diff --git a/.claude/settings.json b/.claude/settings.json
index 0596b17e91..1ef3704831 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -55,7 +55,10 @@
       "Read(**/*.pem)",
       "Read(**/*.key)",
       "Read(**/credentials.json)",
-      "Read(**/*secret*)",
+      "Read(**/.secret*)",
+      "Read(**/.secrets*)",
+      "Read(**/*.secret)",
+      "Read(**/*.secrets)",
       "Edit(.env)",
       "Edit(.env.*)",
       "Edit(**/.env)",
diff --git a/.github/workflows/codex-pr-review.yml b/.github/workflows/codex-pr-review.yml
index e89a58b629..b4916714f2 100644
--- a/.github/workflows/codex-pr-review.yml
+++ b/.github/workflows/codex-pr-review.yml
@@ -82,10 +82,11 @@ jobs:
           EVENT_TITLE: ${{ github.event.pull_request.title }}
           EVENT_BODY: ${{ github.event.pull_request.body }}
           EVENT_FORK: ${{ github.event.pull_request.head.repo.fork }}
+          EVENT_AUTHOR: ${{ github.event.pull_request.user.login }}
         run: |
           if [ -n "$INPUT_PR_NUMBER" ]; then
             PR_JSON=$(gh pr view "$INPUT_PR_NUMBER" --repo "${{ github.repository }}" \
-              --json number,baseRefName,baseRefOid,headRefOid,title,body,isCrossRepository)
+              --json number,baseRefName,baseRefOid,headRefOid,title,body,isCrossRepository,author)
             PR_NUMBER=$(echo "$PR_JSON" | jq -r '.number')
             BASE_REF=$(echo "$PR_JSON" | jq -r '.baseRefName')
             BASE_SHA=$(echo "$PR_JSON" | jq -r '.baseRefOid')
@@ -93,6 +94,7 @@ jobs:
             PR_TITLE=$(echo "$PR_JSON" | jq -r '.title')
             PR_BODY=$(echo "$PR_JSON" | jq -r '.body // ""')
             IS_FORK=$(echo "$PR_JSON" | jq -r '.isCrossRepository')
+            PR_AUTHOR=$(echo "$PR_JSON" | jq -r '.author.login // ""')
           else
             PR_NUMBER="$EVENT_PR_NUMBER"
             BASE_REF="$EVENT_BASE_REF"
@@ -101,6 +103,7 @@ jobs:
             PR_TITLE="$EVENT_TITLE"
             PR_BODY="$EVENT_BODY"
             IS_FORK="$EVENT_FORK"
+            PR_AUTHOR="$EVENT_AUTHOR"
           fi
           if [ "$IS_FORK" = "true" ]; then
             echo "Skipping Codex review for fork PR."
@@ -113,6 +116,7 @@ jobs:
             echo "base_ref=$BASE_REF"
             echo "base_sha=$BASE_SHA"
             echo "head_sha=$HEAD_SHA"
+            echo "pr_author=$PR_AUTHOR"
             echo 'title<<PR_TITLE_EOF'
             printf '%s\n' "$PR_TITLE"
             echo 'PR_TITLE_EOF'
@@ -211,6 +215,7 @@ jobs:
           PR_HEAD_SHA: ${{ steps.pr.outputs.head_sha }}
           PR_TITLE: ${{ steps.pr.outputs.title }}
           PR_BODY: ${{ steps.pr.outputs.body }}
+          PR_AUTHOR: ${{ steps.pr.outputs.pr_author }}
           EXTRA_PROMPT: ${{ inputs.extra_prompt }}
         run: |
           mkdir -p .github/codex
@@ -219,6 +224,11 @@ jobs:
           const lines = [
             `Repository: ${process.env.PR_REPOSITORY}`,
             `PR number: ${process.env.PR_NUMBER}`,
+          ];
+          if (process.env.PR_AUTHOR) {
+            lines.push(`PR AUTHOR: ${process.env.PR_AUTHOR}`);
+          }
+          lines.push(
             `Base SHA: ${process.env.PR_BASE_SHA}`,
             `Head SHA: ${process.env.PR_HEAD_SHA}`,
             '',
@@ -236,7 +246,7 @@ jobs:
             '',
             'Full review diff command:',
             `git diff --unified=0 ${process.env.PR_BASE_SHA}...${process.env.PR_HEAD_SHA}`
-          ];
+          );
           if (process.env.EXTRA_PROMPT && process.env.EXTRA_PROMPT.trim()) {
             lines.push('', 'Additional reviewer instructions:', process.env.EXTRA_PROMPT.trim());
           }
diff --git a/.github/workflows/pi-pr-review.yml b/.github/workflows/pi-pr-review.yml
index 9c0edc9cb5..9fbe43e9f0 100644
--- a/.github/workflows/pi-pr-review.yml
+++ b/.github/workflows/pi-pr-review.yml
@@ -82,10 +82,11 @@ jobs:
           EVENT_TITLE: ${{ github.event.pull_request.title }}
           EVENT_BODY: ${{ github.event.pull_request.body }}
           EVENT_FORK: ${{ github.event.pull_request.head.repo.fork }}
+          EVENT_AUTHOR: ${{ github.event.pull_request.user.login }}
         run: |
           if [ -n "$INPUT_PR_NUMBER" ]; then
             PR_JSON=$(gh pr view "$INPUT_PR_NUMBER" --repo "${{ github.repository }}" \
-              --json number,baseRefName,baseRefOid,headRefOid,title,body,isCrossRepository)
+              --json number,baseRefName,baseRefOid,headRefOid,title,body,isCrossRepository,author)
             PR_NUMBER=$(echo "$PR_JSON" | jq -r '.number')
             BASE_REF=$(echo "$PR_JSON" | jq -r '.baseRefName')
             BASE_SHA=$(echo "$PR_JSON" | jq -r '.baseRefOid')
@@ -93,6 +94,7 @@ jobs:
             PR_TITLE=$(echo "$PR_JSON" | jq -r '.title')
             PR_BODY=$(echo "$PR_JSON" | jq -r '.body // ""')
             IS_FORK=$(echo "$PR_JSON" | jq -r '.isCrossRepository')
+            PR_AUTHOR=$(echo "$PR_JSON" | jq -r '.author.login // ""')
           else
             PR_NUMBER="$EVENT_PR_NUMBER"
             BASE_REF="$EVENT_BASE_REF"
@@ -101,6 +103,7 @@ jobs:
             PR_TITLE="$EVENT_TITLE"
             PR_BODY="$EVENT_BODY"
             IS_FORK="$EVENT_FORK"
+            PR_AUTHOR="$EVENT_AUTHOR"
           fi
           if [ "$IS_FORK" = "true" ]; then
             echo "Skipping Pi review for fork PR."
@@ -113,6 +116,7 @@ jobs:
             echo "base_ref=$BASE_REF"
             echo "base_sha=$BASE_SHA"
             echo "head_sha=$HEAD_SHA"
+            echo "pr_author=$PR_AUTHOR"
             echo 'title<<PR_TITLE_EOF'
             printf '%s\n' "$PR_TITLE"
             echo 'PR_TITLE_EOF'
@@ -195,6 +199,7 @@ jobs:
           PR_HEAD_SHA: ${{ steps.pr.outputs.head_sha }}
           PR_TITLE: ${{ steps.pr.outputs.title }}
           PR_BODY: ${{ steps.pr.outputs.body }}
+          PR_AUTHOR: ${{ steps.pr.outputs.pr_author }}
           EXTRA_PROMPT: ${{ inputs.extra_prompt }}
         run: |
           mkdir -p .github/pi
@@ -203,6 +208,11 @@ jobs:
           const lines = [
             `Repository: ${process.env.PR_REPOSITORY}`,
             `PR number: ${process.env.PR_NUMBER}`,
+          ];
+          if (process.env.PR_AUTHOR) {
+            lines.push(`PR AUTHOR: ${process.env.PR_AUTHOR}`);
+          }
+          lines.push(
             `Base SHA: ${process.env.PR_BASE_SHA}`,
             `Head SHA: ${process.env.PR_HEAD_SHA}`,
             '',
@@ -220,7 +230,7 @@ jobs:
             '',
             'Full review diff command:',
             `git diff --unified=0 ${process.env.PR_BASE_SHA}...${process.env.PR_HEAD_SHA}`
-          ];
+          );
           if (process.env.EXTRA_PROMPT && process.env.EXTRA_PROMPT.trim()) {
             lines.push('', 'Additional reviewer instructions:', process.env.EXTRA_PROMPT.trim());
           }
diff --git a/.github/workflows/pr-ready-review.yml b/.github/workflows/pr-ready-review.yml
index be2d13477a..6414cf944c 100644
--- a/.github/workflows/pr-ready-review.yml
+++ b/.github/workflows/pr-ready-review.yml
@@ -90,14 +90,21 @@ jobs:
       - name: Resolve PR number
         id: resolve
         env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
           INPUT_PR_NUMBER: ${{ inputs.pr_number }}
           EVENT_PR_NUMBER: ${{ github.event.pull_request.number }}
+          EVENT_PR_AUTHOR: ${{ github.event.pull_request.user.login }}
         run: |
           if [ -n "$INPUT_PR_NUMBER" ]; then
-            echo "pr_number=$INPUT_PR_NUMBER" >> "$GITHUB_OUTPUT"
+            PR_NUMBER="$INPUT_PR_NUMBER"
+            PR_AUTHOR=$(gh api "repos/$REPO/pulls/$PR_NUMBER" --jq '.user.login')
           else
-            echo "pr_number=$EVENT_PR_NUMBER" >> "$GITHUB_OUTPUT"
+            PR_NUMBER="$EVENT_PR_NUMBER"
+            PR_AUTHOR="$EVENT_PR_AUTHOR"
           fi
+          echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
+          echo "pr_author=$PR_AUTHOR" >> "$GITHUB_OUTPUT"
 
       - name: Fetch prior PR discussion
         id: prior
@@ -148,6 +155,7 @@ jobs:
           prompt: |
             REPO: ${{ github.repository }}
             PR NUMBER: ${{ steps.resolve.outputs.pr_number }}
+            PR AUTHOR: ${{ steps.resolve.outputs.pr_author }}
 
             ${{ env.REVIEW_PROMPT }}
           claude_args: |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a7f2f43e3a..e297309df2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,84 @@
 # Changelog
 
+## [1.700.2](https://github.com/windmill-labs/windmill/compare/v1.700.1...v1.700.2) (2026-05-12)
+
+
+### Bug Fixes
+
+* preserve explicit nulls for typed fields in bulk instance config ([#9123](https://github.com/windmill-labs/windmill/issues/9123)) ([cab0000](https://github.com/windmill-labs/windmill/commit/cab0000f3a5e9a0b201a85da1a01b1f82df8a316))
+* preserve negative integers in Bedrock tool schema conversion ([#9116](https://github.com/windmill-labs/windmill/issues/9116)) ([01e21c7](https://github.com/windmill-labs/windmill/commit/01e21c7f913eaf7dffc3d6a31501418ff2104c8b))
+
+## [1.700.1](https://github.com/windmill-labs/windmill/compare/v1.700.0...v1.700.1) (2026-05-11)
+
+
+### Bug Fixes
+
+* CE build broken by enterprise-gated compute_instance_hash ([#9113](https://github.com/windmill-labs/windmill/issues/9113)) ([cd65de4](https://github.com/windmill-labs/windmill/commit/cd65de49285ff60abdd94c883180ded65609f382))
+
+## [1.700.0](https://github.com/windmill-labs/windmill/compare/v1.699.0...v1.700.0) (2026-05-11)
+
+
+### Features
+
+* **cli:** auto-infer args for `wmill app push` ([#9091](https://github.com/windmill-labs/windmill/issues/9091)) ([43b1800](https://github.com/windmill-labs/windmill/commit/43b18006f32fd5db54bbf8ae7ff0e0b314a517e5))
+* **forks:** prompt to delete forked children when deleting a fork ([#9097](https://github.com/windmill-labs/windmill/issues/9097)) ([e43a958](https://github.com/windmill-labs/windmill/commit/e43a958c5c6ae01a1fbecf3db63c6541a245be62))
+* **operators:** allow operators to access assets page ([#9095](https://github.com/windmill-labs/windmill/issues/9095)) ([20ecd90](https://github.com/windmill-labs/windmill/commit/20ecd904e7060c3cf90f2605740bb349b2a3e6ed))
+* **vault:** configurable JWT auth mount path and setup-doc fixes ([#9100](https://github.com/windmill-labs/windmill/issues/9100)) ([f8ba084](https://github.com/windmill-labs/windmill/commit/f8ba0840d74572c880cf458938365b3ec808c6fb))
+
+
+### Bug Fixes
+
+* add Input, Result, Trigger to reserved flow step IDs ([#9109](https://github.com/windmill-labs/windmill/issues/9109)) ([9f79a86](https://github.com/windmill-labs/windmill/commit/9f79a86a686708f66ccc512d4f132cb9a00397a7)), closes [#7139](https://github.com/windmill-labs/windmill/issues/7139)
+* **frontend:** mark Path dirty when folder picker changes selection ([#9096](https://github.com/windmill-labs/windmill/issues/9096)) ([23bb1b5](https://github.com/windmill-labs/windmill/commit/23bb1b541e78846d5978153fd8d9bb4f01cec72b))
+* mask oauth client secret in instance settings ([#9112](https://github.com/windmill-labs/windmill/issues/9112)) ([ac3c155](https://github.com/windmill-labs/windmill/commit/ac3c155541eb5ca20d65c38ad13dca6c10a572c9))
+* populate raw_code for flowscript and appscript runs ([#9104](https://github.com/windmill-labs/windmill/issues/9104)) ([05172ac](https://github.com/windmill-labs/windmill/commit/05172ac3bdfc3472da5e9d8a825cdd479ba9e375))
+
+
+### Performance Improvements
+
+* lazy-load script editor history and hit partial index ([#9107](https://github.com/windmill-labs/windmill/issues/9107)) ([03e8bc8](https://github.com/windmill-labs/windmill/commit/03e8bc8c14258355d7d695333c1588807fbf8cd6))
+
+## [1.699.0](https://github.com/windmill-labs/windmill/compare/v1.698.0...v1.699.0) (2026-05-08)
+
+
+### Features
+
+* parse windmill_failure field to tag run as failure ([#9073](https://github.com/windmill-labs/windmill/issues/9073)) ([dd53202](https://github.com/windmill-labs/windmill/commit/dd5320205f200dd058db2ff7d44d5c4bbcf25ec9))
+
+
+### Bug Fixes
+
+* **cli:** bump svelte version in `wmill app new` template ([#9084](https://github.com/windmill-labs/windmill/issues/9084)) ([4b4aa0e](https://github.com/windmill-labs/windmill/commit/4b4aa0e303f9c47c4f931511977107f42f93abc3))
+* **flows:** populate error handler input args from failure picker ([#9087](https://github.com/windmill-labs/windmill/issues/9087)) ([f37d360](https://github.com/windmill-labs/windmill/commit/f37d3606446d23f8b11a94ea1ce5f5d4836fae17))
+* hide _ENTRYPOINT_OVERRIDE jobs from script/flow history panel ([#9088](https://github.com/windmill-labs/windmill/issues/9088)) ([935c666](https://github.com/windmill-labs/windmill/commit/935c666d50ef30d89a3669c76094af7506fbb448))
+* **native-triggers:** serialize Google channel renewal across replicas ([#9060](https://github.com/windmill-labs/windmill/issues/9060)) ([ee3d82f](https://github.com/windmill-labs/windmill/commit/ee3d82f01f52d835218f544dad6de9b7c3184fbb))
+* **python:** verify wheel RECORD on cache pull/install, finalize piptar ([#9090](https://github.com/windmill-labs/windmill/issues/9090)) ([98ff146](https://github.com/windmill-labs/windmill/commit/98ff146cfabf45418c95c027ad6d07b08069cfcd))
+* reject root-rooted paths in ansible playbook validator on windows ([#9081](https://github.com/windmill-labs/windmill/issues/9081)) ([d37277d](https://github.com/windmill-labs/windmill/commit/d37277d2341c83faf72efa0035cbf70e2cfbd596))
+
+
+### Performance Improvements
+
+* **flows:** gate flow_env resolve on expr text and share cache with handle_flow ([#9085](https://github.com/windmill-labs/windmill/issues/9085)) ([23af6c2](https://github.com/windmill-labs/windmill/commit/23af6c2ea31265a1898d0632e72cd2fd826e4044))
+
+## [1.698.0](https://github.com/windmill-labs/windmill/compare/v1.697.0...v1.698.0) (2026-05-08)
+
+
+### Features
+
+* **cli:** add --parallel flag to generate-metadata ([#9074](https://github.com/windmill-labs/windmill/issues/9074)) ([bc527fd](https://github.com/windmill-labs/windmill/commit/bc527fd929577ac57d4e24196069ed236b702d71))
+
+
+### Bug Fixes
+
+* **cli-tests:** stabilize flow lock-gen race + Windows path ([#9080](https://github.com/windmill-labs/windmill/issues/9080)) ([1c56148](https://github.com/windmill-labs/windmill/commit/1c56148714861aafc4f489916c71aa4674e938c0))
+* **cli:** forward HEADERS env var on every backend fetch call ([#9075](https://github.com/windmill-labs/windmill/issues/9075)) ([d647686](https://github.com/windmill-labs/windmill/commit/d6476862b30692e450cceda09c58d47964f87d32))
+
+
+### Performance Improvements
+
+* **flows:** cache resolved flow_env per flow execution ([#9079](https://github.com/windmill-labs/windmill/issues/9079)) ([e1a7c75](https://github.com/windmill-labs/windmill/commit/e1a7c75e192b72b3b0d854c1901653e0b9386bf2))
+* **flows:** skip flow_env DB+transform work when no resolution is needed ([#9078](https://github.com/windmill-labs/windmill/issues/9078)) ([2067e07](https://github.com/windmill-labs/windmill/commit/2067e0719fd1fd1b899b015badec0f222c054e66))
+
 ## [1.697.0](https://github.com/windmill-labs/windmill/compare/v1.696.2...v1.697.0) (2026-05-07)
 
 
diff --git a/REVIEW.md b/REVIEW.md
index de311cccc6..21f5e50f26 100644
--- a/REVIEW.md
+++ b/REVIEW.md
@@ -9,7 +9,7 @@ You are reviewing a GitHub pull request for this repository. Apply this policy a
 
 ## Verdict (first line of the review)
 
-Start every review with a single verdict line, before any other section. Pick exactly one:
+Start every review with a single verdict line, before any other section (the only thing that may appear above the verdict is the optional `cc @<PR_AUTHOR>` ping described in "Pinging the author" below). Pick exactly one:
 
 - **Good to merge** — no blocking issues and no nits worth surfacing.
 - **Mergeable, but should ideally address nits: <short list>** — no blockers, but P2 findings that are worth a look. The list must name each nit briefly (e.g. "doc/code mismatch in `foo.rs`, half-finished `pub fn bar`").
@@ -17,6 +17,10 @@ Start every review with a single verdict line, before any other section. Pick ex
 
 The names in the list must match findings detailed later in the review. If you list a nit or issue here, it must appear with full context in the body. Do not invent items that aren't in the body, and do not bury blockers in the body without surfacing them in the verdict.
 
+## Pinging the author
+
+If the prompt context provides a `PR AUTHOR` (GitHub login) and the verdict is NOT "Good to merge" (i.e. it is "Mergeable, but should ideally address nits: ..." or "Should address issues before merging: ..."), prepend a single line `cc @<PR_AUTHOR>` to the top-level review comment, above the verdict line. This pings the author so they get a notification that there are items to address. Skip the ping entirely when the verdict is "Good to merge" — there is nothing for the author to act on. Do not add the ping to inline comments; the top-level summary comment is the only place it belongs.
+
 ## Review policy
 
