhood) values (?, ?)",
-                ["City {}".format(i), "Neighbourhood {}".format(j)],
+                [f"City {i}", f"Neighbourhood {j}"],
             )
     response = await ds.client.get(
         "/test_facet_size/neighbourhoods.json?_extra=suggested_facets"
diff --git a/tests/test_filters.py b/tests/test_filters.py
index eda9e9a1..8d0f3512 100644
--- a/tests/test_filters.py
+++ b/tests/test_filters.py
@@ -1,7 +1,8 @@
-from datasette.filters import Filters, through_filters, where_filters, search_filters
-from datasette.utils.asgi import Request
 import pytest
 
+from datasette.filters import Filters, search_filters, through_filters, where_filters
+from datasette.utils.asgi import Request
+
 
 @pytest.mark.parametrize(
     "args,expected_where,expected_params",
diff --git a/tests/test_html.py b/tests/test_html.py
index 20ab22bc..6a7b4907 100644
--- a/tests/test_html.py
+++ b/tests/test_html.py
@@ -1,15 +1,19 @@
-from bs4 import BeautifulSoup as Soup
-from datasette.app import Datasette
-from datasette.utils import allowed_pragmas
-from .fixtures import make_app_client
-from .utils import assert_footer_links, inner_html
 import copy
+import hashlib
 import json
 import pathlib
-import pytest
 import re
 import urllib.parse
 
+import pytest
+from bs4 import BeautifulSoup as Soup
+
+from datasette.app import Datasette
+from datasette.utils import allowed_pragmas
+
+from .fixtures import make_app_client
+from .utils import assert_footer_links, inner_html
+
 
 def test_homepage(app_client_two_attached_databases):
     response = app_client_two_attached_databases.get("/")
@@ -83,7 +87,7 @@ async def test_homepage_options(ds_client):
 async def test_favicon(ds_client):
     response = await ds_client.get("/favicon.ico")
     assert response.status_code == 200
-    assert response.headers["cache-control"] == "max-age=3600, immutable, public"
+    assert response.headers["cache-control"] == "max-age=3600, public"
     assert int(response.headers["content-length"]) > 100
     assert response.headers["content-type"] == "image/png"
 
@@ -101,6 +105,24 @@ async def test_static(ds_client):
     assert response.status_code == 304
 
 
+@pytest.mark.asyncio
+async def test_static_hash_cache_control(ds_client):
+    hashed_url = ds_client.ds.static("app.css")
+    response = await ds_client.get(hashed_url)
+    assert response.status_code == 200
+    assert response.headers["cache-control"] == "max-age=31536000, immutable, public"
+
+    response = await ds_client.get(
+        hashed_url, headers={"if-none-match": response.headers["etag"]}
+    )
+    assert response.status_code == 304
+    assert response.headers["cache-control"] == "max-age=31536000, immutable, public"
+
+    response = await ds_client.get("/-/static/app.css?_hash=incorrect")
+    assert response.status_code == 200
+    assert "cache-control" not in response.headers
+
+
 def test_static_mounts():
     with make_app_client(
         static_mounts=[("custom-static", str(pathlib.Path(__file__).parent))]
@@ -113,6 +135,21 @@ def test_static_mounts():
         assert response.status_code == 404
 
 
+def test_static_mounts_hash_cache_control():
+    mount_path = pathlib.Path(__file__).parent
+    with make_app_client(static_mounts=[("custom-static", str(mount_path))]) as client:
+        response = client.get(client.ds.static("test_html.py", mount="custom-static"))
+        assert response.status_code == 200
+        assert (
+            response.headers["cache-control"] == "max-age=31536000, immutable, public"
+        )
+
+        incorrect_hash = hashlib.sha256(b"incorrect").hexdigest()[:12]
+        response = client.get(f"/custom-static/test_html.py?_hash={incorrect_hash}")
+        assert response.status_code == 200
+        assert "cache-control" not in response.headers
+
+
 def test_memory_database_page():
     with make_app_client(memory=True) as client:
         response = client.get("/_memory")
@@ -183,11 +220,9 @@ async def test_disallowed_custom_sql_pragma(ds_client):
         "/fixtures/-/query?sql=SELECT+*+FROM+pragma_not_on_allow_list('idx52')"
     )
     assert response.status_code == 400
-    pragmas = ", ".join("pragma_{}()".format(pragma) for pragma in allowed_pragmas)
+    pragmas = ", ".join(f"pragma_{pragma}()" for pragma in allowed_pragmas)
     assert (
-        "Statement contained a disallowed PRAGMA. Allowed pragma functions are {}".format(
-            pragmas
-        )
+        f"Statement contained a disallowed PRAGMA. Allowed pragma functions are {pragmas}"
         in response.text
     )
 
@@ -609,7 +644,7 @@ async def test_404(ds_client, path):
     response = await ds_client.get(path)
     assert response.status_code == 404
     assert (
-        f'<link rel="stylesheet" href="/-/static/app.css?{ds_client.ds.app_css_hash()}'
+        '<link rel="stylesheet" href="{}"'.format(ds_client.ds.static("app.css"))
         in response.text
     )
 
@@ -742,8 +777,8 @@ def test_stored_query_show_hide_metadata_option(
         },
         memory=True,
     ) as client:
-        expected_show_hide_fragment = '(<a href="{}">{}</a>)'.format(
-            expected_show_hide_link, expected_show_hide_text
+        expected_show_hide_fragment = (
+            f'(<a href="{expected_show_hide_link}">{expected_show_hide_text}</a>)'
         )
         response = client.get("/_memory/one" + querystring)
         html = response.text
@@ -752,10 +787,7 @@ def test_stored_query_show_hide_metadata_option(
         )[0]
         assert show_hide_fragment == expected_show_hide_fragment
         if expected_hidden:
-            assert (
-                '<input type="hidden" name="{}" value="1">'.format(expected_hidden)
-                in html
-            )
+            assert f'<input type="hidden" name="{expected_hidden}" value="1">' in html
         else:
             assert '<input type="hidden" ' not in html
 
@@ -1082,7 +1114,9 @@ async def test_navigation_menu_links(
     navigation_search_script = soup.find(
         "script", {"src": re.compile(r"navigation-search\.js")}
     )
-    assert navigation_search_script["src"] == "/-/static/navigation-search.js"
+    assert navigation_search_script["src"] == ds_client.ds.static(
+        "navigation-search.js"
+    )
     assert details.find("li").find("button") == search_button
     if not actor_id:
         # The app menu is always visible, but anonymous users do not see logout
@@ -1156,13 +1190,9 @@ async def test_alternate_url_json(ds_client, path, expected):
     response = await ds_client.get(path)
     assert response.status_code == 200
     link = response.headers["link"]
-    assert link == '<{}>; rel="alternate"; type="application/json+datasette"'.format(
-        expected
-    )
+    assert link == f'<{expected}>; rel="alternate"; type="application/json+datasette"'
     assert (
-        '<link rel="alternate" type="application/json+datasette" href="{}">'.format(
-            expected
-        )
+        f'<link rel="alternate" type="application/json+datasette" href="{expected}">'
         in response.text
     )
 
@@ -1254,8 +1284,8 @@ async def test_database_color(ds_client):
     expected_color = ds_client.ds.get_database("fixtures").color
     # Should be something like #9403e5
     expected_fragments = (
-        "10px solid #{}".format(expected_color),
-        "border-color: #{}".format(expected_color),
+        f"10px solid #{expected_color}",
+        f"border-color: #{expected_color}",
     )
     assert len(expected_color) == 6
     for path in (
@@ -1325,12 +1355,12 @@ async def test_permission_debug_tabs_with_query_string(ds_client):
 
         # Test /-/allowed with query string
         response = await ds_client.get(
-            "/-/allowed?action=view-table&page_size=50", actor=actor
+            "/-/allowed?action=view-table&_size=50", actor=actor
         )
         assert response.status_code == 200
         # Check that Rules and Check tabs have the query string
-        assert 'href="/-/rules?action=view-table&amp;page_size=50"' in response.text
-        assert 'href="/-/check?action=view-table&amp;page_size=50"' in response.text
+        assert 'href="/-/rules?action=view-table&amp;_size=50"' in response.text
+        assert 'href="/-/check?action=view-table&amp;_size=50"' in response.text
         # Playground and Actions should not have query string
         assert 'href="/-/permissions"' in response.text
         assert 'href="/-/actions"' in response.text
diff --git a/tests/test_internal_db.py b/tests/test_internal_db.py
index 26d63a92..b4bb964d 100644
--- a/tests/test_internal_db.py
+++ b/tests/test_internal_db.py
@@ -1,5 +1,9 @@
+import sqlite3
+
 import pytest
-import sqlite_utils
+
+from datasette.utils import escape_sqlite
+from datasette.utils.internal_db import INTERNAL_DB_SCHEMA_SQL
 
 
 # ensure refresh_schemas() gets called before interacting with internal_db
@@ -16,6 +20,53 @@ async def test_internal_databases(ds_client):
     assert databases.rows[0]["database_name"] == "fixtures"
 
 
+@pytest.mark.asyncio
+async def test_internal_migrations_recorded(ds_client):
+    internal_db = await ensure_internal(ds_client)
+    migrations = await internal_db.execute("""
+        select migration_set, name
+        from _sqlite_migrations
+        order by id
+        """)
+    assert [tuple(row) for row in migrations.rows] == [
+        ("datasette_internal", "0001_initial")
+    ]
+
+
+@pytest.mark.asyncio
+async def test_internal_migrations_adopt_existing_internal_db(tmp_path):
+    from datasette.app import Datasette
+
+    internal_db_path = str(tmp_path / "internal.db")
+    conn = sqlite3.connect(internal_db_path)
+    conn.executescript(INTERNAL_DB_SCHEMA_SQL)
+    conn.execute(
+        "insert into metadata_instance (key, value) values (?, ?)",
+        ("legacy", "preserved"),
+    )
+    conn.commit()
+    conn.close()
+
+    ds = Datasette(internal=internal_db_path)
+    await ds.invoke_startup()
+    internal_db = ds.get_internal_database()
+
+    metadata = await internal_db.execute(
+        "select key, value from metadata_instance where key = 'legacy'"
+    )
+    assert [tuple(row) for row in metadata.rows] == [("legacy", "preserved")]
+    migrations = await internal_db.execute("""
+        select migration_set, name
+        from _sqlite_migrations
+        order by id
+        """)
+    assert [tuple(row) for row in migrations.rows] == [
+        ("datasette_internal", "0001_initial")
+    ]
+
+    ds.close()
+
+
 @pytest.mark.asyncio
 async def test_internal_tables(ds_client):
     internal_db = await ensure_internal(ds_client)
@@ -76,19 +127,62 @@ async def test_internal_foreign_key_references(ds_client):
     internal_db = await ensure_internal(ds_client)
 
     def inner(conn):
-        db = sqlite_utils.Database(conn)
-        table_names = db.table_names()
-        for table in db.tables:
-            for fk in table.foreign_keys:
-                other_table = fk.other_table
-                other_column = fk.other_column
-                message = 'Column "{}.{}" references other column "{}.{}" which does not exist'.format(
-                    table.name, fk.column, other_table, other_column
+        table_names = [
+            row[0]
+            for row in conn.execute(
+                "select name from sqlite_master where type = 'table'"
+            ).fetchall()
+        ]
+
+        def columns_for_table(table_name):
+            return {
+                row[1]
+                for row in conn.execute(
+                    f"PRAGMA table_info({escape_sqlite(table_name)})"
+                ).fetchall()
+            }
+
+        def primary_keys_for_table(table_name):
+            return [
+                name
+                for _, name in sorted(
+                    (row[5], row[1])
+                    for row in conn.execute(
+                        f"PRAGMA table_info({escape_sqlite(table_name)})"
+                    ).fetchall()
+                    if row[5]
                 )
+            ]
+
+        columns_by_table = {
+            table_name: columns_for_table(table_name) for table_name in table_names
+        }
+
+        for table_name in table_names:
+            foreign_key_rows = conn.execute(
+                f"PRAGMA foreign_key_list({escape_sqlite(table_name)})"
+            ).fetchall()
+            foreign_keys_by_id = {}
+            for foreign_key in foreign_key_rows:
+                foreign_keys_by_id.setdefault(foreign_key[0], []).append(foreign_key)
+
+            for foreign_key_rows in foreign_keys_by_id.values():
+                foreign_key_rows.sort(key=lambda row: row[1])
+                other_table = foreign_key_rows[0][2]
+                other_columns = [row[4] for row in foreign_key_rows]
+                message = f'Column "{table_name}.{foreign_key_rows[0][3]}" references other table "{other_table}" which does not exist'
                 assert other_table in table_names, message + " (bad table)"
-                assert other_column in db[other_table].columns_dict, (
-                    message + " (bad column)"
-                )
+                if all(other_column is None for other_column in other_columns):
+                    other_columns = primary_keys_for_table(other_table)
+                length_message = f'Foreign key from "{table_name}" to "{other_table}" has {len(foreign_key_rows)} columns but references {len(other_columns)} columns'
+                assert len(other_columns) == len(foreign_key_rows), length_message
+
+                for foreign_key, other_column in zip(foreign_key_rows, other_columns):
+                    column = foreign_key[3]
+                    message = f'Column "{table_name}.{column}" references other column "{other_table}.{other_column}" which does not exist'
+                    assert other_column in columns_by_table[other_table], (
+                        message + " (bad column)"
+                    )
 
     await internal_db.execute_fn(inner)
 
@@ -143,10 +237,10 @@ async def test_stale_catalog_entry_database_fix(tmp_path):
 
 @pytest.mark.asyncio
 async def test_stale_catalog_child_entries_removed_for_missing_database(tmp_path):
-    from datasette.app import Datasette
-
     import sqlite3
 
+    from datasette.app import Datasette
+
     internal_db_path = str(tmp_path / "internal.db")
     alpha_db_path = str(tmp_path / "alpha.db")
     bravo_db_path = str(tmp_path / "bravo.db")
@@ -191,10 +285,10 @@ async def test_stale_catalog_child_entries_removed_for_missing_database(tmp_path
 
 @pytest.mark.asyncio
 async def test_orphan_stale_catalog_child_entries_removed(tmp_path):
-    from datasette.app import Datasette
-
     import sqlite3
 
+    from datasette.app import Datasette
+
     internal_db_path = str(tmp_path / "internal.db")
     alpha_db_path = str(tmp_path / "alpha.db")
 
diff --git a/tests/test_internals_database.py b/tests/test_internals_database.py
index bad4e8ca..b1093b1c 100644
--- a/tests/test_internals_database.py
+++ b/tests/test_internals_database.py
@@ -3,16 +3,23 @@ Tests for the datasette.database.Database class
 """
 
 import asyncio
-from types import SimpleNamespace
-from datasette.app import Datasette
-from datasette.database import Database, ExecuteWriteResult, Results, MultipleValues
-from datasette.database import DatasetteClosedError
-from datasette.database import _deliver_write_result
-from datasette.utils.sqlite import sqlite3, supports_returning
-from datasette.utils import Column
-import pytest
-import time
 import uuid
+from types import SimpleNamespace
+
+import pytest
+import sqlite_utils
+
+from datasette.app import Datasette
+from datasette.database import (
+    Database,
+    DatasetteClosedError,
+    ExecuteWriteResult,
+    MultipleValues,
+    Results,
+    _deliver_write_result,
+)
+from datasette.utils import Column
+from datasette.utils.sqlite import sqlite3, supports_returning
 
 requires_sqlite_returning = pytest.mark.skipif(
     not supports_returning(), reason="SQLite does not support RETURNING"
@@ -43,7 +50,7 @@ async def test_results_first(db):
 @pytest.mark.parametrize("expected", (True, False))
 async def test_results_bool(db, expected):
     where = "" if expected else "where pk = 0"
-    results = await db.execute("select * from facetable {}".format(where))
+    results = await db.execute(f"select * from facetable {where}")
     assert bool(results) is expected
 
 
@@ -615,7 +622,7 @@ async def test_execute_write_block_false(db):
         "update roadside_attractions set name = ? where pk = ?",
         ["Mystery!", 1],
     )
-    time.sleep(0.1)
+    await asyncio.sleep(0.1)
     rows = await db.execute("select name from roadside_attractions where pk = 1")
     assert "Mystery!" == rows.rows[0][0]
 
@@ -633,7 +640,7 @@ async def test_execute_write_with_returning_block_false(db):
     )
 
     assert isinstance(task_id, uuid.UUID)
-    time.sleep(0.1)
+    await asyncio.sleep(0.1)
     assert (
         await db.execute("select name from write_returning_block_false")
     ).single_value() == "Cleo"
@@ -718,15 +725,51 @@ async def test_execute_write_fn_exception(db):
         await db.execute_write_fn(write_fn)
 
 
+@pytest.mark.asyncio
+@pytest.mark.parametrize("num_sql_threads", (0, 1))
+async def test_execute_write_fn_sqlite_utils_transaction(tmp_path, num_sql_threads):
+    # A write inside a failing Datasette task must never become visible or
+    # survive the rollback. Exercise both the synchronous and writer-thread
+    # paths against a file-backed database so a second connection can observe
+    # committed state independently.
+    db_path = tmp_path / "test.db"
+    sqlite3.connect(db_path).close()
+    ds = Datasette([str(db_path)], settings={"num_sql_threads": num_sql_threads})
+    db = ds.get_database("test")
+    await db.execute_write("create table items (id integer primary key)")
+    # This reader is used inside the write callback, which may run on another
+    # thread, but it is never accessed concurrently.
+    reader = sqlite3.connect(db_path, check_same_thread=False)
+
+    def insert_then_fail(conn):
+        # Datasette must open the outer transaction before sqlite-utils writes.
+        assert conn.in_transaction
+        sqlite_utils.Database(conn)["items"].insert({"id": 1})
+        # If sqlite-utils committed its own transaction, this would return 1.
+        assert reader.execute("select count(*) from items").fetchone()[0] == 0
+        # Simulate a later step failing after the sqlite-utils write succeeded.
+        raise ValueError("deliberate")
+
+    try:
+        with pytest.raises(ValueError, match="deliberate"):
+            await db.execute_write_fn(insert_then_fail)
+        # The outer transaction must roll back the sqlite-utils write as well.
+        assert reader.execute("select count(*) from items").fetchone()[0] == 0
+    finally:
+        reader.close()
+        db.close()
+
+
 @pytest.mark.asyncio
 @pytest.mark.parametrize("param_name", ["conn", "connection", "db", "c"])
 async def test_execute_write_fn_accepts_any_single_param_name(db, param_name):
     # Plugins historically relied on the fact that the callback was invoked
     # positionally, so any parameter name worked. Preserve that contract.
     scope = {}
-    exec(
-        "def write_fn({0}):\n"
-        "    return {0}.execute('select 1 + 1').fetchone()[0]".format(param_name),
+    # exec() is how we build a function with a parameterized argument name
+    exec(  # noqa: S102
+        f"def write_fn({param_name}):\n"
+        f"    return {param_name}.execute('select 1 + 1').fetchone()[0]",
         scope,
     )
     write_fn = scope["write_fn"]
@@ -750,7 +793,9 @@ async def test_execute_write_fn_with_track_event(db):
 
 
 @pytest.mark.asyncio
-@pytest.mark.timeout(1)
+# func_only so the budget covers the write-thread call under test, not the
+# one-off app_client fixture setup this test may be first to trigger
+@pytest.mark.timeout(1, func_only=True)
 async def test_execute_write_fn_connection_exception(tmpdir, app_client):
     path = str(tmpdir / "immutable.db")
     conn = sqlite3.connect(path)
diff --git a/tests/test_internals_datasette.py b/tests/test_internals_datasette.py
index 3f867eb0..ed2aeaf0 100644
--- a/tests/test_internals_datasette.py
+++ b/tests/test_internals_datasette.py
@@ -4,15 +4,20 @@ Tests for the datasette.app.Datasette class
 
 import asyncio
 import dataclasses
+import hashlib
+import importlib
 import os
 import sqlite3
 import time
+
+import pytest
+from itsdangerous import BadSignature
+
 from datasette import Context
-from datasette.app import Datasette, Database, ResourcesSQL
+from datasette.app import Database, Datasette, ResourcesSQL
 from datasette.database import DatasetteClosedError
 from datasette.resources import DatabaseResource
-from itsdangerous import BadSignature
-import pytest
+from datasette.utils import PrefixedUrlString
 
 
 @pytest.fixture
@@ -56,10 +61,111 @@ def test_datasette_setting(datasette, setting, expected):
     assert datasette.setting(setting) == expected
 
 
+def _setup_static_app_root(tmp_path, monkeypatch, filename, content):
+    app_module = importlib.import_module("datasette.app")
+    app_root = tmp_path / "app-root"
+    static_path = app_root / "datasette" / "static"
+    static_path.mkdir(parents=True)
+    asset_path = static_path / filename
+    asset_path.write_bytes(content)
+    monkeypatch.setattr(app_module, "app_root", app_root)
+    return asset_path
+
+
+@pytest.mark.asyncio
+async def test_static_template_function_hashes_core_asset(tmp_path, monkeypatch):
+    _setup_static_app_root(tmp_path, monkeypatch, "demo.js", b"const demo = true;")
+    ds = Datasette()
+    template = ds.get_jinja_environment().from_string("{{ static('demo.js') }}")
+    expected_hash = hashlib.sha256(b"const demo = true;").hexdigest()[:12]
+
+    assert await template.render_async() == f"/-/static/demo.js?_hash={expected_hash}"
+    assert isinstance(ds.static("demo.js"), PrefixedUrlString)
+
+
+def test_static_hash_cached_when_cache_headers_enabled(tmp_path, monkeypatch):
+    asset_path = _setup_static_app_root(tmp_path, monkeypatch, "demo.js", b"let a = 1;")
+    ds = Datasette(cache_headers=True)
+    first_url = ds.static("demo.js")
+
+    asset_path.write_bytes(b"let a = 2;")
+
+    assert ds.static("demo.js") == first_url
+
+
+def test_static_hash_recalculated_when_cache_headers_disabled(tmp_path, monkeypatch):
+    asset_path = _setup_static_app_root(tmp_path, monkeypatch, "demo.js", b"let a = 1;")
+    ds = Datasette(cache_headers=False)
+    first_url = ds.static("demo.js")
+
+    asset_path.write_bytes(b"let a = 2;")
+
+    expected_hash = hashlib.sha256(b"let a = 2;").hexdigest()[:12]
+    assert ds.static("demo.js") == f"/-/static/demo.js?_hash={expected_hash}"
+    assert ds.static("demo.js") != first_url
+
+
+def test_static_hashes_mounted_static_file(tmp_path):
+    static_path = tmp_path / "static-files"
+    static_path.mkdir()
+    asset_path = static_path / "styles.css"
+    asset_path.write_bytes(b"body { color: black; }")
+    ds = Datasette(static_mounts=[("assets", str(static_path))])
+    expected_hash = hashlib.sha256(b"body { color: black; }").hexdigest()[:12]
+
+    assert ds.static("styles.css", mount="assets") == (
+        f"/assets/styles.css?_hash={expected_hash}"
+    )
+
+    ds._settings["base_url"] = "/prefix/"
+    assert ds.static("styles.css", mount="assets") == (
+        f"/prefix/assets/styles.css?_hash={expected_hash}"
+    )
+
+
+def test_static_hashes_plugin_static_file(tmp_path, monkeypatch):
+    plugin_static_path = tmp_path / "plugin-static"
+    plugin_static_path.mkdir()
+    asset_path = plugin_static_path / "plugin.js"
+    asset_path.write_bytes(b"console.log('plugin');")
+    app_module = importlib.import_module("datasette.app")
+    monkeypatch.setattr(
+        app_module,
+        "get_plugins",
+        lambda: [
+            {
+                "name": "datasette-cluster-map",
+                "static_path": str(plugin_static_path),
+                "templates_path": None,
+            }
+        ],
+    )
+    ds = Datasette()
+    expected_hash = hashlib.sha256(b"console.log('plugin');").hexdigest()[:12]
+
+    assert ds.static("plugin.js", plugin="datasette_cluster_map") == (
+        f"/-/static-plugins/datasette_cluster_map/plugin.js?_hash={expected_hash}"
+    )
+
+
+def test_static_rejects_plugin_and_mount():
+    ds = Datasette()
+    with pytest.raises(ValueError):
+        ds.static("styles.css", plugin="datasette_cluster_map", mount="assets")
+
+
+def test_static_rejects_path_traversal(tmp_path, monkeypatch):
+    _setup_static_app_root(tmp_path, monkeypatch, "demo.js", b"")
+    ds = Datasette()
+
+    with pytest.raises(ValueError, match="cannot escape static root"):
+        ds.static("../secret.js")
+
+
 @pytest.mark.asyncio
 async def test_datasette_constructor():
     ds = Datasette()
-    databases = (await ds.client.get("/-/databases.json")).json()
+    databases = (await ds.client.get("/-/databases.json")).json()["databases"]
     assert databases == [
         {
             "name": "_memory",
@@ -76,11 +182,12 @@ async def test_datasette_constructor():
 @pytest.mark.asyncio
 async def test_num_sql_threads_zero():
     ds = Datasette([], memory=True, settings={"num_sql_threads": 0})
+    ds.root_enabled = True
     db = ds.add_database(Database(ds, memory_name="test_num_sql_threads_zero"))
     await db.execute_write("create table t(id integer primary key)")
     await db.execute_write("insert into t (id) values (1)")
-    response = await ds.client.get("/-/threads.json")
-    assert response.json() == {"num_threads": 0, "threads": []}
+    response = await ds.client.get("/-/threads.json", actor={"id": "root"})
+    assert response.json() == {"ok": True, "num_threads": 0, "threads": []}
     response2 = await ds.client.get("/test_num_sql_threads_zero/t.json?_shape=array")
     assert response2.json() == [{"id": 1}]
 
