@@ -18,12 +18,10 @@ import { TokenServiceAccountValidationError } from '@/lib/credentials/token-serv
 
 const {
   mockCheckWorkspaceAccess,
-  mockGetCredentialActorContext,
   mockGetCredentialCreationWorkspaceContext,
   mockVerifyAndBuildServiceAccountSecret,
 } = vi.hoisted(() => ({
   mockCheckWorkspaceAccess: vi.fn(),
-  mockGetCredentialActorContext: vi.fn(),
   mockGetCredentialCreationWorkspaceContext: vi.fn(),
   mockVerifyAndBuildServiceAccountSecret: vi.fn(),
 }))
@@ -43,10 +41,6 @@ vi.mock('@/lib/credentials/oauth', () => ({
   syncWorkspaceOAuthCredentialsForUser: vi.fn(),
 }))
 
-vi.mock('@/lib/credentials/access', () => ({
-  getCredentialActorContext: mockGetCredentialActorContext,
-}))
-
 vi.mock('@/lib/oauth', () => ({
   getServiceConfigByProviderId: vi.fn(),
 }))
@@ -138,15 +132,9 @@ describe('POST /api/credentials', () => {
       memberUserIds: ['user-1'],
       canWrite: true,
     })
-    mockGetCredentialActorContext.mockResolvedValue({
-      member: null,
-      hasWorkspaceAccess: true,
-      canWriteWorkspace: true,
-      isAdmin: true,
-    })
   })
 
-  describe('service-account credentials', () => {
+  describe('client-credential service accounts', () => {
     it('forwards clientId, clientSecret, and orgId to the secret builder on create', async () => {
       mockVerifyAndBuildServiceAccountSecret.mockResolvedValueOnce({
         providerId: 'zoom-service-account',
@@ -252,136 +240,6 @@ describe('POST /api/credentials', () => {
       )
     })
 
-    it.each([
-      {
-        family: 'client-credential',
-        providerId: 'zoom-service-account',
-        fields: {
-          orgId: 'zoom-account',
-          clientId: 'new-client-id',
-          clientSecret: 'new-client-secret',
-        },
-      },
-      {
-        family: 'token-paste',
-        providerId: 'snowflake-service-account',
-        fields: {
-          domain: 'acme.snowflakecomputing.com',
-          apiToken: 'new-programmatic-access-token',
-        },
-      },
-      {
-        family: 'Google JSON-key',
-        providerId: 'google-service-account',
-        fields: {
-          serviceAccountJson: JSON.stringify({
-            type: 'service_account',
-            client_email: 'automation@example.iam.gserviceaccount.com',
-            private_key: 'new-private-key',
-            project_id: 'example-project',
-          }),
-        },
-      },
-      {
-        family: 'Atlassian',
-        providerId: 'atlassian-service-account',
-        fields: { domain: 'example.atlassian.net', apiToken: 'new-atlassian-token' },
-      },
-      {
-        family: 'Slack different-ID',
-        providerId: 'slack-custom-bot',
-        fields: {
-          id: '33333333-4444-4555-8666-777777777777',
-          signingSecret: 'new-slack-signing-secret',
-          botToken: 'xoxb-new-slack-bot-token',
-        },
-      },
-    ])(
-      'conflicts for an existing $family service account instead of dropping new secrets',
-      async ({ providerId, fields }) => {
-        const displayName = 'Production automation'
-        mockVerifyAndBuildServiceAccountSecret.mockResolvedValueOnce({
-          providerId,
-          encryptedServiceAccountKey: 'new-secret-ciphertext',
-          displayName,
-          auditMetadata: {},
-          principal: null,
-        })
-        queueTableRows(credential, [
-          {
-            id: 'existing-credential',
-            workspaceId: WORKSPACE_ID,
-            type: 'service_account',
-            displayName,
-            providerId,
-          },
-        ])
-
-        const response = await POST(
-          createMockRequest('POST', {
-            workspaceId: WORKSPACE_ID,
-            type: 'service_account',
-            providerId,
-            displayName,
-            ...fields,
-          })
-        )
-        const body = await response.json()
-
-        expect(response.status).toBe(409)
-        expect(body.code).toBe('duplicate_display_name')
-        expect(dbChainMockFns.update).not.toHaveBeenCalled()
-        expect(dbChainMockFns.insert).not.toHaveBeenCalled()
-      }
-    )
-
-    it('preserves an exact-ID Slack custom-bot create replay', async () => {
-      const credentialId = '22222222-3333-4444-8555-666666666666'
-      const existing = {
-        id: credentialId,
-        workspaceId: WORKSPACE_ID,
-        type: 'service_account',
-        displayName: 'Production Slack Bot',
-        description: null,
-        providerId: 'slack-custom-bot',
-        accountId: null,
-        envKey: null,
-        envOwnerUserId: null,
-        encryptedServiceAccountKey: 'existing-secret-ciphertext',
-        createdBy: 'user-1',
-        createdAt: new Date('2026-08-11T00:00:00.000Z'),
-        updatedAt: new Date('2026-08-11T00:00:00.000Z'),
-      }
-      mockVerifyAndBuildServiceAccountSecret.mockResolvedValueOnce({
-        providerId: 'slack-custom-bot',
-        encryptedServiceAccountKey: 'replayed-secret-ciphertext',
-        displayName: existing.displayName,
-        auditMetadata: {},
-        principal: null,
-      })
-      queueTableRows(credential, [existing])
-
-      const response = await POST(
-        createMockRequest('POST', {
-          id: credentialId,
-          workspaceId: WORKSPACE_ID,
-          type: 'service_account',
-          providerId: 'slack-custom-bot',
-          displayName: existing.displayName,
-          signingSecret: 'slack-signing-secret',
-          botToken: 'xoxb-slack-bot-token',
-        })
-      )
-
-      const body = await response.json()
-      expect({ status: response.status, body }).toMatchObject({
-        status: 200,
-        body: { credential: { id: credentialId } },
-      })
-      expect(dbChainMockFns.update).not.toHaveBeenCalled()
-      expect(dbChainMockFns.insert).not.toHaveBeenCalled()
-    })
-
     it('maps a verification failure to a 400 with the validation code', async () => {
       mockVerifyAndBuildServiceAccountSecret.mockRejectedValueOnce(
         new TokenServiceAccountValidationError('invalid_credentials', 400, {
 