 - Only report issues you are confident are real and introduced by this pull request.
diff --git a/ai_evals/README.md b/ai_evals/README.md
index 267451aabf..2e1f3210f8 100644
--- a/ai_evals/README.md
+++ b/ai_evals/README.md
@@ -55,7 +55,7 @@ bun run cli -- run flow flow-test4-order-processing-loop --model opus
 bun run cli -- run flow flow-test0-sum-two-numbers --models haiku,opus,4o
 bun run cli -- run flow flow-test0-sum-two-numbers --runs 3 --verbose
 bun run cli -- run flow --record
-GEMINI_API_KEY=... bun run cli -- run app app-test1-counter-create --model gemini-pro --transport proxy
+GEMINI_API_KEY=... bun run cli -- run app app-test1-counter-create --model gemini-pro
 WMILL_AI_EVAL_BACKEND_URL=http://127.0.0.1:8000 bun run cli -- run flow --backend-validation preview
 bun run cli -- run cli bun-hello-script
 ```
@@ -72,7 +72,6 @@ Public CLI surface:
 - `--output <path>`: custom result JSON path
 - `--model <alias>`: choose the model under test
 - `--models <a,b,c>`: run the same cases sequentially against several model aliases
-- `--transport <mode>`: frontend request transport (`direct` by default, `proxy` to exercise `/api/w/{workspace}/ai/proxy`)
 - `--verbose`: stream assistant output for frontend runs
 - `--record`: append a compact tracked summary line to `ai_evals/history/<mode>.jsonl` for full-suite runs only
 - `--backend-validation <mode>`: optional backend smoke validation (`off` or `preview`) for `script` and `flow` evals
@@ -145,26 +144,23 @@ If `--backend-validation preview` is enabled:
 - `script` evals run a real backend script preview in an isolated temp workspace
 - `flow` evals run a real backend flow preview only for cases that define `runtime.backendPreview`
 - `flow` cases with `initial.workspace` fixtures seed those scripts and flows into the preview workspace before preview
-- when `WMILL_AI_EVAL_BACKEND_WORKSPACE` is set, `ai_evals` treats that workspace as a dedicated test workspace, clears managed eval assets under `f/evals/*` before each preview run, and then reseeds the current case fixtures
+- when `WMILL_AI_EVAL_BACKEND_WORKSPACE` is set, `ai_evals` creates or reuses that workspace as a dedicated test workspace, clears managed eval assets under `f/evals/*` before each preview run, and then reseeds the current case fixtures
 
-Supported backend validation env vars:
+Supported backend env vars:
 
 - `WMILL_AI_EVAL_BACKEND_VALIDATION=preview`
 - `WMILL_AI_EVAL_BACKEND_URL=http://127.0.0.1:8000`
 - `WMILL_AI_EVAL_BACKEND_EMAIL=admin@windmill.dev`
 - `WMILL_AI_EVAL_BACKEND_PASSWORD=changeme`
 - `WMILL_AI_EVAL_BACKEND_WORKSPACE=integration-tests` to reuse an existing workspace on CE installs with low workspace limits
-- `WMILL_AI_EVAL_KEEP_WORKSPACES=1`
-- `WMILL_AI_EVAL_WORKSPACE_PREFIX=ai-evals`
 
-Frontend proxy transport uses the same backend auth/workspace env vars.
+Frontend modes require a reachable Windmill backend and send model requests through the workspace AI proxy at `/api/w/{workspace}/ai/proxy`. At startup, `ai_evals` checks the resolved backend URL and fails early with setup guidance if the backend cannot be reached or login fails.
 
-When `--transport proxy` is set:
+For frontend modes:
 
-- `ai_evals` creates or reuses a backend workspace
+- `ai_evals` creates a temporary backend workspace, or creates/reuses `WMILL_AI_EVAL_BACKEND_WORKSPACE` when it is set
 - it upserts a provider resource under `f/evals/ai/<provider>`
 - frontend requests go through `/api/w/{workspace}/ai/proxy`
-- result JSON and history records include `transport` so direct vs proxy runs stay distinguishable
 
 ## Results And Artifacts
 
@@ -182,7 +178,7 @@ If `--record` is used, the CLI also appends one compact JSON line to:
 
 Each recorded line contains:
 
-- run metadata (`createdAt`, `gitSha`, `mode`, `runModel`, `transport`, `judgeModel`)
+- run metadata (`createdAt`, `gitSha`, `mode`, `runModel`, `judgeModel`)
 - suite totals (`caseCount`, `attemptCount`, `passedAttempts`, `passRate`, `averageDurationMs`, `averageJudgeScore`)
 - average token usage (`averageTokenUsagePerAttempt`)
 - per-case metrics under `cases[]` (`averageDurationMs`, `averageJudgeScore`, `averageTokenUsagePerAttempt`, pass rate)
diff --git a/ai_evals/adapters/frontend/backendPreview.test.ts b/ai_evals/adapters/frontend/backendPreview.test.ts
index 2f12c9a896..d4de361333 100644
--- a/ai_evals/adapters/frontend/backendPreview.test.ts
+++ b/ai_evals/adapters/frontend/backendPreview.test.ts
@@ -210,8 +210,6 @@ function buildSettings(
 		baseUrl: 'http://backend.test/default',
 		email: 'admin@windmill.dev',
 		password: 'changeme',
-		keepWorkspaces: true,
-		workspacePrefix: 'ai-evals',
 		pollIntervalMs: 1,
 		maxWaitMs: 50,
 		...overrides
diff --git a/ai_evals/adapters/frontend/backendPreview.ts b/ai_evals/adapters/frontend/backendPreview.ts
index e1be934564..57e1cfdf2a 100644
--- a/ai_evals/adapters/frontend/backendPreview.ts
+++ b/ai_evals/adapters/frontend/backendPreview.ts
@@ -24,6 +24,7 @@ export interface CompletedPreviewJob {
 const tokenCache = new Map<string, Promise<string>>()
 const sharedWorkspaceQueue = new Map<string, Promise<void>>()
 const managedSharedWorkspacePrefixes = ['f/evals/']
+const DEFAULT_WORKSPACE_PREFIX = 'ai-evals'
 
 export class BackendPreviewClient {
 	constructor(private readonly settings: BackendValidationSettings) {}
@@ -35,7 +36,7 @@ export class BackendPreviewClient {
 	): Promise<T> {
 		const workspaceId =
 			this.settings.workspaceOverride ??
-			buildWorkspaceId(this.settings.workspacePrefix, caseId, attempt)
+			buildWorkspaceId(caseId, attempt)
 
 		const run = async () => {
 			await this.ensureWorkspace(workspaceId)
@@ -46,7 +47,7 @@ export class BackendPreviewClient {
 			try {
 				return await body(workspaceId)
 			} finally {
-				if (!this.settings.keepWorkspaces && !this.settings.workspaceOverride) {
+				if (!this.settings.workspaceOverride) {
 					await this.deleteWorkspace(workspaceId).catch(() => undefined)
 				}
 			}
@@ -440,14 +441,14 @@ async function withSharedWorkspaceLock<T>(workspaceId: string, body: () => Promi
 	}
 }
 
-function buildWorkspaceId(prefix: string, caseId: string, attempt: number): string {
+function buildWorkspaceId(caseId: string, attempt: number): string {
 	const caseSlug = caseId
 		.toLowerCase()
 		.replace(/[^a-z0-9-]+/g, '-')
 		.replace(/^-+|-+$/g, '')
 		.slice(0, 30)
 	const suffix = randomUUID().slice(0, 8)
-	return `${prefix}-${caseSlug || 'case'}-a${attempt}-${suffix}`
+	return `${DEFAULT_WORKSPACE_PREFIX}-${caseSlug || 'case'}-a${attempt}-${suffix}`
 }
 
 function extractFolderName(path: string): string | null {
diff --git a/ai_evals/adapters/frontend/benchmarkRunner.ts b/ai_evals/adapters/frontend/benchmarkRunner.ts
index 474d434803..50a0d10c3c 100644
--- a/ai_evals/adapters/frontend/benchmarkRunner.ts
+++ b/ai_evals/adapters/frontend/benchmarkRunner.ts
@@ -1,6 +1,5 @@
 import { loadSelectedCases } from "../../core/cases";
 import { resolveBackendValidationSettings } from "../../core/backendValidation";
-import { resolveFrontendEvalTransportSettings } from "../../core/frontendTransport";
 import {
   formatRunModelLabel,
   getFrontendEvalModel,
@@ -9,6 +8,7 @@ import {
 import { buildRunResult } from "../../core/results";
 import { runSuite } from "../../core/runSuite";
 import type { BenchmarkRunResult, ModeRunner } from "../../core/types";
+import { resolveWindmillBackendSettings } from "../../core/windmillBackendSettings";
 import { emitFrontendBenchmarkProgress } from "./progress";
 import { createAppModeRunner } from "../../modes/app";
 import { createFlowModeRunner } from "../../modes/flow";
@@ -36,17 +36,14 @@ export async function runFrontendBenchmarkFromEnv(): Promise<BenchmarkRunResult>
     evalMode: mode,
     requestedMode: process.env.WMILL_FRONTEND_AI_EVAL_BACKEND_VALIDATION,
   });
-  const transportSettings = resolveFrontendEvalTransportSettings({
-    evalMode: mode,
-    requestedTransport: process.env.WMILL_FRONTEND_AI_EVAL_TRANSPORT,
-  });
+  const backendSettings = resolveWindmillBackendSettings();
 
   const selectedCases = await loadSelectedCases(mode, caseIds);
   const modeRunner = getModeRunner(
     mode,
     getFrontendEvalModel(model),
     backendValidation,
-    transportSettings,
+    backendSettings,
   );
   const runModel = formatRunModelLabel(mode, model);
   const caseResults = await runSuite({
@@ -66,7 +63,6 @@ export async function runFrontendBenchmarkFromEnv(): Promise<BenchmarkRunResult>
     mode,
     runs,
     runModel,
-    transport: transportSettings.transport,
     judgeModel: DEFAULT_JUDGE_MODEL,
     caseResults,
   });
@@ -76,18 +72,18 @@ function getModeRunner(
   mode: FrontendBenchmarkMode,
   model: ReturnType<typeof getFrontendEvalModel>,
   backendValidation: ReturnType<typeof resolveBackendValidationSettings>,
-  transportSettings: ReturnType<typeof resolveFrontendEvalTransportSettings>,
+  backendSettings: ReturnType<typeof resolveWindmillBackendSettings>,
 ): ModeRunner<any, any, any> {
   switch (mode) {
     case "flow":
-      return createFlowModeRunner(model, backendValidation, transportSettings);
+      return createFlowModeRunner(model, backendValidation, backendSettings);
     case "app":
-      return createAppModeRunner(model, transportSettings);
+      return createAppModeRunner(model, backendSettings);
     case "script":
       return createScriptModeRunner(
         model,
         backendValidation,
-        transportSettings,
+        backendSettings,
       );
   }
 }
diff --git a/ai_evals/adapters/frontend/core/app/appEvalRunner.ts b/ai_evals/adapters/frontend/core/app/appEvalRunner.ts
index 55d1e6ab9a..16543b28de 100644
--- a/ai_evals/adapters/frontend/core/app/appEvalRunner.ts
+++ b/ai_evals/adapters/frontend/core/app/appEvalRunner.ts
@@ -12,7 +12,7 @@ import {
   prepareAppUserMessage,
 } from "../../../../../frontend/src/lib/components/copilot/chat/app/core";
 import type { Tool as ProductionTool } from "../../../../../frontend/src/lib/components/copilot/chat/shared";
-import { createAppFileHelpers } from "./fileHelpers";
+import { createAppFileHelpers, type AppEvalChatHelpers } from "./fileHelpers";
 import { runEval } from "../shared";
 import type { AIProvider } from "$lib/gen/types.gen";
 import type {
@@ -22,7 +22,6 @@ import type {
 } from "../../../../core/types";
 import type { TokenUsage } from "../shared/types";
 import type { AppFilesState } from "../../../../core/validators";
-import type { FrontendEvalTransport } from "../../../../core/frontendTransport";
 import type { WindmillBackendSettings } from "../../../../core/windmillBackendSettings";
 import {
   createAppBackendRunnableContextElement,
@@ -49,8 +48,7 @@ export interface AppEvalOptions {
   model?: string;
   maxIterations?: number;
   provider?: AIProvider;
-  transport?: FrontendEvalTransport;
-  backend?: WindmillBackendSettings;
+  backend: WindmillBackendSettings;
   workspaceRoot?: string;
   runContext?: ModeRunContext;
 }
@@ -58,7 +56,7 @@ export interface AppEvalOptions {
 export async function runAppEval(
   userPrompt: string,
   apiKey: string,
-  options?: AppEvalOptions,
+  options: AppEvalOptions,
 ): Promise<AppEvalResult> {
   const workspaceRoot =
     options?.workspaceRoot ??
@@ -101,10 +99,9 @@ export async function runAppEval(
         model,
         workspace: workspaceRoot,
         provider: options?.provider,
-        transport: options?.transport,
-        backend: options?.backend,
-        proxyCaseId: options?.runContext?.caseId,
-        proxyAttempt: options?.runContext?.attempt,
+        backend: options.backend,
+        caseId: options?.runContext?.caseId,
+        attempt: options?.runContext?.attempt,
       },
     });
 
@@ -124,7 +121,7 @@ export async function runAppEval(
 
 async function buildAdditionalContext(
   appContext: EvalCaseRuntimeAppContextSpec | undefined,
-  helpers: AppAIChatHelpers,
+  helpers: AppEvalChatHelpers,
 ): Promise<ContextElement[]> {
   const entries = appContext?.additional ?? [];
   if (entries.length === 0) {
diff --git a/ai_evals/adapters/frontend/core/app/fileHelpers.ts b/ai_evals/adapters/frontend/core/app/fileHelpers.ts
index e82ddf4672..15721a49ed 100644
--- a/ai_evals/adapters/frontend/core/app/fileHelpers.ts
+++ b/ai_evals/adapters/frontend/core/app/fileHelpers.ts
@@ -2,6 +2,7 @@ import { mkdir, rm, writeFile } from 'fs/promises'
 import { dirname, join } from 'path'
 import type {
 	AppAIChatHelpers,
+	AppDatatableMetadata,
 	AppFiles,
 	BackendRunnable,
 	DataTableSchema,
@@ -10,6 +11,10 @@ import type {
 } from '../../../../../frontend/src/lib/components/copilot/chat/app/core'
 import { buildAppWmillTypes, collectAppDiagnostics } from '../../../../core/appDiagnostics'
 
+export interface AppEvalChatHelpers extends AppAIChatHelpers {
+	getDatatables: () => Promise<DataTableSchema[]>
+}
+
 async function writeFrontendFile(
 	workspaceRoot: string | undefined,
 	path: string,
@@ -92,7 +97,7 @@ export async function createAppFileHelpers(
 	initialDatatables: DataTableSchema[] = [],
 	workspaceRoot?: string
 ): Promise<{
-	helpers: AppAIChatHelpers
+	helpers: AppEvalChatHelpers
 	getFiles: () => AppFiles
 	getEvalState: () => {
 		frontend: Record<string, string>
@@ -137,7 +142,7 @@ export async function createAppFileHelpers(
 	}
 	await persistDatatables(workspaceRoot, datatables)
 
-	const helpers: AppAIChatHelpers = {
+	const helpers: AppEvalChatHelpers = {
 		listFrontendFiles: () => [
 			...Object.keys(frontend).filter((path) => path !== '/wmill.d.ts'),
 			'/wmill.d.ts'
@@ -211,6 +216,34 @@ export async function createAppFileHelpers(
 		},
 		lint,
 		getDatatables: async () => structuredClone(datatables),
+		listDatatableTables: async () =>
+			datatables.map(
+				(datatable): AppDatatableMetadata => {
+					const schemas = Object.fromEntries(
+						Object.entries(datatable.schemas).map(([schemaName, tables]) => [
+							schemaName,
+							Object.keys(tables)
+						])
+					)
+					return {
+						datatable_name: datatable.datatable_name,
+						schemas,
+						tableCount: Object.values(schemas).reduce(
+							(sum, tableNames) => sum + tableNames.length,
+							0
+						),
+						error: datatable.error
+					}
+				}
+			),
+		getDatatableTableSchema: async (
+			datatableName: string,
+			schemaName: string,
+			tableName: string
+		) => {
+			const datatable = datatables.find((entry) => entry.datatable_name === datatableName)
+			return structuredClone(datatable?.schemas?.[schemaName]?.[tableName] ?? {})
+		},
 		getAvailableDatatableNames: () => datatables.map((datatable) => datatable.datatable_name),
 		execDatatableSql: async (
 			datatableName: string,
diff --git a/ai_evals/adapters/frontend/core/flow/flowEvalRunner.ts b/ai_evals/adapters/frontend/core/flow/flowEvalRunner.ts
index 1b448bdea4..0cd25f5787 100644
--- a/ai_evals/adapters/frontend/core/flow/flowEvalRunner.ts
+++ b/ai_evals/adapters/frontend/core/flow/flowEvalRunner.ts
@@ -18,7 +18,6 @@ import {
 import { runEval } from "../shared";
 import type { ModeRunContext } from "../../../../core/types";
 import type { TokenUsage, ToolCallDetail } from "../shared/types";
-import type { FrontendEvalTransport } from "../../../../core/frontendTransport";
 import type { WindmillBackendSettings } from "../../../../core/windmillBackendSettings";
 
 export interface FlowFixture {
@@ -48,8 +47,7 @@ export interface FlowEvalOptions {
   model?: string;
   maxIterations?: number;
   provider?: AIProvider;
-  transport?: FrontendEvalTransport;
-  backend?: WindmillBackendSettings;
+  backend: WindmillBackendSettings;
   workspaceRoot?: string;
   runContext?: ModeRunContext;
 }
@@ -57,7 +55,7 @@ export interface FlowEvalOptions {
 export async function runFlowEval(
   userPrompt: string,
   apiKey: string,
-  options?: FlowEvalOptions,
+  options: FlowEvalOptions,
 ): Promise<FlowEvalResult> {
   const workspaceRoot =
     options?.workspaceRoot ??
@@ -100,10 +98,9 @@ export async function runFlowEval(
         model,
         workspace: workspaceRoot,
         provider: options?.provider,
-        transport: options?.transport,
-        backend: options?.backend,
-        proxyCaseId: options?.runContext?.caseId,
-        proxyAttempt: options?.runContext?.attempt,
+        backend: options.backend,
+        caseId: options?.runContext?.caseId,
+        attempt: options?.runContext?.attempt,
       },
     });
 
diff --git a/ai_evals/adapters/frontend/core/script/scriptEvalRunner.ts b/ai_evals/adapters/frontend/core/script/scriptEvalRunner.ts
index 30aa2c81e7..95ce6555e6 100644
--- a/ai_evals/adapters/frontend/core/script/scriptEvalRunner.ts
+++ b/ai_evals/adapters/frontend/core/script/scriptEvalRunner.ts
@@ -14,7 +14,6 @@ import { createScriptFileHelpers, type ScriptEvalState } from "./fileHelpers";
 import { runEval } from "../shared";
 import type { ModeRunContext } from "../../../../core/types";
 import type { TokenUsage, ToolCallDetail } from "../shared/types";
-import type { FrontendEvalTransport } from "../../../../core/frontendTransport";
 import type { WindmillBackendSettings } from "../../../../core/windmillBackendSettings";
 
 export interface ScriptEvalResult {
@@ -33,8 +32,7 @@ export interface ScriptEvalOptions {
   model?: string;
   maxIterations?: number;
   provider?: AIProvider;
-  transport?: FrontendEvalTransport;
-  backend?: WindmillBackendSettings;
+  backend: WindmillBackendSettings;
   workspaceRoot?: string;
   runContext?: ModeRunContext;
 }
@@ -98,10 +96,9 @@ export async function runScriptEval(
         model,
         workspace: workspaceRoot,
         provider: modelProvider.provider,
-        transport: options.transport,
         backend: options.backend,
-        proxyCaseId: options.runContext?.caseId,
-        proxyAttempt: options.runContext?.attempt,
+        caseId: options.runContext?.caseId,
+        attempt: options.runContext?.attempt,
       },
     });
 
diff --git a/ai_evals/adapters/frontend/core/shared/baseEvalRunner.ts b/ai_evals/adapters/frontend/core/shared/baseEvalRunner.ts
index 5b1f2e948e..7fd43ccb87 100644
--- a/ai_evals/adapters/frontend/core/shared/baseEvalRunner.ts
+++ b/ai_evals/adapters/frontend/core/shared/baseEvalRunner.ts
@@ -40,8 +40,8 @@ export interface RunEvalParams<THelpers, TOutput> {
   apiKey: string;
   /** Function to get the current output state */
   getOutput: () => TOutput;
-  /** Optional configuration */
-  options?: EvalRunnerOptions;
+  /** Model and Windmill backend configuration */
+  options: EvalRunnerOptions;
   onAssistantMessageStart?: () => void;
   onAssistantToken?: (token: string) => void;
   onAssistantMessageEnd?: () => void;
@@ -70,10 +70,10 @@ export async function runEval<THelpers, TOutput>(
   } = params;
   let shouldEmitMessageStart = true;
 
-  const model = options?.model ?? "gpt-4o";
-  const maxIterations = options?.maxIterations ?? 20;
-  const workspace = options?.workspace ?? "test-workspace";
-  const provider = toFrontendEvalProvider(options?.provider);
+  const model = options.model ?? "gpt-4o";
+  const maxIterations = options.maxIterations ?? 20;
+  const workspace = options.workspace ?? "test-workspace";
+  const provider = toFrontendEvalProvider(options.provider);
 
   const modelProvider = resolveEvalModelProvider(model, provider);
 
@@ -203,45 +203,31 @@ export async function runEval<THelpers, TOutput>(
     }
   };
 
-  if (options?.transport === "proxy") {
-    const backendSettings = options.backend;
-    if (!backendSettings) {
-      throw new Error("Missing backend settings for proxy transport");
-    }
-
-    const backendClient = new WindmillBackendClient(backendSettings);
-    return await backendClient.withWorkspace(
-      options.proxyCaseId ?? "eval",
-      options.proxyAttempt ?? 1,
-      async (proxyWorkspaceId) => {
-        const resourcePath = buildProxyResourcePath(modelProvider.provider);
-        await backendClient.upsertResource({
-          workspaceId: proxyWorkspaceId,
-          path: resourcePath,
-          resourceType: modelProvider.provider,
-          value: { api_key: apiKey },
-        });
-        const token = await backendClient.getToken();
-        const clients = createEvalClients({
-          provider: modelProvider.provider,
-          apiKey,
-          transport: "proxy",
-          proxy: {
-            baseURL: `${backendSettings.baseUrl}/api/w/${encodeURIComponent(proxyWorkspaceId)}/ai/proxy`,
-            bearerToken: token,
-            resourcePath,
-          },
-        }) as unknown as ChatClients;
-        return await executeChatLoop(clients);
-      },
-    );
-  }
-
-  const clients = createEvalClients({
-    provider: modelProvider.provider,
-    apiKey,
-  }) as unknown as ChatClients;
-  return await executeChatLoop(clients);
+  const backendSettings = options.backend;
+  const backendClient = new WindmillBackendClient(backendSettings);
+  return await backendClient.withWorkspace(
+    options.caseId ?? "eval",
+    options.attempt ?? 1,
+    async (proxyWorkspaceId) => {
+      const resourcePath = buildProxyResourcePath(modelProvider.provider);
+      await backendClient.upsertResource({
+        workspaceId: proxyWorkspaceId,
+        path: resourcePath,
+        resourceType: modelProvider.provider,
+        value: { api_key: apiKey },
+      });
+      const token = await backendClient.getToken();
+      const clients = createEvalClients({
+        provider: modelProvider.provider,
+        proxy: {
+          baseURL: `${backendSettings.baseUrl}/api/w/${encodeURIComponent(proxyWorkspaceId)}/ai/proxy`,
+          bearerToken: token,
+          resourcePath,
+        },
+      }) as unknown as ChatClients;
+      return await executeChatLoop(clients);
+    },
+  );
 }
 
 function toFrontendEvalProvider(
diff --git a/ai_evals/adapters/frontend/core/shared/providerConfig.test.ts b/ai_evals/adapters/frontend/core/shared/providerConfig.test.ts
index e504ced376..77d9154da3 100644
--- a/ai_evals/adapters/frontend/core/shared/providerConfig.test.ts
+++ b/ai_evals/adapters/frontend/core/shared/providerConfig.test.ts
@@ -2,35 +2,9 @@ import { describe, expect, it } from "bun:test";
 import {
   buildProxyHeaders,
   buildProxyResourcePath,
-  buildOpenAICompatibleClientOptions,
   resolveEvalModelProvider,
 } from "./providerConfig";
 
-describe("buildOpenAICompatibleClientOptions", () => {
-  it("adds Gemini's OpenAI-compatible base URL and client header", () => {
-    const options = buildOpenAICompatibleClientOptions(
-      "googleai",
-      "gemini-test-key",
-    );
-
-    expect(options).toMatchObject({
-      apiKey: "gemini-test-key",
-      baseURL: "https://generativelanguage.googleapis.com/v1beta/openai/",
-      defaultHeaders: {
-        "x-goog-api-client": "windmill-ai-evals/1.0",
-      },
-    });
-  });
-
-  it("keeps the default OpenAI-compatible config for OpenAI", () => {
-    expect(
-      buildOpenAICompatibleClientOptions("openai", "openai-test-key"),
-    ).toEqual({
-      apiKey: "openai-test-key",
-    });
-  });
-});
-
 describe("proxy helpers", () => {
   it("builds provider-scoped proxy resource paths", () => {
     expect(buildProxyResourcePath("googleai")).toBe("f/evals/ai/googleai");
diff --git a/ai_evals/adapters/frontend/core/shared/providerConfig.ts b/ai_evals/adapters/frontend/core/shared/providerConfig.ts
index 62ba221a40..15372049fe 100644
--- a/ai_evals/adapters/frontend/core/shared/providerConfig.ts
+++ b/ai_evals/adapters/frontend/core/shared/providerConfig.ts
@@ -1,7 +1,6 @@
 import Anthropic from "@anthropic-ai/sdk";
 import OpenAI from "openai";
 import type { FrontendEvalModelConfig } from "../../../../core/models";
-import type { FrontendEvalTransport } from "../../../../core/frontendTransport";
 
 export type FrontendEvalProvider = FrontendEvalModelConfig["provider"];
 
@@ -15,15 +14,12 @@ export interface ResolvedEvalModelProvider {
   model: string;
 }
 
-export interface EvalProxyClientConfig {
+export interface WindmillAiProxyClientConfig {
   baseURL: string;
   bearerToken: string;
   resourcePath: string;
 }
 
-const GEMINI_OPENAI_BASE_URL =
-  "https://generativelanguage.googleapis.com/v1beta/openai/";
-const GEMINI_GOOG_API_CLIENT = "windmill-ai-evals/1.0";
 const EVAL_PROXY_RESOURCE_PREFIX = "f/evals/ai";
 
 export function buildProxyHeaders(
@@ -40,25 +36,8 @@ export function buildProxyResourcePath(provider: FrontendEvalProvider): string {
   return `${EVAL_PROXY_RESOURCE_PREFIX}/${provider}`;
 }
 
-export function buildOpenAICompatibleClientOptions(
-  provider: Exclude<FrontendEvalProvider, "anthropic">,
-  apiKey: string,
-): ConstructorParameters<typeof OpenAI>[0] {
-  if (provider === "googleai") {
-    return {
-      apiKey,
-      baseURL: GEMINI_OPENAI_BASE_URL,
-      defaultHeaders: {
-        "x-goog-api-client": GEMINI_GOOG_API_CLIENT,
-      },
-    };
-  }
-
-  return { apiKey };
-}
-
 function buildProxyOpenAIClientOptions(
-  proxy: EvalProxyClientConfig,
+  proxy: WindmillAiProxyClientConfig,
 ): ConstructorParameters<typeof OpenAI>[0] {
   return {
     apiKey: "unused",
@@ -69,52 +48,24 @@ function buildProxyOpenAIClientOptions(
 
 export function createEvalClients(input: {
   provider: FrontendEvalProvider;
-  apiKey: string;
-  transport?: FrontendEvalTransport;
-  proxy?: EvalProxyClientConfig;
+  proxy: WindmillAiProxyClientConfig;
 }): EvalClients {
-  const transport = input.transport ?? "direct";
-
   if (input.provider === "anthropic") {
-    if (transport === "proxy") {
-      if (!input.proxy) {
-        throw new Error(
-          "Missing proxy client configuration for proxy transport",
-        );
-      }
-      return {
-        openai: new OpenAI({ apiKey: "unused" }),
-        anthropic: new Anthropic({
-          apiKey: "unused",
-          baseURL: input.proxy.baseURL,
-          defaultHeaders: buildProxyHeaders(
-            input.proxy.bearerToken,
-            input.proxy.resourcePath,
-          ),
-        }),
-      };
-    }
-
     return {
       openai: new OpenAI({ apiKey: "unused" }),
-      anthropic: new Anthropic({ apiKey: input.apiKey }),
-    };
-  }
-
-  if (transport === "proxy") {
-    if (!input.proxy) {
-      throw new Error("Missing proxy client configuration for proxy transport");
-    }
-    return {
-      openai: new OpenAI(buildProxyOpenAIClientOptions(input.proxy)),
-      anthropic: new Anthropic({ apiKey: "unused" }),
+      anthropic: new Anthropic({
+        apiKey: "unused",
+        baseURL: input.proxy.baseURL,
+        defaultHeaders: buildProxyHeaders(
+          input.proxy.bearerToken,
+          input.proxy.resourcePath,
+        ),
+      }),
     };
   }
 
   return {
-    openai: new OpenAI(
-      buildOpenAICompatibleClientOptions(input.provider, input.apiKey),
-    ),
+    openai: new OpenAI(buildProxyOpenAIClientOptions(input.proxy)),
     anthropic: new Anthropic({ apiKey: "unused" }),
   };
 }
diff --git a/ai_evals/adapters/frontend/core/shared/types.ts b/ai_evals/adapters/frontend/core/shared/types.ts
index f2a3f04794..f081fe398a 100644
--- a/ai_evals/adapters/frontend/core/shared/types.ts
+++ b/ai_evals/adapters/frontend/core/shared/types.ts
@@ -1,6 +1,5 @@
 import type { ChatCompletionMessageParam } from "openai/resources/chat/completions.mjs";
 import type { AIProvider } from "$lib/gen/types.gen";
-import type { FrontendEvalTransport } from "../../../../core/frontendTransport";
 import type { WindmillBackendSettings } from "../../../../core/windmillBackendSettings";
 
 export interface TokenUsage {
@@ -15,14 +14,13 @@ export interface ToolCallDetail {
 }
 
 export interface EvalRunnerOptions {
+  backend: WindmillBackendSettings;
   maxIterations?: number;
   model?: string;
   workspace?: string;
   provider?: AIProvider;
-  transport?: FrontendEvalTransport;
-  backend?: WindmillBackendSettings;
-  proxyCaseId?: string;
-  proxyAttempt?: number;
+  caseId?: string;
+  attempt?: number;
 }
 
 export interface RawEvalResult<TOutput> {
diff --git a/ai_evals/adapters/frontend/runtime.ts b/ai_evals/adapters/frontend/runtime.ts
index 6a76fceeb0..180c7a2993 100644
--- a/ai_evals/adapters/frontend/runtime.ts
+++ b/ai_evals/adapters/frontend/runtime.ts
@@ -23,7 +23,6 @@ export async function runFrontendBenchmarkAdapter(input: {
   caseIds: string[];
   runs: number;
   model?: string;
-  transport?: string;
   verbose?: boolean;
   backendValidation?: string;
 }): Promise<BenchmarkRunResult> {
@@ -44,10 +43,6 @@ export async function runFrontendBenchmarkAdapter(input: {
     WMILL_FRONTEND_AI_EVAL_BACKEND_VALIDATION: input.backendValidation ?? "",
   };
 
-  if (input.transport) {
-    env.WMILL_FRONTEND_AI_EVAL_TRANSPORT = input.transport;
-  }
-
   try {
     await runVitestBenchmark(
       path.join(FRONTEND_DIR, "node_modules", ".bin", "vitest"),
diff --git a/ai_evals/adapters/frontend/windmillBackend.test.ts b/ai_evals/adapters/frontend/windmillBackend.test.ts
new file mode 100644
index 0000000000..302502c2d9
--- /dev/null
+++ b/ai_evals/adapters/frontend/windmillBackend.test.ts
@@ -0,0 +1,104 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import type { WindmillBackendSettings } from "../../core/windmillBackendSettings";
+import {
+  WindmillBackendClient,
+  assertWindmillBackendReachable,
+} from "./windmillBackend";
+
+const ORIGINAL_FETCH = globalThis.fetch;
+
+afterEach(() => {
+  globalThis.fetch = ORIGINAL_FETCH;
+});
+
+describe("assertWindmillBackendReachable", () => {
+  it("logs in to verify backend reachability", async () => {
+    const requests: Array<{ url: string; init?: RequestInit }> = [];
+    globalThis.fetch = mockFetch(requests, textResponse(200, "token"));
+
+    await expect(
+      assertWindmillBackendReachable(
+        buildSettings({ baseUrl: "http://backend.test/reachable" }),
+      ),
+    ).resolves.toBeUndefined();
+
+    expect(requests.map((entry) => entry.url)).toEqual([
+      "http://backend.test/reachable/api/auth/login",
+    ]);
+  });
+
+  it("adds setup guidance when the backend cannot be initialized", async () => {
+    globalThis.fetch = mockFetch(
+      [],
+      textResponse(401, "invalid password"),
+    );
+
+    await expect(
+      assertWindmillBackendReachable(
+        buildSettings({ baseUrl: "http://backend.test/auth-failure" }),
+      ),
+    ).rejects.toThrow(
+      "Start a Windmill backend at that URL, or set WMILL_AI_EVAL_BACKEND_URL=<url>.",
+    );
+  });
+});
+
+describe("WindmillBackendClient", () => {
+  it("creates or reuses the specified backend workspace without deleting it", async () => {
+    const requests: Array<{ url: string; init?: RequestInit }> = [];
+    globalThis.fetch = mockFetch(
+      requests,
+      textResponse(200, "token"),
+      textResponse(200, "false"),
+      textResponse(200, ""),
+    );
+
+    const client = new WindmillBackendClient(
+      buildSettings({
+        baseUrl: "http://backend.test/shared-workspace",
+        workspaceOverride: "shared-evals",
+      }),
+    );
+
+    await expect(
+      client.withWorkspace("case-a", 1, async (workspaceId) => workspaceId),
+    ).resolves.toBe("shared-evals");
+
+    expect(requests.map((entry) => entry.url)).toEqual([
+      "http://backend.test/shared-workspace/api/auth/login",
+      "http://backend.test/shared-workspace/api/workspaces/exists",
+      "http://backend.test/shared-workspace/api/workspaces/create",
+    ]);
+  });
+});
+
+function buildSettings(
+  overrides: Partial<WindmillBackendSettings> = {},
+): WindmillBackendSettings {
+  return {
+    baseUrl: "http://backend.test/default",
+    email: "admin@windmill.dev",
+    password: "changeme",
+    ...overrides,
+  };
+}
+
+function mockFetch(
+  requests: Array<{ url: string; init?: RequestInit }>,
+  ...responses: Response[]
+): typeof fetch {
+  const queue = [...responses];
+  return async (input, init) => {
+    const url = String(input);
+    requests.push({ url, init });
+    const next = queue.shift();
+    if (!next) {
+      throw new Error(`Unexpected fetch: ${url}`);
+    }
+    return next;
+  };
+}
+
+function textResponse(status: number, body: string): Response {
+  return new Response(body, { status });
+}
diff --git a/ai_evals/adapters/frontend/windmillBackend.ts b/ai_evals/adapters/frontend/windmillBackend.ts
index c8d9537779..2247d8e5d5 100644
--- a/ai_evals/adapters/frontend/windmillBackend.ts
+++ b/ai_evals/adapters/frontend/windmillBackend.ts
@@ -3,6 +3,7 @@ import type { WindmillBackendSettings } from "../../core/windmillBackendSettings
 
 const tokenCache = new Map<string, Promise<string>>();
 const sharedWorkspaceQueue = new Map<string, Promise<void>>();
+const DEFAULT_WORKSPACE_PREFIX = "ai-evals";
 
 export class WindmillBackendClient {
   constructor(private readonly settings: WindmillBackendSettings) {}
@@ -14,7 +15,7 @@ export class WindmillBackendClient {
   ): Promise<T> {
     const workspaceId =
       this.settings.workspaceOverride ??
-      buildWorkspaceId(this.settings.workspacePrefix, caseId, attempt);
+      buildWorkspaceId(caseId, attempt);
 
     const run = async () => {
       await this.ensureWorkspace(workspaceId);
@@ -22,7 +23,7 @@ export class WindmillBackendClient {
       try {
         return await body(workspaceId);
       } finally {
-        if (!this.settings.keepWorkspaces && !this.settings.workspaceOverride) {
+        if (!this.settings.workspaceOverride) {
           await this.deleteWorkspace(workspaceId).catch(() => undefined);
         }
       }
@@ -136,6 +137,24 @@ export class WindmillBackendClient {
   }
 }
 
+export async function assertWindmillBackendReachable(
+  settings: WindmillBackendSettings,
+): Promise<void> {
+  try {
+    await new WindmillBackendClient(settings).getToken();
+  } catch (error) {
+    const details = error instanceof Error ? error.message : String(error);
+    throw new Error(
+      [
+        `Could not initialize the Windmill backend for AI eval proxy at ${settings.baseUrl}.`,
+        "Start a Windmill backend at that URL, or set WMILL_AI_EVAL_BACKEND_URL=<url>.",
+        `Using login ${settings.email}; if authentication failed, set WMILL_AI_EVAL_BACKEND_EMAIL and WMILL_AI_EVAL_BACKEND_PASSWORD.`,
+        `Details: ${details}`,
+      ].join("\n"),
+    );
+  }
+}
+
 async function withSharedWorkspaceLock<T>(
   workspaceId: string,
   body: () => Promise<T>,
@@ -160,18 +179,14 @@ async function withSharedWorkspaceLock<T>(
   }
 }
 
-function buildWorkspaceId(
-  prefix: string,
-  caseId: string,
-  attempt: number,
-): string {
+function buildWorkspaceId(caseId: string, attempt: number): string {
   const caseSlug = caseId
     .toLowerCase()
     .replace(/[^a-z0-9-]+/g, "-")
     .replace(/^-+|-+$/g, "")
     .slice(0, 30);
   const suffix = randomUUID().slice(0, 8);
-  return `${prefix}-${caseSlug || "case"}-a${attempt}-${suffix}`;
+  return `${DEFAULT_WORKSPACE_PREFIX}-${caseSlug || "case"}-a${attempt}-${suffix}`;
 }
 
 async function expectOk(response: Response, context: string): Promise<void> {
diff --git a/ai_evals/cli/index.ts b/ai_evals/cli/index.ts
index 202d826078..259b055ff5 100644
--- a/ai_evals/cli/index.ts
+++ b/ai_evals/cli/index.ts
@@ -27,11 +27,8 @@ import { EVAL_MODES, type EvalMode } from "../core/types";
 import { DEFAULT_JUDGE_MODEL } from "../core/judge";
 import { createCliModeRunner } from "../modes/cli";
 import { runFrontendBenchmarkAdapter } from "../adapters/frontend/runtime";
-import {
-  FRONTEND_EVAL_TRANSPORTS,
-  type FrontendEvalTransport,
-  parseFrontendEvalTransport,
-} from "../core/frontendTransport";
+import { resolveWindmillBackendSettings } from "../core/windmillBackendSettings";
+import { assertWindmillBackendReachable } from "../adapters/frontend/windmillBackend";
 
 async function main() {
   const program = new Command()
@@ -98,10 +95,6 @@ async function main() {
       "--models <names>",
       "comma-separated model aliases to run sequentially",
     )
-    .option(
-      "--transport <mode>",
-      `frontend transport (${FRONTEND_EVAL_TRANSPORTS.join(", ")})`,
-    )
     .option("--verbose", "stream assistant output during frontend runs")
     .option(
       "--record",
@@ -120,7 +113,6 @@ async function main() {
           output?: string;
           model?: string;
           models?: string;
-          transport?: string;
           verbose?: boolean;
           record?: boolean;
           backendValidation?: string;
@@ -133,9 +125,6 @@ async function main() {
           outputPath: options.output,
           model: options.model,
           models: options.models,
-          transport: options.transport
-            ? parseFrontendEvalTransport(options.transport)
-            : undefined,
           verbose: options.verbose ?? false,
           record: options.record ?? false,
           backendValidation: options.backendValidation,
@@ -184,7 +173,6 @@ async function handleRun(input: {
   outputPath?: string;
   model?: string;
   models?: string;
-  transport?: FrontendEvalTransport;
   verbose: boolean;
   record: boolean;
   backendValidation?: string;
@@ -197,11 +185,6 @@ async function handleRun(input: {
   if (input.model && input.models) {
     throw new Error("Use either --model or --models, not both");
   }
-  if (input.mode === "cli" && input.transport === "proxy") {
-    throw new Error(
-      "--transport proxy is only supported for flow, script, and app modes",
-    );
-  }
 
   const selectedCases = await loadSelectedCases(input.mode, input.caseIds);
   const models = resolveRequestedModels(input.mode, input.model, input.models);
@@ -220,6 +203,9 @@ async function handleRun(input: {
       "--backend-validation currently supports only flow and script modes",
     );
   }
+  if (input.mode !== "cli") {
+    await assertWindmillBackendReachable(resolveWindmillBackendSettings());
+  }
 
   const summaries: Array<{
     label: string;
@@ -249,7 +235,6 @@ async function handleRun(input: {
             caseIds: input.caseIds,
             runs: input.runs,
             model: model.id,
-            transport: input.transport,
             verbose: input.verbose,
             backendValidation,
           });
diff --git a/ai_evals/core/backendValidation.ts b/ai_evals/core/backendValidation.ts
index 87094fd23f..1484aee2d4 100644
--- a/ai_evals/core/backendValidation.ts
+++ b/ai_evals/core/backendValidation.ts
@@ -13,9 +13,7 @@ export interface BackendValidationSettings {
   baseUrl: string;
   email: string;
   password: string;
-  keepWorkspaces: boolean;
   workspaceOverride?: string;
-  workspacePrefix: string;
   pollIntervalMs: number;
   maxWaitMs: number;
 }
diff --git a/ai_evals/core/frontendTransport.test.ts b/ai_evals/core/frontendTransport.test.ts
deleted file mode 100644
index 09ebd1b3a7..0000000000
--- a/ai_evals/core/frontendTransport.test.ts
+++ /dev/null
@@ -1,64 +0,0 @@
-import { afterEach, describe, expect, it } from "bun:test";
-import {
-  parseFrontendEvalTransport,
-  resolveFrontendEvalTransportSettings,
-} from "./frontendTransport";
-
-const ORIGINAL_ENV = {
-  WMILL_AI_EVAL_BACKEND_URL: process.env.WMILL_AI_EVAL_BACKEND_URL,
-};
-
-afterEach(() => {
-  if (ORIGINAL_ENV.WMILL_AI_EVAL_BACKEND_URL === undefined) {
-    delete process.env.WMILL_AI_EVAL_BACKEND_URL;
-  } else {
-    process.env.WMILL_AI_EVAL_BACKEND_URL =
-      ORIGINAL_ENV.WMILL_AI_EVAL_BACKEND_URL;
-  }
-});
-
-describe("parseFrontendEvalTransport", () => {
-  it("defaults to direct when unset", () => {
-    expect(parseFrontendEvalTransport(undefined)).toBe("direct");
-  });
-
-  it("accepts proxy explicitly", () => {
-    expect(parseFrontendEvalTransport("proxy")).toBe("proxy");
-  });
-
-  it("rejects unsupported values", () => {
-    expect(() => parseFrontendEvalTransport("worker")).toThrow(
-      "Unsupported frontend eval transport: worker",
-    );
-  });
-});
-
-describe("resolveFrontendEvalTransportSettings", () => {
-  it("includes backend settings for proxy transport", () => {
-    process.env.WMILL_AI_EVAL_BACKEND_URL = "http://127.0.0.1:8000/";
-
-    expect(
-      resolveFrontendEvalTransportSettings({
-        evalMode: "app",
-        requestedTransport: "proxy",
-      }),
-    ).toMatchObject({
-      transport: "proxy",
-      backend: {
-        baseUrl: "http://127.0.0.1:8000",
-      },
-    });
-  });
-
-  it("keeps direct transport for cli runs", () => {
-    expect(
-      resolveFrontendEvalTransportSettings({
-        evalMode: "cli",
-        requestedTransport: "direct",
-      }),
-    ).toEqual({
-      transport: "direct",
-      backend: undefined,
-    });
-  });
-});
diff --git a/ai_evals/core/frontendTransport.ts b/ai_evals/core/frontendTransport.ts
deleted file mode 100644
index fa78505113..0000000000
--- a/ai_evals/core/frontendTransport.ts
+++ /dev/null
@@ -1,49 +0,0 @@
-import type { EvalMode } from "./types";
-import type { WindmillBackendSettings } from "./windmillBackendSettings";
-import { resolveWindmillBackendSettings } from "./windmillBackendSettings";
-
-export const FRONTEND_EVAL_TRANSPORTS = ["direct", "proxy"] as const;
-
-export type FrontendEvalTransport = (typeof FRONTEND_EVAL_TRANSPORTS)[number];
-
-export interface FrontendEvalTransportSettings {
-  transport: FrontendEvalTransport;
-  backend?: WindmillBackendSettings;
-}
-
-export function parseFrontendEvalTransport(
-  value?: string | null,
-): FrontendEvalTransport {
-  const normalized = value?.trim().toLowerCase();
-
-  if (!normalized || normalized === "direct") {
-    return "direct";
-  }
-
-  if (normalized === "proxy") {
-    return "proxy";
-  }
-
-  throw new Error(
-    `Unsupported frontend eval transport: ${value}. Use one of: ${FRONTEND_EVAL_TRANSPORTS.join(", ")}`,
-  );
-}
-
-export function resolveFrontendEvalTransportSettings(input: {
-  evalMode: EvalMode;
-  requestedTransport?: string | null;
-}): FrontendEvalTransportSettings {
-  const transport = parseFrontendEvalTransport(input.requestedTransport);
-
-  if (transport === "proxy" && input.evalMode === "cli") {
-    throw new Error(
-      'Frontend eval transport "proxy" is only supported for flow, script, and app evals',
-    );
-  }
-
-  return {
-    transport,
-    backend:
-      transport === "proxy" ? resolveWindmillBackendSettings() : undefined,
-  };
-}
diff --git a/ai_evals/core/results.ts b/ai_evals/core/results.ts
index c5f6b8749b..e58840f911 100644
--- a/ai_evals/core/results.ts
+++ b/ai_evals/core/results.ts
@@ -74,7 +74,6 @@ export function buildRunResult(input: {
   mode: EvalMode;
   runs: number;
   runModel: string | null;
-  transport?: BenchmarkRunResult["transport"];
   judgeModel: string | null;
   caseResults: BenchmarkCaseResult[];
 }): BenchmarkRunResult {
@@ -116,7 +115,6 @@ export function buildRunResult(input: {
     gitSha: getGitSha(),
     runs: input.runs,
     runModel: input.runModel,
-    transport: input.transport ?? null,
     judgeModel: input.judgeModel,
     caseCount: input.caseResults.length,
     attemptCount,
@@ -142,9 +140,6 @@ export function formatRunSummary(result: BenchmarkRunResult): string {
     `Pass rate: ${formatPercent(result.passRate)} (${result.passedAttempts}/${result.attemptCount})`,
     `Average duration: ${Math.round(result.averageDurationMs)}ms`,
   ];
-  if (result.transport) {
-    lines.splice(1, 0, `Transport: ${result.transport}`);
-  }
 
   const failures = collectFailures(result);
   if (failures.length > 0) {
@@ -251,7 +246,6 @@ function toHistoryRecord(result: BenchmarkRunResult) {
     mode: result.mode,
     runs: result.runs,
     runModel: result.runModel,
-    transport: result.transport,
     judgeModel: result.judgeModel,
     caseCount: result.caseCount,
     attemptCount: result.attemptCount,
diff --git a/ai_evals/core/types.ts b/ai_evals/core/types.ts
index 2d612be21a..dfc6882f84 100644
--- a/ai_evals/core/types.ts
+++ b/ai_evals/core/types.ts
@@ -1,7 +1,6 @@
 export const EVAL_MODES = ["cli", "flow", "script", "app"] as const;
 
 export type EvalMode = (typeof EVAL_MODES)[number];
-export type FrontendEvalTransport = "direct" | "proxy";
 
 export interface EvalCaseRuntimeBackendPreview {
   args?: Record<string, unknown>;
@@ -297,7 +296,6 @@ export interface BenchmarkRunResult {
   gitSha: string | null;
   runs: number;
   runModel: string | null;
-  transport: FrontendEvalTransport | null;
   judgeModel: string | null;
   caseCount: number;
   attemptCount: number;
diff --git a/ai_evals/core/windmillBackendSettings.test.ts b/ai_evals/core/windmillBackendSettings.test.ts
new file mode 100644
index 0000000000..200bc4aa7a
--- /dev/null
+++ b/ai_evals/core/windmillBackendSettings.test.ts
@@ -0,0 +1,63 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import { resolveWindmillBackendSettings } from "./windmillBackendSettings";
+
+const ENV_KEYS = [
+  "WMILL_AI_EVAL_BACKEND_URL",
+  "WINDMILL_URL",
+  "WINDMILL_BASE_URL",
+  "REMOTE",
+  "WMILL_AI_EVAL_BACKEND_EMAIL",
+  "WMILL_AI_EVAL_BACKEND_PASSWORD",
+  "WMILL_AI_EVAL_BACKEND_WORKSPACE",
+] as const;
+
+const ORIGINAL_ENV = Object.fromEntries(
+  ENV_KEYS.map((key) => [key, process.env[key]]),
+) as Record<(typeof ENV_KEYS)[number], string | undefined>;
+
+afterEach(() => {
+  for (const key of ENV_KEYS) {
+    const value = ORIGINAL_ENV[key];
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+});
+
+describe("resolveWindmillBackendSettings", () => {
+  it("uses backend URL/auth defaults and the optional explicit workspace", () => {
+    delete process.env.WMILL_AI_EVAL_BACKEND_URL;
+    delete process.env.WINDMILL_URL;
+    delete process.env.WINDMILL_BASE_URL;
+    delete process.env.REMOTE;
+    process.env.WMILL_AI_EVAL_BACKEND_WORKSPACE = "shared-evals";
+
+    expect(resolveWindmillBackendSettings()).toEqual({
+      baseUrl: "http://127.0.0.1:8000",
+      email: "admin@windmill.dev",
+      password: "changeme",
+      workspaceOverride: "shared-evals",
+    });
+  });
+
+  it("does not expose workspace retention knobs", () => {
+    process.env.WMILL_AI_EVAL_BACKEND_URL = "http://backend.test/";
+
+    const settings = resolveWindmillBackendSettings();
+
+    expect(settings).toEqual({
+      baseUrl: "http://backend.test",
+      email: "admin@windmill.dev",
+      password: "changeme",
+      workspaceOverride: undefined,
+    });
+    expect(Object.keys(settings).sort()).toEqual([
+      "baseUrl",
+      "email",
+      "password",
+      "workspaceOverride",
+    ]);
+  });
+});
diff --git a/ai_evals/core/windmillBackendSettings.ts b/ai_evals/core/windmillBackendSettings.ts
index c3a0a52d47..2388c32b4d 100644
--- a/ai_evals/core/windmillBackendSettings.ts
+++ b/ai_evals/core/windmillBackendSettings.ts
@@ -2,9 +2,7 @@ export interface WindmillBackendSettings {
   baseUrl: string;
   email: string;
   password: string;
-  keepWorkspaces: boolean;
   workspaceOverride?: string;
-  workspacePrefix: string;
 }
 
 export function resolveWindmillBackendSettings(): WindmillBackendSettings {
@@ -18,13 +16,9 @@ export function resolveWindmillBackendSettings(): WindmillBackendSettings {
     ),
     email: process.env.WMILL_AI_EVAL_BACKEND_EMAIL ?? "admin@windmill.dev",
     password: process.env.WMILL_AI_EVAL_BACKEND_PASSWORD ?? "changeme",
-    keepWorkspaces: isTruthy(process.env.WMILL_AI_EVAL_KEEP_WORKSPACES),
     workspaceOverride: sanitizeOptionalWorkspaceId(
       process.env.WMILL_AI_EVAL_BACKEND_WORKSPACE,
     ),
-    workspacePrefix: sanitizeWorkspacePrefix(
-      process.env.WMILL_AI_EVAL_WORKSPACE_PREFIX ?? "ai-evals",
-    ),
   };
 }
 
@@ -43,25 +37,9 @@ function normalizeBaseUrl(value: string): string {
   return value.replace(/\/+$/, "");
 }
 
-function sanitizeWorkspacePrefix(value: string): string {
-  const sanitized = value
-    .trim()
-    .toLowerCase()
-    .replace(/[^a-z0-9-]+/g, "-")
-    .replace(/^-+|-+$/g, "");
-  return sanitized.length > 0 ? sanitized : "ai-evals";
-}
-
 function sanitizeOptionalWorkspaceId(
   value: string | undefined,
 ): string | undefined {
   const trimmed = value?.trim();
   return trimmed ? trimmed : undefined;
 }
-
-function isTruthy(value: string | undefined): boolean {
-  if (!value) {
-    return false;
-  }
-  return ["1", "true", "yes", "on"].includes(value.trim().toLowerCase());
-}
diff --git a/ai_evals/modes/app.ts b/ai_evals/modes/app.ts
index 5bca0ad878..af9d7c667b 100644
--- a/ai_evals/modes/app.ts
+++ b/ai_evals/modes/app.ts
@@ -5,15 +5,12 @@ import type { FrontendEvalModelConfig } from "../core/models";
 import { validateAppState, type AppFilesState } from "../core/validators";
 import type { BenchmarkArtifactFile, ModeRunner } from "../core/types";
 import { runAppEval } from "../adapters/frontend/core/app/appEvalRunner";
-import {
-  DEFAULT_FRONTEND_EVAL_MODEL,
-  getFrontendApiKey,
-} from "./frontendCommon";
-import type { FrontendEvalTransportSettings } from "../core/frontendTransport";
+import { getFrontendApiKey } from "./frontendCommon";
+import type { WindmillBackendSettings } from "../core/windmillBackendSettings";
 
 export function createAppModeRunner(
-  modelConfig: FrontendEvalModelConfig = DEFAULT_FRONTEND_EVAL_MODEL,
-  transportSettings?: FrontendEvalTransportSettings,
+  modelConfig: FrontendEvalModelConfig,
+  backendSettings: WindmillBackendSettings,
 ): ModeRunner<AppFilesState, AppFilesState, AppFilesState> {
   return {
     mode: "app",
@@ -37,8 +34,7 @@ export function createAppModeRunner(
           appContext: context.evalCase?.runtime?.appContext,
           provider: modelConfig.provider,
           model: modelConfig.model,
-          transport: transportSettings?.transport,
-          backend: transportSettings?.backend,
+          backend: backendSettings,
           runContext: context,
         },
       );
diff --git a/ai_evals/modes/flow.ts b/ai_evals/modes/flow.ts
index 4e4f6451b9..e40a495573 100644
--- a/ai_evals/modes/flow.ts
+++ b/ai_evals/modes/flow.ts
@@ -7,11 +7,8 @@ import type { BenchmarkArtifactFile, ModeRunner } from "../core/types";
 import { runFlowEval } from "../adapters/frontend/core/flow/flowEvalRunner";
 import type { FlowWorkspaceFixtures } from "../adapters/frontend/core/flow/fileHelpers";
 import { BackendPreviewClient } from "../adapters/frontend/backendPreview";
-import {
-  DEFAULT_FRONTEND_EVAL_MODEL,
-  getFrontendApiKey,
-} from "./frontendCommon";
-import type { FrontendEvalTransportSettings } from "../core/frontendTransport";
+import { getFrontendApiKey } from "./frontendCommon";
+import type { WindmillBackendSettings } from "../core/windmillBackendSettings";
 import {
   normalizeFlowInitialFixture,
   normalizeFlowStateFixture,
@@ -19,9 +16,9 @@ import {
 } from "./flowFixtures";
 
 export function createFlowModeRunner(
-  modelConfig: FrontendEvalModelConfig = DEFAULT_FRONTEND_EVAL_MODEL,
-  backendValidation?: BackendValidationSettings,
-  transportSettings?: FrontendEvalTransportSettings,
+  modelConfig: FrontendEvalModelConfig,
+  backendValidation: BackendValidationSettings | undefined,
+  backendSettings: WindmillBackendSettings,
 ): ModeRunner<FlowInitialFixture, FlowState, FlowState> {
   return {
     mode: "flow",
@@ -49,8 +46,7 @@ export function createFlowModeRunner(
           maxIterations: context.evalCase?.runtime?.maxTurns,
           provider: modelConfig.provider,
           model: modelConfig.model,
-          transport: transportSettings?.transport,
-          backend: transportSettings?.backend,
+          backend: backendSettings,
           runContext: context,
         },
       );
diff --git a/ai_evals/modes/frontendCommon.ts b/ai_evals/modes/frontendCommon.ts
index 2619d21821..f121551d86 100644
--- a/ai_evals/modes/frontendCommon.ts
+++ b/ai_evals/modes/frontendCommon.ts
@@ -1,12 +1,4 @@
-import {
-  getFrontendEvalModel,
-  resolveEvalModel,
-  type FrontendEvalModelConfig,
-} from "../core/models";
-
-export const DEFAULT_FRONTEND_EVAL_MODEL: FrontendEvalModelConfig = getFrontendEvalModel(
-  resolveEvalModel("flow")
-);
+import type { FrontendEvalModelConfig } from "../core/models";
 
 export function getFrontendApiKey(provider: FrontendEvalModelConfig["provider"]): string {
   const envName =
diff --git a/ai_evals/modes/script.ts b/ai_evals/modes/script.ts
index 7671e8220a..0c49b05d7d 100644
--- a/ai_evals/modes/script.ts
+++ b/ai_evals/modes/script.ts
@@ -6,16 +6,13 @@ import type { BenchmarkArtifactFile, ModeRunner } from "../core/types";
 import { BackendPreviewClient } from "../adapters/frontend/backendPreview";
 import { runScriptEval } from "../adapters/frontend/core/script/scriptEvalRunner";
 import type { ScriptEvalState } from "../adapters/frontend/core/script/fileHelpers";
-import {
-  DEFAULT_FRONTEND_EVAL_MODEL,
-  getFrontendApiKey,
-} from "./frontendCommon";
-import type { FrontendEvalTransportSettings } from "../core/frontendTransport";
+import { getFrontendApiKey } from "./frontendCommon";
+import type { WindmillBackendSettings } from "../core/windmillBackendSettings";
 
 export function createScriptModeRunner(
-  modelConfig: FrontendEvalModelConfig = DEFAULT_FRONTEND_EVAL_MODEL,
-  backendValidation?: BackendValidationSettings,
-  transportSettings?: FrontendEvalTransportSettings,
+  modelConfig: FrontendEvalModelConfig,
+  backendValidation: BackendValidationSettings | undefined,
+  backendSettings: WindmillBackendSettings,
 ): ModeRunner<ScriptEvalState, ScriptEvalState, ScriptEvalState> {
   return {
     mode: "script",
@@ -40,8 +37,7 @@ export function createScriptModeRunner(
           maxIterations: context.evalCase?.runtime?.maxTurns,
           provider: modelConfig.provider,
           model: modelConfig.model,
-          transport: transportSettings?.transport,
-          backend: transportSettings?.backend,
+          backend: backendSettings,
           runContext: context,
         },
       );
diff --git a/backend/.sqlx/query-8b92a7d04fcdd8e61178d7dab97c31e10f89481908c479b4039af5e94fa0f8ac.json b/backend/.sqlx/query-290599fc173947acb518344d6fb631af9f524389309f17ef04f70c773b1d5e75.json
similarity index 85%
rename from backend/.sqlx/query-8b92a7d04fcdd8e61178d7dab97c31e10f89481908c479b4039af5e94fa0f8ac.json
rename to backend/.sqlx/query-290599fc173947acb518344d6fb631af9f524389309f17ef04f70c773b1d5e75.json
index 415544ece9..ad296e9eda 100644
--- a/backend/.sqlx/query-8b92a7d04fcdd8e61178d7dab97c31e10f89481908c479b4039af5e94fa0f8ac.json
+++ b/backend/.sqlx/query-290599fc173947acb518344d6fb631af9f524389309f17ef04f70c773b1d5e75.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        SELECT s.item_kind, s.path\n        FROM ws_specific s\n        WHERE s.workspace_id = $1\n          AND (\n              (s.item_kind = 'resource' AND EXISTS (\n                  SELECT 1 FROM resource r\n                  WHERE r.workspace_id = s.workspace_id AND r.path = s.path\n              ))\n              OR (s.item_kind = 'variable' AND EXISTS (\n                  SELECT 1 FROM variable v\n                  WHERE v.workspace_id = s.workspace_id AND v.path = s.path\n              ))\n          )\n        ",
+  "query": "\n        SELECT s.item_kind, s.path\n        FROM ws_specific s\n        WHERE s.workspace_id = $1\n          AND (\n              (s.item_kind = 'resource' AND EXISTS (\n                  SELECT 1 FROM resource r\n                  WHERE r.workspace_id = s.workspace_id AND r.path = s.path\n              ))\n              OR (s.item_kind = 'variable' AND EXISTS (\n                  SELECT 1 FROM variable v\n                  WHERE v.workspace_id = s.workspace_id AND v.path = s.path\n              ))\n          )\n        ORDER BY s.item_kind, s.path\n        ",
   "describe": {
     "columns": [
       {
@@ -24,5 +24,5 @@
       false
     ]
   },
-  "hash": "8b92a7d04fcdd8e61178d7dab97c31e10f89481908c479b4039af5e94fa0f8ac"
+  "hash": "290599fc173947acb518344d6fb631af9f524389309f17ef04f70c773b1d5e75"
 }
diff --git a/backend/.sqlx/query-6474dbc070afdce3e6bc74b02f93d94c27fcbbf989a4a70678dbc54e0d896e24.json b/backend/.sqlx/query-6474dbc070afdce3e6bc74b02f93d94c27fcbbf989a4a70678dbc54e0d896e24.json
new file mode 100644
index 0000000000..702e6e36bb
--- /dev/null
+++ b/backend/.sqlx/query-6474dbc070afdce3e6bc74b02f93d94c27fcbbf989a4a70678dbc54e0d896e24.json
@@ -0,0 +1,41 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT service_config, webhook_token_hash\n        FROM native_trigger\n        WHERE workspace_id = $1\n          AND service_name = $2\n          AND external_id = $3\n        FOR UPDATE SKIP LOCKED\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "service_config",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 1,
+        "name": "webhook_token_hash",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        {
+          "Custom": {
+            "name": "native_trigger_service",
+            "kind": {
+              "Enum": [
+                "nextcloud",
+                "google",
+                "github"
+              ]
+            }
+          }
+        },
+        "Text"
+      ]
+    },
+    "nullable": [
+      true,
+      false
+    ]
+  },
+  "hash": "6474dbc070afdce3e6bc74b02f93d94c27fcbbf989a4a70678dbc54e0d896e24"
+}
diff --git a/backend/.sqlx/query-406bcbf55758b10243c8eaff1c349b8082c0052d626bf67e08317e56ab9ad026.json b/backend/.sqlx/query-676405f5ba49c1c711646bd0882fb888d53c5e4aa53bfc43ca296863bc61813f.json
similarity index 62%
rename from backend/.sqlx/query-406bcbf55758b10243c8eaff1c349b8082c0052d626bf67e08317e56ab9ad026.json
rename to backend/.sqlx/query-676405f5ba49c1c711646bd0882fb888d53c5e4aa53bfc43ca296863bc61813f.json
index 2b5b68dfae..a1aa4cc015 100644
--- a/backend/.sqlx/query-406bcbf55758b10243c8eaff1c349b8082c0052d626bf67e08317e56ab9ad026.json
+++ b/backend/.sqlx/query-676405f5ba49c1c711646bd0882fb888d53c5e4aa53bfc43ca296863bc61813f.json
@@ -1,42 +1,32 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT label, email, scopes, workspace_id, super_admin, owner, expiration FROM token WHERE token_hash = $1",
+  "query": "SELECT email, scopes, workspace_id, super_admin, owner FROM token WHERE token_hash = $1",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "label",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
         "name": "email",
         "type_info": "Varchar"
       },
       {
-        "ordinal": 2,
+        "ordinal": 1,
         "name": "scopes",
         "type_info": "TextArray"
       },
       {
-        "ordinal": 3,
+        "ordinal": 2,
         "name": "workspace_id",
         "type_info": "Varchar"
       },
       {
-        "ordinal": 4,
+        "ordinal": 3,
         "name": "super_admin",
         "type_info": "Bool"
       },
       {
-        "ordinal": 5,
+        "ordinal": 4,
         "name": "owner",
         "type_info": "Varchar"
-      },
-      {
-        "ordinal": 6,
-        "name": "expiration",
-        "type_info": "Timestamptz"
       }
     ],
     "parameters": {
@@ -48,11 +38,9 @@
       true,
       true,
       true,
-      true,
       false,
-      true,
       true
     ]
   },
-  "hash": "406bcbf55758b10243c8eaff1c349b8082c0052d626bf67e08317e56ab9ad026"
+  "hash": "676405f5ba49c1c711646bd0882fb888d53c5e4aa53bfc43ca296863bc61813f"
 }
diff --git a/backend/.sqlx/query-6be4bf59c404d2f557d1106c48c320bb3eff65255a44bd66799ae14288312ba4.json b/backend/.sqlx/query-6be4bf59c404d2f557d1106c48c320bb3eff65255a44bd66799ae14288312ba4.json
deleted file mode 100644
index 0a39db6822..0000000000
--- a/backend/.sqlx/query-6be4bf59c404d2f557d1106c48c320bb3eff65255a44bd66799ae14288312ba4.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT EXISTS(SELECT 1 FROM variable WHERE workspace_id = $1 AND path = $2)",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "exists",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "6be4bf59c404d2f557d1106c48c320bb3eff65255a44bd66799ae14288312ba4"
-}
diff --git a/backend/.sqlx/query-9c85ba8d41bedbcb5466f44a7d4cf6b4946e1fd337f00d243f518283783833c9.json b/backend/.sqlx/query-9c85ba8d41bedbcb5466f44a7d4cf6b4946e1fd337f00d243f518283783833c9.json
new file mode 100644
index 0000000000..fce125c6d5
--- /dev/null
+++ b/backend/.sqlx/query-9c85ba8d41bedbcb5466f44a7d4cf6b4946e1fd337f00d243f518283783833c9.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT bool_and(operator) FROM (\n            SELECT operator FROM usr WHERE email = $1\n            UNION ALL\n            SELECT operator FROM workspace_invite WHERE email = $1\n        ) t",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "bool_and",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "9c85ba8d41bedbcb5466f44a7d4cf6b4946e1fd337f00d243f518283783833c9"
+}
diff --git a/backend/.sqlx/query-0c6e8f03a4e9f543cb85582e0aec1ed508d83695ef6d62ca06cfb612fd332b87.json b/backend/.sqlx/query-b02d3563b72ee8989dea128a3c6a2be62ce1f8f7edf3793d7ad4af9eb11b648f.json
similarity index 50%
rename from backend/.sqlx/query-0c6e8f03a4e9f543cb85582e0aec1ed508d83695ef6d62ca06cfb612fd332b87.json
rename to backend/.sqlx/query-b02d3563b72ee8989dea128a3c6a2be62ce1f8f7edf3793d7ad4af9eb11b648f.json
index 7de0416a12..3536567e16 100644
--- a/backend/.sqlx/query-0c6e8f03a4e9f543cb85582e0aec1ed508d83695ef6d62ca06cfb612fd332b87.json
+++ b/backend/.sqlx/query-b02d3563b72ee8989dea128a3c6a2be62ce1f8f7edf3793d7ad4af9eb11b648f.json
@@ -1,17 +1,17 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT item_kind, path FROM ws_specific WHERE workspace_id = $1",
+  "query": "SELECT label, expiration FROM token WHERE token_hash = $1",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "item_kind",
+        "name": "label",
         "type_info": "Varchar"
       },
       {
         "ordinal": 1,
-        "name": "path",
-        "type_info": "Varchar"
+        "name": "expiration",
+        "type_info": "Timestamptz"
       }
     ],
     "parameters": {
@@ -20,9 +20,9 @@
       ]
     },
     "nullable": [
-      false,
-      false
+      true,
+      true
     ]
   },
-  "hash": "0c6e8f03a4e9f543cb85582e0aec1ed508d83695ef6d62ca06cfb612fd332b87"
+  "hash": "b02d3563b72ee8989dea128a3c6a2be62ce1f8f7edf3793d7ad4af9eb11b648f"
 }
diff --git a/backend/.sqlx/query-b4162468afae99cf31c4668ca6769657fd73742b6ee8289b1e9736e381314cfb.json b/backend/.sqlx/query-b4162468afae99cf31c4668ca6769657fd73742b6ee8289b1e9736e381314cfb.json
deleted file mode 100644
index 327032afb5..0000000000
--- a/backend/.sqlx/query-b4162468afae99cf31c4668ca6769657fd73742b6ee8289b1e9736e381314cfb.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT EXISTS(SELECT 1 FROM ws_specific WHERE workspace_id = $1 AND item_kind = 'variable' AND path = $2)",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "exists",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "b4162468afae99cf31c4668ca6769657fd73742b6ee8289b1e9736e381314cfb"
-}
diff --git a/backend/.sqlx/query-e1ada31c1625b453c2ff85edbcd7ad51a4cd5cbdc2fa34038530070d6a579455.json b/backend/.sqlx/query-e1ada31c1625b453c2ff85edbcd7ad51a4cd5cbdc2fa34038530070d6a579455.json
new file mode 100644
index 0000000000..f38c023cb3
--- /dev/null
+++ b/backend/.sqlx/query-e1ada31c1625b453c2ff85edbcd7ad51a4cd5cbdc2fa34038530070d6a579455.json
@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH potential AS (\n            SELECT email, operator FROM usr\n            UNION\n            SELECT email, operator FROM workspace_invite\n        ),\n        per_user AS (\n            SELECT email, bool_and(operator) AS only_operator FROM potential GROUP BY email\n        )\n        SELECT\n            COUNT(*) FILTER (WHERE NOT only_operator) AS \"authors!\",\n            COUNT(*) FILTER (WHERE only_operator) AS \"operators!\"\n        FROM per_user",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "authors!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "operators!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null,
+      null
+    ]
+  },
+  "hash": "e1ada31c1625b453c2ff85edbcd7ad51a4cd5cbdc2fa34038530070d6a579455"
+}
diff --git a/backend/.sqlx/query-f8f756bc498e5f084851f98e1e8d8c74cdc672a903d566baf5ac5ef50a4da1bd.json b/backend/.sqlx/query-f8f756bc498e5f084851f98e1e8d8c74cdc672a903d566baf5ac5ef50a4da1bd.json
new file mode 100644
index 0000000000..e4125ddab9
--- /dev/null
+++ b/backend/.sqlx/query-f8f756bc498e5f084851f98e1e8d8c74cdc672a903d566baf5ac5ef50a4da1bd.json
@@ -0,0 +1,32 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT memory, worker, native_mode FROM worker_ping WHERE ping_at > now() - interval '2 minutes'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "memory",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "worker",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "native_mode",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      true,
+      false,
+      false
+    ]
+  },
+  "hash": "f8f756bc498e5f084851f98e1e8d8c74cdc672a903d566baf5ac5ef50a4da1bd"
+}
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index c6bf144004..00e8959f72 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -2,16 +2,6 @@
 # It is not intended for manual editing.
 version = 4
 
-[[package]]
-name = "Inflector"
-version = "0.11.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe438c63458706e03479442743baae6c88256498e6431708f6dfc520a26515d3"
-dependencies = [
- "lazy_static",
- "regex",
-]
-
 [[package]]
 name = "addr2line"
 version = "0.25.1"
@@ -21,12 +11,6 @@ dependencies = [
  "gimli",
 ]
 
-[[package]]
-name = "adler"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
-
 [[package]]
 name = "adler2"
 version = "2.0.1"
@@ -39,24 +23,10 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
 dependencies = [
- "crypto-common 0.1.7",
+ "crypto-common",
  "generic-array",
 ]
 
-[[package]]
-name = "aead-gcm-stream"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e70c8dec860340effb00f6945c49c0daaa6dac963602750db862eabb74bf7886"
-dependencies = [
- "aead",
- "aes 0.8.3",
- "cipher 0.4.4",
- "ctr",
- "ghash",
- "subtle",
-]
-
 [[package]]
 name = "aes"
 version = "0.7.5"
@@ -71,9 +41,9 @@ dependencies = [
 
 [[package]]
 name = "aes"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac1f845298e95f983ff1944b728ae08b8cebab80d684f0a832ed0fc74dfa27e2"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
 dependencies = [
  "cfg-if",
  "cipher 0.4.4",
@@ -87,22 +57,13 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
 dependencies = [
  "aead",
- "aes 0.8.3",
+ "aes 0.8.4",
  "cipher 0.4.4",
  "ctr",
  "ghash",
  "subtle",
 ]
 
-[[package]]
-name = "aes-kw"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69fa2b352dcefb5f7f3a5fb840e02665d311d878955380515e4fd50095dd3d8c"
-dependencies = [
- "aes 0.8.3",
-]
-
 [[package]]
 name = "ahash"
 version = "0.7.8"
@@ -279,9 +240,6 @@ name = "arrayvec"
 version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
-dependencies = [
- "serde",
-]
 
 [[package]]
 name = "arrow"
@@ -494,29 +452,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "ash"
-version = "0.37.3+1.3.251"
+name = "ascii"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39e9c3835d686b0a6084ab4234fcd1b07dbf6e4767dce60874b12356a25ecd4a"
-dependencies = [
- "libloading 0.7.4",
-]
-
-[[package]]
-name = "asn1-rs"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f6fd5ddaf0351dff5b8da21b2fb4ff8e08ddd02857f0bf69c47639106c0fff0"
-dependencies = [
- "asn1-rs-derive 0.4.0",
- "asn1-rs-impl 0.1.0",
- "displaydoc",
- "nom 7.1.3",
- "num-traits",
- "rusticata-macros",
- "thiserror 1.0.69",
- "time",
-]
+checksum = "d92bec98840b8f03a5ff5413de5293bfcd8bf96467cf5452609f939ec6f5de16"
 
 [[package]]
 name = "asn1-rs"
@@ -524,28 +463,16 @@ version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5493c3bedbacf7fd7382c6346bbd66687d12bbaad3a89a2d2c303ee6cf20b048"
 dependencies = [
- "asn1-rs-derive 0.5.1",
- "asn1-rs-impl 0.2.0",
+ "asn1-rs-derive",
+ "asn1-rs-impl",
  "displaydoc",
- "nom 7.1.3",
+ "nom",
  "num-traits",
  "rusticata-macros",
  "thiserror 1.0.69",
  "time",
 ]
 
-[[package]]
-name = "asn1-rs-derive"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "726535892e8eae7e70657b4c8ea93d26b8553afb1ce617caee529ef96d7dee6c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
- "synstructure 0.12.6",
-]
-
 [[package]]
 name = "asn1-rs-derive"
 version = "0.5.1"
@@ -555,18 +482,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.117",
- "synstructure 0.13.2",
-]
-
-[[package]]
-name = "asn1-rs-impl"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2777730b2039ac0f95f093556e61b6d26cebed5393ca6f152717777cec3a42ed"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
+ "synstructure",
 ]
 
 [[package]]
@@ -582,11 +498,10 @@ dependencies = [
 
 [[package]]
 name = "ast_node"
-version = "0.9.9"
+version = "3.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9184f2b369b3e8625712493c89b785881f27eedc6cde480a81883cef78868b2"
+checksum = "0a184645bcc6f52d69d8e7639720699c6a99efb711f886e251ed1d16db8dd90e"
 dependencies = [
- "proc-macro2",
  "quote",
  "swc_macros_common",
  "syn 2.0.117",
@@ -1137,7 +1052,7 @@ dependencies = [
  "bytes",
  "form_urlencoded",
  "hex",
- "hmac 0.12.1",
+ "hmac",
  "http 0.2.12",
  "http 1.4.0",
  "percent-encoding",
@@ -1326,7 +1241,7 @@ version = "1.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "576b0d6991c9c32bc14fc340582ef148311f924d41815f641a308b5d11e8e7cd"
 dependencies = [
- "base64-simd 0.8.0",
+ "base64-simd",
  "bytes",
  "bytes-utils",
  "futures-core",
@@ -1408,9 +1323,9 @@ dependencies = [
 
 [[package]]
 name = "axum"
-version = "0.8.4"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "021e862c184ae977658b36c4500f7feac3221ca5da43e3f25bd04ab6c79a29b5"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
 dependencies = [
  "axum-core 0.5.6",
  "axum-macros",
@@ -1429,8 +1344,7 @@ dependencies = [
  "multer",
  "percent-encoding",
  "pin-project-lite",
- "rustversion",
- "serde",
+ "serde_core",
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
@@ -1518,7 +1432,7 @@ dependencies = [
  "addr2line",
  "cfg-if",
  "libc",
- "miniz_oxide 0.8.9",
+ "miniz_oxide",
  "object",
  "rustc-demangle",
  "windows-link 0.2.1",
@@ -1554,22 +1468,13 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
-[[package]]
-name = "base64-simd"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "781dd20c3aff0bd194fe7d2a977dd92f21c173891f3a03b677359e5fa457e5d5"
-dependencies = [
- "simd-abstraction",
-]
-
 [[package]]
 name = "base64-simd"
 version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "339abbe78e73178762e23bea9dfd08e697eb3f3301cd4be981c0f78ba5859195"
 dependencies = [
- "outref 0.5.2",
+ "outref",
  "vsimd",
 ]
 
@@ -1581,9 +1486,9 @@ checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
 [[package]]
 name = "better_scoped_tls"
-version = "0.1.2"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "297b153aa5e573b5863108a6ddc9d5c968bd0b20e75cc614ee9821d2f45679c7"
+checksum = "7cd228125315b132eed175bf47619ac79b945b26e56b848ba203ae4ea8603609"
 dependencies = [
  "scoped-tls",
 ]
@@ -1610,33 +1515,13 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "bindgen"
-version = "0.70.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f49d8fed880d473ea71efb9bf597651e77201bdd4893efe54c9e5d65ae04ce6f"
-dependencies = [
- "bitflags 2.9.4",
- "cexpr",
- "clang-sys",
- "itertools 0.13.0",
- "log",
- "prettyplease",
- "proc-macro2",
- "quote",
- "regex",
- "rustc-hash 1.1.0",
- "shlex",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "bindgen"
 version = "0.71.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5f58bf3d7db68cfbac37cfc485a8d711e87e064c3d0fe0435b92f7a407f9d6b3"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "cexpr",
  "clang-sys",
  "itertools 0.13.0",
@@ -1656,7 +1541,7 @@ version = "0.72.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "cexpr",
  "clang-sys",
  "itertools 0.13.0",
@@ -1670,15 +1555,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "bit-set"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0700ddab506f33b20a03b13996eccd309a48e5ff77d0d95926aa0210fb4e95f1"
-dependencies = [
- "bit-vec 0.6.3",
-]
-
 [[package]]
 name = "bit-set"
 version = "0.8.0"
@@ -1708,11 +1584,11 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.9.4"
+version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2261d10cca569e4643e526d8dc2e62e433cc8aba21ab764233731f8d369bf394"
+checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
 dependencies = [
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -1759,19 +1635,13 @@ dependencies = [
  "cpufeatures 0.3.0",
 ]
 
-[[package]]
-name = "block"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d8c1fef690941d3e7788d328517591fecc684c084084702d6ff1641e993699a"
-
 [[package]]
 name = "block-buffer"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
 dependencies = [
- "block-padding 0.2.1",
+ "block-padding",
  "generic-array",
 ]
 
@@ -1784,22 +1654,13 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "block-buffer"
-version = "0.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be"
-dependencies = [
- "hybrid-array",
-]
-
 [[package]]
 name = "block-modes"
 version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2cb03d1bed155d89dce0f845b7899b18a9a163e148fd004e1c28421a783e2d8e"
 dependencies = [
- "block-padding 0.2.1",
+ "block-padding",
  "cipher 0.3.0",
 ]
 
@@ -1809,15 +1670,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8d696c370c750c948ada61c69a0ee2cbbb9c50b1019ddb86d9317157a99c2cae"
 
-[[package]]
-name = "block-padding"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
-dependencies = [
- "generic-array",
-]
-
 [[package]]
 name = "bollard"
 version = "0.18.1"
@@ -1895,7 +1747,7 @@ checksum = "cfd1e3f8955a5d7de9fab72fc8373fade9fb8a703968cb200ae3dc6cf08e185a"
 dependencies = [
  "borsh-derive",
  "bytes",
- "cfg_aliases 0.2.1",
+ "cfg_aliases",
 ]
 
 [[package]]
@@ -1921,17 +1773,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "brotli"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74f7971dbd9326d58187408ab83117d8ac1bb9c17b085fdacd1cf2f598719b6b"
-dependencies = [
- "alloc-no-stdlib",
- "alloc-stdlib",
- "brotli-decompressor 4.0.3",
-]
-
 [[package]]
 name = "brotli"
 version = "7.0.0"
@@ -1974,6 +1815,15 @@ dependencies = [
  "alloc-stdlib",
 ]
 
+[[package]]
+name = "bs58"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4"
+dependencies = [
+ "tinyvec",
+]
+
 [[package]]
 name = "bstr"
 version = "1.12.1"
@@ -2072,6 +1922,16 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "bytes-str"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c60b5ce37e0b883c37eb89f79a1e26fbe9c1081945d024eee93e8d91a7e18b3"
+dependencies = [
+ "bytes",
+ "serde",
+]
+
 [[package]]
 name = "bytes-utils"
 version = "0.1.4"
@@ -2107,12 +1967,6 @@ dependencies = [
  "pkg-config",
 ]
 
-[[package]]
-name = "cache_control"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bf2a5fb3207c12b5d208ebc145f967fea5cac41a021c37417ccc31ba40f39ee"
-
 [[package]]
 name = "candle-core"
 version = "0.9.2"
@@ -2124,7 +1978,7 @@ dependencies = [
  "gemm",
  "half",
  "libm",
- "memmap2 0.9.10",
+ "memmap2",
  "num-traits",
  "num_cpus",
  "rand 0.9.0",
@@ -2132,7 +1986,7 @@ dependencies = [
  "rayon",
  "safetensors",
  "thiserror 2.0.18",
- "yoke 0.8.2",
+ "yoke",
  "zip",
 ]
 
@@ -2171,15 +2025,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "capacity_builder"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58ec49028cb308564429cd8fac4ef21290067a0afe8f5955330a8d487d0d790c"
-dependencies = [
- "itoa",
-]
-
 [[package]]
 name = "capacity_builder"
 version = "0.5.0"
@@ -2187,8 +2032,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f2d24a6dcf0cd402a21b65d35340f3a49ff3475dc5fdac91d22d2733e6641c6"
 dependencies = [
  "capacity_builder_macros",
- "ecow",
- "hipstr",
  "itoa",
 ]
 
@@ -2203,19 +2046,19 @@ dependencies = [
 ]
 
 [[package]]
-name = "cbc"
-version = "0.1.2"
+name = "castaway"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
+checksum = "dec551ab6e7578819132c713a93c022a05d60159dc86e7a7050223577484c55a"
 dependencies = [
- "cipher 0.4.4",
+ "rustversion",
 ]
 
 [[package]]
 name = "cc"
-version = "1.2.61"
+version = "1.2.62"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d"
+checksum = "a1dce859f0832a7d088c4f1119888ab94ef4b5d6795d1ce05afb7fe159d79f98"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -2241,7 +2084,7 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
 dependencies = [
- "nom 7.1.3",
+ "nom",
 ]
 
 [[package]]
@@ -2250,12 +2093,6 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
-[[package]]
-name = "cfg_aliases"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd16c4719339c4530435d38e511904438d07cce7950afa3718a84ac36c10e89e"
-
 [[package]]
 name = "cfg_aliases"
 version = "0.2.1"
@@ -2322,7 +2159,7 @@ version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
- "crypto-common 0.1.7",
+ "crypto-common",
  "inout",
 ]
 
@@ -2334,7 +2171,7 @@ checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
 dependencies = [
  "glob",
  "libc",
- "libloading 0.8.9",
+ "libloading",
 ]
 
 [[package]]
@@ -2377,15 +2214,6 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 
-[[package]]
-name = "clipboard-win"
-version = "5.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bde03770d3df201d4fb868f2c9c59e66a3e4e2bd06692a0fe701e7103c7e84d4"
-dependencies = [
- "error-code",
-]
-
 [[package]]
 name = "cmake"
 version = "0.1.58"
@@ -2395,49 +2223,6 @@ dependencies = [
  "cc",
 ]
 
-[[package]]
-name = "cmov"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f88a43d011fc4a6876cb7344703e297c71dda42494fee094d5f7c76bf13f746"
-
-[[package]]
-name = "codespan-reporting"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3538270d33cc669650c4b093848450d380def10c331d38c768e34cac80576e6e"
-dependencies = [
- "termcolor",
- "unicode-width 0.1.14",
-]
-
-[[package]]
-name = "color-print"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3aa954171903797d5623e047d9ab69d91b493657917bdfb8c2c80ecaf9cdb6f4"
-dependencies = [
- "color-print-proc-macro",
-]
-
-[[package]]
-name = "color-print-proc-macro"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "692186b5ebe54007e45a59aea47ece9eb4108e141326c304cdc91699a7118a22"
-dependencies = [
- "nom 7.1.3",
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
-[[package]]
-name = "color_quant"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
-
 [[package]]
 name = "colorchoice"
 version = "1.0.5"
@@ -2464,6 +2249,19 @@ dependencies = [
  "unicode-width 0.2.2",
 ]
 
+[[package]]
+name = "compact_str"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f86b9c4c00838774a6d902ef931eff7470720c51d90c2e32cfe15dc304737b3f"
+dependencies = [
+ "castaway",
+ "cfg-if",
+ "itoa",
+ "ryu",
+ "static_assertions",
+]
+
 [[package]]
 name = "concurrent-queue"
 version = "2.5.0"
@@ -2498,12 +2296,6 @@ version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
-[[package]]
-name = "const-oid"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
-
 [[package]]
 name = "const-random"
 version = "0.1.18"
@@ -2624,17 +2416,6 @@ version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
-[[package]]
-name = "core-graphics-types"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45390e6114f68f718cc7a830514a96f903cccd70d02a8f6d9f643ac4ba45afaf"
-dependencies = [
- "bitflags 1.3.2",
- "core-foundation 0.9.4",
- "libc",
-]
-
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -2788,25 +2569,16 @@ dependencies = [
  "typenum",
 ]
 
-[[package]]
-name = "crypto-common"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77727bb15fa921304124b128af125e7e3b968275d1b108b379190264f4423710"
-dependencies = [
- "hybrid-array",
-]
-
 [[package]]
 name = "csv"
-version = "1.3.1"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acdc4883a9c96732e4733212c01447ebd805833b7275a73ca3ee080fd77afdaf"
+checksum = "52cd9d68cf7efc6ddfaaee42e7288d3a99d613d4b50f76ce9827ae0c6e14f938"
 dependencies = [
  "csv-core",
  "itoa",
  "ryu",
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -2827,15 +2599,6 @@ dependencies = [
  "cipher 0.4.4",
 ]
 
-[[package]]
-name = "ctutils"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
-dependencies = [
- "cmov",
-]
-
 [[package]]
 name = "curl-sys"
 version = "0.4.88+curl-8.20.0"
@@ -2861,7 +2624,7 @@ dependencies = [
  "cpufeatures 0.2.17",
  "curve25519-dalek-derive",
  "digest 0.10.7",
- "fiat-crypto 0.2.9",
+ "fiat-crypto",
  "rustc_version 0.4.1",
  "subtle",
  "zeroize",
@@ -2878,17 +2641,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "d3d12"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b28bfe653d79bd16c77f659305b195b82bb5ce0c0eb2a4846b82ddbd77586813"
-dependencies = [
- "bitflags 2.9.4",
- "libloading 0.8.9",
- "winapi",
-]
-
 [[package]]
 name = "darling"
 version = "0.13.4"
@@ -2919,16 +2671,6 @@ dependencies = [
  "darling_macro 0.20.11",
 ]
 
-[[package]]
-name = "darling"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cdf337090841a411e2a7f3deb9187445851f91b309c0c0a29e05f74a00a48c0"
-dependencies = [
- "darling_core 0.21.3",
- "darling_macro 0.21.3",
-]
-
 [[package]]
 name = "darling"
 version = "0.23.0"
@@ -2981,20 +2723,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "darling_core"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1247195ecd7e3c85f83c8d2a366e4210d588e802133e1e355180a9870b517ea4"
-dependencies = [
- "fnv",
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim 0.11.1",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "darling_core"
 version = "0.23.0"
@@ -3041,17 +2769,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "darling_macro"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81"
-dependencies = [
- "darling_core 0.21.3",
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "darling_macro"
 version = "0.23.0"
@@ -3063,19 +2780,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "dashmap"
-version = "5.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "978747c1d849a7d2ee5e8adc0159961c48fb7e5db2f06af6723b80123bb53856"
-dependencies = [
- "cfg-if",
- "hashbrown 0.14.5",
- "lock_api",
- "once_cell",
- "parking_lot_core",
-]
-
 [[package]]
 name = "dashmap"
 version = "6.1.0"
@@ -3165,7 +2869,7 @@ checksum = "61fe34f401bd03724a1f96d12108144f8cd495a3cdda2bf5e091822fb80b7e66"
 dependencies = [
  "arrow",
  "async-trait",
- "dashmap 6.1.0",
+ "dashmap",
  "datafusion-common",
  "datafusion-common-runtime",
  "datafusion-datasource",
@@ -3371,7 +3075,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06f004d100f49a3658c9da6fb0c3a9b760062d96cd4ad82ccc3b7b69a9fb2f84"
 dependencies = [
  "arrow",
- "dashmap 6.1.0",
+ "dashmap",
  "datafusion-common",
  "datafusion-expr",
  "futures",
@@ -3667,7 +3371,7 @@ checksum = "ad229a134c7406c057ece00c8743c0c34b97f4e72f78b475fe17b66c5e14fa4f"
 dependencies = [
  "arrow",
  "async-trait",
- "dashmap 6.1.0",
+ "dashmap",
  "datafusion-common",
  "datafusion-common-runtime",
  "datafusion-execution",
@@ -3724,19 +3428,18 @@ dependencies = [
 
 [[package]]
 name = "deno_ast"
-version = "0.44.0"
+version = "0.51.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eebc7aaabfdb3ddcad32aee1b62d250149dc8b35dfbdccbb125df2bdc62da952"
+checksum = "c72e0409b3dbd60a5bf296cbc273a8e36bb3a3aab6abac389f1891e187d5ce14"
 dependencies = [
- "base64 0.21.7",
- "deno_error",
+ "base64 0.22.1",
+ "capacity_builder",
+ "deno_error 0.7.3",
  "deno_media_type",
  "deno_terminal",
  "dprint-swc-ext",
- "once_cell",
  "percent-encoding",
  "serde",
- "sourcemap 9.3.2",
  "swc_atoms",
  "swc_common",
  "swc_config",
@@ -3744,6 +3447,7 @@ dependencies = [
  "swc_ecma_ast",
  "swc_ecma_codegen",
  "swc_ecma_codegen_macros",
+ "swc_ecma_lexer",
  "swc_ecma_loader",
  "swc_ecma_parser",
  "swc_ecma_transforms_base",
@@ -3756,146 +3460,45 @@ dependencies = [
  "swc_ecma_visit",
  "swc_eq_ignore_macros",
  "swc_macros_common",
+ "swc_sourcemap",
  "swc_visit",
- "swc_visit_macros",
  "text_lines",
  "thiserror 2.0.18",
- "unicode-width 0.1.14",
- "url",
-]
-
-[[package]]
-name = "deno_broadcast_channel"
-version = "0.184.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33db5dacb54c6fda4c5ea4103c5687b76a51202343379af8b21120ba9d20f3c2"
-dependencies = [
- "async-trait",
- "deno_core",
- "deno_error",
- "thiserror 2.0.18",
- "tokio",
- "uuid",
-]
-
-[[package]]
-name = "deno_cache"
-version = "0.122.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0daca6ec4e6142a994d38e7bc587dda7948fa00e6194b671a5d4340f5a918a3"
-dependencies = [
- "async-trait",
- "deno_core",
- "deno_error",
- "rusqlite",
- "serde",
- "sha2 0.10.9",
- "thiserror 2.0.18",
- "tokio",
-]
-
-[[package]]
-name = "deno_cache_dir"
-version = "0.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27429da4d0e601baaa41415a43468d49a586645d13497f12e8a9346f9f6b1347"
-dependencies = [
- "async-trait",
- "base32",
- "base64 0.21.7",
- "boxed_error",
- "cache_control",
- "chrono",
- "data-url",
- "deno_error",
- "deno_media_type",
- "deno_path_util",
- "http 1.4.0",
- "indexmap 2.14.0",
- "log",
- "once_cell",
- "parking_lot",
- "serde",
- "serde_json",
- "sha2 0.10.9",
- "sys_traits",
- "thiserror 1.0.69",
- "url",
-]
-
-[[package]]
-name = "deno_canvas"
-version = "0.59.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35ca8f93d60d96d6f6cb0da632303afb98567accf07d9b6f8d2ef88617589d9e"
-dependencies = [
- "deno_core",
- "deno_error",
- "deno_webgpu",
- "image",
- "serde",
- "thiserror 2.0.18",
-]
-
-[[package]]
-name = "deno_config"
-version = "0.46.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08fe512a72c4300bd997c6849450a1f050da0c909a2a4fbdc44891647392bacf"
-dependencies = [
- "boxed_error",
- "capacity_builder 0.5.0",
- "deno_error",
- "deno_package_json",
- "deno_path_util",
- "deno_semver",
- "glob",
- "ignore",
- "import_map",
- "indexmap 2.14.0",
- "jsonc-parser",
- "log",
- "percent-encoding",
- "phf 0.11.3",
- "serde",
- "serde_json",
- "sys_traits",
- "thiserror 2.0.18",
+ "unicode-width 0.2.2",
  "url",
 ]
 
 [[package]]
 name = "deno_console"
-version = "0.190.0"
+version = "0.209.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94352b8d75c288a26ef748ad0ddae07e181109374a02c547850f96eef76b5389"
+checksum = "66c0b8a65dcb7b38c22e5969c6454b3cb0839b7dcfb7a4f0d904de871a4c4416"
 dependencies = [
  "deno_core",
 ]
 
 [[package]]
 name = "deno_core"
-version = "0.336.0"
+version = "0.352.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdd50476c4325d5fa52bb906804a1e35b127d2a1dcf674e3447b53dcf25525bf"
+checksum = "bf78f3f72ac8e09b18a588bc26a1b3c5ab853e7fb489889b2f5000654d34db5d"
 dependencies = [
  "anyhow",
  "az",
  "bincode",
- "bit-set 0.5.3",
- "bit-vec 0.6.3",
+ "bit-set",
+ "bit-vec 0.8.0",
  "bytes",
- "capacity_builder 0.1.3",
+ "capacity_builder",
  "cooked-waker",
  "deno_core_icudata",
- "deno_error",
+ "deno_error 0.6.1",
  "deno_ops",
  "deno_path_util",
  "deno_unsync",
  "futures",
  "indexmap 2.14.0",
  "libc",
- "memoffset",
  "parking_lot",
  "percent-encoding",
  "pin-project",
@@ -3903,7 +3506,7 @@ dependencies = [
  "serde_json",
  "serde_v8",
  "smallvec",
- "sourcemap 8.0.1",
+ "sourcemap",
  "static_assertions",
  "thiserror 2.0.18",
  "tokio",
@@ -3918,69 +3521,13 @@ version = "0.74.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fe4dccb6147bb3f3ba0c7a48e993bfeb999d2c2e47a81badee80e2b370c8d695"
 
-[[package]]
-name = "deno_cron"
-version = "0.70.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8ec283bef14bcf655b209619766bdeab67f2a5e093991cca73f5d502f7bf6e8"
-dependencies = [
- "anyhow",
- "async-trait",
- "chrono",
- "deno_core",
- "deno_error",
- "saffron",
- "thiserror 2.0.18",
- "tokio",
-]
-
-[[package]]
-name = "deno_crypto"
-version = "0.204.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f0493142a437e49b46aa8e08d715942076ff48c3cb776f0b015b4224ed0d37a"
-dependencies = [
- "aes 0.8.3",
- "aes-gcm",
- "aes-kw",
- "base64 0.21.7",
- "cbc",
- "const-oid 0.9.6",
- "ctr",
- "curve25519-dalek",
- "deno_core",
- "deno_error",
- "deno_web",
- "ed448-goldilocks",
- "elliptic-curve",
- "num-traits",
- "once_cell",
- "p256",
- "p384",
- "p521",
- "rand 0.8.5",
- "ring 0.17.14",
- "rsa",
- "sec1",
- "serde",
- "serde_bytes",
- "sha1",
- "sha2 0.10.9",
- "signature",
- "spki",
- "thiserror 2.0.18",
- "tokio",
- "uuid",
- "x25519-dalek",
-]
-
 [[package]]
 name = "deno_error"
-version = "0.5.5"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c23dbc46d5804814b08b4675838f9884e3a52916987ec5105af36d42f9911b5"
+checksum = "612ec3fc481fea759141b0c57810889b0a4fb6fee8f10748677bfe492fd30486"
 dependencies = [
- "deno_error_macro",
+ "deno_error_macro 0.6.1",
  "libc",
  "serde",
  "serde_json",
@@ -3989,10 +3536,20 @@ dependencies = [
 ]
 
 [[package]]
-name = "deno_error_macro"
-version = "0.5.5"
+name = "deno_error"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "babccedee31ce7e57c3e6dff2cb3ab8d68c49d0df8222fe0d11d628e65192790"
+checksum = "3007d3f1ea92ea503324ae15883aac0c2de2b8cf6fead62203ff6a67161007ab"
+dependencies = [
+ "deno_error_macro 0.7.3",
+ "libc",
+]
+
+[[package]]
+name = "deno_error_macro"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8380a4224d5d2c3f84da4d764c4326cac62e9a1e3d4960442d29136fc07be863"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4000,16 +3557,38 @@ dependencies = [
 ]
 
 [[package]]
-name = "deno_fetch"
-version = "0.214.0"
+name = "deno_error_macro"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3df032ca1f7f06a5cc459189b960793f64d415ddc9f59f262e0ad5059865002d"
+checksum = "9b565e60a9685cdf312c888665b5f8647ac692a7da7e058a5e2268a466da8eaf"
 dependencies = [
- "base64 0.21.7",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "deno_features"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "487773bb24b92f3b88d1c9ef0d4d15888641a2e2ea4d4cdfd6fda12cae26317c"
+dependencies = [
+ "deno_core",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "deno_fetch"
+version = "0.233.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cbe158bec955790105ded69978b1245b97c65092f7bf184add344c0e78efffa"
+dependencies = [
+ "base64 0.22.1",
  "bytes",
  "data-url",
  "deno_core",
- "deno_error",
+ "deno_error 0.6.1",
  "deno_fs",
  "deno_path_util",
  "deno_permissions",
@@ -4033,45 +3612,23 @@ dependencies = [
  "tokio-rustls 0.26.4",
  "tokio-socks",
  "tokio-util",
+ "tokio-vsock",
  "tower 0.5.3",
  "tower-http",
  "tower-service",
 ]
 
-[[package]]
-name = "deno_ffi"
-version = "0.177.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfbdc4e55c79ec1bc8a3ac72313e6f70d76340222f1e50c5c91e050296f83544"
-dependencies = [
- "deno_core",
- "deno_error",
- "deno_permissions",
- "dlopen2 0.6.1",
- "dynasmrt",
- "libffi",
- "libffi-sys",
- "log",
- "num-bigint",
- "serde",
- "serde-value",
- "serde_json",
- "thiserror 2.0.18",
- "tokio",
- "winapi",
-]
-
 [[package]]
 name = "deno_fs"
-version = "0.100.0"
+version = "0.119.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c82f79b71403b93b248727a89746026104b3a5ac1d82e79a02af6fa8e8487666"
+checksum = "5ca83a95cea7bcdf19dac1888ef6f04aff69d251640a4d085bc6089c06b4b181"
 dependencies = [
  "async-trait",
  "base32",
  "boxed_error",
  "deno_core",
- "deno_error",
+ "deno_error 0.6.1",
  "deno_io",
  "deno_path_util",
  "deno_permissions",
@@ -4087,58 +3644,21 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
-[[package]]
-name = "deno_http"
-version = "0.188.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0b7e7a3bcac31ebd4677a96318003a98f0fda4613f6ba6d7f5ba57928727191"
-dependencies = [
- "async-compression",
- "async-trait",
- "base64 0.21.7",
- "brotli 6.0.0",
- "bytes",
- "cache_control",
- "deno_core",
- "deno_error",
- "deno_net",
- "deno_websocket",
- "flate2",
- "http 0.2.12",
- "http 1.4.0",
- "httparse",
- "hyper 0.14.32",
- "hyper 1.9.0",
- "hyper-util",
- "itertools 0.10.5",
- "memmem",
- "mime",
- "once_cell",