@@ -344,3 +451,28 @@ async def test_datasette_close_continues_past_db_error():
         ds.close()
     assert good._closed
     assert ds._internal_database._closed
+
+
+@pytest.mark.asyncio
+async def test_datasette_render_template_dataclass_values_not_deep_copied():
+    # display_rows can contain values like sqlite3.Row that cannot be
+    # deep-copied, so render_template must convert Context dataclasses
+    # shallowly - https://github.com/simonw/datasette/issues/2127
+    class RefusesDeepCopy:
+        def __deepcopy__(self, memo):
+            raise RuntimeError("deepcopy not supported")
+
+        def __str__(self):
+            return "shallow-copied-value"
+
+    @dataclasses.dataclass
+    class ExampleContext(Context):
+        title: str
+        status: int
+        error: RefusesDeepCopy
+
+    context = ExampleContext(title="Hello", status=200, error=RefusesDeepCopy())
+    ds = Datasette(memory=True)
+    await ds.invoke_startup()
+    rendered = await ds.render_template("error.html", context)
+    assert "shallow-copied-value" in rendered
diff --git a/tests/test_internals_datasette_client.py b/tests/test_internals_datasette_client.py
index 543077a5..51b38f8d 100644
--- a/tests/test_internals_datasette_client.py
+++ b/tests/test_internals_datasette_client.py
@@ -1,6 +1,7 @@
 import httpx
 import pytest
 import pytest_asyncio
+
 from datasette.app import Datasette
 
 
@@ -238,7 +239,7 @@ async def test_in_client_returns_false_outside_request(datasette):
 @pytest.mark.asyncio
 async def test_in_client_returns_true_inside_request():
     """Test that datasette.in_client() returns True inside a client request"""
-    from datasette import hookimpl, Response
+    from datasette import Response, hookimpl
 
     class TestPlugin:
         __name__ = "test_in_client_plugin"
@@ -318,7 +319,7 @@ async def test_actor_parameter_sets_cookie(datasette):
     """Passing actor= should sign a ds_actor cookie and authenticate the request."""
     response = await datasette.client.get("/-/actor.json", actor={"id": "root"})
     assert response.status_code == 200
-    assert response.json() == {"actor": {"id": "root"}}
+    assert response.json() == {"ok": True, "actor": {"id": "root"}}
 
 
 @pytest.mark.asyncio
@@ -327,7 +328,7 @@ async def test_actor_parameter_works_with_request_method(datasette):
         "GET", "/-/actor.json", actor={"id": "root"}
     )
     assert response.status_code == 200
-    assert response.json() == {"actor": {"id": "root"}}
+    assert response.json() == {"ok": True, "actor": {"id": "root"}}
 
 
 @pytest.mark.asyncio
@@ -362,7 +363,7 @@ async def test_actor_parameter_merges_with_other_cookies(datasette):
         cookies={"unrelated": "value"},
     )
     assert response.status_code == 200
-    assert response.json() == {"actor": {"id": "root"}}
+    assert response.json() == {"ok": True, "actor": {"id": "root"}}
 
 
 @pytest.mark.asyncio
diff --git a/tests/test_internals_request.py b/tests/test_internals_request.py
index 9c448186..e982628b 100644
--- a/tests/test_internals_request.py
+++ b/tests/test_internals_request.py
@@ -1,7 +1,39 @@
-from datasette.utils.asgi import Request
 import json
+
 import pytest
 
+from datasette.utils.asgi import PayloadTooLarge, Request
+
+
+def _post_scope(headers=None):
+    return {
+        "http_version": "1.1",
+        "method": "POST",
+        "path": "/",
+        "raw_path": b"/",
+        "query_string": b"",
+        "scheme": "http",
+        "type": "http",
+        "headers": headers or [[b"content-type", b"application/json"]],
+    }
+
+
+def _receive_chunks(chunks):
+    messages = [
+        {
+            "type": "http.request",
+            "body": chunk,
+            "more_body": i < len(chunks) - 1,
+        }
+        for i, chunk in enumerate(chunks)
+    ]
+    messages.reverse()
+
+    async def receive():
+        return messages.pop()
+
+    return receive
+
 
 @pytest.mark.asyncio
 async def test_request_post_vars():
@@ -106,6 +138,70 @@ async def test_request_json_invalid():
         await request.json()
 
 
+@pytest.mark.asyncio
+async def test_request_post_body_multiple_chunks():
+    request = Request(_post_scope(), _receive_chunks([b"hello ", b"world"]))
+    assert await request.post_body() == b"hello world"
+
+
+@pytest.mark.asyncio
+async def test_request_post_body_content_length_too_large():
+    # Should reject based on content-length without reading the body
+    async def receive():
+        raise AssertionError("receive() should not be called")
+
+    scope = _post_scope(
+        headers=[
+            [b"content-type", b"application/json"],
+            [b"content-length", b"101"],
+        ]
+    )
+    request = Request(scope, receive)
+    with pytest.raises(PayloadTooLarge):
+        await request.post_body(max_bytes=100)
+
+
+@pytest.mark.asyncio
+async def test_request_post_body_streaming_too_large():
+    # No content-length header - limit enforced as chunks arrive
+    chunks = [b"a" * 60, b"b" * 60, b"c" * 60]
+    request = Request(_post_scope(), _receive_chunks(chunks))
+    with pytest.raises(PayloadTooLarge):
+        await request.post_body(max_bytes=100)
+
+
+@pytest.mark.asyncio
+async def test_request_post_body_limit_from_constructor():
+    request = Request(
+        _post_scope(), _receive_chunks([b"too much data"]), max_post_body_bytes=5
+    )
+    with pytest.raises(PayloadTooLarge):
+        await request.post_body()
+
+
+@pytest.mark.asyncio
+async def test_request_post_body_limit_disabled():
+    body = b"a" * (3 * 1024 * 1024)
+    request = Request(_post_scope(), _receive_chunks([body]), max_post_body_bytes=0)
+    assert await request.post_body() == body
+
+
+@pytest.mark.asyncio
+async def test_request_post_body_default_limit():
+    # Bodies over 2MB are rejected by default
+    request = Request(_post_scope(), _receive_chunks([b"a" * (2 * 1024 * 1024 + 1)]))
+    with pytest.raises(PayloadTooLarge):
+        await request.post_body()
+
+
+@pytest.mark.asyncio
+async def test_request_json_too_large():
+    body = json.dumps({"rows": ["x" * 100]}).encode("utf-8")
+    request = Request(_post_scope(), _receive_chunks([body]), max_post_body_bytes=50)
+    with pytest.raises(PayloadTooLarge):
+        await request.json()
+
+
 def test_request_args():
     request = Request.fake("/foo?multi=1&multi=2&single=3")
     assert "1" == request.args.get("multi")
diff --git a/tests/test_internals_response.py b/tests/test_internals_response.py
index 820b20b2..aa3e1ae2 100644
--- a/tests/test_internals_response.py
+++ b/tests/test_internals_response.py
@@ -1,6 +1,9 @@
-from datasette.utils.asgi import Response
+import json
+
 import pytest
 
+from datasette.utils.asgi import Response
+
 
 def test_response_html():
     response = Response.html("Hello from HTML")
@@ -52,3 +55,26 @@ async def test_response_set_cookie():
         },
         {"type": "http.response.body", "body": b""},
     ] == events
+
+
+def test_response_error_single_message():
+    response = Response.error("Method not allowed", 405)
+    assert response.status == 405
+    assert response.content_type == "application/json; charset=utf-8"
+    assert json.loads(response.body) == {
+        "ok": False,
+        "error": "Method not allowed",
+        "errors": ["Method not allowed"],
+        "status": 405,
+    }
+
+
+def test_response_error_message_list_and_default_status():
+    response = Response.error(["First problem", "Second problem"])
+    assert response.status == 400
+    assert json.loads(response.body) == {
+        "ok": False,
+        "error": "First problem; Second problem",
+        "errors": ["First problem", "Second problem"],
+        "status": 400,
+    }
diff --git a/tests/test_internals_urls.py b/tests/test_internals_urls.py
index 24fa745d..50c61995 100644
--- a/tests/test_internals_urls.py
+++ b/tests/test_internals_urls.py
@@ -1,6 +1,7 @@
+import pytest
+
 from datasette.app import Datasette
 from datasette.utils import PrefixedUrlString
-import pytest
 
 
 @pytest.fixture(scope="module")
diff --git a/tests/test_label_column_for_table.py b/tests/test_label_column_for_table.py
index 7667b595..b67b8882 100644
--- a/tests/test_label_column_for_table.py
+++ b/tests/test_label_column_for_table.py
@@ -1,6 +1,7 @@
 import pytest
-from datasette.database import Database
+
 from datasette.app import Datasette
+from datasette.database import Database
 
 
 @pytest.mark.asyncio
diff --git a/tests/test_load_extensions.py b/tests/test_load_extensions.py
index cdadb091..61cdb3e0 100644
--- a/tests/test_load_extensions.py
+++ b/tests/test_load_extensions.py
@@ -1,7 +1,9 @@
-from datasette.app import Datasette
-import pytest
 from pathlib import Path
 
+import pytest
+
+from datasette.app import Datasette
+
 # not necessarily a full path - the full compiled path looks like "ext.dylib"
 # or another suffix, but sqlite will, under the hood, decide which file
 # extension to use based on the operating system (apple=dylib, windows=dll etc)
diff --git a/tests/test_messages.py b/tests/test_messages.py
index 62d9f647..60eb7938 100644
--- a/tests/test_messages.py
+++ b/tests/test_messages.py
@@ -1,6 +1,7 @@
-from .utils import cookie_was_deleted
 import pytest
 
+from .utils import cookie_was_deleted
+
 
 @pytest.mark.asyncio
 @pytest.mark.parametrize(
diff --git a/tests/test_multipart.py b/tests/test_multipart.py
index 0dc3ecd7..ab38bfb7 100644
--- a/tests/test_multipart.py
+++ b/tests/test_multipart.py
@@ -6,12 +6,12 @@ Uses TDD approach - these tests are written first, then implementation follows.
 
 import base64
 import json
-import pytest
 from collections import namedtuple
 
+import pytest
 from multipart_form_data_conformance import get_tests_dir
 
-from datasette.utils.asgi import Request, BadRequest
+from datasette.utils.asgi import BadRequest, Request
 
 
 def make_receive(body: bytes):
diff --git a/tests/test_package.py b/tests/test_package.py
index f05f3ece..43b20589 100644
--- a/tests/test_package.py
+++ b/tests/test_package.py
@@ -1,9 +1,11 @@
-from click.testing import CliRunner
-from datasette import cli
-from unittest import mock
 import os
 import pathlib
+from unittest import mock
+
 import pytest
+from click.testing import CliRunner
+
+from datasette import cli
 
 
 class CaptureDockerfile:
diff --git a/tests/test_permission_endpoints.py b/tests/test_permission_endpoints.py
index e25be23e..c54bfbfd 100644
--- a/tests/test_permission_endpoints.py
+++ b/tests/test_permission_endpoints.py
@@ -6,6 +6,7 @@ Tests for permission endpoints:
 
 import pytest
 import pytest_asyncio
+
 from datasette.app import Datasette
 
 
@@ -137,9 +138,7 @@ async def test_allowed_json_pagination():
     await ds.refresh_schemas()
 
     # Test page 1
-    response = await ds.client.get(
-        "/-/allowed.json?action=view-table&page_size=10&page=1"
-    )
+    response = await ds.client.get("/-/allowed.json?action=view-table&_size=10&_page=1")
     assert response.status_code == 200
     data = response.json()
     assert data["page"] == 1
@@ -147,9 +146,7 @@ async def test_allowed_json_pagination():
     assert len(data["items"]) == 10
 
     # Test page 2
-    response = await ds.client.get(
-        "/-/allowed.json?action=view-table&page_size=10&page=2"
-    )
+    response = await ds.client.get("/-/allowed.json?action=view-table&_size=10&_page=2")
     assert response.status_code == 200
     data = response.json()
     assert data["page"] == 2
@@ -157,10 +154,10 @@ async def test_allowed_json_pagination():
 
     # Verify items are different between pages
     response1 = await ds.client.get(
-        "/-/allowed.json?action=view-table&page_size=10&page=1"
+        "/-/allowed.json?action=view-table&_size=10&_page=1"
     )
     response2 = await ds.client.get(
-        "/-/allowed.json?action=view-table&page_size=10&page=2"
+        "/-/allowed.json?action=view-table&_size=10&_page=2"
     )
     items1 = {(item["parent"], item["child"]) for item in response1.json()["items"]}
     items2 = {(item["parent"], item["child"]) for item in response2.json()["items"]}
@@ -323,7 +320,7 @@ async def test_rules_json_pagination():
 
     # Test basic pagination structure - just verify it returns paginated results
     response = await ds.client.get(
-        "/-/rules.json?action=view-table&page_size=2&page=1",
+        "/-/rules.json?action=view-table&_size=2&_page=1",
         actor={"id": "root"},
     )
     assert response.status_code == 200
@@ -436,8 +433,8 @@ async def test_execute_sql_requires_view_database():
     A user who has execute-sql permission but not view-database permission should not
     be able to execute SQL on that database.
     """
-    from datasette.permissions import PermissionSQL
     from datasette import hookimpl
+    from datasette.permissions import PermissionSQL
 
     class TestPermissionPlugin:
         __name__ = "TestPermissionPlugin"
diff --git a/tests/test_permissions.py b/tests/test_permissions.py
index 8323fe92..73c44682 100644
--- a/tests/test_permissions.py
+++ b/tests/test_permissions.py
@@ -1,19 +1,23 @@
 import collections
-from asgiref.sync import async_to_sync
-from datasette.app import Datasette
-from datasette.cli import cli
-from datasette.default_permissions import restrictions_allow_action
-from .fixtures import assert_permissions_checked, make_app_client
-from click.testing import CliRunner
-from bs4 import BeautifulSoup as Soup
 import copy
 import json
-from pprint import pprint
-import pytest_asyncio
-import pytest
 import re
 import time
 import urllib
+from pprint import pprint
+
+import pytest
+import pytest_asyncio
+from asgiref.sync import async_to_sync
+from bs4 import BeautifulSoup as Soup
+from click.testing import CliRunner
+
+from datasette.app import Datasette
+from datasette.cli import cli
+from datasette.default_permissions import restrictions_allow_action
+from datasette.utils import UNSTABLE_API_MESSAGE
+
+from .fixtures import assert_permissions_checked, make_app_client
 
 
 @pytest.fixture(scope="module")
@@ -456,6 +460,20 @@ async def test_permissions_debug(ds_client, filter_):
     assert checks == expected_checks
 
 
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "permissions_debug,expected_status",
+    (
+        (1, 200),
+        (0, 403),
+    ),
+)
+async def test_permissions_debug_numeric_boolean(permissions_debug, expected_status):
+    ds = Datasette(config={"permissions": {"permissions-debug": permissions_debug}})
+    response = await ds.client.get("/-/permissions")
+    assert response.status_code == expected_status
+
+
 @pytest.mark.asyncio
 @pytest.mark.parametrize(
     "actor,allow,expected_fragment",
@@ -587,9 +605,7 @@ def test_permissions_cascade(cascade_app_client, path, permissions, expected_sta
         )
         assert (
             response.status == expected_status
-        ), "path: {}, permissions: {}, expected_status: {}, status: {}".format(
-            path, permissions, expected_status, response.status
-        )
+        ), f"path: {path}, permissions: {permissions}, expected_status: {expected_status}, status: {response.status}"
     finally:
         cascade_app_client.ds.config = previous_config
 
@@ -739,13 +755,20 @@ async def test_actor_restricted_permissions(
         "path": expected_path,
     }
     expected = {
+        "ok": True,
+        "unstable": UNSTABLE_API_MESSAGE,
         "action": permission,
         "allowed": expected_result,
         "resource": expected_resource,
     }
     if actor.get("id"):
         expected["actor_id"] = actor["id"]
-    assert response.json() == expected
+    data = response.json()
+    for key, value in expected.items():
+        assert data[key] == value
+    assert data["actor"] == actor
+    assert data["explanation"]["allowed"] is expected_result
+    assert data["explanation"]["summary"]
 
 
 PermConfigTestCase = collections.namedtuple(
@@ -1115,7 +1138,7 @@ def test_cli_create_token(options, expected):
         ],
     )
     assert 0 == result2.exit_code, result2.output
-    assert json.loads(result2.output) == {"actor": expected}
+    assert json.loads(result2.output) == {"ok": True, "actor": expected}
 
 
 _visible_tables_re = re.compile(r">\/((\w+)\/(\w+))\.json<\/a> - Get rows for")
@@ -1731,6 +1754,8 @@ async def test_permission_check_view_requires_debug_permission():
     data = response.json()
     assert data["action"] == "view-instance"
     assert data["allowed"] is True
+    assert data["explanation"]["allowed"] is True
+    assert data["explanation"]["summary"]
 
 
 @pytest.mark.asyncio
@@ -1756,6 +1781,211 @@ async def test_permission_check_view_query_actions(action):
     }
 
 
+@pytest.mark.asyncio
+async def test_permission_check_explains_specificity_for_hypothetical_actor():
+    ds = Datasette(
+        config={
+            "permissions": {"view-table": {"id": "alice"}},
+            "databases": {
+                "analytics": {
+                    "permissions": {"view-table": False},
+                    "tables": {
+                        "public": {"permissions": {"view-table": {"id": "alice"}}}
+                    },
+                }
+            },
+        }
+    )
+    ds.root_enabled = True
+    await ds.invoke_startup()
+
+    def path_for(child):
+        return "/-/check.json?" + urllib.parse.urlencode(
+            {
+                "action": "view-table",
+                "parent": "analytics",
+                "child": child,
+                "actor": json.dumps({"id": "alice"}),
+            }
+        )
+
+    public_response = await ds.client.get(path_for("public"), actor={"id": "root"})
+    assert public_response.status_code == 200
+    public = public_response.json()
+    assert public["actor"] == {"id": "alice"}
+    assert public["allowed"] is True
+    assert public["explanation"]["allowed"] is True
+    assert public["explanation"]["winning_scope"] == "resource"
+    public_rules = public["explanation"]["matched_rules"]
+    assert any(
+        rule["scope"] == "resource" and rule["effect"] == "allow" and rule["decisive"]
+        for rule in public_rules
+    )
+    assert any(
+        rule["scope"] == "parent"
+        and rule["effect"] == "deny"
+        and rule["ignored_because"] == "A more specific rule matched"
+        for rule in public_rules
+    )
+
+    private_response = await ds.client.get(path_for("private"), actor={"id": "root"})
+    assert private_response.status_code == 200
+    private = private_response.json()
+    assert private["allowed"] is False
+    assert private["explanation"]["allowed"] is False
+    assert private["explanation"]["winning_scope"] == "parent"
+    assert private["explanation"]["summary"].startswith("Denied by a parent-level rule")
+
+
+@pytest.mark.asyncio
+async def test_permission_check_explains_deny_wins_at_same_scope():
+    ds = Datasette(config={"permissions": {"view-table": {"id": "someone-else"}}})
+    ds.root_enabled = True
+    await ds.invoke_startup()
+    path = "/-/check.json?" + urllib.parse.urlencode(
+        {
+            "action": "view-table",
+            "parent": "analytics",
+            "child": "users",
+            "actor": json.dumps({"id": "alice"}),
+        }
+    )
+    response = await ds.client.get(path, actor={"id": "root"})
+    assert response.status_code == 200
+    data = response.json()
+    assert data["allowed"] is False
+    assert data["explanation"]["winning_scope"] == "global"
+    rules = data["explanation"]["matched_rules"]
+    assert any(rule["effect"] == "deny" and rule["decisive"] for rule in rules)
+    assert any(
+        rule["effect"] == "allow"
+        and rule["ignored_because"] == "A deny rule matched at the same scope"
+        for rule in rules
+    )
+
+
+@pytest.mark.asyncio
+async def test_permission_check_explains_default_deny():
+    ds = Datasette()
+    ds.root_enabled = True
+    await ds.invoke_startup()
+    path = "/-/check.json?" + urllib.parse.urlencode(
+        {
+            "action": "insert-row",
+            "parent": "analytics",
+            "child": "users",
+            "actor": json.dumps({"id": "alice"}),
+        }
+    )
+    response = await ds.client.get(path, actor={"id": "root"})
+    assert response.status_code == 200
+    data = response.json()
+    assert data["allowed"] is False
+    explanation = data["explanation"]
+    assert explanation["allowed"] is False
+    assert explanation["matched_rules"] == []
+    assert explanation["winning_scope"] is None
+    assert explanation["summary"] == (
+        "Denied because no permission rule matched this actor and resource."
+    )
+
+
+@pytest.mark.asyncio
+async def test_permission_check_explains_actor_restrictions():
+    ds = Datasette()
+    ds.root_enabled = True
+    await ds.invoke_startup()
+    restricted_actor = {
+        "id": "alice",
+        "_r": {"r": {"analytics": {"public": ["vt"]}}},
+    }
+    path = "/-/check.json?" + urllib.parse.urlencode(
+        {
+            "action": "view-table",
+            "parent": "analytics",
+            "child": "private",
+            "actor": json.dumps(restricted_actor),
+        }
+    )
+    response = await ds.client.get(path, actor={"id": "root"})
+    assert response.status_code == 200
+    data = response.json()
+    assert data["allowed"] is False
+    explanation = data["explanation"]
+    assert explanation["rule_allowed"] is True
+    assert explanation["restriction_allowed"] is False
+    assert explanation["allowed"] is False
+    assert explanation["restrictions"]
+    assert any(
+        restriction["allowed"] is False for restriction in explanation["restrictions"]
+    )
+    assert "actor's restrictions" in explanation["summary"]
+
+
+@pytest.mark.asyncio
+async def test_permission_check_explains_required_actions():
+    from datasette import hookimpl
+    from datasette.permissions import PermissionSQL
+
+    class StoreQueryPermissions:
+        @hookimpl
+        def permission_resources_sql(self, actor, action):
+            if not actor or actor.get("id") != "alice":
+                return None
+            if action == "store-query":
+                return PermissionSQL(
+                    sql="SELECT 'analytics' AS parent, NULL AS child, 1 AS allow, 'alice can store queries' AS reason"
+                )
+            if action == "execute-sql":
+                return PermissionSQL(
+                    sql="SELECT 'analytics' AS parent, NULL AS child, 0 AS allow, 'alice cannot execute SQL' AS reason"
+                )
+
+    ds = Datasette()
+    ds.root_enabled = True
+    await ds.invoke_startup()
+    ds.pm.register(StoreQueryPermissions(), name="store-query-test")
+    path = "/-/check.json?" + urllib.parse.urlencode(
+        {
+            "action": "store-query",
+            "parent": "analytics",
+            "actor": json.dumps({"id": "alice"}),
+        }
+    )
+    response = await ds.client.get(path, actor={"id": "root"})
+    assert response.status_code == 200
+    data = response.json()
+    assert data["allowed"] is False
+    explanation = data["explanation"]
+    assert explanation["rule_allowed"] is True
+    assert explanation["required_actions"][0]["action"] == "execute-sql"
+    assert explanation["required_actions"][0]["allowed"] is False
+    assert explanation["summary"] == (
+        "Denied because store-query also requires execute-sql, which was denied."
+    )
+
+
+@pytest.mark.asyncio
+async def test_permission_check_hypothetical_actor_validation():
+    ds = Datasette()
+    ds.root_enabled = True
+    await ds.invoke_startup()
+
+    response = await ds.client.get(
+        "/-/check.json?action=view-instance&actor=not-json",
+        actor={"id": "root"},
+    )
+    assert response.status_code == 400
+    assert response.json()["error"].startswith("Invalid actor JSON:")
+
+    response = await ds.client.get(
+        "/-/check.json?action=view-instance&actor=%5B%5D",
+        actor={"id": "root"},
+    )
+    assert response.status_code == 400
+    assert response.json()["error"] == "actor must be a JSON object or null"
+
+
 @pytest.mark.asyncio
 async def test_root_allow_block_with_table_restricted_actor():
     """
@@ -1799,3 +2029,35 @@ async def test_root_allow_block_with_table_restricted_actor():
         actor=admin_actor,
     )
     assert result is True
+
+
+@pytest.mark.asyncio
+async def test_databases_json_respects_view_database(tmp_path_factory):
+    # https://github.com/simonw/datasette - /-/databases should not list
+    # databases the actor is not allowed to view
+    db_directory = tmp_path_factory.mktemp("dbs")
+    from datasette.utils import sqlite3 as _sqlite3
+
+    paths = []
+    for name in ("public", "private"):
+        path = str(db_directory / f"{name}.db")
+        conn = _sqlite3.connect(path)
+        conn.execute("vacuum")
+        conn.close()
+        paths.append(path)
+    ds = Datasette(
+        paths,
+        config={"databases": {"private": {"allow": {"id": "root"}}}},
+    )
+    ds.root_enabled = True
+    await ds.invoke_startup()
+    try:
+        anon_response = await ds.client.get("/-/databases.json")
+        assert anon_response.status_code == 200
+        anon_names = {db["name"] for db in anon_response.json()["databases"]}
+        assert anon_names == {"public"}
+        root_response = await ds.client.get("/-/databases.json", actor={"id": "root"})
+        root_names = {db["name"] for db in root_response.json()["databases"]}
+        assert root_names == {"public", "private"}
+    finally:
+        ds.close()
diff --git a/tests/test_playwright.py b/tests/test_playwright.py
index a8c5aa4b..eb1edb57 100644
--- a/tests/test_playwright.py
+++ b/tests/test_playwright.py
@@ -1,3 +1,4 @@
+import base64
 import json
 import socket
 import subprocess
@@ -10,6 +11,10 @@ import pytest
 from datasette.fixtures import write_fixture_database
 from datasette.utils.sqlite import sqlite3
 