@@ -2,7 +2,6 @@
 
 import { useEffect, useRef } from 'react'
 import { Tooltip } from '@sim/emcn'
-import type { CanonicalModeOverrides } from '@/lib/workflows/subblocks/visibility'
 import { SelectorCombobox } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/selector-combobox/selector-combobox'
 import { useSelectorSetup } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-selector-setup'
 import { useSubBlockValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-sub-block-value'
@@ -22,7 +21,6 @@ interface SelectorInputProps {
   isPreview?: boolean
   previewValue?: any
   previewContextValues?: Record<string, any>
-  canonicalModeOverrides?: CanonicalModeOverrides
   overrides?: SelectorOverrides
 }
 
@@ -33,7 +31,6 @@ export function SelectorInput({
   isPreview = false,
   previewValue,
   previewContextValues,
-  canonicalModeOverrides,
   overrides,
 }: SelectorInputProps) {
   const { collaborativeSetSubblockValue } = useCollaborativeWorkflow()
@@ -46,12 +43,7 @@ export function SelectorInput({
     allowSearch,
     disabled: selectorDisabled,
     dependencyValues,
-  } = useSelectorSetup(blockId, subBlock, {
-    disabled,
-    isPreview,
-    previewContextValues,
-    canonicalModeOverrides,
-  })
+  } = useSelectorSetup(blockId, subBlock, { disabled, isPreview, previewContextValues })
 
   const selectorContext = overrides?.transformContext
     ? overrides.transformContext(autoContext, dependencyValues)
 
@@ -1,7 +1,6 @@
 'use client'
 
 import { useCallback, useEffect, useRef } from 'react'
-import type { CanonicalModeOverrides } from '@/lib/workflows/subblocks/visibility'
 import {
   buildToolSubBlockId,
   resolveToolParamSync,
@@ -24,7 +23,6 @@ interface ToolSubBlockRendererProps {
   toolParams: Record<string, string> | undefined
   onParamChange: (toolIndex: number, paramId: string, value: string) => void
   disabled: boolean
-  canonicalModeOverrides?: CanonicalModeOverrides
   canonicalToggle?: {
     mode: 'basic' | 'advanced'
     disabled?: boolean
@@ -63,7 +61,6 @@ export function ToolSubBlockRenderer({
   toolParams,
   onParamChange,
   disabled,
-  canonicalModeOverrides,
   canonicalToggle,
 }: ToolSubBlockRendererProps) {
   const syntheticId = buildToolSubBlockId(subBlockId, toolIndex, effectiveParamId)
@@ -143,7 +140,6 @@ export function ToolSubBlockRenderer({
         disabled={disabled}
         canonicalToggle={canonicalToggle}
         dependencyContext={toolParams}
-        canonicalModeOverrides={canonicalModeOverrides}
       />
     </DependencyBlockTypeProvider>
   )
 
@@ -2151,7 +2151,6 @@ export const ToolInput = memo(function ToolInput({
                             toolParams={tool.params}
                             onParamChange={handleParamChange}
                             disabled={disabled}
-                            canonicalModeOverrides={toolScopedOverrides}
                             canonicalToggle={canonicalToggleProp}
                           />
                         </ActiveSearchTargetProvider>
 