- "percent-encoding",
- "phf 0.11.3",
- "pin-project",
- "ring 0.17.14",
- "scopeguard",
- "serde",
- "smallvec",
- "thiserror 2.0.18",
- "tokio",
- "tokio-util",
-]
-
 [[package]]
 name = "deno_io"
-version = "0.100.0"
+version = "0.119.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e72489fe0dcada08047611d1ab92db1baebf7b606ab7c78790f622ecb30e22b"
+checksum = "597aac25be261a1bd545d6f47a80439c60e600c076f9847b3718a592883b2a73"
 dependencies = [
  "async-trait",
  "deno_core",
- "deno_error",
+ "deno_error 0.6.1",
+ "deno_subprocess_windows",
  "filetime",
  "fs3",
  "libc",
  "log",
+ "nix 0.27.1",
  "once_cell",
  "os_pipe",
  "parking_lot",
@@ -4150,88 +3670,24 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
-[[package]]
-name = "deno_kv"
-version = "0.98.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0e3930d0195a3350c05eb9a4bc619ec598ea84ad8bdb9b6c3e4bef798e7cf34"
-dependencies = [
- "anyhow",
- "async-trait",
- "base64 0.21.7",
- "boxed_error",
- "bytes",
- "chrono",
- "deno_core",
- "deno_error",
- "deno_fetch",
- "deno_path_util",
- "deno_permissions",
- "deno_tls",
- "denokv_proto",
- "denokv_remote",
- "denokv_sqlite",
- "faster-hex",
- "http 1.4.0",
- "http-body-util",
- "log",
- "num-bigint",
- "prost",
- "prost-build",
- "rand 0.8.5",
- "rusqlite",
- "serde",
- "thiserror 2.0.18",
- "url",
-]
-
-[[package]]
-name = "deno_lockfile"
-version = "0.24.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "632e835a53ed667d62fdd766c5780fe8361c831d3e3fbf1a760a0b7896657587"
-dependencies = [
- "deno_semver",
- "serde",
- "serde_json",
- "thiserror 2.0.18",
-]
-
 [[package]]
 name = "deno_media_type"
-version = "0.2.5"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "600222d059ab31ff31182b3e12615df2134a9e01605836b78ad8df91ba39eab3"
+checksum = "9fd0af4161f90b092feb363864a64d7c74e0efc13a15905d0d09df73bb72a123"
 dependencies = [
  "data-url",
  "serde",
  "url",
 ]
 
-[[package]]
-name = "deno_napi"
-version = "0.121.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13f30bf147cc46dba87e3088d037cf99a2845ead1138033d3b346178cb781558"
-dependencies = [
- "deno_core",
- "deno_error",
- "deno_permissions",
- "libc",
- "libloading 0.7.4",
- "log",
- "napi_sym",
- "thiserror 2.0.18",
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "deno_native_certs"
 version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "86bc737e098a45aa5742d51ce694ac7236a1e69fb0d9df8c862e9b4c9583c5f9"
 dependencies = [
- "dlopen2 0.7.0",
+ "dlopen2",
  "dlopen2_derive",
  "once_cell",
  "rustls-native-certs 0.7.3",
@@ -4240,12 +3696,13 @@ dependencies = [
 
 [[package]]
 name = "deno_net"
-version = "0.182.0"
+version = "0.201.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab869063cbfe428a707511835865d55247886eb175659e538af4d5096c3d4d9d"
+checksum = "eb88f1ea2762065d6cc0316372acc22696ab6004943aa029f80546f9faf1b491"
 dependencies = [
  "deno_core",
- "deno_error",
+ "deno_error 0.6.1",
+ "deno_features",
  "deno_permissions",
  "deno_tls",
  "hickory-proto",
@@ -4254,191 +3711,39 @@ dependencies = [
  "quinn",
  "rustls-tokio-stream",
  "serde",
+ "sha2 0.10.9",
  "socket2 0.5.10",
  "thiserror 2.0.18",
  "tokio",
-]
-
-[[package]]
-name = "deno_node"
-version = "0.128.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9638e803a668b0a5793ff94c9b2e82c54a05d9fc510901e9f3093d2d63dbdaab"
-dependencies = [
- "aead-gcm-stream",
- "aes 0.8.3",
- "async-trait",
- "base64 0.21.7",
- "blake2",
- "boxed_error",
- "brotli 6.0.0",
- "bytes",
- "cbc",
- "const-oid 0.9.6",
- "ctr",
- "data-encoding",
- "deno_core",
- "deno_error",
- "deno_fetch",
- "deno_fs",
- "deno_io",
- "deno_net",
- "deno_package_json",
- "deno_path_util",
- "deno_permissions",
- "deno_process",
- "deno_whoami",
- "der",
- "digest 0.10.7",
- "dsa",
- "ecb",
- "ecdsa",
- "ed25519-dalek",
- "elliptic-curve",
- "errno",
- "faster-hex",
- "h2 0.4.14",
- "hkdf",
- "http 1.4.0",
- "http-body-util",
- "hyper 1.9.0",
- "hyper-util",
- "idna",
- "indexmap 2.14.0",
- "ipnetwork",
- "k256",
- "lazy-regex",
- "libc",
- "libz-sys",
- "md-5 0.10.6",
- "md4",
- "memchr",
- "node_resolver",
- "num-bigint",
- "num-bigint-dig",
- "num-integer",
- "num-traits",
- "once_cell",
- "p224",
- "p256",
- "p384",
- "path-clean",
- "pbkdf2",
- "pkcs8",
- "rand 0.8.5",
- "regex",
- "ring 0.17.14",
- "ripemd",
- "rsa",
- "scrypt",
- "sec1",
- "serde",
- "sha1",
- "sha2 0.10.9",
- "sha3",
- "signature",
- "simd-json",
- "sm3",
- "spki",
- "stable_deref_trait",
- "sys_traits",
- "thiserror 2.0.18",
- "tokio",
- "tokio-eld",
- "url",
- "webpki-root-certs 0.26.11",
- "winapi",
- "windows-sys 0.59.0",
- "x25519-dalek",
- "x509-parser 0.15.1",
- "yoke 0.7.5",
-]
-
-[[package]]
-name = "deno_npm"
-version = "0.27.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4adceb4c34f10e837d0e3ae76e88dddefb13e83c05c1ef1699fa5519241c9d27"
-dependencies = [
- "async-trait",
- "capacity_builder 0.5.0",
- "deno_error",
- "deno_lockfile",
- "deno_semver",
- "futures",
- "log",
- "monch",
- "serde",
- "serde_json",
- "thiserror 2.0.18",
+ "tokio-vsock",
  "url",
+ "web-transport-proto",
 ]
 
 [[package]]
 name = "deno_ops"
-version = "0.212.0"
+version = "0.228.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2d328067139909aa81522a5d90f119368b541fbddd73ab630e4d9f777865f0d"
+checksum = "8bf8dbe5abf37d270bb853c5dfe45fbe3b1b6c453877cc11d7fe84e9862a6dbc"
 dependencies = [
  "indexmap 2.14.0",
  "proc-macro-rules",
  "proc-macro2",
  "quote",
  "stringcase",
- "strum 0.25.0",
- "strum_macros 0.25.3",
+ "strum 0.27.2",
+ "strum_macros 0.27.2",
  "syn 2.0.117",
  "thiserror 2.0.18",
 ]
 
-[[package]]
-name = "deno_os"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8371d206f6265c4e0b74116c1a58cc8c464c45da0b43c1e8c19a911e88feb2b"
-dependencies = [
- "deno_core",
- "deno_error",
- "deno_path_util",
- "deno_permissions",
- "deno_telemetry",
- "libc",
- "netif",
- "ntapi",
- "once_cell",
- "serde",
- "signal-hook",
- "signal-hook-registry",
- "thiserror 2.0.18",
- "tokio",
- "winapi",
-]
-
-[[package]]
-name = "deno_package_json"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d07d26dbfcc01e636aef86f9baff7faf5338398e74d283d8fe01e39068f48049"
-dependencies = [
- "boxed_error",
- "deno_error",
- "deno_path_util",
- "deno_semver",
- "indexmap 2.14.0",
- "serde",
- "serde_json",
- "sys_traits",
- "thiserror 2.0.18",
- "url",
-]
-
 [[package]]
 name = "deno_path_util"
-version = "0.3.1"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c87b8996966ae1b13ee9c20219b1d10fc53905b9570faae6adfa34614fd15224"
+checksum = "516f813389095889776b81cc9108ff6f336fd9409b4b12fc0138aea23d2708e1"
 dependencies = [
- "deno_error",
+ "deno_error 0.6.1",
  "percent-encoding",
  "sys_traits",
  "thiserror 2.0.18",
@@ -4447,183 +3752,54 @@ dependencies = [
 
 [[package]]
 name = "deno_permissions"
-version = "0.49.0"
+version = "0.68.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abf879dff0b3de4dbcb78d6dda3a55e711369d5b9f479270a82853ef106c4176"
+checksum = "baa14d9c3fbba59836ffbaac7f736a2f48d4a5fc209a2103d1e1b898915232a5"
 dependencies = [
- "capacity_builder 0.5.0",
- "deno_core",
- "deno_error",
+ "capacity_builder",
+ "deno_error 0.6.1",
  "deno_path_util",
  "deno_terminal",
+ "deno_unsync",
  "fqdn",
+ "ipnetwork",
  "libc",
  "log",
- "once_cell",
- "percent-encoding",
- "serde",
- "thiserror 2.0.18",
- "which 6.0.3",
- "winapi",
-]
-
-[[package]]
-name = "deno_process"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "700f8a2c9d369e7035e693f26a671489a73724450cbbc0a1e32f3966ef2f21fb"
-dependencies = [
- "deno_core",
- "deno_error",
- "deno_fs",
- "deno_io",
- "deno_os",
- "deno_path_util",
- "deno_permissions",
- "libc",
- "log",
- "memchr",
  "nix 0.27.1",
- "pin-project-lite",
- "rand 0.8.5",
- "serde",
- "simd-json",
- "tempfile",
- "thiserror 2.0.18",
- "tokio",
- "which 6.0.3",
- "winapi",
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "deno_resolver"
-version = "0.21.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93c4ceec7b6e22344047b8a5577bb8239dc0a99884c25c1fa7d8611f4c3ed28b"
-dependencies = [
- "anyhow",
- "async-once-cell",
- "async-trait",
- "base32",
- "boxed_error",
- "dashmap 5.5.3",
- "deno_cache_dir",
- "deno_config",
- "deno_error",
- "deno_media_type",
- "deno_npm",
- "deno_package_json",
- "deno_path_util",
- "deno_semver",
- "deno_terminal",
- "futures",
- "log",
- "node_resolver",
  "once_cell",
  "parking_lot",
+ "percent-encoding",
+ "serde",
+ "serde_json",
  "sys_traits",
+ "temp_deno_which",
  "thiserror 2.0.18",
  "url",
-]
-
-[[package]]
-name = "deno_runtime"
-version = "0.198.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26a54d54ca920e5256c1e910c7574787d009a34afd41b20ad250278bb1aea290"
-dependencies = [
- "color-print",
- "deno_ast",
- "deno_broadcast_channel",
- "deno_cache",
- "deno_canvas",
- "deno_console",
- "deno_core",
- "deno_cron",
- "deno_crypto",
- "deno_error",
- "deno_fetch",
- "deno_ffi",
- "deno_fs",
- "deno_http",
- "deno_io",
- "deno_kv",
- "deno_napi",
- "deno_net",
- "deno_node",
- "deno_os",
- "deno_path_util",
- "deno_permissions",
- "deno_process",
- "deno_resolver",
- "deno_telemetry",
- "deno_terminal",
- "deno_tls",
- "deno_url",
- "deno_web",
- "deno_webgpu",
- "deno_webidl",
- "deno_websocket",
- "deno_webstorage",
- "dlopen2 0.6.1",
- "encoding_rs",
- "fastwebsockets",
- "http 1.4.0",
- "http-body-util",
- "hyper 0.14.32",
- "hyper 1.9.0",
- "hyper-util",
- "libc",
- "log",
- "nix 0.27.1",
- "node_resolver",
- "notify",
- "ntapi",
- "once_cell",
- "percent-encoding",
- "regex",
- "rustyline",
- "same-file",
- "serde",
- "sys_traits",
- "tempfile",
- "thiserror 2.0.18",
- "tokio",
- "tokio-metrics",
- "twox-hash 1.6.3",
- "uuid",
- "which 6.0.3",
  "winapi",
  "windows-sys 0.59.0",
 ]
 
 [[package]]
-name = "deno_semver"
-version = "0.7.1"
+name = "deno_subprocess_windows"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4775271f9b5602482698f76d24ea9ed8ba27af7f587a7e9a876916300c542435"
+checksum = "7bc6b10059f0ccb14c6e0319c5275f0407fb2f9ffe405cd555700561999ea4bf"
 dependencies = [
- "capacity_builder 0.5.0",
- "deno_error",
- "ecow",
- "hipstr",
- "monch",
- "once_cell",
- "serde",
- "thiserror 2.0.18",
- "url",
+ "fastrand",
+ "futures-channel",
+ "libc",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "deno_telemetry"
-version = "0.12.0"
+version = "0.31.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d73802ee27361bbb6c0e3c04a799b39f458afbed1972c4aff0867420d1c36fdb"
+checksum = "377581966bd34e85ce230f7f4b1dee7e16c6bf7f845b4690648507ce7ba105d9"
 dependencies = [
  "async-trait",
  "deno_core",
- "deno_error",
+ "deno_error 0.6.1",
  "deno_tls",
  "http-body-util",
  "hyper 1.9.0",
@@ -4644,9 +3820,9 @@ dependencies = [
 
 [[package]]
 name = "deno_terminal"
-version = "0.2.3"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3ba8041ae7319b3ca6a64c399df4112badcbbe0868b4517637647614bede4be"
+checksum = "23f71c27009e0141dedd315f1dfa3ebb0a6ca4acce7c080fac576ea415a465f6"
 dependencies = [
  "once_cell",
  "termcolor",
@@ -4654,12 +3830,12 @@ dependencies = [
 
 [[package]]
 name = "deno_tls"
-version = "0.177.0"
+version = "0.196.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1e3ceb2be448150d8214e8fc454c947e0ea94f6ce16556544f05a67ad5a16b8"
+checksum = "a7835eb6a8d114703b0293573fbb8885bc2c81e8c35363b9e89391dd3c541fa6"
 dependencies = [
  "deno_core",
- "deno_error",
+ "deno_error 0.6.1",
  "deno_native_certs",
  "rustls 0.23.35",
  "rustls-pemfile 2.2.0",
@@ -4684,27 +3860,26 @@ dependencies = [
 
 [[package]]
 name = "deno_url"
-version = "0.190.0"
+version = "0.209.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d79e743ad841f7826d46c6944580f5ba665fe9ab4c31a68c4eed8b5a78225da3"
+checksum = "8cccbb10fb59f29b04161055a65f7fe83364f9e8317d4d2ce3bd7979faf63a87"
 dependencies = [
  "deno_core",
- "deno_error",
- "thiserror 2.0.18",
+ "deno_error 0.6.1",
  "urlpattern",
 ]
 
 [[package]]
 name = "deno_web"
-version = "0.221.0"
+version = "0.240.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8041ba73bb2f238c61b5e4ed341d2fe1f9464a71115a240ab3390480b3c10e12"
+checksum = "1d6b8a97cc90b6aaea20fe200cfa7e5b6953dd33ecda0af50d6d360387c33df4"
 dependencies = [
  "async-trait",
- "base64-simd 0.8.0",
+ "base64-simd",
  "bytes",
  "deno_core",
- "deno_error",
+ "deno_error 0.6.1",
  "deno_permissions",
  "encoding_rs",
  "flate2",
@@ -4715,197 +3890,40 @@ dependencies = [
  "uuid",
 ]
 
-[[package]]
-name = "deno_webgpu"
-version = "0.157.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4077584c0ccfde0737e576c396bbf1645f25ed0ebf4f44543e0ad13729285cf3"
-dependencies = [
- "deno_core",
- "deno_error",
- "raw-window-handle",
- "serde",
- "thiserror 2.0.18",
- "tokio",
- "wgpu-core",
- "wgpu-types",
-]
-
 [[package]]
 name = "deno_webidl"
-version = "0.190.0"
+version = "0.209.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4ff81a990196bf3a80fe5d339b4eb8b411ef17634d60d399a63bae6e71a37c9"
+checksum = "a20bbfac0cf15918f7cbd0b55c366ac20ad65c825f362fa684c3104984254d3b"
 dependencies = [
  "deno_core",
 ]
 
-[[package]]
-name = "deno_websocket"
-version = "0.195.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ad15c3856dd1748f9a36102e90b4e345e40d7d64a9bf6672d584201e1fded28"
-dependencies = [
- "bytes",
- "deno_core",
- "deno_error",
- "deno_net",
- "deno_permissions",
- "deno_tls",
- "fastwebsockets",
- "h2 0.4.14",
- "http 1.4.0",
- "http-body-util",
- "hyper 1.9.0",
- "hyper-util",
- "once_cell",
- "rustls-tokio-stream",
- "serde",
- "thiserror 2.0.18",
- "tokio",
-]
-
-[[package]]
-name = "deno_webstorage"
-version = "0.185.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "079dc4f6ce91f53bb848bad8d743dc20d16ca44cbed3425531cf5d922b1a45bc"
-dependencies = [
- "deno_core",
- "deno_error",
- "deno_web",
- "rusqlite",
- "thiserror 2.0.18",
-]
-
-[[package]]
-name = "deno_whoami"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e75e4caa92b98a27f09c671d1399aee0f5970aa491b9a598523aac000a2192e3"
-dependencies = [
- "libc",
- "whoami",
-]
-
-[[package]]
-name = "denokv_proto"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5b77de4d3b9215e14624d4f4eb16cb38c0810e3f5860ba3b3fc47d0537f9a4d"
-dependencies = [
- "async-trait",
- "chrono",
- "deno_error",
- "futures",
- "num-bigint",
- "prost",
- "serde",
- "uuid",
-]
-
-[[package]]
-name = "denokv_remote"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6497c28eec268ed99f1e8664f0842935f02d1508529c67d94c57ca5d893d743"
-dependencies = [
- "async-stream",
- "async-trait",
- "bytes",
- "chrono",
- "deno_error",
- "denokv_proto",
- "futures",
- "http 1.4.0",
- "log",
- "prost",
- "rand 0.8.5",
- "serde",
- "serde_json",
- "thiserror 2.0.18",
- "tokio",
- "tokio-util",
- "url",
- "uuid",
-]
-
-[[package]]
-name = "denokv_sqlite"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc0f21a450a35eb85760761401fddf9bfff9840127be07a6ca5c31863127913d"
-dependencies = [
- "async-stream",
- "async-trait",
- "chrono",
- "deno_error",
- "denokv_proto",
- "futures",
- "hex",
- "log",
- "num-bigint",
- "rand 0.8.5",
- "rusqlite",
- "serde_json",
- "thiserror 2.0.18",
- "tokio",
- "tokio-stream",
- "uuid",
- "v8_valueserializer",
-]
-
 [[package]]
 name = "der"
 version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
- "const-oid 0.9.6",
- "der_derive",
+ "const-oid",
  "pem-rfc7468",
  "zeroize",
 ]
 
-[[package]]
-name = "der-parser"
-version = "8.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbd676fbbab537128ef0278adb5576cf363cff6aa22a7b24effe97347cfab61e"
-dependencies = [
- "asn1-rs 0.5.2",
- "displaydoc",
- "nom 7.1.3",
- "num-bigint",
- "num-traits",
- "rusticata-macros",
-]
-
 [[package]]
 name = "der-parser"
 version = "9.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5cd0a5c643689626bec213c4d8bd4d96acc8ffdb4ad4bb6bc16abf27d5f4b553"
 dependencies = [
- "asn1-rs 0.6.2",
+ "asn1-rs",
  "displaydoc",
- "nom 7.1.3",
+ "nom",
  "num-bigint",
  "num-traits",
  "rusticata-macros",
 ]
 
-[[package]]
-name = "der_derive"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8034092389675178f570469e6c3b0465d3d30b4505c294a6550db47f3c17ad18"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "deranged"
 version = "0.5.8"
@@ -5047,23 +4065,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer 0.10.4",
- "const-oid 0.9.6",
- "crypto-common 0.1.7",
+ "const-oid",
+ "crypto-common",
  "subtle",
 ]
 
-[[package]]
-name = "digest"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
-dependencies = [
- "block-buffer 0.12.0",
- "const-oid 0.10.2",
- "crypto-common 0.2.1",
- "ctutils",
-]
-
 [[package]]
 name = "dirs"
 version = "4.0.0"
@@ -5158,18 +4164,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "dlopen2"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6bc2c7ed06fd72a8513ded8d0d2f6fd2655a85d6885c48cae8625d80faf28c03"
-dependencies = [
- "dlopen2_derive",
- "libc",
- "once_cell",
- "winapi",
-]
-
 [[package]]
 name = "dlopen2"
 version = "0.7.0"
@@ -5193,15 +4187,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "document-features"
-version = "0.2.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4b8a88685455ed29a21542a33abd9cb6510b6b129abadabdcef0f4c55bc8f61"
-dependencies = [
- "litrs",
-]
-
 [[package]]
 name = "dotenv"
 version = "0.15.0"
@@ -5222,35 +4207,20 @@ checksum = "117240f60069e65410b3ae1bb213295bd828f707b5bec6596a1afc8793ce0cbc"
 
 [[package]]
 name = "dprint-swc-ext"
-version = "0.20.0"
+version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ba28c12892aadb751c2ba7001d8460faee4748a04b4edc51c7121cc67ee03db"
+checksum = "cf592ae6a864437e98ef9c6ae7936b822077e9d038a3a48ee081ab92313afad4"
 dependencies = [
  "num-bigint",
- "rustc-hash 1.1.0",
+ "rustc-hash 2.1.2",
  "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
+ "swc_ecma_lexer",
  "swc_ecma_parser",
  "text_lines",
 ]
 
-[[package]]
-name = "dsa"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48bc224a9084ad760195584ce5abb3c2c34a225fa312a128ad245a6b412b7689"
-dependencies = [
- "digest 0.10.7",
- "num-bigint-dig",
- "num-traits",
- "pkcs8",
- "rfc6979",
- "sha2 0.10.9",
- "signature",
- "zeroize",
-]
-
 [[package]]
 name = "duct"
 version = "0.13.7"
@@ -5291,41 +4261,6 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e1d926b4d407d372f141f93bb444696142c29d32962ccbd3531117cf3aa0bfa9"
 
-[[package]]
-name = "dynasm"
-version = "1.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "add9a102807b524ec050363f09e06f1504214b0e1c7797f64261c891022dce8b"
-dependencies = [
- "bitflags 1.3.2",
- "byteorder",
- "lazy_static",
- "proc-macro-error",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "dynasmrt"
-version = "1.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64fba5a42bd76a17cad4bfa00de168ee1cbfa06a5e8ce992ae880218c05641a9"
-dependencies = [
- "byteorder",
- "dynasm",
- "memmap2 0.5.10",
-]
-
-[[package]]
-name = "ecb"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a8bfa975b1aec2145850fcaa1c6fe269a16578c44705a532ae3edc92b8881c7"
-dependencies = [
- "cipher 0.4.4",
-]
-
 [[package]]
 name = "ecdsa"
 version = "0.16.9"
@@ -5340,15 +4275,6 @@ dependencies = [
  "spki",
 ]
 
-[[package]]
-name = "ecow"
-version = "0.2.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78e4f79b296fbaab6ce2e22d52cb4c7f010fe0ebe7a32e34fa25885fd797bd02"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "ed25519"
 version = "2.2.3"
@@ -5375,18 +4301,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "ed448-goldilocks"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06924531e9e90130842b012e447f85bdaf9161bc8a0f8092be8cb70b01ebe092"
-dependencies = [
- "fiat-crypto 0.1.20",
- "hex",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "educe"
 version = "0.6.0"
@@ -5415,7 +4329,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
 dependencies = [
  "base16ct",
- "base64ct",
  "crypto-bigint",
  "digest 0.10.7",
  "ff",
@@ -5426,8 +4339,6 @@ dependencies = [
  "pkcs8",
  "rand_core 0.6.4",
  "sec1",
- "serde_json",
- "serdect",
  "subtle",
  "zeroize",
 ]
@@ -5440,19 +4351,13 @@ checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
 
 [[package]]
 name = "encoding_rs"
-version = "0.8.33"
+version = "0.8.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7268b386296a025e474d5140678f75d6de9493ae55a5d709eeb9dd08149945e1"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
 dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "endian-type"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c34f04666d835ff5d62e058c3995147c06f42fe86ff053337632bca83e42702d"
-
 [[package]]
 name = "enum-as-inner"
 version = "0.6.1"
@@ -5532,12 +4437,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "error-code"
-version = "3.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dea2df4cf52843e0452895c455a1a2cfbb842a1e7329671acf418fdc53ed4c59"
-
 [[package]]
 name = "error_reporter"
 version = "1.0.0"
@@ -5598,7 +4497,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "74fef4569247a5f429d9156b9d0a2599914385dd189c539334c625d8099d90ab"
 dependencies = [
  "futures-core",
- "nom 7.1.3",
+ "nom",
  "pin-project-lite",
 ]
 
@@ -5608,25 +4507,13 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4443176a9f2c162692bd3d352d745ef9413eec5782a80d8fd6f8a1ac692a07f7"
 
-[[package]]
-name = "fallible-iterator"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
-
-[[package]]
-name = "fallible-streaming-iterator"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
-
 [[package]]
 name = "fancy-regex"
 version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e24cb5a94bcae1e5408b0effca5cd7172ea3c5755049c5f3af4cd283a165298"
 dependencies = [
- "bit-set 0.8.0",
+ "bit-set",
  "regex-automata",
  "regex-syntax 0.8.10",
 ]
@@ -5637,7 +4524,7 @@ version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72cf461f865c862bb7dc573f643dd6a2b6842f7c30b07882b56bd148cc2761b8"
 dependencies = [
- "bit-set 0.8.0",
+ "bit-set",
  "regex-automata",
  "regex-syntax 0.8.10",
 ]
@@ -5648,61 +4535,12 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9afc2bd4d5a73106dd53d10d73d3401c2f32730ba2c0b93ddb888a8983680471"
 
-[[package]]
-name = "faster-hex"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2a2b11eda1d40935b26cf18f6833c526845ae8c41e58d09af6adeb6f0269183"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "fastrand"
 version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
 
-[[package]]
-name = "fastwebsockets"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9dac026e15fb7e44d768880b868a0fd5bd30ffdee272e88b3060f657a5a72947"
-dependencies = [
- "base64 0.21.7",
- "bytes",
- "http-body-util",
- "hyper 1.9.0",
- "hyper-util",
- "pin-project",
- "rand 0.8.5",
- "sha1",
- "simdutf8",
- "thiserror 1.0.69",
- "tokio",
- "utf-8",
-]
-
-[[package]]
-name = "fd-lock"
-version = "4.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ce92ff622d6dadf7349484f42c93271a0d49b7cc4d466a936405bacbe10aa78"
-dependencies = [
- "cfg-if",
- "rustix 1.1.4",
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "fdeflate"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
-dependencies = [
- "simd-adler32",
-]
-
 [[package]]
 name = "ff"
 version = "0.13.1"
@@ -5713,12 +4551,6 @@ dependencies = [
  "subtle",
 ]
 
-[[package]]
-name = "fiat-crypto"
-version = "0.1.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e825f6987101665dea6ec934c09ec6d721de7bc1bf92248e1d5810c8cd636b77"
-
 [[package]]
 name = "fiat-crypto"
 version = "0.2.9"
@@ -5727,13 +4559,12 @@ checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 
 [[package]]
 name = "filetime"
-version = "0.2.27"
+version = "0.2.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f98844151eee8917efc50bd9e8318cb963ae8b297431495d3f758616ea5c57db"
+checksum = "2d5b2eef6fafbf69f877e55509ce5b11a760690ac9700a2921be067aa6afaef6"
 dependencies = [
  "cfg-if",
  "libc",
- "libredox",
 ]
 
 [[package]]
@@ -5754,7 +4585,7 @@ version = "25.12.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "35f6839d7b3b98adde531effaf34f0c2badc6f4735d26fe74709d8e513a96ef3"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "rustc_version 0.4.1",
 ]
 
@@ -5766,19 +4597,10 @@ checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
  "crc32fast",
  "libz-sys",
- "miniz_oxide 0.8.9",
+ "miniz_oxide",
  "zlib-rs",
 ]
 
-[[package]]
-name = "float-cmp"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b09cf3155332e944990140d967ff5eceb70df778b34f77d8075db46e4704e6d8"
-dependencies = [
- "num-traits",
-]
-
 [[package]]
 name = "float8"
 version = "0.6.1"
@@ -5827,28 +4649,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
 dependencies = [
- "foreign-types-shared 0.1.1",
-]
-
-[[package]]
-name = "foreign-types"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
-dependencies = [
- "foreign-types-macros",
- "foreign-types-shared 0.3.1",
-]
-
-[[package]]
-name = "foreign-types-macros"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a5c6c585bc94aaf2c7b51dd4c2ba22680844aba4c687be581871a6f518c5742"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
+ "foreign-types-shared",
 ]
 
 [[package]]
@@ -5857,12 +4658,6 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
 
-[[package]]
-name = "foreign-types-shared"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa9a19cbb55df58761df49b23516a86d432839add4af60fc256da840f66ed35b"
-
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
@@ -5880,11 +4675,10 @@ checksum = "eb540cf7bc4fe6df9d8f7f0c974cfd0dce8ed4e9e8884e73433b503ee78b4e7d"
 
 [[package]]
 name = "from_variant"
-version = "0.1.9"
+version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32016f1242eb82af5474752d00fd8ebcd9004bd69b462b1c91de833972d08ed4"
+checksum = "308530a56b099da144ebc5d8e179f343ad928fa2b3558d1eb3db9af18d6eff43"
 dependencies = [
- "proc-macro2",
  "swc_macros_common",
  "syn 2.0.117",
 ]
@@ -5916,15 +4710,6 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
 
-[[package]]
-name = "fsevent-sys"
-version = "4.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76ee7a02da4d231650c7cea31349b889be2f45ddb3ef3032d2ec8185f6313fd2"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "fslock"
 version = "0.2.1"
@@ -6330,17 +5115,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "gl_generator"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a95dfc23a2b4a9a2f5ab41d194f8bfda3cabec42af4e39f08c339eb2a0c124d"
-dependencies = [
- "khronos_api",
- "log",
- "xml-rs",
-]
-
 [[package]]
 name = "glob"
 version = "0.3.3"
@@ -6372,27 +5146,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "glow"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd348e04c43b32574f2de31c8bb397d96c9fcfa1371bd4ca6d8bdc464ab121b1"
-dependencies = [
- "js-sys",
- "slotmap",
- "wasm-bindgen",
- "web-sys",
-]
-
-[[package]]
-name = "glutin_wgl_sys"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c8098adac955faa2d31079b65dc48841251f69efd3ac25477903fc424362ead"
-dependencies = [
- "gl_generator",
-]
-
 [[package]]
 name = "google-cloud-auth"
 version = "0.17.2"
@@ -6493,45 +5246,6 @@ dependencies = [
  "unic-ucd-category",
 ]
 
-[[package]]
-name = "gpu-alloc"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbcd2dba93594b227a1f57ee09b8b9da8892c34d55aa332e034a228d0fe6a171"
-dependencies = [
- "bitflags 2.9.4",
- "gpu-alloc-types",
-]
-
-[[package]]
-name = "gpu-alloc-types"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98ff03b468aa837d70984d55f5d3f846f6ec31fe34bbb97c4f85219caeee1ca4"
-dependencies = [
- "bitflags 2.9.4",
-]
-
-[[package]]
-name = "gpu-descriptor"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b89c83349105e3732062a895becfc71a8f921bb71ecbbdd8ff99263e3b53a0ca"
-dependencies = [
- "bitflags 2.9.4",
- "gpu-descriptor-types",
- "hashbrown 0.15.5",
-]
-
-[[package]]
-name = "gpu-descriptor-types"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdf242682df893b86f33a73828fb09ca4b2d3bb6cc95249707fc684d27484b91"
-dependencies = [
- "bitflags 2.9.4",
-]
-
 [[package]]
 name = "group"
 version = "0.13.0"
@@ -6605,16 +5319,6 @@ dependencies = [
  "zerocopy",
 ]
 
-[[package]]
-name = "halfbrown"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8588661a8607108a5ca69cab034063441a0413a0b041c13618a7dd348021ef6f"
-dependencies = [
- "hashbrown 0.14.5",
- "serde",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.12.3"
@@ -6647,21 +5351,22 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.16.0"
+version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5419bdc4f6a9207fbeba6d11b604d481addf78ecd10c11ad51e76c2f6482748d"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 dependencies = [
  "allocator-api2",
  "equivalent",
  "foldhash 0.2.0",
  "serde",
+ "serde_core",
 ]
 
 [[package]]
 name = "hashbrown"
-version = "0.17.0"
+version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 
 [[package]]
 name = "hashify"
@@ -6675,15 +5380,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "hashlink"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ba4ff7128dee98c7dc9794b6a411377e1404dba1c97deb8d1a55297bd25d8af"
-dependencies = [
- "hashbrown 0.14.5",
-]
-
 [[package]]
 name = "hashlink"
 version = "0.10.0"
@@ -6693,20 +5389,6 @@ dependencies = [
  "hashbrown 0.15.5",
 ]
 
-[[package]]
-name = "hdrhistogram"
-version = "7.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "765c9198f173dd59ce26ff9f95ef0aafd0a0fe01fb9d72841bc5066a4c06511d"
-dependencies = [
- "base64 0.21.7",
- "byteorder",
- "crossbeam-channel",
- "flate2",
- "nom 7.1.3",
- "num-traits",
-]
-
 [[package]]
 name = "headers"
 version = "0.4.1"
@@ -6755,12 +5437,6 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
-[[package]]
-name = "hexf-parse"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfa686283ad6dd069f105e5ab091b04c62850d3e4cf5d67debad1933f55023df"
-
 [[package]]
 name = "hf-hub"
 version = "0.4.3"
@@ -6833,24 +5509,13 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "hipstr"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97971ffc85d4c98de12e2608e992a43f5294ebb625fdb045b27c731b64c4c6d6"
-dependencies = [
- "serde",
- "serde_bytes",
- "sptr",
-]
-
 [[package]]
 name = "hkdf"
 version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
 dependencies = [
- "hmac 0.12.1",
+ "hmac",
 ]
 
 [[package]]
@@ -6862,15 +5527,6 @@ dependencies = [
  "digest 0.10.7",
 ]
 
-[[package]]
-name = "hmac"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
-dependencies = [
- "digest 0.11.3",
-]
-
 [[package]]
 name = "home"
 version = "0.5.12"
@@ -6893,15 +5549,14 @@ dependencies = [
 
 [[package]]
 name = "hstr"
-version = "0.2.17"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1a26def229ea95a8709dad32868d975d0dd40235bd2ce82920e4a8fe692b5e0"
+checksum = "31f11d91d7befd2ffd9d216e9e5ea1fae6174b20a2a1b67a688138003d2f4122"
 dependencies = [
  "hashbrown 0.14.5",
  "new_debug_unreachable",
  "once_cell",
- "phf 0.11.3",
- "rustc-hash 1.1.0",
+ "rustc-hash 2.1.2",
  "triomphe",
 ]
 
@@ -7013,15 +5668,6 @@ version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "135b12329e5e3ce057a9f972339ea52bc954fe1e9358ef27f95e89716fbc5424"
 
-[[package]]
-name = "hybrid-array"
-version = "0.4.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d46837a0ed51fe95bd3b05de33cd64a1ee88fc797477ca48446872504507c5"
-dependencies = [
- "typenum",
-]
-
 [[package]]
 name = "hyper"
 version = "0.14.32"
@@ -7276,7 +5922,7 @@ dependencies = [
  "displaydoc",
  "potential_utf",
  "utf8_iter",
- "yoke 0.8.2",
+ "yoke",
  "zerofrom",
  "zerovec",
 ]
@@ -7343,7 +5989,7 @@ dependencies = [
  "displaydoc",
  "icu_locale_core",
  "writeable",
- "yoke 0.8.2",
+ "yoke",
  "zerofrom",
  "zerotrie",
  "zerovec",
@@ -7388,52 +6034,6 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cd62e6b5e86ea8eeeb8db1de02880a6abc01a397b2ebb64b5d74ac255318f5cb"
 
-[[package]]
-name = "ignore"
-version = "0.4.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3d782a365a015e0f5c04902246139249abf769125006fbe7649e2ee88169b4a"
-dependencies = [
- "crossbeam-deque",
- "globset",
- "log",
- "memchr",
- "regex-automata",
- "same-file",
- "walkdir",
- "winapi-util",
-]
-
-[[package]]
-name = "image"
-version = "0.24.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5690139d2f55868e080017335e4b94cb7414274c74f1669c84fb5feba2c9f69d"
-dependencies = [
- "bytemuck",
- "byteorder",
- "color_quant",
- "num-traits",
- "png",
-]
-
-[[package]]
-name = "import_map"
-version = "0.21.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1215d4d92511fbbdaea50e750e91f2429598ef817f02b579158e92803b52c00a"
-dependencies = [
- "boxed_error",
- "deno_error",
- "indexmap 2.14.0",
- "log",
- "percent-encoding",
- "serde",
- "serde_json",
- "thiserror 2.0.18",
- "url",
-]
-
 [[package]]
 name = "indexmap"
 version = "1.9.3"
@@ -7452,7 +6052,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown 0.17.0",
+ "hashbrown 0.17.1",
  "serde",
  "serde_core",
 ]
@@ -7470,33 +6070,12 @@ dependencies = [
  "web-time",
 ]
 
-[[package]]
-name = "inotify"
-version = "0.9.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8069d3ec154eb856955c1c0fbffefbf5f3c40a104ec912d4797314c1801abff"
-dependencies = [
- "bitflags 1.3.2",
- "inotify-sys",
- "libc",
-]
-
-[[package]]
-name = "inotify-sys"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e05c02b5e89bff3b946cedeca278abc628fe811e604f027c45a8aa3cf793d0eb"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "inout"
 version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
 dependencies = [
- "block-padding 0.3.3",
  "generic-array",
 ]
 
@@ -7521,7 +6100,7 @@ version = "0.7.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4d09b98f7eace8982db770e4408e7470b028ce513ac28fecdc6bf4c30fe92b62"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "cfg-if",
  "libc",
 ]
@@ -7696,15 +6275,6 @@ dependencies = [
  "thiserror 2.0.18",
 ]
 
-[[package]]
-name = "jsonc-parser"
-version = "0.26.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d6d80e6d70e7911a29f3cf3f44f452df85d06f73572b494ca99a2cad3fcf8f4"
-dependencies = [
- "serde_json",
-]
-
 [[package]]
 name = "jsonpath-rust"
 version = "0.7.5"
@@ -7767,20 +6337,6 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "k256"
-version = "0.13.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6e3919bbaa2945715f0bb6d3934a173d1e9a59ac23767fbaaef277265a7411b"
-dependencies = [
- "cfg-if",
- "ecdsa",
- "elliptic-curve",
- "once_cell",
- "sha2 0.10.9",
- "signature",
-]
-
 [[package]]
 name = "k8s-openapi"
 version = "0.25.0"
@@ -7793,15 +6349,6 @@ dependencies = [
  "serde_json",
 ]
 
-[[package]]
-name = "keccak"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
-dependencies = [
- "cpufeatures 0.2.17",
-]
-
 [[package]]
 name = "keyed_priority_queue"
 version = "0.4.2"
@@ -7811,23 +6358,6 @@ dependencies = [
  "indexmap 2.14.0",
 ]
 
-[[package]]
-name = "khronos-egl"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6aae1df220ece3c0ada96b8153459b67eebe9ae9212258bb0134ae60416fdf76"
-dependencies = [
- "libc",
- "libloading 0.8.9",
- "pkg-config",
-]
-
-[[package]]
-name = "khronos_api"
-version = "3.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2db585e1d738fc771bf08a151420d3ed193d9d895a36df7f6f8a9456b911ddc"
-
 [[package]]
 name = "konst"
 version = "0.2.20"
@@ -7843,26 +6373,6 @@ version = "0.2.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a4933f3f57a8e9d9da04db23fb153356ecaf00cbd14aee46279c33dc80925c37"
 
-[[package]]
-name = "kqueue"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eac30106d7dce88daf4a3fcb4879ea939476d5074a9b7ddd0fb97fa4bed5596a"
-dependencies = [
- "kqueue-sys",
- "libc",
-]
-
-[[package]]
-name = "kqueue-sys"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed9625ffda8729b85e45cf04090035ac368927b8cebc34898e7c120f52e4838b"
-dependencies = [
- "bitflags 1.3.2",
- "libc",
-]
-
 [[package]]
 name = "kube"
 version = "1.1.0"
@@ -7979,29 +6489,6 @@ version = "0.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "507460a910eb7b32ee961886ff48539633b788a36b65692b95f225b844c82553"
 
-[[package]]
-name = "lazy-regex"
-version = "3.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6bae91019476d3ec7147de9aa291cadb6d870abf2f3015d2da73a90325ac1496"
-dependencies = [
- "lazy-regex-proc_macros",
- "once_cell",
- "regex",
-]
-
-[[package]]
-name = "lazy-regex-proc_macros"
-version = "3.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4de9c1e1439d8b7b3061b2d209809f447ca33241733d9a3c01eabf2dc8d94358"
-dependencies = [
- "proc-macro2",
- "quote",
- "regex",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
@@ -8086,16 +6573,6 @@ version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
-[[package]]
-name = "libffi"
-version = "3.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce826c243048e3d5cec441799724de52e2d42f820468431fc3fceee2341871e2"
-dependencies = [
- "libc",
- "libffi-sys",
-]
-
 [[package]]
 name = "libffi-sys"
 version = "2.3.0"
@@ -8111,7 +6588,7 @@ version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9e668df13f2e97f3eed52d9301f6b1c4c1ccfccc30eab9e6628e4a8c1fc3546"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "bytes",
  "lazy_static",
  "libgssapi-sys",
@@ -8127,16 +6604,6 @@ dependencies = [
  "pkg-config",
 ]
 
-[[package]]
-name = "libloading"
-version = "0.7.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b67380fd3b2fbe7527a606e18729d21c6f3951633d0500574c4dc22d2d638b9f"
-dependencies = [
- "cfg-if",
- "winapi",
-]
-
 [[package]]
 name = "libloading"
 version = "0.8.9"
@@ -8170,7 +6637,7 @@ version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e02f3bb43d335493c96bf3fd3a321600bf6bd07ed34bc64118e9293bdffea46c"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "libc",
  "plain",
  "redox_syscall 0.7.5",
@@ -8182,7 +6649,6 @@ version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
 dependencies = [
- "cc",
  "pkg-config",
  "vcpkg",
 ]
@@ -8244,12 +6710,6 @@ version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
 
-[[package]]
-name = "litrs"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
-
 [[package]]
 name = "lock_api"
 version = "0.4.14"
@@ -8296,7 +6756,7 @@ version = "0.16.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f66e8d5d03f609abc3a39e6f08e4164ebf1447a732906d39eb9b99b7919ef39"
 dependencies = [
- "hashbrown 0.16.0",
+ "hashbrown 0.16.1",
 ]
 
 [[package]]
@@ -8320,14 +6780,14 @@ version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "373f5eceeeab7925e0c1098212f2fbc4d416adec9d35051a6ab251e824c1854a"
 dependencies = [
- "twox-hash 2.1.2",
+ "twox-hash",
 ]
 
 [[package]]
 name = "lz4_flex"
-version = "0.13.0"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db9a0d582c2874f68138a16ce1867e0ffde6c0bb0a0df85e1f36d04146db488a"
+checksum = "7ef0d4ed8669f8f8826eb00dc878084aa8f253506c4fd5e8f58f5bce72ddb97e"
 
 [[package]]
 name = "lzma-sys"
@@ -8477,15 +6937,6 @@ dependencies = [
  "malachite-nz",
 ]
 
-[[package]]
-name = "malloc_buf"
-version = "0.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62bb907fe88d54d8d9ce32a3cceab4218ed2f6b7d35617cafe9adf84e43919cb"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "mappable-rc"
 version = "0.1.1"
@@ -8540,25 +6991,6 @@ dependencies = [
  "digest 0.10.7",
 ]
 
-[[package]]
-name = "md-5"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69b6441f590336821bb897fb28fc622898ccceb1d6cea3fde5ea86b090c4de98"
-dependencies = [
- "cfg-if",
- "digest 0.11.3",
-]
-
-[[package]]
-name = "md4"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7da5ac363534dce5fabf69949225e174fbf111a498bf0ff794c8ea1fba9f3dda"
-dependencies = [
- "digest 0.10.7",
-]
-
 [[package]]
 name = "md5"
 version = "0.6.1"
@@ -8580,15 +7012,6 @@ version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
-[[package]]
-name = "memmap2"
-version = "0.5.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83faa42c0a078c393f6b29d5db232d8be22776a891f8f56e5284faee4a20b327"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "memmap2"
 version = "0.9.10"
@@ -8599,12 +7022,6 @@ dependencies = [
  "stable_deref_trait",
 ]
 
-[[package]]
-name = "memmem"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a64a92489e2744ce060c349162be1c5f33c6969234104dbd99ddb5feb08b8c15"
-
 [[package]]
 name = "memoffset"
 version = "0.9.1"
@@ -8614,21 +7031,6 @@ dependencies = [
  "autocfg",
 ]
 
-[[package]]
-name = "metal"
-version = "0.28.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5637e166ea14be6063a3f8ba5ccb9a4159df7d8f6d61c02fc3d480b1f90dcfcb"
-dependencies = [
- "bitflags 2.9.4",
- "block",
- "core-graphics-types",
- "foreign-types 0.5.0",
- "log",
- "objc",
- "paste",
-]
-
 [[package]]
 name = "miette"
 version = "7.6.0"
@@ -8689,15 +7091,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
-[[package]]
-name = "miniz_oxide"
-version = "0.7.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8a240ddb74feaf34a79a7add65a741f3167852fba007066dcac1ca548d89c08"
-dependencies = [
- "adler",
-]
-
 [[package]]
 name = "miniz_oxide"
 version = "0.8.9"
@@ -8708,18 +7101,6 @@ dependencies = [
  "simd-adler32",
 ]
 
-[[package]]
-name = "mio"
-version = "0.8.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
-dependencies = [
- "libc",
- "log",
- "wasi 0.11.1+wasi-snapshot-preview1",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "mio"
 version = "1.2.0"
@@ -8751,12 +7132,6 @@ dependencies = [
  "uuid",
 ]
 
-[[package]]
-name = "monch"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b52c1b33ff98142aecea13138bd399b68aa7ab5d9546c300988c345004001eea"
-
 [[package]]
 name = "monostate"
 version = "0.1.18"
@@ -8796,12 +7171,6 @@ dependencies = [
  "version_check",
 ]
 
-[[package]]
-name = "multimap"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d87ecb2933e8aeadb3e3a02b828fed80a7528047e68b4f424523a0981a3a084"
-
 [[package]]
 name = "murmurhash32"
 version = "0.3.1"
@@ -8852,7 +7221,7 @@ dependencies = [
  "tokio",
  "tokio-native-tls",
  "tokio-util",
- "twox-hash 2.1.2",
+ "twox-hash",
  "url",
 ]
 
@@ -8863,7 +7232,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fbb9f371618ce723f095c61fbcdc36e8936956d2b62832f9c7648689b338e052"
 dependencies = [
  "base64 0.22.1",
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "btoi",
  "byteorder",
  "bytes",
@@ -8884,28 +7253,6 @@ dependencies = [
  "uuid",
 ]
 
-[[package]]
-name = "naga"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e536ae46fcab0876853bd4a632ede5df4b1c2527a58f6c5a4150fe86be858231"
-dependencies = [
- "arrayvec",
- "bit-set 0.5.3",
- "bitflags 2.9.4",
- "codespan-reporting",
- "hexf-parse",
- "indexmap 2.14.0",
- "log",
- "num-traits",
- "rustc-hash 1.1.0",
- "serde",
- "spirv",
- "termcolor",
- "thiserror 1.0.69",
- "unicode-xid",
-]
-
 [[package]]
 name = "nanorand"
 version = "0.7.0"
@@ -8915,18 +7262,6 @@ dependencies = [
  "getrandom 0.2.17",
 ]
 
-[[package]]
-name = "napi_sym"
-version = "0.120.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33a55ec137cebb7f4a594edd16157a5b9d9addf7ebd29c88198ec4e0cff2e93e"
-dependencies = [
- "quote",
- "serde",
- "serde_json",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "native-tls"
 version = "0.2.16"
@@ -8939,52 +7274,24 @@ dependencies = [
  "openssl-probe 0.2.1",
  "openssl-sys",
  "schannel",
- "security-framework 3.6.0",
+ "security-framework 3.7.0",
  "security-framework-sys",
  "tempfile",
 ]
 
-[[package]]
-name = "ndk-sys"
-version = "0.5.0+25.2.9519653"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c196769dd60fd4f363e11d948139556a344e79d451aeb2fa2fd040738ef7691"
-dependencies = [
- "jni-sys 0.3.1",
-]
-
-[[package]]
-name = "netif"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29a01b9f018d6b7b277fef6c79fdbd9bf17bb2d1e298238055cafab49baa5ee"
-dependencies = [
- "libc",
- "winapi",
-]
-
 [[package]]
 name = "new_debug_unreachable"
 version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
 
-[[package]]
-name = "nibble_vec"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77a5d83df9f36fe23f0c3648c6bbb8b0298bb5f1939c8f2704431371f4b84d43"
-dependencies = [
- "smallvec",
-]
-
 [[package]]
 name = "nix"
 version = "0.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "cfg-if",
  "libc",
 ]
@@ -8995,9 +7302,9 @@ version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "cfg-if",
- "cfg_aliases 0.2.1",
+ "cfg_aliases",
  "libc",
 ]
 
@@ -9007,12 +7314,25 @@ version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "cfg-if",
- "cfg_aliases 0.2.1",
+ "cfg_aliases",
  "libc",
 ]
 
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags 2.11.1",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+ "memoffset",
+]
+
 [[package]]
 name = "nkeys"
 version = "0.4.5"
@@ -9028,42 +7348,6 @@ dependencies = [
  "signatory",
 ]
 
-[[package]]
-name = "node_resolver"
-version = "0.28.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "808426e80ce77a311b24ac080caf18c23c632e035d797edb217ce74cdf6a0e71"
-dependencies = [
- "anyhow",
- "async-trait",
- "boxed_error",
- "dashmap 5.5.3",
- "deno_error",
- "deno_media_type",
- "deno_package_json",
- "deno_path_util",
- "futures",
- "lazy-regex",
- "once_cell",
- "path-clean",
- "regex",
- "serde",
- "serde_json",
- "sys_traits",
- "thiserror 2.0.18",
- "url",
-]
-
-[[package]]
-name = "nom"
-version = "5.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08959a387a676302eebf4ddbcbc611da04285579f76f88ee0506c63b1a61dd4b"
-dependencies = [
- "memchr",
- "version_check",
-]
-
 [[package]]
 name = "nom"
 version = "7.1.3"
@@ -9074,25 +7358,6 @@ dependencies = [
  "minimal-lexical",
 ]
 
-[[package]]
-name = "notify"
-version = "6.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6205bd8bb1e454ad2e27422015fb5e4f2bcc7e08fa8f27058670d208324a4d2d"
-dependencies = [
- "bitflags 2.9.4",
- "crossbeam-channel",
- "filetime",
- "fsevent-sys",
- "inotify",
- "kqueue",
- "libc",
- "log",
- "mio 0.8.11",
- "walkdir",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "ntapi"
 version = "0.4.3"
@@ -9288,7 +7553,6 @@ dependencies = [
  "num-iter",
  "num-traits",
  "rand 0.8.5",
- "serde",
  "smallvec",
  "zeroize",
 ]
@@ -9418,15 +7682,6 @@ dependencies = [
  "url",
 ]
 
-[[package]]
-name = "objc"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "915b1b472bc21c53464d6c8461c9d3af805ba1ef837e1cac254428f4a77177b1"
-dependencies = [
- "malloc_buf",
-]
-
 [[package]]
 name = "object"
 version = "0.37.3"
@@ -9482,22 +7737,13 @@ dependencies = [
  "cc",
 ]
 
-[[package]]
-name = "oid-registry"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9bedf36ffb6ba96c2eb7144ef6270557b52e54b20c0a8e1eb2ff99a6c6959bff"
-dependencies = [
- "asn1-rs 0.5.2",
-]
-
 [[package]]
 name = "oid-registry"
 version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a8d8034d9489cdaf79228eb9f6a3b8d7bb32ba00d6645ebd48eef4077ceb5bd9"
 dependencies = [
- "asn1-rs 0.6.2",
+ "asn1-rs",
 ]
 
 [[package]]
@@ -9530,7 +7776,7 @@ version = "6.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0cc3cbf698f9438986c11a880c90a6d04b9de27575afd28bbf45b154b6c709e2"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "libc",
  "once_cell",
  "onig_sys",
@@ -9562,7 +7808,7 @@ dependencies = [
  "chrono",
  "dyn-clone",
  "ed25519-dalek",
- "hmac 0.12.1",
+ "hmac",
  "http 1.4.0",
  "itertools 0.10.5",
  "log",
@@ -9589,9 +7835,9 @@ version = "0.10.79"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bf0b434746ee2832f4f0baf10137e1cabb18cbe6912c69e2e33263c45250f542"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "cfg-if",
- "foreign-types 0.3.2",
+ "foreign-types",
  "libc",
  "openssl-macros",
  "openssl-sys",
@@ -9804,6 +8050,8 @@ dependencies = [
  "rand 0.8.5",
  "serde_json",
  "thiserror 1.0.69",
+ "tokio",
+ "tokio-stream",
  "tracing",
 ]
 
@@ -9878,20 +8126,14 @@ dependencies = [
 
 [[package]]
 name = "os_pipe"
-version = "1.1.5"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57119c3b893986491ec9aa85056780d3a0f3cf4da7cc09dd3650dbd6c6738fb9"
+checksum = "5ffd2b0a5634335b135d5728d84c5e0fd726954b87111f7506a61c502280d982"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
-[[package]]
-name = "outref"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f222829ae9293e33a9f5e9f440c6760a3d450a64affe1846486b140db81c1f4"
-
 [[package]]
 name = "outref"
 version = "0.5.2"
@@ -9912,18 +8154,6 @@ version = "4.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d211803b9b6b570f68772237e415a029d5a50c65d382910b879fb19d3271f94d"
 
-[[package]]
-name = "p224"
-version = "0.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30c06436d66652bc2f01ade021592c80a2aad401570a18aa18b82e440d2b9aa1"
-dependencies = [
- "ecdsa",
- "elliptic-curve",
- "primeorder",
- "sha2 0.10.9",
-]
-
 [[package]]
 name = "p256"
 version = "0.13.2"
@@ -9949,17 +8179,12 @@ dependencies = [
 ]
 
 [[package]]
-name = "p521"
-version = "0.13.3"
+name = "par-core"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fc9e2161f1f215afdfce23677034ae137bbd45016a880c2eb3ba8eb95f085b2"
+checksum = "e96cbd21255b7fb29a5d51ef38a779b517a91abd59e2756c039583f43ef4c90f"
 dependencies = [
- "base16ct",
- "ecdsa",
- "elliptic-curve",
- "primeorder",
- "rand_core 0.6.4",
- "sha2 0.10.9",
+ "once_cell",
 ]
 
 [[package]]
@@ -10023,7 +8248,7 @@ dependencies = [
  "snap",
  "thrift",
  "tokio",
- "twox-hash 2.1.2",
+ "twox-hash",
  "zstd",
 ]
 
@@ -10050,28 +8275,12 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c5a797f0e07bdf071d15742978fc3128ec6c22891c31a3a931513263904c982a"
 
-[[package]]
-name = "path-clean"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecba01bf2678719532c5e3059e0b5f0811273d94b397088b82e3bd0a78c78fdd"
-
 [[package]]
 name = "pathdiff"
 version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df94ce210e5bc13cb6651479fa48d14f601d9858cfe0467f43ae157023b938d3"
 
-[[package]]
-name = "pbkdf2"
-version = "0.12.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
-dependencies = [
- "digest 0.10.7",
- "hmac 0.12.1",
-]
-
 [[package]]
 name = "pem"
 version = "1.1.1"
@@ -10199,6 +8408,16 @@ dependencies = [
  "phf_shared 0.12.1",
 ]
 
+[[package]]
+name = "phf"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+dependencies = [
+ "phf_shared 0.13.1",
+ "serde",
+]
+
 [[package]]
 name = "phf_codegen"
 version = "0.11.3"
@@ -10250,6 +8469,15 @@ dependencies = [
  "siphasher 1.0.3",
 ]
 
+[[package]]
+name = "phf_shared"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+dependencies = [
+ "siphasher 1.0.3",
+]
+
 [[package]]
 name = "php-parser-rs"
 version = "0.1.3"
@@ -10305,21 +8533,6 @@ dependencies = [
  "spki",
 ]
 
-[[package]]
-name = "pkcs5"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e847e2c91a18bfa887dd028ec33f2fe6f25db77db3619024764914affe8b69a6"
-dependencies = [
- "aes 0.8.3",
- "cbc",
- "der",
- "pbkdf2",
- "scrypt",
- "sha2 0.10.9",
- "spki",
-]
-
 [[package]]
 name = "pkcs8"
 version = "0.10.2"
@@ -10327,8 +8540,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
 dependencies = [
  "der",
- "pkcs5",
- "rand_core 0.6.4",
  "spki",
 ]
 
@@ -10344,19 +8555,6 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
-[[package]]
-name = "png"
-version = "0.17.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82151a2fc869e011c153adc57cf2789ccb8d9906ce52c0b39a6b5697749d7526"
-dependencies = [
- "bitflags 1.3.2",
- "crc32fast",
- "fdeflate",
- "flate2",
- "miniz_oxide 0.8.9",
-]
-
 [[package]]
 name = "polyval"
 version = "0.6.2"
@@ -10377,85 +8575,56 @@ checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
 
 [[package]]
 name = "postgres-native-tls"
-version = "0.5.0"
-source = "git+https://github.com/imor/rust-postgres?rev=20265ef38e32a06f76b6f9b678e2077fc2211f6b#20265ef38e32a06f76b6f9b678e2077fc2211f6b"
+version = "0.5.2"
+source = "git+https://github.com/MaterializeInc/rust-postgres?rev=78c1222577bb091d69bc22b1bc7ad01c14675abe#78c1222577bb091d69bc22b1bc7ad01c14675abe"
 dependencies = [
  "native-tls",
  "tokio",
  "tokio-native-tls",
- "tokio-postgres 0.7.11",
+ "tokio-postgres",
 ]
 
 [[package]]
 name = "postgres-native-tls"
-version = "0.5.1"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1f39498473c92f7b6820ae970382c1d83178a3454c618161cb772e8598d9f6f"
+checksum = "fef4de47bb81477e0c3deaf153a1b10ae176484713ff1640969f4cb96b653ebc"
 dependencies = [
  "native-tls",
  "tokio",
  "tokio-native-tls",
- "tokio-postgres 0.7.13",
+ "tokio-postgres",
 ]
 
 [[package]]
 name = "postgres-protocol"
-version = "0.6.7"
-source = "git+https://github.com/imor/rust-postgres?rev=20265ef38e32a06f76b6f9b678e2077fc2211f6b#20265ef38e32a06f76b6f9b678e2077fc2211f6b"
+version = "0.6.9"
+source = "git+https://github.com/MaterializeInc/rust-postgres?rev=78c1222577bb091d69bc22b1bc7ad01c14675abe#78c1222577bb091d69bc22b1bc7ad01c14675abe"
 dependencies = [
  "base64 0.22.1",
  "byteorder",
  "bytes",
- "fallible-iterator 0.2.0",
- "hmac 0.12.1",
+ "fallible-iterator",
+ "hmac",
  "md-5 0.10.6",
  "memchr",
- "rand 0.8.5",
+ "rand 0.9.0",
  "sha2 0.10.9",
  "stringprep",
 ]
 
-[[package]]
-name = "postgres-protocol"
-version = "0.6.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56201207dac53e2f38e848e31b4b91616a6bb6e0c7205b77718994a7f49e70fc"
-dependencies = [
- "base64 0.22.1",
- "byteorder",
- "bytes",
- "fallible-iterator 0.2.0",
- "hmac 0.13.0",
- "md-5 0.11.0",
- "memchr",
- "rand 0.10.1",
- "sha2 0.11.0",
- "stringprep",
-]
-
 [[package]]
 name = "postgres-types"
-version = "0.2.7"
-source = "git+https://github.com/imor/rust-postgres?rev=20265ef38e32a06f76b6f9b678e2077fc2211f6b#20265ef38e32a06f76b6f9b678e2077fc2211f6b"
-dependencies = [
- "bytes",
- "fallible-iterator 0.2.0",
- "postgres-protocol 0.6.7",
-]
-
-[[package]]
-name = "postgres-types"
-version = "0.2.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613283563cd90e1dfc3518d548caee47e0e725455ed619881f5cf21f36de4b48"
+version = "0.2.11"
+source = "git+https://github.com/MaterializeInc/rust-postgres?rev=78c1222577bb091d69bc22b1bc7ad01c14675abe#78c1222577bb091d69bc22b1bc7ad01c14675abe"
 dependencies = [
  "array-init",
  "bit-vec 0.6.3",
  "bytes",
  "chrono",
- "fallible-iterator 0.2.0",
- "postgres-protocol 0.6.11",
- "serde",
+ "fallible-iterator",
+ "postgres-protocol",
+ "serde_core",
  "serde_json",
  "uuid",
 ]
@@ -10511,11 +8680,11 @@ dependencies = [
 
 [[package]]
 name = "proc-macro-crate"
-version = "3.4.0"
+version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "219cb19e96be00ab2e37d6e299658a0cfa83e52429179969b0f0121b4ac46983"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
 dependencies = [
- "toml_edit 0.23.4",
+ "toml_edit 0.25.11+spec-1.1.0",
 ]
 
 [[package]]
@@ -10527,7 +8696,6 @@ dependencies = [
  "proc-macro-error-attr",
  "proc-macro2",
  "quote",
- "syn 1.0.109",
  "version_check",
 ]
 
@@ -10616,7 +8784,7 @@ version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cc5b72d8145275d844d4b5f6d4e1eef00c8cd889edb6035c21675d1bb1f45c9f"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "chrono",
  "flate2",
  "hex",
@@ -10630,17 +8798,11 @@ version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "239df02d8349b06fc07398a3a1697b06418223b1c7725085e801e7c0fc6a12ec"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "chrono",
  "hex",
 ]
 
-[[package]]
-name = "profiling"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d595e54a326bc53c1c197b32d295e14b169e3cfeaa8dc82b529f947fba6bcf5"
-
 [[package]]
 name = "prometheus"
 version = "0.14.0"
@@ -10665,26 +8827,6 @@ dependencies = [
  "prost-derive",
 ]
 
-[[package]]
-name = "prost-build"
-version = "0.13.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
-dependencies = [
- "heck 0.5.0",
- "itertools 0.14.0",
- "log",
- "multimap",
- "once_cell",
- "petgraph",
- "prettyplease",
- "prost",
- "prost-types",
- "regex",
- "syn 2.0.117",
- "tempfile",
-]
-
 [[package]]
 name = "prost-derive"
 version = "0.13.5"
@@ -10743,7 +8885,7 @@ version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "57206b407293d2bcd3af849ce869d52068623f19e1b5ff8e8778e3309439682b"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "getopts",
  "memchr",
  "unicase",
@@ -10806,7 +8948,7 @@ checksum = "5a70b1b8b47e31d0498ecbc3c5470bb931399a8bfed1fd79d1717a61ce7f96e3"
 dependencies = [
  "ahash 0.8.12",
  "equivalent",
- "hashbrown 0.16.0",
+ "hashbrown 0.16.1",
  "parking_lot",
 ]
 
@@ -10817,7 +8959,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
 dependencies = [
  "bytes",
- "cfg_aliases 0.2.1",
+ "cfg_aliases",
  "pin-project-lite",
  "quinn-proto",
  "quinn-udp",
@@ -10858,7 +9000,7 @@ version = "0.5.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
 dependencies = [
- "cfg_aliases 0.2.1",
+ "cfg_aliases",
  "libc",
  "once_cell",
  "socket2 0.6.3",
@@ -10893,16 +9035,6 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
 
-[[package]]
-name = "radix_trie"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c069c179fcdc6a2fe24d8d18305cf085fdbd4f922c041943e203685d6a1c58fd"
-dependencies = [
- "endian-type",
- "nibble_vec",
-]
-
 [[package]]
 name = "rand"
 version = "0.7.3"
@@ -11031,27 +9163,15 @@ dependencies = [
  "rand_core 0.5.1",
 ]
 
-[[package]]
-name = "range-alloc"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca45419789ae5a7899559e9512e58ca889e41f04f1f2445e9f4b290ceccd1d08"
-
 [[package]]
 name = "raw-cpuid"
 version = "11.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
 ]
 
-[[package]]
-name = "raw-window-handle"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20675572f6f24e9e76ef639bc5552774ed45f1c30e2951e1e99c59888861c539"
-
 [[package]]
 name = "rayon"
 version = "1.12.0"
@@ -11093,7 +9213,7 @@ dependencies = [
  "ring 0.17.14",
  "rustls-pki-types",
  "time",
- "x509-parser 0.16.0",
+ "x509-parser",
  "yasna",
 ]
 
@@ -11163,7 +9283,7 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
 ]
 
 [[package]]
@@ -11172,7 +9292,7 @@ version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4666a1a60d8412eab19d94f6d13dcc9cea0a5ef4fdf6a5db306537413c661b1b"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
 ]
 
 [[package]]
@@ -11414,11 +9534,11 @@ checksum = "1e061d1b48cb8d38042de4ae0a7a6401009d6143dc80d2e2d6f31f0bdd6470c7"
 
 [[package]]
 name = "retry-policies"
-version = "0.5.0"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "503c78f59814e2664c9980b739b19e40f549233ecf39928040ee54fdd431f614"
+checksum = "dc05fbf560421a0357a750cbe78c7ca19d4923918490daabba313d5dbc871e47"
 dependencies = [
- "rand 0.8.5",
+ "rand 0.10.1",
 ]
 
 [[package]]
@@ -11427,7 +9547,7 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
 dependencies = [
- "hmac 0.12.1",
+ "hmac",
  "subtle",
 ]
 
@@ -11460,15 +9580,6 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "ripemd"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd124222d17ad93a644ed9d011a40f4fb64aa54275c08cc216524a9ea82fb09f"
-dependencies = [
- "digest 0.10.7",
-]
-
 [[package]]
 name = "rkyv"
 version = "0.7.46"
@@ -11505,7 +9616,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1bef41ebc9ebed2c1b1d90203e9d1756091e8a00bbc3107676151f39868ca0ee"
 dependencies = [
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "bytes",
  "chrono",
@@ -11546,18 +9657,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "ron"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b91f7eff05f748767f183df4320a63d6936e9c6107d97c9e6bdd9784f4289c94"
-dependencies = [
- "base64 0.21.7",
- "bitflags 2.9.4",
- "serde",
- "serde_derive",
-]
-
 [[package]]
 name = "rquickjs"
 version = "0.11.0"
@@ -11575,7 +9674,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8bf7840285c321c3ab20e752a9afb95548c75cd7f4632a0627cea3507e310c1"
 dependencies = [
  "async-lock",
- "hashbrown 0.16.0",
+ "hashbrown 0.16.1",
  "relative-path",
  "rquickjs-sys",
 ]
@@ -11612,7 +9711,7 @@ version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
 dependencies = [
- "const-oid 0.9.6",
+ "const-oid",
  "digest 0.10.7",
  "num-bigint-dig",
  "num-integer",
@@ -11646,20 +9745,6 @@ dependencies = [
  "tokio-rustls 0.25.0",
 ]
 
-[[package]]
-name = "rusqlite"
-version = "0.32.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7753b721174eb8ff87a9a0e799e2d7bc3749323e773db92e0984debb00019d6e"
-dependencies = [
- "bitflags 2.9.4",
- "fallible-iterator 0.3.0",
- "fallible-streaming-iterator",
- "hashlink 0.9.1",
- "libsqlite3-sys",
- "smallvec",
-]
-
 [[package]]
 name = "rust-embed"
 version = "6.8.1"
@@ -11715,7 +9800,7 @@ dependencies = [
  "borsh",
  "bytes",
  "num-traits",
- "postgres-types 0.2.9",
+ "postgres-types",
  "rand 0.8.5",
  "rkyv",
  "serde",
@@ -11765,7 +9850,7 @@ version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
 dependencies = [
- "nom 7.1.3",
+ "nom",
 ]
 
 [[package]]
@@ -11774,7 +9859,7 @@ version = "0.38.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "errno",
  "libc",
  "linux-raw-sys 0.4.15",
@@ -11787,7 +9872,7 @@ version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
@@ -11870,7 +9955,7 @@ dependencies = [
  "openssl-probe 0.2.1",
  "rustls-pki-types",
  "schannel",
- "security-framework 3.6.0",
+ "security-framework 3.7.0",
 ]
 
 [[package]]
@@ -11916,9 +10001,9 @@ dependencies = [
  "rustls-native-certs 0.8.3",
  "rustls-platform-verifier-android",
  "rustls-webpki 0.103.13",
- "security-framework 3.6.0",
+ "security-framework 3.7.0",
  "security-framework-sys",
- "webpki-root-certs 1.0.7",
+ "webpki-root-certs",
  "windows-sys 0.61.2",
 ]
 
@@ -11930,9 +10015,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-tokio-stream"
-version = "0.3.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22557157d7395bc30727745b365d923f1ecc230c4c80b176545f3f4f08c46e33"
+checksum = "faa7dc7c991d9164e55bbf1558029eb5b84d32cc4d61a7df5b8641b2deedc4b3"
 dependencies = [
  "futures",
  "rustls 0.23.35",
@@ -12036,28 +10121,6 @@ version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
-[[package]]
-name = "rustyline"
-version = "13.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02a2d683a4ac90aeef5b1013933f6d977bd37d51ff3f4dad829d4931a7e6be86"
-dependencies = [
- "bitflags 2.9.4",
- "cfg-if",
- "clipboard-win",
- "fd-lock",
- "home",
- "libc",
- "log",
- "memchr",
- "nix 0.27.1",
- "radix_trie",
- "unicode-segmentation",
- "unicode-width 0.1.14",
- "utf8parse",
- "winapi",
-]
-
 [[package]]
 name = "ryu"
 version = "1.0.23"
@@ -12076,30 +10139,11 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "675656c1eabb620b921efea4f9199f97fc86e36dd6ffd1fbbe48d0f59a4987f5"
 dependencies = [
- "hashbrown 0.16.0",
+ "hashbrown 0.16.1",
  "serde",
  "serde_json",
 ]
 
-[[package]]
-name = "saffron"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03fb9a628596fc7590eb7edbf7b0613287be78df107f5f97b118aad59fb2eea9"
-dependencies = [
- "chrono",
- "nom 5.1.3",
-]
-
-[[package]]
-name = "salsa20"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97a22f5af31f73a954c10289c93e8a50cc23d971e80ee446f1f6f7137a088213"
-dependencies = [
- "cipher 0.4.4",
-]
-
 [[package]]
 name = "samael"
 version = "0.0.20"
@@ -12245,18 +10289,6 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
-[[package]]
-name = "scrypt"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0516a385866c09368f0b5bcd1caff3366aace790fcd46e2bb032697bb172fd1f"
-dependencies = [
- "password-hash",
- "pbkdf2",
- "salsa20",
- "sha2 0.10.9",
-]
-
 [[package]]
 name = "sct"
 version = "0.7.1"
@@ -12289,7 +10321,6 @@ dependencies = [
  "der",
  "generic-array",
  "pkcs8",
- "serdect",
  "subtle",
  "zeroize",
 ]
@@ -12309,7 +10340,7 @@ version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "core-foundation 0.9.4",
  "core-foundation-sys",
  "libc",
@@ -12318,11 +10349,11 @@ dependencies = [
 
 [[package]]
 name = "security-framework"
-version = "3.6.0"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d17b898a6d6948c3a8ee4372c17cb384f90d2e6e912ef00895b14fd7ab54ec38"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "core-foundation 0.10.1",
  "core-foundation-sys",
  "libc",
@@ -12368,9 +10399,9 @@ checksum = "1bc711410fbe7399f390ca1c3b60ad0f53f80e95c5eb935e52268a0e2cd49acc"
 
 [[package]]
 name = "serde"
-version = "1.0.220"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ceecad4c782e936ac90ecfd6b56532322e3262b14320abf30ce89a92ffdbfe22"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
 dependencies = [
  "serde_core",
  "serde_derive",
@@ -12409,30 +10440,20 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "serde_bytes"
-version = "0.11.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5d440709e79d88e51ac01c4b72fc6cb7314017bb7da9eeff678aa94c10e3ea8"
-dependencies = [
- "serde",
- "serde_core",
-]
-
 [[package]]
 name = "serde_core"
-version = "1.0.220"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddba47394f3b862d6ff6efdbd26ca4673e3566a307880a0ffb98f274bbe0ec32"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.220"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60e1f3b1761e96def5ec6d04a6e7421c0404fa3cf5c0155f1e2848fae3d8cc08"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -12527,11 +10548,11 @@ dependencies = [
 
 [[package]]
 name = "serde_v8"
-version = "0.245.0"
+version = "0.261.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "945f93c91e0c7e4799b5fefff076756141aae92e262c4dc4833310dd3d2d845e"
+checksum = "3495190857461e87a2716141043218aad5281f219f54a03b7ebbe605b3b931df"
 dependencies = [
- "deno_error",
+ "deno_error 0.6.1",
  "num-bigint",
  "serde",
  "smallvec",
@@ -12541,19 +10562,19 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.14.1"
+version = "3.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c522100790450cf78eeac1507263d0a350d4d5b30df0c8e1fe051a10c22b376e"
+checksum = "e72c1c2cb7b223fafb600a619537a871c2818583d619401b785e7c0b746ccde2"
 dependencies = [
  "base64 0.22.1",
+ "bs58",
  "chrono",
  "hex",
  "indexmap 1.9.3",
  "indexmap 2.14.0",
  "schemars 0.9.0",
  "schemars 1.2.1",
- "serde",
- "serde_derive",
+ "serde_core",
  "serde_json",
  "serde_with_macros",
  "time",
@@ -12561,11 +10582,11 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.14.1"
+version = "3.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "327ada00f7d64abaac1e55a6911e90cf665aa051b9a561c7006c157f4633135e"
+checksum = "b90c488738ecb4fb0262f41f43bc40efc5868d9fb744319ddf5f5317f417bfac"
 dependencies = [
- "darling 0.21.3",
+ "darling 0.23.0",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -12599,16 +10620,6 @@ dependencies = [
  "version_check",
 ]
 
-[[package]]
-name = "serdect"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a84f14a19e9a014bb9f4512488d9829a68e04ecabffb0f9904cd1ace94598177"
-dependencies = [
- "base16ct",
- "serde",
-]
-
 [[package]]
 name = "serial_test"
 version = "3.4.0"
@@ -12670,27 +10681,6 @@ dependencies = [
  "digest 0.10.7",
 ]
 
-[[package]]
-name = "sha2"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.3.0",
- "digest 0.11.3",
-]
-
-[[package]]
-name = "sha3"
-version = "0.10.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874"
-dependencies = [
- "digest 0.10.7",
- "keccak",
-]
-
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -12725,16 +10715,6 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
-[[package]]
-name = "signal-hook"
-version = "0.3.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d881a16cf4426aa584979d30bd82cb33429027e42122b169753d6ef1085ed6e2"
-dependencies = [
- "libc",
- "signal-hook-registry",
-]
-
 [[package]]
 name = "signal-hook-registry"
 version = "1.4.8"
@@ -12767,36 +10747,12 @@ dependencies = [
  "rand_core 0.6.4",
 ]
 
-[[package]]
-name = "simd-abstraction"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cadb29c57caadc51ff8346233b5cec1d240b68ce55cf1afc764818791876987"
-dependencies = [
- "outref 0.1.0",
-]
-
 [[package]]
 name = "simd-adler32"
 version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
 
-[[package]]
-name = "simd-json"
-version = "0.14.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa2bcf6c6e164e81bc7a5d49fc6988b3d515d9e8c07457d7b74ffb9324b9cd40"
-dependencies = [
- "getrandom 0.2.17",
- "halfbrown",
- "ref-cast",
- "serde",
- "serde_json",
- "simdutf8",
- "value-trait",
-]
-
 [[package]]
 name = "simdutf8"
 version = "0.1.5"
@@ -12848,24 +10804,6 @@ version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
-[[package]]
-name = "slotmap"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdd58c3c93c3d278ca835519292445cb4b0d4dc59ccfdf7ceadaab3f8aeb4038"
-dependencies = [
- "version_check",
-]
-
-[[package]]
-name = "sm3"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebb9a3b702d0a7e33bc4d85a14456633d2b165c2ad839c5fd9a8417c1ab15860"
-dependencies = [
- "digest 0.10.7",
-]
-
 [[package]]
 name = "smallvec"
 version = "1.15.1"
@@ -12929,32 +10867,13 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "sourcemap"
-version = "8.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "208d40b9e8cad9f93613778ea295ed8f3c2b1824217c6cfc7219d3f6f45b96d4"
-dependencies = [
- "base64-simd 0.7.0",
- "bitvec",
- "data-encoding",
- "debugid",
- "if_chain",
- "rustc-hash 1.1.0",
- "rustc_version 0.2.3",
- "serde",
- "serde_json",
- "unicode-id-start",
- "url",
-]
-
 [[package]]
 name = "sourcemap"
 version = "9.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "314d62a489431668f719ada776ca1d49b924db951b7450f8974c9ae51ab05ad7"
 dependencies = [
- "base64-simd 0.8.0",
+ "base64-simd",
  "bitvec",
  "data-encoding",
  "debugid",
@@ -12981,15 +10900,6 @@ dependencies = [
  "lock_api",
 ]
 
-[[package]]
-name = "spirv"
-version = "0.3.0+sdk-1.3.268.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eda41003dc44290527a59b13432d4a0379379fa074b70174882adfbdfd917844"
-dependencies = [
- "bitflags 2.9.4",
-]
-
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -13007,17 +10917,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5851699c4033c63636f7ea4cf7b7c1f1bf06d0cc03cfb42e711de5a5c46cf326"
 dependencies = [
  "base64 0.13.1",
- "nom 7.1.3",
+ "nom",
  "serde",
  "unicode-segmentation",
 ]
 
-[[package]]
-name = "sptr"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b9b39299b249ad65f3b7e96443bad61c02ca5cd3589f46cb6d610a0fd6c0d6a"
-
 [[package]]
 name = "sql-builder"
 version = "3.1.1"
@@ -13093,7 +10997,7 @@ dependencies = [
  "futures-io",
  "futures-util",
  "hashbrown 0.15.5",
- "hashlink 0.10.0",
+ "hashlink",
  "indexmap 2.14.0",
  "log",
  "memchr",
@@ -13160,7 +11064,7 @@ dependencies = [
  "atoi",
  "base64 0.22.1",
  "bigdecimal",
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "byteorder",
  "bytes",
  "chrono",
@@ -13175,7 +11079,7 @@ dependencies = [
  "generic-array",
  "hex",
  "hkdf",
- "hmac 0.12.1",
+ "hmac",
  "itoa",
  "log",
  "md-5 0.10.6",
@@ -13205,7 +11109,7 @@ dependencies = [
  "atoi",
  "base64 0.22.1",
  "bigdecimal",
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "byteorder",
  "chrono",
  "crc",
@@ -13216,7 +11120,7 @@ dependencies = [
  "futures-util",
  "hex",
  "hkdf",
- "hmac 0.12.1",
+ "hmac",
  "home",
  "itoa",
  "log",
@@ -13303,11 +11207,10 @@ checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
 [[package]]
 name = "string_enum"
-version = "0.4.4"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05e383308aebc257e7d7920224fa055c632478d92744eca77f99be8fa1545b90"
+checksum = "ae36a4951ca7bd1cfd991c241584a9824a70f6aff1e7d4f693fb3f2465e4030e"
 dependencies = [
- "proc-macro2",
  "quote",
  "swc_macros_common",
  "syn 2.0.117",
@@ -13315,9 +11218,9 @@ dependencies = [
 
 [[package]]
 name = "stringcase"
-version = "0.3.0"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04028eeb851ed08af6aba5caa29f2d59a13ed168cee4d6bd753aeefcf1d636b0"
+checksum = "72abeda133c49d7bddece6c154728f83eec8172380c80ab7096da9487e20d27c"
 
 [[package]]
 name = "stringprep"
@@ -13423,64 +11326,48 @@ checksum = "b7401a30af6cb5818bb64852270bb722533397edcfc7344954a38f420819ece2"
 
 [[package]]
 name = "swc_allocator"
-version = "0.1.10"
+version = "4.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76aa0eb65c0f39f9b6d82a7e5192c30f7ac9a78f084a21f270de1d8c600ca388"
+checksum = "9d7eefd2c8b228a8c73056482b2ae4b3a1071fbe07638e3b55ceca8570cc48bb"
 dependencies = [
+ "allocator-api2",
  "bumpalo",
  "hashbrown 0.14.5",
- "ptr_meta",
- "rustc-hash 1.1.0",
- "triomphe",
+ "rustc-hash 2.1.2",
 ]
 
 [[package]]
 name = "swc_atoms"
-version = "0.6.7"
+version = "7.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb6567e4e67485b3e7662b486f1565bdae54bd5b9d6b16b2ba1a9babb1e42125"
+checksum = "3500dcf04c84606b38464561edc5e46f5132201cb3e23cf9613ed4033d6b1bb2"
 dependencies = [
  "hstr",
  "once_cell",
- "rustc-hash 1.1.0",
- "serde",
-]
-
-[[package]]
-name = "swc_cached"
-version = "0.3.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83406221c501860fce9c27444f44125eafe9e598b8b81be7563d7036784cd05c"
-dependencies = [
- "ahash 0.8.12",
- "anyhow",
- "dashmap 5.5.3",
- "once_cell",
- "regex",
  "serde",
 ]
 
 [[package]]
 name = "swc_common"
-version = "0.37.5"
+version = "14.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12d0a8eaaf1606c9207077d75828008cb2dfb51b095a766bd2b72ef893576e31"
+checksum = "c2bb772b3a26b8b71d4e8c112ced5b5867be2266364b58517407a270328a2696"
 dependencies = [
+ "anyhow",
  "ast_node",
  "better_scoped_tls",
- "cfg-if",
+ "bytes-str",
  "either",
  "from_variant",
  "new_debug_unreachable",
  "num-bigint",
  "once_cell",
- "rustc-hash 1.1.0",
+ "rustc-hash 2.1.2",
  "serde",
  "siphasher 0.3.11",
- "sourcemap 9.3.2",
- "swc_allocator",
  "swc_atoms",
  "swc_eq_ignore_macros",
+ "swc_sourcemap",
  "swc_visit",
  "tracing",
  "unicode-width 0.1.14",
@@ -13489,23 +11376,23 @@ dependencies = [
 
 [[package]]
 name = "swc_config"
-version = "0.1.15"
+version = "3.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4740e53eaf68b101203c1df0937d5161a29f3c13bceed0836ddfe245b72dd000"
+checksum = "72e90b52ee734ded867104612218101722ad87ff4cf74fe30383bd244a533f97"
 dependencies = [
  "anyhow",
+ "bytes-str",
  "indexmap 2.14.0",
  "serde",
  "serde_json",
- "swc_cached",
  "swc_config_macro",
 ]
 
 [[package]]
 name = "swc_config_macro"
-version = "0.1.4"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c5f56139042c1a95b54f5ca48baa0e0172d369bcc9d3d473dad1de36bae8399"
+checksum = "7b416e8ce6de17dc5ea496e10c7012b35bbc0e3fef38d2e065eed936490db0b3"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -13515,78 +11402,72 @@ dependencies = [
 
 [[package]]
 name = "swc_ecma_ast"
-version = "0.118.2"
+version = "15.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6f866d12e4d519052b92a0a86d1ac7ff17570da1272ca0c89b3d6f802cd79df"
+checksum = "65c25af97d53cf8aab66a6c68f3418663313fc969ad267fc2a4d19402c329be1"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "is-macro",
  "num-bigint",
+ "once_cell",
  "phf 0.11.3",
- "scoped-tls",
+ "rustc-hash 2.1.2",
  "serde",
  "string_enum",
  "swc_atoms",
  "swc_common",
+ "swc_visit",
  "unicode-id-start",
 ]
 
 [[package]]
 name = "swc_ecma_codegen"
-version = "0.155.1"
+version = "17.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc7641608ef117cfbef9581a99d02059b522fcca75e5244fa0cbbd8606689c6f"
+checksum = "bcf55c2d7555c93f4945e29f93b7529562be97ba16e60dd94c25724d746174ac"
 dependencies = [
+ "ascii",
+ "compact_str",
  "memchr",
  "num-bigint",
  "once_cell",
+ "regex",
+ "rustc-hash 2.1.2",
+ "ryu-js",
  "serde",
- "sourcemap 9.3.2",
  "swc_allocator",
  "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_codegen_macros",
+ "swc_sourcemap",
  "tracing",
 ]
 
 [[package]]
 name = "swc_ecma_codegen_macros"
-version = "0.7.7"
+version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "859fabde36db38634f3fad548dd5e3410c1aebba1b67a3c63e67018fa57a0bca"
+checksum = "e276dc62c0a2625a560397827989c82a93fd545fcf6f7faec0935a82cc4ddbb8"
 dependencies = [
  "proc-macro2",
- "quote",
  "swc_macros_common",
  "syn 2.0.117",
 ]
 
 [[package]]
-name = "swc_ecma_loader"
-version = "0.49.1"
+name = "swc_ecma_lexer"
+version = "23.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55fa3d55045b97894bfb04d38aff6d6302ac8a6a38e3bb3dfb0d20475c4974a9"
-dependencies = [
- "anyhow",
- "pathdiff",
- "serde",
- "swc_atoms",
- "swc_common",
- "tracing",
-]
-
-[[package]]
-name = "swc_ecma_parser"
-version = "0.149.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "683dada14722714588b56481399c699378b35b2ba4deb5c4db2fb627a97fb54b"
+checksum = "017d06ea85008234aa9fb34d805c7dc563f2ea6e03869ed5ac5a2dc27d561e4d"
 dependencies = [
+ "arrayvec",
+ "bitflags 2.11.1",
  "either",
- "new_debug_unreachable",
  "num-bigint",
- "num-traits",
  "phf 0.11.3",
+ "rustc-hash 2.1.2",
+ "seq-macro",
  "serde",
  "smallvec",
  "smartstring",
@@ -13595,23 +11476,52 @@ dependencies = [
  "swc_common",
  "swc_ecma_ast",
  "tracing",
- "typed-arena",
+]
+
+[[package]]
+name = "swc_ecma_loader"
+version = "14.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c675d14700c92f12585049b22b02356f1e142f4b0c32a4d0eb4b7a968a4c0c1e"
+dependencies = [
+ "anyhow",
+ "pathdiff",
+ "rustc-hash 2.1.2",
+ "serde",
+ "swc_atoms",
+ "swc_common",
+ "tracing",
+]
+
+[[package]]
+name = "swc_ecma_parser"
+version = "24.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e9011783c975ba592ffc09cd208ced92b1dfabb2e5e0ef453559e2e25286127"
+dependencies = [
+ "either",
+ "num-bigint",
+ "serde",
+ "swc_atoms",
+ "swc_common",
+ "swc_ecma_ast",
+ "swc_ecma_lexer",
+ "tracing",
 ]
 
 [[package]]
 name = "swc_ecma_transforms_base"
-version = "0.145.0"
+version = "27.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65f21494e75d0bd8ef42010b47cabab9caaed8f2207570e809f6f4eb51a710d1"
+checksum = "6c6f1b8f4232e7a7f614ff7c0f6ccb89c2d028cdf7629f79ad710cff5b28b62c"
 dependencies = [
  "better_scoped_tls",
- "bitflags 2.9.4",
  "indexmap 2.14.0",
  "once_cell",
+ "par-core",
  "phf 0.11.3",
- "rustc-hash 1.1.0",
+ "rustc-hash 2.1.2",
  "serde",
- "smallvec",
  "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
@@ -13623,11 +11533,10 @@ dependencies = [
 
 [[package]]
 name = "swc_ecma_transforms_classes"
-version = "0.134.0"
+version = "27.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c3d884594385bea9405a2e1721151470d9a14d3ceec5dd773c0ca6894791601"
+checksum = "108d4d52db6151f768a516fe86e6f21fc783b03fa2d20292999f29275fd0c71d"
 dependencies = [
- "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_transforms_base",
@@ -13637,9 +11546,9 @@ dependencies = [
 
 [[package]]
 name = "swc_ecma_transforms_macros"
-version = "0.5.5"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "500a1dadad1e0e41e417d633b3d6d5de677c9e0d3159b94ba3348436cdb15aab"
+checksum = "bc777288799bf6786e5200325a56e4fbabba590264a4a48a0c70b16ad0cf5cd8"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -13649,56 +11558,54 @@ dependencies = [
 
 [[package]]
 name = "swc_ecma_transforms_proposal"
-version = "0.179.0"
+version = "27.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79938ff510fc647febd8c6c3ef4143d099fdad87a223680e632623d056dae2dd"
+checksum = "39b3b34f6a28348416174912009d09994ab71c867682ec78d641a9feb3a96b4e"
 dependencies = [
  "either",
- "rustc-hash 1.1.0",
+ "rustc-hash 2.1.2",
  "serde",
- "smallvec",
  "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_transforms_base",
  "swc_ecma_transforms_classes",
- "swc_ecma_transforms_macros",
  "swc_ecma_utils",
  "swc_ecma_visit",
 ]
 
 [[package]]
 name = "swc_ecma_transforms_react"
-version = "0.191.0"
+version = "30.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76c76d8b9792ce51401d38da0fa62158d61f6d80d16d68fe5b03ce4bf5fba383"
+checksum = "69ea0052ac23b5b9fbc85bbdb1791b36b918f9d55f594b0ed8e25babb4c32d16"
 dependencies = [
- "base64 0.21.7",
- "dashmap 5.5.3",
+ "base64 0.22.1",
+ "bytes-str",
  "indexmap 2.14.0",
  "once_cell",
+ "rustc-hash 2.1.2",
  "serde",
  "sha1",
  "string_enum",
- "swc_allocator",
  "swc_atoms",
  "swc_common",
  "swc_config",
  "swc_ecma_ast",
  "swc_ecma_parser",
  "swc_ecma_transforms_base",
- "swc_ecma_transforms_macros",
  "swc_ecma_utils",
  "swc_ecma_visit",
 ]
 
 [[package]]
 name = "swc_ecma_transforms_typescript"
-version = "0.198.1"
+version = "30.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15455da4768f97186c40523e83600495210c11825d3a44db43383fd81eace88d"
+checksum = "3872c006ccfdcc19f1cf5c01c15915a69964ba7982c9f581cdb7e727e77b9a2c"
 dependencies = [
- "ryu-js",
+ "bytes-str",
+ "rustc-hash 2.1.2",
  "serde",
  "swc_atoms",
  "swc_common",
@@ -13711,28 +11618,28 @@ dependencies = [
 
 [[package]]
 name = "swc_ecma_utils"
-version = "0.134.2"
+version = "21.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "029eec7dd485923a75b5a45befd04510288870250270292fc2c1b3a9e7547408"
+checksum = "83259addd99ed4022aa9fc4d39428c008d3d42533769e1a005529da18cde4568"
 dependencies = [
  "indexmap 2.14.0",
  "num_cpus",
  "once_cell",
- "rustc-hash 1.1.0",
+ "par-core",
+ "rustc-hash 2.1.2",
  "ryu-js",
  "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_visit",
  "tracing",
- "unicode-id",
 ]
 
 [[package]]
 name = "swc_ecma_visit"
-version = "0.104.8"
+version = "15.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b1c6802e68e51f336e8bc9644e9ff9da75d7da9c1a6247d532f2e908aa33e81"
+checksum = "75a579aa8f9e212af521588df720ccead079c09fe5c8f61007cf724324aed3a0"
 dependencies = [
  "new_debug_unreachable",
  "num-bigint",
@@ -13745,9 +11652,9 @@ dependencies = [
 
 [[package]]
 name = "swc_eq_ignore_macros"
-version = "0.1.4"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63db0adcff29d220c3d151c5b25c0eabe7e32dd936212b84cdaa1392e3130497"
+checksum = "c16ce73424a6316e95e09065ba6a207eba7765496fed113702278b7711d4b632"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -13756,38 +11663,44 @@ dependencies = [
 
 [[package]]
 name = "swc_macros_common"
-version = "0.3.13"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f486687bfb7b5c560868f69ed2d458b880cebc9babebcb67e49f31b55c5bf847"
+checksum = "aae1efbaa74943dc5ad2a2fb16cbd78b77d7e4d63188f3c5b4df2b4dcd2faaae"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "swc_sourcemap"
+version = "9.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de08ef00f816acdd1a58ee8a81c0e1a59eefef2093aefe5611f256fa6b64c4d7"
+dependencies = [
+ "base64-simd",
+ "bitvec",
+ "bytes-str",
+ "data-encoding",
+ "debugid",
+ "if_chain",
+ "rustc-hash 2.1.2",
+ "serde",
+ "serde_json",
+ "unicode-id-start",
+ "url",
+]
+
 [[package]]
 name = "swc_visit"
-version = "0.6.2"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ceb044142ba2719ef9eb3b6b454fce61ab849eb696c34d190f04651955c613d"
+checksum = "62fb71484b486c185e34d2172f0eabe7f4722742aad700f426a494bb2de232a2"
 dependencies = [
  "either",
  "new_debug_unreachable",
 ]
 
-[[package]]
-name = "swc_visit_macros"
-version = "0.5.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92807d840959f39c60ce8a774a3f83e8193c658068e6d270dbe0a05e40e90b41"
-dependencies = [
- "Inflector",
- "proc-macro2",
- "quote",
- "swc_macros_common",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "symlink"
 version = "0.1.0"
@@ -13825,18 +11738,6 @@ dependencies = [
  "futures-core",
 ]
 
-[[package]]
-name = "synstructure"
-version = "0.12.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f36bdaa60a83aca3921b5259d5400cbf5e90fc51931376a9bd4a0eb79aa7210f"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
- "unicode-xid",
-]
-
 [[package]]
 name = "synstructure"
 version = "0.13.2"
@@ -13859,12 +11760,22 @@ dependencies = [
 
 [[package]]
 name = "sys_traits"
-version = "0.1.7"
+version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b46ac05dfbe9fd3a9703eff20e17f5b31e7b6a54daf27a421dcd56c7a27ecdd"
+checksum = "dc4707edf3196e8037ee45018d1bb1bfb233b0e4fc440fa3d3f25bc69bfdaf26"
 dependencies = [
- "libc",
- "windows-sys 0.59.0",
+ "sys_traits_macros",
+]
+
+[[package]]
+name = "sys_traits_macros"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "181f22127402abcf8ee5c83ccd5b408933fec36a6095cf82cda545634692657e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -13873,7 +11784,7 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "01198a2debb237c62b6826ec7081082d951f46dbb64b0e8c7649a452230d1dfc"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "byteorder",
  "enum-as-inner",
  "libc",
@@ -13901,7 +11812,7 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "core-foundation 0.9.4",
  "system-configuration-sys",
 ]
@@ -13925,7 +11836,7 @@ dependencies = [
  "bytesize",
  "lazy_static",
  "libc",
- "nom 7.1.3",
+ "nom",
  "time",
  "winapi",
 ]
@@ -13960,9 +11871,9 @@ dependencies = [
  "levenshtein_automata",
  "log",
  "lru 0.16.4",
- "lz4_flex 0.13.0",
+ "lz4_flex 0.13.1",
  "measure_time",
- "memmap2 0.9.10",
+ "memmap2",
  "once_cell",
  "oneshot",
  "rayon",
@@ -14040,7 +11951,7 @@ version = "0.25.0"
 source = "git+https://github.com/windmill-labs/tantivy?rev=6ae7c70bc603b8e69e27f3240e08bd00a93fb12c#6ae7c70bc603b8e69e27f3240e08bd00a93fb12c"
 dependencies = [
  "fnv",
- "nom 7.1.3",
+ "nom",
  "ordered-float 5.3.0",
  "serde",
  "serde_json",
@@ -14093,6 +12004,15 @@ dependencies = [
  "xattr",
 ]
 
+[[package]]
+name = "temp_deno_which"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "366c5ccd670145885feb6efd6bbf2478ed236c4c3839046fcc8e2a1a84c51091"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "tempfile"
 version = "3.27.0"
@@ -14399,7 +12319,7 @@ dependencies = [
  "bytes",
  "io-uring",
  "libc",
- "mio 1.2.0",
+ "mio",
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
@@ -14410,16 +12330,6 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "tokio-eld"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9166030f05d6bc5642bdb8f8c2be31eb3c02cd465d662bcdc2df82d4aa41a584"
-dependencies = [
- "hdrhistogram",
- "tokio",
-]
-
 [[package]]
 name = "tokio-graceful"
 version = "0.1.6"
@@ -14444,18 +12354,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "tokio-metrics"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eace09241d62c98b7eeb1107d4c5c64ca3bd7da92e8c218c153ab3a78f9be112"
-dependencies = [
- "futures-util",
- "pin-project-lite",
- "tokio",
- "tokio-stream",
-]
-
 [[package]]
 name = "tokio-native-tls"
 version = "0.3.1"
@@ -14468,50 +12366,24 @@ dependencies = [
 
 [[package]]
 name = "tokio-postgres"
-version = "0.7.11"
-source = "git+https://github.com/imor/rust-postgres?rev=20265ef38e32a06f76b6f9b678e2077fc2211f6b#20265ef38e32a06f76b6f9b678e2077fc2211f6b"
+version = "0.7.15"
+source = "git+https://github.com/MaterializeInc/rust-postgres?rev=78c1222577bb091d69bc22b1bc7ad01c14675abe#78c1222577bb091d69bc22b1bc7ad01c14675abe"
 dependencies = [
  "async-trait",
  "byteorder",
  "bytes",
- "fallible-iterator 0.2.0",
+ "fallible-iterator",
  "futures-channel",
  "futures-util",
  "log",
  "parking_lot",
  "percent-encoding",
- "phf 0.11.3",
+ "phf 0.13.1",
  "pin-project-lite",
- "postgres-protocol 0.6.7",
- "postgres-types 0.2.7",
- "rand 0.8.5",
- "socket2 0.5.10",
- "tokio",
- "tokio-util",
- "whoami",
-]
-
-[[package]]
-name = "tokio-postgres"
-version = "0.7.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c95d533c83082bb6490e0189acaa0bbeef9084e60471b696ca6988cd0541fb0"
-dependencies = [
- "async-trait",
- "byteorder",
- "bytes",
- "fallible-iterator 0.2.0",
- "futures-channel",
- "futures-util",
- "log",
- "parking_lot",
- "percent-encoding",
- "phf 0.11.3",
- "pin-project-lite",
- "postgres-protocol 0.6.11",
- "postgres-types 0.2.9",
+ "postgres-protocol",
+ "postgres-types",
  "rand 0.9.0",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "tokio",
  "tokio-util",
  "whoami",
@@ -14624,12 +12496,24 @@ dependencies = [
  "futures-io",
  "futures-sink",
  "futures-util",
- "hashbrown 0.15.5",
  "pin-project-lite",
  "slab",
  "tokio",
 ]
 
+[[package]]
+name = "tokio-vsock"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b319ef9394889dab2e1b4f0085b45ba11d0c79dc9d1a9d1afc057d009d0f1c7"
+dependencies = [
+ "bytes",
+ "futures",
+ "libc",
+ "tokio",
+ "vsock",
+]
+
 [[package]]
 name = "tokio-websockets"
 version = "0.10.1"
@@ -14674,11 +12558,11 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "0.7.0"
+version = "1.1.1+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bade1c3e902f58d73d3f294cd7f20391c1cb2fbcb643b73566bc773971df91e3"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
 dependencies = [
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -14696,14 +12580,14 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.23.4"
+version = "0.25.11+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7211ff1b8f0d3adae1663b7da9ffe396eabe1ca25f0b0bee42b0da29a9ddce93"
+checksum = "0b59c4d22ed448339746c59b905d24568fcbb3ab65a500494f7b8c3e97739f2b"
 dependencies = [
  "indexmap 2.14.0",
- "toml_datetime 0.7.0",
+ "toml_datetime 1.1.1+spec-1.1.0",
  "toml_parser",
- "winnow 0.7.15",
+ "winnow 1.0.2",
 ]
 
 [[package]]
@@ -14756,7 +12640,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7e581ba15a835f4d9ea06c55ab1bd4dce26fc53752c69a04aac00703bfb49ba9"
 dependencies = [
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "bytes",
  "h2 0.4.14",
@@ -14843,7 +12727,7 @@ checksum = "68d6fdd9f81c2819c9a8b0e0cd91660e7746a8e6ea2ba7c6b2b057985f6bcb51"
 dependencies = [
  "async-compression",
  "base64 0.22.1",
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "bytes",
  "futures-core",
  "futures-util",
@@ -15114,29 +12998,12 @@ dependencies = [
  "utf-8",
 ]
 
-[[package]]
-name = "twox-hash"
-version = "1.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97fee6b57c6a41524a810daee9286c02d7752c4253064d0b05472833a438f675"
-dependencies = [
- "cfg-if",
- "rand 0.8.5",
- "static_assertions",
-]
-
 [[package]]
 name = "twox-hash"
 version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ea3136b675547379c4bd395ca6b938e5ad3c3d20fad76e7fe85f9e0d011419c"
 
-[[package]]
-name = "typed-arena"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6af6ae20167a9ece4bcb41af5b80f8a1f1df981f6391189ce00fd257af04126a"
-
 [[package]]
 name = "typed-path"
 version = "0.12.3"
@@ -15272,12 +13139,6 @@ version = "0.3.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
 
-[[package]]
-name = "unicode-id"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ba288e709927c043cbe476718d37be306be53fb1fafecd0dbe36d072be2580"
-
 [[package]]
 name = "unicode-id-start"
 version = "1.4.0"
@@ -15378,7 +13239,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
 dependencies = [
- "crypto-common 0.1.7",
+ "crypto-common",
  "subtle",
 ]
 
@@ -15489,66 +13350,38 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.18.1"
+version = "1.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f87b8aa10b915a06587d0dec516c282ff295b475d94abf425d62b57710070a2"
+checksum = "ddd74a9687298c6858e9b88ec8935ec45d22e8fd5e6394fa1bd4e99a87789c76"
 dependencies = [
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "js-sys",
- "serde",
+ "serde_core",
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "v8"
-version = "130.0.7"
+version = "137.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a511192602f7b435b0a241c1947aa743eb7717f20a9195f4b5e8ed1952e01db1"
+checksum = "33995a1fee055ff743281cde33a41f0d618ee0bdbe8bdf6859e11864499c2595"
 dependencies = [
- "bindgen 0.70.1",
- "bitflags 2.9.4",
+ "bindgen 0.71.1",
+ "bitflags 2.11.1",
  "fslock",
  "gzip-header",
  "home",
- "miniz_oxide 0.7.4",
- "once_cell",
+ "miniz_oxide",
  "paste",
  "which 6.0.3",
 ]
 
-[[package]]
-name = "v8_valueserializer"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97599c400fc79925922b58303e98fcb8fa88f573379a08ddb652e72cbd2e70f6"
-dependencies = [
- "bitflags 2.9.4",
- "encoding_rs",
- "indexmap 2.14.0",
- "num-bigint",
- "serde",
- "thiserror 1.0.69",
- "wtf8",
-]
-
 [[package]]
 name = "valuable"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
-[[package]]
-name = "value-trait"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9170e001f458781e92711d2ad666110f153e4e50bfd5cbd02db6547625714187"
-dependencies = [
- "float-cmp",
- "halfbrown",
- "itoa",
- "ryu",
-]
-
 [[package]]
 name = "vcpkg"
 version = "0.2.15"
@@ -15567,6 +13400,16 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5c3082ca00d5a5ef149bb8b555a72ae84c9c59f7250f013ac822ac2e49b19c64"
 
+[[package]]