+PNG_1X1_BYTES = base64.b64decode(
+    "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+/p9sAAAAASUVORK5CYII="
+)
+
 
 def find_free_port():
     with socket.socket() as sock:
@@ -17,7 +22,7 @@ def find_free_port():
         return sock.getsockname()[1]
 
 
-def wait_for_server(process, url, timeout=10):
+def wait_for_server(process, url, timeout=30):
     deadline = time.monotonic() + timeout
     last_error = None
     while time.monotonic() < deadline:
@@ -36,7 +41,20 @@ def wait_for_server(process, url, timeout=10):
         except httpx.HTTPError as ex:
             last_error = repr(ex)
         time.sleep(0.1)
-    raise AssertionError(f"Timed out waiting for {url}: {last_error}")
+    if process.poll() is None:
+        process.terminate()
+        try:
+            stdout, stderr = process.communicate(timeout=5)
+        except subprocess.TimeoutExpired:
+            process.kill()
+            stdout, stderr = process.communicate()
+    else:
+        stdout, stderr = process.communicate()
+    raise AssertionError(
+        f"Timed out waiting for {url}: {last_error}\n"
+        f"stdout:\n{stdout}\n"
+        f"stderr:\n{stderr}"
+    )
 
 
 @pytest.fixture
@@ -98,6 +116,26 @@ def write_playwright_database(db_path):
             notes text,
             score integer default 5
         );
+        create table defaults_demo (
+            id integer primary key,
+            created_ms integer default (CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER))
+        );
+        create table binary_files (
+            id integer primary key,
+            name text not null,
+            data blob
+        );
+        create table bulk_defaults (
+            id integer primary key,
+            title text not null,
+            status text not null default 'todo',
+            score integer default 5
+        );
+        create table upsert_items (
+            id text primary key,
+            title text,
+            metadata text
+        );
         insert into projects (title, metadata, logo, notes, score) values
             (
                 'Build Datasette',
@@ -106,7 +144,22 @@ def write_playwright_database(db_path):
                 'Initial notes',
                 5
             );
+        insert into upsert_items (id, title, metadata) values
+            ('existing', 'Existing title', '{"old": true}');
         """)
+        conn.execute(
+            "insert into binary_files (name, data) values (?, ?)",
+            ("Raw bytes", b"\x00\x01\x02\x03"),
+        )
+        conn.execute(
+            "insert into binary_files (name, data) values (?, ?)",
+            ("PNG image", PNG_1X1_BYTES),
+        )
+        conn.execute(
+            "insert into binary_files (name, data) values (?, ?)",
+            ("Null bytes", None),
+        )
+        conn.commit()
     finally:
         conn.close()
 
@@ -117,6 +170,11 @@ def write_playwright_config(config_path):
             {
                 "databases": {
                     "data": {
+                        "permissions": {
+                            "create-table": True,
+                            "insert-row": True,
+                            "set-column-type": True,
+                        },
                         "tables": {
                             "projects": {
                                 "label_column": "title",
@@ -126,11 +184,36 @@ def write_playwright_config(config_path):
                                     "notes": "textarea",
                                 },
                                 "permissions": {
+                                    "alter-table": True,
                                     "insert-row": True,
                                     "update-row": True,
                                     "delete-row": True,
                                 },
                             },
+                            "defaults_demo": {
+                                "permissions": {
+                                    "alter-table": True,
+                                },
+                            },
+                            "binary_files": {
+                                "label_column": "name",
+                                "permissions": {
+                                    "insert-row": True,
+                                    "update-row": True,
+                                    "delete-row": True,
+                                },
+                            },
+                            "bulk_defaults": {
+                                "permissions": {
+                                    "insert-row": True,
+                                },
+                            },
+                            "upsert_items": {
+                                "permissions": {
+                                    "insert-row": True,
+                                    "update-row": True,
+                                },
+                            },
                         },
                     },
                 },
@@ -264,6 +347,58 @@ def project_row(datasette_server, pk):
     return rows[0]
 
 
+def binary_file_blob(datasette_server, pk):
+    response = httpx.get(
+        f"{datasette_server}data/binary_files/{pk}.blob",
+        params={"_blob_column": "data"},
+    )
+    response.raise_for_status()
+    return response.content
+
+
+def wait_for_binary_control_file(binary_control, size, name=None):
+    binary_control.locator(
+        ".row-edit-binary-size", has_text=f"Binary: {size} bytes"
+    ).wait_for()
+    if name:
+        binary_control.locator(".row-edit-binary-name", has_text=name).wait_for()
+
+
+def bulk_default_rows(datasette_server, **filters):
+    params = {
+        "_shape": "objects",
+        **{key: str(value) for key, value in filters.items()},
+    }
+    response = httpx.get(f"{datasette_server}data/bulk_defaults.json", params=params)
+    response.raise_for_status()
+    return response.json()["rows"]
+
+
+def upsert_item_rows(datasette_server, **filters):
+    params = {
+        "_shape": "objects",
+        **{key: str(value) for key, value in filters.items()},
+    }
+    response = httpx.get(f"{datasette_server}data/upsert_items.json", params=params)
+    response.raise_for_status()
+    return response.json()["rows"]
+
+
+def upsert_item_row(datasette_server, pk):
+    rows = upsert_item_rows(datasette_server, id=pk)
+    assert len(rows) == 1
+    return rows[0]
+
+
+def open_bulk_insert_dialog(page, url):
+    page.goto(url)
+    page.locator('button[data-table-action="insert-row"]').click()
+    dialog = page.locator("#row-edit-dialog")
+    dialog.wait_for()
+    dialog.locator(".row-edit-bulk-insert").click()
+    return dialog
+
+
 def open_jump_menu(page):
     page.keyboard.press("/")
     page.locator("navigation-search .search-input").wait_for()
@@ -275,6 +410,639 @@ def test_datasette_homepage_contains_datasette(page, datasette_server):
     assert "Datasette" in page.locator("body").inner_text()
 
 
+@pytest.mark.playwright
+def test_create_table_flow(page, datasette_server):
+    page.goto(f"{datasette_server}data")
+    page.locator("details.actions-menu-links summary").click()
+    page.locator('button[data-database-action="create-table"]').click()
+
+    dialog = page.locator("#table-create-dialog")
+    dialog.wait_for()
+    assert dialog.locator(".modal-title").inner_text() == "Create a table in data"
+    placeholder_select = dialog.locator(".table-create-custom-column-type").nth(0)
+    assert placeholder_select.input_value() == ""
+    assert (
+        placeholder_select.locator("option:checked").inner_text() == "- custom type -"
+    )
+    assert "table-create-input-placeholder" in placeholder_select.get_attribute("class")
+    assert (
+        dialog.locator(".table-create-column-name").nth(0).get_attribute("placeholder")
+        == "column name"
+    )
+    assert dialog.locator(".table-create-column-main").first.evaluate("""node => {
+            const inputHeight = node.querySelector(
+                ".table-create-column-name"
+            ).getBoundingClientRect().height;
+            const selectHeight = node.querySelector(
+                ".table-create-column-type"
+            ).getBoundingClientRect().height;
+            return Math.abs(inputHeight - selectHeight) <= 1;
+        }""")
+    dialog.locator('input[name="table"]').fill("playwright_created")
+    dialog.locator(".table-create-column-name").nth(1).fill("title")
+    dialog.locator(".table-create-more-options").nth(1).click()
+    dialog.locator(".table-create-not-null-input").nth(1).check()
+    title_defaults = dialog.locator(".table-create-default-options").nth(1)
+    assert title_defaults.locator("summary").inner_text() == "Set a default value"
+    title_defaults.locator("summary").click()
+    assert "or default to a specific value" in title_defaults.inner_text()
+    title_default_expr = title_defaults.locator(".table-create-default-expr")
+    title_default_input = title_defaults.locator(".table-create-default")
+    assert (
+        "Current timestamp in UTC, e.g. 2026-05-01 13:34:00"
+        in title_default_expr.locator("option").nth(1).inner_text()
+    )
+    title_default_expr.select_option("current_timestamp")
+    assert title_default_input.is_enabled()
+    title_default_input.fill("Untitled")
+    assert title_default_expr.input_value() == ""
+    dialog.locator(".table-create-add-column").click()
+    dialog.locator(".table-create-column-name").nth(2).fill("score")
+    dialog.locator(".table-create-column-type").nth(2).select_option("integer")
+    dialog.locator(".table-create-add-column").click()
+    dialog.locator(".table-create-column-name").nth(3).fill("metadata")
+    dialog.locator(".table-create-column-type").nth(3).select_option("integer")
+    dialog.locator(".table-create-more-options").nth(3).click()
+    dialog.locator(".table-create-custom-column-type").nth(3).select_option("json")
+    assert dialog.locator(".table-create-column-type").nth(3).input_value() == "text"
+    assert "table-create-input-placeholder" not in dialog.locator(
+        ".table-create-custom-column-type"
+    ).nth(3).get_attribute("class")
+
+    dialog.locator(".table-create-save").click()
+    page.wait_for_url("**/data/playwright_created")
+    assert "playwright_created" in page.locator("h1").inner_text()
+
+    response = httpx.get(
+        f"{datasette_server}data/playwright_created.json?_extra=columns,column_types"
+    )
+    response.raise_for_status()
+    data = response.json()
+    assert data["columns"] == [
+        "id",
+        "title",
+        "score",
+        "metadata",
+    ]
+    assert data["column_types"] == {
+        "metadata": {"type": "json", "config": None},
+    }
+    schema_response = httpx.get(
+        f"{datasette_server}data/-/query.json",
+        params={
+            "sql": (
+                "select sql from sqlite_master where type = 'table' "
+                "and name = 'playwright_created'"
+            )
+        },
+    )
+    schema_response.raise_for_status()
+    schema = schema_response.json()["rows"][0]["sql"]
+    assert "title" in schema
+    assert "NOT NULL DEFAULT 'Untitled'" in schema
+
+
+@pytest.mark.playwright
+def test_create_table_from_data_flow(page, datasette_server):
+    page.goto(f"{datasette_server}data")
+    page.locator("details.actions-menu-links summary").click()
+    page.locator('button[data-database-action="create-table"]').click()
+
+    dialog = page.locator("#table-create-dialog")
+    dialog.wait_for()
+    from_data = dialog.locator(".table-create-from-data")
+    assert from_data.inner_text() == "Create table from data"
+    from_data.click()
+
+    assert dialog.locator(".table-create-columns").is_hidden()
+    assert dialog.locator(".table-create-data").is_visible()
+    assert dialog.locator(".table-create-save").inner_text() == "Preview rows"
+    assert (
+        dialog.locator(".table-create-data-note").inner_text()
+        == "Paste TSV, CSV, or JSON. You can also open a file or drop it onto this textarea"
+    )
+    assert dialog.locator(".table-create-data-open-file").inner_text() == "open a file"
+    assert (
+        dialog.locator(".table-create-data-editor").evaluate(
+            """node => Array.from(node.children)
+            .filter((child) => !child.hidden)
+            .map((child) => child.className)
+            .join(" ")"""
+        )
+        == ("table-create-data-note table-create-input table-create-data-textarea")
+    )
+    assert dialog.locator(".table-create-manual").inner_text() == (
+        "Create table manually"
+    )
+    assert (
+        dialog.get_by_label("Paste TSV, CSV, or JSON").get_attribute("id")
+        == "table-create-data-textarea"
+    )
+
+    textarea = dialog.locator(".table-create-data-textarea")
+    dropped_value = textarea.evaluate("""node => new Promise((resolve) => {
+            node.addEventListener("input", () => resolve(node.value), { once: true });
+            const file = new File(["short_id,name\\nx,Ada"], "Repo Export 2026!!.CSV", { type: "text/csv" });
+            const dataTransfer = new DataTransfer();
+            dataTransfer.items.add(file);
+            node.dispatchEvent(new DragEvent("dragenter", { bubbles: true, cancelable: true, dataTransfer }));
+            node.dispatchEvent(new DragEvent("dragover", { bubbles: true, cancelable: true, dataTransfer }));
+            node.dispatchEvent(new DragEvent("drop", { bubbles: true, cancelable: true, dataTransfer }));
+        })""")
+    assert dropped_value == "short_id,name\nx,Ada"
+    assert dialog.locator(".table-create-table-name").input_value() == (
+        "repo_export_2026"
+    )
+
+    dialog.locator(".table-create-table-name").fill("playwright_from_data")
+    textarea.fill(
+        json.dumps(
+            {
+                "metadata": [{"short_id": "a", "name": "Ignored", "score": 9}],
+                "people": [
+                    {"short_id": "b", "name": "Ada", "score": 1},
+                    {"short_id": "c", "name": "Bob", "score": 2.5},
+                ],
+            }
+        )
+    )
+    dialog.locator(".table-create-save").click()
+
+    assert dialog.locator(".table-create-data-textarea").is_hidden()
+    assert dialog.locator(".table-create-save").inner_text() == "Create table"
+    assert dialog.locator(".table-create-cancel").inner_text() == "Back"
+    assert dialog.locator(".table-create-data-preview-summary").inner_text() == (
+        "Previewing 2 rows."
+    )
+    assert dialog.locator(".table-create-data-primary-key").input_value() == "short_id"
+    preview_text = dialog.locator(".table-create-data-preview-table").inner_text()
+    assert "short_id" in preview_text
+    assert "Ada" in preview_text
+    assert "2.5" in preview_text
+    preview_cell_style = dialog.locator(
+        ".table-create-data-preview-table td"
+    ).first.evaluate(
+        """node => ({
+            overflowWrap: getComputedStyle(node).overflowWrap,
+            whiteSpace: getComputedStyle(node).whiteSpace
+        })"""
+    )
+    assert preview_cell_style == {
+        "overflowWrap": "anywhere",
+        "whiteSpace": "normal",
+    }
+
+    dialog.locator(".table-create-cancel").click()
+    assert dialog.evaluate("node => node.open")
+    assert dialog.locator(".table-create-data-textarea").is_visible()
+    assert '"people"' in dialog.locator(".table-create-data-textarea").input_value()
+    assert dialog.locator(".table-create-save").inner_text() == "Preview rows"
+
+    dialog.locator(".table-create-save").click()
+    assert dialog.locator(".table-create-save").inner_text() == "Create table"
+    dialog.locator(".table-create-save").click()
+    page.wait_for_url("**/data/playwright_from_data")
+
+    response = httpx.get(
+        f"{datasette_server}data/playwright_from_data.json?_shape=objects"
+    )
+    response.raise_for_status()
+    data = response.json()
+    assert data["rows"] == [
+        {"short_id": "b", "name": "Ada", "score": 1},
+        {"short_id": "c", "name": "Bob", "score": 2.5},
+    ]
+
+
+@pytest.mark.playwright
+def test_create_table_from_csv_keeps_numeric_type_when_values_are_blank(
+    page, datasette_server
+):
+    page.goto(f"{datasette_server}data")
+    page.locator("details.actions-menu-links summary").click()
+    page.locator('button[data-database-action="create-table"]').click()
+
+    dialog = page.locator("#table-create-dialog")
+    dialog.wait_for()
+    dialog.locator(".table-create-from-data").click()
+    dialog.locator(".table-create-table-name").fill("playwright_numeric_blanks")
+    dialog.locator(".table-create-data-textarea").fill("name,score\nA,1\nB,")
+    dialog.locator(".table-create-save").click()
+
+    assert dialog.locator(".table-create-save").inner_text() == "Create table"
+    preview_text = dialog.locator(".table-create-data-preview-table").inner_text()
+    assert "A" in preview_text
+    assert "1" in preview_text
+    assert "B" in preview_text
+    assert "null" in preview_text
+
+    dialog.locator(".table-create-save").click()
+    page.wait_for_url("**/data/playwright_numeric_blanks")
+
+    response = httpx.get(
+        f"{datasette_server}data/playwright_numeric_blanks.json?_shape=objects"
+    )
+    response.raise_for_status()
+    assert response.json()["rows"] == [
+        {"name": "A", "score": 1},
+        {"name": "B", "score": None},
+    ]
+
+    schema_response = httpx.get(
+        f"{datasette_server}data/-/query.json",
+        params={
+            "sql": (
+                "select type from pragma_table_info('playwright_numeric_blanks') "
+                "where name = 'score'"
+            )
+        },
+    )
+    schema_response.raise_for_status()
+    assert schema_response.json()["rows"] == [{"type": "INTEGER"}]
+
+
+@pytest.mark.playwright
+def test_create_table_foreign_key_selection_updates_column_type(page, datasette_server):
+    page.goto(f"{datasette_server}data")
+    page.locator("details.actions-menu-links summary").click()
+    page.locator('button[data-database-action="create-table"]').click()
+
+    dialog = page.locator("#table-create-dialog")
+    dialog.wait_for()
+    dialog.locator(".table-create-more-options").nth(1).click()
+
+    column_name = dialog.locator(".table-create-column-name").nth(1)
+    type_select = dialog.locator(".table-create-column-type").nth(1)
+    foreign_key_select = dialog.locator(".table-create-foreign-key-target").nth(1)
+    assert column_name.input_value() == ""
+    assert type_select.input_value() == "text"
+
+    foreign_key_select.select_option("projects\u001fid")
+    assert column_name.input_value() == "projects_id"
+    assert type_select.input_value() == "integer"
+    assert foreign_key_select.input_value() == "projects\u001fid"
+
+
+@pytest.mark.playwright
+def test_create_table_unix_default_expression_updates_column_type(
+    page, datasette_server
+):
+    page.goto(f"{datasette_server}data")
+    page.locator("details.actions-menu-links summary").click()
+    page.locator('button[data-database-action="create-table"]').click()
+
+    dialog = page.locator("#table-create-dialog")
+    dialog.wait_for()
+    row = dialog.locator(".table-create-column-row").nth(1)
+    row.locator(".table-create-more-options").click()
+    row.locator(".table-create-default-options summary").click()
+
+    type_select = row.locator(".table-create-column-type")
+    default_expr = row.locator(".table-create-default-expr")
+    assert type_select.input_value() == "text"
+    assert (
+        "Current Unix time, integer milliseconds since the epoch"
+        in default_expr.locator("option").last.inner_text()
+    )
+
+    default_expr.select_option("current_unixtime_ms")
+    assert type_select.input_value() == "integer"
+
+
+@pytest.mark.playwright
+def test_alter_table_foreign_key_selection_updates_blank_column(page, datasette_server):
+    page.goto(f"{datasette_server}data/projects")
+    page.locator("details.actions-menu-links summary").click()
+    page.locator('button[data-table-action="alter-table"]').click()
+
+    dialog = page.locator("#table-alter-dialog")
+    dialog.wait_for()
+    dialog.locator(".table-alter-add-column").click()
+
+    column_name = dialog.locator(".table-alter-column-name").last
+    type_select = dialog.locator(".table-alter-column-type").last
+    foreign_key_select = dialog.locator(".table-alter-foreign-key-target").last
+    assert column_name.input_value() == ""
+    assert type_select.input_value() == "text"
+
+    foreign_key_select.select_option("projects\u001fid")
+    assert column_name.input_value() == "projects_id"
+    assert type_select.input_value() == "integer"
+    assert foreign_key_select.input_value() == "projects\u001fid"
+
+
+@pytest.mark.playwright
+def test_alter_table_unix_default_expression_updates_column_type(
+    page, datasette_server
+):
+    page.goto(f"{datasette_server}data/projects")
+    page.locator("details.actions-menu-links summary").click()
+    page.locator('button[data-table-action="alter-table"]').click()
+
+    dialog = page.locator("#table-alter-dialog")
+    dialog.wait_for()
+    dialog.locator(".table-alter-add-column").click()
+    row = dialog.locator(".table-alter-column-row").last
+    row.locator(".table-alter-default-options summary").click()
+
+    type_select = row.locator(".table-alter-column-type")
+    default_expr = row.locator(".table-alter-default-expr")
+    assert type_select.input_value() == "text"
+    assert (
+        "Current Unix time, integer seconds since the epoch"
+        in default_expr.locator("option").all_inner_texts()
+    )
+
+    default_expr.select_option("current_unixtime")
+    assert type_select.input_value() == "integer"
+
+
+@pytest.mark.playwright
+def test_alter_table_existing_default_expression_populates_select(
+    page, datasette_server
+):
+    page.goto(f"{datasette_server}data/defaults_demo")
+    page.locator("details.actions-menu-links summary").click()
+    page.locator('button[data-table-action="alter-table"]').click()
+
+    dialog = page.locator("#table-alter-dialog")
+    dialog.wait_for()
+    row = dialog.locator(".table-alter-column-row").nth(1)
+    row.locator(".table-alter-more-options").click()
+    row.locator(".table-alter-default-options summary").click()
+
+    assert row.locator(".table-alter-default-expr").input_value() == (
+        "current_unixtime_ms"
+    )
+    assert row.locator(".table-alter-default").input_value() == ""
+
+
+@pytest.mark.playwright
+def test_alter_table_flow(page, datasette_server):
+    page.goto(f"{datasette_server}data/projects")
+    page.locator("details.actions-menu-links summary").click()
+    page.locator('button[data-table-action="alter-table"]').click()
+
+    dialog = page.locator("#table-alter-dialog")
+    dialog.wait_for()
+    assert dialog.locator(".modal-title").inner_text() == "Alter table projects"
+    assert dialog.locator(".table-alter-save").is_disabled()
+    assert (
+        dialog.locator(".table-alter-column-name").first.get_attribute("placeholder")
+        == "column name"
+    )
+    assert dialog.locator(".table-alter-column-main").first.evaluate("""node => {
+            const inputHeight = node.querySelector(
+                ".table-alter-column-name"
+            ).getBoundingClientRect().height;
+            const selectHeight = node.querySelector(
+                ".table-alter-column-type"
+            ).getBoundingClientRect().height;
+            return Math.abs(inputHeight - selectHeight) <= 1;
+        }""")
+    type_options = dialog.locator(".table-alter-column-type").first.locator("option")
+    assert type_options.all_inner_texts() == [
+        "text",
+        "integer",
+        "floating point number",
+        "blob - binary data",
+    ]
+    first_more_options = dialog.locator(".table-alter-more-options").first
+    assert first_more_options.inner_text() == "> Advanced options"
+    first_more_options.click()
+    assert first_more_options.inner_text() == "v Hide options"
+    expanded_options_text = dialog.locator(
+        ".table-alter-column-details"
+    ).first.inner_text()
+    assert dialog.locator(".table-alter-fields").evaluate(
+        "node => node.scrollWidth <= node.clientWidth + 1"
+    )
+    assert "Not null" in expanded_options_text
+    assert "This value cannot be left unset" in expanded_options_text
+    assert "Set a default value" in expanded_options_text
+    assert "Primary key" in expanded_options_text
+    assert "This ID uniquely identifies the record" in expanded_options_text
+    assert "Foreign key" in expanded_options_text
+    first_defaults = dialog.locator(".table-alter-default-options").first
+    first_defaults.locator("summary").click()
+    assert "or default to a specific value" in first_defaults.inner_text()
+    first_default_expr = first_defaults.locator(".table-alter-default-expr")
+    first_default_input = first_defaults.locator(".table-alter-default")
+    assert (
+        "Current timestamp in UTC, e.g. 2026-05-01 13:34:00"
+        in first_default_expr.locator("option").nth(1).inner_text()
+    )
+    first_default_expr.select_option("current_timestamp")
+    assert first_default_input.is_enabled()
+    first_default_input.fill("manual")
+    assert first_default_expr.input_value() == ""
+
+    dialog.locator(".table-alter-add-column").click()
+    assert dialog.locator(".table-alter-save").is_enabled()
+    dialog.locator(".table-alter-column-name").last.fill("status")
+    dialog.locator(".table-alter-column-type").last.select_option("text")
+    dialog.locator(".table-alter-default-options").last.locator("summary").click()
+    dialog.locator(".table-alter-default").last.fill("planned")
+    dialog.locator(".table-alter-save").click()
+    review = dialog.locator(".table-alter-review")
+    review.wait_for()
+    assert not dialog.locator(".table-alter-column-list").is_visible()
+    review_text = review.inner_text()
+    assert "Add column status as text, with default value planned." in review_text
+    assert "Set column order to" not in review_text
+    assert dialog.locator(".table-alter-back").is_visible()
+    assert dialog.locator(".table-alter-save").inner_text() == "Apply changes"
+    dialog.locator(".table-alter-save").click()
+
+    columns = []
+    for _ in range(20):
+        response = httpx.get(f"{datasette_server}data/projects.json?_extra=columns")
+        response.raise_for_status()
+        columns = response.json()["columns"]
+        if "status" in columns:
+            break
+        time.sleep(0.1)
+    assert "status" in columns
+
+
+@pytest.mark.playwright
+def test_alter_table_primary_key_columns_stay_at_top(page, datasette_server):
+    page.goto(f"{datasette_server}data/projects")
+    page.locator("details.actions-menu-links summary").click()
+    page.locator('button[data-table-action="alter-table"]').click()
+
+    dialog = page.locator("#table-alter-dialog")
+    dialog.wait_for()
+    rows = dialog.locator(".table-alter-column-row")
+    assert rows.nth(0).locator(".table-alter-column-name").input_value() == "id"
+    first_row_move_buttons = rows.nth(0).locator(".table-alter-move-controls button")
+    for i in range(first_row_move_buttons.count()):
+        assert first_row_move_buttons.nth(i).is_disabled()
+        assert (
+            first_row_move_buttons.nth(i).get_attribute("title")
+            == "Primary key columns are always listed first"
+        )
+
+    assert rows.nth(1).locator(".table-alter-move-up").is_disabled()
+    assert rows.nth(1).locator(".table-alter-move-top").get_attribute("title") == (
+        "Primary key columns are always listed first"
+    )
+    assert rows.nth(1).locator(".table-alter-move-up").get_attribute("title") == (
+        "Primary key columns are always listed first"
+    )
+    last_row = rows.nth(rows.count() - 1)
+    assert last_row.locator(".table-alter-column-name").input_value() == "score"
+    last_row.locator(".table-alter-move-top").click()
+    assert rows.nth(0).locator(".table-alter-column-name").input_value() == "id"
+    assert rows.nth(1).locator(".table-alter-column-name").input_value() == "score"
+
+
+@pytest.mark.playwright
+def test_alter_table_review_rename_primary_key_column(page, datasette_server):
+    page.goto(f"{datasette_server}data/projects")
+    page.locator("details.actions-menu-links summary").click()
+    page.locator('button[data-table-action="alter-table"]').click()
+
+    dialog = page.locator("#table-alter-dialog")
+    dialog.wait_for()
+    save = dialog.locator(".table-alter-save")
+    assert save.is_disabled()
+    dialog.locator(".table-alter-column-name").first.fill("id3")
+    assert save.is_enabled()
+    save.click()
+
+    review = dialog.locator(".table-alter-review")
+    review.wait_for()
+    review_text = review.inner_text()
+    assert "Rename column id to id3." in review_text
+    assert "Set primary key to" not in review_text
+    assert dialog.locator(".table-alter-review-name").all_inner_texts() == [
+        "id",
+        "id3",
+    ]
+
+
+@pytest.mark.playwright
+def test_alter_table_review_rename_table(page, datasette_server):
+    page.goto(f"{datasette_server}data/projects")
+    page.locator("details.actions-menu-links summary").click()
+    page.locator('button[data-table-action="alter-table"]').click()
+
+    dialog = page.locator("#table-alter-dialog")
+    dialog.wait_for()
+    save = dialog.locator(".table-alter-save")
+    rename_details = dialog.locator(".table-alter-table-options")
+    assert rename_details.locator("summary").inner_text() == "Rename table"
+    assert not dialog.locator(".table-alter-table-name").is_visible()
+    assert save.is_disabled()
+
+    rename_details.locator("summary").click()
+    table_name = dialog.locator(".table-alter-table-name")
+    assert table_name.input_value() == "projects"
+    assert table_name.get_attribute("placeholder") == "table name"
+    table_name.fill("projects_archive")
+    assert save.is_enabled()
+    save.click()
+
+    review = dialog.locator(".table-alter-review")
+    review.wait_for()
+    assert "Rename table to projects_archive." in review.inner_text()
+    assert dialog.locator(".table-alter-review-name").all_inner_texts() == [
+        "projects_archive",
+    ]
+
+
+@pytest.mark.playwright
+def test_alter_table_review_not_null_wording(page, datasette_server):
+    page.goto(f"{datasette_server}data/projects")
+    page.locator("details.actions-menu-links summary").click()
+    page.locator('button[data-table-action="alter-table"]').click()
+
+    dialog = page.locator("#table-alter-dialog")
+    dialog.wait_for()
+    dialog.locator(".table-alter-more-options").first.click()
+    dialog.locator(".table-alter-not-null-input").first.check()
+    dialog.locator(".table-alter-save").click()
+
+    review = dialog.locator(".table-alter-review")
+    review.wait_for()
+    assert "Change column id: not null (require values)." in review.inner_text()
+
+
+@pytest.mark.playwright
+def test_alter_table_review_warns_when_dropping_column(page, datasette_server):
+    page.goto(f"{datasette_server}data/projects")
+    page.locator("details.actions-menu-links summary").click()
+    page.locator('button[data-table-action="alter-table"]').click()
+
+    dialog = page.locator("#table-alter-dialog")
+    dialog.wait_for()
+    remove_buttons = dialog.locator(".table-alter-remove-column")
+    remove_buttons.nth(remove_buttons.count() - 1).click()
+    dialog.locator(".table-alter-save").click()
+
+    review = dialog.locator(".table-alter-review")
+    review.wait_for()
+    assert not dialog.locator(".table-alter-column-list").is_visible()
+    review_text = review.inner_text()
+    assert "Warning: data in dropped columns will be permanently lost." in review_text
+    assert "Drop column score." in review_text
+    assert "Set column order to" not in review_text
+    assert dialog.locator(".table-alter-review-damaging").inner_text() == (
+        "Drop column score."
+    )
+
+    dialog.locator(".table-alter-back").click()
+    assert dialog.locator(".table-alter-column-list").is_visible()
+    assert dialog.locator(".table-alter-save").inner_text() == "Review changes"
+
+
+@pytest.mark.playwright
+def test_alter_table_cancel_skips_discard_prompt(page, datasette_server):
+    def open_alter_dialog():
+        page.locator("details.actions-menu-links").evaluate("node => node.open = true")
+        page.locator('button[data-table-action="alter-table"]').click()
+        dialog = page.locator("#table-alter-dialog")
+        dialog.wait_for()
+        return dialog
+
+    page.goto(f"{datasette_server}data/projects")
+    page.evaluate("""
+        () => {
+            window.__discardConfirmMessages = [];
+            window.confirm = (message) => {
+                window.__discardConfirmMessages.push(message);
+                return false;
+            };
+        }
+        """)
+
+    dialog = open_alter_dialog()
+    dialog.locator(".table-alter-add-column").click()
+    dialog.locator(".table-alter-column-name").last.fill("cancel_me")
+    dialog.locator(".table-alter-cancel").click()
+    assert dialog.evaluate("node => node.open") is False
+    assert page.evaluate("() => window.__discardConfirmMessages") == []
+
+    dialog = open_alter_dialog()
+    dialog.locator(".table-alter-add-column").click()
+    dialog.locator(".table-alter-column-name").last.fill("escape_me")
+    page.keyboard.press("Escape")
+    assert page.evaluate("() => window.__discardConfirmMessages") == [
+        "Discard table changes?"
+    ]
+    assert dialog.evaluate("node => node.open") is True
+
+    page.evaluate("() => window.__discardConfirmMessages = []")
+    dialog.evaluate(
+        """node => node.dispatchEvent(new MouseEvent("click", {bubbles: true}))"""
+    )
+    assert page.evaluate("() => window.__discardConfirmMessages") == [
+        "Discard table changes?"
+    ]
+    assert dialog.evaluate("node => node.open") is True
+
+
 @pytest.mark.playwright
 def test_navigation_search_tracks_and_renders_recent_items(page, datasette_server):
     page.goto(datasette_server)
@@ -313,11 +1081,128 @@ def test_navigation_search_renders_jump_sections_from_javascript_plugins(
 