@@ -5,11 +5,9 @@ import { isEqual } from 'es-toolkit'
 import { useStoreWithEqualityFn } from 'zustand/traditional'
 import {
   buildCanonicalIndex,
-  type CanonicalModeOverrides,
   isNonEmptyValue,
   normalizeDependencyValue,
   parseDependsOn,
-  resolveActiveDependencyValue,
   resolveDependencyValue,
 } from '@/lib/workflows/subblocks/visibility'
 import { getBlock } from '@/blocks/registry'
@@ -28,18 +26,11 @@ import { useDependencyBlockType } from './use-dependency-block-type'
 export function useDependsOnGate(
   blockId: string,
   subBlock: SubBlockConfig,
-  opts?: {
-    disabled?: boolean
-    isPreview?: boolean
-    previewContextValues?: Record<string, any>
-    canonicalModeOverrides?: CanonicalModeOverrides
-    strictCanonicalDependencies?: boolean
-  }
+  opts?: { disabled?: boolean; isPreview?: boolean; previewContextValues?: Record<string, any> }
 ) {
   const disabledProp = opts?.disabled ?? false
   const isPreview = opts?.isPreview ?? false
   const previewContextValues = opts?.previewContextValues
-  const strictCanonicalDependencies = opts?.strictCanonicalDependencies ?? false
 
   const activeWorkflowId = useWorkflowRegistry((s) => s.activeWorkflowId)
   const blockState = useWorkflowStore((state) => state.blocks[blockId])
@@ -54,7 +45,7 @@ export function useDependsOnGate(
     () => buildCanonicalIndex(blockConfig?.subBlocks || []),
     [blockConfig?.subBlocks]
   )
-  const canonicalModeOverrides = opts?.canonicalModeOverrides ?? blockState?.data?.canonicalModes
+  const canonicalModeOverrides = blockState?.data?.canonicalModes
 
   // Parse dependsOn config to get all/any field lists
   const { allFields, anyFields, allDependsOnFields } = useMemo(
@@ -69,17 +60,17 @@ export function useDependsOnGate(
     (state: ReturnType<typeof useSubBlockStore.getState>) => {
       if (allDependsOnFields.length === 0) return {} as Record<string, unknown>
 
-      const resolveValue = strictCanonicalDependencies
-        ? resolveActiveDependencyValue
-        : resolveDependencyValue
-
       // If previewContextValues are provided (e.g., tool parameters), use those first
       if (previewContextValues) {
         const map: Record<string, unknown> = {}
         for (const key of allDependsOnFields) {
-          map[key] = normalizeDependencyValue(
-            resolveValue(key, previewContextValues, canonicalIndex, canonicalModeOverrides)
+          const resolvedValue = resolveDependencyValue(
+            key,
+            previewContextValues,
+            canonicalIndex,
+            canonicalModeOverrides
           )
+          map[key] = normalizeDependencyValue(resolvedValue)
         }
         return map
       }
@@ -96,9 +87,13 @@ export function useDependsOnGate(
       const blockValues = (workflowValues as any)[blockId] || {}
       const map: Record<string, unknown> = {}
       for (const key of allDependsOnFields) {
-        map[key] = normalizeDependencyValue(
-          resolveValue(key, blockValues, canonicalIndex, canonicalModeOverrides)
+        const resolvedValue = resolveDependencyValue(
+          key,
+          blockValues,
+          canonicalIndex,
+          canonicalModeOverrides
         )
+        map[key] = normalizeDependencyValue(resolvedValue)
       }
       return map
     },
@@ -109,25 +104,24 @@ export function useDependsOnGate(
       blockId,
       canonicalIndex,
       canonicalModeOverrides,
-      strictCanonicalDependencies,
     ]
   )
 
   // Get values for all dependency fields (both all and any)
   // Use isEqual to prevent re-renders when dependency values haven't actually changed
-  const dependencyValues = useStoreWithEqualityFn(useSubBlockStore, dependencySelector, isEqual)
+  const dependencyValuesMap = useStoreWithEqualityFn(useSubBlockStore, dependencySelector, isEqual)
 
   const depsSatisfied = useMemo(() => {
     // Check all fields (AND logic) - all must be satisfied
     const allSatisfied =
-      allFields.length === 0 || allFields.every((key) => isNonEmptyValue(dependencyValues[key]))
+      allFields.length === 0 || allFields.every((key) => isNonEmptyValue(dependencyValuesMap[key]))
 
     // Check any fields (OR logic) - at least one must be satisfied
     const anySatisfied =
-      anyFields.length === 0 || anyFields.some((key) => isNonEmptyValue(dependencyValues[key]))
+      anyFields.length === 0 || anyFields.some((key) => isNonEmptyValue(dependencyValuesMap[key]))
 
     return allSatisfied && anySatisfied
-  }, [allFields, anyFields, dependencyValues])
+  }, [allFields, anyFields, dependencyValuesMap])
 
   // Block everything except the credential field itself until dependencies are set
   const blocked =
@@ -140,7 +134,7 @@ export function useDependsOnGate(
     depsSatisfied,
     blocked,
     finalDisabled,
-    dependencyValues,
+    dependencyValues: dependencyValuesMap,
     canonicalIndex,
   }
 }