+name = "vsock"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ba782755fc073877e567c2253c0be48e4aa9a254c232d36d3985dfae0bd5205"
+dependencies = [
+ "libc",
+ "nix 0.31.3",
+]
+
 [[package]]
 name = "vte"
 version = "0.14.1"
@@ -15765,11 +13608,11 @@ dependencies = [
 
 [[package]]
 name = "wasm_dep_analyzer"
-version = "0.2.0"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2eeee3bdea6257cc36d756fa745a70f9d393571e47d69e0ed97581676a5369ca"
+checksum = "e51cf5f08b357e64cd7642ab4bbeb11aecab9e15520692129624fb9908b8df2c"
 dependencies = [
- "deno_error",
+ "deno_error 0.6.1",
  "thiserror 2.0.18",
 ]
 
@@ -15779,7 +13622,7 @@ version = "0.244.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "hashbrown 0.15.5",
  "indexmap 2.14.0",
  "semver 1.0.28",
@@ -15820,12 +13663,15 @@ dependencies = [
 ]
 
 [[package]]
-name = "webpki-root-certs"
-version = "0.26.11"
+name = "web-transport-proto"
+version = "0.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75c7f0ef91146ebfb530314f5f1d24528d7f0767efbfd31dce919275413e393e"
+checksum = "974fa1e325e6cc5327de8887f189a441fcff4f8eedcd31ec87f0ef0cc5283fbc"
 dependencies = [
- "webpki-root-certs 1.0.7",
+ "bytes",
+ "http 1.4.0",
+ "thiserror 2.0.18",
+ "url",
 ]
 
 [[package]]
@@ -15855,89 +13701,6 @@ dependencies = [
  "rustls-pki-types",
 ]
 
-[[package]]
-name = "wgpu-core"
-version = "0.21.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d50819ab545b867d8a454d1d756b90cd5f15da1f2943334ca314af10583c9d39"
-dependencies = [
- "arrayvec",
- "bit-vec 0.6.3",
- "bitflags 2.9.4",
- "cfg_aliases 0.1.1",
- "codespan-reporting",
- "document-features",
- "indexmap 2.14.0",
- "log",
- "naga",
- "once_cell",
- "parking_lot",
- "profiling",
- "raw-window-handle",
- "ron",
- "rustc-hash 1.1.0",
- "serde",
- "smallvec",
- "thiserror 1.0.69",
- "web-sys",
- "wgpu-hal",
- "wgpu-types",
-]
-
-[[package]]
-name = "wgpu-hal"
-version = "0.21.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "172e490a87295564f3fcc0f165798d87386f6231b04d4548bca458cbbfd63222"
-dependencies = [
- "android_system_properties",
- "arrayvec",
- "ash",
- "bit-set 0.5.3",
- "bitflags 2.9.4",
- "block",
- "cfg_aliases 0.1.1",
- "core-graphics-types",
- "d3d12",
- "glow",
- "glutin_wgl_sys",
- "gpu-alloc",
- "gpu-descriptor",
- "js-sys",
- "khronos-egl",
- "libc",
- "libloading 0.8.9",
- "log",
- "metal",
- "naga",
- "ndk-sys",
- "objc",
- "once_cell",
- "parking_lot",
- "profiling",
- "range-alloc",
- "raw-window-handle",
- "rustc-hash 1.1.0",
- "smallvec",
- "thiserror 1.0.69",
- "wasm-bindgen",
- "web-sys",
- "wgpu-types",
- "winapi",
-]
-
-[[package]]
-name = "wgpu-types"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1353d9a46bff7f955a680577f34c69122628cc2076e1d6f3a9be6ef00ae793ef"
-dependencies = [
- "bitflags 2.9.4",
- "js-sys",
- "serde",
- "web-sys",
-]
-
 [[package]]
 name = "which"
 version = "4.4.2"
@@ -16025,14 +13788,14 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-nats",
  "aws-config",
  "aws-credential-types",
  "aws-sdk-sqs",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "chrono",
  "constant_time_eq 0.3.1",
@@ -16106,7 +13869,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "async-trait",
  "aws-config",
@@ -16114,13 +13877,19 @@ dependencies = [
  "aws-sdk-bedrockruntime",
  "aws-smithy-types",
  "base64 0.22.1",
+ "bytes",
+ "eventsource-stream",
+ "futures",
  "lazy_static",
+ "mime_guess",
  "reqwest 0.13.1",
  "serde",
  "serde_json",
  "sqlx",
  "tokio",
+ "tokio-stream",
  "tracing",
+ "ulid",
  "uuid",
  "windmill-common",
  "windmill-mcp",
@@ -16130,9 +13899,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "serde",
  "serde_json",
@@ -16143,7 +13912,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "argon2",
@@ -16159,7 +13928,7 @@ dependencies = [
  "aws-sdk-config",
  "aws-sigv4",
  "aws-smithy-types",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base32",
  "base64 0.22.1",
  "bytes",
@@ -16168,7 +13937,7 @@ dependencies = [
  "const_format",
  "cookie",
  "cron",
- "dashmap 6.1.0",
+ "dashmap",
  "datafusion",
  "ed25519-dalek",
  "eventsource-stream",
@@ -16176,7 +13945,7 @@ dependencies = [
  "futures",
  "git-version",
  "hex",
- "hmac 0.12.1",
+ "hmac",
  "http 1.4.0",
  "hyper 1.9.0",
  "indexmap 2.14.0",
@@ -16192,7 +13961,7 @@ dependencies = [
  "openidconnect",
  "openssl",
  "pin-project",
- "postgres-native-tls 0.5.1",
+ "postgres-native-tls 0.5.3",
  "prometheus",
  "quick_cache",
  "rand 0.9.0",
@@ -16215,7 +13984,7 @@ dependencies = [
  "time",
  "tokio",
  "tokio-native-tls",
- "tokio-postgres 0.7.13",
+ "tokio-postgres",
  "tokio-stream",
  "tokio-util",
  "tower 0.5.3",
@@ -16286,9 +14055,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "http 1.4.0",
  "hyper 1.9.0",
@@ -16309,9 +14078,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "serde",
  "serde_json",
@@ -16322,10 +14091,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "http 1.4.0",
  "itertools 0.14.0",
@@ -16348,7 +14117,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -16358,9 +14127,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "itertools 0.14.0",
  "serde",
@@ -16375,9 +14144,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "chrono",
  "ed25519-dalek",
@@ -16397,10 +14166,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
- "axum 0.8.4",
+ "axum 0.8.9",
  "candle-core",
  "candle-nn",
  "candle-transformers",
@@ -16420,9 +14189,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "serde",
  "sql-builder",
@@ -16436,9 +14205,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "hyper 1.9.0",
  "serde",
@@ -16457,9 +14226,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "globset",
  "lazy_static",
@@ -16478,9 +14247,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "serde",
  "serde_json",
@@ -16492,14 +14261,14 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-nats",
  "aws-config",
  "aws-credential-types",
  "aws-sdk-sqs",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "futures",
  "rand 0.9.0",
@@ -16524,10 +14293,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "chrono",
  "http 1.4.0",
@@ -16549,9 +14318,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "flate2",
  "reqwest 0.13.1",
  "serde",
@@ -16567,10 +14336,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
- "axum 0.8.4",
+ "axum 0.8.9",
  "http 1.4.0",
  "indexmap 2.14.0",
  "itertools 0.14.0",
@@ -16589,9 +14358,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "chrono-tz",
  "serde",
@@ -16609,9 +14378,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "futures",
  "http 1.4.0",
@@ -16639,10 +14408,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "bytes",
  "chrono",
@@ -16667,7 +14436,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "lazy_static",
  "serde",
@@ -16679,12 +14448,12 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "argon2",
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
- "dashmap 6.1.0",
+ "dashmap",
  "http 1.4.0",
  "hyper 1.9.0",
  "lazy_static",
@@ -16704,9 +14473,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "serde",
  "serde_json",
@@ -16718,9 +14487,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "hex",
  "http 1.4.0",
@@ -16751,7 +14520,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -16765,10 +14534,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
- "axum 0.8.4",
+ "axum 0.8.9",
  "k8s-openapi",
  "kube",
  "serde",
@@ -16784,7 +14553,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -16798,10 +14567,10 @@ dependencies = [
  "aws-sdk-secretsmanager",
  "aws-sdk-sts",
  "aws-smithy-types-convert",
- "axum 0.8.4",
+ "axum 0.8.9",
  "backon",
  "base64 0.22.1",
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "bytes",
  "chrono",
  "chrono-tz",
@@ -16810,7 +14579,7 @@ dependencies = [
  "crc",
  "cron",
  "croner",
- "dashmap 6.1.0",
+ "dashmap",
  "datafusion",
  "equivalent",
  "futures",
@@ -16819,7 +14588,7 @@ dependencies = [
  "git-version",
  "globset",
  "hex",
- "hmac 0.12.1",
+ "hmac",
  "hyper 1.9.0",
  "indexmap 2.14.0",
  "itertools 0.14.0",
@@ -16838,7 +14607,7 @@ dependencies = [
  "pep440_rs",
  "phf 0.11.3",
  "pin-project-lite",
- "postgres-native-tls 0.5.1",
+ "postgres-native-tls 0.5.3",
  "prometheus",
  "quick_cache",
  "rand 0.9.0",
@@ -16864,7 +14633,7 @@ dependencies = [
  "thiserror 2.0.18",
  "tikv-jemalloc-ctl",
  "tokio",
- "tokio-postgres 0.7.13",
+ "tokio-postgres",
  "tokio-stream",
  "tokio-util",
  "tonic 0.13.1",
@@ -16885,7 +14654,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -16904,7 +14673,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "regex",
  "serde",
@@ -16919,7 +14688,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -16943,7 +14712,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "futures",
@@ -16960,7 +14729,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -16976,7 +14745,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16997,15 +14766,15 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "backon",
  "base64 0.22.1",
  "chrono",
- "hmac 0.12.1",
+ "hmac",
  "http 1.4.0",
  "itertools 0.14.0",
  "lazy_static",
@@ -17028,16 +14797,16 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "arc-swap",
  "async-oauth2",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "chrono",
  "hex",
- "hmac 0.12.1",
+ "hmac",
  "itertools 0.14.0",
  "lazy_static",
  "reqwest 0.12.28",
@@ -17053,7 +14822,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -17062,7 +14831,7 @@ dependencies = [
  "aws-credential-types",
  "aws-sdk-sts",
  "aws-smithy-types-convert",
- "axum 0.8.4",
+ "axum 0.8.9",
  "bytes",
  "chrono",
  "datafusion",
@@ -17087,7 +14856,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "futures",
@@ -17105,7 +14874,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -17114,7 +14883,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -17126,7 +14895,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -17138,7 +14907,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -17150,7 +14919,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -17162,7 +14931,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -17174,7 +14943,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -17185,7 +14954,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -17196,7 +14965,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -17208,7 +14977,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -17219,7 +14988,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -17241,7 +15010,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -17253,7 +15022,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -17267,7 +15036,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -17284,7 +15053,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -17297,7 +15066,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -17309,7 +15078,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -17327,7 +15096,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -17343,7 +15112,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -17359,7 +15128,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -17370,20 +15139,20 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-recursion",
- "axum 0.8.4",
+ "axum 0.8.9",
  "backon",
  "chrono",
  "chrono-tz",
  "cron",
- "dashmap 6.1.0",
+ "dashmap",
  "futures",
  "futures-core",
  "hex",
- "hmac 0.12.1",
+ "hmac",
  "itertools 0.14.0",
  "lazy_static",
  "once_cell",
@@ -17407,19 +15176,19 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "const_format",
  "deno_ast",
  "deno_console",
  "deno_core",
- "deno_error",
+ "deno_error 0.6.1",
  "deno_fetch",
+ "deno_fs",
  "deno_io",
  "deno_net",
  "deno_permissions",
- "deno_runtime",
  "deno_telemetry",
  "deno_tls",
  "deno_url",
@@ -17445,7 +15214,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -17456,11 +15225,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-recursion",
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "futures",
  "http 1.4.0",
@@ -17486,11 +15255,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "futures",
  "serde",
@@ -17510,11 +15279,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "http 1.4.0",
  "hyper 1.9.0",
@@ -17543,11 +15312,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "bytes",
  "chrono",
@@ -17576,11 +15345,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "lazy_static",
  "regex",
@@ -17596,11 +15365,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "bytes",
  "chrono",
@@ -17630,17 +15399,17 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "chrono",
  "constant_time_eq 0.3.1",
  "futures",
  "hex",
- "hmac 0.12.1",
+ "hmac",
  "http 1.4.0",
  "hyper 1.9.0",
  "itertools 0.14.0",
@@ -17666,11 +15435,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "itertools 0.14.0",
  "rdkafka",
@@ -17689,11 +15458,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "bytes",
  "itertools 0.14.0",
@@ -17713,12 +15482,12 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-nats",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "itertools 0.14.0",
  "nkeys",
@@ -17737,11 +15506,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "byteorder",
  "bytes",
  "chrono",
@@ -17750,7 +15519,7 @@ dependencies = [
  "lazy_static",
  "native-tls",
  "pg_escape",
- "postgres-native-tls 0.5.0",
+ "postgres-native-tls 0.5.2",
  "quick_cache",
  "rand 0.9.0",
  "rust_decimal",
@@ -17759,7 +15528,7 @@ dependencies = [
  "sqlx",
  "thiserror 2.0.18",
  "tokio",
- "tokio-postgres 0.7.11",
+ "tokio-postgres",
  "tokio-stream",
  "tracing",
  "uuid",
@@ -17772,7 +15541,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17781,7 +15550,7 @@ dependencies = [
  "aws-sdk-sqs",
  "aws-sdk-sts",
  "aws-smithy-types",
- "axum 0.8.4",
+ "axum 0.8.9",
  "backon",
  "chrono",
  "itertools 0.14.0",
@@ -17800,11 +15569,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "futures",
  "http 1.4.0",
  "itertools 0.14.0",
@@ -17823,10 +15592,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "chrono",
  "hex",
  "itertools 0.14.0",
@@ -17842,18 +15611,14 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-once-cell",
  "async-recursion",
  "async-stream",
  "async-trait",
- "aws-config",
- "aws-credential-types",
- "aws-sdk-bedrockruntime",
- "aws-smithy-types",
- "axum 0.8.4",
+ "axum 0.8.9",
  "backon",
  "base64 0.22.1",
  "bit-vec 0.6.3",
@@ -17870,7 +15635,7 @@ dependencies = [
  "gcp_auth",
  "git-version",
  "hex",
- "hmac 0.12.1",
+ "hmac",
  "hudsucker",
  "hyper-http-proxy",
  "hyper-tls",
@@ -17879,7 +15644,7 @@ dependencies = [
  "jsonwebtoken 8.3.0",
  "lazy_static",
  "libffi-sys",
- "libloading 0.8.9",
+ "libloading",
  "mappable-rc",
  "mime_guess",
  "mysql_async",
@@ -17891,10 +15656,11 @@ dependencies = [
  "oracle",
  "pem 3.0.6",
  "pep440_rs",
- "postgres-native-tls 0.5.1",
+ "postgres-native-tls 0.5.3",
  "process-wrap",
  "prometheus",
  "prost",
+ "quick_cache",
  "rand 0.9.0",
  "rcgen",
  "regex",
@@ -17909,7 +15675,7 @@ dependencies = [
  "tempfile",
  "tiberius",
  "tokio",
- "tokio-postgres 0.7.13",
+ "tokio-postgres",
  "tokio-stream",
  "tokio-util",
  "tracing",
@@ -17948,13 +15714,13 @@ dependencies = [
  "windmill-types",
  "windmill-worker-volumes",
  "windows 0.61.3",
- "x509-parser 0.16.0",
+ "x509-parser",
  "yaml-rust",
 ]
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "bytes",
  "futures",
@@ -18205,7 +15971,7 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d24d6bcc7f734a4091ecf8d7a64c5f7d7066f45585c1861eba06449909609c8a"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "widestring",
  "windows-sys 0.52.0",
 ]
@@ -18557,6 +16323,9 @@ name = "winnow"
 version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2ee1708bef14716a11bae175f579062d4554d95be2c6829f518df847b7b3fdd0"
+dependencies = [
+ "memchr",
+]
 
 [[package]]
 name = "winsafe"
@@ -18628,7 +16397,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
 dependencies = [
  "anyhow",
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "indexmap 2.14.0",
  "log",
  "serde",
@@ -18664,12 +16433,6 @@ version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
 
-[[package]]
-name = "wtf8"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c01ae8492c38f52376efd3a17d0994b6bcf3df1e39c0226d458b7d81670b2a06"
-
 [[package]]
 name = "wyz"
 version = "0.5.1"
@@ -18679,47 +16442,18 @@ dependencies = [
  "tap",
 ]
 
-[[package]]
-name = "x25519-dalek"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
-dependencies = [
- "curve25519-dalek",
- "rand_core 0.6.4",
- "serde",
- "zeroize",
-]
-
-[[package]]
-name = "x509-parser"
-version = "0.15.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7069fba5b66b9193bd2c5d3d4ff12b839118f6bcbef5328efafafb5395cf63da"
-dependencies = [
- "asn1-rs 0.5.2",
- "data-encoding",
- "der-parser 8.2.0",
- "lazy_static",
- "nom 7.1.3",
- "oid-registry 0.6.1",
- "rusticata-macros",
- "thiserror 1.0.69",
- "time",
-]
-
 [[package]]
 name = "x509-parser"
 version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fcbc162f30700d6f3f82a24bf7cc62ffe7caea42c0b2cba8bf7f3ae50cf51f69"
 dependencies = [
- "asn1-rs 0.6.2",
+ "asn1-rs",
  "data-encoding",
- "der-parser 9.0.0",
+ "der-parser",
  "lazy_static",
- "nom 7.1.3",
- "oid-registry 0.7.1",
+ "nom",
+ "oid-registry",
  "ring 0.17.14",
  "rusticata-macros",
  "thiserror 1.0.69",
@@ -18736,12 +16470,6 @@ dependencies = [
  "rustix 1.1.4",
 ]
 
-[[package]]
-name = "xml-rs"
-version = "0.8.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ae8337f8a065cfc972643663ea4279e04e7256de865aa66fe25cec5fb912d3f"
-
 [[package]]
 name = "xmlparser"
 version = "0.13.6"
@@ -18781,18 +16509,6 @@ dependencies = [
  "time",
 ]
 
-[[package]]
-name = "yoke"
-version = "0.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "120e6aef9aa629e3d4f52dc8cc43a015c7724194c97dfaf45180d2daf2b77f40"
-dependencies = [
- "serde",
- "stable_deref_trait",
- "yoke-derive 0.7.5",
- "zerofrom",
-]
-
 [[package]]
 name = "yoke"
 version = "0.8.2"
@@ -18800,22 +16516,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
 dependencies = [
  "stable_deref_trait",
- "yoke-derive 0.8.2",
+ "yoke-derive",
  "zerofrom",
 ]
 
-[[package]]
-name = "yoke-derive"
-version = "0.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2380878cad4ac9aac1e2435f3eb4020e8374b5f13c296cb75b4620ff8e229154"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
- "synstructure 0.13.2",
-]
-
 [[package]]
 name = "yoke-derive"
 version = "0.8.2"
@@ -18825,7 +16529,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.117",
- "synstructure 0.13.2",
+ "synstructure",
 ]
 
 [[package]]
@@ -18850,9 +16554,9 @@ dependencies = [
 
 [[package]]
 name = "zerofrom"
-version = "0.1.7"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69faa1f2a1ea75661980b013019ed6687ed0e83d069bc1114e2cc74c6c04c4df"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
 dependencies = [
  "zerofrom-derive",
 ]
@@ -18866,7 +16570,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.117",
- "synstructure 0.13.2",
+ "synstructure",
 ]
 
 [[package]]
@@ -18874,20 +16578,6 @@ name = "zeroize"
 version = "1.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
-dependencies = [
- "zeroize_derive",
-]
-
-[[package]]
-name = "zeroize_derive"
-version = "1.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85a5b4158499876c763cb03bc4e49185d3cccbabb15b33c627f7884f43db852e"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
 
 [[package]]
 name = "zerotrie"
@@ -18896,7 +16586,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
 dependencies = [
  "displaydoc",
- "yoke 0.8.2",
+ "yoke",
  "zerofrom",
 ]
 
@@ -18906,7 +16596,7 @@ version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
 dependencies = [
- "yoke 0.8.2",
+ "yoke",
  "zerofrom",
  "zerovec-derive",
 ]
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 0d25909c74..0babfe3810 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.697.0"
+version = "1.700.2"
 authors.workspace = true
 edition.workspace = true
 
@@ -87,7 +87,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.697.0"
+version = "1.700.2"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
@@ -207,6 +207,36 @@ all_sqlx_features = ["all_languages", "enterprise", "enterprise_saml", "embeddin
 object_store = { git = "https://github.com/apache/arrow-rs-object-store", rev = "36752c975d4f29e20b57c91f81a10872dcd48ae7" }
 # Use tiberius main branch for libgssapi 0.8.1 fix (https://github.com/prisma/tiberius/issues/343)
 tiberius = { git = "https://github.com/prisma/tiberius", rev = "59db57960a14b422fb3a1309aa4aa47880896ff8" }
+# Pin tokio-postgres / postgres-types / postgres-protocol to the
+# MaterializeInc fork. windmill-trigger-postgres already pulled this
+# fork in transitively for the postgres-replication crate
+# (CopyBothDuplex, LogicalReplicationStream, TupleData with binary
+# tuple support) which upstream rust-postgres has declined to merge
+# since 2021 (PR #752 → #778, both still unmerged).
+#
+# MI also carries a mitigation for the
+# Client::query_typed_raw / Client::prepare deadlock on result columns
+# whose Oid the client doesn't know about yet (citext, custom enums /
+# domains, postgis): MI's 2025-12-11 PR #33 resized the per-request
+# response channel from mpsc::channel(1) → mpsc::channel(1024).
+# bounded(1024) is sufficient for any realistic typeinfo deferral
+# (need ~2-3 batches) but leaves a theoretical failure mode at
+# >~64 MB results with a custom-Oid column. The strict-correct fix is
+# mpsc::unbounded(); a follow-up PR to MI is open proposing that.
+#
+# The [patch.crates-io] entries below force windmill-worker's
+# pg_executor (which imports `tokio_postgres::` directly from
+# crates.io) onto the same fork as windmill-trigger-postgres, so the
+# deadlock mitigation reaches both consumers.
+#
+# Upstream deadlock PRs (open, not on the critical path now that MI
+# is mitigated):
+#   https://github.com/rust-postgres/rust-postgres/pull/1348
+#   https://github.com/rust-postgres/rust-postgres/pull/1349
+# Reproducer: https://github.com/rubenfiszel/tokio-postgres-deadlock-repro
+tokio-postgres = { git = "https://github.com/MaterializeInc/rust-postgres", rev = "78c1222577bb091d69bc22b1bc7ad01c14675abe" }
+postgres-types = { git = "https://github.com/MaterializeInc/rust-postgres", rev = "78c1222577bb091d69bc22b1bc7ad01c14675abe" }
+postgres-protocol = { git = "https://github.com/MaterializeInc/rust-postgres", rev = "78c1222577bb091d69bc22b1bc7ad01c14675abe" }
 
 [dependencies]
 anyhow.workspace = true
@@ -387,8 +417,7 @@ tokio-stream = { version = "0.1.17" }
 tower = "^0"
 tower-http = { version = "^0.6", features = ["trace", "cors", "catch-panic"] }
 tower-cookies = "^0.11"
-#stuck because of swc for now
-serde = "=1.0.220"
+serde = "^1"
 serde_json = { version = "^1", features = ["preserve_order", "raw_value"] }
 serde_yml = "0.0.12"
 uuid = { version = "^1", features = ["serde", "v4", "js"] }
@@ -443,21 +472,29 @@ aws-sdk-rds = "^1"
 async-trait = "0.1.88"
 
 
-v8 = "=130.0.7"  # Exact version NOTE: Do not forget to update version and hash in flake.nix
-deno_fetch = "0.214.0"
-deno_tls = "0.177.0"
-deno_console = "0.190.0"
-deno_url = "0.190.0"
-deno_webidl = "0.190.0"
-deno_web = "0.221.0"
-deno_io = "0.100.0"
-deno_net = "0.182.0"
-deno_core = "0.336.0"
-deno_ast = { version = "=0.44.0", features = ["transpiling"] }
-deno_permissions = "0.49.0"
-deno_runtime = { version = "0.198.0", features = ["transpile"] }
-deno_telemetry = "0.12.0"
-deno_error = "=0.5.5"
+v8 = "=137.1.0"  # Exact version NOTE: Do not forget to update version and hash in flake.nix
+# deno_* pin set: deno v2.4.0 base, with deno_ast force-overridden to =0.51.0.
+# Rationale: deno_ast 0.51.0 is the first version pulling swc_common =14.0.4,
+# the first swc_common patch that dropped `pub use serde::__private as serde;`
+# (the line that capped our workspace serde pin at =1.0.220). v2.4.0's other
+# pins keep deno_tls at 0.196.0 which uses permissive `rustls ^0.23.11`,
+# compatible with aws-sdk-bedrockruntime's `^0.23.31` requirement. deno_tls
+# 0.198+ tightened that to exact `=0.23.28`, which would have made any
+# meaningful deno bump resolver-impossible against aws-sdk.
+deno_fetch = "0.233.0"
+deno_tls = "0.196.0"
+deno_console = "0.209.0"
+deno_url = "0.209.0"
+deno_webidl = "0.209.0"
+deno_web = "0.240.0"
+deno_io = "0.119.0"
+deno_fs = "0.119.0"
+deno_net = "0.201.0"
+deno_core = "0.352.0"
+deno_ast = { version = "=0.51.0", features = ["transpiling"] }
+deno_permissions = "0.68.0"
+deno_telemetry = "0.31.0"
+deno_error = "=0.6.1"
 rustls-pemfile = "2.2.0"
 
 # only used with special deno_core_mac feature to prevent ffi issue on macos, requires libffi to be installed
@@ -470,10 +507,10 @@ google-cloud-googleapis = {version = "0.16.1", features = ["pubsub"]}
 winapi = { version = "0.3.9", features = ["sysinfoapi"] }
 sysinfo = { version = "0.32.1" }
 
-swc_common = "=0.37.5"
-swc_ecma_parser = "=0.149.1"
-swc_ecma_ast = "=0.118.2"
-swc_ecma_visit = "=0.104.8"
+swc_common = "=14.0.4"
+swc_ecma_parser = "=24.0.3"
+swc_ecma_ast = "=15.0.0"
+swc_ecma_visit = "=15.0.0"
 
 
 async-recursion = "^1"
@@ -517,8 +554,8 @@ wasm-bindgen-test = "^0"
 convert_case = "0.6.0"
 getrandom = "0.2"
 tokio-postgres = {version = "^0.7", features = ["array-impls", "with-serde_json-1", "with-chrono-0_4", "with-uuid-1", "with-bit-vec-0_6"]}
-rust-postgres = { package = "tokio-postgres", git = "https://github.com/imor/rust-postgres", rev = "20265ef38e32a06f76b6f9b678e2077fc2211f6b"}
-rust-postgres-native-tls = { package = "postgres-native-tls", git = "https://github.com/imor/rust-postgres", features = ["runtime"], rev = "20265ef38e32a06f76b6f9b678e2077fc2211f6b" }
+rust-postgres = { package = "tokio-postgres", git = "https://github.com/MaterializeInc/rust-postgres", rev = "78c1222577bb091d69bc22b1bc7ad01c14675abe"}
+rust-postgres-native-tls = { package = "postgres-native-tls", git = "https://github.com/MaterializeInc/rust-postgres", features = ["runtime"], rev = "78c1222577bb091d69bc22b1bc7ad01c14675abe" }
 bit-vec = "=0.6.3"
 mappable-rc = "^0"
 mysql_async = { version = "*", default-features = false, features = ["minimal", "default", "native-tls-tls", "rust_decimal"]}
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 401a8213f7..8a34b69a0e 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-c8d100d74b8de6bd26fc973d5edbd8853d54dd8b
+f9494c6320bb5fd07c1e9e09734b7fd5fbe7aa38
diff --git a/backend/migrations/20260511075225_add_assets_to_operator_settings.down.sql b/backend/migrations/20260511075225_add_assets_to_operator_settings.down.sql
new file mode 100644
index 0000000000..c38c2a1e42
--- /dev/null
+++ b/backend/migrations/20260511075225_add_assets_to_operator_settings.down.sql
@@ -0,0 +1,19 @@
+-- Remove "assets" key from operator_settings
+UPDATE workspace_settings
+SET operator_settings = operator_settings - 'assets'
+WHERE operator_settings IS NOT NULL
+  AND operator_settings ? 'assets';
+
+-- Revert the column default
+ALTER TABLE workspace_settings
+ALTER COLUMN operator_settings SET DEFAULT '{
+    "runs": true,
+    "groups": true,
+    "folders": true,
+    "workers": true,
+    "triggers": true,
+    "resources": true,
+    "schedules": true,
+    "variables": true,
+    "audit_logs": true
+}';
diff --git a/backend/migrations/20260511075225_add_assets_to_operator_settings.up.sql b/backend/migrations/20260511075225_add_assets_to_operator_settings.up.sql
new file mode 100644
index 0000000000..96aba860ec
--- /dev/null
+++ b/backend/migrations/20260511075225_add_assets_to_operator_settings.up.sql
@@ -0,0 +1,21 @@
+-- Add "assets": true to operator_settings for all workspaces that have operator_settings
+-- but don't already have an "assets" key
+UPDATE workspace_settings
+SET operator_settings = operator_settings || '{"assets": true}'::jsonb
+WHERE operator_settings IS NOT NULL
+  AND NOT operator_settings ? 'assets';
+
+-- Update the column default to include assets
+ALTER TABLE workspace_settings
+ALTER COLUMN operator_settings SET DEFAULT '{
+    "runs": true,
+    "groups": true,
+    "folders": true,
+    "workers": true,
+    "triggers": true,
+    "resources": true,
+    "schedules": true,
+    "variables": true,
+    "audit_logs": true,
+    "assets": true
+}';
diff --git a/backend/parsers/windmill-parser-ts-asset/src/lib.rs b/backend/parsers/windmill-parser-ts-asset/src/lib.rs
index bc31a16c99..3c04ef7447 100644
--- a/backend/parsers/windmill-parser-ts-asset/src/lib.rs
+++ b/backend/parsers/windmill-parser-ts-asset/src/lib.rs
@@ -12,7 +12,7 @@ use AssetUsageAccessType::*;
 
 pub fn parse_assets(code: &str) -> anyhow::Result<ParseAssetsOutput> {
     let cm: Lrc<SourceMap> = Default::default();
-    let fm = cm.new_source_file(FileName::Custom("main.ts".into()).into(), code.into());
+    let fm = cm.new_source_file(FileName::Custom("main.ts".into()).into(), code.to_string());
     let lexer = Lexer::new(
         // We want to parse ecmascript
         Syntax::Typescript(TsSyntax::default()),
diff --git a/backend/parsers/windmill-parser-ts/src/lib.rs b/backend/parsers/windmill-parser-ts/src/lib.rs
index 1ae22879b6..1e78ec8665 100644
--- a/backend/parsers/windmill-parser-ts/src/lib.rs
+++ b/backend/parsers/windmill-parser-ts/src/lib.rs
@@ -129,7 +129,7 @@ impl Visit for ImportsFinder {
 /// See also: [`parse_relative_imports`] for resolved absolute paths.
 pub fn parse_expr_for_imports(code: &str, skip_type_only: bool) -> anyhow::Result<Vec<String>> {
     let cm: Lrc<SourceMap> = Default::default();
-    let fm = cm.new_source_file(FileName::Custom("main.d.ts".into()).into(), code.into());
+    let fm = cm.new_source_file(FileName::Custom("main.d.ts".into()).into(), code.to_string());
     let mut tss = TsSyntax::default();
     tss.disallow_ambiguous_jsx_like;
     tss.tsx = true;
@@ -263,7 +263,7 @@ impl Visit for OutputFinder {
 
 pub fn parse_expr_for_ids(code: &str) -> anyhow::Result<Vec<(String, String)>> {
     let cm: Lrc<SourceMap> = Default::default();
-    let fm = cm.new_source_file(FileName::Custom("main.ts".into()).into(), code.into());
+    let fm = cm.new_source_file(FileName::Custom("main.ts".into()).into(), code.to_string());
     let lexer = Lexer::new(
         // We want to parse ecmascript
         Syntax::Es(EsSyntax { jsx: false, ..Default::default() }),
@@ -305,7 +305,7 @@ pub fn parse_deno_signature(
     entrypoint_override: Option<String>,
 ) -> anyhow::Result<MainArgSignature> {
     let cm: Lrc<SourceMap> = Default::default();
-    let fm = cm.new_source_file(FileName::Custom("main.ts".into()).into(), code.into());
+    let fm = cm.new_source_file(FileName::Custom("main.ts".into()).into(), code.to_string());
     let lexer = Lexer::new(
         // We want to parse ecmascript
         Syntax::Typescript(TsSyntax::default()),
diff --git a/backend/parsers/windmill-parser-wac/src/typescript.rs b/backend/parsers/windmill-parser-wac/src/typescript.rs
index 87fa7cef01..9ad84a2e97 100644
--- a/backend/parsers/windmill-parser-wac/src/typescript.rs
+++ b/backend/parsers/windmill-parser-wac/src/typescript.rs
@@ -712,7 +712,7 @@ fn extract_ts_params(params: &[swc_ecma_ast::Param], cm: &Lrc<SourceMap>) -> Vec
 
 pub fn parse_ts_workflow(code: &str) -> Result<WorkflowDag, Vec<CompileError>> {
     let cm: Lrc<SourceMap> = Default::default();
-    let fm = cm.new_source_file(FileName::Custom("workflow.ts".into()).into(), code.into());
+    let fm = cm.new_source_file(FileName::Custom("workflow.ts".into()).into(), code.to_string());
     let lexer = Lexer::new(
         Syntax::Typescript(TsSyntax::default()),
         Default::default(),
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 4bb0074734..954303108f 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6183,7 +6183,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6263,7 +6263,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6275,7 +6275,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "convert_case",
  "serde",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6296,7 +6296,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6308,7 +6308,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6320,7 +6320,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6332,7 +6332,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6344,7 +6344,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6355,7 +6355,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6366,7 +6366,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6378,7 +6378,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6389,7 +6389,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6411,7 +6411,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6423,7 +6423,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6437,7 +6437,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6454,7 +6454,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6467,7 +6467,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -6479,7 +6479,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6497,7 +6497,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6513,7 +6513,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6529,7 +6529,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6561,7 +6561,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -6572,7 +6572,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.697.0"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index e9dc39abc7..0131c16089 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.697.0"
+version = "1.700.2"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/src/ee_oss.rs b/backend/src/ee_oss.rs
index 2aefaf7431..4dcaf2437b 100644
--- a/backend/src/ee_oss.rs
+++ b/backend/src/ee_oss.rs
@@ -8,6 +8,6 @@ pub async fn set_license_key(_license_key: String, _db: Option<&windmill_common:
 }
 
 #[cfg(all(feature = "enterprise", not(feature = "private")))]
-pub async fn verify_license_key() -> () {
+pub async fn verify_license_key(_db: Option<&windmill_common::db::DB>) -> () {
     // Implementation is not open source
 }
diff --git a/backend/src/main.rs b/backend/src/main.rs
index 3049064624..9a2709e9a9 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -1441,7 +1441,7 @@ Windmill Community Edition {GIT_VERSION}
                                         tracing::error!("Failed to reload license key on agent: {e:#}");
                                     }
                                     #[cfg(feature = "enterprise")]
-                                    ee_oss::verify_license_key().await;
+                                    ee_oss::verify_license_key(conn.as_sql()).await;
                                 }
 
                                 // update min version explicitly.
diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs
index 59a2f47ed0..0ddc02b256 100644
--- a/backend/src/monitor.rs
+++ b/backend/src/monitor.rs
@@ -2373,7 +2373,19 @@ pub async fn monitor_db(
     let verify_license_key_f = async {
         #[cfg(feature = "enterprise")]
         if !initial_load {
-            verify_license_key().await;
+            verify_license_key(conn.as_sql()).await;
+        }
+    };
+
+    let enforce_offline_caps_f = async {
+        #[cfg(feature = "enterprise")]
+        if server_mode && !initial_load {
+            if let Some(db) = conn.as_sql() {
+                // Cheap: one query for workers active in the last 2 minutes.
+                if let Err(e) = windmill_common::ee_oss::enforce_offline_caps(db).await {
+                    tracing::error!("Failed to enforce offline license caps: {e:#}");
+                }
+            }
         }
     };
 
@@ -2522,6 +2534,7 @@ pub async fn monitor_db(
         vacuum_queue_f,
         expose_queue_metrics_f,
         verify_license_key_f,
+        enforce_offline_caps_f,
         worker_groups_alerts_f,
         jobs_waiting_alerts_f,
         low_disk_alerts_f,
@@ -2853,6 +2866,11 @@ pub async fn reload_base_url_setting(conn: &Connection) -> error::Result<()> {
 
     IS_SECURE.store(is_secure, Ordering::Relaxed);
 
+    #[cfg(feature = "enterprise")]
+    {
+        crate::ee_oss::verify_license_key(conn.as_sql()).await;
+    }
+
     Ok(())
 }
 
diff --git a/backend/windmill-ai/Cargo.toml b/backend/windmill-ai/Cargo.toml
index 69cc0f181b..542c390cc0 100644
--- a/backend/windmill-ai/Cargo.toml
+++ b/backend/windmill-ai/Cargo.toml
@@ -21,6 +21,10 @@ windmill-mcp = { workspace = true, optional = true }
 
 async-trait.workspace = true
 base64.workspace = true
+bytes.workspace = true
+eventsource-stream.workspace = true
+futures.workspace = true
+mime_guess.workspace = true
 reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true
@@ -29,6 +33,8 @@ uuid.workspace = true
 lazy_static.workspace = true
 tracing.workspace = true
 tokio.workspace = true
+tokio-stream.workspace = true
+ulid.workspace = true
 
 # Bedrock (optional)
 aws-config = { workspace = true, optional = true }
diff --git a/backend/windmill-ai/src/ai_bedrock.rs b/backend/windmill-ai/src/ai_bedrock.rs
index 49166978e8..c05094b8f4 100644
--- a/backend/windmill-ai/src/ai_bedrock.rs
+++ b/backend/windmill-ai/src/ai_bedrock.rs
@@ -326,8 +326,10 @@ pub fn json_to_document(value: serde_json::Value) -> aws_smithy_types::Document
         }
         Value::Array(arr) => Document::Array(arr.into_iter().map(json_to_document).collect()),
         Value::Number(num) => {
-            if let Some(i) = num.as_i64() {
-                Document::Number(aws_smithy_types::Number::PosInt(i as u64))
+            if let Some(u) = num.as_u64() {
+                Document::Number(aws_smithy_types::Number::PosInt(u))
+            } else if let Some(i) = num.as_i64() {
+                Document::Number(aws_smithy_types::Number::NegInt(i))
             } else if let Some(f) = num.as_f64() {
                 Document::Number(aws_smithy_types::Number::Float(f))
             } else {
@@ -844,6 +846,36 @@ mod tests {
         }
     }
 
+    #[test]
+    fn json_to_document_preserves_negative_integers() {
+        let value = serde_json::json!(-1);
+        let doc = json_to_document(value);
+        assert!(matches!(
+            doc,
+            aws_smithy_types::Document::Number(aws_smithy_types::Number::NegInt(-1))
+        ));
+    }
+
+    #[test]
+    fn json_to_document_handles_large_u64_above_i64_max() {
+        let value = serde_json::json!(u64::MAX);
+        let doc = json_to_document(value);
+        assert!(matches!(
+            doc,
+            aws_smithy_types::Document::Number(aws_smithy_types::Number::PosInt(u)) if u == u64::MAX
+        ));
+    }
+
+    #[test]
+    fn json_to_document_handles_positive_integers() {
+        let value = serde_json::json!(42);
+        let doc = json_to_document(value);
+        assert!(matches!(
+            doc,
+            aws_smithy_types::Document::Number(aws_smithy_types::Number::PosInt(42))
+        ));
+    }
+
     #[test]
     fn openai_messages_to_bedrock_adds_cache_points_when_enabled() {
         let messages = vec![
diff --git a/backend/windmill-worker/src/ai/image_handler.rs b/backend/windmill-ai/src/image_handler.rs
similarity index 86%
rename from backend/windmill-worker/src/ai/image_handler.rs
rename to backend/windmill-ai/src/image_handler.rs
index 4fc0bcb4db..5bd9794da5 100644
--- a/backend/windmill-worker/src/ai/image_handler.rs
+++ b/backend/windmill-ai/src/image_handler.rs
@@ -1,16 +1,18 @@
+use crate::types::*;
 use base64::Engine;
 use futures;
 use ulid;
+use uuid::Uuid;
 use windmill_common::{client::AuthedClient, error::Error};
-use windmill_queue::MiniPulledJob;
 use windmill_types::s3::S3Object;
 
-use crate::ai::types::*;
-
-/// Upload image to S3 and return S3Object
+/// Upload image to S3 and return S3Object.
+///
+/// The caller must provide an AuthedClient authorized for `workspace_id`.
 pub async fn upload_image_to_s3(
     base64_image: &str,
-    job: &MiniPulledJob,
+    workspace_id: &str,
+    job_id: &Uuid,
     client: &AuthedClient,
 ) -> Result<S3Object, Error> {
     let image_bytes = base64::engine::general_purpose::STANDARD
@@ -19,7 +21,7 @@ pub async fn upload_image_to_s3(
 
     // Generate unique S3 key
     let unique_id = ulid::Ulid::new().to_string();
-    let s3_key = format!("ai_images/{}/{}.png", job.id, unique_id);
+    let s3_key = format!("ai_images/{}/{}.png", job_id, unique_id);
 
     // Create byte stream
     let byte_stream = futures::stream::once(async move {
@@ -29,7 +31,7 @@ pub async fn upload_image_to_s3(
     // Upload to S3
     client
         .upload_s3_file(
-            &job.workspace_id,
+            workspace_id,
             s3_key.clone(),
             None, // storage - use default
             byte_stream,
@@ -45,7 +47,9 @@ pub async fn upload_image_to_s3(
     })
 }
 
-/// Download an S3 image and convert it to a base64 data URL
+/// Download an S3 image and convert it to a base64 data URL.
+///
+/// The caller must provide an AuthedClient authorized for `workspace_id`.
 pub async fn download_and_encode_s3_image(
     image: &S3Object,
     client: &AuthedClient,
@@ -71,6 +75,8 @@ pub async fn download_and_encode_s3_image(
 }
 
 /// Convert an S3Object to the appropriate ContentPart based on MIME type.
+///
+/// The caller must provide an AuthedClient authorized for `workspace_id`.
 pub async fn s3_object_to_content_part(
     s3_object: &S3Object,
     client: &AuthedClient,
@@ -80,7 +86,7 @@ pub async fn s3_object_to_content_part(
         download_and_encode_s3_image(s3_object, client, workspace_id).await?;
     let data_url = format!("data:{};base64,{}", mime_type, file_bytes);
 
-    if windmill_ai::ai_types::is_document_mime(&mime_type) {
+    if crate::ai_types::is_document_mime(&mime_type) {
         let filename = s3_object
             .s3
             .rsplit('/')
@@ -93,7 +99,9 @@ pub async fn s3_object_to_content_part(
     }
 }
 
-/// Prepare messages for API by converting S3Objects to base64 ImageUrls
+/// Prepare messages for API by converting S3Objects to base64 ImageUrls.
+///
+/// The caller must provide an AuthedClient authorized for `workspace_id`.
 pub async fn prepare_messages_for_api(
     messages: &[OpenAIMessage],
     client: &AuthedClient,
diff --git a/backend/windmill-ai/src/lib.rs b/backend/windmill-ai/src/lib.rs
index dfa34e7d43..6b174bf2e6 100644
--- a/backend/windmill-ai/src/lib.rs
+++ b/backend/windmill-ai/src/lib.rs
@@ -4,5 +4,9 @@ pub mod ai_cache;
 pub mod ai_google;
 pub mod ai_providers;
 pub mod ai_types;
+pub mod image_handler;
+pub mod providers;
 pub mod query_builder;
+pub mod sse;
 pub mod types;
+pub mod utils;
diff --git a/backend/windmill-worker/src/ai/providers/anthropic.rs b/backend/windmill-ai/src/providers/anthropic.rs
similarity index 99%
rename from backend/windmill-worker/src/ai/providers/anthropic.rs
rename to backend/windmill-ai/src/providers/anthropic.rs
index 2bbfd83768..43cb503d96 100644
--- a/backend/windmill-worker/src/ai/providers/anthropic.rs
+++ b/backend/windmill-ai/src/providers/anthropic.rs
@@ -1,16 +1,16 @@
-use async_trait::async_trait;
-use serde::{Deserialize, Serialize};
-use serde_json::value::RawValue;
-use windmill_ai::{ai_google::parse_data_url, ai_providers::AIProvider};
-use windmill_common::{client::AuthedClient, error::Error};
-
-use crate::ai::{
+use crate::{
+    ai_google::parse_data_url,
+    ai_providers::AIProvider,
     image_handler::prepare_messages_for_api,
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink},
     sse::{AnthropicSSEParser, SSEParser},
     types::*,
     utils::{extract_text_content, should_use_structured_output_tool},
 };
+use async_trait::async_trait;
+use serde::{Deserialize, Serialize};
+use serde_json::value::RawValue;
+use windmill_common::{client::AuthedClient, error::Error};
 
 /// Anthropic API version for standard API
 const ANTHROPIC_VERSION_STANDARD: &str = "2023-06-01";
diff --git a/backend/windmill-worker/src/ai/providers/bedrock.rs b/backend/windmill-ai/src/providers/bedrock.rs
similarity index 96%
rename from backend/windmill-worker/src/ai/providers/bedrock.rs
rename to backend/windmill-ai/src/providers/bedrock.rs
index ce87d21a44..005327c15b 100644
--- a/backend/windmill-worker/src/ai/providers/bedrock.rs
+++ b/backend/windmill-ai/src/providers/bedrock.rs
@@ -1,4 +1,4 @@
-//! AWS Bedrock provider for the AI agent.
+//! AWS Bedrock provider for AI requests.
 //!
 //! Uses shared SDK code from windmill_ai::ai_bedrock for:
 //! - BedrockClient (SDK wrapper with auth)
@@ -6,28 +6,25 @@
 //! - Stream event parsing
 //! - Helper utilities
 
-use crate::ai::{
+use crate::{
     image_handler::prepare_messages_for_api,
     query_builder::{ParsedResponse, StreamEventSink},
-    types::StreamingEvent,
-    types::TokenUsage,
-    types::{OpenAIMessage, ToolDef},
+    types::{OpenAIMessage, StreamingEvent, TokenUsage, ToolDef},
 };
 use std::collections::HashMap;
 use windmill_common::{client::AuthedClient, error::Error};
 
-// Re-export from shared module for use by other parts of the worker
-use windmill_ai::ai_bedrock::{
+// Import shared Bedrock helpers for provider orchestration.
+use crate::ai_bedrock::{
     bedrock_model_supports_prompt_caching, bedrock_stream_event_is_block_stop,
     bedrock_stream_event_to_text, bedrock_stream_event_to_tool_delta,
     bedrock_stream_event_to_tool_start, build_tool_config, create_inference_config,
     format_bedrock_error, openai_messages_to_bedrock, streaming_tool_calls_to_openai,
-    StreamingToolCall,
+    BedrockClient, StreamingToolCall,
 };
-pub use windmill_ai::ai_bedrock::{check_env_credentials, BedrockClient};
 
 // ============================================================================
-// Query Builder (Worker-specific orchestration)
+// Query Builder
 // ============================================================================
 
 #[derive(Default)]
diff --git a/backend/windmill-worker/src/ai/providers/google_ai.rs b/backend/windmill-ai/src/providers/google_ai.rs
similarity index 97%
rename from backend/windmill-worker/src/ai/providers/google_ai.rs
rename to backend/windmill-ai/src/providers/google_ai.rs
index 6098cb22d8..81f34e7acb 100644
--- a/backend/windmill-worker/src/ai/providers/google_ai.rs
+++ b/backend/windmill-ai/src/providers/google_ai.rs
@@ -1,17 +1,16 @@
-use async_trait::async_trait;
-use windmill_ai::ai_google::{
-    openai_messages_to_gemini, openai_tools_to_gemini, GeminiGenerationConfig, GeminiImageContent,
-    GeminiImageRequest, GeminiImageResponse, GeminiInlineData, GeminiPart, GeminiPredictContent,
-    GeminiTextRequest, GeminiTool,
-};
-use windmill_common::{client::AuthedClient, error::Error};
-
-use crate::ai::{
+use crate::{
+    ai_google::{
+        openai_messages_to_gemini, openai_tools_to_gemini, GeminiGenerationConfig,
+        GeminiImageContent, GeminiImageRequest, GeminiImageResponse, GeminiInlineData, GeminiPart,
+        GeminiPredictContent, GeminiTextRequest, GeminiTool,
+    },
     image_handler::{download_and_encode_s3_image, prepare_messages_for_api},
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink},
     sse::{GeminiSSEParser, SSEParser},
     types::*,
 };
+use async_trait::async_trait;
+use windmill_common::{client::AuthedClient, error::Error};
 
 // ============================================================================
 // Query Builder Implementation
diff --git a/backend/windmill-ai/src/providers/mod.rs b/backend/windmill-ai/src/providers/mod.rs
new file mode 100644
index 0000000000..8f9e2382a8
--- /dev/null
+++ b/backend/windmill-ai/src/providers/mod.rs
@@ -0,0 +1,31 @@
+pub mod anthropic;
+#[cfg(feature = "bedrock")]
+pub mod bedrock;
+pub mod google_ai;
+pub mod openai;
+pub mod openrouter;
+pub mod other;
+
+use crate::{ai_providers::AIProvider, query_builder::QueryBuilder, types::ProviderWithResource};
+
+use self::{
+    anthropic::AnthropicQueryBuilder, google_ai::GoogleAIQueryBuilder, openai::OpenAIQueryBuilder,
+    openrouter::OpenRouterQueryBuilder, other::OtherQueryBuilder,
+};
+
+/// Factory function to create the appropriate query builder for a provider.
+pub fn create_query_builder(provider: &ProviderWithResource) -> Box<dyn QueryBuilder> {
+    match provider.kind {
+        AIProvider::GoogleAI => {
+            Box::new(GoogleAIQueryBuilder::new(provider.get_platform().clone()))
+        }
+        AIProvider::OpenAI => Box::new(OpenAIQueryBuilder::new(provider.kind.clone())),
+        AIProvider::Anthropic => Box::new(AnthropicQueryBuilder::new(
+            provider.kind.clone(),
+            provider.get_platform().clone(),
+            provider.get_enable_1m_context(),
+        )),
+        AIProvider::OpenRouter => Box::new(OpenRouterQueryBuilder::new()),
+        _ => Box::new(OtherQueryBuilder::new(provider.kind.clone())),
+    }
+}
diff --git a/backend/windmill-worker/src/ai/providers/openai.rs b/backend/windmill-ai/src/providers/openai.rs
similarity index 99%
rename from backend/windmill-worker/src/ai/providers/openai.rs
rename to backend/windmill-ai/src/providers/openai.rs
index 52feb2eca7..f8928ca940 100644
--- a/backend/windmill-worker/src/ai/providers/openai.rs
+++ b/backend/windmill-ai/src/providers/openai.rs
@@ -1,17 +1,16 @@
-use async_trait::async_trait;
-use serde::{Deserialize, Serialize};
-use serde_json::value::RawValue;
-use windmill_ai::ai_providers::AIProvider;
-use windmill_ai::ai_types::OpenAIToolCall;
-use windmill_common::{client::AuthedClient, error::Error};
-
-use crate::ai::{
+use crate::{
+    ai_providers::AIProvider,
+    ai_types::OpenAIToolCall,
     image_handler::{prepare_messages_for_api, s3_object_to_content_part},
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink},
     sse::{OpenAIResponsesSSEParser, SSEParser},
     types::*,
     utils::extract_text_content,
 };
+use async_trait::async_trait;
+use serde::{Deserialize, Serialize};
+use serde_json::value::RawValue;
+use windmill_common::{client::AuthedClient, error::Error};
 
 // Responses API structures
 #[derive(Deserialize)]
diff --git a/backend/windmill-worker/src/ai/providers/openrouter.rs b/backend/windmill-ai/src/providers/openrouter.rs
similarity index 97%
rename from backend/windmill-worker/src/ai/providers/openrouter.rs
rename to backend/windmill-ai/src/providers/openrouter.rs
index 68ad1922d3..aaefbb08ca 100644
--- a/backend/windmill-worker/src/ai/providers/openrouter.rs
+++ b/backend/windmill-ai/src/providers/openrouter.rs
@@ -1,15 +1,15 @@
-use async_trait::async_trait;
-use serde::{Deserialize, Serialize};
-use serde_json;
-use windmill_ai::ai_providers::AIProvider;
-use windmill_common::{client::AuthedClient, error::Error};
-
-use crate::ai::{
+use crate::{
+    ai_providers::AIProvider,
     image_handler::prepare_messages_for_api,
-    providers::other::OtherQueryBuilder,
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink},
     types::*,
 };
+use async_trait::async_trait;
+use serde::{Deserialize, Serialize};
+use serde_json;
+use windmill_common::{client::AuthedClient, error::Error};
+
+use crate::providers::other::OtherQueryBuilder;
 
 // OpenRouter-specific types
 #[derive(Serialize)]
diff --git a/backend/windmill-worker/src/ai/providers/other.rs b/backend/windmill-ai/src/providers/other.rs
similarity index 99%
rename from backend/windmill-worker/src/ai/providers/other.rs
rename to backend/windmill-ai/src/providers/other.rs
index f8ee60f287..08f922a1de 100644
--- a/backend/windmill-worker/src/ai/providers/other.rs
+++ b/backend/windmill-ai/src/providers/other.rs
@@ -1,16 +1,15 @@
-use async_trait::async_trait;
-use serde::Serialize;
-use serde_json;
-use windmill_ai::ai_providers::AIProvider;
-use windmill_common::{client::AuthedClient, error::Error};
-
-use crate::ai::{
+use crate::{
+    ai_providers::AIProvider,
     image_handler::prepare_messages_for_api,
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink},
     sse::{OpenAISSEParser, SSEParser},
     types::*,
     utils::should_use_structured_output_tool,
 };
+use async_trait::async_trait;
+use serde::Serialize;
+use serde_json;
+use windmill_common::{client::AuthedClient, error::Error};
 
 #[derive(Serialize, Debug, Clone)]
 #[serde(rename_all = "lowercase")]
diff --git a/backend/windmill-worker/src/ai/sse.rs b/backend/windmill-ai/src/sse.rs
similarity index 99%
rename from backend/windmill-worker/src/ai/sse.rs
rename to backend/windmill-ai/src/sse.rs
index 2cc03b148e..35a4e43acc 100644
--- a/backend/windmill-worker/src/ai/sse.rs
+++ b/backend/windmill-ai/src/sse.rs
@@ -3,17 +3,15 @@ use std::collections::HashMap;
 use eventsource_stream::Eventsource;
 use reqwest::Response;
 use serde::Deserialize;
-use serde_json;
 use tokio_stream::StreamExt;
-use windmill_ai::{
-    ai_google::{parse_gemini_sse_event, GeminiUsageMetadata},
-    ai_types::{ExtraContent, GoogleExtraContent, OpenAIFunction, OpenAIToolCall},
-};
 use windmill_common::{error::Error, utils::rd_string};
 
-use crate::ai::{
+use crate::{
+    ai_google::{parse_gemini_sse_event, GeminiUsageMetadata},
+    ai_types::UrlCitation,
+    ai_types::{ExtraContent, GoogleExtraContent, OpenAIFunction, OpenAIToolCall},
     query_builder::StreamEventSink,
-    types::{StreamingEvent, UrlCitation},
+    types::StreamingEvent,
 };
 
 #[derive(Deserialize)]
@@ -64,6 +62,7 @@ lazy_static::lazy_static! {
         .parse::<bool>()
         .unwrap_or(false);
 }
+#[allow(async_fn_in_trait)]
 pub trait SSEParser {
     async fn parse_event_data(&mut self, data: &str) -> Result<(), Error>;
 
@@ -459,11 +458,11 @@ impl SSEParser for AnthropicSSEParser {
 // Gemini SSE Parser
 // ============================================================================
 
-/// Accumulates Gemini streaming events and converts them into the worker's
-/// internal [`OpenAIToolCall`] / [`StreamingEvent`] representation.
+/// Accumulates Gemini streaming events and converts them into the shared
+/// [`OpenAIToolCall`] / [`StreamingEvent`] representation.
 ///
 /// The actual SSE parsing is delegated to [`parse_gemini_sse_event`] from
-/// `windmill_common::ai_google` so the logic can be shared with the API proxy.
+/// `windmill_ai::ai_google` so the logic can be shared with the API proxy.
 pub struct GeminiSSEParser {
     pub accumulated_content: String,
     pub accumulated_tool_calls: HashMap<i64, OpenAIToolCall>,
diff --git a/backend/windmill-ai/src/utils.rs b/backend/windmill-ai/src/utils.rs
new file mode 100644
index 0000000000..b401282df1
--- /dev/null
+++ b/backend/windmill-ai/src/utils.rs
@@ -0,0 +1,56 @@
+use crate::{
+    ai_providers::AIProvider,
+    ai_types::{ContentPart, OpenAIContent},
+};
+
+lazy_static::lazy_static! {
+    /// Parse AI_HTTP_HEADERS environment variable into a vector of (header_name, header_value) tuples
+    /// Format: "header1: value1, header2: value2"
+    pub static ref AI_HTTP_HEADERS: Vec<(String, String)> = {
+        std::env::var("AI_HTTP_HEADERS")
+            .ok()
+            .map(|headers_str| {
+                headers_str
+                    .split(',')
+                    .filter_map(|header| {
+                        let parts: Vec<&str> = header.splitn(2, ':').collect();
+                        if parts.len() == 2 {
+                            let name = parts[0].trim().to_string();
+                            let value = parts[1].trim().to_string();
+                            if !name.is_empty() && !value.is_empty() {
+                                Some((name, value))
+                            } else {
+                                None
+                            }
+                        } else {
+                            None
+                        }
+                    })
+                    .collect()
+            })
+            .unwrap_or_default()
+    };
+}
+
+/// AWS Bedrock do not handle structured output query param, so we use a tool for structured output. Same for every Claude models.
+pub fn should_use_structured_output_tool(provider: &AIProvider, model: &str) -> bool {
+    model.contains("claude") || provider == &AIProvider::AWSBedrock
+}
+
+/// Extract text content from OpenAIContent, joining parts with space if multiple
+pub fn extract_text_content(content: &OpenAIContent) -> String {
+    match content {
+        OpenAIContent::Text(text) => text.clone(),
+        OpenAIContent::Parts(parts) => parts
+            .iter()
+            .filter_map(|p| {
+                if let ContentPart::Text { text } = p {
+                    Some(text.as_str())
+                } else {
+                    None
+                }
+            })
+            .collect::<Vec<_>>()
+            .join(""),
+    }
+}
diff --git a/backend/windmill-api-auth/src/auth.rs b/backend/windmill-api-auth/src/auth.rs
index d4c448e934..ac4017b81c 100644
--- a/backend/windmill-api-auth/src/auth.rs
+++ b/backend/windmill-api-auth/src/auth.rs
@@ -715,7 +715,8 @@ pub async fn resolve_opt_job_authed(
 fn username_override_from_label(label: Option<String>) -> Option<String> {
     match label {
         Some(label)
-            if label.starts_with("webhook-")
+            if label.starts_with("ephemeral-webhook-")
+                || label.starts_with("webhook-")
                 || label.starts_with("http-")
                 || label.starts_with("email-")
                 || label.starts_with("ws-") =>
diff --git a/backend/windmill-api-inputs/src/lib.rs b/backend/windmill-api-inputs/src/lib.rs
index 154e02e5a9..348b434eea 100644
--- a/backend/windmill-api-inputs/src/lib.rs
+++ b/backend/windmill-api-inputs/src/lib.rs
@@ -172,6 +172,7 @@ async fn get_input_history(
             kind IN ('preview', 'flowpreview') as is_preview \
             FROM v2_job JOIN v2_job_completed USING (id) \
             WHERE v2_job.workspace_id = $3 AND {} = $1 AND kind = any($2) \
+            AND v2_job.script_entrypoint_override IS NULL \
             {args_query} AND v2_job_completed.status != 'skipped' {include_non_root} \
             ORDER BY v2_job.created_at DESC LIMIT $4\
         ) t ORDER BY completed_at DESC LIMIT $5 OFFSET $6",
diff --git a/backend/windmill-api-integration-tests/tests/token_hash.rs b/backend/windmill-api-integration-tests/tests/token_hash.rs
index 6f4ba6b0ac..45d324a3d4 100644
--- a/backend/windmill-api-integration-tests/tests/token_hash.rs
+++ b/backend/windmill-api-integration-tests/tests/token_hash.rs
@@ -274,7 +274,9 @@ async fn test_plaintext_backward_compat(db: Pool<Postgres>) -> anyhow::Result<()
     );
 
     // --- Phase 2: All workers upgraded (version >= 1.650.0) ---
-    MIN_VERSION.store(std::sync::Arc::new(MIN_VERSION_SUPPORTS_TOKEN_HASH.version().clone()));
+    MIN_VERSION.store(std::sync::Arc::new(
+        MIN_VERSION_SUPPORTS_TOKEN_HASH.version().clone(),
+    ));
 
     let resp = authed(client().post(format!("{base}/tokens/create")))
         .json(&json!({"label": "new-worker-token"}))
@@ -324,7 +326,7 @@ async fn test_plaintext_backward_compat(db: Pool<Postgres>) -> anyhow::Result<()
 async fn test_rotate_webhook_token(db: Pool<Postgres>) -> anyhow::Result<()> {
     initialize_tracing().await;
 
-    use windmill_native_triggers::{delete_token_by_hash, rotate_webhook_token};
+    use windmill_native_triggers::{delete_token_by_hash, rotate_webhook_token, ServiceName};
 
     // Insert a token directly with known values
     let original_token = "test-webhook-token-original-1234";
@@ -342,7 +344,7 @@ async fn test_rotate_webhook_token(db: Pool<Postgres>) -> anyhow::Result<()> {
     .await?;
 
     // Rotate the token
-    let rotated = rotate_webhook_token(&db, &original_hash)
+    let rotated = rotate_webhook_token(&db, &original_hash, ServiceName::Google)
         .await?
         .expect("rotate must return Some for existing token");
 
@@ -350,16 +352,27 @@ async fn test_rotate_webhook_token(db: Pool<Postgres>) -> anyhow::Result<()> {
     assert_ne!(rotated.new_token, original_token);
     assert_eq!(rotated.old_token_hash, original_hash);
 
-    // New token's hash should exist in DB
+    // New token's hash should exist in DB with the per-service label and expiration
     let new_hash = hash_token(&rotated.new_token);
-    let exists: bool = sqlx::query_scalar!(
-        "SELECT EXISTS(SELECT 1 FROM token WHERE token_hash = $1) AS exists",
+    let new_row = sqlx::query!(
+        "SELECT label, expiration FROM token WHERE token_hash = $1",
         new_hash
     )
-    .fetch_one(&db)
+    .fetch_optional(&db)
     .await?
-    .unwrap_or(false);
-    assert!(exists, "new token hash must exist in DB after rotation");
+    .expect("new token hash must exist in DB after rotation");
+    assert!(
+        new_row
+            .label
+            .as_deref()
+            .is_some_and(|l| l.starts_with("ephemeral-webhook-google-")),
+        "rotated token must carry an ephemeral-webhook-google-* label, got {:?}",
+        new_row.label
+    );
+    assert!(
+        new_row.expiration.is_some(),
+        "rotated Google token must carry an expiration"
+    );
 
     // Old token should still exist (deletion deferred to caller)
     let old_exists: bool = sqlx::query_scalar!(
@@ -389,7 +402,7 @@ async fn test_rotate_webhook_token(db: Pool<Postgres>) -> anyhow::Result<()> {
     assert!(!old_gone, "old token must be gone after explicit deletion");
 
     // Rotating a non-existent hash should return None
-    let result = rotate_webhook_token(&db, "nonexistent_hash").await?;
+    let result = rotate_webhook_token(&db, "nonexistent_hash", ServiceName::Google).await?;
     assert!(
         result.is_none(),
         "rotating a non-existent token must return None"
diff --git a/backend/windmill-api-jobs/src/concurrency_groups.rs b/backend/windmill-api-jobs/src/concurrency_groups.rs
index f3ef3b14a8..d8e7a54112 100644
--- a/backend/windmill-api-jobs/src/concurrency_groups.rs
+++ b/backend/windmill-api-jobs/src/concurrency_groups.rs
@@ -226,6 +226,7 @@ async fn get_concurrent_intervals(
             trigger_kind: _,
             include_args: _,
             broad_filter: _,
+            excludes_entrypoint_override: _,
         } => true,
         _ => false,
     };
diff --git a/backend/windmill-api-jobs/src/execution.rs b/backend/windmill-api-jobs/src/execution.rs
index 555d7a4d8b..e4359e19da 100644
--- a/backend/windmill-api-jobs/src/execution.rs
+++ b/backend/windmill-api-jobs/src/execution.rs
@@ -248,8 +248,11 @@ lazy_static::lazy_static! {
 
 #[derive(Deserialize)]
 pub struct WindmillCompositeResult {
+    #[serde(alias = "wm_status_code")]
     windmill_status_code: Option<u16>,
+    #[serde(alias = "wm_content_type")]
     windmill_content_type: Option<String>,
+    #[serde(alias = "wm_headers")]
     windmill_headers: Option<HashMap<String, String>>,
     result: Option<Box<RawValue>>,
 }
diff --git a/backend/windmill-api-jobs/src/query.rs b/backend/windmill-api-jobs/src/query.rs
index 38e139b77b..e6c57e6c5b 100644
--- a/backend/windmill-api-jobs/src/query.rs
+++ b/backend/windmill-api-jobs/src/query.rs
@@ -216,6 +216,10 @@ pub fn filter_list_queue_query(
         sqlb.and_where("trigger_kind IS DISTINCT FROM 'schedule'");
     }
 
+    if lq.excludes_entrypoint_override.unwrap_or(false) {
+        sqlb.and_where_is_null("v2_job.script_entrypoint_override");
+    }
+
     if let Some(tk) = &lq.trigger_kind {
         let quoted: Vec<_> = tk.values.iter().map(|v| quote(&format!("{}", v))).collect();
         if tk.negated {
@@ -519,6 +523,10 @@ pub fn filter_list_completed_query(
         sqlb.and_where("trigger_kind IS DISTINCT FROM 'schedule'");
     }
 
+    if lq.excludes_entrypoint_override.unwrap_or(false) {
+        sqlb.and_where_is_null("v2_job.script_entrypoint_override");
+    }
+
     if let Some(tk) = &lq.trigger_kind {
         let quoted: Vec<_> = tk.values.iter().map(|v| quote(&format!("{}", v))).collect();
         if tk.negated {
@@ -624,6 +632,7 @@ mod tests {
             trigger_path: None,
             include_args: None,
             broad_filter: None,
+            excludes_entrypoint_override: None,
         }
     }
 
@@ -668,6 +677,7 @@ mod tests {
             trigger_path: None,
             include_args: None,
             broad_filter: None,
+            excludes_entrypoint_override: None,
         }
     }
 
diff --git a/backend/windmill-api-jobs/src/types.rs b/backend/windmill-api-jobs/src/types.rs
index e07328e2be..bc03a04289 100644
--- a/backend/windmill-api-jobs/src/types.rs
+++ b/backend/windmill-api-jobs/src/types.rs
@@ -122,6 +122,7 @@ pub struct ListQueueQuery {
     pub trigger_path: Option<NegatedListFilter<String>>,
     pub include_args: Option<bool>,
     pub broad_filter: Option<String>,
+    pub excludes_entrypoint_override: Option<bool>,
 }
 
 #[derive(Deserialize, Clone)]
@@ -167,6 +168,7 @@ pub struct ListCompletedQuery {
     pub trigger_path: Option<NegatedListFilter<String>>,
     pub include_args: Option<bool>,
     pub broad_filter: Option<String>,
+    pub excludes_entrypoint_override: Option<bool>,
 }
 
 impl From<ListCompletedQuery> for ListQueueQuery {
@@ -202,6 +204,7 @@ impl From<ListCompletedQuery> for ListQueueQuery {
             trigger_path: lcq.trigger_path,
             include_args: lcq.include_args,
             broad_filter: lcq.broad_filter,
+            excludes_entrypoint_override: lcq.excludes_entrypoint_override,
         }
     }
 }
@@ -704,6 +707,7 @@ mod tests {
             trigger_path: None,
             include_args: None,
             broad_filter: None,
+            excludes_entrypoint_override: None,
         };
 
         let lqq: ListQueueQuery = lcq.into();
@@ -772,6 +776,7 @@ mod tests {
             trigger_path: None,
             include_args: None,
             broad_filter: None,
+            excludes_entrypoint_override: None,
         };
 
         let lqq: ListQueueQuery = lcq.into();
diff --git a/backend/windmill-api-settings/src/ee_oss.rs b/backend/windmill-api-settings/src/ee_oss.rs
index d0e0f69b62..92b3d6ad53 100644
--- a/backend/windmill-api-settings/src/ee_oss.rs
+++ b/backend/windmill-api-settings/src/ee_oss.rs
@@ -8,7 +8,11 @@ use anyhow::anyhow;
 pub async fn validate_license_key(
     _license_key: String,
     _db: Option<&windmill_common::DB>,
-) -> anyhow::Result<(String, bool)> {
+) -> anyhow::Result<(
+    String,
+    bool,
+    Option<windmill_common::ee_oss::OfflineMetadata>,
+)> {
     // Implementation is not open source
     Err(anyhow!("License can't be validated in Windmill CE"))
 }
diff --git a/backend/windmill-api-settings/src/lib.rs b/backend/windmill-api-settings/src/lib.rs
index f027046808..09b52a3d22 100644
--- a/backend/windmill-api-settings/src/lib.rs
+++ b/backend/windmill-api-settings/src/lib.rs
@@ -37,13 +37,13 @@ use axum::{
 use serde_json::json;
 
 use serde::{Deserialize, Serialize};
+use windmill_ai::ai_cache::bump_instance_ai_config_revision;
 #[cfg(feature = "enterprise")]
 use windmill_common::ee_oss::{send_critical_alert, CriticalAlertKind, CriticalErrorChannel};
 #[cfg(all(feature = "private", feature = "enterprise"))]
 use windmill_common::secret_backend::{
     AwsSecretsManagerSettings, AzureKeyVaultSettings, SecretMigrationReport, VaultSettings,
 };
-use windmill_ai::ai_cache::bump_instance_ai_config_revision;
 use windmill_common::{
     email_oss::send_email_plain_text,
     error::{self, JsonResult, Result},
@@ -118,6 +118,8 @@ pub fn global_service() -> Router {
             get(get_latest_key_renewal_attempt),
         )
         .route("/renew_license_key", post(renew_license_key))
+        .route("/offline_license_status", get(get_offline_license_status))
+        .route("/instance_hash", get(get_instance_hash))
         .route("/customer_portal", post(create_customer_portal_session))
         .route("/test_critical_channels", post(test_critical_channels))
         .route("/critical_alerts", get(get_critical_alerts))
@@ -340,7 +342,7 @@ pub async fn test_license_key(
     Json(TestKey { license_key }): Json<TestKey>,
 ) -> error::Result<String> {
     require_super_admin(&db, &authed.email).await?;
-    let (_, expired) = validate_license_key(license_key, Some(&db)).await?;
+    let (_, expired, _offline_meta) = validate_license_key(license_key, Some(&db)).await?;
 
     if expired {
         Err(error::Error::BadRequest("Expired license key".to_string()))
@@ -349,6 +351,53 @@ pub async fn test_license_key(
     }
 }
 
+#[derive(serde::Serialize)]
+pub struct InstanceHash {
+    pub instance_hash: Option<String>,
+}
+
+/// Returns the live cap status for an offline license, or `null` when no
+/// offline license is loaded. Used by the superadmin settings panel.
+pub async fn get_offline_license_status(
+    Extension(db): Extension<DB>,
+    authed: ApiAuthed,
+) -> error::JsonResult<Option<windmill_common::ee_oss::OfflineCapStatus>> {
+    require_super_admin(&db, &authed.email).await?;
+
+    let offline = (**windmill_common::ee_oss::LICENSE_OFFLINE_METADATA.load()).clone();
+    let is_offline = matches!(&offline, Some(m) if m.is_offline());
+
+    if !is_offline {
+        return Ok(Json(None));
+    }
+
+    #[cfg(feature = "enterprise")]
+    let cap = windmill_common::ee_oss::enforce_offline_caps(&db)
+        .await
+        .map_err(|e| error::Error::internal_err(format!("enforce_offline_caps: {e:#}")))?;
+    #[cfg(not(feature = "enterprise"))]
+    let cap: Option<windmill_common::ee_oss::OfflineCapStatus> = None;
+
+    Ok(Json(cap))
+}
+
+/// Returns the per-instance binding hash that goes into offline license keys.
+/// Admin invokes via `curl` with their personal token when requesting a key
+/// from support.
+pub async fn get_instance_hash(
+    Extension(db): Extension<DB>,
+    authed: ApiAuthed,
+) -> error::JsonResult<InstanceHash> {
+    require_super_admin(&db, &authed.email).await?;
+    #[cfg(feature = "enterprise")]
+    let hash = windmill_common::ee_oss::compute_instance_hash(&db)
+        .await
+        .map_err(|e| error::Error::internal_err(format!("compute_instance_hash: {e:#}")))?;
+    #[cfg(not(feature = "enterprise"))]
+    let hash: Option<String> = None;
+    Ok(Json(InstanceHash { instance_hash: hash }))
+}
+
 pub async fn get_local_settings(
     Extension(db): Extension<DB>,
     authed: ApiAuthed,
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index f479b8c719..95c7157d61 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -5233,6 +5233,13 @@ async fn invite_user(
 
     nu.email = nu.email.to_lowercase();
 
+    #[cfg(feature = "enterprise")]
+    if let Some(msg) =
+        windmill_common::ee_oss::check_seat_cap_for_new_user(&db, &nu.email, nu.operator).await?
+    {
+        return Err(Error::BadRequest(msg));
+    }
+
     let mut tx = db.begin().await?;
 
     let already_in_workspace = sqlx::query_scalar!(
@@ -5306,6 +5313,13 @@ async fn add_user(
 
     nu.email = nu.email.to_lowercase();
 
+    #[cfg(feature = "enterprise")]
+    if let Some(msg) =
+        windmill_common::ee_oss::check_seat_cap_for_new_user(&db, &nu.email, nu.operator).await?
+    {
+        return Err(Error::BadRequest(msg));
+    }
+
     let mut tx = db.begin().await?;
 
     let already_exists_email = sqlx::query_scalar!(
@@ -7351,6 +7365,7 @@ async fn list_ws_specific(
                   WHERE v.workspace_id = s.workspace_id AND v.path = s.path
               ))
           )
+        ORDER BY s.item_kind, s.path
         "#,
         &w_id
     )
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index dd3c480241..258e268f88 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.697.0
+  version: 1.700.2
   title: Windmill API
 
   contact:
@@ -1779,6 +1779,63 @@ paths:
               schema:
                 type: string
 
+  /settings/offline_license_status:
+    get:
+      summary: get cap-usage status for the currently-loaded offline license
+      description: |
+        Returns the live cap status (seats used vs cap, current CU vs cap) for
+        the offline license key currently in use. Returns `null` if no offline
+        license is loaded. Super-admin only.
+      operationId: getOfflineLicenseStatus
+      tags:
+        - setting
+      responses:
+        "200":
+          description: cap status (or null when no offline license)
+          content:
+            application/json:
+              schema:
+                type: object
+                nullable: true
+                properties:
+                  seats_used:
+                    type: number
+                    description: Author-equivalent seats consumed (authors + 0.5 × operators)
+                  seats_cap:
+                    type: integer
+                  author_count:
+                    type: integer
+                  operator_count:
+                    type: integer
+                  current_cu:
+                    type: number
+                    description: Sum of CU rate across workers that pinged in the last 2 minutes.
+                  cu_cap:
+                    type: number
+                  cu_over_cap:
+                    type: boolean
+
+  /settings/instance_hash:
+    get:
+      summary: per-instance binding hash for offline license issuance
+      description: |
+        Returns the hash a superadmin shares with Windmill support when
+        requesting an offline license. Super-admin only.
+      operationId: getInstanceHash
+      tags:
+        - setting
+      responses:
+        '200':
+          description: instance hash
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  instance_hash:
+                    type: string
+                    nullable: true
+
   /settings/customer_portal:
     post:
       summary: create customer portal session
@@ -12000,6 +12057,11 @@ paths:
           in: query
           schema:
             type: boolean
+        - name: excludes_entrypoint_override
+          description: exclude jobs that were started with a `_ENTRYPOINT_OVERRIDE` arg (e.g. dynamic-select helper runs and preprocessor previews)
+          in: query
+          schema:
+            type: boolean
         - name: broad_filter
           description: broad search across multiple fields (case-insensitive substring match on path, tag, schedule path, trigger kind, label)
           in: query
@@ -20958,6 +21020,9 @@ components:
         jwt_role:
           type: string
           description: Vault JWT auth role name for Windmill (optional, if not provided token auth is used)
+        jwt_mount_path:
+          type: string
+          description: Mount path for the JWT auth method in Vault (optional, defaults to "jwt"). Set this when the JWT auth method is mounted at a non-default path, e.g. via `vault auth enable -path=<mount> jwt`.
         namespace:
           type: string
           description: Vault Enterprise namespace (optional)
diff --git a/backend/windmill-api/src/ai.rs b/backend/windmill-api/src/ai.rs
index a2c4ceb811..8b415997c2 100644
--- a/backend/windmill-api/src/ai.rs
+++ b/backend/windmill-api/src/ai.rs
@@ -15,11 +15,12 @@ use serde::{Deserialize, Serialize};
 use serde_json::{json, value::RawValue};
 use std::collections::HashMap;
 use std::time::Duration;
-use windmill_audit::{audit_oss::audit_log, ActionKind};
 use windmill_ai::ai_cache::current_instance_ai_config_revision;
 use windmill_ai::ai_providers::{
     empty_string_as_none, AIPlatform, AIProvider, ProviderConfig, ProviderModel,
 };
+use windmill_ai::utils::AI_HTTP_HEADERS;
+use windmill_audit::{audit_oss::audit_log, ActionKind};
 use windmill_common::db::UserDB;
 use windmill_common::error::{to_anyhow, Error, Result};
 use windmill_common::utils::configure_client;
@@ -101,32 +102,6 @@ lazy_static::lazy_static! {
 
     pub static ref AI_REQUEST_CACHE: Cache<(String, AIProvider), ExpiringAIRequestConfig> = Cache::new(500);
 
-    /// Parse AI_HTTP_HEADERS environment variable into a vector of (header_name, header_value) tuples
-    /// Format: "header1: value1, header2: value2"
-    static ref AI_HTTP_HEADERS: Vec<(String, String)> = {
-        std::env::var("AI_HTTP_HEADERS")
-            .ok()
-            .map(|headers_str| {
-                headers_str
-                    .split(',')
-                    .filter_map(|header| {
-                        let parts: Vec<&str> = header.splitn(2, ':').collect();
-                        if parts.len() == 2 {
-                            let name = parts[0].trim().to_string();
-                            let value = parts[1].trim().to_string();
-                            if !name.is_empty() && !value.is_empty() {
-                                Some((name, value))
-                            } else {
-                                None
-                            }
-                        } else {
-                            None
-                        }
-                    })
-                    .collect()
-            })
-            .unwrap_or_default()
-    };
 }
 
 pub(crate) fn invalidate_ai_request_cache_for_workspace(workspace_id: &str) {
diff --git a/backend/windmill-api/src/ee_oss.rs b/backend/windmill-api/src/ee_oss.rs
index a1f7a54d20..e5a7f71cbc 100644
--- a/backend/windmill-api/src/ee_oss.rs
+++ b/backend/windmill-api/src/ee_oss.rs
@@ -10,7 +10,11 @@ use anyhow::anyhow;
 pub async fn validate_license_key(
     _license_key: String,
     _db: Option<&crate::db::DB>,
-) -> anyhow::Result<(String, bool)> {
+) -> anyhow::Result<(
+    String,
+    bool,
+    Option<windmill_common::ee_oss::OfflineMetadata>,
+)> {
     // Implementation is not open source
     Err(anyhow!("License can't be validated in Windmill CE"))
 }
diff --git a/backend/windmill-api/src/jobs.rs b/backend/windmill-api/src/jobs.rs
index efe03f73dd..ff72ddce70 100644
--- a/backend/windmill-api/src/jobs.rs
+++ b/backend/windmill-api/src/jobs.rs
@@ -1067,10 +1067,15 @@ impl<'a> GetQuery<'a> {
                 .ok()
                 .inspect(|data| job.raw_flow = Some(sqlx::types::Json(data.raw_flow.clone())));
         }
-        if self.with_code && job.job_kind() == &JobKind::Preview {
+        if self.with_code
+            && matches!(
+                job.job_kind(),
+                JobKind::Preview | JobKind::FlowScript | JobKind::AppScript
+            )
+        {
             // Try to fetch the code from the cache, fallback to the preview code.
-            // NOTE: This could check for the job kinds instead of the `or_else` but it's not
-            // necessary as `fetch_script` return early if the job kind is not a preview one.
+            // `fetch_script` resolves FlowScript / AppScript via their runnable_id; for
+            // Preview jobs it returns early and we fall through to `fetch_preview_script`.
             let conn = Connection::from(db.clone());
             cache::job::fetch_script(db.clone(), job.job_kind(), hash)
                 .or_else(|_| cache::job::fetch_preview_script(&conn, &id, raw_lock, raw_code))
diff --git a/backend/windmill-common/src/ee_oss.rs b/backend/windmill-common/src/ee_oss.rs
index 15d9e7cb5e..e68bc00c6e 100644
--- a/backend/windmill-common/src/ee_oss.rs
+++ b/backend/windmill-common/src/ee_oss.rs
@@ -18,6 +18,60 @@ lazy_static::lazy_static! {
   pub static ref LICENSE_KEY_VALID: AtomicBool = AtomicBool::new(true);
   pub static ref LICENSE_KEY_ID: arc_swap::ArcSwap<String> = arc_swap::ArcSwap::from_pointee("".to_string());
   pub static ref LICENSE_KEY: arc_swap::ArcSwap<String> = arc_swap::ArcSwap::from_pointee("".to_string());
+  pub static ref LICENSE_OFFLINE_METADATA: arc_swap::ArcSwap<Option<OfflineMetadata>> = arc_swap::ArcSwap::from_pointee(None);
+  pub static ref LICENSE_OFFLINE_OVER_CU_CAP: AtomicBool = AtomicBool::new(false);
+  pub static ref LICENSE_OFFLINE_LAST_STATUS: arc_swap::ArcSwap<Option<OfflineCapStatus>> = arc_swap::ArcSwap::from_pointee(None);
+  pub static ref LICENSE_OFFLINE_LAST_CHECKED_AT: arc_swap::ArcSwap<Option<chrono::DateTime<chrono::Utc>>> = arc_swap::ArcSwap::from_pointee(None);
+}
+
+#[cfg(not(feature = "private"))]
+#[derive(Clone, Debug, Deserialize, serde::Serialize)]
+pub struct OfflineMetadata {
+    pub v: u32,
+    pub kind: String,
+    pub hash: String,
+    pub seats: i64,
+    pub cu_limit: f64,
+}
+
+#[cfg(not(feature = "private"))]
+impl OfflineMetadata {
+    pub fn is_offline(&self) -> bool {
+        self.kind == "offline"
+    }
+}
+
+#[cfg(not(feature = "private"))]
+#[derive(Clone, Debug, serde::Serialize)]
+pub struct OfflineCapStatus {
+    pub seats_used: f64,
+    pub seats_cap: i64,
+    pub author_count: i64,
+    pub operator_count: i64,
+    pub current_cu: f64,
+    pub cu_cap: f64,
+    pub cu_over_cap: bool,
+}
+
+#[cfg(all(feature = "enterprise", not(feature = "private")))]
+pub async fn check_seat_cap_for_new_user(
+    _db: &DB,
+    _email: &str,
+    _new_user_is_operator: bool,
+) -> anyhow::Result<Option<String>> {
+    Ok(None)
+}
+
+#[cfg(all(feature = "enterprise", not(feature = "private")))]
+pub async fn compute_instance_hash(_db: &DB) -> anyhow::Result<Option<String>> {
+    // Implementation is not open source
+    Ok(None)
+}
+
+#[cfg(all(feature = "enterprise", not(feature = "private")))]
+pub async fn enforce_offline_caps(_db: &DB) -> anyhow::Result<Option<OfflineCapStatus>> {
+    // Implementation is not open source
+    Ok(None)
 }
 
 #[cfg(not(feature = "private"))]
diff --git a/backend/windmill-common/src/instance_config.rs b/backend/windmill-common/src/instance_config.rs
index e9a9731f74..e19182be30 100644
--- a/backend/windmill-common/src/instance_config.rs
+++ b/backend/windmill-common/src/instance_config.rs
@@ -200,7 +200,15 @@ fn opaque_json_schema(_: &mut schemars::gen::SchemaGenerator) -> schemars::schem
 
 /// Typed global settings with schema validation.
 /// Known settings have explicit fields; unknown settings pass through via `extra`.
+///
+/// `#[serde(remote = "Self")]` turns the derived (de)serializers into inherent
+/// associated functions so we can wrap them with the manual `Deserialize` impl
+/// below. The wrapper preserves explicit `null` values (which the typed
+/// `Option<T>` fields would otherwise silently drop on round-trip through
+/// `to_settings_map`) by stashing them in `extra`, where they survive
+/// re-serialization and reach `diff_global_settings` as proper deletes.
 #[derive(Deserialize, Serialize, Clone, Debug, Default)]
+#[serde(remote = "Self")]
 #[cfg_attr(feature = "instance_config_schema", derive(schemars::JsonSchema))]
 pub struct GlobalSettings {
     // Numeric settings
@@ -373,6 +381,42 @@ pub struct GlobalSettings {
     pub extra: BTreeMap<String, serde_json::Value>,
 }
 
+impl Serialize for GlobalSettings {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        Self::serialize(self, serializer)
+    }
+}
+
+impl<'de> Deserialize<'de> for GlobalSettings {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        // Capture top-level keys explicitly set to `null` so they survive the
+        // `to_settings_map` round-trip — typed `Option<T>` fields all use
+        // `skip_serializing_if = "Option::is_none"`, which would otherwise
+        // silently drop the null. We stash the null entries in `extra`, which
+        // serializes them back out as `null` for `diff_global_settings` to
+        // route to deletes.
+        let mut value = serde_json::Value::deserialize(deserializer)?;
+        let null_keys: Vec<String> = value
+            .as_object()
+            .map(|m| {
+                m.iter()
+                    .filter_map(|(k, v)| v.is_null().then(|| k.clone()))
+                    .collect()
+            })
+            .unwrap_or_default();
+        if let Some(obj) = value.as_object_mut() {
+            for k in &null_keys {
+                obj.remove(k);
+            }
+        }
+        let mut s = Self::deserialize(value).map_err(serde::de::Error::custom)?;
+        for k in null_keys {
+            s.extra.insert(k, serde_json::Value::Null);
+        }
+        Ok(s)
+    }
+}
+
 impl GlobalSettings {
     /// Convert to a flat `BTreeMap` suitable for DB sync.
     pub fn to_settings_map(&self) -> BTreeMap<String, serde_json::Value> {
@@ -1930,6 +1974,101 @@ mod tests {
     // to_settings_map edge cases
     // -----------------------------------------------------------------------
 
+    /// Regression test for bulk-endpoint deletion of typed settings.
+    ///
+    /// A naive `#[derive(Deserialize)]` would route
+    /// `{"object_store_cache_config": null}` to the typed `Option<...>` field
+    /// as `None`, and `skip_serializing_if = "Option::is_none"` would then
+    /// strip it from `to_settings_map`, so `diff_global_settings` (Merge mode)
+    /// would never see the deletion. The manual `Deserialize` impl on
+    /// `GlobalSettings` captures explicit top-level nulls into `extra` so they
+    /// survive the round-trip and reach `diff_global_settings` as proper
+    /// deletes.
+    #[test]
+    fn explicit_null_on_typed_field_survives_round_trip() {
+        let json = serde_json::json!({
+            "object_store_cache_config": null,
+            "secret_backend": null,
+            "smtp_settings": null,
+            "base_url": "https://x",
+        });
+        let settings: GlobalSettings =
+            serde_json::from_value(json).expect("null should deserialize");
+        assert!(settings.object_store_cache_config.is_none());
+        assert!(settings.secret_backend.is_none());
+        assert!(settings.smtp_settings.is_none());
+        assert_eq!(settings.base_url.as_deref(), Some("https://x"));
+        let map = settings.to_settings_map();
+        assert_eq!(map["object_store_cache_config"], serde_json::Value::Null);
+        assert_eq!(map["secret_backend"], serde_json::Value::Null);
+        assert_eq!(map["smtp_settings"], serde_json::Value::Null);
+        assert_eq!(map["base_url"], serde_json::json!("https://x"));
+    }
+
+    /// Absent keys remain absent — critical so a PUT that only sets a single
+    /// field doesn't accidentally delete every other setting in Merge mode.
+    #[test]
+    fn absent_typed_fields_do_not_appear_in_map() {
+        let settings: GlobalSettings =
+            serde_json::from_value(serde_json::json!({"base_url": "https://x"})).unwrap();
+        let map = settings.to_settings_map();
+        assert!(!map.contains_key("object_store_cache_config"));
+        assert!(!map.contains_key("smtp_settings"));
+        assert_eq!(map.get("base_url"), Some(&serde_json::json!("https://x")));
+    }
+
+    /// End-to-end: deserialize → `to_settings_map` → diff in Merge mode with
+    /// an explicit null produces a delete (the scenario that silently failed
+    /// before the manual `Deserialize` impl).
+    #[test]
+    fn deserialize_then_diff_deletes_typed_null() {
+        let mut current = BTreeMap::new();
+        current.insert(
+            "object_store_cache_config".to_string(),
+            serde_json::json!({"type": "S3", "bucket": "b"}),
+        );
+        let desired: GlobalSettings =
+            serde_json::from_value(serde_json::json!({"object_store_cache_config": null})).unwrap();
+        let desired_map = desired.to_settings_map();
+        let diff = diff_global_settings(&current, &desired_map, ApplyMode::Merge);
+        assert!(diff.upserts.is_empty());
+        assert_eq!(diff.deletes, vec!["object_store_cache_config".to_string()]);
+    }
+
+    /// Nested nulls inside a typed sub-struct are not promoted to top-level
+    /// deletes — only the top-level key matters, mirroring the per-key API.
+    #[test]
+    fn nested_null_inside_typed_field_is_not_treated_as_top_level_null() {
+        let settings: GlobalSettings =
+            serde_json::from_value(serde_json::json!({"smtp_settings": {"smtp_host": null}}))
+                .unwrap();
+        let map = settings.to_settings_map();
+        assert!(
+            map["smtp_settings"].is_object(),
+            "smtp_settings should be an object, not null"
+        );
+    }
+
+    /// Unknown/extra keys with explicit null still flow through `extra` — this
+    /// was already correct before the manual impl; guard against regression.
+    #[test]
+    fn explicit_null_on_extra_field_survives_round_trip() {
+        let settings: GlobalSettings =
+            serde_json::from_value(serde_json::json!({"unknown_legacy_setting": null})).unwrap();
+        let map = settings.to_settings_map();
+        assert_eq!(map["unknown_legacy_setting"], serde_json::Value::Null);
+    }
+
+    /// Top-level non-object input must reject with a deserialize error rather
+    /// than silently producing defaults. Matches the previous derive behavior.
+    #[test]
+    fn non_object_top_level_input_errors() {
+        assert!(serde_json::from_value::<GlobalSettings>(serde_json::json!(null)).is_err());
+        assert!(serde_json::from_value::<GlobalSettings>(serde_json::json!("s")).is_err());
+        assert!(serde_json::from_value::<GlobalSettings>(serde_json::json!(42)).is_err());
+        assert!(serde_json::from_value::<GlobalSettings>(serde_json::json!([])).is_err());
+    }
+
     #[test]
     fn to_settings_map_empty_defaults() {
         let settings = GlobalSettings::default();
diff --git a/backend/windmill-common/src/lib.rs b/backend/windmill-common/src/lib.rs
index 7c7e3f79ed..39884e3d35 100644
--- a/backend/windmill-common/src/lib.rs
+++ b/backend/windmill-common/src/lib.rs
@@ -121,6 +121,36 @@ pub const PRIVATE_HUB_MIN_VERSION: i32 = 10_000_000;
 pub const SERVICE_LOG_RETENTION_SECS: i64 = 60 * 60 * 24 * 14; // 2 weeks retention period for logs
 pub const WM_DEPLOYERS_GROUP: &str = "wm_deployers";
 
+/// Canonical form of a base URL, used as one of the inputs to the offline-license
+/// instance hash (`compute_instance_hash`).
+///
+/// Rules: lowercase scheme and host, drop default ports (80/443), strip path/query/fragment,
+/// strip trailing slash. If URL parsing fails, falls back to a best-effort lowercase +
+/// trailing-slash strip so two semantically-equivalent inputs still produce the same
+/// canonical form.
+pub fn canonical_base_url(input: &str) -> String {
+    let trimmed = input.trim();
+    if trimmed.is_empty() {
+        return String::new();
+    }
+    match url::Url::parse(trimmed) {
+        Ok(u) => {
+            let scheme = u.scheme().to_ascii_lowercase();
+            let host = u
+                .host_str()
+                .map(|h| h.to_ascii_lowercase())
+                .unwrap_or_default();
+            let port = match (u.port(), scheme.as_str()) {
+                (Some(80), "http") | (Some(443), "https") => String::new(),
+                (Some(p), _) => format!(":{p}"),
+                (None, _) => String::new(),
+            };
+            format!("{scheme}://{host}{port}")
+        }
+        Err(_) => trimmed.trim_end_matches('/').to_ascii_lowercase(),
+    }
+}
+
 /// Checks if the user is allowed to preserve on_behalf_of values (admin or deployer).
 pub fn can_preserve_on_behalf_of(authed: &impl db::Authable) -> bool {
     authed.is_admin() || authed.groups().iter().any(|g| g == &WM_DEPLOYERS_GROUP)
diff --git a/backend/windmill-common/src/secret_backend/mod.rs b/backend/windmill-common/src/secret_backend/mod.rs
index a75f51ea70..36f35f0cf8 100644
--- a/backend/windmill-common/src/secret_backend/mod.rs
+++ b/backend/windmill-common/src/secret_backend/mod.rs
@@ -122,6 +122,11 @@ pub struct VaultSettings {
     /// Optional - if not provided, token auth is used
     #[serde(skip_serializing_if = "Option::is_none")]
     pub jwt_role: Option<String>,
+    /// Mount path for the JWT auth method in Vault (defaults to "jwt").
+    /// Set this when the JWT auth method is mounted at a non-default path,