 @pytest.mark.playwright
 def test_insert_row_flow_uses_custom_column_field(page, datasette_server):
+    page.add_init_script("""
+        (() => {
+            let clipboardText = "";
+            Object.defineProperty(navigator, "clipboard", {
+                configurable: true,
+                get: () => ({
+                    writeText: async (text) => {
+                        clipboardText = String(text);
+                    },
+                    readText: async () => clipboardText,
+                }),
+            });
+        })();
+        """)
     page.goto(f"{datasette_server}data/projects")
     page.locator('button[data-table-action="insert-row"]').click()
 
     dialog = page.locator("#row-edit-dialog")
     dialog.wait_for()
+    bulk_insert = dialog.locator(".row-edit-bulk-insert")
+    bulk_insert.wait_for()
+    assert bulk_insert.inner_text() == "Insert multiple rows"
+    current_url = page.url
+    bulk_insert.click()
+    assert page.url == current_url
+    assert dialog.evaluate("node => node.open")
+    assert dialog.locator(".row-edit-fields").is_hidden()
+    assert dialog.locator(".row-edit-bulk").is_visible()
+    assert dialog.locator(".row-edit-save").inner_text() == "Preview rows"
+    assert (
+        dialog.locator(".row-edit-bulk-note").inner_text()
+        == "Paste TSV, CSV, or JSON. You can also open a file or drop it onto this textarea"
+    )
+    assert dialog.locator(".row-edit-bulk-open-file").inner_text() == "open a file"
+    assert (
+        dialog.locator(".row-edit-bulk-editor").evaluate(
+            """node => Array.from(node.children)
+            .filter((child) => !child.hidden)
+            .map((child) => child.className)
+            .join(" ")"""
+        )
+        == (
+            "row-edit-bulk-note row-edit-input row-edit-bulk-textarea "
+            "row-edit-bulk-actions"
+        )
+    )
+    copy_template = dialog.locator(".row-edit-copy-template")
+    assert copy_template.inner_text() == "Copy spreadsheet template"
+    assert (
+        dialog.get_by_label("Paste TSV, CSV, or JSON").get_attribute("id")
+        == "row-edit-bulk-textarea"
+    )
+    assert dialog.locator(".row-edit-copy-template-label-narrow").text_content() == (
+        "Copy template"
+    )
+    assert dialog.locator(".row-edit-bulk-template-note").inner_text() == (
+        "You can paste the template into Google Sheets or Excel."
+    )
+    assert dialog.locator(".row-edit-bulk-template-note-narrow").text_content() == (
+        "Paste into Google Sheets or Excel"
+    )
+    copy_template.click()
+    page.wait_for_function(
+        """() => document.querySelector(".row-edit-copy-template").textContent === "Copied" """
+    )
+    assert page.evaluate("navigator.clipboard.readText()") == (
+        "title\tmetadata\tlogo\tnotes\tscore"
+    )
+    textarea = dialog.locator(".row-edit-bulk-textarea")
+    textarea.fill("title\tmetadata\nFrom TSV\t{}")
+    assert textarea.input_value() == "title\tmetadata\nFrom TSV\t{}"
+    dropped_value = textarea.evaluate("""node => new Promise((resolve) => {
+            node.addEventListener("input", () => resolve(node.value), { once: true });
+            const file = new File(["\\n\\ntitle,metadata\\nFrom CSV,{}\\n,\\n  ,  \\n"], "rows.csv", { type: "text/csv" });
+            const dataTransfer = new DataTransfer();
+            dataTransfer.items.add(file);
+            node.dispatchEvent(new DragEvent("dragenter", { bubbles: true, cancelable: true, dataTransfer }));
+            node.dispatchEvent(new DragEvent("dragover", { bubbles: true, cancelable: true, dataTransfer }));
+            node.dispatchEvent(new DragEvent("drop", { bubbles: true, cancelable: true, dataTransfer }));
+        })""")
+    assert dropped_value == "\n\ntitle,metadata\nFrom CSV,{}\n,\n  ,  \n"
+    dialog.locator(".row-edit-save").click()
+    assert dialog.evaluate("node => node.open")
+    assert dialog.locator(".row-edit-bulk-textarea").is_hidden()
+    assert dialog.locator(".row-edit-save").inner_text() == "Insert these rows"
+    assert dialog.locator(".row-edit-bulk-preview-summary").inner_text() == (
+        "Previewing 1 row."
+    )
+    preview_text = dialog.locator(".row-edit-bulk-preview-table").inner_text()
+    assert "id" in preview_text
+    assert "title" in preview_text
+    assert "metadata" in preview_text
+    assert "From CSV" in preview_text
+    assert dialog.locator(".row-edit-bulk-preview-auto").first.text_content() == "auto"
+    assert "null" not in preview_text
+    assert "undefined" not in preview_text
+    preview_cell_style = dialog.locator(
+        ".row-edit-bulk-preview-table td"
+    ).first.evaluate(
+        """node => ({
+            overflowWrap: getComputedStyle(node).overflowWrap,
+            whiteSpace: getComputedStyle(node).whiteSpace
+        })"""
+    )
+    assert preview_cell_style == {
+        "overflowWrap": "anywhere",
+        "whiteSpace": "normal",
+    }
+    assert dialog.locator(".row-edit-cancel").inner_text() == "Back"
+    dialog.locator(".row-edit-cancel").click()
+    assert dialog.evaluate("node => node.open")
+    assert dialog.locator(".row-edit-bulk-textarea").is_visible()
+    assert dialog.locator(".row-edit-bulk-textarea").input_value() == (
+        "\n\ntitle,metadata\nFrom CSV,{}\n,\n  ,  \n"
+    )
+    assert dialog.locator(".row-edit-save").inner_text() == "Preview rows"
+    single_insert = dialog.locator(".row-edit-single-insert")
+    assert single_insert.inner_text() == "Insert single row"
+    single_insert.click()
+    assert dialog.locator(".row-edit-bulk").is_hidden()
+    assert dialog.locator(".row-edit-fields").is_visible()
+    assert dialog.locator(".row-edit-save").inner_text() == "Insert row"
     dialog.locator('input[name="title"]').fill("Launch Datasette Cloud")
     dialog.locator('textarea[name="metadata"]').fill(
         '{"ok": false, "source": "playwright"}'
@@ -347,6 +1232,206 @@ def test_insert_row_flow_uses_custom_column_field(page, datasette_server):
     assert data["score"] == 5
 
 
+@pytest.mark.playwright
+def test_bulk_insert_preview_inserts_rows(page, datasette_server):
+    page.goto(f"{datasette_server}data/projects")
+    page.locator('button[data-table-action="insert-row"]').click()
+
+    dialog = page.locator("#row-edit-dialog")
+    dialog.wait_for()
+    dialog.locator(".row-edit-bulk-insert").click()
+    dialog.locator(".row-edit-bulk-textarea").fill(
+        json.dumps(
+            {
+                "metadata": [{"title": "Ignored", "metadata": "{}"}],
+                "projects": [
+                    {"title": "Bulk one", "metadata": "{}"},
+                    {"title": "Bulk two", "metadata": "{}"},
+                ],
+            }
+        )
+    )
+    dialog.locator(".row-edit-save").click()
+    assert dialog.locator(".row-edit-save").inner_text() == "Insert these rows"
+    dialog.locator(".row-edit-save").click()
+    dialog.locator(
+        ".row-edit-bulk-progress-status", has_text="2 rows inserted."
+    ).wait_for()
+    assert dialog.locator(".row-edit-cancel").inner_text() == "Close and view table"
+    dialog.locator(".row-edit-cancel").click()
+    page.wait_for_load_state("domcontentloaded")
+    assert page.url == f"{datasette_server}data/projects"
+
+    assert project_rows(datasette_server, title="Bulk one")
+    assert project_rows(datasette_server, title="Bulk two")
+
+
+@pytest.mark.playwright
+def test_bulk_insert_upsert_option_updates_existing_and_inserts_new(
+    page, datasette_server
+):
+    dialog = open_bulk_insert_dialog(page, f"{datasette_server}data/upsert_items")
+    textarea = dialog.locator(".row-edit-bulk-textarea")
+    conflict_field = dialog.locator(".row-edit-bulk-conflict")
+    conflict_select = dialog.locator(".row-edit-bulk-conflict-mode")
+
+    assert conflict_field.is_hidden()
+    textarea.fill("title\nNo primary key")
+    assert conflict_field.is_hidden()
+
+    textarea.fill(
+        "id,title,metadata\nexisting,Updated by upsert,{}\nnew,Inserted by upsert,{}"
+    )
+    assert conflict_field.is_visible()
+    assert (
+        dialog.locator(".row-edit-bulk-conflict-label").inner_text()
+        == "If the row exists already"
+    )
+    assert conflict_select.input_value() == "ignore"
+    assert (
+        conflict_select.evaluate("""node => Array.from(node.options)
+        .filter((option) => !option.hidden)
+        .map((option) => option.textContent.trim())""")
+        == [
+            "Stop with an error",
+            "Skip existing rows",
+            "Update existing and insert new",
+        ]
+    )
+
+    conflict_select.select_option("upsert")
+    assert conflict_select.input_value() == "upsert"
+    dialog.locator(".row-edit-save").click()
+
+    assert dialog.locator(".row-edit-save").inner_text() == "Update or insert rows"
+    preview_text = dialog.locator(".row-edit-bulk-preview-table").inner_text()
+    assert "Updated by upsert" in preview_text
+    assert "Inserted by upsert" in preview_text
+
+    dialog.locator(".row-edit-save").click()
+    dialog.locator(
+        ".row-edit-bulk-progress-status", has_text="2 rows upserted."
+    ).wait_for()
+
+    assert upsert_item_row(datasette_server, "existing")["title"] == (
+        "Updated by upsert"
+    )
+    assert upsert_item_row(datasette_server, "new")["title"] == "Inserted by upsert"
+
+
+@pytest.mark.playwright
+def test_bulk_insert_conflicts_hide_upsert_without_update_permission(
+    page, datasette_server
+):
+    dialog = open_bulk_insert_dialog(page, f"{datasette_server}data/bulk_defaults")
+    textarea = dialog.locator(".row-edit-bulk-textarea")
+    conflict_field = dialog.locator(".row-edit-bulk-conflict")
+    conflict_select = dialog.locator(".row-edit-bulk-conflict-mode")
+
+    textarea.fill("title\nOnly title")
+    assert conflict_field.is_hidden()
+
+    textarea.fill("id,title\n1,Only title")
+    assert conflict_field.is_visible()
+    assert conflict_select.input_value() == "ignore"
+    assert (
+        conflict_select.evaluate("""node => Array.from(node.options)
+        .filter((option) => !option.hidden)
+        .map((option) => option.textContent.trim())""")
+        == [
+            "Stop with an error",
+            "Skip existing rows",
+        ]
+    )
+    assert conflict_select.locator('option[value="upsert"]').evaluate(
+        "node => node.hidden && node.disabled"
+    )
+
+
+@pytest.mark.playwright
+def test_bulk_insert_live_validation_reports_unknown_columns(page, datasette_server):
+    dialog = open_bulk_insert_dialog(page, f"{datasette_server}data/projects")
+    textarea = dialog.locator(".row-edit-bulk-textarea")
+    error = dialog.locator(".row-edit-error")
+    save = dialog.locator(".row-edit-save")
+
+    textarea.fill(json.dumps([{"id2": 1, "title": "Unknown column"}]))
+    error.wait_for()
+    assert error.inner_text() == "JSON row 1 has unknown column id2."
+    assert save.is_disabled()
+    assert textarea.evaluate("node => document.activeElement === node")
+
+    textarea.fill("id2,title\n1,Unknown column")
+    assert error.inner_text() == "Unknown column id2 in header row."
+    assert save.is_disabled()
+
+    textarea.fill("[")
+    assert error.is_hidden()
+    assert not save.is_disabled()
+
+    textarea.fill(json.dumps([{"id": 1, "title": "Known column"}]))
+    assert error.is_hidden()
+    assert not save.is_disabled()
+    assert dialog.locator(".row-edit-bulk-conflict").is_visible()
+    assert dialog.locator(".row-edit-bulk-conflict-mode").input_value() == "ignore"
+
+
+@pytest.mark.playwright
+def test_bulk_insert_omits_columns_absent_from_pasted_input(page, datasette_server):
+    page.goto(f"{datasette_server}data/bulk_defaults")
+    page.locator('button[data-table-action="insert-row"]').click()
+
+    dialog = page.locator("#row-edit-dialog")
+    dialog.wait_for()
+    dialog.locator(".row-edit-bulk-insert").click()
+    dialog.locator(".row-edit-bulk-textarea").fill("title\nOnly title")
+    dialog.locator(".row-edit-save").click()
+
+    assert dialog.locator(".row-edit-save").inner_text() == "Insert these rows"
+    preview_text = dialog.locator(".row-edit-bulk-preview-table").inner_text()
+    assert "Only title" in preview_text
+    assert "undefined" not in preview_text
+    assert dialog.locator(".row-edit-bulk-preview-auto").inner_text() == "auto"
+
+    dialog.locator(".row-edit-save").click()
+    dialog.locator(
+        ".row-edit-bulk-progress-status", has_text="1 row inserted."
+    ).wait_for()
+
+    rows = bulk_default_rows(datasette_server, title="Only title")
+    assert rows == [
+        {
+            "id": 1,
+            "title": "Only title",
+            "status": "todo",
+            "score": 5,
+        }
+    ]
+
+
+@pytest.mark.playwright
+def test_bulk_insert_preview_accepts_single_column_input(page, datasette_server):
+    page.goto(f"{datasette_server}data/projects")
+    page.locator('button[data-table-action="insert-row"]').click()
+
+    dialog = page.locator("#row-edit-dialog")
+    dialog.wait_for()
+    dialog.locator(".row-edit-bulk-insert").click()
+    dialog.locator(".row-edit-bulk-textarea").fill("title\none\ntwo\nthree")
+    dialog.locator(".row-edit-save").click()
+
+    assert dialog.locator(".row-edit-save").inner_text() == "Insert these rows"
+    assert dialog.locator(".row-edit-bulk-preview-summary").inner_text() == (
+        "Previewing 3 rows."
+    )
+    preview_text = dialog.locator(".row-edit-bulk-preview-table").inner_text()
+    assert "one" in preview_text
+    assert "two" in preview_text
+    assert "three" in preview_text
+    assert "null" not in preview_text
+    assert "undefined" not in preview_text
+
+
 @pytest.mark.playwright
 def test_edit_row_flow_validates_json_and_saves_changes(page, datasette_server):
     page.goto(f"{datasette_server}data/projects")
@@ -354,6 +1439,9 @@ def test_edit_row_flow_validates_json_and_saves_changes(page, datasette_server):
 
     dialog = page.locator("#row-edit-dialog")
     dialog.wait_for()
+    assert dialog.locator(".row-edit-bulk-insert").is_hidden()
+    assert dialog.locator(".row-edit-single-insert").is_hidden()
+    assert dialog.locator(".row-edit-bulk").is_hidden()
     title = dialog.locator('input[name="title"]')
     title.wait_for()
     title.fill("Build Datasette, edited")
@@ -389,6 +1477,120 @@ def test_edit_row_flow_validates_json_and_saves_changes(page, datasette_server):
     assert data["notes"] == "Edited from Playwright"
 
 
+@pytest.mark.playwright
+def test_edit_row_binary_control_shows_size_and_image_preview(page, datasette_server):
+    page.goto(f"{datasette_server}data/binary_files")
+    page.locator('tr[data-row="1"] button[data-row-action="edit"]').click()
+
+    dialog = page.locator("#row-edit-dialog")
+    dialog.wait_for()
+    raw_control = dialog.locator('.row-edit-binary-control[data-column="data"]')
+    raw_control.wait_for()
+    assert (
+        raw_control.locator(".row-edit-binary-size").inner_text() == "Binary: 4 bytes"
+    )
+    assert raw_control.locator(".row-edit-binary-preview img").count() == 0
+    assert dialog.locator('textarea[name="data"]').count() == 0
+    assert dialog.locator('input[type="hidden"][name="data"]').count() == 1
+
+    dialog.locator(".row-edit-cancel").click()
+    page.locator('tr[data-row="2"] button[data-row-action="edit"]').click()
+
+    image_control = dialog.locator('.row-edit-binary-control[data-column="data"]')
+    image_control.wait_for()
+    assert (
+        image_control.locator(".row-edit-binary-size").inner_text()
+        == f"Binary: {len(PNG_1X1_BYTES)} bytes"
+    )
+    image = image_control.locator(".row-edit-binary-preview img")
+    image.wait_for()
+    assert image.get_attribute("src").startswith("blob:")
+
+
+@pytest.mark.playwright
+def test_edit_row_binary_control_replaces_blob_from_file(page, datasette_server):
+    replacement = b"Replacement \x00 bytes"
+
+    page.goto(f"{datasette_server}data/binary_files")
+    page.locator('tr[data-row="1"] button[data-row-action="edit"]').click()
+
+    dialog = page.locator("#row-edit-dialog")
+    binary_control = dialog.locator('.row-edit-binary-control[data-column="data"]')
+    binary_control.wait_for()
+    binary_control.locator('input[type="file"]').set_input_files(
+        {
+            "name": "replacement.bin",
+            "mimeType": "application/octet-stream",
+            "buffer": replacement,
+        }
+    )
+    wait_for_binary_control_file(binary_control, len(replacement), "replacement.bin")
+
+    dialog.locator(".row-edit-save").click()
+    page.locator(".row-mutation-status", has_text="Updated row 1").wait_for()
+    assert binary_file_blob(datasette_server, 1) == replacement
+
+
+@pytest.mark.playwright
+def test_edit_row_binary_control_handles_null_blob(page, datasette_server):
+    replacement = b"From NULL"
+
+    page.goto(f"{datasette_server}data/binary_files")
+    page.locator('tr[data-row="3"] button[data-row-action="edit"]').click()
+
+    dialog = page.locator("#row-edit-dialog")
+    binary_control = dialog.locator('.row-edit-binary-control[data-column="data"]')
+    binary_control.wait_for()
+    assert (
+        binary_control.locator(".row-edit-binary-size").inner_text() == "No binary data"
+    )
+    binary_control.locator('input[type="file"]').set_input_files(
+        {
+            "name": "from-null.bin",
+            "mimeType": "application/octet-stream",
+            "buffer": replacement,
+        }
+    )
+    wait_for_binary_control_file(binary_control, len(replacement), "from-null.bin")
+
+    dialog.locator(".row-edit-save").click()
+    page.locator(".row-mutation-status", has_text="Updated row 3").wait_for()
+    assert binary_file_blob(datasette_server, 3) == replacement
+
+
+@pytest.mark.playwright
+def test_insert_row_binary_control_accepts_pasted_file(page, datasette_server):
+    pasted = b"Pasted \x00 bytes"
+
+    page.goto(f"{datasette_server}data/binary_files")
+    page.locator('button[data-table-action="insert-row"]').click()
+
+    dialog = page.locator("#row-edit-dialog")
+    dialog.wait_for()
+    dialog.locator('input[name="name"]').fill("Pasted bytes")
+    binary_control = dialog.locator('.row-edit-binary-control[data-column="data"]')
+    binary_control.wait_for()
+    binary_control.evaluate(
+        """(node, bytes) => {
+          const transfer = new DataTransfer();
+          transfer.items.add(
+            new File([new Uint8Array(bytes)], "pasted.bin", {
+              type: "application/octet-stream"
+            })
+          );
+          const event = new Event("paste", { bubbles: true, cancelable: true });
+          Object.defineProperty(event, "clipboardData", { value: transfer });
+          node.dispatchEvent(event);
+        }""",
+        list(pasted),
+    )
+    wait_for_binary_control_file(binary_control, len(pasted), "pasted.bin")
+
+    dialog.locator(".row-edit-save").click()
+    page.locator(".row-mutation-status", has_text="Inserted row 4").wait_for()
+    assert binary_file_blob(datasette_server, 4) == pasted
+
+
 @pytest.mark.playwright
 def test_delete_row_flow_removes_row(page, datasette_server):
     page.goto(f"{datasette_server}data/projects")
diff --git a/tests/test_plugins.py b/tests/test_plugins.py
index da14c714..734f0fc2 100644
--- a/tests/test_plugins.py
+++ b/tests/test_plugins.py
@@ -1,21 +1,3 @@
-from bs4 import BeautifulSoup as Soup
-from .fixtures import (
-    make_app_client,
-    TEMP_PLUGIN_SECRET_FILE,
-    PLUGINS_DIR,
-    TestClient as _TestClient,
-)  # noqa
-from click.testing import CliRunner
-from datasette.app import Datasette
-from datasette import cli, hookimpl
-from datasette.fixtures import TABLES
-from datasette.filters import FilterArguments
-from datasette.plugins import get_plugins, DEFAULT_PLUGINS, pm
-from datasette.permissions import PermissionSQL, Action
-from datasette.resources import DatabaseResource
-from datasette.utils.sqlite import sqlite3
-from datasette.utils import StartupError, await_me_maybe
-from jinja2 import ChoiceLoader, FileSystemLoader
 import base64
 import datetime
 import importlib
@@ -24,9 +6,32 @@ import os
 import pathlib
 import re
 import textwrap
-import pytest
 import urllib
 
+import pytest
+from bs4 import BeautifulSoup as Soup
+from click.testing import CliRunner
+from jinja2 import ChoiceLoader, FileSystemLoader
+
+from datasette import cli, hookimpl
+from datasette.app import Datasette
+from datasette.filters import FilterArguments
+from datasette.fixtures import TABLES
+from datasette.permissions import Action, PermissionSQL
+from datasette.plugins import DEFAULT_PLUGINS, get_plugins, pm
+from datasette.resources import DatabaseResource
+from datasette.utils import StartupError, await_me_maybe
+from datasette.utils.sqlite import sqlite3
+
+from .fixtures import (
+    PLUGINS_DIR,
+    TEMP_PLUGIN_SECRET_FILE,
+    make_app_client,
+)
+from .fixtures import (
+    TestClient as _TestClient,
+)
+
 at_memory_re = re.compile(r" at 0x\w+")
 
 
@@ -35,7 +40,7 @@ at_memory_re = re.compile(r" at 0x\w+")
 )
 def test_plugin_hooks_have_tests(plugin_hook):
     """Every plugin hook should be referenced in this test module"""
-    tests_in_this_module = [t for t in globals().keys() if t.startswith("test_hook_")]
+    tests_in_this_module = [t for t in globals() if t.startswith("test_hook_")]
     ok = False
     for test in tests_in_this_module:
         if plugin_hook in test:
@@ -125,11 +130,11 @@ async def test_hook_extra_css_urls(ds_client, path, expected_decoded_object):
     response = await ds_client.get(path)
     assert response.status_code == 200
     links = Soup(response.text, "html.parser").find_all("link")
-    special_href = [
+    special_href = next(
         link
         for link in links
         if link.attrs["href"].endswith("/extra-css-urls-demo.css")
-    ][0]["href"]
+    )["href"]
     # This link has a base64-encoded JSON blob in it
     encoded = special_href.split("/")[3]
     actual_decoded_object = json.loads(base64.b64decode(encoded).decode("utf8"))
@@ -152,7 +157,7 @@ async def test_hook_extra_js_urls(ds_client):
             "type": "module",
         },
     ]:
-        assert any(s == attrs for s in script_attrs), "Expected: {}".format(attrs)
+        assert any(s == attrs for s in script_attrs), f"Expected: {attrs}"
 
 
 @pytest.mark.asyncio
@@ -315,7 +320,8 @@ async def test_plugin_config_env_from_list(ds_client):
 
 @pytest.mark.asyncio
 async def test_plugin_config_file(ds_client):
-    with open(TEMP_PLUGIN_SECRET_FILE, "w") as fp:
+    # Blocking write is fine here - it is tiny test setup, not request handling
+    with open(TEMP_PLUGIN_SECRET_FILE, "w") as fp:  # noqa: ASYNC230
         fp.write("FROM_FILE")
     assert {"foo": "FROM_FILE"} == ds_client.ds.plugin_config("file-plugin")
     os.remove(TEMP_PLUGIN_SECRET_FILE)
@@ -783,9 +789,13 @@ async def test_hook_permission_resources_sql():
 
 @pytest.mark.asyncio
 async def test_actor_json(ds_client):
-    assert (await ds_client.get("/-/actor.json")).json() == {"actor": None}
+    assert (await ds_client.get("/-/actor.json")).json() == {
+        "ok": True,
+        "actor": None,
+    }
     assert (await ds_client.get("/-/actor.json?_bot2=1")).json() == {
-        "actor": {"id": "bot2", "1+1": 2}
+        "ok": True,
+        "actor": {"id": "bot2", "1+1": 2},
     }
 
 
@@ -819,7 +829,7 @@ def test_hook_register_routes_with_datasette(configured_path):
         assert response.status_code == 200
         assert configured_path.upper() == response.text
         # Other one should 404
-        other_path = [p for p in ("path1", "path2") if configured_path != p][0]
+        other_path = next(p for p in ("path1", "path2") if configured_path != p)
         assert client.get(f"/{other_path}/", follow_redirects=True).status_code == 404
 
 
@@ -924,7 +934,7 @@ async def test_plugin_startup_can_add_queries():
                 await datasette.add_query(
                     "data",
                     "from_startup",
-                    "select {}".format(result.first()[0]),
+                    f"select {result.first()[0]}",
                     source="plugin",
                 )
 
@@ -1036,7 +1046,7 @@ async def test_hook_handle_exception(ds_client):
 @pytest.mark.asyncio
 @pytest.mark.parametrize("param", ("_custom_error", "_custom_error_async"))
 async def test_hook_handle_exception_custom_response(ds_client, param):
-    response = await ds_client.get("/trigger-error?{}=1".format(param))
+    response = await ds_client.get(f"/trigger-error?{param}=1")
     assert response.text == param
 
 
@@ -1370,7 +1380,7 @@ async def test_hook_register_actions_no_duplicates(duplicate):
     # This should error:
     with pytest.raises(StartupError) as ex:
         await ds.invoke_startup()
-        assert "Duplicate action {}".format(duplicate) in str(ex.value)
+        assert f"Duplicate action {duplicate}" in str(ex.value)
 
 
 @pytest.mark.asyncio
diff --git a/tests/test_publish_cloudrun.py b/tests/test_publish_cloudrun.py
index 6617bc77..aebcaa33 100644
--- a/tests/test_publish_cloudrun.py
+++ b/tests/test_publish_cloudrun.py
@@ -1,10 +1,12 @@
-from click.testing import CliRunner
-from datasette import cli
-from unittest import mock
 import json
 import os
-import pytest
 import textwrap
+from unittest import mock
+
+import pytest
+from click.testing import CliRunner
+
+from datasette import cli
 
 
 @pytest.mark.serial
@@ -70,9 +72,7 @@ def test_publish_cloudrun_prompts_for_service(
             ),
             mock.call(f"gcloud builds submit --tag {tag}", shell=True),
             mock.call(
-                "gcloud run deploy --allow-unauthenticated --platform=managed --image {} input-service --max-instances 1".format(
-                    tag
-                ),
+                f"gcloud run deploy --allow-unauthenticated --platform=managed --image {tag} input-service --max-instances 1",
                 shell=True,
             ),
         ]
@@ -107,9 +107,7 @@ def test_publish_cloudrun(mock_call, mock_output, mock_which, tmp_path_factory):
             ),
             mock.call(f"gcloud builds submit --tag {tag}", shell=True),
             mock.call(
-                "gcloud run deploy --allow-unauthenticated --platform=managed --image {} test --max-instances 1".format(
-                    tag
-                ),
+                f"gcloud run deploy --allow-unauthenticated --platform=managed --image {tag} test --max-instances 1",
                 shell=True,
             ),
         ]
@@ -186,13 +184,13 @@ def test_publish_cloudrun_memory_cpu(
     tag = f"us-docker.pkg.dev/{mock_output.return_value}/datasette/datasette-test"
     expected_call = (
         "gcloud run deploy --allow-unauthenticated --platform=managed"
-        " --image {} test".format(tag)
+        f" --image {tag} test"
     )
     expected_build_call = f"gcloud builds submit --tag {tag}"
     if memory:
-        expected_call += " --memory {}".format(memory)
+        expected_call += f" --memory {memory}"
     if cpu:
-        expected_call += " --cpu {}".format(cpu)
+        expected_call += f" --cpu {cpu}"
     if timeout:
         expected_build_call += f" --timeout {timeout}"
     # max_instances defaults to 1
diff --git a/tests/test_publish_heroku.py b/tests/test_publish_heroku.py
index cab83654..4302ed94 100644
--- a/tests/test_publish_heroku.py
+++ b/tests/test_publish_heroku.py
@@ -1,9 +1,11 @@
-from click.testing import CliRunner
-from datasette import cli
-from unittest import mock
 import os
 import pathlib
+from unittest import mock
+
 import pytest
+from click.testing import CliRunner
+
+from datasette import cli
 
 
 @pytest.mark.serial
diff --git a/tests/test_pytest_autoclose_plugin.py b/tests/test_pytest_autoclose_plugin.py
index 3af1aace..9b17d24b 100644
--- a/tests/test_pytest_autoclose_plugin.py
+++ b/tests/test_pytest_autoclose_plugin.py
@@ -20,6 +20,7 @@ def _run_pytest(tmp_path: Path) -> subprocess.CompletedProcess:
         cwd=str(tmp_path),
         capture_output=True,
         text=True,
+        check=False,
     )
 
 
diff --git a/tests/test_queries.py b/tests/test_queries.py
index b757f221..15b7ad0f 100644
--- a/tests/test_queries.py
+++ b/tests/test_queries.py
@@ -8,43 +8,36 @@ from bs4 import BeautifulSoup as Soup
 from datasette.app import Datasette
 from datasette.resources import DatabaseResource, QueryResource
 from datasette.stored_queries import StoredQuery, StoredQueryPage
+from datasette.utils import UNSTABLE_API_MESSAGE
 from datasette.utils.asgi import Forbidden
 from datasette.utils.sqlite import sqlite3, supports_returning
 
 requires_sqlite_returning = pytest.mark.skipif(
     not supports_returning(), reason="SQLite does not support RETURNING"
 )
-EXPECTED_CREATE_TABLE_TEMPLATE_SQL = "\n".join(
-    (
-        "create table new_table (",
-        "  id integer primary key,",
-        "  name text",
-        "  -- created text default (datetime('now'))",
-        ")",
-    )
-)
+EXPECTED_CREATE_TABLE_TEMPLATE_SQL = "create table new_table (\n  id integer primary key,\n  name text\n  -- created text default (datetime('now'))\n)"
 
 
 def _template_option_attributes(html, table):
-    match = re.search(r'<option value="{}"([^>]*)>'.format(table), html)
-    assert match, "Could not find template option for {}".format(table)
+    match = re.search(rf'<option value="{table}"([^>]*)>', html)
+    assert match, f"Could not find template option for {table}"
     return match.group(1)
 
 
 def _template_sql(html, table, operation):
     attrs = _template_option_attributes(html, table)
-    match = re.search(r'data-template-{}-sql="([^"]*)"'.format(operation), attrs)
-    assert match, "Could not find {} template for {}".format(operation, table)
+    match = re.search(rf'data-template-{operation}-sql="([^"]*)"', attrs)
+    assert match, f"Could not find {operation} template for {table}"
     return unescape(match.group(1))
 
 
 def _template_button_sql(html, operation):
     soup = Soup(html, "html.parser")
-    button = soup.select_one('button[data-sql-template="{}"]'.format(operation))
-    assert button, "Could not find {} template button".format(operation)
+    button = soup.select_one(f'button[data-sql-template="{operation}"]')
+    assert button, f"Could not find {operation} template button"
     assert button.get(
         "data-template-sql"
-    ), "Could not find SQL for {} template button".format(operation)
+    ), f"Could not find SQL for {operation} template button"
     return button["data-template-sql"]
 
 
@@ -52,10 +45,10 @@ async def add_numbered_queries(ds, database, count):
     for i in range(1, count + 1):
         await ds.add_query(
             database,
-            "demo_query_{:02d}".format(i),
-            "select {} as query_number".format(i),
-            title="Demo query {:02d}".format(i),
-            description="Seeded demo query number {:02d}".format(i),
+            f"demo_query_{i:02d}",
+            f"select {i} as query_number",
+            title=f"Demo query {i:02d}",
+            description=f"Seeded demo query number {i:02d}",
             source="user",
             owner_id="root",
         )
@@ -879,7 +872,7 @@ async def test_query_list_html_defaults_to_twenty_and_shows_pagination():
     assert response.text.count('aria-label="Query pagination"') == 1
     assert "Demo query 20" in response.text
     assert "Demo query 21" not in response.text
-    assert 'href="/data/-/queries?_next=' in response.text
+    assert 'href="http://localhost/data/-/queries?_next=' in response.text
     assert len(json_response.json()["queries"]) == 25
 
 
@@ -1125,6 +1118,47 @@ async def test_query_update_api_rejects_config_only_fields():
     assert query.on_success_message_sql is None
 
 
+@pytest.mark.asyncio
+async def test_query_api_rejects_params_alias():
+    # "params" is a datasette.yaml configuration key, not an API input -
+    # the API only accepts "parameters"
+    ds = Datasette(memory=True, default_deny=True)
+    ds.root_enabled = True
+    db = ds.add_memory_database("query_params_alias", name="data")
+    await db.execute_write("create table dogs (id integer primary key, name text)")
+    await ds.invoke_startup()
+
+    store_response = await ds.client.post(
+        "/data/-/queries/store",
+        actor={"id": "root"},
+        json={
+            "query": {
+                "name": "by_name",
+                "sql": "select * from dogs where name = :name",
+                "params": ["name"],
+            }
+        },
+    )
+    assert store_response.status_code == 400
+    assert store_response.json()["errors"] == ["Invalid keys: params"]
+    assert await ds.get_query("data", "by_name") is None
+
+    await ds.add_query(
+        "data",
+        "editable",
+        "select * from dogs where name = :name",
+        source="user",
+        owner_id="root",
+    )
+    update_response = await ds.client.post(
+        "/data/editable/-/update",
+        actor={"id": "root"},
+        json={"update": {"params": ["name"]}},
+    )
+    assert update_response.status_code == 400
+    assert update_response.json()["errors"] == ["Invalid keys: params"]
+
+
 @pytest.mark.asyncio
 async def test_query_update_api_rejects_trusted_queries_but_internal_update_allowed():
     ds = Datasette(
@@ -1585,6 +1619,66 @@ async def test_create_query_analyze_endpoint_uses_sql_only():
     assert old_analyze_response.status_code == 404
 