+    /// e.g. via `vault auth enable -path=my-mount jwt`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub jwt_mount_path: Option<String>,
     /// Vault Enterprise namespace (optional)
     #[serde(skip_serializing_if = "Option::is_none")]
     pub namespace: Option<String>,
diff --git a/backend/windmill-common/src/secret_backend/tests.rs b/backend/windmill-common/src/secret_backend/tests.rs
index 630b6cf023..3e2a12382a 100644
--- a/backend/windmill-common/src/secret_backend/tests.rs
+++ b/backend/windmill-common/src/secret_backend/tests.rs
@@ -26,6 +26,7 @@ mod tests {
             address: "http://127.0.0.1:8200".to_string(),
             mount_path: "windmill".to_string(),
             jwt_role: Some("windmill-secrets".to_string()),
+            jwt_mount_path: None,
             namespace: None,
             token: Some("test-root-token".to_string()),
             skip_ssl_verify: None,
diff --git a/backend/windmill-common/src/utils.rs b/backend/windmill-common/src/utils.rs
index efe5481e1d..17d9cfd804 100644
--- a/backend/windmill-common/src/utils.rs
+++ b/backend/windmill-common/src/utils.rs
@@ -447,7 +447,9 @@ pub async fn get_license_id_or_uid<'c, E: sqlx::Executor<'c, Database = Postgres
     }
 }
 
-async fn get_instance_uid<'c, E: sqlx::Executor<'c, Database = Postgres>>(db: E) -> Result<String> {
+pub async fn get_instance_uid<'c, E: sqlx::Executor<'c, Database = Postgres>>(
+    db: E,
+) -> Result<String> {
     let uid_value = sqlx::query_scalar!(
         "SELECT value FROM global_settings WHERE name = $1",
         UNIQUE_ID_SETTING
diff --git a/backend/windmill-common/tests/secret_backend_integration.rs b/backend/windmill-common/tests/secret_backend_integration.rs
index 070c70defa..350fc297af 100644
--- a/backend/windmill-common/tests/secret_backend_integration.rs
+++ b/backend/windmill-common/tests/secret_backend_integration.rs
@@ -91,6 +91,7 @@ mod tests {
                 .unwrap_or_else(|_| "http://127.0.0.1:8200".to_string()),
             mount_path: "windmill".to_string(),
             jwt_role: None, // Static token mode
+            jwt_mount_path: None,
             namespace: None,
             token: Some(
                 std::env::var("VAULT_TOKEN").unwrap_or_else(|_| "test-root-token".to_string()),
@@ -106,6 +107,7 @@ mod tests {
                 .unwrap_or_else(|_| "http://127.0.0.1:8200".to_string()),
             mount_path: "windmill".to_string(),
             jwt_role: Some("windmill-secrets".to_string()), // JWT mode
+            jwt_mount_path: None,
             namespace: None,
             token: None, // No static token - use JWT
             skip_ssl_verify: None,
@@ -203,7 +205,10 @@ mod tests {
         println!("Testing Vault connection with JWT auth...");
         println!("  Address: {}", settings.address);
         println!("  JWT Role: {:?}", settings.jwt_role);
-        println!("  BASE_URL: {}", (**windmill_common::BASE_URL.load()).clone());
+        println!(
+            "  BASE_URL: {}",
+            (**windmill_common::BASE_URL.load()).clone()
+        );
 
         let result = test_vault_connection(&settings, Some(&db)).await;
         assert!(
@@ -274,13 +279,15 @@ mod tests {
         // Encrypt fixture placeholders with real workspace keys
         encrypt_fixture_secrets(&db).await;
 
-        let secret_count = sqlx::query_scalar!(
-            "SELECT COUNT(*) FROM variable WHERE is_secret = true"
-        )
-        .fetch_one(&db)
-        .await
-        .expect("Failed to count secrets");
-        println!("Found {} secrets in database before migration", secret_count.unwrap_or(0));
+        let secret_count =
+            sqlx::query_scalar!("SELECT COUNT(*) FROM variable WHERE is_secret = true")
+                .fetch_one(&db)
+                .await
+                .expect("Failed to count secrets");
+        println!(
+            "Found {} secrets in database before migration",
+            secret_count.unwrap_or(0)
+        );
 
         // Run migration
         println!("Migrating secrets to Vault...");
@@ -288,8 +295,10 @@ mod tests {
             .await
             .expect("Migration to Vault failed");
 
-        println!("Migration report: total={}, migrated={}, failed={}",
-            report.total_secrets, report.migrated_count, report.failed_count);
+        println!(
+            "Migration report: total={}, migrated={}, failed={}",
+            report.total_secrets, report.migrated_count, report.failed_count
+        );
 
         if !report.failures.is_empty() {
             for f in &report.failures {
@@ -307,7 +316,11 @@ mod tests {
                 .get_secret(ws, path)
                 .await
                 .unwrap_or_else(|e| panic!("Failed to read {}/{} from Vault: {:?}", ws, path, e));
-            assert_eq!(value, expected_plaintext, "Vault value mismatch for {}/{}", ws, path);
+            assert_eq!(
+                value, expected_plaintext,
+                "Vault value mismatch for {}/{}",
+                ws, path
+            );
             println!("  ✓ {}/{} correct in Vault", ws, path);
         }
 
@@ -346,8 +359,10 @@ mod tests {
             .await
             .expect("Migration to database failed");
 
-        println!("Migration report: total={}, migrated={}, failed={}",
-            report.total_secrets, report.migrated_count, report.failed_count);
+        println!(
+            "Migration report: total={}, migrated={}, failed={}",
+            report.total_secrets, report.migrated_count, report.failed_count
+        );
 
         assert_eq!(report.failed_count, 0, "Migration had failures");
         assert!(report.migrated_count > 0, "No secrets were migrated");
@@ -364,7 +379,11 @@ mod tests {
 
             let mc = build_crypt(&db, ws).await.unwrap();
             let decrypted = decrypt(&mc, row).expect("Failed to decrypt restored value");
-            assert_eq!(decrypted, expected_plaintext, "Restored value mismatch for {}/{}", ws, path);
+            assert_eq!(
+                decrypted, expected_plaintext,
+                "Restored value mismatch for {}/{}",
+                ws, path
+            );
             println!("  ✓ {}/{} correctly restored in DB", ws, path);
         }
 
@@ -488,11 +507,19 @@ mod tests {
             .await
             .unwrap_or_else(|_| panic!("Secret {}/{} not found after round-trip", ws, path));
 
-            assert_ne!(encrypted, "ROUND_TRIP_CLEARED", "Secret {}/{} was not restored", ws, path);
+            assert_ne!(
+                encrypted, "ROUND_TRIP_CLEARED",
+                "Secret {}/{} was not restored",
+                ws, path
+            );
 
             let mc = build_crypt(&db, ws).await.unwrap();
             let decrypted = decrypt(&mc, encrypted).expect("Failed to decrypt");
-            assert_eq!(decrypted, expected_plaintext, "Round-trip value mismatch for {}/{}", ws, path);
+            assert_eq!(
+                decrypted, expected_plaintext,
+                "Round-trip value mismatch for {}/{}",
+                ws, path
+            );
             println!("  ✓ {}/{}: round-trip OK", ws, path);
         }
 
@@ -522,10 +549,7 @@ mod tests {
             .get_secret("test-workspace", "u/test-user/other_secret")
             .await;
 
-        assert!(
-            cross_access.is_err(),
-            "Cross-workspace access should fail!"
-        );
+        assert!(cross_access.is_err(), "Cross-workspace access should fail!");
         println!("✓ Cross-workspace access correctly denied");
 
         // Verify own workspace access works
diff --git a/backend/windmill-common/tests/secret_backend_migration.rs b/backend/windmill-common/tests/secret_backend_migration.rs
index 1915b90630..fba27ee260 100644
--- a/backend/windmill-common/tests/secret_backend_migration.rs
+++ b/backend/windmill-common/tests/secret_backend_migration.rs
@@ -23,19 +23,21 @@
 use sqlx::{Pool, Postgres};
 use windmill_common::error::Result;
 use windmill_common::secret_backend::{
-    vault_oss::{migrate_secrets_to_database, migrate_secrets_to_vault, test_vault_connection, VaultBackend},
+    vault_oss::{
+        migrate_secrets_to_database, migrate_secrets_to_vault, test_vault_connection, VaultBackend,
+    },
     SecretBackend, VaultSettings,
 };
 
 fn test_vault_settings() -> VaultSettings {
     VaultSettings {
-        address: std::env::var("VAULT_ADDR").unwrap_or_else(|_| "http://127.0.0.1:8200".to_string()),
+        address: std::env::var("VAULT_ADDR")
+            .unwrap_or_else(|_| "http://127.0.0.1:8200".to_string()),
         mount_path: "windmill".to_string(),
         jwt_role: Some("windmill-secrets".to_string()),
+        jwt_mount_path: None,
         namespace: None,
-        token: Some(
-            std::env::var("VAULT_TOKEN").unwrap_or_else(|_| "test-root-token".to_string()),
-        ),
+        token: Some(std::env::var("VAULT_TOKEN").unwrap_or_else(|_| "test-root-token".to_string())),
         skip_ssl_verify: None,
     }
 }
@@ -47,7 +49,11 @@ async fn test_vault_connection_works(db: Pool<Postgres>) {
     let settings = test_vault_settings();
 
     let result = test_vault_connection(&settings, Some(&db)).await;
-    assert!(result.is_ok(), "Failed to connect to Vault: {:?}", result.err());
+    assert!(
+        result.is_ok(),
+        "Failed to connect to Vault: {:?}",
+        result.err()
+    );
     println!("✓ Successfully connected to Vault at {}", settings.address);
 }
 
@@ -70,7 +76,10 @@ async fn test_migrate_db_to_vault(db: Pool<Postgres>) {
     .await
     .expect("Failed to query secrets");
 
-    println!("Found {} secrets in database before migration:", secrets_before.len());
+    println!(
+        "Found {} secrets in database before migration:",
+        secrets_before.len()
+    );
     for s in &secrets_before {
         println!("  - {}/{}: {} chars", s.workspace_id, s.path, s.value.len());
     }
@@ -111,7 +120,10 @@ async fn test_migrate_db_to_vault(db: Pool<Postgres>) {
             secret.path,
             result.err()
         );
-        println!("  ✓ {}/{} exists in Vault", secret.workspace_id, secret.path);
+        println!(
+            "  ✓ {}/{} exists in Vault",
+            secret.workspace_id, secret.path
+        );
     }
 
     println!("\n✓ Migration to Vault completed successfully");
@@ -133,8 +145,14 @@ async fn test_migrate_vault_to_db(db: Pool<Postgres>) {
     let to_vault_report = migrate_secrets_to_vault(&db, &settings)
         .await
         .expect("Initial migration to Vault failed");
-    assert!(to_vault_report.migrated_count > 0, "No secrets to test with");
-    println!("  Migrated {} secrets to Vault", to_vault_report.migrated_count);
+    assert!(
+        to_vault_report.migrated_count > 0,
+        "No secrets to test with"
+    );
+    println!(
+        "  Migrated {} secrets to Vault",
+        to_vault_report.migrated_count
+    );
 
     // Clear the database values to simulate fresh migration back
     println!("\nClearing database secret values...");
@@ -150,7 +168,10 @@ async fn test_migrate_vault_to_db(db: Pool<Postgres>) {
     .fetch_one(&db)
     .await
     .expect("Failed to count cleared");
-    println!("  Cleared {} secret values in database", cleared.count.unwrap_or(0));
+    println!(
+        "  Cleared {} secret values in database",
+        cleared.count.unwrap_or(0)
+    );
 
     // Now migrate from Vault back to database
     println!("\nMigrating secrets from Vault to database...");
@@ -206,15 +227,14 @@ async fn test_full_round_trip_migration(db: Pool<Postgres>) {
         .expect("Failed to connect to Vault");
 
     // Get original secrets
-    let original_secrets: std::collections::HashMap<(String, String), String> = sqlx::query!(
-        "SELECT workspace_id, path, value FROM variable WHERE is_secret = true"
-    )
-    .fetch_all(&db)
-    .await
-    .expect("Failed to query original secrets")
-    .into_iter()
-    .map(|r| ((r.workspace_id, r.path), r.value))
-    .collect();
+    let original_secrets: std::collections::HashMap<(String, String), String> =
+        sqlx::query!("SELECT workspace_id, path, value FROM variable WHERE is_secret = true")
+            .fetch_all(&db)
+            .await
+            .expect("Failed to query original secrets")
+            .into_iter()
+            .map(|r| ((r.workspace_id, r.path), r.value))
+            .collect();
 
     println!("Original secrets: {} entries", original_secrets.len());
 
@@ -243,21 +263,23 @@ async fn test_full_round_trip_migration(db: Pool<Postgres>) {
 
     // Step 4: Verify round-trip integrity
     println!("\n=== Step 4: Verify round-trip integrity ===");
-    let restored_secrets: std::collections::HashMap<(String, String), String> = sqlx::query!(
-        "SELECT workspace_id, path, value FROM variable WHERE is_secret = true"
-    )
-    .fetch_all(&db)
-    .await
-    .expect("Failed to query restored secrets")
-    .into_iter()
-    .map(|r| ((r.workspace_id, r.path), r.value))
-    .collect();
+    let restored_secrets: std::collections::HashMap<(String, String), String> =
+        sqlx::query!("SELECT workspace_id, path, value FROM variable WHERE is_secret = true")
+            .fetch_all(&db)
+            .await
+            .expect("Failed to query restored secrets")
+            .into_iter()
+            .map(|r| ((r.workspace_id, r.path), r.value))
+            .collect();
 
     // Compare original and restored
     for ((ws, path), _original_value) in &original_secrets {
         let restored_value = restored_secrets
             .get(&(ws.clone(), path.clone()))
-            .expect(&format!("Secret {}/{} not found after round-trip", ws, path));
+            .expect(&format!(
+                "Secret {}/{} not found after round-trip",
+                ws, path
+            ));
 
         // Note: Values might differ slightly due to encryption/decryption
         // but they should not be the cleared value
@@ -266,7 +288,12 @@ async fn test_full_round_trip_migration(db: Pool<Postgres>) {
             "Secret {}/{} was not restored",
             ws, path
         );
-        println!("  ✓ {}/{}: restored ({} chars)", ws, path, restored_value.len());
+        println!(
+            "  ✓ {}/{}: restored ({} chars)",
+            ws,
+            path,
+            restored_value.len()
+        );
     }
 
     println!("\n✓ Full round-trip migration completed successfully!");
@@ -289,7 +316,10 @@ async fn test_workspace_isolation(db: Pool<Postgres>) {
         .await
         .expect("Migration failed");
 
-    println!("Migrated {} secrets across workspaces", report.migrated_count);
+    println!(
+        "Migrated {} secrets across workspaces",
+        report.migrated_count
+    );
 
     // Verify workspace isolation in Vault
     let vault_backend = VaultBackend::new(settings.clone());
@@ -309,13 +339,19 @@ async fn test_workspace_isolation(db: Pool<Postgres>) {
     let ws1_result: Result<String> = vault_backend
         .get_secret("test-workspace", "u/test-user/db_password")
         .await;
-    assert!(ws1_result.is_ok(), "test-workspace secret should be accessible");
+    assert!(
+        ws1_result.is_ok(),
+        "test-workspace secret should be accessible"
+    );
     println!("✓ test-workspace secrets accessible");
 
     let ws2_result: Result<String> = vault_backend
         .get_secret("test-workspace-2", "u/test-user/other_secret")
         .await;
-    assert!(ws2_result.is_ok(), "test-workspace-2 secret should be accessible");
+    assert!(
+        ws2_result.is_ok(),
+        "test-workspace-2 secret should be accessible"
+    );
     println!("✓ test-workspace-2 secrets accessible");
 
     println!("\n✓ Workspace isolation verified!");
diff --git a/backend/windmill-native-triggers/src/google/external.rs b/backend/windmill-native-triggers/src/google/external.rs
index 29dd1c943f..616f8d3f63 100644
--- a/backend/windmill-native-triggers/src/google/external.rs
+++ b/backend/windmill-native-triggers/src/google/external.rs
@@ -323,9 +323,10 @@ impl Google {
     }
 
     /// Renew an expiring Google watch channel.
-    /// Rotates the webhook token (creating a new one with the same label),
-    /// stops the old channel and creates a new one with a fresh channel ID
-    /// (Google rejects reused channel IDs with `channelIdNotUnique`).
+    /// Rotates the webhook token (mints a fresh `ephemeral-webhook-google-{rd5}` label
+    /// and a 14-day expiration via `rotate_webhook_token`), stops the old channel and
+    /// creates a new one with a fresh channel ID (Google rejects reused channel IDs
+    /// with `channelIdNotUnique`).
     /// Returns (new_service_config, new_plaintext_token, old_token_hash).
     /// Callers should delete old_token_hash after successfully updating the trigger.
     pub async fn renew_channel(
@@ -341,7 +342,13 @@ impl Google {
             .transpose()?
             .ok_or_else(|| Error::InternalErr("Missing service config".to_string()))?;
 
-        let rotated = match rotate_webhook_token(db, &trigger.webhook_token_hash).await? {
+        let rotated = match rotate_webhook_token(
+            db,
+            &trigger.webhook_token_hash,
+            ServiceName::Google,
+        )
+        .await?
+        {
             Some(r) => r,
             None => {
                 return Err(Error::InternalErr(format!(
@@ -464,6 +471,115 @@ pub fn should_renew_channel(service_config: &serde_json::Value) -> bool {
     remaining_ms < renewal_window_ms
 }
 
+enum RenewOutcome {
+    Renewed,
+    /// Another replica holds the lock, or the row was already renewed.
+    Skipped,
+}
+
+/// Renew one Google watch channel under a row lock.
+/// `sync_all_triggers` runs on every replica with no leader election — without
+/// the lock, parallel renewals orphan the losers' new tokens and Google channels.
+async fn try_renew_channel_locked(
+    handler: &Google,
+    db: &DB,
+    workspace_id: &str,
+    trigger: &NativeTrigger,
+) -> Result<RenewOutcome> {
+    let mut tx = db.begin().await?;
+
+    let row = sqlx::query!(
+        r#"
+        SELECT service_config, webhook_token_hash
+        FROM native_trigger
+        WHERE workspace_id = $1
+          AND service_name = $2
+          AND external_id = $3
+        FOR UPDATE SKIP LOCKED
+        "#,
+        workspace_id,
+        ServiceName::Google as ServiceName,
+        trigger.external_id,
+    )
+    .fetch_optional(&mut *tx)
+    .await?;
+
+    let Some(row) = row else {
+        return Ok(RenewOutcome::Skipped);
+    };
+
+    let Some(service_config) = row.service_config else {
+        // Anomalous: a Google trigger row should always carry a service_config.
+        tracing::warn!(
+            "Google trigger '{}' has NULL service_config — skipping renewal",
+            trigger.external_id
+        );
+        return Ok(RenewOutcome::Skipped);
+    };
+
+    // Re-check after the lock — a contending replica may have just renewed.
+    if !should_renew_channel(&service_config) {
+        return Ok(RenewOutcome::Skipped);
+    }
+
+    // Use freshly-read fields — webhook_token_hash may have rotated since list time.
+    let fresh_trigger = NativeTrigger {
+        service_config: Some(service_config),
+        webhook_token_hash: row.webhook_token_hash,
+        ..trigger.clone()
+    };
+
+    let (new_config, new_token, old_token_hash) = handler
+        .renew_channel(workspace_id, &fresh_trigger, db)
+        .await?;
+
+    // Past this point a new Google channel exists. Any failure leaks it.
+    if let Err(e) = update_native_trigger_service_config(
+        &mut *tx,
+        workspace_id,
+        ServiceName::Google,
+        &trigger.external_id,
+        &new_config,
+        Some(&new_token),
+    )
+    .await
+    {
+        tracing::error!(
+            "DB update failed after creating new Google channel for '{}' — channel orphaned in Google: {}",
+            trigger.external_id,
+            e
+        );
+        return Err(e);
+    }
+
+    if let Err(e) = tx.commit().await {
+        tracing::error!(
+            "Commit failed after creating new Google channel for '{}' — channel orphaned in Google: {}",
+            trigger.external_id,
+            e
+        );
+        return Err(e.into());
+    }
+
+    // With the lock + rotation in place, the old token row must exist here.
+    // Ok(false) means a concurrent path deleted it (or the expiry sweep collected it).
+    match crate::delete_token_by_hash(db, &old_token_hash).await {
+        Ok(true) => {}
+        Ok(false) => tracing::warn!(
+            "Old webhook token already gone after renewal for '{}' (hash {})",
+            trigger.external_id,
+            old_token_hash
+        ),
+        Err(e) => tracing::warn!(
+            "Failed to delete old webhook token after channel renewal for '{}': {}",
+            trigger.external_id,
+            e
+        ),
+    }
+
+    Ok(RenewOutcome::Renewed)
+}
+
 async fn renew_expiring_channels(
     handler: &Google,
     db: &DB,
@@ -488,53 +604,25 @@ async fn renew_expiring_channels(
             workspace_id
         );
 
-        match handler.renew_channel(workspace_id, trigger, db).await {
-            Ok((new_config, new_token, old_token_hash)) => {
-                match update_native_trigger_service_config(
-                    db,
-                    workspace_id,
-                    ServiceName::Google,
-                    &trigger.external_id,
-                    &new_config,
-                    Some(&new_token),
-                )
-                .await
-                {
-                    Ok(()) => {
-                        // Trigger updated — clean up old token (best-effort)
-                        if let Err(e) = crate::delete_token_by_hash(db, &old_token_hash).await {
-                            tracing::warn!(
-                                "Failed to delete old webhook token after channel renewal for {}: {}",
-                                trigger.external_id, e
-                            );
-                        }
-                        tracing::info!(
-                            "Renewed Google channel {} for '{}'",
-                            trigger.external_id,
-                            trigger.script_path
-                        );
-                        synced.push(TriggerSyncInfo {
-                            external_id: trigger.external_id.clone(),
-                            script_path: trigger.script_path.clone(),
-                            action: SyncAction::ConfigUpdated,
-                        });
-                    }
-                    Err(e) => {
-                        tracing::error!(
-                            "Failed to update DB after renewing Google channel {}: {}",
-                            trigger.external_id,
-                            e
-                        );
-                        errors.push(SyncError {
-                            resource_path: format!("workspace:{}", workspace_id),
-                            error_message: format!(
-                                "Failed to update DB after channel renewal for {}: {}",
-                                trigger.external_id, e
-                            ),
-                            error_type: "channel_renewal_error".to_string(),
-                        });
-                    }
-                }
+        match try_renew_channel_locked(handler, db, workspace_id, trigger).await {
+            Ok(RenewOutcome::Renewed) => {
+                tracing::info!(
+                    "Renewed Google channel {} for '{}'",
+                    trigger.external_id,
+                    trigger.script_path
+                );
+                synced.push(TriggerSyncInfo {
+                    external_id: trigger.external_id.clone(),
+                    script_path: trigger.script_path.clone(),
+                    action: SyncAction::ConfigUpdated,
+                });
+            }
+            Ok(RenewOutcome::Skipped) => {
+                // Expected outcome under SKIP LOCKED: contending replica or already-renewed row.
+                tracing::debug!(
+                    "Skipped Google channel renewal for '{}': another replica is renewing or the row was already renewed",
+                    trigger.external_id
+                );
             }
             Err(e) => {
                 tracing::error!(
diff --git a/backend/windmill-native-triggers/src/handler.rs b/backend/windmill-native-triggers/src/handler.rs
index 91a8b9531e..1b6aa83b92 100644
--- a/backend/windmill-native-triggers/src/handler.rs
+++ b/backend/windmill-native-triggers/src/handler.rs
@@ -1,7 +1,8 @@
 use crate::{
     decrypt_oauth_data, delete_native_trigger, delete_token_by_hash, get_native_trigger,
     list_native_triggers, rotate_webhook_token, store_native_trigger, update_native_trigger_error,
-    External, NativeTrigger, NativeTriggerConfig, NativeTriggerData, ServiceName,
+    webhook_token_label, External, NativeTrigger, NativeTriggerConfig, NativeTriggerData,
+    ServiceName,
 };
 use axum::{
     extract::{Path, Query},
@@ -18,7 +19,6 @@ use windmill_audit::{audit_oss::audit_log, ActionKind};
 use windmill_common::{
     db::UserDB,
     error::{Error, JsonResult, Result},
-    utils::rd_string,
     DB,
 };
 
@@ -84,10 +84,13 @@ async fn new_webhook_token(
     let kind = if is_flow { "flows" } else { "scripts" };
 
     let scopes = vec![format!("jobs:run:{kind}:{script_path}")];
-    let label = format!("webhook-{}-{}", service_name.as_str(), rd_string(5));
+    let label = webhook_token_label(service_name);
+    let expiration = service_name
+        .webhook_token_expiration()
+        .map(|d| chrono::Utc::now() + d);
     let token_config = NewToken::new(
         Some(label),
-        None,
+        expiration,
         None,
         Some(scopes),
         Some(workspace_id.to_owned()),
@@ -255,8 +258,8 @@ async fn update_native_trigger_handler<T: External>(
         tx = user_db.begin(&authed).await?;
         token
     } else {
-        // Same runnable — rotate the token keeping the same label
-        match rotate_webhook_token(&db, &existing.webhook_token_hash).await? {
+        // Same runnable — rotate the token (mints a fresh label + expiration)
+        match rotate_webhook_token(&db, &existing.webhook_token_hash, service_name).await? {
             Some(rotated) => {
                 old_token_hash_to_delete = Some(rotated.old_token_hash);
                 rotated.new_token
diff --git a/backend/windmill-native-triggers/src/lib.rs b/backend/windmill-native-triggers/src/lib.rs
index c871159b0f..743b9f8210 100644
--- a/backend/windmill-native-triggers/src/lib.rs
+++ b/backend/windmill-native-triggers/src/lib.rs
@@ -180,6 +180,17 @@ impl ServiceName {
     pub fn integration_service(&self) -> ServiceName {
         *self
     }
+
+    /// How long webhook tokens for this service should remain valid. `None` = no expiry.
+    /// Google channels turn over on a tight schedule (24h Drive, 7d Calendar) — a finite
+    /// TTL lets `delete_expired_items` (`monitor.rs`) sweep orphaned tokens automatically.
+    /// Persistent-webhook services (Nextcloud, GitHub) return `None`.
+    pub fn webhook_token_expiration(&self) -> Option<chrono::Duration> {
+        match self {
+            ServiceName::Google => Some(chrono::Duration::days(14)),
+            ServiceName::Nextcloud | ServiceName::Github => None,
+        }
+    }
 }
 
 impl std::fmt::Display for ServiceName {
@@ -759,22 +770,23 @@ async fn update_oauth_token_resource(
     }
 }
 
-/// Create a new webhook token that keeps the same label as the old one.
-/// The old token is **not** deleted — callers must call `delete_token_by_hash`
-/// on `old_token_hash` after the trigger row has been successfully updated.
-/// This ensures the trigger keeps working if the external service call or
-/// subsequent DB update fails.
+/// Create a new webhook token, minting a fresh `ephemeral-webhook-{service}-{rd5}`
+/// label and the per-service expiration (see `ServiceName::webhook_token_expiration`).
+/// The old token is **not** deleted — callers must call `delete_token_by_hash` on
+/// `old_token_hash` after the trigger row has been successfully updated.
 ///
 /// Returns `Ok(None)` if the old token no longer exists (e.g. manually deleted by user).
-/// In that case, `renew_channel` returns an error which `renew_expiring_channels` writes
-/// to the trigger's `error` column — visible in the UI so the user can re-create the trigger.
-pub async fn rotate_webhook_token(db: &DB, old_token_hash: &str) -> Result<Option<RotatedToken>> {
+pub async fn rotate_webhook_token(
+    db: &DB,
+    old_token_hash: &str,
+    service_name: ServiceName,
+) -> Result<Option<RotatedToken>> {
     use windmill_common::auth::{hash_token, TOKEN_PREFIX_LEN};
     use windmill_common::min_version::MIN_VERSION_SUPPORTS_TOKEN_HASH;
     use windmill_common::utils::rd_string;
 
     let old = match sqlx::query!(
-        "SELECT label, email, scopes, workspace_id, super_admin, owner, expiration FROM token WHERE token_hash = $1",
+        "SELECT email, scopes, workspace_id, super_admin, owner FROM token WHERE token_hash = $1",
         old_token_hash
     )
     .fetch_optional(db)
@@ -799,6 +811,11 @@ pub async fn rotate_webhook_token(db: &DB, old_token_hash: &str) -> Result<Optio
         Some(&new_token)
     };
 
+    let new_label = webhook_token_label(service_name);
+    let new_expiration = service_name
+        .webhook_token_expiration()
+        .map(|d| Utc::now() + d);
+
     sqlx::query!(
         "INSERT INTO token (token_hash, token_prefix, token, email, label, super_admin, scopes, workspace_id, owner, expiration)
          VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)",
@@ -806,12 +823,12 @@ pub async fn rotate_webhook_token(db: &DB, old_token_hash: &str) -> Result<Optio
         new_prefix,
         plaintext as Option<&str>,
         old.email,
-        old.label,
+        new_label,
         old.super_admin,
         old.scopes.as_deref(),
         old.workspace_id,
         old.owner,
-        old.expiration,
+        new_expiration,
     )
     .execute(db)
     .await?;
@@ -822,6 +839,19 @@ pub async fn rotate_webhook_token(db: &DB, old_token_hash: &str) -> Result<Optio
     }))
 }
 
+/// Mint the standard label used for native-trigger webhook tokens.
+/// The `ephemeral-` prefix opts the token out of the user-token email/critical-alert
+/// notification paths (`is_user_token` in `monitor.rs`, `register_token_expiry_notification`
+/// in `windmill-api-auth/src/lib.rs`, `isUserToken` in the frontend).
+pub fn webhook_token_label(service_name: ServiceName) -> String {
+    use windmill_common::utils::rd_string;
+    format!(
+        "ephemeral-webhook-{}-{}",
+        service_name.as_str(),
+        rd_string(5)
+    )
+}
+
 pub struct RotatedToken {
     pub new_token: String,
     /// Hash of the old token — callers should delete this after the
@@ -829,7 +859,10 @@ pub struct RotatedToken {
     pub old_token_hash: String,
 }
 
-/// Delete a token from the token table using its hash (exact match).
+/// Delete a token by hash. Returns `Ok(false)` when no row matched.
+/// Some call sites legitimately race against expiry sweeps or concurrent deletes;
+/// callers that consider 0-rows anomalous should log themselves at the appropriate
+/// level rather than have this helper warn unconditionally.
 pub async fn delete_token_by_hash<'c, E: sqlx::Executor<'c, Database = Postgres>>(
     db: E,
     token_hash: &str,
diff --git a/backend/windmill-queue/src/jobs.rs b/backend/windmill-queue/src/jobs.rs
index 897f8e2ce0..52e6b09c6f 100644
--- a/backend/windmill-queue/src/jobs.rs
+++ b/backend/windmill-queue/src/jobs.rs
@@ -630,12 +630,45 @@ pub struct WrappedError {
 pub trait ValidableJson {
     fn is_valid_json(&self) -> bool;
     fn wm_labels(&self) -> Option<Vec<String>>;
+    fn wm_failure(&self) -> Option<String>;
+    fn result_metadata(&self) -> ResultMetadata;
     fn size(&self) -> usize;
 }
 
-#[derive(serde::Deserialize)]
-struct ResultLabels {
-    wm_labels: Vec<String>,
+/// The Windmill-specific markers we look for inside a job's result.
+/// `wm_failure` retags a successful run as a failure with the
+/// given message; `wm_labels` adds runtime labels to the job row.
+#[derive(serde::Deserialize, Default, Debug, Clone)]
+pub struct ResultMetadata {
+    pub wm_labels: Option<Vec<String>>,
+    pub wm_failure: Option<String>,
+}
+
+/// Sentinel `error.name` we inject into a result when retagging a successful
+/// run as a failure due to `wm_failure`. Used downstream to detect that
+/// the result is already in the standard `{ error: { name, message }, ... }`
+/// shape and must not be wrapped a second time by `WrappedError`.
+pub const MANUAL_FAILURE_ERROR_NAME: &str = "ManualFailure";
+
+/// Returns true when the result already carries our injected
+/// `error: { name: "ManualFailure", ... }` marker — i.e. it was shaped by
+/// `process_jc`'s wm_failure path. A real runtime failure whose raw
+/// result happens to contain a `wm_failure` field but no such error
+/// key returns false (and so still goes through the standard wrap path).
+pub fn is_pre_shaped_wm_failure_result(result: &str) -> bool {
+    #[derive(serde::Deserialize)]
+    struct Marker {
+        error: Option<NameOnly>,
+    }
+    #[derive(serde::Deserialize)]
+    struct NameOnly {
+        name: String,
+    }
+    serde_json::from_str::<Marker>(result)
+        .ok()
+        .and_then(|m| m.error)
+        .map(|e| e.name == MANUAL_FAILURE_ERROR_NAME)
+        .unwrap_or(false)
 }
 
 impl ValidableJson for WrappedError {
@@ -647,6 +680,14 @@ impl ValidableJson for WrappedError {
         None
     }
 
+    fn wm_failure(&self) -> Option<String> {
+        None
+    }
+
+    fn result_metadata(&self) -> ResultMetadata {
+        ResultMetadata::default()
+    }
+
     fn size(&self) -> usize {
         0
     }
@@ -658,9 +699,15 @@ impl ValidableJson for Box<RawValue> {
     }
 
     fn wm_labels(&self) -> Option<Vec<String>> {
-        serde_json::from_str::<ResultLabels>(self.get())
-            .ok()
-            .map(|r| r.wm_labels)
+        self.result_metadata().wm_labels
+    }
+
+    fn wm_failure(&self) -> Option<String> {
+        self.result_metadata().wm_failure
+    }
+
+    fn result_metadata(&self) -> ResultMetadata {
+        serde_json::from_str::<ResultMetadata>(self.get()).unwrap_or_default()
     }
 
     fn size(&self) -> usize {
@@ -677,6 +724,14 @@ impl<T: ValidableJson> ValidableJson for Arc<T> {
         T::wm_labels(&self)
     }
 
+    fn wm_failure(&self) -> Option<String> {
+        T::wm_failure(&self)
+    }
+
+    fn result_metadata(&self) -> ResultMetadata {
+        T::result_metadata(&self)
+    }
+
     fn size(&self) -> usize {
         T::size(&self)
     }
@@ -688,9 +743,15 @@ impl ValidableJson for serde_json::Value {
     }
 
     fn wm_labels(&self) -> Option<Vec<String>> {
-        serde_json::from_value::<ResultLabels>(self.clone())
-            .ok()
-            .map(|r| r.wm_labels)
+        self.result_metadata().wm_labels
+    }
+
+    fn wm_failure(&self) -> Option<String> {
+        self.result_metadata().wm_failure
+    }
+
+    fn result_metadata(&self) -> ResultMetadata {
+        serde_json::from_value::<ResultMetadata>(self.clone()).unwrap_or_default()
     }
 
     fn size(&self) -> usize {
@@ -707,6 +768,14 @@ impl<T: ValidableJson> ValidableJson for Json<T> {
         self.0.wm_labels()
     }
 
+    fn wm_failure(&self) -> Option<String> {
+        self.0.wm_failure()
+    }
+
+    fn result_metadata(&self) -> ResultMetadata {
+        self.0.result_metadata()
+    }
+
     fn size(&self) -> usize {
         self.0.size()
     }
@@ -742,16 +811,7 @@ where
     }
 }
 
-pub async fn add_completed_job_error(
-    db: &Pool<Postgres>,
-    completed_job: &MiniCompletedJob,
-    mem_peak: i32,
-    canceled_by: Option<CanceledBy>,
-    e: serde_json::Value,
-    _worker_name: &str,
-    flow_is_done: bool,
-    duration: Option<i64>,
-) -> Result<WrappedError, Error> {
+async fn record_failure_metrics(completed_job: &MiniCompletedJob, _worker_name: &str) {
     #[cfg(feature = "prometheus")]
     register_metric(
         &WORKER_EXECUTION_FAILED,
@@ -772,6 +832,64 @@ pub async fn add_completed_job_error(
     .await;
 
     otel_incr_worker_execution_failed(&completed_job.tag);
+}
+
+/// Tag a completed job as a failure while storing the result as-is, without
+/// the standard `WrappedError` `{ error: ... }` wrap. Use for jobs whose result
+/// is already shaped (e.g. when `wm_failure` injected a top-level
+/// `error` key, while preserving sibling fields like `windmill_status_code`).
+///
+/// This is a worker-internal helper called by trusted result-processing code
+/// after the worker has authenticated and pulled the job. Callers MUST verify
+/// upstream auth (i.e. the job was legitimately pulled by this worker) — this
+/// function performs no authorization check itself, mirroring the contract of
+/// `add_completed_job_error`.
+pub async fn add_completed_job_pre_shaped_failure<T: Serialize + Send + Sync + ValidableJson>(
+    db: &Pool<Postgres>,
+    completed_job: &MiniCompletedJob,
+    mem_peak: i32,
+    canceled_by: Option<CanceledBy>,
+    result: Json<&T>,
+    worker_name: &str,
+    flow_is_done: bool,
+    duration: Option<i64>,
+) -> Result<(), Error> {
+    record_failure_metrics(completed_job, worker_name).await;
+
+    tracing::error!(
+        "job {} in {} did not succeed (wm_failure)",
+        completed_job.id,
+        completed_job.workspace_id,
+    );
+    let _ = add_completed_job(
+        db,
+        completed_job,
+        false,
+        false,
+        result,
+        None,
+        mem_peak,
+        canceled_by,
+        flow_is_done,
+        duration,
+        false,
+    )
+    .warn_after_seconds(10)
+    .await?;
+    Ok(())
+}
+
+pub async fn add_completed_job_error(
+    db: &Pool<Postgres>,
+    completed_job: &MiniCompletedJob,
+    mem_peak: i32,
+    canceled_by: Option<CanceledBy>,
+    e: serde_json::Value,
+    worker_name: &str,
+    flow_is_done: bool,
+    duration: Option<i64>,
+) -> Result<WrappedError, Error> {
+    record_failure_metrics(completed_job, worker_name).await;
 
     let result = WrappedError { error: e };
     tracing::error!(
diff --git a/backend/windmill-runtime-nativets/Cargo.toml b/backend/windmill-runtime-nativets/Cargo.toml
index 417ec8de9d..edad615ae5 100644
--- a/backend/windmill-runtime-nativets/Cargo.toml
+++ b/backend/windmill-runtime-nativets/Cargo.toml
@@ -28,9 +28,9 @@ deno_ast.workspace = true
 deno_tls.workspace = true
 deno_permissions.workspace = true
 deno_io.workspace = true
+deno_fs.workspace = true
 deno_telemetry.workspace = true
 deno_error.workspace = true
-deno_runtime.workspace = true
 winapi.workspace = true
 
 itertools.workspace = true
@@ -60,6 +60,7 @@ deno_ast.workspace = true
 deno_tls.workspace = true
 deno_permissions.workspace = true
 deno_io.workspace = true
-deno_runtime.workspace = true
+deno_fs.workspace = true
 deno_telemetry.workspace = true
+deno_error.workspace = true
 winapi.workspace = true
diff --git a/backend/windmill-runtime-nativets/build.rs b/backend/windmill-runtime-nativets/build.rs
index 2f4ec8c38d..8262827815 100644
--- a/backend/windmill-runtime-nativets/build.rs
+++ b/backend/windmill-runtime-nativets/build.rs
@@ -1,3 +1,6 @@
+use deno_ast::{MediaType, ParseParams};
+use deno_core::{ModuleCodeString, ModuleName, SourceMapData};
+use deno_error::JsErrorBox;
 use deno_fetch::FetchPermissions;
 use deno_net::NetPermissions;
 use deno_web::{BlobStore, TimersPermission};
@@ -22,10 +25,30 @@ impl FetchPermissions for PermissionsContainer {
     #[inline(always)]
     fn check_read<'a>(
         &mut self,
-        _resolved: bool,
-        _p: &'a std::path::Path,
+        _path: Cow<'a, Path>,
         _api_name: &str,
-    ) -> Result<Cow<'a, std::path::Path>, deno_io::fs::FsError> {
+        _get_path: &'a dyn deno_fs::GetPath,
+    ) -> Result<deno_fs::CheckedPath<'a>, deno_io::fs::FsError> {
+        unreachable!("snapshotting")
+    }
+
+    #[inline(always)]
+    fn check_write<'a>(
+        &mut self,
+        _path: Cow<'a, Path>,
+        _api_name: &str,
+        _get_path: &'a dyn deno_fs::GetPath,
+    ) -> Result<deno_fs::CheckedPath<'a>, deno_io::fs::FsError> {
+        unreachable!("snapshotting")
+    }
+
+    #[inline(always)]
+    fn check_net_vsock(
+        &mut self,
+        _cid: u32,
+        _port: u32,
+        _api_name: &str,
+    ) -> Result<(), deno_permissions::PermissionCheckError> {
         unreachable!("snapshotting")
     }
 }
@@ -38,17 +61,17 @@ impl TimersPermission for PermissionsContainer {
 }
 
 impl NetPermissions for PermissionsContainer {
-    fn check_read<'a>(
+    fn check_read(
         &mut self,
-        _p: &'a str,
+        _p: &str,
         _api_name: &str,
     ) -> Result<PathBuf, deno_permissions::PermissionCheckError> {
         unreachable!("snapshotting")
     }
 
-    fn check_write<'a>(
+    fn check_write(
         &mut self,
-        _p: &'a str,
+        _p: &str,
         _api_name: &str,
     ) -> Result<PathBuf, deno_permissions::PermissionCheckError> {
         unreachable!("snapshotting")
@@ -64,10 +87,19 @@ impl NetPermissions for PermissionsContainer {
 
     fn check_write_path<'a>(
         &mut self,
-        _: &'a Path,
-        _: &str,
+        _p: Cow<'a, Path>,
+        _api_name: &str,
     ) -> Result<Cow<'a, Path>, deno_permissions::PermissionCheckError> {
-        todo!()
+        unreachable!("snapshotting")
+    }
+
+    fn check_vsock(
+        &mut self,
+        _cid: u32,
+        _port: u32,
+        _api_name: &str,
+    ) -> Result<(), deno_permissions::PermissionCheckError> {
+        unreachable!("snapshotting")
     }
 }
 
@@ -77,22 +109,87 @@ deno_core::extension!(
     esm = ["src/runtime.js"],
 );
 
+// `extension_transpiler` callback for `deno_core::snapshot::create_snapshot`.
+//
+// Specialized to our snapshot's inputs. Of the seven deno_* extensions
+// we register via `init()`, six ship pre-built `.js` files
+// in their `esm` lists (webidl/url/console/web/fetch/net) — only
+// `deno_telemetry`'s `extension!` macro lists `.ts` files
+// (`telemetry.ts`, `util.ts`), so the TypeScript branch is needed
+// solely for that crate. Our local `fetch` extension contributes
+// `src/runtime.js` (pure JS). No `node:` imports happen at snapshot
+// build time, no `.mjs`, no user-supplied modules. So:
+//   - `.js` → pass through.
+//   - `.ts` → transpile via deno_ast (deno_telemetry only).
+//   - anything else → build bug (deno shipping an unexpected file type
+//     or us mislabelling one), panic loudly rather than emit a broken
+//     snapshot.
+//
+// No source maps: the snapshot is a binary blob the runtime loads — source
+// maps would never be consumed.
+//
+// The signature still returns `Result<_, JsErrorBox>` because that's what
+// `extension_transpiler` expects, but we never construct one — parse and
+// transpile failures are build-time bugs in deno's own .ts internals (or
+// in our runtime.js, if we ever change its extension), so they panic.
+//
+// This replaces a call to `deno_runtime::transpile::maybe_transpile_source`
+// from `deno_runtime 0.198.0`. The original is more general (handles
+// `node:` modules, `.mjs`, emits source maps in debug builds, plumbs
+// errors via `JsErrorBox`); none of that surface is reachable in our
+// build. Dropping the `deno_runtime` dep eliminates a
+// `deno_cache → rusqlite → libsqlite3-sys 0.35` transitive chain that
+// collides with sqlx-sqlite's `libsqlite3-sys 0.30` (cargo's
+// `links = "sqlite3"` rule).
+fn maybe_transpile_source(
+    name: ModuleName,
+    source: ModuleCodeString,
+) -> Result<(ModuleCodeString, Option<SourceMapData>), JsErrorBox> {
+    let media_type = MediaType::from_path(Path::new(&name));
+    match media_type {
+        MediaType::JavaScript => return Ok((source, None)),
+        MediaType::TypeScript => {}
+        _ => panic!("unexpected media type {media_type:?} for {name} during snapshot build"),
+    }
+
+    let parsed = deno_ast::parse_module(ParseParams {
+        specifier: deno_core::url::Url::parse(&name).unwrap(),
+        text: source.into(),
+        media_type,
+        capture_tokens: false,
+        scope_analysis: false,
+        maybe_syntax: None,
+    })
+    .unwrap_or_else(|e| panic!("snapshot transpile: parse failed for {name}: {e}"));
+
+    let transpiled = parsed
+        .transpile(
+            &deno_ast::TranspileOptions {
+                imports_not_used_as_values: deno_ast::ImportsNotUsedAsValues::Remove,
+                ..Default::default()
+            },
+            &deno_ast::TranspileModuleOptions::default(),
+            &deno_ast::EmitOptions::default(),
+        )
+        .unwrap_or_else(|e| panic!("snapshot transpile: emit failed for {name}: {e}"))
+        .into_source();
+
+    Ok((transpiled.text.into(), None))
+}
+
 fn main() {
     println!("cargo:rustc-env=TARGET={}", env::var("TARGET").unwrap());
     println!("cargo:rustc-env=PROFILE={}", env::var("PROFILE").unwrap());
 
     let exts = vec![
-        deno_telemetry::deno_telemetry::init_ops_and_esm(),
-        deno_webidl::deno_webidl::init_ops_and_esm(),
-        deno_url::deno_url::init_ops_and_esm(),
-        deno_console::deno_console::init_ops_and_esm(),
-        deno_web::deno_web::init_ops_and_esm::<PermissionsContainer>(
-            Arc::new(BlobStore::default()),
-            None,
-        ),
-        deno_fetch::deno_fetch::init_ops_and_esm::<PermissionsContainer>(Default::default()),
-        deno_net::deno_net::init_ops_and_esm::<PermissionsContainer>(None, None),
-        fetch::init_ops_and_esm(),
+        deno_telemetry::deno_telemetry::init(),
+        deno_webidl::deno_webidl::init(),
+        deno_url::deno_url::init(),
+        deno_console::deno_console::init(),
+        deno_web::deno_web::init::<PermissionsContainer>(Arc::new(BlobStore::default()), None),
+        deno_fetch::deno_fetch::init::<PermissionsContainer>(Default::default()),
+        deno_net::deno_net::init::<PermissionsContainer>(None, None),
+        fetch::init(),
     ];
 
     // Build the file path to the snapshot.
@@ -105,7 +202,7 @@ fn main() {
             cargo_manifest_dir: env!("CARGO_MANIFEST_DIR"),
             startup_snapshot: None,
             extension_transpiler: Some(std::rc::Rc::new(|specifier, source| {
-                deno_runtime::transpile::maybe_transpile_source(specifier, source)
+                maybe_transpile_source(specifier, source)
             })),
             extensions: exts,
             with_runtime_cb: None,
diff --git a/backend/windmill-runtime-nativets/src/lib.rs b/backend/windmill-runtime-nativets/src/lib.rs
index dda57ae708..52e23f11da 100644
--- a/backend/windmill-runtime-nativets/src/lib.rs
+++ b/backend/windmill-runtime-nativets/src/lib.rs
@@ -15,6 +15,9 @@
 mod dedicated;
 pub use dedicated::{ExecutingIsolate, PrewarmedIsolate, PrewarmedResult};
 
+#[cfg(test)]
+mod smoke_tests;
+
 use std::{
     borrow::Cow,
     cell::RefCell,
@@ -47,6 +50,28 @@ use windmill_common::error::Error;
 use windmill_common::result_stream::append_result_stream_db;
 use windmill_common::worker::{write_file, Connection, WINDMILL_DIR};
 
+// ── Snapshot-matched extensions ──────────────────────────────────────
+//
+// `deno_core` 0.352 validates that the snapshot's extension list is a
+// *prefix* of the runtime's extension list (snapshot does not need an
+// exact match — runtime is allowed to add extensions at the tail, but
+// must not reorder or omit any that the snapshot baked in).
+//
+// Our snapshot (in build.rs) is the same eight deno_* extensions ending
+// with this local `fetch` ext. The runtime adds one extra entry at the
+// end — the windmill `ext` carrying our own ops — which is fine because
+// it's after the snapshot prefix.
+//
+// This local `fetch` extension declaration must be present in both
+// build.rs and lib.rs so the type passes through the `init()` macro.
+// The ESM is already in the snapshot, so this `init()` call at runtime
+// is a no-op for esm — the registration just records the ext.
+deno_core::extension!(
+    fetch,
+    esm_entry_point = "ext:fetch/src/runtime.js",
+    esm = ["src/runtime.js"],
+);
+
 // ── Permission container ─────────────────────────────────────────────
 
 pub struct PermissionsContainer;
@@ -64,11 +89,31 @@ impl FetchPermissions for PermissionsContainer {
     #[inline(always)]
     fn check_read<'a>(
         &mut self,
-        _resolved: bool,
-        p: &'a std::path::Path,
+        path: Cow<'a, std::path::Path>,
         _api_name: &str,
-    ) -> Result<Cow<'a, std::path::Path>, deno_io::fs::FsError> {
-        Ok(Cow::Borrowed(p))
+        _get_path: &'a dyn deno_fs::GetPath,
+    ) -> Result<deno_fs::CheckedPath<'a>, deno_io::fs::FsError> {
+        Ok(deno_fs::CheckedPath::Unresolved(path))
+    }
+
+    #[inline(always)]
+    fn check_write<'a>(
+        &mut self,
+        path: Cow<'a, std::path::Path>,
+        _api_name: &str,
+        _get_path: &'a dyn deno_fs::GetPath,
+    ) -> Result<deno_fs::CheckedPath<'a>, deno_io::fs::FsError> {
+        Ok(deno_fs::CheckedPath::Unresolved(path))
+    }
+
+    #[inline(always)]
+    fn check_net_vsock(
+        &mut self,
+        _cid: u32,
+        _port: u32,
+        _api_name: &str,
+    ) -> Result<(), deno_permissions::PermissionCheckError> {
+        Ok(())
     }
 }
 
@@ -80,17 +125,17 @@ impl TimersPermission for PermissionsContainer {
 }
 
 impl NetPermissions for PermissionsContainer {
-    fn check_read<'a>(
+    fn check_read(
         &mut self,
-        p: &'a str,
+        p: &str,
         _api_name: &str,
     ) -> Result<PathBuf, deno_permissions::PermissionCheckError> {
         Ok(PathBuf::from(p))
     }
 
-    fn check_write<'a>(
+    fn check_write(
         &mut self,
-        p: &'a str,
+        p: &str,
         _api_name: &str,
     ) -> Result<PathBuf, deno_permissions::PermissionCheckError> {
         Ok(PathBuf::from(p))
@@ -106,10 +151,19 @@ impl NetPermissions for PermissionsContainer {
 
     fn check_write_path<'a>(
         &mut self,
-        p: &'a std::path::Path,
+        p: Cow<'a, std::path::Path>,
         _api_name: &str,
-    ) -> Result<std::borrow::Cow<'a, std::path::Path>, deno_permissions::PermissionCheckError> {
-        Ok(Cow::Borrowed(p))
+    ) -> Result<Cow<'a, std::path::Path>, deno_permissions::PermissionCheckError> {
+        Ok(p)
+    }
+
+    fn check_vsock(
+        &mut self,
+        _cid: u32,
+        _port: u32,
+        _api_name: &str,
+    ) -> Result<(), deno_permissions::PermissionCheckError> {
+        Ok(())
     }
 }
 
@@ -381,7 +435,7 @@ pub(crate) fn create_nativets_runtime(
     let fetch_options = deno_fetch::Options {
         root_cert_store_provider: None,
         user_agent: ann.useragent.unwrap_or_else(|| "windmill/beta".to_string()),
-        proxy: ann.proxy.map(|x| deno_tls::Proxy {
+        proxy: ann.proxy.map(|x| deno_tls::Proxy::Http {
             url: x.0,
             basic_auth: x
                 .1
@@ -391,13 +445,14 @@ pub(crate) fn create_nativets_runtime(
     };
 
     let exts: Vec<Extension> = vec![
-        deno_telemetry::deno_telemetry::init_ops(),
-        deno_webidl::deno_webidl::init_ops(),
-        deno_url::deno_url::init_ops(),
-        deno_console::deno_console::init_ops(),
-        deno_web::deno_web::init_ops::<PermissionsContainer>(Arc::new(BlobStore::default()), None),
-        deno_fetch::deno_fetch::init_ops::<PermissionsContainer>(fetch_options),
-        deno_net::deno_net::init_ops::<PermissionsContainer>(None, None),
+        deno_telemetry::deno_telemetry::init(),
+        deno_webidl::deno_webidl::init(),
+        deno_url::deno_url::init(),
+        deno_console::deno_console::init(),
+        deno_web::deno_web::init::<PermissionsContainer>(Arc::new(BlobStore::default()), None),
+        deno_fetch::deno_fetch::init::<PermissionsContainer>(fetch_options),
+        deno_net::deno_net::init::<PermissionsContainer>(None, None),
+        fetch::init(),
         ext,
     ];
 
diff --git a/backend/windmill-runtime-nativets/src/smoke_tests.rs b/backend/windmill-runtime-nativets/src/smoke_tests.rs
new file mode 100644
index 0000000000..20675ee2a7
--- /dev/null
+++ b/backend/windmill-runtime-nativets/src/smoke_tests.rs
@@ -0,0 +1,280 @@
+//! Opt-in smoke tests for the nativets V8 runtime.
+//!
+//! Exercise the deno_core / deno_ast / swc surface (TypeScript transpile,
+//! fetch, timers, URL, structuredClone, error propagation, concurrent
+//! isolates, large payload roundtrip) that the standard worker-level
+//! nativets tests in `backend/tests/worker.rs` don't reach — those tests
+//! validate value passing through the job queue, but not the JS API
+//! surface a deno_core bump would actually move.
+//!
+//! These tests are `#[ignore]`'d so the regular `cargo test` flow doesn't
+//! pay their cost (each spawns a V8 isolate; some hit the network). Run
+//! when changing the `deno_core` / `deno_ast` / `deno_runtime` / `swc_*`
+//! pins in `backend/Cargo.toml`:
+//!
+//!     cargo test -p windmill-runtime-nativets smoke -- --ignored
+//!
+//! Tests prefixed `smoke_net_` hit the public internet (httpbin.org,
+//! example.com) and will fail if the runner has no egress. Skip them
+//! locally with `cargo test -p windmill-runtime-nativets smoke -- --ignored --skip smoke_net_`.
+
+use crate::{transpile_ts, NativeAnnotation, PrewarmedIsolate, PrewarmedResult};
+
+/// Compile a TS snippet, run it through a fresh isolate with the given
+/// positional args, and return the isolate's result + captured logs.
+async fn run_ts(ts: &str, arg_names: &[&str], args: serde_json::Value) -> PrewarmedResult {
+    let js = transpile_ts(ts.to_string()).expect("transpile_ts failed");
+    let ann = NativeAnnotation { useragent: None, proxy: None };
+    let arg_names: Vec<String> = arg_names.iter().map(|s| s.to_string()).collect();
+    let mut iso = PrewarmedIsolate::spawn(String::new(), js, ann, arg_names, None);
+    iso.wait_ready().await.expect("isolate failed to pre-warm");
+    iso.start_execution(args.to_string())
+        .wait()
+        .await
+        .expect("isolate execution panicked")
+}
+
+fn unwrap_value(r: &PrewarmedResult) -> serde_json::Value {
+    let raw = r.result.as_ref().expect("script returned an error");
+    serde_json::from_str(raw.get()).expect("result not valid JSON")
+}
+
+// -----------------------------------------------------------------------------
+// Local (no network) — these still need V8 / deno_core ops to be wired.
+// -----------------------------------------------------------------------------
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "deno_core upgrade smoke; run with --ignored"]
+async fn smoke_basic_value_passing() {
+    let ts = r#"
+export async function main(x: number): Promise<number> {
+    return x + 1;
+}
+"#;
+    let r = run_ts(ts, &["x"], serde_json::json!({"x": 41})).await;
+    assert_eq!(unwrap_value(&r), serde_json::json!(42));
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "deno_core upgrade smoke; run with --ignored"]
+async fn smoke_transpile_enum_and_union() {
+    // Enums + discriminated union + as-cast exercise the swc_ecma_ast +
+    // swc_ecma_parser TS-syntax paths the bare value tests don't.
+    let ts = r#"
+enum Direction { Up = "U", Down = "D" }
+type Msg = { kind: "move"; dir: Direction } | { kind: "stop" };
+export async function main(): Promise<string> {
+    const msgs: Msg[] = [
+        { kind: "move", dir: Direction.Up },
+        { kind: "stop" },
+        { kind: "move", dir: Direction.Down },
+    ];
+    return msgs.map(m => m.kind === "move" ? m.dir : "_").join(",");
+}
+"#;
+    let r = run_ts(ts, &[], serde_json::json!({})).await;
+    assert_eq!(unwrap_value(&r), serde_json::json!("U,_,D"));
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "deno_core upgrade smoke; run with --ignored"]
+async fn smoke_set_timeout_and_promise_all() {
+    // setTimeout lives in deno_web; Promise.all hits the V8 microtask
+    // queue. A bump that breaks timer-op registration or microtask drain
+    // would surface here (script would hang or return wrong order).
+    let ts = r#"
+export async function main(): Promise<number[]> {
+    const delays = [40, 10, 20, 30];
+    return await Promise.all(delays.map(d =>
+        new Promise<number>(resolve => setTimeout(() => resolve(d), d))
+    ));
+}
+"#;
+    let r = run_ts(ts, &[], serde_json::json!({})).await;
+    // Promise.all preserves input order regardless of resolution order.
+    assert_eq!(unwrap_value(&r), serde_json::json!([40, 10, 20, 30]));
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "deno_core upgrade smoke; run with --ignored"]
+async fn smoke_url_and_searchparams() {
+    // deno_url surface: URL ctor, URLSearchParams parsing + iteration.
+    let ts = r#"
+export async function main(): Promise<{ host: string; pairs: [string, string][] }> {
+    const u = new URL("https://example.com:8443/path?b=2&a=1&a=3");
+    const pairs: [string, string][] = [];
+    for (const [k, v] of u.searchParams) pairs.push([k, v]);
+    return { host: u.host, pairs };
+}
+"#;
+    let r = run_ts(ts, &[], serde_json::json!({})).await;
+    assert_eq!(
+        unwrap_value(&r),
+        serde_json::json!({
+            "host": "example.com:8443",
+            "pairs": [["b", "2"], ["a", "1"], ["a", "3"]],
+        }),
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "deno_core upgrade smoke; run with --ignored"]
+async fn smoke_web_blob_btoa_atob() {
+    // deno_web surface: Blob, atob/btoa. `structuredClone` is *not* wired
+    // into the nativets global (the deno_web binding doesn't expose it
+    // here) — if that's ever changed, extend this test to cover it.
+    let ts = r#"
+export async function main(): Promise<{ b64: string; round_trip: string; size: number }> {
+    const blob = new Blob(["hello"], { type: "text/plain" });
+    const b64 = btoa("hello");
+    const round_trip = atob(b64);
+    return { b64, round_trip, size: blob.size };
+}
+"#;
+    let r = run_ts(ts, &[], serde_json::json!({})).await;
+    assert_eq!(
+        unwrap_value(&r),
+        serde_json::json!({
+            "b64": "aGVsbG8=",
+            "round_trip": "hello",
+            "size": 5,
+        }),
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "deno_core upgrade smoke; run with --ignored"]
+async fn smoke_large_payload_roundtrip() {
+    // ~512 KB string in and out — exercises arg encoding + result
+    // serialization through the deno_core <-> host op boundary at sizes
+    // an op-table change could break.
+    let big_in: String = "a".repeat(512 * 1024);
+    let ts = r#"
+export async function main(s: string): Promise<{ in_len: number; out: string }> {
+    if (typeof s !== "string") throw new Error(`expected string, got ${typeof s}`);
+    return { in_len: s.length, out: "b".repeat(512 * 1024) };
+}
+"#;
+    let r = run_ts(ts, &["s"], serde_json::json!({"s": big_in})).await;
+    let v = unwrap_value(&r);
+    assert_eq!(v.get("in_len").and_then(|x| x.as_u64()), Some(512 * 1024));
+    let out_len = v
+        .get("out")
+        .and_then(|x| x.as_str())
+        .map(|s| s.len())
+        .unwrap_or(0);
+    assert_eq!(out_len, 512 * 1024);
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "deno_core upgrade smoke; run with --ignored"]
+async fn smoke_error_propagation_with_message() {
+    // Throwing a typed Error must surface as PrewarmedResult::Err with
+    // the original message. A deno_core bump that changes the host-side
+    // error wrapping would lose this contract.
+    let ts = r#"
+export async function main(): Promise<void> {
+    throw new Error("nativets_smoke_marker_xyz");
+}
+"#;
+    let r = run_ts(ts, &[], serde_json::json!({})).await;
+    let err = r.result.expect_err("expected script to fail");
+    assert!(
+        err.contains("nativets_smoke_marker_xyz"),
+        "thrown error message did not reach result: {err}",
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "deno_core upgrade smoke; run with --ignored"]
+async fn smoke_concurrent_isolates() {
+    // Spawn N isolates in parallel from the same tokio runtime. Each
+    // PrewarmedIsolate uses spawn_blocking + a fresh V8 isolate.
+    // Catches isolate-setup races (V8_ISOLATE_CREATE_LOCK ordering) and
+    // any per-isolate state that a deno_core bump could break under
+    // concurrency.
+    let ts = r#"
+export async function main(i: number): Promise<number> {
+    return i * 10;
+}
+"#;
+    let js = transpile_ts(ts.to_string()).expect("transpile_ts failed");
+
+    const N: i64 = 8;
+    let mut handles = Vec::with_capacity(N as usize);
+    for i in 0..N {
+        let js = js.clone();
+        let h = tokio::spawn(async move {
+            let ann = NativeAnnotation { useragent: None, proxy: None };
+            let mut iso =
+                PrewarmedIsolate::spawn(String::new(), js, ann, vec!["i".to_string()], None);
+            iso.wait_ready().await.expect("pre-warm failed");
+            let res = iso
+                .start_execution(serde_json::json!({"i": i}).to_string())
+                .wait()
+                .await
+                .expect("isolate panicked");
+            res.result.expect("script errored")
+        });
+        handles.push(h);
+    }
+
+    let mut got: Vec<i64> = Vec::with_capacity(N as usize);
+    for h in handles {
+        let raw = h.await.expect("join failed");
+        let v: serde_json::Value = serde_json::from_str(raw.get()).expect("not JSON");
+        got.push(v.as_i64().unwrap_or(-1));
+    }
+    got.sort();
+    let expected: Vec<i64> = (0..N).map(|i| i * 10).collect();
+    assert_eq!(got, expected);
+}
+
+// -----------------------------------------------------------------------------
+// Network — actually exercise deno_fetch end-to-end. Skip in air-gapped CI
+// with `--skip smoke_net_`.
+// -----------------------------------------------------------------------------
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "deno_core upgrade smoke (network); run with --ignored"]
+async fn smoke_net_fetch_example_com() {
+    // example.com is one of the most stable hosts on the internet and
+    // returns a tiny known-text body, so we can both assert "fetch works"
+    // and "the response body parses correctly through deno_fetch".
+    let ts = r#"
+export async function main(): Promise<{ status: number; has_marker: boolean }> {
+    const r = await fetch("https://example.com/");
+    const body = await r.text();
+    return { status: r.status, has_marker: body.includes("Example Domain") };
+}
+"#;
+    let r = run_ts(ts, &[], serde_json::json!({})).await;
+    let v = unwrap_value(&r);
+    assert_eq!(v.get("status").and_then(|x| x.as_u64()), Some(200));
+    assert_eq!(v.get("has_marker"), Some(&serde_json::json!(true)));
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "deno_core upgrade smoke (network); run with --ignored"]
+async fn smoke_net_fetch_json_and_headers() {
+    // httpbin.org/anything echoes request metadata back as JSON, so we
+    // can verify: deno_fetch sends custom headers, parses JSON response,
+    // and propagates query params end-to-end.
+    let ts = r#"
+export async function main(): Promise<{ ua: string; arg: string }> {
+    const r = await fetch("https://httpbin.org/anything?nativets=ok", {
+        headers: { "x-windmill-smoke": "1" },
+    });
+    if (!r.ok) throw new Error(`status ${r.status}`);
+    const j: any = await r.json();
+    return {
+        ua: j.headers["X-Windmill-Smoke"] ?? "",
+        arg: j.args.nativets ?? "",
+    };
+}
+"#;
+    let r = run_ts(ts, &[], serde_json::json!({})).await;
+    let v = unwrap_value(&r);
+    assert_eq!(v.get("ua").and_then(|x| x.as_str()), Some("1"));
+    assert_eq!(v.get("arg").and_then(|x| x.as_str()), Some("ok"));
+}
diff --git a/backend/windmill-store/src/resources.rs b/backend/windmill-store/src/resources.rs
index 6b169a0c0d..8aa88bad86 100644
--- a/backend/windmill-store/src/resources.rs
+++ b/backend/windmill-store/src/resources.rs
@@ -1238,10 +1238,39 @@ async fn delete_resources_bulk(
         .await?;
 
         if let Some(res_data) = trash_resource {
+            // Per-resource linked vars so each resource's trash entry carries
+            // exactly the variables that vanished with it (matching the
+            // single-delete shape: trash_data["linked_variables"]).
+            let mut this_linked: Vec<String> = Vec::new();
             if let Some(value) = res_data.get("value") {
-                collect_var_refs(value, &mut linked_var_paths);
+                collect_var_refs(value, &mut this_linked);
+            }
+            this_linked.sort();
+            this_linked.dedup();
+
+            let trash_linked_vars: Vec<serde_json::Value> = if this_linked.is_empty() {
+                Vec::new()
+            } else {
+                let placeholders: Vec<String> = this_linked
+                    .iter()
+                    .enumerate()
+                    .map(|(i, _)| format!("${}", i + 2))
+                    .collect();
+                let query = format!(
+                    "SELECT to_jsonb(t) FROM variable t WHERE workspace_id = $1 AND path IN ({})",
+                    placeholders.join(", ")
+                );
+                let mut q = sqlx::query_scalar::<_, serde_json::Value>(&query).bind(&w_id);
+                for var_path in &this_linked {
+                    q = q.bind(var_path);
+                }
+                q.fetch_all(&mut *tx).await?
+            };
+
+            let mut trash_data = serde_json::json!({"row": res_data});
+            if !trash_linked_vars.is_empty() {
+                trash_data["linked_variables"] = serde_json::Value::Array(trash_linked_vars);
             }
-            let trash_data = serde_json::json!({"row": res_data});
             windmill_common::trashbin::move_to_trash(
                 &mut *tx,
                 &w_id,
@@ -1251,6 +1280,8 @@ async fn delete_resources_bulk(
                 &authed.username,
             )
             .await?;
+
+            linked_var_paths.extend(this_linked);
         }
     }
     linked_var_paths.sort();
diff --git a/backend/windmill-store/src/variables.rs b/backend/windmill-store/src/variables.rs
index a9f8734647..c50049fcd6 100644
--- a/backend/windmill-store/src/variables.rs
+++ b/backend/windmill-store/src/variables.rs
@@ -755,6 +755,17 @@ async fn delete_variables_bulk(
     )
     .fetch_all(&mut *tx)
     .await?;
+    // Mirror single delete_variable: clean the linked-resource ws_specific
+    // markers BEFORE deleting the resource rows so they don't survive as
+    // orphans. A resource later created at the same path would otherwise
+    // inherit a stale ws_specific flag.
+    sqlx::query!(
+        "DELETE FROM ws_specific WHERE workspace_id = $1 AND item_kind = 'resource' AND path = ANY($2)",
+        w_id,
+        &deleted_paths
+    )
+    .execute(&mut *tx)
+    .await?;
     sqlx::query!(
         "DELETE FROM resource WHERE path = ANY($1) AND workspace_id = $2",
         &deleted_paths,
@@ -1019,6 +1030,20 @@ async fn update_variable(
             )
             .execute(&mut *tx)
             .await?;
+
+            // The linked resource at the same path is renamed above; move
+            // its ws_specific 'resource' marker too so an explicitly-flagged
+            // resource doesn't lose its ws_specific status on rename and
+            // doesn't leave a stale marker at the old path. Symmetric with
+            // update_resource's rename block.
+            sqlx::query!(
+                "UPDATE ws_specific SET path = $1 WHERE workspace_id = $2 AND item_kind = 'resource' AND path = $3",
+                npath,
+                w_id,
+                path
+            )
+            .execute(&mut *tx)
+            .await?;
         }
     }
 
diff --git a/backend/windmill-worker/Cargo.toml b/backend/windmill-worker/Cargo.toml
index ad3d87d8df..5ebcb0b370 100644
--- a/backend/windmill-worker/Cargo.toml
+++ b/backend/windmill-worker/Cargo.toml
@@ -39,7 +39,7 @@ ruby = ["dep:windmill-parser-ruby"]
 rlang = ["dep:windmill-parser-r"]
 duckdb = ["dep:libloading"]
 quickjs = ["windmill-jseval/quickjs"]
-bedrock = ["windmill-ai/bedrock", "dep:aws-sdk-bedrockruntime", "dep:aws-config", "dep:aws-credential-types", "dep:aws-smithy-types"]
+bedrock = ["windmill-ai/bedrock"]
 
 [dependencies]
 windmill-ai = { workspace = true, default-features = false }
@@ -71,10 +71,6 @@ windmill-parser-sql.workspace = true
 windmill-parser-graphql.workspace = true
 windmill-parser-php = { workspace = true, optional = true }
 windmill-git-sync.workspace = true
-aws-sdk-bedrockruntime = { workspace = true, optional = true }
-aws-config = { workspace = true, optional = true }
-aws-credential-types = { workspace = true, optional = true }
-aws-smithy-types = { workspace = true, optional = true }
 flume.workspace = true
 sqlx.workspace = true
 uuid.workspace = true
@@ -93,6 +89,7 @@ itertools.workspace = true
 regex.workspace = true
 prometheus = { workspace = true, optional = true }
 lazy_static.workspace = true
+quick_cache.workspace = true
 chrono.workspace = true
 dotenv.workspace = true
 rand.workspace = true # TODO: Remove. only used by token creation hack.
diff --git a/backend/windmill-worker/src/ai/mod.rs b/backend/windmill-worker/src/ai/mod.rs
index 4ad67b9e6e..24e877ab13 100644
--- a/backend/windmill-worker/src/ai/mod.rs
+++ b/backend/windmill-worker/src/ai/mod.rs
@@ -1,10 +1,6 @@
 // AI executor module structure
 // This module will contain all AI-related execution logic
 
-pub mod image_handler;
-pub mod providers;
 pub mod query_builder;
-pub mod sse;
 pub mod tools;
-pub mod types;
 pub mod utils;
diff --git a/backend/windmill-worker/src/ai/providers/mod.rs b/backend/windmill-worker/src/ai/providers/mod.rs
deleted file mode 100644
index f558c28289..0000000000
--- a/backend/windmill-worker/src/ai/providers/mod.rs
+++ /dev/null
@@ -1,7 +0,0 @@
-pub mod anthropic;
-#[cfg(feature = "bedrock")]
-pub mod bedrock;
-pub mod google_ai;
-pub mod openai;
-pub mod openrouter;
-pub mod other;
diff --git a/backend/windmill-worker/src/ai/query_builder.rs b/backend/windmill-worker/src/ai/query_builder.rs
index d74c45c098..fe8a3b9b00 100644
--- a/backend/windmill-worker/src/ai/query_builder.rs
+++ b/backend/windmill-worker/src/ai/query_builder.rs
@@ -1,42 +1,9 @@
 use async_trait::async_trait;
+use windmill_ai::{query_builder::StreamEventSink, types::*};
 use windmill_common::{error::Error, worker::Connection};
 use windmill_queue::MiniPulledJob;
 
-use crate::{
-    ai::{
-        providers::{
-            anthropic::AnthropicQueryBuilder, google_ai::GoogleAIQueryBuilder,
-            openai::OpenAIQueryBuilder, openrouter::OpenRouterQueryBuilder,
-            other::OtherQueryBuilder,
-        },
-        types::*,
-    },
-    job_logger::append_result_stream,
-};
-
-// Re-export from windmill_ai
-pub use windmill_ai::query_builder::{
-    BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink,
-};
-
-/// Factory function to create the appropriate query builder for a provider
-pub fn create_query_builder(provider: &ProviderWithResource) -> Box<dyn QueryBuilder> {
-    use windmill_ai::ai_providers::AIProvider;
-
-    match provider.kind {
-        AIProvider::GoogleAI => {
-            Box::new(GoogleAIQueryBuilder::new(provider.get_platform().clone()))
-        }
-        AIProvider::OpenAI => Box::new(OpenAIQueryBuilder::new(provider.kind.clone())),
-        AIProvider::Anthropic => Box::new(AnthropicQueryBuilder::new(
-            provider.kind.clone(),
-            provider.get_platform().clone(),
-            provider.get_enable_1m_context(),
-        )),
-        AIProvider::OpenRouter => Box::new(OpenRouterQueryBuilder::new()),
-        _ => Box::new(OtherQueryBuilder::new(provider.kind.clone())),
-    }
-}
+use crate::job_logger::append_result_stream;
 
 /// Processes streaming events by persisting them to the database.
 /// Implements StreamEventSink so it can be passed to QueryBuilder methods.
diff --git a/backend/windmill-worker/src/ai/tools.rs b/backend/windmill-worker/src/ai/tools.rs
index c92fc2a94e..fcc9cdf3c9 100644
--- a/backend/windmill-worker/src/ai/tools.rs
+++ b/backend/windmill-worker/src/ai/tools.rs
@@ -1,6 +1,4 @@
-use crate::ai::query_builder::{StreamEventProcessor, StreamEventSink};
-use crate::ai::types::McpToolSource;
-use crate::ai::types::*;
+use crate::ai::query_builder::StreamEventProcessor;
 use crate::ai::utils::{
     add_message_to_conversation, execute_mcp_tool, get_step_name_from_flow,
     is_completed_input_transform, update_flow_status_module_with_actions,
@@ -20,7 +18,7 @@ use mappable_rc::Marc;
 use serde_json::value::RawValue;
 use std::{collections::HashMap, sync::Arc};
 use uuid::Uuid;
-use windmill_ai::ai_types::OpenAIToolCall;
+use windmill_ai::{ai_types::OpenAIToolCall, query_builder::StreamEventSink, types::*};
 use windmill_common::jobs::JobPayload;
 
 #[cfg(feature = "mcp")]
diff --git a/backend/windmill-worker/src/ai/types.rs b/backend/windmill-worker/src/ai/types.rs
deleted file mode 100644
index 57619f0dd9..0000000000
--- a/backend/windmill-worker/src/ai/types.rs
+++ /dev/null
@@ -1,2 +0,0 @@
-// Re-export all types from windmill_ai::types
-pub use windmill_ai::types::*;
diff --git a/backend/windmill-worker/src/ai/utils.rs b/backend/windmill-worker/src/ai/utils.rs
index f1e8fdd22f..74e75ef0a5 100644
--- a/backend/windmill-worker/src/ai/utils.rs
+++ b/backend/windmill-worker/src/ai/utils.rs
@@ -1,5 +1,3 @@
-pub use crate::ai::types::McpToolSource;
-use crate::ai::types::ToolDef;
 use anyhow::Context;
 use serde_json::value::RawValue;
 use sqlx::types::Json;
@@ -8,7 +6,7 @@ use std::{
     sync::Arc,
 };
 use uuid::Uuid;
-use windmill_ai::ai_providers::AIProvider;
+use windmill_ai::types::*;
 use windmill_common::flows::FlowModuleValue;
 use windmill_common::{
     db::DB,
@@ -24,7 +22,7 @@ use windmill_common::{
 use windmill_mcp::{McpClient, McpResource, McpTool};
 use windmill_queue::{flow_status::get_step_of_flow_status, MiniPulledJob};
 
-use crate::{ai::types::*, parse_sig_of_lang};
+use crate::parse_sig_of_lang;
 
 pub fn parse_raw_script_schema(
     content: &str,
@@ -323,11 +321,6 @@ pub fn get_step_name_from_flow(
     )
 }
 
-/// AWS Bedrock do not handle structured output query param, so we use a tool for structured output. Same for every Claude models.
-pub fn should_use_structured_output_tool(provider: &AIProvider, model: &str) -> bool {
-    model.contains("claude") || provider == &AIProvider::AWSBedrock
-}
-
 /// Cleanup MCP clients by gracefully shutting down connections
 #[cfg(feature = "mcp")]
 pub async fn cleanup_mcp_clients(mcp_clients: HashMap<String, Arc<McpClient>>) {
@@ -713,21 +706,3 @@ pub fn any_tool_needs_previous_result(tools: &[Tool]) -> bool {
         false
     })
 }
-
-/// Extract text content from OpenAIContent, joining parts with space if multiple
-pub fn extract_text_content(content: &OpenAIContent) -> String {
-    match content {
-        OpenAIContent::Text(text) => text.clone(),
-        OpenAIContent::Parts(parts) => parts
-            .iter()
-            .filter_map(|p| {
-                if let ContentPart::Text { text } = p {
-                    Some(text.as_str())
-                } else {
-                    None
-                }
-            })
-            .collect::<Vec<_>>()
-            .join(""),
-    }
-}
diff --git a/backend/windmill-worker/src/ai_executor.rs b/backend/windmill-worker/src/ai_executor.rs
index 03153df0a4..dae4f277f2 100644
--- a/backend/windmill-worker/src/ai_executor.rs
+++ b/backend/windmill-worker/src/ai_executor.rs
@@ -1,12 +1,10 @@
-#[cfg(feature = "bedrock")]
-use crate::ai::providers::bedrock::check_env_credentials;
 use crate::ai::tools::{execute_tool_calls, ToolAbortHandles, ToolExecutionContext};
 use crate::ai::utils::{
     add_message_to_conversation, any_tool_needs_previous_result, cleanup_mcp_clients,
     filter_schema_by_input_transforms, find_unique_tool_name, get_flow_context,
     get_flow_job_runnable_and_raw_flow, get_step_name_from_flow, load_mcp_tools,
-    parse_raw_script_schema, should_use_structured_output_tool,
-    update_flow_status_module_with_actions, update_flow_status_module_with_actions_success,
+    parse_raw_script_schema, update_flow_status_module_with_actions,
+    update_flow_status_module_with_actions_success,
 };
 use crate::memory_oss::{read_from_memory, write_to_memory};
 use crate::worker_flow::{get_previous_job_result, get_transform_context};
@@ -15,12 +13,21 @@ use regex::Regex;
 use serde_json::value::RawValue;
 use std::{collections::HashMap, sync::Arc};
 use uuid::Uuid;
+#[cfg(feature = "bedrock")]
+use windmill_ai::ai_bedrock::check_env_credentials;
 #[cfg(feature = "mcp")]
 use windmill_mcp::McpClient;
 
 #[cfg(not(feature = "mcp"))]
 use crate::ai::tools::McpClientStub as McpClient;
-use windmill_ai::ai_providers::AIProvider;
+use windmill_ai::{
+    ai_providers::AIProvider,
+    image_handler::upload_image_to_s3,
+    providers::create_query_builder,
+    query_builder::{BuildRequestArgs, ParsedResponse},
+    types::*,
+    utils::{should_use_structured_output_tool, AI_HTTP_HEADERS},
+};
 use windmill_common::{
     cache,
     client::AuthedClient,
@@ -38,13 +45,7 @@ use windmill_common::{
 use windmill_queue::{cancel_single_job, CanceledBy, MiniPulledJob};
 
 use crate::{
-    ai::{
-        image_handler::upload_image_to_s3,
-        query_builder::{
-            create_query_builder, BuildRequestArgs, ParsedResponse, StreamEventProcessor,
-        },
-        types::*,
-    },
+    ai::query_builder::StreamEventProcessor,
     common::{build_args_map, resolve_job_timeout, OccupancyMetrics, StreamNotifier},
     handle_child::{run_future_with_polling_update_job_poller_graceful, GracefulPollOutcome},
 };
@@ -52,33 +53,6 @@ use crate::{
 lazy_static::lazy_static! {
     static ref TOOL_NAME_REGEX: Regex = Regex::new(r"^[a-zA-Z0-9_]+$").unwrap();
 
-    /// Parse AI_HTTP_HEADERS environment variable into a vector of (header_name, header_value) tuples
-    /// Format: "header1: value1, header2: value2"
-    static ref AI_HTTP_HEADERS: Vec<(String, String)> = {
-        std::env::var("AI_HTTP_HEADERS")
-            .ok()
-            .map(|headers_str| {
-                headers_str
-                    .split(',')
-                    .filter_map(|header| {
-                        let parts: Vec<&str> = header.splitn(2, ':').collect();
-                        if parts.len() == 2 {
-                            let name = parts[0].trim().to_string();
-                            let value = parts[1].trim().to_string();
-                            if !name.is_empty() && !value.is_empty() {
-                                Some((name, value))
-                            } else {
-                                None
-                            }
-                        } else {
-                            None
-                        }
-                    })
-                    .collect()
-            })
-            .unwrap_or_default()
-    };
-
     static ref AI_AGENT_TOOL_SCHEMA: Box<RawValue> = to_raw_value(&serde_json::json!({
         "type": "object",
         "properties": {
@@ -791,7 +765,7 @@ pub async fn run_agent(
 
     let mut actions = vec![];
     let mut content = None;
-    let mut final_usage: Option<crate::ai::types::TokenUsage> = None;
+    let mut final_usage: Option<TokenUsage> = None;
 
     // Check if this provider supports tools with the current output type
     let supports_tools = query_builder.supports_tools_with_output_type(output_type);
@@ -893,7 +867,7 @@ pub async fn run_agent(
                     .get_region()
                     .unwrap_or(windmill_ai::ai_providers::USE_ENV_REGION);
                 // Use Bedrock SDK via dedicated query builder
-                crate::ai::providers::bedrock::BedrockQueryBuilder::default()
+                windmill_ai::providers::bedrock::BedrockQueryBuilder::default()
                     .execute_request(
                         &messages,
                         tool_defs.as_deref(),
@@ -1231,7 +1205,8 @@ pub async fn run_agent(
             }
             ParsedResponse::Image { base64_data } => {
                 // For image output, upload to S3 and track in conversation
-                let s3_object = upload_image_to_s3(&base64_data, job, client).await?;
+                let s3_object =
+                    upload_image_to_s3(&base64_data, &job.workspace_id, &job.id, client).await?;
 
                 let content = to_raw_value(&s3_object);
 
diff --git a/backend/windmill-worker/src/ansible_executor.rs b/backend/windmill-worker/src/ansible_executor.rs
index c8289b6934..2608cc6088 100644
--- a/backend/windmill-worker/src/ansible_executor.rs
+++ b/backend/windmill-worker/src/ansible_executor.rs
@@ -121,18 +121,24 @@ fn validate_relative_path(path: &str, field_name: &str) -> error::Result<()> {
         )));
     }
     let p = std::path::Path::new(trimmed);
-    if p.is_absolute() {
-        return Err(error::Error::BadRequest(format!(
-            "`{}` must be a relative path inside the cloned repo, got: {}",
-            field_name, trimmed
-        )));
-    }
     for component in p.components() {
-        if matches!(component, std::path::Component::ParentDir) {
-            return Err(error::Error::BadRequest(format!(
-                "`{}` must not contain `..` segments, got: {}",
-                field_name, trimmed
-            )));
+        match component {
+            // RootDir catches leading `/` or `\`; Prefix catches Windows drive
+            // letters and UNC paths. `Path::is_absolute()` alone misses
+            // RootDir-only paths on Windows (e.g. `/etc/passwd`).
+            std::path::Component::RootDir | std::path::Component::Prefix(_) => {
+                return Err(error::Error::BadRequest(format!(
+                    "`{}` must be a relative path inside the cloned repo, got: {}",
+                    field_name, trimmed
+                )));
+            }
+            std::path::Component::ParentDir => {
+                return Err(error::Error::BadRequest(format!(
+                    "`{}` must not contain `..` segments, got: {}",
+                    field_name, trimmed
+                )));
+            }
+            _ => {}
         }
     }
     Ok(())
@@ -1765,9 +1771,19 @@ mod tests {
 
     #[test]
     fn test_validate_relative_path_rejects_absolute() {
+        // `/etc/passwd` isn't `is_absolute()` on Windows (no drive prefix), but
+        // its leading RootDir still escapes the cloned repo, so reject it on
+        // every platform.
         assert!(validate_relative_path("/etc/passwd", "playbook").is_err());
     }
 
+    #[cfg(windows)]
+    #[test]
+    fn test_validate_relative_path_rejects_windows_absolute() {
+        assert!(validate_relative_path("\\etc\\passwd", "playbook").is_err());
+        assert!(validate_relative_path("C:\\Windows\\System32", "playbook").is_err());
+    }
+
     #[test]
     fn test_validate_relative_path_rejects_parent_dir() {
         assert!(validate_relative_path("../escape.yml", "playbook").is_err());
diff --git a/backend/windmill-worker/src/common.rs b/backend/windmill-worker/src/common.rs
index 0946075443..99e323dcfd 100644
--- a/backend/windmill-worker/src/common.rs
+++ b/backend/windmill-worker/src/common.rs
@@ -148,6 +148,13 @@ lazy_static::lazy_static! {
     static ref RE_RES_VAR: Regex = Regex::new(r#"\$(?:var|jsonvar|res|encrypted)\:"#).unwrap();
 }
 
+/// Returns true if any value in `vs` contains a `$var:`/`$jsonvar:`/`$res:`/`$encrypted:`
+/// reference that would need interpolation by `transform_json`. Cheap pre-check that
+/// callers can use to skip the DB roundtrip + clone path when nothing requires resolution.
+pub(crate) fn map_needs_resolution(vs: &HashMap<String, Box<RawValue>>) -> bool {
+    vs.values().any(|v| (*RE_RES_VAR).is_match(v.get()))
+}
+
 pub async fn transform_json<'a>(
     client: &AuthedClient,
     workspace: &str,
diff --git a/backend/windmill-worker/src/global_cache.rs b/backend/windmill-worker/src/global_cache.rs
index 23375746fd..67a8484b82 100644
--- a/backend/windmill-worker/src/global_cache.rs
+++ b/backend/windmill-worker/src/global_cache.rs
@@ -40,6 +40,9 @@ pub async fn build_tar_and_push(
     let tar_file = std::fs::File::create(&tar_path)?;
     let mut tar = tar::Builder::new(tar_file);
     tar.append_dir_all(".", &folder)?;
+    // Write the trailing zero blocks and close the inner file BEFORE std::fs::read
+    // below. Without this, the bytes we upload to S3 are an unfinalized archive.
+    drop(tar.into_inner()?);
 
     let tar_metadata = tokio::fs::metadata(&tar_path).await;
     if tar_metadata.is_err() || tar_metadata.as_ref().unwrap().len() == 0 {
@@ -231,6 +234,7 @@ pub async fn save_cache(
             let tar_file = std::fs::File::create(&tar_path)?;
             let mut tar = tar::Builder::new(tar_file);
             tar.append_dir_all(".", &origin)?;
+            drop(tar.into_inner()?);
             let tar_metadata = tokio::fs::metadata(&tar_path).await;
             if tar_metadata.is_err() || tar_metadata.as_ref().unwrap().len() == 0 {
                 tracing::info!("Failed to tar cache: {origin}");
diff --git a/backend/windmill-worker/src/memory_common.rs b/backend/windmill-worker/src/memory_common.rs
index 440199702f..e024acea69 100644
--- a/backend/windmill-worker/src/memory_common.rs
+++ b/backend/windmill-worker/src/memory_common.rs
@@ -1,5 +1,5 @@
-use crate::ai::types::OpenAIMessage;
 use uuid::Uuid;
+use windmill_ai::types::OpenAIMessage;
 use windmill_common::{db::DB, error::Error};
 
 pub const MAX_MEMORY_SIZE_BYTES: usize = 100_000; // 100KB per memory entry in database
diff --git a/backend/windmill-worker/src/memory_oss.rs b/backend/windmill-worker/src/memory_oss.rs
index 74771a79e8..dcdab14e2a 100644
--- a/backend/windmill-worker/src/memory_oss.rs
+++ b/backend/windmill-worker/src/memory_oss.rs
@@ -3,7 +3,9 @@
 pub use crate::memory_ee::*;
 
 #[cfg(not(all(feature = "private", feature = "enterprise")))]
-use {crate::ai::types::OpenAIMessage, crate::memory_common, uuid::Uuid, windmill_common::db::DB};
+use {
+    crate::memory_common, uuid::Uuid, windmill_ai::types::OpenAIMessage, windmill_common::db::DB,
+};
 
 /// Read AI agent memory from storage
 /// In OSS: always reads from database
diff --git a/backend/windmill-worker/src/python_executor.rs b/backend/windmill-worker/src/python_executor.rs
index 5fb1278976..4db7b20fd5 100644
--- a/backend/windmill-worker/src/python_executor.rs
+++ b/backend/windmill-worker/src/python_executor.rs
@@ -2113,6 +2113,84 @@ async fn spawn_uv_install(
     }
 }
 
+/// Verify that every file listed in the wheel's RECORD exists on disk under
+/// `venv_p`. Used as a structural integrity check after both a successful
+/// `pull_from_tar` (object-store cache hit) and a successful local
+/// `uv pip install`, so a truncated tar or a dropped wheel entry can never
+/// become an authoritative cache entry. Returns Err with a short description
+/// on the first integrity issue (no .dist-info, no RECORD, or any listed
+/// path missing on disk).
+async fn verify_wheel_record(venv_p: &str) -> Result<(), String> {
+    let mut entries = tokio::fs::read_dir(venv_p)
+        .await
+        .map_err(|e| format!("read_dir({venv_p}): {e}"))?;
+
+    let mut dist_info: Option<String> = None;
+    loop {
+        match entries.next_entry().await {
+            Ok(Some(entry)) => {
+                let name = entry.file_name();
+                let name_s = name.to_string_lossy();
+                if name_s.ends_with(".dist-info") {
+                    if let Ok(ft) = entry.file_type().await {
+                        if ft.is_dir() {
+                            dist_info = Some(name_s.into_owned());
+                            break;
+                        }
+                    }
+                }
+            }
+            Ok(None) => break,
+            Err(e) => return Err(format!("read_dir entry in {venv_p}: {e}")),
+        }
+    }
+
+    let dist_info = match dist_info {
+        Some(d) => d,
+        None => return Err(format!("no .dist-info directory in {venv_p}")),
+    };
+
+    let record_path = format!("{venv_p}/{dist_info}/RECORD");
+    let record_content = tokio::fs::read_to_string(&record_path)
+        .await
+        .map_err(|e| format!("read RECORD at {record_path}: {e}"))?;
+
+    let mut missing: Vec<String> = Vec::new();
+    for line in record_content.lines() {
+        let trimmed = line.trim();
+        if trimmed.is_empty() {
+            continue;
+        }
+        let rel_path = match trimmed.split(',').next() {
+            Some(p) if !p.is_empty() => p,
+            _ => continue,
+        };
+        // Defensive: skip absolute paths or escaping entries — we only
+        // validate package-relative files.
+        if rel_path.starts_with('/') || rel_path.contains("..") {
+            continue;
+        }
+        let full = format!("{venv_p}/{rel_path}");
+        if tokio::fs::metadata(&full).await.is_err() {
+            missing.push(rel_path.to_string());
+            // Bound error size in pathological cases (e.g. wholly empty dir).
+            if missing.len() >= 10 {
+                missing.push("...".to_string());
+                break;
+            }
+        }
+    }
+
+    if missing.is_empty() {
+        Ok(())
+    } else {
+        Err(format!(
+            "wheel RECORD lists files missing on disk: {}",
+            missing.join(", ")
+        ))
+    }
+}
+
 /// uv pip install, include cached or pull from S3
 pub async fn handle_python_reqs(
     requirements: Vec<String>,
@@ -2484,6 +2562,30 @@ pub async fn handle_python_reqs(
                                     workspace_id = %w_id,
                                     "No tarball was found for {venv_p} on S3 or different problem occurred {job_id}:\n{e}",
                                 );
+                            } else if let Err(verify_err) = verify_wheel_record(&venv_p).await {
+                                // The object-store tar extracted cleanly but the resulting
+                                // directory is missing files referenced by the wheel RECORD.
+                                // Wipe the broken cache entry and fall through to a fresh
+                                // local install rather than treating it as authoritative.
+                                tracing::warn!(
+                                    workspace_id = %w_id,
+                                    job_id = %job_id,
+                                    "Object-store cache for {venv_p} failed wheel RECORD verification, will reinstall locally: {verify_err}"
+                                );
+                                if let Err(rm_err) = tokio::fs::remove_dir_all(&venv_p).await {
+                                    tracing::warn!(
+                                        workspace_id = %w_id,
+                                        "could not remove broken cache dir {venv_p}: {rm_err}"