 
+@pytest.mark.asyncio
+async def test_create_query_supports_recursive_cte():
+    ds = Datasette(memory=True, default_deny=True)
+    ds.root_enabled = True
+    db = ds.add_memory_database("query_create_recursive_cte", name="data")
+    await db.execute_write("create table dogs (id integer primary key, name text)")
+    await ds.invoke_startup()
+
+    sql = """
+    with recursive dog_tree(id, name) as (
+        select id, name from dogs
+        union all
+        select id + 1, name from dog_tree where id < 3
+    )
+    select name from dog_tree
+    """.strip()
+
+    analysis_response = await ds.client.get(
+        "/data/-/queries/analyze",
+        actor={"id": "root"},
+        params={"sql": sql},
+    )
+    form_response = await ds.client.get(
+        "/data/-/queries/store",
+        actor={"id": "root"},
+        params={"sql": sql},
+    )
+    store_response = await ds.client.post(
+        "/data/-/queries/store",
+        actor={"id": "root"},
+        data={
+            "name": "dog-tree",
+            "title": "Dog tree",
+            "sql": sql,
+            "is_private": "1",
+        },
+    )
+
+    assert analysis_response.status_code == 200
+    analysis_data = analysis_response.json()
+    assert analysis_data["ok"] is True
+    assert analysis_data["analysis_error"] is None
+    assert analysis_data["analysis_is_write"] is False
+    assert analysis_data["save_disabled"] is False
+
+    assert form_response.status_code == 200
+    soup = Soup(form_response.text, "html.parser")
+    submit = soup.select_one("[data-query-create-submit]")
+    assert submit is not None
+    assert not submit.has_attr("disabled")
+    assert "This is a read-only query." in form_response.text
+
+    assert store_response.status_code == 302
+    assert store_response.headers["location"] == "/data/dog-tree"
+    query = await ds.get_query("data", "dog-tree")
+    assert query is not None
+    assert query.sql == sql
+    assert query.is_write is False
+
+
 @pytest.mark.asyncio
 async def test_create_query_form_error_redisplays_form_with_values():
     ds = Datasette(memory=True, default_deny=True)
@@ -2080,7 +2174,11 @@ async def test_query_parameters_endpoint_uses_get_sql_only():
     )
 
     assert response.status_code == 200
-    assert response.json() == {"ok": True, "parameters": ["name", "id"]}
+    assert response.json() == {
+        "ok": True,
+        "unstable": UNSTABLE_API_MESSAGE,
+        "parameters": ["name", "id"],
+    }
     assert permission_denied_response.status_code == 403
     assert permission_denied_response.json()["errors"] == [
         "Permission denied: need execute-sql"
@@ -2325,9 +2423,7 @@ async def test_execute_write_json_returning_rows_can_be_truncated():
     db = ds.add_memory_database("execute_write_returning_json_truncated", name="data")
     await db.execute_write("create table dogs (id integer primary key, name text)")
     for index in range(1, 12):
-        await db.execute_write(
-            "insert into dogs (name) values (?)", ["Dog {}".format(index)]
-        )
+        await db.execute_write("insert into dogs (name) values (?)", [f"Dog {index}"])
     await ds.invoke_startup()
 
     response = await ds.client.post(
@@ -2342,7 +2438,7 @@ async def test_execute_write_json_returning_rows_can_be_truncated():
     assert data["message"] == "Query executed"
     assert data["rowcount"] == -1
     assert data["rows"] == [
-        {"id": index, "name": "Dog {}!".format(index)} for index in range(1, 11)
+        {"id": index, "name": f"Dog {index}!"} for index in range(1, 11)
     ]
     assert data["truncated"] is True
     assert (await db.execute("select count(*) from dogs where name like '%!'")).first()[
@@ -2396,9 +2492,7 @@ async def test_execute_write_html_returning_rows_can_be_truncated():
     db = ds.add_memory_database("execute_write_returning_html_truncated", name="data")
     await db.execute_write("create table dogs (id integer primary key, name text)")
     for index in range(1, 12):
-        await db.execute_write(
-            "insert into dogs (name) values (?)", ["Dog {}".format(index)]
-        )
+        await db.execute_write("insert into dogs (name) values (?)", [f"Dog {index}"])
     await ds.invoke_startup()
 
     response = await ds.client.post(
@@ -3033,9 +3127,9 @@ async def test_untrusted_stored_write_query_rejects_virtual_table_control_insert
     )
 
     assert denied_response.status_code == 403
-    assert denied_response.json()["message"] == (
+    assert denied_response.json()["errors"] == [
         "Writes to virtual tables are not allowed in user-supplied SQL"
-    )
+    ]
     assert (
         await db.execute("select count(*) from docs where docs match 'hello'")
     ).first()[0] == 1
@@ -3154,6 +3248,74 @@ async def test_execute_write_create_table_uses_create_table_permission():
     assert not await db.table_exists("should_not_exist")
 
 
+@pytest.mark.asyncio
+async def test_execute_write_create_view_uses_create_view_permission():
+    ds = Datasette(
+        memory=True,
+        default_deny=True,
+        config={
+            "permissions": {
+                "insert-row": {"id": "row-writer"},
+                "update-row": {"id": "row-writer"},
+            },
+            "databases": {
+                "data": {
+                    "permissions": {
+                        "view-database": {"id": ["creator", "row-writer"]},
+                        "execute-write-sql": {"id": ["creator", "row-writer"]},
+                        "create-view": {"id": "creator"},
+                    }
+                }
+            },
+        },
+    )
+    db = ds.add_memory_database("execute_write_create_view", name="data")
+    await db.execute_write("create table dogs (id integer primary key, name text)")
+    await ds.invoke_startup()
+
+    analysis_response = await ds.client.get(
+        "/data/-/execute-write/analyze",
+        actor={"id": "creator"},
+        params={"sql": "create view dog_names as select id, name from dogs"},
+    )
+    allowed_response = await ds.client.post(
+        "/data/-/execute-write",
+        actor={"id": "creator"},
+        json={"sql": "create view dog_names as select id, name from dogs"},
+    )
+    row_permission_response = await ds.client.post(
+        "/data/-/execute-write",
+        actor={"id": "row-writer"},
+        json={"sql": "create view should_not_exist as select id from dogs"},
+    )
+
+    assert analysis_response.status_code == 200
+    analysis_data = analysis_response.json()
+    assert analysis_data["ok"] is True
+    assert analysis_data["execute_disabled"] is False
+    assert analysis_data["analysis_rows"] == [
+        {
+            "operation": "create",
+            "database": "data",
+            "table": "dog_names",
+            "required_permission": "create-view",
+            "source": None,
+            "allowed": True,
+        }
+    ]
+
+    assert allowed_response.status_code == 200
+    assert allowed_response.json()["ok"] is True
+    assert allowed_response.json()["message"] == "Query executed"
+    assert await db.view_exists("dog_names")
+
+    assert row_permission_response.status_code == 403
+    assert row_permission_response.json()["errors"] == [
+        "Permission denied: need create-view on data"
+    ]
+    assert not await db.view_exists("should_not_exist")
+
+
 @pytest.mark.parametrize(
     (
         "database_name",
@@ -3204,8 +3366,20 @@ async def test_execute_write_create_table_uses_create_table_permission():
             (),
             "drop-table",
         ),
+        (
+            "execute_write_drop_view",
+            "dropper",
+            "drop view dogs_view",
+            "drop view cats_view",
+            "Permission denied: need drop-view on data/cats_view",
+            (
+                "create view dogs_view as select * from dogs",
+                "create view cats_view as select * from cats",
+            ),
+            "drop-view",
+        ),
     ),
-    ids=("alter-table", "create-index", "drop-index", "drop-table"),
+    ids=("alter-table", "create-index", "drop-index", "drop-table", "drop-view"),
 )
 @pytest.mark.asyncio
 async def test_execute_write_schema_operations_use_schema_permissions(
@@ -3240,7 +3414,12 @@ async def test_execute_write_schema_operations_use_schema_permissions(
                                 "drop-table": {"id": "dropper"},
                                 "view-table": {"id": "alterer"},
                             }
-                        }
+                        },
+                        "dogs_view": {
+                            "permissions": {
+                                "drop-view": {"id": "dropper"},
+                            }
+                        },
                     },
                 }
             },
@@ -3293,6 +3472,9 @@ async def test_execute_write_schema_operations_use_schema_permissions(
     elif expected_state == "drop-table":
         assert not await db.table_exists("dogs")
         assert await db.table_exists("cats")
+    elif expected_state == "drop-view":
+        assert not await db.view_exists("dogs_view")
+        assert await db.view_exists("cats_view")
 
 
 @pytest.mark.asyncio
@@ -3451,12 +3633,12 @@ async def test_private_query_restricts_broad_update_delete_permissions(
     )
 
     private_response = await ds.client.post(
-        "/data/alice_private/{}".format(path_suffix),
+        f"/data/alice_private/{path_suffix}",
         actor={"id": "bob"},
         json=request_json,
     )
     public_response = await ds.client.post(
-        "/data/alice_public/{}".format(path_suffix),
+        f"/data/alice_public/{path_suffix}",
         actor={"id": "bob"},
         json=request_json,
     )
@@ -3594,3 +3776,81 @@ async def test_stored_write_query_with_truncated_returning_message():
     assert response.status_code == 200
     assert response.json()["ok"] is True
     assert response.json()["message"] == "Query executed"
+
+
+@pytest.mark.asyncio
+async def test_query_delete_api_rejects_trusted_queries():
+    ds = Datasette(
+        memory=True,
+        default_deny=True,
+        config={
+            "databases": {
+                "data": {
+                    "permissions": {
+                        "view-query": {"id": "editor"},
+                        "delete-query": {"id": "editor"},
+                    },
+                    "queries": {
+                        "trusted_report": {
+                            "sql": "select 1 as one",
+                        },
+                    },
+                }
+            }
+        },
+    )
+    ds.add_memory_database("query_delete_trusted_api", name="data")
+    await ds.invoke_startup()
+
+    response = await ds.client.post(
+        "/data/trusted_report/-/delete",
+        actor={"id": "editor"},
+        json={},
+    )
+    assert response.status_code == 403
+    assert response.json()["errors"] == [
+        "Trusted queries cannot be deleted using the API"
+    ]
+    # The query must still exist
+    assert await ds.get_query("data", "trusted_report") is not None
+
+    # The HTML confirmation page refuses too
+    get_response = await ds.client.get(
+        "/data/trusted_report/-/delete",
+        actor={"id": "editor"},
+    )
+    assert get_response.status_code == 403
+
+    # datasette.remove_query() remains available for internal use
+    await ds.remove_query("data", "trusted_report")
+    assert await ds.get_query("data", "trusted_report") is None
+
+
+@pytest.mark.asyncio
+async def test_stored_query_json_uses_parameters_not_params():
+    ds = Datasette(
+        memory=True,
+        config={
+            "databases": {
+                "data": {
+                    "queries": {
+                        "with_params": {
+                            "sql": "select :name as name, :age as age",
+                            "params": ["name", "age"],
+                        },
+                    },
+                }
+            }
+        },
+    )
+    ds.add_memory_database("query_parameters_key", name="data")
+    await ds.invoke_startup()
+
+    definition = (await ds.client.get("/data/with_params/-/definition")).json()
+    assert definition["query"]["parameters"] == ["name", "age"]
+    assert "params" not in definition["query"]
+
+    listing = (await ds.client.get("/data/-/queries.json")).json()
+    query = next(q for q in listing["queries"] if q["name"] == "with_params")
+    assert query["parameters"] == ["name", "age"]
+    assert "params" not in query
diff --git a/tests/test_restriction_sql.py b/tests/test_restriction_sql.py
index df6abd29..fd33f535 100644
--- a/tests/test_restriction_sql.py
+++ b/tests/test_restriction_sql.py
@@ -1,4 +1,5 @@
 import pytest
+
 from datasette.app import Datasette
 from datasette.permissions import PermissionSQL
 from datasette.resources import TableResource
diff --git a/tests/test_routes.py b/tests/test_routes.py
index 24c702fc..0fba1041 100644
--- a/tests/test_routes.py
+++ b/tests/test_routes.py
@@ -1,8 +1,9 @@
-from datasette.app import Datasette, Database
-from datasette.utils import resolve_routes
 import pytest
 import pytest_asyncio
 
+from datasette.app import Database, Datasette
+from datasette.utils import resolve_routes
+
 
 @pytest.fixture(scope="session")
 def routes():
@@ -73,7 +74,7 @@ async def ds_with_route():
 @pytest.mark.asyncio
 async def test_db_with_route_databases(ds_with_route):
     response = await ds_with_route.client.get("/-/databases.json")
-    assert response.json()[0] == {
+    assert response.json()["databases"][0] == {
         "name": "original-name",
         "route": "custom-route-name",
         "path": None,
diff --git a/tests/test_schema_endpoints.py b/tests/test_schema_endpoints.py
index c95d8614..2ef78867 100644
--- a/tests/test_schema_endpoints.py
+++ b/tests/test_schema_endpoints.py
@@ -1,5 +1,6 @@
 import pytest
 import pytest_asyncio
+
 from datasette.app import Datasette
 
 
diff --git a/tests/test_search_tables.py b/tests/test_search_tables.py
index ce774327..e43e9b0c 100644
--- a/tests/test_search_tables.py
+++ b/tests/test_search_tables.py
@@ -4,6 +4,7 @@ Tests for special endpoints in datasette/views/special.py
 
 import pytest
 import pytest_asyncio
+
 from datasette.app import Datasette
 
 
diff --git a/tests/test_spatialite.py b/tests/test_spatialite.py
index c07a30e8..0d11737e 100644
--- a/tests/test_spatialite.py
+++ b/tests/test_spatialite.py
@@ -1,8 +1,10 @@
-from datasette.app import Datasette
-from datasette.utils import find_spatialite, SpatialiteNotFound, SPATIALITE_FUNCTIONS
-from .utils import has_load_extension
 import pytest
 
+from datasette.app import Datasette
+from datasette.utils import SPATIALITE_FUNCTIONS, SpatialiteNotFound, find_spatialite
+
+from .utils import has_load_extension
+
 
 def has_spatialite():
     try:
diff --git a/tests/test_stored_queries.py b/tests/test_stored_queries.py
index 46420749..4be96b30 100644
--- a/tests/test_stored_queries.py
+++ b/tests/test_stored_queries.py
@@ -1,8 +1,10 @@
-from bs4 import BeautifulSoup as Soup
-from asgiref.sync import async_to_sync
 import json
-import pytest
 import re
+
+import pytest
+from asgiref.sync import async_to_sync
+from bs4 import BeautifulSoup as Soup
+
 from .fixtures import make_app_client
 
 
diff --git a/tests/test_success_envelope.py b/tests/test_success_envelope.py
new file mode 100644
index 00000000..d24a8c5d
--- /dev/null
+++ b/tests/test_success_envelope.py
@@ -0,0 +1,170 @@
+"""
+Tests for the canonical JSON success envelope.
+
+Every JSON object returned by a Datasette endpoint on success should include
+"ok": true. /-/plugins intentionally returns a top-level array instead, while
+/-/databases and /-/actions use the object envelope.
+"""
+
+import pytest
+
+from datasette.app import Datasette
+from datasette.utils import UNSTABLE_API_MESSAGE, sqlite3
+
+
+@pytest.fixture
+def ds_envelope(tmp_path_factory):
+    db_directory = tmp_path_factory.mktemp("dbs")
+    db_path = str(db_directory / "data.db")
+    conn = sqlite3.connect(db_path)
+    conn.execute("vacuum")
+    conn.execute("create table docs (id integer primary key, title text)")
+    conn.close()
+    ds = Datasette([db_path])
+    ds.root_enabled = True
+    yield ds
+    ds.close()
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "path",
+    (
+        "/.json",
+        "/-/.json",
+        "/-/versions.json",
+        "/-/settings.json",
+        "/-/config.json",
+        "/-/actor.json",
+        "/-/jump.json",
+        "/-/schema.json",
+        "/fixtures/-/schema.json",
+        "/fixtures/facetable/-/schema.json",
+        "/-/allowed.json?action=view-instance",
+        "/fixtures/facet_cities/-/autocomplete?_initial=1",
+    ),
+)
+async def test_success_object_has_ok_true(ds_client, path):
+    response = await ds_client.get(path)
+    assert response.status_code == 200
+    data = response.json()
+    assert isinstance(data, dict)
+    assert data["ok"] is True
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "path",
+    (
+        "/-/rules.json?action=view-instance",
+        "/-/check.json?action=view-instance",
+        "/-/threads.json",
+    ),
+)
+async def test_permission_debug_success_has_ok_true(ds_envelope, path):
+    response = await ds_envelope.client.get(path, actor={"id": "root"})
+    assert response.status_code == 200
+    data = response.json()
+    assert data["ok"] is True
+
+
+@pytest.mark.asyncio
+async def test_permissions_post_success_has_ok_true(ds_envelope):
+    response = await ds_envelope.client.post(
+        "/-/permissions",
+        data={"actor": '{"id": "root"}', "permission": "view-instance"},
+        actor={"id": "root"},
+    )
+    assert response.status_code == 200
+    assert response.json()["ok"] is True
+
+
+@pytest.mark.asyncio
+async def test_plugins_json_is_array(ds_client):
+    response = await ds_client.get("/-/plugins.json")
+    assert response.status_code == 200
+    data = response.json()
+    assert isinstance(data, list)
+    assert all(isinstance(plugin, dict) for plugin in data)
+    # ?all=1 should include Datasette's default plugins in the same shape
+    response_all = await ds_client.get("/-/plugins.json?all=1")
+    all_plugins = response_all.json()
+    assert len(all_plugins) > len(data)
+
+
+@pytest.mark.asyncio
+async def test_databases_json_is_object(ds_client):
+    response = await ds_client.get("/-/databases.json")
+    assert response.status_code == 200
+    data = response.json()
+    assert set(data.keys()) == {"ok", "databases"}
+    assert data["ok"] is True
+    assert isinstance(data["databases"], list)
+    assert "fixtures" in {db["name"] for db in data["databases"]}
+
+
+@pytest.mark.asyncio
+async def test_actions_json_is_object(ds_envelope):
+    response = await ds_envelope.client.get("/-/actions.json", actor={"id": "root"})
+    assert response.status_code == 200
+    data = response.json()
+    assert set(data.keys()) == {"ok", "actions"}
+    assert data["ok"] is True
+    assert isinstance(data["actions"], list)
+    assert "view-instance" in {action["name"] for action in data["actions"]}
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "path",
+    (
+        "/.json",
+        "/-/.json",
+        "/fixtures/-/queries/analyze?sql=select+1",
+        "/fixtures/-/query/parameters?sql=select+:name",
+        "/fixtures/-/execute-write/analyze?sql=delete+from+facetable",
+    ),
+)
+async def test_undocumented_endpoints_report_unstable(ds_client, path):
+    ds_client.ds.root_enabled = True
+    try:
+        response = await ds_client.get(path, actor={"id": "root"})
+    finally:
+        ds_client.ds.root_enabled = False
+    assert response.status_code == 200
+    assert response.json()["unstable"] == UNSTABLE_API_MESSAGE
+
+
+@pytest.mark.asyncio
+async def test_query_store_and_definition_report_unstable(ds_envelope):
+    store = await ds_envelope.client.post(
+        "/data/-/queries/store",
+        json={"query": {"name": "unstable_check", "sql": "select 1"}},
+        actor={"id": "root"},
+    )
+    assert store.status_code == 201
+    assert store.json()["unstable"] == UNSTABLE_API_MESSAGE
+    definition = await ds_envelope.client.get(
+        "/data/unstable_check/-/definition", actor={"id": "root"}
+    )
+    assert definition.status_code == 200
+    assert definition.json()["unstable"] == UNSTABLE_API_MESSAGE
+
+
+@pytest.mark.asyncio
+async def test_permissions_post_reports_unstable(ds_envelope):
+    response = await ds_envelope.client.post(
+        "/-/permissions",
+        data={"actor": '{"id": "root"}', "permission": "view-instance"},
+        actor={"id": "root"},
+    )
+    assert response.status_code == 200
+    assert response.json()["unstable"] == UNSTABLE_API_MESSAGE
+
+
+@pytest.mark.asyncio
+async def test_documented_endpoints_do_not_report_unstable(ds_client):
+    for path in ("/-/versions.json", "/fixtures.json", "/fixtures/facetable.json"):
+        response = await ds_client.get(path)
+        assert response.status_code == 200
+        assert "unstable" not in response.json()
diff --git a/tests/test_table_api.py b/tests/test_table_api.py
index 0cb67164..32dd37f2 100644
--- a/tests/test_table_api.py
+++ b/tests/test_table_api.py
@@ -1,10 +1,13 @@
+import json
+import urllib
+
+import pytest
+
+from datasette.fixtures import generate_compound_rows, generate_sortable_rows
 from datasette.utils import detect_json1
 from datasette.utils.sqlite import sqlite_version
-from datasette.fixtures import generate_compound_rows, generate_sortable_rows
+
 from .fixtures import make_app_client
-import json
-import pytest
-import urllib
 
 
 @pytest.mark.asyncio
@@ -31,8 +34,8 @@ async def test_table_not_exists_json(ds_client):
     assert (await ds_client.get("/fixtures/blah.json")).json() == {
         "ok": False,
         "error": "Table not found",
+        "errors": ["Table not found"],
         "status": 404,
-        "title": None,
     }
 
 
@@ -123,8 +126,8 @@ async def test_html_only_extras_are_not_available_via_json(ds_client, extra):
     # These extras exist for the HTML view; their values are not JSON
     # serializable so they are internal, not part of the JSON API
     response = await ds_client.get(f"/fixtures/facetable.json?_extra={extra}")
-    assert response.status_code == 200
-    assert extra not in response.json()
+    assert response.status_code == 400
+    assert response.json()["errors"] == [f"Unknown _extra: {extra}"]
 
 
 @pytest.mark.asyncio
@@ -180,9 +183,11 @@ def test_query_extra_query_reports_bound_params():
         assert response.json["query"]["params"] == {}
 
 
-def test_query_extra_query_does_not_echo_querystring_without_sql():
+def test_query_extra_query_does_not_echo_querystring():
     with make_app_client() as client:
-        response = client.get("/fixtures/-/query.json?_extra=query&foo=bar")
+        response = client.get(
+            "/fixtures/-/query.json?sql=select+1&_extra=query&foo=bar"
+        )
         assert response.status == 200
         assert response.json["query"]["params"] == {}
 
@@ -242,8 +247,8 @@ async def test_table_shape_invalid(ds_client):
     assert response.json() == {
         "ok": False,
         "error": "Invalid _shape: invalid",
+        "errors": ["Invalid _shape: invalid"],
         "status": 400,
-        "title": None,
     }
 
 
@@ -321,10 +326,6 @@ async def test_paginate_tables_and_views(
     fetched = []
     count = 0
     while path:
-        if "?" in path:
-            path += "&_extra=next_url"
-        else:
-            path += "?_extra=next_url"
         response = await ds_client.get(path)
         assert response.status_code == 200
         count += 1
@@ -357,9 +358,7 @@ async def test_validate_page_size(ds_client, path, expected_error):
 @pytest.mark.asyncio
 async def test_page_size_zero(ds_client):
     """For _size=0 we return the counts, empty rows and no continuation token"""
-    response = await ds_client.get(
-        "/fixtures/no_primary_key.json?_size=0&_extra=count,next_url"
-    )
+    response = await ds_client.get("/fixtures/no_primary_key.json?_size=0&_extra=count")
     assert response.status_code == 200
     assert [] == response.json()["rows"]
     assert 202 == response.json()["count"]
@@ -370,7 +369,7 @@ async def test_page_size_zero(ds_client):
 @pytest.mark.asyncio
 async def test_paginate_compound_keys(ds_client):
     fetched = []
-    path = "/fixtures/compound_three_primary_keys.json?_shape=objects&_extra=next_url"
+    path = "/fixtures/compound_three_primary_keys.json?_shape=objects"
     page = 0
     while path:
         page += 1
@@ -391,7 +390,9 @@ async def test_paginate_compound_keys(ds_client):
 @pytest.mark.asyncio
 async def test_paginate_compound_keys_with_extra_filters(ds_client):
     fetched = []
-    path = "/fixtures/compound_three_primary_keys.json?content__contains=d&_shape=objects&_extra=next_url"
+    path = (
+        "/fixtures/compound_three_primary_keys.json?content__contains=d&_shape=objects"
+    )
     page = 0
     while path:
         page += 1
@@ -444,7 +445,7 @@ async def test_paginate_compound_keys_with_extra_filters(ds_client):
     ],
 )
 async def test_sortable(ds_client, query_string, sort_key, human_description_en):
-    path = f"/fixtures/sortable.json?_shape=objects&_extra=human_description_en,next_url&{query_string}"
+    path = f"/fixtures/sortable.json?_shape=objects&_extra=human_description_en&{query_string}"
     fetched = []
     page = 0
     while path:
@@ -635,8 +636,8 @@ async def test_searchable_invalid_column(ds_client):
     assert response.json() == {
         "ok": False,
         "error": "Cannot search by that column",
+        "errors": ["Cannot search by that column"],
         "status": 400,
-        "title": None,
     }
 
 
@@ -775,7 +776,7 @@ async def test_table_filter_extra_where_invalid(ds_client):
         "/fixtures/facetable.json?_where=_neighborhood=Dogpatch'"
     )
     assert response.status_code == 400
-    assert "Invalid SQL" == response.json()["title"]
+    assert "unrecognized token" in response.json()["error"]
 
 
 def test_table_filter_extra_where_disabled_if_no_sql_allowed():
@@ -848,7 +849,7 @@ def test_page_size_matching_max_returned_rows(
     app_client_returned_rows_matches_page_size,
 ):
     fetched = []
-    path = "/fixtures/no_primary_key.json?_extra=next_url"
+    path = "/fixtures/no_primary_key.json"
     while path:
         response = app_client_returned_rows_matches_page_size.get(path)
         fetched.extend(response.json["rows"])
@@ -1336,6 +1337,109 @@ async def test_binary_data_in_json(ds_client, path, expected_json, expected_text
         assert response.text == expected_text
 
 
+@pytest.mark.asyncio
+async def test_column_details_extra_table(ds_client):
+    response = await ds_client.get(
+        "/fixtures/binary_data.json?_size=0&_extra=column_details"
+    )
+    assert response.status_code == 200
+    data_detail = response.json()["column_details"]["data"]
+    assert data_detail["type"].lower() == "blob"
+    assert data_detail == {
+        "type": data_detail["type"],
+        "sqlite_type": "BLOB",
+        "notnull": False,
+        "default": None,
+        "is_pk": False,
+        "pk_position": 0,
+        "hidden": 0,
+    }
+
+    response = await ds_client.get(
+        "/fixtures/simple_primary_key.json?_size=0&_extra=column_details"
+    )
+    assert response.status_code == 200
+    column_details = response.json()["column_details"]
+    id_detail = column_details["id"]
+    assert id_detail["type"].lower() == "integer"
+    assert id_detail == {
+        "type": id_detail["type"],
+        "sqlite_type": "INTEGER",
+        "notnull": False,
+        "default": None,
+        "is_pk": True,
+        "pk_position": 1,
+        "hidden": 0,
+    }
+    content_detail = column_details["content"]
+    assert content_detail["type"].lower() == "text"
+    assert content_detail == {
+        "type": content_detail["type"],
+        "sqlite_type": "TEXT",
+        "notnull": False,
+        "default": None,
+        "is_pk": False,
+        "pk_position": 0,
+        "hidden": 0,
+    }
+
+    response = await ds_client.get(
+        "/fixtures/compound_three_primary_keys.json?_size=0&_extra=column_details"
+    )
+    assert response.status_code == 200
+    column_details = response.json()["column_details"]
+    assert column_details["pk1"]["is_pk"] is True
+    assert column_details["pk1"]["pk_position"] == 1
+    assert column_details["pk2"]["is_pk"] is True
+    assert column_details["pk2"]["pk_position"] == 2
+    assert column_details["pk3"]["is_pk"] is True
+    assert column_details["pk3"]["pk_position"] == 3
+    assert column_details["content"]["is_pk"] is False
+    assert column_details["content"]["pk_position"] == 0
+
+
+def test_column_details_extra_defaults_and_notnull():
+    with make_app_client(extra_databases={"defaults.db": """
+                CREATE TABLE defaults (
+                    i INTEGER NOT NULL DEFAULT 42,
+                    s TEXT DEFAULT 'hello',
+                    dt TEXT DEFAULT (datetime('now'))
+                );
+            """}) as client:
+        response = client.get("/defaults/defaults.json?_size=0&_extra=column_details")
+        assert response.status == 200
+        column_details = response.json["column_details"]
+        assert column_details["i"]["notnull"] is True
+        assert column_details["i"]["default"] == "42"
+        assert column_details["s"]["notnull"] is False
+        assert column_details["s"]["default"] == "'hello'"
+        assert column_details["dt"]["default"] == "datetime('now')"
+
+
+@pytest.mark.skipif(
+    sqlite_version() < (3, 31, 0),
+    reason="generated columns were added in SQLite 3.31.0",
+)
+def test_column_details_extra_generated_columns():
+    with make_app_client(extra_databases={"generated.db": """
+                CREATE TABLE generated_columns (
+                    body TEXT,
+                    body_length_virtual INTEGER
+                        GENERATED ALWAYS AS (length(body)) VIRTUAL,
+                    body_length_stored INTEGER
+                        GENERATED ALWAYS AS (length(body)) STORED
+                );
+            """}) as client:
+        response = client.get(
+            "/generated/generated_columns.json?_size=0&_extra=column_details"
+        )
+        assert response.status == 200
+        column_details = response.json["column_details"]
+        assert column_details["body"]["hidden"] == 0
+        assert column_details["body_length_virtual"]["hidden"] == 2
+        assert column_details["body_length_stored"]["hidden"] == 3
+
+
 @pytest.mark.asyncio
 @pytest.mark.parametrize(
     "qs",
@@ -1420,6 +1524,16 @@ def test_generated_columns_are_visible_in_datasette():
             "/fixtures/facetable.json?_col=state&_col=state",
             ["pk", "state"],
         ),
+        (
+            # https://github.com/simonw/datasette/issues/1975
+            "/fixtures/facetable.json?_col=pk&_col=state",
+            ["pk", "state"],
+        ),
+        (
+            # https://github.com/simonw/datasette/issues/1975
+            "/fixtures/facetable.json?_col=pk",
+            ["pk"],
+        ),
         (
             "/fixtures/facetable.json?_col=state&_col=created&_nocol=created",
             ["pk", "state"],
@@ -1479,6 +1593,7 @@ async def test_col_nocol_errors(ds_client, path, expected_error):
             {
                 "ok": True,
                 "next": None,
+                "next_url": None,
                 "columns": ["id", "content", "content2"],
                 "rows": [{"id": "1", "content": "hey", "content2": "world"}],
                 "truncated": False,
@@ -1489,9 +1604,11 @@ async def test_col_nocol_errors(ds_client, path, expected_error):
             {
                 "ok": True,
                 "next": None,
+                "next_url": None,
                 "rows": [{"id": "1", "content": "hey", "content2": "world"}],
                 "truncated": False,
                 "count": 1,
+                "count_truncated": False,
             },
         ),
     ),
@@ -1578,3 +1695,58 @@ async def test_extra_render_cell():
 
     finally:
         ds.pm.unregister(name="TestRenderCellPlugin")
+
+
+@pytest.mark.asyncio
+async def test_count_truncated_included_with_count_extra(tmp_path_factory):
+    from datasette.app import Datasette
+    from datasette.utils import sqlite3
+
+    db_directory = tmp_path_factory.mktemp("dbs")
+    db_path = str(db_directory / "counts.db")
+    conn = sqlite3.connect(db_path)
+    conn.execute("vacuum")
+    conn.execute("create table big (id integer primary key)")
+    conn.execute("create table small (id integer primary key)")
+    conn.executemany("insert into big (id) values (?)", [(i,) for i in range(10)])
+    conn.executemany("insert into small (id) values (?)", [(i,) for i in range(3)])
+    conn.commit()
+    conn.close()
+    ds = Datasette([db_path])
+    ds.get_database("counts").count_limit = 5
+    try:
+        response = await ds.client.get("/counts/big.json?_extra=count")
+        data = response.json()
+        # Count is capped at count_limit + 1 and flagged as truncated
+        assert data["count"] == 6
+        assert data["count_truncated"] is True
+
+        response = await ds.client.get("/counts/small.json?_extra=count")
+        data = response.json()
+        assert data["count"] == 3
+        assert data["count_truncated"] is False
+
+        # count_truncated can also be requested on its own
+        response = await ds.client.get("/counts/big.json?_extra=count_truncated")
+        assert response.json()["count_truncated"] is True
+    finally:
+        ds.close()
+
+
+@pytest.mark.asyncio
+async def test_next_url_included_by_default(ds_client):
+    response = await ds_client.get("/fixtures/compound_three_primary_keys.json")
+    data = response.json()
+    assert data["next"] is not None
+    assert data["next_url"].endswith(
+        "/fixtures/compound_three_primary_keys.json?_next="
+        + urllib.parse.quote(data["next"], safe="")
+    )
+    # Follow to the last page - next and next_url are both null there
+    while data["next"]:
+        response = await ds_client.get(
+            "/fixtures/compound_three_primary_keys.json?_next=" + data["next"]
+        )
+        data = response.json()
+    assert data["next"] is None
+    assert data["next_url"] is None
diff --git a/tests/test_table_html.py b/tests/test_table_html.py
index aa67bb3f..e508acb3 100644
--- a/tests/test_table_html.py
+++ b/tests/test_table_html.py
@@ -1,10 +1,13 @@
+import pathlib
+import urllib.parse
+
+import pytest
+from bs4 import BeautifulSoup as Soup
+
 from datasette.app import Datasette
 from datasette.database import Database
-from bs4 import BeautifulSoup as Soup
+
 from .fixtures import make_app_client
-import pathlib
-import pytest
-import urllib.parse
 from .utils import inner_html
 
 
@@ -12,9 +15,9 @@ def table_data_from_soup(soup):
     import json
     import re
 
-    table_script = [
+    table_script = next(
         s for s in soup.find_all("script") if "_datasetteTableData" in (s.string or "")
-    ][0]
+    )
     match = re.search(
         r"window\._datasetteTableData\s*=\s*({.*?});",
         table_script.string,
@@ -23,6 +26,52 @@ def table_data_from_soup(soup):
     return json.loads(match.group(1))
 
 
+def database_data_from_soup(soup):
+    import json
+    import re
+
+    database_script = next(
+        s
+        for s in soup.find_all("script")
+        if "_datasetteDatabaseData" in (s.string or "")
+    )
+    match = re.search(
+        r"window\._datasetteDatabaseData\s*=\s*({.*?});",
+        database_script.string,
+        re.DOTALL,
+    )
+    return json.loads(match.group(1))
+
+
+DEFAULT_EXPRESSION_OPTIONS = [
+    {
+        "value": "current_timestamp",
+        "label": "Current timestamp in UTC, e.g. 2026-05-01 13:34:00",
+        "sqliteType": "text",
+    },
+    {
+        "value": "current_date",
+        "label": "Current date in UTC, e.g. 2026-05-01",
+        "sqliteType": "text",
+    },
+    {
+        "value": "current_time",
+        "label": "Current time in UTC, e.g. 13:34:00",
+        "sqliteType": "text",
+    },
+    {
+        "value": "current_unixtime",
+        "label": "Current Unix time, integer seconds since the epoch",
+        "sqliteType": "integer",
+    },
+    {
+        "value": "current_unixtime_ms",
+        "label": "Current Unix time, integer milliseconds since the epoch",
+        "sqliteType": "integer",
+    },
+]
+
+
 @pytest.mark.asyncio
 @pytest.mark.parametrize(
     "path,expected_definition_sql",
@@ -188,7 +237,7 @@ async def test_existing_filter_redirects(ds_client):
 )
 async def test_reflected_hidden_form_fields(ds_client, qs, expected_hidden):
     # https://github.com/simonw/datasette/issues/1527
-    response = await ds_client.get("/fixtures/facetable?{}".format(qs))
+    response = await ds_client.get(f"/fixtures/facetable?{qs}")
     # In this case we should NOT have a hidden _neighborhood__exact=Downtown field
     form = Soup(response.text, "html.parser").find("form")
     hidden_inputs = {
@@ -618,9 +667,7 @@ async def test_table_html_no_primary_key(ds_client):
     ]
     expected = [
         [
-            '<td class="col-Link type-pk"><a href="/fixtures/no_primary_key/{}">{}</a></td>'.format(
-                i, i
-            ),
+            f'<td class="col-Link type-pk"><a href="/fixtures/no_primary_key/{i}">{i}</a></td>',
             f'<td class="col-rowid type-int">{i}</td>',
             f'<td class="col-content type-str">{i}</td>',
             f'<td class="col-a type-str">a{i}</td>',
@@ -934,6 +981,327 @@ async def test_row_delete_action_data_attributes():
         ds.close()
 
 
+@pytest.mark.asyncio
+async def test_database_create_table_action_button_and_data():
+    ds = Datasette(
+        [],
+        config={
+            "databases": {
+                "data": {
+                    "permissions": {
+                        "create-table": {"id": "root"},
+                    },
+                },
+            },
+        },
+    )
+    try:
+        db = ds.add_database(
+            Database(ds, memory_name="test_database_create_table_action"), name="data"
+        )
+        await db.execute_write_script("""
+            create table items (id integer primary key, name text);
+            """)
+
+        response = await ds.client.get("/data", actor={"id": "root"})
+        assert response.status_code == 200
+        soup = Soup(response.text, "html.parser")
+
+        button = soup.select_one(
+            'button.action-menu-button[data-database-action="create-table"]'
+        )
+        assert button is not None
+        assert button["aria-label"] == "Create table in data"
+        assert button["role"] == "menuitem"
+        description = button.find("span", class_="dropdown-description")
+        assert description.text.strip() == "Create a new table in this database."
+        description.extract()
+        assert button.text.strip() == "Create table"
+        assert any(
+            "edit-tools.js" in script.get("src", "")
+            for script in soup.find_all("script")
+        )
+        assert database_data_from_soup(soup) == {
+            "createTable": {
+                "path": "/data/-/create",
+                "foreignKeyTargetsPath": "/data/-/foreign-key-targets",
+                "databaseName": "data",
+                "columnTypes": ["text", "integer", "float", "blob"],
+                "defaultExpressions": DEFAULT_EXPRESSION_OPTIONS,
+                "canInsertRows": False,
+            },
+        }
+        assert "customColumnTypes" not in database_data_from_soup(soup)["createTable"]
+
+        response_without_permission = await ds.client.get(
+            "/data", actor={"id": "someone-else"}
+        )
+        assert response_without_permission.status_code == 200
+        soup_without_permission = Soup(response_without_permission.text, "html.parser")
+        assert (
+            soup_without_permission.select_one(
+                'button[data-database-action="create-table"]'
+            )
+            is None
+        )
+        assert not any(
+            "_datasetteDatabaseData" in (script.string or "")
+            for script in soup_without_permission.find_all("script")
+        )
+    finally:
+        ds.close()
+
+
+@pytest.mark.asyncio
+async def test_database_create_table_data_includes_insert_row_permission():
+    ds = Datasette(
+        [],
+        config={
+            "databases": {
+                "data": {
+                    "permissions": {
+                        "create-table": {"id": "root"},
+                        "insert-row": {"id": "root"},
+                    },
+                },
+            },
+        },
+    )
+    try:
+        db = ds.add_database(
+            Database(ds, memory_name="test_database_create_table_insert_permission"),
+            name="data",
+        )
+        await db.execute_write_script("""
+            create table items (id integer primary key, name text);
+            """)
+
+        response = await ds.client.get("/data", actor={"id": "root"})
+        assert response.status_code == 200
+        create_table_data = database_data_from_soup(Soup(response.text, "html.parser"))[
+            "createTable"
+        ]
+        assert create_table_data["canInsertRows"] is True
+    finally:
+        ds.close()
+
+
+@pytest.mark.asyncio
+async def test_database_create_table_data_includes_custom_column_types():
+    ds = Datasette(
+        [],
+        config={
+            "databases": {
+                "data": {
+                    "permissions": {
+                        "create-table": {"id": "root"},
+                        "set-column-type": {"id": "root"},
+                    },
+                },
+            },
+        },
+    )
+    try:
+        db = ds.add_database(
+            Database(ds, memory_name="test_database_create_table_custom_types"),
+            name="data",
+        )
+        await db.execute_write_script("""
+            create table items (id integer primary key, name text);
+            """)
+
+        response = await ds.client.get("/data", actor={"id": "root"})
+        assert response.status_code == 200
+        create_table_data = database_data_from_soup(Soup(response.text, "html.parser"))[
+            "createTable"
+        ]
+        assert create_table_data["customColumnTypes"] == [
+            {
+                "name": "email",
+                "description": "Email address",
+                "sqliteTypes": ["text"],
+                "fixedSqliteType": "text",
+            },
+            {
+                "name": "json",
+                "description": "JSON data",
+                "sqliteTypes": ["text"],
+                "fixedSqliteType": "text",
+            },
+            {
+                "name": "textarea",
+                "description": "Multiline text",
+                "sqliteTypes": ["text"],
+                "fixedSqliteType": "text",
+            },
+            {
+                "name": "url",
+                "description": "URL",
+                "sqliteTypes": ["text"],
+                "fixedSqliteType": "text",
+            },
+        ]
+    finally:
+        ds.close()
+
+
+@pytest.mark.asyncio
+async def test_table_alter_action_button_and_data():
+    ds = Datasette(
+        [],
+        config={
+            "databases": {
+                "data": {
+                    "tables": {
+                        "items": {
+                            "permissions": {
+                                "alter-table": {"id": ["root", "alter-only"]},
+                                "set-column-type": {"id": "root"},
+                                "drop-table": {"id": "root"},
+                            },
+                            "column_types": {"name": "textarea"},
+                        },
+                    },
+                },
+            },
+        },
+    )
+    try:
+        db = ds.add_database(
+            Database(ds, memory_name="test_table_alter_action"), name="data"
+        )
+        await db.execute_write_script("""
+            create table items (
+                id integer primary key,
+                name text not null,
+                score integer default 5,
+                created text default current_timestamp,
+                created_ms integer default (CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER))
+            );
+            """)
+        response = await ds.client.get("/data/items", actor={"id": "root"})
+        assert response.status_code == 200
+        soup = Soup(response.text, "html.parser")
+
+        button = soup.select_one(
+            'button.action-menu-button[data-table-action="alter-table"]'
+        )
+        assert button is not None
+        assert button["aria-label"] == "Alter table items"
+        assert button["role"] == "menuitem"
+        description = button.find("span", class_="dropdown-description")
+        assert description.text.strip() == (
+            "Change columns and primary key for this table."
+        )
+        description.extract()
+        assert button.text.strip() == "Alter table"
+        assert any(
+            "edit-tools.js" in script.get("src", "")
+            for script in soup.find_all("script")
+        )
+
+        alter_data = table_data_from_soup(soup)["alterTable"]
+        assert alter_data["path"] == "/data/items/-/alter"
+        assert alter_data["tableName"] == "items"
+        assert alter_data["primaryKeys"] == ["id"]
+        assert alter_data["columnTypes"] == ["text", "integer", "float", "blob"]
+        assert alter_data["foreignKeyTargetsPath"] == (
+            "/data/-/foreign-key-targets?table=items"
+        )
+        assert alter_data["defaultExpressions"] == DEFAULT_EXPRESSION_OPTIONS
+        assert [option["name"] for option in alter_data["customColumnTypes"]] == [
+            "email",
+            "json",
+            "textarea",
+            "url",
+        ]
+        assert alter_data["dropPath"] == "/data/items/-/drop"
+        assert alter_data["columns"] == [
+            {
+                "name": "id",
+                "type": "integer",
+                "sqlite_type": "INTEGER",
+                "notnull": 0,
+                "default": None,
+                "has_default": False,
+                "is_pk": True,
+                "foreign_key": None,
+                "column_type": None,
+            },
+            {
+                "name": "name",
+                "type": "text",
+                "sqlite_type": "TEXT",
+                "notnull": 1,
+                "default": None,
+                "has_default": False,
+                "is_pk": False,
+                "foreign_key": None,
+                "column_type": {"type": "textarea", "config": None},
+            },
+            {
+                "name": "score",
+                "type": "integer",
+                "sqlite_type": "INTEGER",
+                "notnull": 0,
+                "default": "5",
+                "has_default": True,
+                "is_pk": False,
+                "foreign_key": None,
+                "column_type": None,
+            },
+            {
+                "name": "created",
+                "type": "text",
+                "sqlite_type": "TEXT",
+                "notnull": 0,
+                "default": None,
+                "default_expr": "current_timestamp",
+                "has_default": True,
+                "is_pk": False,
+                "foreign_key": None,
+                "column_type": None,
+            },
+            {
+                "name": "created_ms",
+                "type": "integer",
+                "sqlite_type": "INTEGER",
+                "notnull": 0,
+                "default": None,
+                "default_expr": "current_unixtime_ms",
+                "has_default": True,
+                "is_pk": False,
+                "foreign_key": None,
+                "column_type": None,
+            },
+        ]
+
+        response_without_permission = await ds.client.get(
+            "/data/items", actor={"id": "someone-else"}
+        )
+        assert response_without_permission.status_code == 200
+        soup_without_permission = Soup(response_without_permission.text, "html.parser")
+        assert (
+            soup_without_permission.select_one(
+                'button[data-table-action="alter-table"]'
+            )
+            is None
+        )
+        assert "alterTable" not in table_data_from_soup(soup_without_permission)
+
+        # An actor that can alter but not drop should not get a dropPath
+        response_alter_only = await ds.client.get(
+            "/data/items", actor={"id": "alter-only"}
+        )
+        assert response_alter_only.status_code == 200
+        alter_only_data = table_data_from_soup(
+            Soup(response_alter_only.text, "html.parser")
+        )["alterTable"]
+        assert "dropPath" not in alter_only_data
+    finally:
+        ds.close()
+
+
 @pytest.mark.asyncio
 async def test_table_insert_action_button_and_data():
     ds = Datasette(
@@ -984,6 +1352,7 @@ async def test_table_insert_action_button_and_data():
         assert insert_data["path"] == "/data/items/-/insert"
         assert insert_data["tableName"] == "items"
         assert insert_data["primaryKeys"] == ["id"]
+        assert insert_data["maxInsertRows"] == 100
         assert [column["name"] for column in insert_data["columns"]] == [
             "name",
             "score",
@@ -1297,9 +1666,9 @@ async def test_row_update_sets_message():
             json={"update": {"name": long_name}, "return": True},
         )
         assert response.status_code == 200
-        assert response.json()["row"]["name"] == long_name
+        assert response.json()["rows"][0]["name"] == long_name
         assert ds.unsign(response.cookies["ds_messages"], "messages") == [
-            ["Updated row 1 ({})".format(truncated_name), ds.INFO]
+            [f"Updated row 1 ({truncated_name})", ds.INFO]
         ]
     finally:
         ds.close()
@@ -1312,9 +1681,9 @@ def test_table_data_uses_base_url(app_client_base_url_prefix):
     import re
 
     soup = Soup(response.text, "html.parser")
-    table_script = [
+    table_script = next(
         s for s in soup.find_all("script") if "_datasetteTableData" in (s.string or "")
-    ][0]
+    )
     match = re.search(
         r"window\._datasetteTableData\s*=\s*({.*?});",
         table_script.string,
@@ -1342,16 +1711,17 @@ def test_table_fragment_custom_table_include():
 
 @pytest.mark.asyncio
 async def test_table_fragment_uses_render_cell_hook():
-    from datasette import hookimpl
     from markupsafe import Markup
 
+    from datasette import hookimpl
+
     class TestRenderCellPlugin:
         __name__ = "TestRenderCellPlugin"
 
         @hookimpl
         def render_cell(self, value, column, table, database):
             if database == "data" and table == "items" and column == "name":
-                return Markup("<strong>{}</strong>".format(value))
+                return Markup(f"<strong>{value}</strong>")
             return None
 
     ds = Datasette(memory=True)
@@ -1647,8 +2017,8 @@ async def test_sort_errors(ds_client, json, params, error):
         assert response.json() == {
             "ok": False,
             "error": error,
+            "errors": [error],
             "status": 400,
-            "title": None,
         }
     else:
         assert error in response.text
@@ -1890,18 +2260,16 @@ def test_allow_facet_off(allow_facet):
 )
 async def test_format_of_binary_links(size, title, length_bytes):
     ds = Datasette()
-    db_name = "binary-links-{}".format(size)
+    db_name = f"binary-links-{size}"
     db = ds.add_memory_database(db_name)
-    sql = "select zeroblob({}) as blob".format(size)
-    await db.execute_write("create table blobs as {}".format(sql))
-    response = await ds.client.get("/{}/blobs".format(db_name))
+    sql = f"select zeroblob({size}) as blob"
+    await db.execute_write(f"create table blobs as {sql}")
+    response = await ds.client.get(f"/{db_name}/blobs")
     assert response.status_code == 200
-    expected = "{}>&lt;Binary:&nbsp;{}&nbsp;bytes&gt;</a>".format(title, length_bytes)
+    expected = f"{title}>&lt;Binary:&nbsp;{length_bytes}&nbsp;bytes&gt;</a>"
     assert expected in response.text
     # And test with arbitrary SQL query too
-    sql_response = await ds.client.get(
-        "{}/-/query".format(db_name), params={"sql": sql}
-    )
+    sql_response = await ds.client.get(f"{db_name}/-/query", params={"sql": sql})
     assert sql_response.status_code == 200
     assert expected in sql_response.text
 