+                                    );
+                                }
+                                append_logs(
+                                    &job_id,
+                                    &w_id,
+                                    format!(
+                                        "\n[!] cached wheel for {req} from object store failed integrity check, reinstalling: {verify_err}\n"
+                                    ),
+                                    &conn,
+                                ).await;
                             } else {
                                 print_success(
                                     true,
@@ -2640,6 +2742,39 @@ pub async fn handle_python_reqs(
                 let _ = std::fs::remove_file(format!("{job_dir}/{req}.config.proto"));
             }
 
+            // Verify the install before declaring success: if uv exited 0 but
+            // the on-disk directory is missing files the wheel RECORD says
+            // should exist, do NOT write .valid.windmill, do NOT queue the
+            // piptar upload, and fail the job. This prevents a broken tar
+            // from ever being pushed to the object store and propagated to
+            // every other replica.
+            if let Err(verify_err) = verify_wheel_record(&venv_p).await {
+                tracing::error!(
+                    workspace_id = %w_id,
+                    job_id = %job_id,
+                    "uv pip install of {req} into {venv_p} failed wheel RECORD verification: {verify_err}"
+                );
+                append_logs(
+                    &job_id,
+                    &w_id,
+                    format!(
+                        "\nWheel RECORD verification failed after install of {req}: {verify_err}. \
+                         Aborting to avoid publishing a corrupt cache entry."
+                    ),
+                    &conn,
+                ).await;
+                if let Err(rm_err) = tokio::fs::remove_dir_all(&venv_p).await {
+                    tracing::warn!(
+                        workspace_id = %w_id,
+                        "could not remove broken install dir {venv_p}: {rm_err}"
+                    );
+                }
+                pids.lock().await.get_mut(i).and_then(|e| e.take());
+                return Err(Error::from(anyhow!(
+                    "wheel RECORD verification failed after install of {req}"
+                )));
+            }
+
             print_success(
                 false,
                 s3_push,
diff --git a/backend/windmill-worker/src/result_processor.rs b/backend/windmill-worker/src/result_processor.rs
index 1f771f6879..9eac0a5dcd 100644
--- a/backend/windmill-worker/src/result_processor.rs
+++ b/backend/windmill-worker/src/result_processor.rs
@@ -35,8 +35,9 @@ use windmill_common::{
 use windmill_common::bench::{BenchmarkInfo, BenchmarkIter};
 
 use windmill_queue::{
-    append_logs, get_mini_completed_job, CanceledBy, FlowRunners, JobCompleted, MiniCompletedJob,
-    MiniPulledJob, ValidableJson, WrappedError, INIT_SCRIPT_TAG,
+    append_logs, get_mini_completed_job, is_pre_shaped_wm_failure_result, CanceledBy, FlowRunners,
+    JobCompleted, MiniCompletedJob, MiniPulledJob, ValidableJson, WrappedError, INIT_SCRIPT_TAG,
+    MANUAL_FAILURE_ERROR_NAME,
 };
 
 use serde_json::{json, value::RawValue, Value};
@@ -61,8 +62,37 @@ struct ErrorMessage {
     name: String,
 }
 
+#[derive(Debug, Deserialize)]
+struct NestedErrorMessage {
+    error: ErrorMessage,
+}
+
+/// Extract `{ name, message }` from a result. Accepts both the standard
+/// top-level shape (regular runtime errors) and the nested `{ error: { name,
+/// message }, ... }` shape produced by the wm_failure injection.
+///
+/// For wm_failure-injected results, we prefer the nested error: a successful
+/// run may legitimately contain top-level `name`/`message` fields (user data
+/// named `name`/`message`), and we want OTel to record the ManualFailure
+/// rather than the user's sibling fields.
+fn extract_error_message(raw: &str) -> Option<ErrorMessage> {
+    let nested = serde_json::from_str::<NestedErrorMessage>(raw)
+        .ok()
+        .map(|n| n.error);
+    if matches!(&nested, Some(em) if em.name == MANUAL_FAILURE_ERROR_NAME) {
+        return nested;
+    }
+    if let Ok(em) = serde_json::from_str::<ErrorMessage>(raw) {
+        return Some(em);
+    }
+    nested
+}
+
+/// Returns the post-processing `success` value (after any `wm_failure`
+/// override). Callers use this to make worker-loop decisions that depend on
+/// whether the job ultimately succeeded — e.g. the init-script killpill.
 async fn process_jc(
-    jc: JobCompleted,
+    mut jc: JobCompleted,
     worker_name: &str,
     base_internal_url: &str,
     db: &DB,
@@ -73,7 +103,32 @@ async fn process_jc(
     killpill_rx: &tokio::sync::broadcast::Receiver<()>,
     #[cfg(feature = "benchmark")] bench: &mut BenchmarkIter,
     #[cfg(feature = "benchmark")] bench_infos: &mut BenchmarkInfo,
-) {
+) -> bool {
+    // Parse `wm_labels` and `wm_failure` together (single `from_str`)
+    // so we don't deserialize the whole result twice on every job.
+    let metadata = jc.result.result_metadata();
+
+    // If the script returned a `wm_failure: <string>` field in its
+    // result, tag the run as a failure. Inject an `error: { name, message }`
+    // at the top level so error handlers / UI / OTel see the standard error
+    // shape, while preserving sibling fields (`windmill_status_code`,
+    // `windmill_content_type`, `windmill_headers`, the user's data) at the
+    // top level so sync webhook responses still honor them.
+    if jc.success {
+        if let Some(failure_msg) = metadata.wm_failure.as_ref() {
+            if let Ok(Value::Object(mut map)) = serde_json::from_str::<Value>(jc.result.get()) {
+                map.insert(
+                    "error".to_string(),
+                    json!({ "name": MANUAL_FAILURE_ERROR_NAME, "message": failure_msg }),
+                );
+                if let Ok(raw) = serde_json::value::to_raw_value(&Value::Object(map)) {
+                    jc.result = Arc::new(raw);
+                }
+            }
+            jc.success = false;
+        }
+    }
+
     let success: bool = jc.success;
 
     let span = if success {
@@ -125,7 +180,7 @@ async fn process_jc(
         jc.job.id
     };
 
-    if let Some(labels) = jc.result.wm_labels() {
+    if let Some(labels) = metadata.wm_labels.as_ref() {
         if !labels.is_empty() {
             span.record("labels", labels.join(","));
         }
@@ -163,7 +218,7 @@ async fn process_jc(
         span.record("script_hash", script_hash.to_string().as_str());
     }
     if !success {
-        if let Ok(result_error) = serde_json::from_str::<ErrorMessage>(jc.result.get()) {
+        if let Some(result_error) = extract_error_message(jc.result.get()) {
             span.record("error.message", result_error.message.as_str());
             span.record("error.name", result_error.name.as_str());
             span.record(
@@ -218,6 +273,8 @@ async fn process_jc(
         )
         .await;
     }
+
+    success
 }
 
 enum JobCompletedRx {
@@ -311,8 +368,7 @@ pub fn start_background_processor(
                     result: SendResultPayload::JobCompleted(jc),
                     time,
                 }) => {
-                    let is_init_script_and_failure =
-                        !jc.success && jc.job.tag.as_str() == INIT_SCRIPT_TAG;
+                    let is_init_script = jc.job.tag.as_str() == INIT_SCRIPT_TAG;
                     let is_dependency_job = matches!(
                         jc.job.kind,
                         JobKind::Dependencies | JobKind::FlowDependencies
@@ -322,7 +378,10 @@ pub fn start_background_processor(
                     #[cfg(feature = "benchmark")]
                     let is_top_level_job = jc.job.parent_job.is_none();
 
-                    process_jc(
+                    // process_jc returns the post-override success value so a
+                    // job that flipped to failure via `wm_failure` still
+                    // triggers the init-script killpill.
+                    let final_success = process_jc(
                         jc,
                         &worker_name,
                         &base_internal_url,
@@ -340,7 +399,7 @@ pub fn start_background_processor(
                     .warn_after_seconds(10)
                     .await;
 
-                    if is_init_script_and_failure {
+                    if is_init_script && !final_success {
                         tracing::error!("init script errored, exiting");
                         killpill_tx.send();
                         break;
@@ -793,19 +852,44 @@ pub async fn process_completed_job(
             }
         }
     } else {
-        let result = add_completed_job_error(
-            db,
-            &job,
-            mem_peak.to_owned(),
-            canceled_by.clone(),
-            serde_json::from_str(result.get()).unwrap_or_else(
-                |_| json!({ "message": format!("Non serializable error: {}", result.get()) }),
-            ),
-            worker_name,
-            false,
-            None,
-        )
-        .await?;
+        // The result already carries our injected
+        // `error: { name: "ManualFailure", ... }` marker when process_jc
+        // retagged a successful run as a failure — store it as-is to preserve
+        // sibling fields like `windmill_status_code`. We check for the
+        // injected marker specifically (not just the presence of a
+        // `wm_failure` field) so a real runtime failure whose raw
+        // result happens to contain a `wm_failure` field still goes
+        // through the standard `WrappedError { error: ... }` wrap path.
+        let downstream_result: Arc<Box<RawValue>> = if is_pre_shaped_wm_failure_result(result.get())
+        {
+            windmill_queue::add_completed_job_pre_shaped_failure(
+                db,
+                &job,
+                mem_peak.to_owned(),
+                canceled_by.clone(),
+                Json(&*result),
+                worker_name,
+                false,
+                None,
+            )
+            .await?;
+            result.clone()
+        } else {
+            let wrapped = add_completed_job_error(
+                db,
+                &job,
+                mem_peak.to_owned(),
+                canceled_by.clone(),
+                serde_json::from_str(result.get()).unwrap_or_else(
+                    |_| json!({ "message": format!("Non serializable error: {}", result.get()) }),
+                ),
+                worker_name,
+                false,
+                None,
+            )
+            .await?;
+            Arc::new(serde_json::value::to_raw_value(&wrapped).unwrap())
+        };
         if job.is_flow_step() {
             if let Some(parent_job) = job.parent_job {
                 tracing::error!(parent_flow = %parent_job, subflow = %job.id, "process completed job error, updating flow status");
@@ -817,7 +901,7 @@ pub async fn process_completed_job(
                     &job.workspace_id,
                     false,
                     canceled_by,
-                    Arc::new(serde_json::value::to_raw_value(&result).unwrap()),
+                    downstream_result,
                     duration.and_then(|d| {
                         job.started_at.map(|started_at| FlowJobDuration {
                             started_at: started_at,
@@ -855,13 +939,12 @@ pub async fn process_completed_job(
             .fetch_optional(db)
             .await?;
             if let Some(Some(job_ids)) = job_ids_json {
-                let err_result = Arc::new(serde_json::value::to_raw_value(&result).unwrap());
                 if let Ok(Some(_)) = handle_wac_child_completion(
                     db,
                     &job.id,
                     parent_job,
                     &job.workspace_id,
-                    err_result,
+                    downstream_result,
                     false,
                     job_ids,
                 )
diff --git a/backend/windmill-worker/src/worker_flow.rs b/backend/windmill-worker/src/worker_flow.rs
index 050ae4b44f..53c94a7458 100644
--- a/backend/windmill-worker/src/worker_flow.rs
+++ b/backend/windmill-worker/src/worker_flow.rs
@@ -81,6 +81,33 @@ use windmill_audit::ActionKind;
 use windmill_common::audit::AuditAuthor;
 use windmill_queue::{canceled_job_to_result, push};
 
+lazy_static::lazy_static! {
+    /// Per-worker LRU cache of resolved `flow_env` values, keyed by flow job id.
+    /// `update_flow_status_after_job_completion_internal` runs once per child-step
+    /// completion, and re-resolving `$var:`/`$res:` references each time was the
+    /// dominant heap-allocation source under flow-heavy load. The cache aligns
+    /// predicate evaluation with `handle_flow`'s input-transform path, which
+    /// already resolves once at flow entry — predicates were the only place still
+    /// re-resolving on every read.
+    ///
+    /// Per-worker scope (caveat): the cache lives in process memory, not the DB,
+    /// so different workers processing children of the same flow each compute
+    /// their own snapshot on first miss. If a `$var:`/`$res:` value mutates
+    /// mid-flow, predicate eval on different workers can observe different
+    /// values for the same flow run. For typical use (env values configured at
+    /// flow start, read-only during execution) this is invisible. Cross-worker
+    /// determinism would require persisting the resolved env in `v2_job_status`;
+    /// see follow-up notes.
+    ///
+    /// Entries become dead weight once a flow completes and are evicted by LRU
+    /// pressure. Bounded at 1024 entries; per-entry footprint depends on the
+    /// env's contents (literals are small but a single resolved `$res:` can be
+    /// tens of KB), so worst-case memory scales with workload mix rather than
+    /// being fixed.
+    static ref RESOLVED_FLOW_ENV_CACHE: quick_cache::sync::Cache<Uuid, Arc<HashMap<String, Box<RawValue>>>> =
+        quick_cache::sync::Cache::new(1024);
+}
+
 #[derive(Debug)]
 pub struct SchedulePushZombieError(pub String);
 
@@ -467,21 +494,54 @@ pub async fn update_flow_status_after_job_completion_internal(
         }
 
         // Resolve flow_env for predicate evaluations (stop_after_if,
-        // stop_after_all_iters_if, retry_if). Only fetch when one of these
-        // predicates is configured to avoid an extra DB query on the common
-        // path. `retry` without `retry_if` doesn't consult flow_env.
-        let retry_uses_flow_env =
-            |module: &FlowModule| module.retry.as_ref().is_some_and(|r| r.retry_if.is_some());
+        // stop_after_all_iters_if, retry_if). Two-level gate:
+        //   1. Structural — at least one such predicate is configured.
+        //   2. Textual — the predicate expression actually references
+        //      `flow_env`. Mirrors the existing `expr.contains("results.")`
+        //      check in `get_id_ctx_for_expr`. A substring match has false
+        //      positives (harmless — just runs an unneeded resolve) but no
+        //      false negatives, since `flow_env` must appear textually for the
+        //      expression engine to read it.
+        let expr_uses_flow_env = |expr: &str| expr.contains("flow_env");
+        let retry_if_uses_flow_env = |module: &FlowModule| {
+            module
+                .retry
+                .as_ref()
+                .and_then(|r| r.retry_if.as_ref())
+                .is_some_and(|r| expr_uses_flow_env(&r.expr))
+        };
         let needs_flow_env = current_module.is_some_and(|m| {
-            m.stop_after_if.is_some()
-                || m.stop_after_all_iters_if.is_some()
-                || retry_uses_flow_env(m)
+            m.stop_after_if
+                .as_ref()
+                .is_some_and(|s| expr_uses_flow_env(&s.expr))
+                || m.stop_after_all_iters_if
+                    .as_ref()
+                    .is_some_and(|s| expr_uses_flow_env(&s.expr))
+                || retry_if_uses_flow_env(m)
         }) || flow_value
             .failure_module
             .as_ref()
-            .is_some_and(|fm| retry_uses_flow_env(fm));
-        let resolved_flow_env: Option<HashMap<String, Box<RawValue>>> = if needs_flow_env {
-            resolve_flow_env_for_status_update(db, client, flow, w_id, flow_value).await
+            .is_some_and(|fm| retry_if_uses_flow_env(fm));
+        // The resolved env is constant for a flow's lifetime, so cache it by flow
+        // job id and reuse across child-step completions. Cache miss falls back to
+        // the existing resolve+persist path; same-worker subsequent completions are
+        // a single Arc::clone away. Transient-failure fallbacks (`is_cacheable ==
+        // false`) bypass the insert so a single API blip doesn't poison the rest
+        // of the flow run.
+        let resolved_flow_env: Option<Arc<HashMap<String, Box<RawValue>>>> = if needs_flow_env {
+            if let Some(cached) = RESOLVED_FLOW_ENV_CACHE.get(&flow) {
+                Some(cached)
+            } else {
+                resolve_flow_env_for_status_update(db, client, flow, w_id, flow_value)
+                    .await
+                    .map(|(env, is_cacheable)| {
+                        let arc = Arc::new(env);
+                        if is_cacheable {
+                            RESOLVED_FLOW_ENV_CACHE.insert(flow, arc.clone());
+                        }
+                        arc
+                    })
+            }
         } else {
             None
         };
@@ -632,7 +692,7 @@ pub async fn update_flow_status_after_job_completion_internal(
                         let bool_res = compute_bool_from_expr(
                             &expr,
                             Marc::new(args),
-                            resolved_flow_env.as_ref(),
+                            resolved_flow_env.as_deref(),
                             result.clone(),
                             all_iters,
                             id_ctx.as_ref(),
@@ -916,7 +976,7 @@ pub async fn update_flow_status_after_job_completion_internal(
                             &mut stop_early_err_msg,
                             &mut nresult,
                             args,
-                            resolved_flow_env.as_ref(),
+                            resolved_flow_env.as_deref(),
                             flow,
                             &old_status,
                         )
@@ -1136,7 +1196,7 @@ pub async fn update_flow_status_after_job_completion_internal(
                             &mut stop_early_err_msg,
                             &mut nresult,
                             args,
-                            resolved_flow_env.as_ref(),
+                            resolved_flow_env.as_deref(),
                             flow,
                             &old_status,
                         )
@@ -1219,7 +1279,7 @@ pub async fn update_flow_status_after_job_completion_internal(
                             &old_status.retry,
                             result.clone(),
                             Marc::new(args),
-                            resolved_flow_env.as_ref(),
+                            resolved_flow_env.as_deref(),
                             Some(client),
                         )
                         .await?
@@ -1601,7 +1661,7 @@ pub async fn update_flow_status_after_job_completion_internal(
                 &old_status.retry,
                 result.clone(),
                 Marc::new(args),
-                resolved_flow_env.as_ref(),
+                resolved_flow_env.as_deref(),
                 Some(client),
             )
             .await?
@@ -2387,28 +2447,62 @@ async fn fetch_root_flow_id(db: &DB, flow_id: Uuid) -> Uuid {
 // `update_flow_status_after_job_completion_internal`: take the current flow's
 // `flow_env` if present, otherwise inherit from the root flow, then interpolate
 // any `$var:`/`$res:` references via `transform_json`.
+//
+// Returns `Some((env, is_cacheable))`. `is_cacheable` is `false` only when the
+// returned env is a partially-resolved fallback after a transient error (e.g.
+// `transform_json` failed mid-resolve, or the mini job fetch failed). Callers
+// must not cache `is_cacheable == false` results — doing so would freeze the
+// transient failure for the rest of the flow run.
 async fn resolve_flow_env_for_status_update(
     db: &DB,
     client: &AuthedClient,
     flow_job_id: Uuid,
     workspace_id: &str,
     flow_value: &FlowValue,
-) -> Option<HashMap<String, Box<RawValue>>> {
-    let env = if let Some(ref e) = flow_value.flow_env {
-        e.clone()
-    } else {
-        fetch_root_flow_env(db, flow_job_id, workspace_id).await?
-    };
+) -> Option<(HashMap<String, Box<RawValue>>, bool)> {
+    // Fetch the env source. For the inherited path, we first need to know whether the
+    // flow even has a parent — `fetch_root_flow_env` runs a recursive CTE on `v2_job`
+    // and is wasted work for top-level flows with no own `flow_env`. The mini job we
+    // pull here can be reused below if `transform_json` ends up needing it.
+    let (env, mini): (HashMap<String, Box<RawValue>>, Option<MiniPulledJob>) =
+        if let Some(ref e) = flow_value.flow_env {
+            (e.clone(), None)
+        } else {
+            let mini = match get_mini_pulled_job(db, &flow_job_id).await {
+                Ok(Some(j)) => j,
+                Ok(None) => return None,
+                Err(e) => {
+                    tracing::warn!("Failed to fetch flow job to resolve flow_env: {e:#}");
+                    return None;
+                }
+            };
+            if mini.parent_job.is_none() {
+                // No own flow_env and no parent to inherit from — nothing to resolve.
+                return None;
+            }
+            let env = fetch_root_flow_env(db, flow_job_id, workspace_id).await?;
+            (env, Some(mini))
+        };
     if env.is_empty() {
-        return Some(env);
+        return Some((env, true));
     }
-    let mini = match get_mini_pulled_job(db, &flow_job_id).await {
-        Ok(Some(j)) => j,
-        Ok(None) => return Some(env),
-        Err(e) => {
-            tracing::warn!("Failed to fetch flow job to resolve flow_env: {e:#}");
-            return Some(env);
-        }
+    // Skip the DB roundtrip + `transform_json` when nothing in env needs interpolation.
+    // This is the common case: a flow_env containing only literal values.
+    if !crate::common::map_needs_resolution(&env) {
+        return Some((env, true));
+    }
+    let mini = match mini {
+        Some(m) => m,
+        None => match get_mini_pulled_job(db, &flow_job_id).await {
+            Ok(Some(j)) => j,
+            // Don't cache: we couldn't fetch the job, so the env we'd return is the
+            // pre-interpolation literal — caching that would freeze the broken state.
+            Ok(None) => return Some((env, false)),
+            Err(e) => {
+                tracing::warn!("Failed to fetch flow job to resolve flow_env: {e:#}");
+                return Some((env, false));
+            }
+        },
     };
     match transform_json(
         client,
@@ -2419,11 +2513,13 @@ async fn resolve_flow_env_for_status_update(
     )
     .await
     {
-        Ok(Some(resolved)) => Some(resolved),
-        Ok(None) => Some(env),
+        Ok(Some(resolved)) => Some((resolved, true)),
+        Ok(None) => Some((env, true)),
+        // Don't cache transient resolution failures: one variable/resource API blip
+        // would otherwise poison the literal-only env for the rest of the flow run.
         Err(e) => {
             tracing::warn!("Failed to resolve flow_env references in status update: {e:#}");
-            Some(env)
+            Some((env, false))
         }
     }
 }
@@ -2648,8 +2744,11 @@ pub async fn handle_flow(
     // Resolve $var: and $res: references in flow_env.
     // We resolve into a separate variable to avoid cloning the entire FlowValue
     // (which includes modules, failure_module, etc.) just to replace flow_env.
+    // `is_cacheable` is `false` only on a transient `transform_json` failure,
+    // matching `resolve_flow_env_for_status_update`'s contract — we must not
+    // freeze a partial resolution into the cache.
     let resolved_env;
-    let flow_env = if let Some(env) = env_source {
+    let (flow_env, is_cacheable) = if let Some(env) = env_source {
         match transform_json(
             client,
             &flow_job.workspace_id,
@@ -2661,18 +2760,31 @@ pub async fn handle_flow(
         {
             Ok(Some(resolved)) => {
                 resolved_env = resolved;
-                Some(&resolved_env)
+                (Some(&resolved_env), true)
             }
-            Ok(None) => Some(env),
+            Ok(None) => (Some(env), true),
             Err(e) => {
                 tracing::warn!("Failed to resolve flow_env references: {e}");
-                Some(env)
+                (Some(env), false)
             }
         }
     } else {
-        None
+        (None, true)
     };
 
+    // Populate the per-flow resolved-env cache so subsequent predicate
+    // evaluations in `update_flow_status_after_job_completion_internal` skip
+    // the recursive CTE + transform_json. Costs one HashMap clone per
+    // sub-flow handle_flow entry; saves up to one CTE + one transform_json
+    // per flow execution that has predicates referencing flow_env.
+    if is_cacheable {
+        if let Some(env) = flow_env {
+            if !env.is_empty() {
+                RESOLVED_FLOW_ENV_CACHE.insert(flow_job.id, Arc::new(env.clone()));
+            }
+        }
+    }
+
     let status = flow_job
         .parse_flow_status()
         .with_context(|| "Unable to parse flow status")?;
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 2e1f9ef06a..22cc1f75eb 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.697.0";
+export const VERSION = "v1.700.2";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/commands/app/app.ts b/cli/src/commands/app/app.ts
index f99df84636..2749c0269c 100644
--- a/cli/src/commands/app/app.ts
+++ b/cli/src/commands/app/app.ts
@@ -4,7 +4,7 @@ import { Command } from "@cliffy/command";
 import { Table } from "@cliffy/table";
 import { colors } from "@cliffy/ansi/colors";
 import * as log from "../../core/log.ts";
-import { sep as SEP } from "node:path";
+import { sep as SEP, isAbsolute, resolve as pathResolve, relative as pathRelative, basename } from "node:path";
 import { stat } from "node:fs/promises";
 import * as windmillUtils from "@windmill-labs/shared-utils";
 import { yamlParseFile } from "../../utils/yaml.ts";
@@ -12,6 +12,7 @@ import * as wmill from "../../../gen/services.gen.ts";
 import { ListableApp, Policy } from "../../../gen/types.gen.ts";
 
 import { GlobalOptions, isSuperset } from "../../types.ts";
+import { getWmillYamlPath } from "../../core/conf.ts";
 import { readInlinePathSync } from "../../utils/utils.ts";
 import devCommand from "./dev.ts";
 import lintCommand from "./lint.ts";
@@ -261,31 +262,122 @@ async function get(opts: GlobalOptions & { json?: boolean }, path: string) {
   }
 }
 
-async function push(opts: GlobalOptions, filePath: string, remotePath: string) {
-  if (!validatePath(remotePath)) {
-    return;
-  }
+const APP_FOLDER_SUFFIXES = ["__raw_app", ".raw_app", "__app", ".app"] as const;
+
+async function push(
+  opts: GlobalOptions,
+  filePath?: string,
+  remotePath?: string
+) {
+  // Capture original CWD before resolveWorkspace, which may chdir to the
+  // wmill.yaml root. We need it to resolve relative inputs and to derive
+  // the remote path from the user's location when auto-inferring.
+  const originalCwd = process.cwd();
+
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
 
-  // Detect raw apps by checking for raw_app.yaml or __raw_app/.raw_app suffix
-  const normalizedPath = filePath.endsWith(SEP) ? filePath.slice(0, -1) : filePath;
-  const isRawApp = normalizedPath.endsWith("__raw_app") || normalizedPath.endsWith(".raw_app");
+  // Auto-infer file path from CWD when omitted
+  if (!filePath) {
+    filePath = originalCwd;
+  }
+  const absoluteFilePath = isAbsolute(filePath)
+    ? filePath
+    : pathResolve(originalCwd, filePath);
+
+  // Detect app folder type (regular vs raw)
+  const normalizedPath = absoluteFilePath.endsWith(SEP)
+    ? absoluteFilePath.slice(0, -1)
+    : absoluteFilePath;
+  const dirName = basename(normalizedPath);
+  const isRawAppByName =
+    dirName.endsWith("__raw_app") || dirName.endsWith(".raw_app");
+  const isAppByName = dirName.endsWith("__app") || dirName.endsWith(".app");
+
   let hasRawAppYaml = false;
-  if (!isRawApp) {
+  let hasAppYaml = false;
+  try {
+    await stat(normalizedPath + SEP + "raw_app.yaml");
+    hasRawAppYaml = true;
+  } catch { /* not a raw app */ }
+  if (!hasRawAppYaml) {
     try {
-      const rawAppPath = (filePath.endsWith(SEP) ? filePath : filePath + SEP) + "raw_app.yaml";
-      await stat(rawAppPath);
-      hasRawAppYaml = true;
-    } catch { /* not a raw app */ }
+      await stat(normalizedPath + SEP + "app.yaml");
+      hasAppYaml = true;
+    } catch { /* not an app */ }
   }
 
-  if (isRawApp || hasRawAppYaml) {
+  if (!isRawAppByName && !isAppByName && !hasRawAppYaml && !hasAppYaml) {
+    log.error(
+      colors.red(
+        `'${filePath}' is not an app folder (no app.yaml or raw_app.yaml, and not a *.app/*.raw_app folder).`
+      )
+    );
+    return;
+  }
+
+  // Auto-infer remote path from the folder location relative to wmill.yaml root
+  if (!remotePath) {
+    const wmillYamlPath = getWmillYamlPath();
+    if (!wmillYamlPath) {
+      log.error(
+        colors.red(
+          "Could not infer remote path: no wmill.yaml found. Run 'wmill init' or pass <remote_path> explicitly."
+        )
+      );
+      return;
+    }
+    // After resolveWorkspace, process.cwd() is the wmill.yaml dir
+    const wmillRoot = process.cwd();
+    let inferred = pathRelative(wmillRoot, normalizedPath).replaceAll(SEP, "/");
+    if (inferred.startsWith("..") || isAbsolute(inferred)) {
+      log.error(
+        colors.red(
+          `Could not infer remote path: '${filePath}' is outside the wmill.yaml root (${wmillRoot}). Move the folder under the root or pass <remote_path> explicitly.`
+        )
+      );
+      return;
+    }
+    for (const suffix of APP_FOLDER_SUFFIXES) {
+      if (inferred.endsWith(suffix)) {
+        inferred = inferred.slice(0, -suffix.length);
+        break;
+      }
+    }
+    if (!inferred) {
+      log.error(
+        colors.red(
+          "Could not infer remote path: app folder is at the wmill.yaml root. Pass <remote_path> explicitly."
+        )
+      );
+      return;
+    }
+    if (
+      !inferred.startsWith("u/") &&
+      !inferred.startsWith("g/") &&
+      !inferred.startsWith("f/")
+    ) {
+      log.error(
+        colors.red(
+          `Could not infer remote path: '${inferred}' is not under u/, g/, or f/. Move the app under one of these prefixes or pass <remote_path> explicitly.`
+        )
+      );
+      return;
+    }
+    remotePath = inferred;
+    log.info(colors.gray(`Inferred remote path: ${remotePath}`));
+  }
+
+  if (!validatePath(remotePath)) {
+    return;
+  }
+
+  if (isRawAppByName || hasRawAppYaml) {
     const { pushRawApp } = await import("./raw_apps.ts");
-    await pushRawApp(workspace.workspaceId, remotePath, filePath);
+    await pushRawApp(workspace.workspaceId, remotePath, absoluteFilePath);
     log.info(colors.bold.underline.green("Raw app pushed"));
   } else {
-    await pushApp(workspace.workspaceId, remotePath, filePath);
+    await pushApp(workspace.workspaceId, remotePath, absoluteFilePath);
     log.info(colors.bold.underline.green("App pushed"));
   }
 }
@@ -301,8 +393,11 @@ const command = new Command()
   .arguments("<path:string>")
   .option("--json", "Output as JSON (for piping to jq)")
   .action(get as any)
-  .command("push", "push a local app ")
-  .arguments("<file_path:string> <remote_path:string>")
+  .command(
+    "push",
+    "push a local app. With no args, infers the app from the current directory and the remote path from its location relative to wmill.yaml."
+  )
+  .arguments("[file_path:string] [remote_path:string]")
   .action(push as any)
   .command("dev", devCommand)
   .command("lint", lintCommand)
diff --git a/cli/src/commands/app/dev.ts b/cli/src/commands/app/dev.ts
index 5b78f84e3f..7edb793bea 100644
--- a/cli/src/commands/app/dev.ts
+++ b/cli/src/commands/app/dev.ts
@@ -14,7 +14,8 @@ import * as path from "node:path";
 import process from "node:process";
 import { Buffer } from "node:buffer";
 import { writeFileSync } from "node:fs";
-import { readTextFile } from "../../utils/utils.ts";
+import { getHeaders, readTextFile } from "../../utils/utils.ts";
+import { detectAuthGatewayChallenge } from "../../utils/http_guards.ts";
 import { WebSocket, WebSocketServer } from "ws";
 import {
   createFrameworkPlugins,
@@ -1714,13 +1715,17 @@ async function streamJobWithSSE(
   const sseUrl =
     `${baseUrl}api/w/${workspace}/jobs_u/getupdate_sse/${jobId}?fast=true`;
 
+  const extraHeaders = getHeaders();
   const response = await fetch(sseUrl, {
     headers: {
       Accept: "text/event-stream",
       Authorization: `Bearer ${token}`,
+      ...extraHeaders,
     },
   });
 
+  await detectAuthGatewayChallenge(response, sseUrl);
+
   if (!response.ok) {
     throw new Error(
       `SSE request failed: ${response.status} ${response.statusText}`,
diff --git a/cli/src/commands/app/new.ts b/cli/src/commands/app/new.ts
index 2072c0312c..87d40f161b 100644
--- a/cli/src/commands/app/new.ts
+++ b/cli/src/commands/app/new.ts
@@ -168,7 +168,7 @@ const templates: Record<string, FrameworkTemplate> = {
       "/index.css": indexCss,
       "/package.json": `{
     "dependencies": {
-        "svelte": "5.45.2",
+        "svelte": "^5.55.5",
         "windmill-client": "^1"
     }
 }`,
diff --git a/cli/src/commands/docs/docs.ts b/cli/src/commands/docs/docs.ts
index d86d4ca367..fed91201e0 100644
--- a/cli/src/commands/docs/docs.ts
+++ b/cli/src/commands/docs/docs.ts
@@ -4,6 +4,8 @@ import * as log from "../../core/log.ts";
 import { requireLogin } from "../../core/auth.ts";
 import { resolveWorkspace } from "../../core/context.ts";
 import { GlobalOptions } from "../../types.ts";
+import { getHeaders } from "../../utils/utils.ts";
+import { detectAuthGatewayChallenge } from "../../utils/http_guards.ts";
 
 interface DocContentItem {
   title: string;
@@ -36,6 +38,7 @@ async function docs(
 
   console.log(colors.bold(`\nSearching Windmill docs...\n`));
 
+  const extraHeaders = getHeaders();
   let res: Response;
   try {
     res = await fetch(url, {
@@ -43,6 +46,7 @@ async function docs(
       headers: {
         "Content-Type": "application/json",
         Authorization: `Bearer ${workspace.token}`,
+        ...extraHeaders,
       },
       body: JSON.stringify({ query }),
     });
@@ -50,6 +54,8 @@ async function docs(
     throw new Error(`Network error connecting to ${workspace.remote}: ${e}`);
   }
 
+  await detectAuthGatewayChallenge(res, url);
+
   if (res.status === 403) {
     log.info(
       "Windmill documentation search is an Enterprise Edition feature. Please upgrade to use this command."
diff --git a/cli/src/commands/generate-metadata/generate-metadata.ts b/cli/src/commands/generate-metadata/generate-metadata.ts
index 226220592e..1de173e582 100644
--- a/cli/src/commands/generate-metadata/generate-metadata.ts
+++ b/cli/src/commands/generate-metadata/generate-metadata.ts
@@ -8,6 +8,8 @@ import { resolveWorkspace } from "../../core/context.ts";
 import { requireLogin } from "../../core/auth.ts";
 import * as log from "../../core/log.ts";
 import {
+  beginLockfileBatch,
+  flushLockfileBatch,
   generateScriptMetadataInternal,
   getRawWorkspaceDependencies,
   readLockfile,
@@ -200,6 +202,12 @@ export async function rehashOnly(
   const stubWorkspace = {} as any;
   const rehashOpts = { ...opts, rehashOnly: true } as any;
 
+  type RehashTask =
+    | { kind: "script"; scriptPath: string }
+    | { kind: "flow"; folder: string }
+    | { kind: "app"; folder: string; rawApp: boolean };
+  const queue: RehashTask[] = [];
+
   if (!rehashFilter?.skipScripts) {
     for (const e of scriptPaths) {
       // Filter against the derived remote path so a folder argument like
@@ -210,14 +218,7 @@ export async function rehashOnly(
       if (rehashFilter?.missingOnly) {
         if (skipIfExisting(remotePath) || skipIfExisting(remotePath, "__script_hash")) continue;
       }
-      try {
-        await generateScriptMetadataInternal(
-          e, stubWorkspace, rehashOpts, false, true, {}, codebases, false,
-        );
-        counts.scripts++;
-      } catch (err) {
-        log.warn(`Skipping ${e}: ${err instanceof Error ? err.message : err}`);
-      }
+      queue.push({ kind: "script", scriptPath: e });
     }
   }
 
@@ -228,12 +229,7 @@ export async function rehashOnly(
         const folderNormalized = f.replaceAll(SEP, "/");
         if (skipIfExisting(folderNormalized, "__flow_hash")) continue;
       }
-      try {
-        await generateFlowLockInternal(f, false, stubWorkspace, rehashOpts, false, true);
-        counts.flows++;
-      } catch (err) {
-        log.warn(`Skipping ${f}: ${err instanceof Error ? err.message : err}`);
-      }
+      queue.push({ kind: "flow", folder: f });
     }
   }
 
@@ -244,13 +240,52 @@ export async function rehashOnly(
         const folderNormalized = appFolder.replaceAll(SEP, "/");
         if (skipIfExisting(folderNormalized, "__app_hash")) continue;
       }
-      try {
-        await generateAppLocksInternal(appFolder, rawApp, false, stubWorkspace, rehashOpts, false, true);
-        counts.apps++;
-      } catch (err) {
-        log.warn(`Skipping ${appFolder}: ${err instanceof Error ? err.message : err}`);
+      queue.push({ kind: "app", folder: appFolder, rawApp });
+    }
+  }
+
+  let parallelism = Number(opts.parallel ?? 1);
+  if (!Number.isFinite(parallelism) || parallelism <= 0) parallelism = 1;
+  if (parallelism > 1) {
+    log.info(`Parallelizing ${parallelism} items at a time`);
+  }
+
+  // Buffer wmill-lock.yaml writes during the parallel phase: each task mutates
+  // the shared in-memory lockfile, then we flush once.
+  await beginLockfileBatch();
+  try {
+    const pool = new Set<Promise<void>>();
+    while (queue.length > 0 || pool.size > 0) {
+      while (pool.size < parallelism && queue.length > 0) {
+        const task = queue.shift()!;
+        const p = (async () => {
+          try {
+            if (task.kind === "script") {
+              await generateScriptMetadataInternal(
+                task.scriptPath, stubWorkspace, rehashOpts, false, true, {}, codebases, false,
+              );
+              counts.scripts++;
+            } else if (task.kind === "flow") {
+              await generateFlowLockInternal(task.folder, false, stubWorkspace, rehashOpts, false, true);
+              counts.flows++;
+            } else {
+              await generateAppLocksInternal(task.folder, task.rawApp, false, stubWorkspace, rehashOpts, false, true);
+              counts.apps++;
+            }
+          } catch (err) {
+            const label = task.kind === "script" ? task.scriptPath : task.folder;
+            log.warn(`Skipping ${label}: ${err instanceof Error ? err.message : err}`);
+          }
+        })();
+        pool.add(p);
+        p.then(() => pool.delete(p));
+      }
+      if (pool.size > 0) {
+        await Promise.race(pool);
       }
     }
+  } finally {
+    await flushLockfileBatch();
   }
 
   if (counts.scripts + counts.flows + counts.apps > 0 || !rehashFilter?.missingOnly) {
@@ -519,85 +554,117 @@ export async function generateMetadata(
 
   const errors: { path: string; error: string }[] = [];
 
-  // Process scripts
-  for (const item of scripts) {
-    current++;
-    log.info(`${formatProgress(current)} script ${item.path}`);
-    try {
-      await generateScriptMetadataInternal(
-        item.path, // originalPath with extension
-        workspace,
-        opts,
-        false, // dryRun
-        true, // noStaleMessage
-        mismatchedWorkspaceDeps,
-        codebases,
-        false,
-        tree
-      );
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      errors.push({ path: item.path, error: msg });
-      log.error(`  Failed: ${msg}`);
-    }
+  let parallelism = Number(opts.parallel ?? 1);
+  if (!Number.isFinite(parallelism) || parallelism <= 0) parallelism = 1;
+  if (parallelism > 1) {
+    log.info(`Parallelizing ${parallelism} items at a time`);
   }
 
-  // Process flows
-  for (const item of flows) {
-    current++;
-    try {
-      const result = await generateFlowLockInternal(
-        item.folder.replaceAll("/", SEP),
-        false, // dryRun
-        workspace,
-        opts,
-        false,
-        true, // noStaleMessage
-        tree
-      );
-      const flowResult = result as FlowLocksResult | undefined;
-      const scriptsInfo = flowResult?.updatedScripts?.length
-        ? colors.dim(colors.white(`: ${flowResult.updatedScripts.join(", ")}`))
-        : "";
-      log.info(`${formatProgress(current)} flow   ${item.path}${scriptsInfo}`);
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      errors.push({ path: item.path, error: msg });
-      log.info(`${formatProgress(current)} flow   ${item.path}`);
-      log.error(`  Failed: ${msg}`);
-    }
-  }
+  type Task =
+    | { kind: "script"; item: StaleItem }
+    | { kind: "flow"; item: StaleItem }
+    | { kind: "app"; item: StaleItem };
+  const queue: Task[] = [
+    ...scripts.map<Task>((item) => ({ kind: "script", item })),
+    ...flows.map<Task>((item) => ({ kind: "flow", item })),
+    ...apps.map<Task>((item) => ({ kind: "app", item })),
+  ];
 
-  // Process apps
-  for (const item of apps) {
-    current++;
-    try {
-      const result = await generateAppLocksInternal(
-        item.folder.replaceAll("/", SEP),
-        item.isRawApp!, // rawApp
-        false, // dryRun
-        workspace,
-        opts,
-        false,
-        true, // noStaleMessage
-        tree
-      );
-      const appResult = result as AppLocksResult | undefined;
-      const scriptsInfo = appResult?.updatedScripts?.length
-        ? colors.dim(colors.white(`: ${appResult.updatedScripts.join(", ")}`))
-        : "";
-      log.info(`${formatProgress(current)} app    ${item.path}${scriptsInfo}`);
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      errors.push({ path: item.path, error: msg });
-      log.info(`${formatProgress(current)} app    ${item.path}`);
-      log.error(`  Failed: ${msg}`);
+  // Buffer wmill-lock.yaml writes during the parallel phase: each task mutates
+  // the shared in-memory lockfile via clearGlobalLock/updateMetadataGlobalLock,
+  // then we flush once. Without this buffering, two workers' read-modify-write
+  // cycles would race and lose hashes.
+  await beginLockfileBatch();
+  try {
+    const pool = new Set<Promise<void>>();
+    while (queue.length > 0 || pool.size > 0) {
+      while (pool.size < parallelism && queue.length > 0) {
+        const task = queue.shift()!;
+        const taskNumber = ++current;
+        const p = (async () => {
+          if (task.kind === "script") {
+            const item = task.item;
+            log.info(`${formatProgress(taskNumber)} script ${item.path}`);
+            try {
+              await generateScriptMetadataInternal(
+                item.path, // originalPath with extension
+                workspace,
+                opts,
+                false, // dryRun
+                true, // noStaleMessage
+                mismatchedWorkspaceDeps,
+                codebases,
+                false,
+                tree
+              );
+            } catch (e) {
+              const msg = e instanceof Error ? e.message : String(e);
+              errors.push({ path: item.path, error: msg });
+              log.error(`  Failed: ${msg}`);
+            }
+          } else if (task.kind === "flow") {
+            const item = task.item;
+            try {
+              const result = await generateFlowLockInternal(
+                item.folder.replaceAll("/", SEP),
+                false, // dryRun
+                workspace,
+                opts,
+                false,
+                true, // noStaleMessage
+                tree
+              );
+              const flowResult = result as FlowLocksResult | undefined;
+              const scriptsInfo = flowResult?.updatedScripts?.length
+                ? colors.dim(colors.white(`: ${flowResult.updatedScripts.join(", ")}`))
+                : "";
+              log.info(`${formatProgress(taskNumber)} flow   ${item.path}${scriptsInfo}`);
+            } catch (e) {
+              const msg = e instanceof Error ? e.message : String(e);
+              errors.push({ path: item.path, error: msg });
+              log.info(`${formatProgress(taskNumber)} flow   ${item.path}`);
+              log.error(`  Failed: ${msg}`);
+            }
+          } else {
+            const item = task.item;
+            try {
+              const result = await generateAppLocksInternal(
+                item.folder.replaceAll("/", SEP),
+                item.isRawApp!, // rawApp
+                false, // dryRun
+                workspace,
+                opts,
+                false,
+                true, // noStaleMessage
+                tree
+              );
+              const appResult = result as AppLocksResult | undefined;
+              const scriptsInfo = appResult?.updatedScripts?.length
+                ? colors.dim(colors.white(`: ${appResult.updatedScripts.join(", ")}`))
+                : "";
+              log.info(`${formatProgress(taskNumber)} app    ${item.path}${scriptsInfo}`);
+            } catch (e) {
+              const msg = e instanceof Error ? e.message : String(e);
+              errors.push({ path: item.path, error: msg });
+              log.info(`${formatProgress(taskNumber)} app    ${item.path}`);
+              log.error(`  Failed: ${msg}`);
+            }
+          }
+        })();
+        pool.add(p);
+        p.then(() => pool.delete(p));
+      }
+      if (pool.size > 0) {
+        await Promise.race(pool);
+      }
     }
-  }
 
-  // Persist all stale workspace dep hashes (not just filtered — deps are global, not folder-scoped)
-  const allStaleDeps = staleItems.filter((i) => i.type === "dependencies");
-  await tree.persistDepsHashes(allStaleDeps.map((d) => d.path));
+    // Persist all stale workspace dep hashes (not just filtered — deps are global, not folder-scoped)
+    const allStaleDeps = staleItems.filter((i) => i.type === "dependencies");
+    await tree.persistDepsHashes(allStaleDeps.map((d) => d.path));
+  } finally {
+    await flushLockfileBatch();
+  }
 
   const succeeded = total - errors.length;
   log.info("");
@@ -640,6 +707,7 @@ const command = new Command()
   .option("--skip-flows", "Skip processing flows")
   .option("--skip-apps", "Skip processing apps")
   .option("--strict-folder-boundaries", "Only update items inside the specified folder (requires folder argument)")
+  .option("--parallel <n:number>", "Number of items to process in parallel")
   .option(
     "-i --includes <patterns:file[]>",
     "Comma separated patterns to specify which files to include"
@@ -661,6 +729,7 @@ const command = new Command()
       .option("--skip-scripts", "Skip processing scripts")
       .option("--skip-flows", "Skip processing flows")
       .option("--skip-apps", "Skip processing apps")
+      .option("--parallel <n:number>", "Number of items to process in parallel")
       .option(
         "-i --includes <patterns:file[]>",
         "Comma separated patterns to specify which files to include"
diff --git a/cli/src/commands/script/script.ts b/cli/src/commands/script/script.ts
index 0635cd42ea..f1e605d8ff 100644
--- a/cli/src/commands/script/script.ts
+++ b/cli/src/commands/script/script.ts
@@ -12,7 +12,8 @@ import * as log from "../../core/log.ts";
 import { sep as SEP } from "node:path";
 import * as path from "node:path";
 import { stringify as yamlStringify } from "yaml";
-import { deepEqual, readTextFile, readTextFileSync } from "../../utils/utils.ts";
+import { deepEqual, getHeaders, readTextFile, readTextFileSync } from "../../utils/utils.ts";
+import { detectAuthGatewayChallenge } from "../../utils/http_guards.ts";
 import * as wmill from "../../../gen/services.gen.ts";
 import * as specificItems from "../../core/specific_items.ts";
 import { getCurrentGitBranch } from "../../utils/git.ts";
@@ -725,6 +726,7 @@ async function createScript(
   // (same content, lockfile, and metadata) as a no-op, so the CLI does not
   // produce phantom git-sync / promotion commits on re-pushes.
   const skipIfNoop = "skip_if_noop=true";
+  const extraHeaders = getHeaders();
   if (!bundleContent) {
     try {
       const url =
@@ -738,9 +740,11 @@ async function createScript(
         headers: {
           Authorization: `Bearer ${workspace.token}`,
           "Content-Type": "application/json",
+          ...extraHeaders,
         },
         body: JSON.stringify(body),
       });
+      await detectAuthGatewayChallenge(req, url);
       if (req.status != 201) {
         throw Error(
           `${req.status} - ${req.statusText} - ${await req.text()}`
@@ -771,9 +775,13 @@ async function createScript(
       skipIfNoop;
     const req = await fetch(url, {
       method: "POST",
-      headers: { Authorization: `Bearer ${workspace.token} ` },
+      headers: {
+        Authorization: `Bearer ${workspace.token} `,
+        ...extraHeaders,
+      },
       body: form,
     });
+    await detectAuthGatewayChallenge(req, url);
     if (req.status != 201) {
       throw Error(
         `Script snapshot creation was not successful: ${req.status} - ${
@@ -1587,12 +1595,18 @@ async function preview(
       workspace.workspaceId +
       "/jobs/run/preview_bundle";
 
+    const extraHeaders = getHeaders();
     const response = await fetch(url, {
       method: "POST",
-      headers: { Authorization: `Bearer ${workspace.token}` },
+      headers: {
+        Authorization: `Bearer ${workspace.token}`,
+        ...extraHeaders,
+      },
       body: form,
     });
 
+    await detectAuthGatewayChallenge(response, url);
+
     if (!response.ok) {
       throw new Error(
         `Preview failed: ${response.status} - ${response.statusText} - ${await response.text()}`
diff --git a/cli/src/guidance/skills.gen.ts b/cli/src/guidance/skills.gen.ts
index 3eb1c872cc..2b0962e09d 100644
--- a/cli/src/guidance/skills.gen.ts
+++ b/cli/src/guidance/skills.gen.ts
@@ -5420,15 +5420,15 @@ Reference a specific resource using \`$res:\` prefix:
 
 ## OpenFlow Schema
 
-{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \\"yellow\\", \\"#ffff00\\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside loops, use 'flow_input.iter.value' for the current iteration value","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly while a condition is true. The loop checks the condition after each iteration. Use stop_after_if on modules to control loop termination","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration. Use stop_after_if to control when the loop ends","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n"}},"required":["provider","user_message","output_type"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["tools","type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}`,
+{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \\"yellow\\", \\"#ffff00\\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside loops, use 'flow_input.iter.value' for the current iteration value","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly while a condition is true. The loop checks the condition after each iteration. Use stop_after_if on modules to control loop termination","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration. Use stop_after_if to control when the loop ends","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\\nRange: 1-1000.\\n"}},"required":["provider","user_message","output_type"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["tools","type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}`,
   "raw-app": `---
 name: raw-app
 description: MUST use when creating raw apps.
 ---
 
-# Windmill Raw Apps
+# Windmill Raw Apps — CLI workflow
 
-Raw apps let you build custom frontends with React, Svelte, or Vue that connect to Windmill backend runnables and datatables.
+This guide covers raw apps from the terminal: scaffolding via \`wmill app new\`, the on-disk layout, and the file-based conventions the CLI uses to represent backend runnables and data table configuration. The platform shape (how a raw app behaves at runtime — frontend bundling, runnable types, datatable SDK calls) is covered in the companion authoring guide.
 
 ## Creating a Raw App
 
@@ -5497,7 +5497,7 @@ wmill app new
 
 This is the wizard. It only works when run by a human in a real terminal. Don't call it this way from an agent.
 
-## App Structure
+## On-disk app layout
 
 \`\`\`
 my_app{{RAW_APP_SUFFIX}}/
@@ -5517,11 +5517,7 @@ my_app{{RAW_APP_SUFFIX}}/
     └── *.sql              # SQL files to apply via dev server
 \`\`\`
 
-## Backend Runnables
-
-Backend runnables are server-side scripts that your frontend can call. They live in the \`backend/\` folder.
-
-### Creating a Backend Runnable
+## Backend runnables on disk
 
 Add a code file to the \`backend/\` folder:
 
@@ -5531,7 +5527,7 @@ backend/<id>.<ext>
 
 The runnable ID is the filename without extension. For example, \`get_user.ts\` creates a runnable with ID \`get_user\`.
 
-### Supported Languages
+### Supported languages (extension-driven)
 
 | Language         | Extension    | Example          |
 |------------------|--------------|------------------|
@@ -5553,27 +5549,14 @@ The runnable ID is the filename without extension. For example, \`get_user.ts\`
 | C#               | \`.cs\`        | \`myFunc.cs\`      |
 | Java             | \`.java\`      | \`myFunc.java\`    |
 
-### Example Backend Runnable
-
-**backend/get_user.ts:**
-\`\`\`typescript
-import * as wmill from 'windmill-client';
-
-export async function main(user_id: string) {
-  const sql = wmill.datatable();
-  const user = await sql\`SELECT * FROM users WHERE id = \${user_id}\`.fetchOne();
-  return user;
-}
-\`\`\`
-
-After creating, tell the user they can generate lock files by running:
+After creating a runnable, tell the user they can generate lock files by running:
 \`\`\`bash
 wmill generate-metadata
 \`\`\`
 
-### Optional YAML Configuration
+### Optional YAML configuration
 
-Add a \`<id>.yaml\` file to configure fields or static values:
+Add a \`<id>.yaml\` file alongside the code to configure fields or static values:
 
 **backend/get_user.yaml:**
 \`\`\`yaml
@@ -5584,7 +5567,7 @@ fields:
     value: "default_user"
 \`\`\`
 
-### Referencing Existing Scripts
+### Referencing existing scripts
 
 To use an existing Windmill script instead of inline code:
 
@@ -5600,32 +5583,9 @@ type: flow
 path: f/my_folder/my_flow
 \`\`\`
 
-### Calling Backend from Frontend
+## Data tables — \`raw_app.yaml\` config
 
-Import from the auto-generated \`wmill.ts\`:
-
-\`\`\`typescript
-import { backend } from './wmill';
-
-// Call a backend runnable
-const user = await backend.get_user({ user_id: '123' });
-\`\`\`
-
-The \`wmill.ts\` file provides type-safe access to all backend runnables.
-
-## Data Tables
-
-Raw apps can query Windmill datatables (PostgreSQL databases managed by Windmill).
-
-### Critical Rules
-
-1. **ONLY USE WHITELISTED TABLES**: You can ONLY query tables listed in \`raw_app.yaml\` → \`data.tables\`. Tables not in this list are NOT accessible.
-
-2. **ADD TABLES BEFORE USING**: To use a new table, first add it to \`data.tables\` in \`raw_app.yaml\`.
-
-3. **USE CONFIGURED DATATABLE/SCHEMA**: Check the app's \`raw_app.yaml\` for the default datatable and schema.
-
-### Configuration in raw_app.yaml
+The \`data\` block in \`raw_app.yaml\` controls which tables the app can query.
 
 \`\`\`yaml
 data:
@@ -5637,9 +5597,153 @@ data:
 \`\`\`
 
 **Table reference formats:**
-- \`<datatable>\` - All tables in the datatable
-- \`<datatable>/<table>\` - Specific table in public schema
-- \`<datatable>/<schema>:<table>\` - Table in specific schema
+- \`<datatable>\` — All tables in the datatable
+- \`<datatable>/<table>\` — Specific table in public schema
+- \`<datatable>/<schema>:<table>\` — Table in specific schema
+
+## SQL Migrations (sql_to_apply/)
+
+The \`sql_to_apply/\` folder is for creating/modifying database tables during development.
+
+### Workflow
+
+1. Create \`.sql\` files in \`sql_to_apply/\`
+2. Run \`wmill app dev\` — the dev server watches this folder
+3. When SQL files change, a modal appears in the browser to confirm execution
+4. After creating tables, **add them to \`data.tables\`** in \`raw_app.yaml\`
+
+### Example migration
+
+**sql_to_apply/001_create_users.sql:**
+\`\`\`sql
+CREATE TABLE IF NOT EXISTS users (
+    id SERIAL PRIMARY KEY,
+    email TEXT NOT NULL UNIQUE,
+    name TEXT,
+    created_at TIMESTAMP DEFAULT NOW()
+);
+\`\`\`
+
+After applying, add to \`raw_app.yaml\`:
+\`\`\`yaml
+data:
+  tables:
+    - main/users
+\`\`\`
+
+### Migration best practices
+
+- **Use idempotent SQL**: \`CREATE TABLE IF NOT EXISTS\`, etc.
+- **Number files**: \`001_\`, \`002_\` for ordering
+- **Always whitelist tables** after creation
+- This folder is NOT synced — it's for local development only
+
+## CLI Commands
+
+\`wmill app new\` is the exception: you run it yourself, with flags, per the "Creating a Raw App" section above.
+
+For everything else, tell the user which command fits their intent and let them run it — these touch the workspace or local lock files, and the user should consent each time:
+
+| Command | Description |
+|---------|-------------|
+| \`wmill app dev\` | Start dev server with live reload (see the \`preview\` skill for the full open-the-app-in-the-IDE-pane procedure). |
+| \`wmill app generate-agents\` | Refresh AGENTS.md and DATATABLES.md |
+| \`wmill generate-metadata\` | Generate lock files for backend runnables |
+| \`wmill sync push\` | Deploy app to Windmill |
+| \`wmill sync pull\` | Pull latest from Windmill |
+
+
+
+# Windmill Raw Apps
+
+Raw apps let you build custom frontends with React, Svelte, or Vue that connect to Windmill backend runnables and datatables.
+
+## App shape
+
+A raw app has three logical parts:
+
+- **Frontend** — bundled with esbuild from \`index.tsx\` as the entrypoint. Files include the entrypoint, components (\`App.tsx\`), styles, etc.
+- **Backend runnables** — server-side scripts the frontend calls, each addressed by a unique key.
+- **Data** — optional whitelisted datatables (managed PostgreSQL) that the backend runnables can query. The frontend never queries the database directly; backend runnables are the only bridge.
+
+## Frontend
+
+### Entrypoint
+
+\`index.tsx\` is the bundling entrypoint. It typically renders a top-level \`App\` component. The bundler is esbuild.
+
+### Generated bindings (\`wmill.d.ts\` / \`wmill.ts\`)
+
+The frontend imports a generated module that mirrors the backend runnables. **Never write to it directly** — it gets regenerated whenever backend runnables change. Modifying it by hand will be overwritten.
+
+### Calling backend runnables
+
+Import the generated bindings and call the runnable like a function:
+
+\`\`\`typescript
+import { backend } from './wmill';
+
+// Call a backend runnable
+const user = await backend.get_user({ user_id: '123' });
+\`\`\`
+
+The frontend cannot reach datatables, workspace items, or external services on its own — it goes through \`backend.<key>(args)\` for everything server-side.
+
+## Backend runnables
+
+Each runnable has a unique key (used to call it from the frontend) and one of four types:
+
+| Type | What it is |
+|---|---|
+| \`inline\` | Custom code stored on the app itself. Most common for app-specific logic. |
+| \`script\` | Reference to an existing workspace script by path. |
+| \`flow\` | Reference to an existing workspace flow by path. |
+| \`hubscript\` | Reference to a hub script by path. |
+
+### Inline runnables
+
+Inline runnables carry their own source code. For file-based raw apps, the runnable language is determined by the backend file extension. The script must expose a \`main\` function as its entrypoint.
+
+**TypeScript example** (\`backend/get_user.ts\`):
+
+\`\`\`typescript
+import * as wmill from 'windmill-client';
+
+export async function main(user_id: string) {
+  const sql = wmill.datatable();
+  const user = await sql\`SELECT * FROM users WHERE id = \${user_id}\`.fetchOne();
+  return user;
+}
+\`\`\`
+
+**Python example** (\`backend/get_user.py\`):
+
+\`\`\`python
+import wmill
+
+def main(user_id: str):
+    db = wmill.datatable()
+    user = db.query('SELECT * FROM users WHERE id = $1', user_id).fetch_one()
+    return user
+\`\`\`
+
+### Path runnables (script / flow / hubscript)
+
+When \`type\` is \`script\`, \`flow\`, or \`hubscript\`, the runnable just stores a \`path\` to an existing workspace or hub item — no inline code. The referenced item's input/output schema becomes the runnable's surface.
+
+### Static inputs
+
+\`staticInputs\` is an optional \`Record<string, any>\` for arguments not overridable from the frontend. Useful with path runnables to pre-fill some args while leaving the rest to the frontend caller.
+
+## Data Tables
+
+Data tables are PostgreSQL databases managed by Windmill. Backend runnables query them via the \`wmill\` client; the frontend never queries them directly.
+
+### Critical rules
+
+1. **Whitelisted tables only**: a runnable can only query tables listed in the app's \`data.tables\` config. Tables not in this list are not accessible.
+2. **Add tables before using**: queries against unlisted tables fail at runtime. When you introduce a new table, register it in \`data.tables\` first.
+3. **Use the configured datatable/schema**: the app's \`data\` config sets the default datatable and schema; reference them consistently across runnables.
 
 ### Querying in TypeScript (Bun/Deno)
 
@@ -5680,65 +5784,13 @@ def main(user_id: str):
     return user
 \`\`\`
 
-## SQL Migrations (sql_to_apply/)
-
-The \`sql_to_apply/\` folder is for creating/modifying database tables during development.
-
-### Workflow
-
-1. Create \`.sql\` files in \`sql_to_apply/\`
-2. Run \`wmill app dev\` - the dev server watches this folder
-3. When SQL files change, a modal appears in the browser to confirm execution
-4. After creating tables, **add them to \`data.tables\`** in \`raw_app.yaml\`
-
-### Example Migration
-
-**sql_to_apply/001_create_users.sql:**
-\`\`\`sql
-CREATE TABLE IF NOT EXISTS users (
-    id SERIAL PRIMARY KEY,
-    email TEXT NOT NULL UNIQUE,
-    name TEXT,
-    created_at TIMESTAMP DEFAULT NOW()
-);
-\`\`\`
-
-After applying, add to \`raw_app.yaml\`:
-\`\`\`yaml
-data:
-  tables:
-    - main/users
-\`\`\`
-
-### Migration Best Practices
-
-- **Use idempotent SQL**: \`CREATE TABLE IF NOT EXISTS\`, etc.
-- **Number files**: \`001_\`, \`002_\` for ordering
-- **Always whitelist tables** after creation
-- This folder is NOT synced - it's for local development only
-
-## CLI Commands
-
-\`wmill app new\` is the exception: you run it yourself, with flags, per the "Creating a Raw App" section above.
-
-For everything else, tell the user which command fits their intent and let them run it — these touch the workspace or local lock files, and the user should consent each time:
-
-| Command | Description |
-|---------|-------------|
-| \`wmill app dev\` | Start dev server with live reload (see the \`preview\` skill for the full open-the-app-in-the-IDE-pane procedure). |
-| \`wmill app generate-agents\` | Refresh AGENTS.md and DATATABLES.md |
-| \`wmill generate-metadata\` | Generate lock files for backend runnables |
-| \`wmill sync push\` | Deploy app to Windmill |
-| \`wmill sync pull\` | Pull latest from Windmill |
-
 ## Best Practices
 
-1. **Check DATATABLES.md** for existing tables before creating new ones
-2. **Use parameterized queries** - never concatenate user input into SQL
-3. **Keep runnables focused** - one function per file
-4. **Use descriptive IDs** - \`get_user.ts\` not \`a.ts\`
-5. **Always whitelist tables** - add to \`data.tables\` before querying
-6. **Generate locks** - tell the user to run \`wmill generate-metadata\` after adding/modifying backend runnables
+1. **Check existing tables** before creating new ones — reuse beats schema growth.
+2. **Use parameterized queries** — never concatenate user input into SQL.
+3. **Keep runnables focused** — one function per runnable; small surface area.
+4. **Use descriptive keys** — \`get_user\`, not \`a\`.
+5. **Always whitelist tables** — adding a runnable that queries a new table requires the table to be in \`data.tables\` first.
 `,
   "triggers": `---
 name: triggers
@@ -6588,7 +6640,7 @@ app related commands
   - \`--json\` - Output as JSON (for piping to jq)
 - \`app get <path:string>\` - get an app's details
   - \`--json\` - Output as JSON (for piping to jq)
-- \`app push <file_path:string> <remote_path:string>\` - push a local app 
+- \`app push [file_path:string] [remote_path:string]\` - push a local app. With no args, infers the app from the current directory and the remote path from its location relative to wmill.yaml.
 - \`app dev [app_folder:string]\` - Start a development server for building apps with live reload and hot module replacement
   - \`--port <port:number>\` - Port to run the dev server on (will find next available port if occupied)
   - \`--host <host:string>\` - Host to bind the dev server to
@@ -6730,6 +6782,7 @@ Generate metadata (locks, schemas) for all scripts, flows, and apps
 - \`--skip-flows\` - Skip processing flows
 - \`--skip-apps\` - Skip processing apps
 - \`--strict-folder-boundaries\` - Only update items inside the specified folder (requires folder argument)
+- \`--parallel <n:number>\` - Number of items to process in parallel
 - \`-i --includes <patterns:file[]>\` - Comma separated patterns to specify which files to include
 - \`-e --excludes <patterns:file[]>\` - Comma separated patterns to specify which files to exclude
 
@@ -6739,6 +6792,7 @@ Generate metadata (locks, schemas) for all scripts, flows, and apps
   - \`--skip-scripts\` - Skip processing scripts
   - \`--skip-flows\` - Skip processing flows
   - \`--skip-apps\` - Skip processing apps
+  - \`--parallel <n:number>\` - Number of items to process in parallel
   - \`-i --includes <patterns:file[]>\` - Comma separated patterns to specify which files to include
   - \`-e --excludes <patterns:file[]>\` - Comma separated patterns to specify which files to exclude
 
diff --git a/cli/src/main.ts b/cli/src/main.ts
index 3d9a15dfd9..a755c16901 100755
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -79,7 +79,7 @@ export {
   token,
 };
 
-export const VERSION = "1.697.0";
+export const VERSION = "1.700.2";
 
 // Re-exported from constants.ts to maintain backwards compatibility
 export { WM_FORK_PREFIX } from "./core/constants.ts";
diff --git a/cli/src/utils/metadata.ts b/cli/src/utils/metadata.ts
index 456336dae2..9668dd19e6 100644
--- a/cli/src/utils/metadata.ts
+++ b/cli/src/utils/metadata.ts
@@ -1202,7 +1202,32 @@ export function normalizeLockPath(p: string): string {
   return n;
 }
 
+// When set, `clearGlobalLock` and `updateMetadataGlobalLock` mutate this
+// in-memory copy instead of doing a full read-modify-write on disk for every
+// call. Callers that fan out item processing through a worker pool wrap the
+// pool with `beginLockfileBatch()`/`flushLockfileBatch()` so the lockfile is
+// only written once at the end — see `generate-metadata` parallelism.
+let inMemoryLock: Lock | null = null;
+
+export async function beginLockfileBatch(): Promise<void> {
+  if (inMemoryLock) return;
+  inMemoryLock = await readLockfile();
+}
+
+export async function flushLockfileBatch(): Promise<void> {
+  if (!inMemoryLock) return;
+  // Write first, then clear: if the disk write throws (e.g. ENOSPC), the
+  // buffered updates remain in memory and a retry can re-attempt the flush.
+  await writeFile(
+    WMILL_LOCKFILE,
+    yamlStringify(inMemoryLock as Record<string, any>, yamlOptions),
+    "utf-8",
+  );
+  inMemoryLock = null;
+}
+
 export async function readLockfile(): Promise<Lock> {
+  if (inMemoryLock) return inMemoryLock;
   let parsed: unknown;
   try {
     parsed = await yamlParseFile(WMILL_LOCKFILE);
@@ -1344,11 +1369,13 @@ export async function clearGlobalLock(path: string): Promise<void> {
         }
       });
     }
-    await writeFile(
-      WMILL_LOCKFILE,
-      yamlStringify(conf as Record<string, any>, yamlOptions),
-      "utf-8"
-    );
+    if (!inMemoryLock) {
+      await writeFile(
+        WMILL_LOCKFILE,
+        yamlStringify(conf as Record<string, any>, yamlOptions),
+        "utf-8"
+      );
+    }
   }
 }
 
@@ -1377,9 +1404,11 @@ export async function updateMetadataGlobalLock(
       conf.locks[path] = hash;
     }
   }
-  await writeFile(
-    WMILL_LOCKFILE,
-    yamlStringify(conf as Record<string, any>, yamlOptions),
-    "utf-8"
-  );
+  if (!inMemoryLock) {
+    await writeFile(
+      WMILL_LOCKFILE,
+      yamlStringify(conf as Record<string, any>, yamlOptions),
+      "utf-8"
+    );
+  }
 }
diff --git a/cli/test/headers_env_var.test.ts b/cli/test/headers_env_var.test.ts
new file mode 100644
index 0000000000..72fdf4103f
--- /dev/null
+++ b/cli/test/headers_env_var.test.ts
@@ -0,0 +1,264 @@
+/**
+ * Integration test: HEADERS env var is forwarded on every CLI fetch call.
+ *
+ * Spins up an auth-gateway proxy in front of the test backend that:
+ *   - 403s + Cloudflare-style HTML if the request is missing CF-Access-Client-Id /
+ *     CF-Access-Client-Secret (mirrors the real-world Cloudflare Access challenge),
+ *   - otherwise reverse-proxies to the backend.
+ *
+ * Then runs `wmill sync push` with --base-url pointed at the proxy. If any fetch
+ * in the CLI bypasses HEADERS, the proxy returns the challenge page and the push
+ * fails (or the request is logged as un-authenticated). Negative case verifies
+ * the gateway actually rejects un-headered requests, so a passing positive case
+ * is meaningful.
+ *
+ * Regression coverage for #6421 and the script.ts pushScript /
+ * jobs/run/preview_bundle / app dev SSE fetch calls that used to skip getHeaders().
+ */
+
+import { expect, test } from "bun:test";
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import type { Server } from "bun";
+import { withTestBackend } from "./test_backend.ts";
+
+const HEADER_NAMES = ["CF-Access-Client-Id", "CF-Access-Client-Secret"] as const;
+const HEADER_VALUES = {
+  "CF-Access-Client-Id": "test-cf-id",
+  "CF-Access-Client-Secret": "test-cf-secret",
+} as const;
+
+const HEADERS_ENV = HEADER_NAMES
+  .map((h) => `${h}: ${HEADER_VALUES[h]}`)
+  .join(", ");
+
+interface ProxyState {
+  authenticatedRequests: { method: string; path: string }[];
+  rejectedRequests: { method: string; path: string }[];
+}
+
+interface RunningProxy {
+  server: Server;
+  state: ProxyState;
+  url: string;
+}
+
+function startGatewayProxy(backendUrl: string): RunningProxy {
+  const state: ProxyState = {
+    authenticatedRequests: [],
+    rejectedRequests: [],
+  };
+
+  const server = Bun.serve({
+    port: 0,
+    hostname: "127.0.0.1",
+    async fetch(req) {
+      const reqUrl = new URL(req.url);
+      const pathAndQuery = reqUrl.pathname + reqUrl.search;
+
+      const id = req.headers.get("cf-access-client-id");
+      const secret = req.headers.get("cf-access-client-secret");
+      const passes =
+        id === HEADER_VALUES["CF-Access-Client-Id"] &&
+        secret === HEADER_VALUES["CF-Access-Client-Secret"];
+
+      if (!passes) {
+        state.rejectedRequests.push({ method: req.method, path: pathAndQuery });
+        return new Response(
+          '<!DOCTYPE html><title>Sign in ・ Cloudflare Access</title>' +
+            '<body>Authenticate to reach this site.</body>',
+          {
+            status: 403,
+            headers: {
+              "content-type": "text/html; charset=utf-8",
+              "cf-ray": "0000000000000000-TEST",
+              "cf-mitigated": "challenge",
+            },
+          },
+        );
+      }
+
+      state.authenticatedRequests.push({ method: req.method, path: pathAndQuery });
+
+      const target = new URL(pathAndQuery, backendUrl);
+      const forwardHeaders = new Headers(req.headers);
+      forwardHeaders.delete("cf-access-client-id");
+      forwardHeaders.delete("cf-access-client-secret");
+      forwardHeaders.set("host", new URL(backendUrl).host);
+
+      const body =
+        req.method === "GET" || req.method === "HEAD"
+          ? undefined
+          : await req.arrayBuffer();
+
+      return await fetch(target, {
+        method: req.method,
+        headers: forwardHeaders,
+        body,
+        redirect: "manual",
+      });
+    },
+  });
+
+  return {
+    server,
+    state,
+    url: `http://127.0.0.1:${server.port}`,
+  };
+}
+
+async function runCliThroughProxy(
+  backend: { workspace: string; testConfigDir: string; token?: string },
+  proxyUrl: string,
+  cliArgs: string[],
+  cwd: string,
+  env: Record<string, string>,
+): Promise<{ stdout: string; stderr: string; code: number }> {
+  // Use fileURLToPath + node:path so the CLI entrypoint is a real OS path on
+  // Windows. `new URL(..).pathname` yields `/C:/...` which Bun.spawn fails to
+  // resolve, so the negative case "rejected" on launch instead of reaching
+  // the proxy and the assertion on rejectedRequests > 0 flaked.
+  const cliDir = join(dirname(fileURLToPath(import.meta.url)), "..");
+  const useNode = process.env["TEST_CLI_RUNTIME"] === "node";
+  const runtime = useNode ? "node" : "bun";
+  const entrypoint = useNode
+    ? join(cliDir, "npm", "esm", "main.js")
+    : join(cliDir, "src", "main.ts");
+  const runtimeArgs = useNode ? [entrypoint] : ["run", entrypoint];
+
+  const fullArgs = [
+    "--base-url", proxyUrl,
+    "--workspace", backend.workspace,
+    "--token", backend.token ?? "",
+    "--config-dir", backend.testConfigDir,
+    ...cliArgs,
+  ];
+
+  const proc = Bun.spawn([runtime, ...runtimeArgs, ...fullArgs], {
+    cwd,
+    env: { ...(process.env as Record<string, string>), ...env },
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+
+  const [stdout, stderr] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+  ]);
+  const code = await proc.exited;
+  return { stdout, stderr, code };
+}
+
+test(
+  "HEADERS env var is forwarded on every CLI fetch (sync push of new script)",
+  async () => {
+    await withTestBackend(async (backend, tempDir) => {
+      const proxy = startGatewayProxy(backend.baseUrl);
+      try {
+        await writeFile(
+          `${tempDir}/wmill.yaml`,
+          `defaultTs: bun\nincludes:\n  - "**"\nexcludes: []\n`,
+          "utf-8",
+        );
+
+        const uniqueId = Date.now();
+        const scriptName = `headers_${uniqueId}`;
+        const scriptDir = `${tempDir}/f/test`;
+        await mkdir(scriptDir, { recursive: true });
+        await writeFile(
+          `${scriptDir}/${scriptName}.ts`,
+          `export async function main() {\n  return "headers test ${uniqueId}";\n}\n`,
+          "utf-8",
+        );
+        await writeFile(
+          `${scriptDir}/${scriptName}.script.yaml`,
+          [
+            `summary: "headers regression"`,
+            `description: "Push covers /scripts/create + /jobs/run/dependencies_async"`,
+            `lock: ""`,
+            `schema:`,
+            `  $schema: "https://json-schema.org/draft/2020-12/schema"`,
+            `  type: object`,
+            `  properties: {}`,
+            `  required: []`,
+            `is_template: false`,
+            `kind: script`,
+            `language: bun`,
+            ``,
+          ].join("\n"),
+          "utf-8",
+        );
+
+        const includesGlob = `f/test/${scriptName}**`;
+
+        // Negative case: no HEADERS env -> the proxy should return the
+        // gateway challenge and the CLI should bail out non-zero. Proves the
+        // proxy is actually gating, so the positive case isn't a false pass.
+        const noHeaders = await runCliThroughProxy(
+          backend,
+          proxy.url,
+          ["sync", "push", "--yes", "--includes", includesGlob],
+          tempDir,
+          {},
+        );
+        expect(noHeaders.code).not.toEqual(0);
+        expect(proxy.state.rejectedRequests.length).toBeGreaterThan(0);
+        expect(proxy.state.authenticatedRequests.length).toEqual(0);
+
+        // Reset proxy state between cases.
+        proxy.state.authenticatedRequests.length = 0;
+        proxy.state.rejectedRequests.length = 0;
+
+        // Positive case: HEADERS env set -> the proxy must see those headers
+        // on every request the CLI makes for sync push to succeed.
+        const withHeaders = await runCliThroughProxy(
+          backend,
+          proxy.url,
+          ["sync", "push", "--yes", "--includes", includesGlob],
+          tempDir,
+          { HEADERS: HEADERS_ENV },
+        );
+        expect(withHeaders.code).toEqual(0);
+        expect(proxy.state.rejectedRequests).toEqual([]);
+
+        const paths = proxy.state.authenticatedRequests.map((r) => r.path);
+
+        // Print the full path list when an assertion below fails so the
+        // failure is debuggable without re-running with extra logging.
+        const debug = () => paths.join("\n  ");
+
+        // Tarball download (sync diff): src/commands/sync/pull.ts
+        expect(
+          paths.some((p) =>
+            p.startsWith(`/api/w/${backend.workspace}/workspaces/tarball`),
+          ),
+          `expected tarball request, got:\n  ${debug()}`,
+        ).toBe(true);
+
+        // Script create: src/commands/script/script.ts pushScript().
+        // This is the regression: PR #8936 switched from wmill.createScript()
+        // (SDK, inherits OpenAPI.HEADERS) to a raw fetch that didn't forward
+        // HEADERS. Without the fix, the proxy would 403 this request and the
+        // CLI exit would be non-zero — so this assertion is the load-bearing
+        // one for #8936 / #6421-style regressions.
+        expect(
+          paths.some((p) =>
+            p.includes(`/api/w/${backend.workspace}/scripts/create`),
+          ),
+          `expected /scripts/create request, got:\n  ${debug()}`,
+        ).toBe(true);
+
+        // Lock generation: src/utils/metadata.ts. Was the original #6421 fix
+        // (PR #6422) — a soft check; the backend may skip queueing a lock job
+        // for trivial bun scripts under some feature configurations, so we
+        // only verify it *if* the CLI tried to generate one.
+        // (No assertion — covered by the tarball+create checks above plus
+        // the negative case proving the proxy actually gates requests.)
+      } finally {
+        proxy.server.stop(true);
+      }
+    });
+  },
+  240_000,
+);
diff --git a/cli/test/mixed_case_paths.test.ts b/cli/test/mixed_case_paths.test.ts
index d85f81cc83..872c6f94ff 100644
--- a/cli/test/mixed_case_paths.test.ts
+++ b/cli/test/mixed_case_paths.test.ts
@@ -130,6 +130,57 @@ async function createFlow(
     throw new Error(`Failed to create flow ${flowPath}: ${error}`);
   }
   await response.text();
+
+  // Flow creation queues an async FlowDependencies job that generates the
+  // inline-script lockfile and rewrites flow.value. If we don't wait, a
+  // subsequent pull/push races the worker and the dry-run idempotency
+  // assertion sees a phantom lock-add + flow.yaml-edit diff (CI-only flake).
+  await waitForFlowDependencyJob(backend, flowPath);
+}
+
+async function waitForFlowDependencyJob(
+  backend: any,
+  flowPath: string,
+  timeoutMs: number = 30000,
+): Promise<void> {
+  // /flows/get does not return `dependency_job`. The deployment_status route
+  // joins flow_version against deployment_metadata, which is populated in the
+  // same tx as the FlowDependencies push, so by the time the create/update
+  // API call returns, job_id is already the latest dep-job UUID.
+  const start = Date.now();
+  while (Date.now() - start < timeoutMs) {
+    const statusResp = await backend.apiRequest!(
+      `/api/w/${backend.workspace}/flows/deployment_status/p/${flowPath}`,
+    );
+    if (statusResp.status === 404) {
+      await statusResp.text().catch(() => {});
+      return;
+    }
+    if (!statusResp.ok) {
+      await statusResp.text().catch(() => {});
+      throw new Error(
+        `Failed to fetch deployment status for ${flowPath}: ${statusResp.status}`,
+      );
+    }
+    const status = await statusResp.json();
+    const depJobId: string | undefined = status?.job_id;
+    if (!depJobId) {
+      await new Promise((r) => setTimeout(r, 100));
+      continue;
+    }
+    const completed = await backend.apiRequest!(
+      `/api/w/${backend.workspace}/jobs_u/completed/get/${depJobId}`,
+    );
+    if (completed.ok) {
+      await completed.text();
+      return;
+    }
+    await completed.text().catch(() => {});
+    await new Promise((r) => setTimeout(r, 100));
+  }
+  throw new Error(
+    `Flow dependency job for ${flowPath} did not complete within ${timeoutMs}ms`,
+  );
 }
 
 async function createApp(
@@ -384,6 +435,10 @@ excludes: []
       const updatedFlow = await getFlow(backend, flowPath);
       expect(updatedFlow.summary).toEqual("Modified Data Processor Flow from test");
 
+      // The CLI push enqueues a fresh FlowDependencies job. Wait for it before
+      // the dry-run pull so the lock/flow.value writes have committed.
+      await waitForFlowDependencyJob(backend, flowPath);
+
       // Verify no diff on subsequent pull (idempotency)
       await verifyNoDiffOnPull(backend, tempDir);
     });
diff --git a/cli/test/sync_pull_push.test.ts b/cli/test/sync_pull_push.test.ts
index e64af246f2..e31c4e1084 100644
--- a/cli/test/sync_pull_push.test.ts
+++ b/cli/test/sync_pull_push.test.ts
@@ -493,6 +493,58 @@ async function cleanupTempDir(dir: string): Promise<void> {
   }
 }
 
+// Polls /flows/deployment_status/p/{path} + /jobs_u/completed/get until the
+// most recent flow dependency job has completed. After a flow create/update
+// the API queues a FlowDependencies job that asynchronously fills inline-
+// script lockfiles and rewrites flow.value; tests that round-trip through
+// sync push/pull must wait for it or they race the worker (CI-only flake).
+// `deployment_status` is the right read here — `/flows/get` does not return
+// `dependency_job`, but the `deployment_metadata.job_id` row is written in
+// the same tx as the dep-job push, so the returned `job_id` is the latest
+// dep-job UUID by the time the create/update API call has returned. Returns
+// silently if the flow doesn't exist on the server (treats it as a no-op
+// push, since the route returns 404 when the flow row is missing).
+async function waitForFlowDependencyJob(
+  backend: any,
+  flowPath: string,
+  timeoutMs: number = 30000,
+): Promise<void> {
+  const start = Date.now();
+  while (Date.now() - start < timeoutMs) {
+    const statusResp = await backend.apiRequest!(
+      `/api/w/${backend.workspace}/flows/deployment_status/p/${flowPath}`,
+    );
+    if (statusResp.status === 404) {
+      await statusResp.text().catch(() => {});
+      return;
+    }
+    if (!statusResp.ok) {
+      await statusResp.text().catch(() => {});
+      throw new Error(
+        `Failed to fetch deployment status for ${flowPath}: ${statusResp.status}`,
+      );
+    }
+    const status = await statusResp.json();
+    const depJobId: string | undefined = status?.job_id;
+    if (!depJobId) {
+      await new Promise((r) => setTimeout(r, 100));
+      continue;
+    }
+    const completed = await backend.apiRequest!(
+      `/api/w/${backend.workspace}/jobs_u/completed/get/${depJobId}`,
+    );
+    if (completed.ok) {
+      await completed.text();
+      return;
+    }
+    await completed.text().catch(() => {});
+    await new Promise((r) => setTimeout(r, 100));
+  }
+  throw new Error(
+    `Flow dependency job for ${flowPath} did not complete within ${timeoutMs}ms`,
+  );
+}
+
 // =============================================================================
 // Tests
 // =============================================================================
@@ -1797,6 +1849,12 @@ excludes: []
 
       expect(pushResult.code).toEqual(0);
 
+      // sync push of the flow enqueues an async FlowDependencies job that
+      // generates the inline-script lockfile and rewrites flow.value. Wait for
+      // it before pulling back, otherwise pull races the worker and the
+      // dry-run push idempotency check sees phantom diffs (CI-only flake).
+      await waitForFlowDependencyJob(backend, flowName);
+
       // Pull back
       const pullResult = await backend.runCLICommand(
         ["sync", "pull", "--yes", "--includes", `f/test/mixed_*_${uniqueId}**`],
diff --git a/docs/windmill-ai-refactor-plan.md b/docs/windmill-ai-refactor-plan.md
index 81ab5d7b86..0e8449d897 100644
--- a/docs/windmill-ai-refactor-plan.md
+++ b/docs/windmill-ai-refactor-plan.md
@@ -23,6 +23,58 @@ windmill-worker →  windmill-ai
 
 windmill-common does **NOT** re-export from windmill-ai (would be circular). All consumers update imports.
 
+## Reviewer Note: Keep the Next PR Small
+
+The first merged PR established the crate boundary; it did not yet remove the duplicated API-vs-worker provider paths. The remaining work should stay split by dependency risk, not by the final desired module layout.
+
+Do not jump directly from the current state to provider moves, proxy unification, and credential unification in one PR. The riskiest part is the API proxy because it combines request transformation, endpoint selection, auth headers, custom headers, OAuth user injection, Azure URL handling, Anthropic Vertex handling, Bedrock SDK calls, and SSE keepalive behavior.
+
+Pull the shared plumbing forward before moving provider implementations:
+- Move tiny shared utilities first, including `AI_HTTP_HEADERS`, `extract_text_content`, and `should_use_structured_output_tool`.
+- Move SSE parsers next, using the existing `StreamEventSink` abstraction, and update callers to import from `windmill_ai` directly.
+- Leave provider implementations, image upload/download handling, API proxy changes, and credential unification out of that PR.
+
+Avoid adding modules whose only purpose is to re-export moved code. Direct imports from `windmill_ai` make ownership and dependency direction clearer at each call site.
+
+Also do not make `build_proxy_request(raw_body, path)` too narrow. The proxy path needs method, incoming headers, resolved credentials, base URL/platform, organization/user fields, custom headers, and Bedrock/Azure/Vertex-specific context. Introduce a structured `ProxyBuildArgs`/`ProviderCredentials` shape before deleting `AIRequestConfig::prepare_request`, `google.rs`, or `bedrock.rs`.
+
+## Next Phase PR: Shared Plumbing Only
+
+Goal: make `windmill-ai` own the provider-independent helper code that later provider moves will need, without changing API proxy behavior or agent request behavior.
+
+Suggested PR title: `refactor(ai): move shared SSE plumbing into windmill-ai`.
+
+Scope:
+- Add `windmill-ai/src/utils.rs`.
+- Move the duplicated `AI_HTTP_HEADERS` parsing into `windmill_ai::utils` with identical parsing behavior.
+- Move `extract_text_content` and `should_use_structured_output_tool` from `windmill-worker/src/ai/utils.rs` to `windmill_ai::utils`.
+- Move `windmill-worker/src/ai/sse.rs` to `windmill-ai/src/sse.rs`.
+- Delete `windmill-worker/src/ai/sse.rs` and update callers to import parser types from `windmill_ai::sse`.
+- Update callers of moved utility functions to import from `windmill_ai::utils` directly.
+- Add the minimal new `windmill-ai` dependencies required by `sse.rs` (`eventsource-stream`, `tokio-stream`) and avoid adding worker/queue dependencies.
+
+Out of scope:
+- Do not move provider implementations.
+- Do not move `image_handler`.
+- Do not change `QueryBuilder` method signatures.
+- Do not add `build_proxy_request`.
+- Do not change API proxy routing, request preparation, credential resolution, audit logging, cache behavior, or Bedrock/Google special cases.
+- Do not remove `windmill-api/src/google.rs`, `windmill-api/src/bedrock.rs`, or `AIRequestConfig::prepare_request`.
+
+Implementation checklist:
+1. Add `utils.rs` to `windmill-ai` and export it from `lib.rs`.
+2. Move `AI_HTTP_HEADERS` exactly once, then update `windmill-api/src/ai.rs` and `windmill-worker/src/ai_executor.rs` to import it.
+3. Move the two provider-independent helper functions into `windmill_ai::utils`; leave worker-specific flow/MCP/conversation utilities in `windmill-worker/src/ai/utils.rs`.
+4. Move `sse.rs` into `windmill-ai`, change imports from `crate::ai::{query_builder, types}` to `crate::{query_builder, types}`, and keep behavior unchanged.
+5. Remove worker `ai/sse.rs` and update provider imports to use `windmill_ai::sse` directly.
+6. Run focused grep checks for duplicate `AI_HTTP_HEADERS`, old local helper definitions, and accidental `windmill_queue`/worker dependencies from `windmill-ai`.
+7. Validate with `cargo check -p windmill-ai`, `cargo check -p windmill-worker`, and `cargo check -p windmill-api`. For `bedrock` builds, also check the existing bedrock feature path.
+
+Review expectations:
+- The diff should be mostly moved code and import updates.
+- The behavior should be byte-for-byte equivalent where practical.
+- Tests are only needed if helper behavior changes. For a pure move, existing backend checks plus manual AI streaming verification are enough.
+
 ## Step-by-Step Plan
 
 Each step produces a compiling, working backend.
@@ -90,7 +142,7 @@ Move from `windmill-worker/src/ai/sse.rs` to `windmill-ai/src/sse.rs`:
 
 ---
 
-### Step 5: Move provider implementations to windmill-ai
+### Step 5: Move provider implementations to windmill-ai ✅
 
 Move from `windmill-worker/src/ai/providers/` to `windmill-ai/src/providers/`:
 - `anthropic.rs` — `AnthropicQueryBuilder`
@@ -107,7 +159,7 @@ Move utility functions providers depend on:
 
 ---
 
-### Step 6: Move image_handler to windmill-ai
+### Step 6: Move image_handler to windmill-ai ✅
 
 Move from `windmill-worker/src/ai/image_handler.rs` to `windmill-ai/src/image_handler.rs`:
 - `download_and_encode_s3_image` — no signature change needed
@@ -131,18 +183,27 @@ This is the key unification step. Add a new method to the `QueryBuilder` trait:
 /// Used by the API chat proxy. Handles format conversion for non-OpenAI providers.
 fn build_proxy_request(
     &self,
-    raw_body: &[u8],
-    path: &str,
+    args: &ProxyBuildArgs<'_>,
 ) -> Result<ProxyRequest, Error>;
 ```
 
-Where `ProxyRequest` contains the transformed body, endpoint URL, and auth headers:
+Where `ProxyBuildArgs` carries the API proxy context that provider implementations need:
+```rust
+pub struct ProxyBuildArgs<'a> {
+    pub method: http::Method,
+    pub path: &'a str,
+    pub headers: &'a http::HeaderMap,
+    pub body: &'a [u8],
+    pub credentials: &'a ProviderCredentials,
+}
+```
+
+And `ProxyRequest` contains the transformed request:
 ```rust
 pub struct ProxyRequest {
     pub url: String,
     pub body: Vec<u8>,
-    pub auth_headers: Vec<(String, String)>,
-    pub is_sse: bool,
+    pub headers: Vec<(String, String)>,
 }
 ```
 
@@ -153,9 +214,9 @@ pub struct ProxyRequest {
 - **Bedrock**: Convert OpenAI format → Bedrock SDK calls. Replaces `windmill-api/src/bedrock.rs`.
 
 **Refactor API proxy** (`windmill-api/src/ai.rs`):
-1. Parse provider from headers, resolve credentials → `ProviderWithResource`
+1. Parse provider from headers, resolve credentials → `ProviderCredentials`
 2. Create `QueryBuilder` via `create_query_builder`
-3. Call `query_builder.build_proxy_request(body, path)` → `ProxyRequest`
+3. Call `query_builder.build_proxy_request(&proxy_args)` → `ProxyRequest`
 4. Send the request, return response with SSE keepalive injection
 