@@ -1981,6 +2349,7 @@ async def test_foreign_key_labels_obey_permissions(config):
     assert root_b.json() == {
         "ok": True,
         "next": None,
+        "next_url": None,
         "rows": [{"id": 1, "name": "world", "a_id": {"value": 1, "label": "hello"}}],
         "truncated": False,
     }
@@ -1988,6 +2357,7 @@ async def test_foreign_key_labels_obey_permissions(config):
     assert anon_b.json() == {
         "ok": True,
         "next": None,
+        "next_url": None,
         "rows": [{"id": 1, "name": "world", "a_id": 1}],
         "truncated": False,
     }
diff --git a/tests/test_template_context.py b/tests/test_template_context.py
new file mode 100644
index 00000000..691c2d64
--- /dev/null
+++ b/tests/test_template_context.py
@@ -0,0 +1,214 @@
+"""
+Tests for the documented template context - the contract that custom
+template authors can rely on for Datasette 1.0.
+"""
+
+import html
+import json
+import pathlib
+from dataclasses import dataclass, field
+
+import pytest
+
+from datasette.app import TEMPLATE_BASE_CONTEXT, Datasette
+from datasette.extras import ExtraScope
+from datasette.fixtures import write_fixture_database
+from datasette.template_contexts import PAGES, documented_context_keys
+from datasette.views import Context
+
+
+def test_documented_fields():
+    @dataclass
+    class DemoNested:
+        name: str
+
+    @dataclass
+    class DemoContext(Context):
+        name: str = field(metadata={"help": "The name"})
+        _internal: str = field()
+        count: int = field(metadata={"help": "How many there are"})
+        items: list[DemoNested] = field(metadata={"help": "Nested items"})
+
+    fields = DemoContext.documented_fields()
+    assert [(f.name, f.type_name, f.help) for f in fields] == [
+        ("name", "str", "The name"),
+        ("count", "int", "How many there are"),
+        ("items", "list[DemoNested]", "Nested items"),
+    ]
+
+
+@pytest.mark.parametrize("klass", PAGES.values(), ids=lambda klass: klass.__name__)
+def test_context_class_fields_all_have_help(klass):
+    for context_field in klass.documented_fields():
+        assert (
+            context_field.help
+        ), f"{klass.__name__}.{context_field.name} is missing documentation"
+
+
+@pytest.mark.parametrize("klass", PAGES.values(), ids=lambda klass: klass.__name__)
+def test_context_class_has_docstring_and_documented_template(klass):
+    assert klass.__doc__, f"{klass.__name__} is missing a docstring"
+    assert (
+        klass.documented_template
+    ), f"{klass.__name__} is missing a documented_template"
+
+
+def test_from_extra_documentation_comes_from_the_extra_class():
+    from datasette.views import from_extra
+    from datasette.views.table_extras import CountExtra
+
+    @dataclass
+    class DemoContext(Context):
+        extras_scope = ExtraScope.TABLE
+
+        count: int = from_extra()
+        name: str = field(metadata={"help": "The name"})
+
+    fields = {f.name: f for f in DemoContext.documented_fields()}
+    assert fields["count"].help == CountExtra.description
+    assert fields["count"].from_extra
+    assert fields["name"].help == "The name"
+    assert not fields["name"].from_extra
+
+
+def test_from_extra_must_match_a_registered_extra():
+    from datasette.views import from_extra
+
+    @dataclass
+    class BadContext(Context):
+        extras_scope = ExtraScope.TABLE
+
+        not_a_real_extra: str = from_extra()
+
+    with pytest.raises(KeyError):
+        BadContext.documented_fields()
+
+
+def test_from_extra_must_be_available_for_the_scope():
+    from datasette.views import from_extra
+
+    @dataclass
+    class WrongScopeContext(Context):
+        extras_scope = ExtraScope.ROW
+
+        # count is a TABLE-scope extra, not available for ROW
+        count: int = from_extra()
+
+    with pytest.raises(ValueError):
+        WrongScopeContext.documented_fields()
+
+
+@pytest.fixture
+def isolate_extra_template_vars_plugins():
+    # Datasette instances created with plugins_dir (e.g. the session-scoped
+    # ds_client fixture) register their plugins on the global plugin manager
+    # for the rest of the process. The contract documents plugin-free
+    # Datasette core, so unregister any non-default plugin that adds
+    # template variables via the extra_template_vars hook
+    from datasette.plugins import DEFAULT_PLUGINS, pm
+
+    hook_plugins = {impl.plugin for impl in pm.hook.extra_template_vars.get_hookimpls()}
+    removed = []
+    for plugin in list(pm.get_plugins()):
+        name = pm.get_name(plugin)
+        if name not in DEFAULT_PLUGINS and plugin in hook_plugins:
+            pm.unregister(plugin)
+            removed.append((plugin, name))
+    yield
+    for plugin, name in removed:
+        pm.register(plugin, name)
+
+
+@pytest.fixture(scope="module")
+def context_ds(tmp_path_factory):
+    db_path = tmp_path_factory.mktemp("template-context") / "fixtures.db"
+    write_fixture_database(db_path)
+    ds = Datasette(
+        [str(db_path)],
+        settings={"num_sql_threads": 1, "template_debug": True},
+        config={
+            "databases": {
+                "fixtures": {
+                    "queries": {
+                        "neighborhood_search": {
+                            "sql": (
+                                "select _neighborhood from facetable "
+                                "where _neighborhood like '%' || :text || '%'"
+                            ),
+                            "title": "Search neighborhoods",
+                        }
+                    }
+                }
+            }
+        },
+    )
+    yield ds
+    for db in ds.databases.values():
+        if not db.is_memory:
+            db.close()
+
+
+async def get_template_context(ds, path):
+    sep = "&" if "?" in path else "?"
+    response = await ds.client.get(path + sep + "_context=1")
+    assert response.status_code == 200, path
+    body = html.unescape(response.text.removeprefix("<pre>").removesuffix("</pre>"))
+    return json.loads(body)
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "page_name,path",
+    (
+        ("database", "/fixtures"),
+        ("table", "/fixtures/facetable"),
+        ("table", "/fixtures/facetable?_city_id__exact=1"),
+        ("row", "/fixtures/facetable/1"),
+        ("query", "/fixtures/-/query?sql=select+*+from+facetable"),
+        ("query", "/fixtures/neighborhood_search?text=cork"),
+    ),
+)
+async def test_template_context_matches_documented_contract(
+    context_ds, isolate_extra_template_vars_plugins, page_name, path
+):
+    # The full contract: every key in the rendered template context is
+    # documented, and every documented key is present in the context
+    documented = documented_context_keys(page_name)
+    actual = {
+        key
+        for key in await get_template_context(context_ds, path)
+        if not key.startswith("_")
+    }
+    undocumented = actual - documented
+    no_longer_present = documented - actual
+    assert not undocumented, (
+        f"Undocumented keys in {page_name} template context: {sorted(undocumented)} - add them to the "
+        "page's Context class"
+    )
+    assert not no_longer_present, (
+        f"Documented keys missing from {page_name} template context: {sorted(no_longer_present)} - this would "
+        "break custom templates"
+    )
+
+
+def test_base_context_keys_all_have_docs():
+    for name, doc in TEMPLATE_BASE_CONTEXT.items():
+        assert doc, f"Base context key {name} is missing docs"
+
+
+def test_template_context_docs_cover_every_documented_key():
+    docs_path = pathlib.Path(__file__).parent.parent / "docs" / "template_context.rst"
+    assert docs_path.exists(), "docs/template_context.rst is missing"
+    docs = docs_path.read_text()
+    for name in TEMPLATE_BASE_CONTEXT:
+        assert f"``{name}``" in docs, name
+    for page_name, klass in PAGES.items():
+        title = "{} page".format(klass.__name__.removesuffix("Context"))
+        assert title in docs, title
+        for context_field in klass.documented_fields():
+            assert (
+                f"``{context_field.name}``" in docs
+            ), f"{context_field.name} ({page_name} page)"
+            assert (
+                f"``{context_field.name}`` - ``{context_field.type_name}``" in docs
+            ), f"{context_field.name} type ({page_name} page)"
diff --git a/tests/test_token_handler.py b/tests/test_token_handler.py
index 5c87f577..10021ddf 100644
--- a/tests/test_token_handler.py
+++ b/tests/test_token_handler.py
@@ -2,11 +2,17 @@
 Tests for the register_token_handler plugin hook.
 """
 
+import pytest
+
 from datasette.app import Datasette
 from datasette.hookspecs import hookimpl
 from datasette.plugins import pm
-from datasette.tokens import TokenHandler, TokenRestrictions, SignedTokenHandler
-import pytest
+from datasette.tokens import (
+    SignedTokenHandler,
+    TokenHandler,
+    TokenInvalid,
+    TokenRestrictions,
+)
 
 
 @pytest.fixture
@@ -66,10 +72,10 @@ async def test_verify_token_unknown_returns_none(datasette):
 
 
 @pytest.mark.asyncio
-async def test_verify_token_bad_signature_returns_none(datasette):
-    """verify_token() should return None for tokens with bad signatures."""
-    result = await datasette.verify_token("dstok_tampered_data_here")
-    assert result is None
+async def test_verify_token_bad_signature_raises(datasette):
+    """verify_token() should raise TokenInvalid for tokens with bad signatures."""
+    with pytest.raises(TokenInvalid):
+        await datasette.verify_token("dstok_tampered_data_here")
 
 
 @pytest.mark.asyncio
@@ -334,5 +340,6 @@ async def test_signed_tokens_disabled():
     ds = Datasette(settings={"allow_signed_tokens": False})
     with pytest.raises(ValueError, match="Signed tokens are not enabled"):
         await ds.create_token("test_actor", handler="signed")
-    # verify_token should return None rather than raising
-    assert await ds.verify_token("dstok_anything") is None
+    # verify_token should raise TokenInvalid for a dstok_ token
+    with pytest.raises(TokenInvalid, match="not enabled"):
+        await ds.verify_token("dstok_anything")
diff --git a/tests/test_tracer.py b/tests/test_tracer.py
index 9db211d3..21cfa952 100644
--- a/tests/test_tracer.py
+++ b/tests/test_tracer.py
@@ -1,4 +1,5 @@
 import pytest
+
 from .fixtures import make_app_client
 
 
@@ -75,10 +76,9 @@ async def test_trace_child_tasks_resets_contextvar_on_exception():
     from datasette import tracer
 
     before = tracer.trace_task_id.get()
-    with pytest.raises(ValueError):
-        with tracer.trace_child_tasks():
-            assert tracer.trace_task_id.get() is not None
-            raise ValueError("simulated error")
+    with pytest.raises(ValueError), tracer.trace_child_tasks():
+        assert tracer.trace_task_id.get() is not None
+        raise ValueError("simulated error")
     # The contextvar must be reset even though the block raised
     assert tracer.trace_task_id.get() == before
 
diff --git a/tests/test_utils.py b/tests/test_utils.py
index 74f1963f..1808b3cf 100644
--- a/tests/test_utils.py
+++ b/tests/test_utils.py
@@ -2,8 +2,17 @@
 Tests for various datasette helper functions.
 """
 
-from datasette.app import Datasette
+import hashlib
+import json
+import os
+import pathlib
+import tempfile
+from unittest.mock import patch
+
+import pytest
+
 from datasette import utils
+from datasette.app import Datasette
 from datasette.utils.asgi import Request
 from datasette.utils.sqlite import (
     sqlite3,
@@ -11,12 +20,6 @@ from datasette.utils.sqlite import (
     sqlite_table_type,
     supports_returning,
 )
-import json
-import os
-import pathlib
-import pytest
-import tempfile
-from unittest.mock import patch
 
 
 @pytest.mark.parametrize(
@@ -131,7 +134,11 @@ def test_path_from_row_pks(row, pks, expected_path):
             """
         {"CategoryID": 1, "Description": "Soft drinks", "Picture": {"$base64": true, "encoded": "FRwCx60F/g=="}}
     """.strip(),
-        )
+        ),
+        (
+            {"message": b"hello"},
+            '{"message": {"$base64": true, "encoded": "aGVsbG8="}}',
+        ),
     ],
 )
 def test_custom_json_encoder(obj, expected):
@@ -189,7 +196,7 @@ def test_validate_sql_select_good(good_sql):
 
 @pytest.mark.parametrize("open_quote,close_quote", [('"', '"'), ("[", "]")])
 def test_detect_fts(open_quote, close_quote):
-    sql = """
+    sql = f"""
     CREATE TABLE "Dumb_Table" (
       "TreeID" INTEGER,
       "qSpecies" TEXT
@@ -204,9 +211,9 @@ def test_detect_fts(open_quote, close_quote):
       "qCaretaker" TEXT
     );
     CREATE VIEW Test_View AS SELECT * FROM Dumb_Table;
-    CREATE VIRTUAL TABLE {open}Street_Tree_List_fts{close} USING FTS4 ("qAddress", "qCaretaker", "qSpecies", content={open}Street_Tree_List{close});
+    CREATE VIRTUAL TABLE {open_quote}Street_Tree_List_fts{close_quote} USING FTS4 ("qAddress", "qCaretaker", "qSpecies", content={open_quote}Street_Tree_List{close_quote});
     CREATE VIRTUAL TABLE r USING rtree(a, b, c);
-    """.format(open=open_quote, close=close_quote)
+    """
     conn = utils.sqlite3.connect(":memory:")
     conn.executescript(sql)
     assert None is utils.detect_fts(conn, "Dumb_Table")
@@ -220,11 +227,10 @@ def test_detect_fts(open_quote, close_quote):
     "identifier,expected",
     (
         ("plain", "plain"),
-        ("select", "[select]"),
-        ("has space", "[has space]"),
-        ("has'quote", "[has'quote]"),
-        # Identifiers containing ] must fall back to double-quote quoting
-        # (SQLite does not support escaping ] inside [brackets]) - #2677
+        ("select", '"select"'),
+        ("has space", '"has space"'),
+        ("has'quote", '"has\'quote"'),
+        ('has"dquote', '"has""dquote"'),
         ("has]bracket", '"has]bracket"'),
         ('has"dquote]', '"has""dquote]"'),
     ),
@@ -233,14 +239,33 @@ def test_escape_sqlite(identifier, expected):
     assert utils.escape_sqlite(identifier) == expected
 
 
+def test_escape_sqlite_double_quotes_work_in_query():
+    conn = utils.sqlite3.connect(":memory:")
+    table = 'table with "double quotes"'
+    column = "select"
+    escaped_table = utils.escape_sqlite(table)
+    escaped_column = utils.escape_sqlite(column)
+    conn.execute(f"CREATE TABLE {escaped_table} ({escaped_column} TEXT)")
+    create_sql = conn.execute(
+        "SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?", (table,)
+    ).fetchone()[0]
+    assert create_sql == 'CREATE TABLE "table with ""double quotes""" ("select" TEXT)'
+    conn.execute(
+        f"INSERT INTO {escaped_table} ({escaped_column}) VALUES (?)", ("hello",)
+    )
+    results = conn.execute(f"SELECT {escaped_column} FROM {escaped_table}").fetchall()
+    conn.close()
+    assert results == [("hello",)]
+
+
 def test_escape_sqlite_prevents_injection():
     # https://github.com/simonw/datasette/issues/2677
     conn = utils.sqlite3.connect(":memory:")
     conn.execute("CREATE TABLE users (id INTEGER, password TEXT)")
     conn.execute("INSERT INTO users VALUES (1, 'super_secret_password')")
     malicious = "users] UNION SELECT password FROM users--"
-    conn.execute('CREATE TABLE "{}" (id INTEGER)'.format(malicious))
-    sql = "select count(*) from {}".format(utils.escape_sqlite(malicious))
+    conn.execute(f'CREATE TABLE "{malicious}" (id INTEGER)')
+    sql = f"select count(*) from {utils.escape_sqlite(malicious)}"
     results = conn.execute(sql).fetchall()
     conn.close()
     # The injected UNION must not execute - only the empty malicious table
@@ -250,16 +275,16 @@ def test_escape_sqlite_prevents_injection():
 
 @pytest.mark.parametrize("table", ("regular", "has'single quote"))
 def test_detect_fts_different_table_names(table):
-    sql = """
+    sql = f"""
     CREATE TABLE [{table}] (
       "TreeID" INTEGER,
       "qSpecies" TEXT
     );
     CREATE VIRTUAL TABLE [{table}_fts] USING FTS4 ("qSpecies", content="{table}");
-    """.format(table=table)
+    """
     conn = utils.sqlite3.connect(":memory:")
     conn.executescript(sql)
-    assert "{table}_fts".format(table=table) == utils.detect_fts(conn, table)
+    assert f"{table}_fts" == utils.detect_fts(conn, table)
     conn.close()
 
 
@@ -667,7 +692,6 @@ def test_resolve_env_secrets(config, expected):
     [
         ({"id": "blah"}, "blah"),
         ({"id": "blah", "login": "l"}, "l"),
-        ({"id": "blah", "login": "l"}, "l"),
         ({"id": "blah", "login": "l", "username": "u"}, "u"),
         ({"login": "l", "name": "n"}, "n"),
         (
@@ -733,6 +757,21 @@ def test_parse_metadata(content, expected):
         ("select 1 + :one + :two", ["one", "two"]),
         ("select 'bob' || '0:00' || :cat", ["cat"]),
         ("select this is invalid :one, :two, :three", ["one", "two", "three"]),
+        # A string literal containing a comment marker should not hide
+        # parameters that come after it
+        ("select * from t where note = '-- TODO' and id = :id", ["id"]),
+        ("select '--' || :y", ["y"]),
+        ("select * from t where note = '/* x */' and id = :id", ["id"]),
+        # Parameters that live inside a comment should be ignored
+        ("select :x -- and :ignored", ["x"]),
+        ("select :x /* and :ignored */ from t", ["x"]),
+        ("select :x /* and :ignored", ["x"]),
+        # Parameters inside quoted identifiers should be ignored
+        ("select [a:b] from t where id = :id", ["id"]),
+        ("select `a:b` from t where id = :id", ["id"]),
+        ("select `a``:b` from t where id = :id", ["id"]),
+        # Parameters inside a string literal should be ignored
+        ("select ':ignored' || :real", ["real"]),
     ),
 )
 @pytest.mark.parametrize("use_async_version", (False, True))
@@ -835,6 +874,12 @@ def test_pairs_to_nested_config(pairs, expected):
     assert actual == expected
 
 
+def test_sha256_file(tmp_path):
+    path = tmp_path / "test.txt"
+    path.write_text("hello")
+    assert utils.sha256_file(path, chunk_size=2) == hashlib.sha256(b"hello").hexdigest()
+
+
 @pytest.mark.asyncio
 async def test_calculate_etag(tmp_path):
     path = tmp_path / "test.txt"
diff --git a/tests/test_utils_check_callable.py b/tests/test_utils_check_callable.py
index 4f72f9ff..857b73cd 100644
--- a/tests/test_utils_check_callable.py
+++ b/tests/test_utils_check_callable.py
@@ -1,6 +1,7 @@
-from datasette.utils.check_callable import check_callable
 import pytest
 
+from datasette.utils.check_callable import check_callable
+
 
 class AsyncClass:
     async def __call__(self):
diff --git a/tests/test_utils_permissions.py b/tests/test_utils_permissions.py
index bc3599c2..918dab95 100644
--- a/tests/test_utils_permissions.py
+++ b/tests/test_utils_permissions.py
@@ -1,14 +1,17 @@
+from collections.abc import Callable
+
 import pytest
+
 from datasette.app import Datasette
 from datasette.permissions import PermissionSQL
 from datasette.utils.permissions import resolve_permissions_from_catalog
-from typing import Callable, List
 
 
 @pytest.fixture
 def db():
     ds = Datasette()
     import tempfile
+
     from datasette.database import Database
 
     path = tempfile.mktemp(suffix="demo.db")
@@ -127,7 +130,7 @@ def plugin_root_deny_for_all() -> Callable[[str], PermissionSQL]:
 
 def plugin_conflicting_same_child_rules(
     user: str, parent: str, child: str
-) -> List[Callable[[str], PermissionSQL]]:
+) -> list[Callable[[str], PermissionSQL]]:
     def allow_provider(action: str) -> PermissionSQL:
         return PermissionSQL(
             """
@@ -277,9 +280,7 @@ async def test_alice_global_allow_with_specific_denies_catalog(db):
     # Alice can see everything except accounting/sales and hr/*
     assert "/accounting/sales" in res_denied(rows)
     for r in rows:
-        if r["parent"] == "hr":
-            assert r["allow"] == 0
-        elif r["resource"] == "/accounting/sales":
+        if r["parent"] == "hr" or r["resource"] == "/accounting/sales":
             assert r["allow"] == 0
         else:
             assert r["allow"] == 1
diff --git a/tests/test_utils_sql_analysis.py b/tests/test_utils_sql_analysis.py
index 979ff9e1..a6f95e5b 100644
--- a/tests/test_utils_sql_analysis.py
+++ b/tests/test_utils_sql_analysis.py
@@ -1,7 +1,7 @@
 import pytest
 
-from datasette.utils.sqlite import sqlite3
 from datasette.utils.sql_analysis import analyze_sql_tables
+from datasette.utils.sqlite import sqlite3
 
 
 @pytest.fixture
diff --git a/tests/test_write_wrapper.py b/tests/test_write_wrapper.py
index 88ce5520..66599c54 100644
--- a/tests/test_write_wrapper.py
+++ b/tests/test_write_wrapper.py
@@ -3,14 +3,16 @@ Tests for the write_wrapper plugin hook.
 """
 
 import asyncio
+import sqlite3
+import time
 from dataclasses import dataclass
+
+import pytest
+
 from datasette.app import Datasette
 from datasette.events import Event
 from datasette.hookspecs import hookimpl
 from datasette.plugins import pm
-import pytest
-import sqlite3
-import time
 
 
 @dataclass
@@ -113,7 +115,8 @@ async def test_write_wrapper_exception_thrown_into_generator(datasette):
             def wrapper(conn):
                 try:
                     yield
-                except Exception as e:
+                except Exception as e:  # noqa: BLE001
+                    # Test helper deliberately captures whatever the wrapped write raised
                     caught["error"] = e
 
             return wrapper
@@ -232,7 +235,6 @@ async def test_write_wrapper_return_none_skips(datasette):
         @hookimpl
         def write_wrapper(datasette, database, request, transaction):
             log.append("hook-called")
-            return None
 
     pm.register(Plugin(), name="test_skip")
     try:
@@ -339,7 +341,7 @@ async def test_write_wrapper_via_api(tmp_path):
             "/test/api_test/-/insert",
             json={"row": {"name": "test"}, "return": True},
             headers={
-                "Authorization": "Bearer {}".format(token),
+                "Authorization": f"Bearer {token}",
                 "Content-Type": "application/json",
             },
         )
@@ -466,7 +468,7 @@ async def test_write_wrapper_set_authorizer(datasette, actor, table, should_deny
     try:
         request = FakeRequest(actor)
         if should_deny:
-            with pytest.raises(Exception):
+            with pytest.raises(sqlite3.DatabaseError, match="not authorized"):
                 await db.execute_write_fn(
                     lambda conn: conn.execute(
                         f"insert into {table} (value) values ('test')"