 **Remove** from windmill-api:
@@ -166,7 +227,7 @@ pub struct ProxyRequest {
 - `supports_native_fim`, `transform_fim_to_chat_completions` — moved to windmill-ai
 
 **Keep** in API:
-- `AIRequestConfig::new` credential resolution (or refactor to produce `ProviderWithResource`)
+- `AIRequestConfig::new` credential resolution until it is refactored to produce `ProviderCredentials`
 - HTTP routes, audit logging, request caching
 - `inject_keepalives`, `is_sse_response` helpers
 - `AIConfig`, `ExpiringAIRequestConfig` caching types
diff --git a/flake.nix b/flake.nix
index aaf06c882e..3872ee636f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -79,11 +79,11 @@
         # ---------------------------------------------------------------
 
         rustyV8Archive = let
-          version = "130.0.7";
+          version = "137.1.0";
           target = stdenv.hostPlatform.rust.rustcTarget;
           sha256 = {
             x86_64-linux =
-              "sha256-pkdsuU6bAkcIHEZUJOt5PXdzK424CEgTLXjLtQ80t10=";
+              "sha256-Tiscfy2bzYGR3s0T+SC1IB3xWvTVpVcSEdjq3MCRoRw=";
             aarch64-linux = lib.fakeHash;
             x86_64-darwin = lib.fakeHash;
             aarch64-darwin = lib.fakeHash;
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 2e8ca86313..2483fa4d97 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.697.0",
+	"version": "1.700.2",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.697.0",
+			"version": "1.700.2",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 79d4465429..32bdc019f0 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.697.0",
+	"version": "1.700.2",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/frontend/src/lib/components/Auth0Setting.svelte b/frontend/src/lib/components/Auth0Setting.svelte
index beb9ec03f9..a246ae196d 100644
--- a/frontend/src/lib/components/Auth0Setting.svelte
+++ b/frontend/src/lib/components/Auth0Setting.svelte
@@ -7,6 +7,7 @@
 	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
 	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import TextInput from './text_input/TextInput.svelte'
+	import Password from './Password.svelte'
 	import SettingCard from './instanceSettings/SettingCard.svelte'
 
 	interface Props {
@@ -103,14 +104,15 @@
 					class="max-w-lg"
 				/>
 			</label>
-			<label class="flex flex-col gap-1">
+			<label for="auth0_client_secret" class="flex flex-col gap-1">
 				<span class="text-emphasis font-semibold text-xs"
 					>Client Secret <Tooltip>Client Secret of the auth0 service configuration</Tooltip></span
 				>
-				<TextInput
-					inputProps={{ type: 'text', placeholder: 'Client Secret' }}
-					bind:value={value['secret']}
-					class="max-w-lg"
+				<Password
+					id="auth0_client_secret"
+					small
+					placeholder="Client Secret"
+					bind:password={value['secret']}
 				/>
 			</label>
 			<CollapseLink text="Instructions">
diff --git a/frontend/src/lib/components/AuthSettings.svelte b/frontend/src/lib/components/AuthSettings.svelte
index d3d4890e9c..68ebefc148 100644
--- a/frontend/src/lib/components/AuthSettings.svelte
+++ b/frontend/src/lib/components/AuthSettings.svelte
@@ -14,6 +14,7 @@
 	import ZitadelSetting from '$lib/components/ZitadelSetting.svelte'
 	import NextcloudSetting from '$lib/components/NextcloudSetting.svelte'
 	import CustomOauth from './CustomOauth.svelte'
+	import Password from './Password.svelte'
 	import { capitalize, type Item } from '$lib/utils'
 	import ClipboardPanel from './details/ClipboardPanel.svelte'
 	import Toggle from './Toggle.svelte'
@@ -297,12 +298,12 @@
 										<span class="text-primary font-semibold text-xs">Client Id</span>
 										<input type="text" placeholder="Client Id" bind:value={oauths[k]['id']} />
 									</label>
-									<label class="block pb-6">
+									<label for="{k}_client_secret_sso" class="block pb-6">
 										<span class="text-primary font-semibold text-xs">Client Secret</span>
-										<input
-											type="text"
+										<Password
+											id="{k}_client_secret_sso"
 											placeholder="Client Secret"
-											bind:value={oauths[k]['secret']}
+											bind:password={oauths[k]['secret']}
 										/>
 									</label>
 									{#if !windmillBuiltins.includes(k) && k != 'slack'}
@@ -394,9 +395,13 @@
 									<span class="text-primary font-semibold text-xs">Client Id</span>
 									<input type="text" placeholder="Client Id" bind:value={oauths[k]['id']} />
 								</label>
-								<label>
+								<label for="{k}_client_secret_oauth">
 									<span class="text-primary font-semibold text-xs">Client Secret</span>
-									<input type="text" placeholder="Client Secret" bind:value={oauths[k]['secret']} />
+									<Password
+										id="{k}_client_secret_oauth"
+										placeholder="Client Secret"
+										bind:password={oauths[k]['secret']}
+									/>
 								</label>
 								{#if k === 'visma' || !windmillBuiltins.includes(k)}
 									<div class="mb-8">
diff --git a/frontend/src/lib/components/AutheliaSetting.svelte b/frontend/src/lib/components/AutheliaSetting.svelte
index a3aa2e3458..fccc133cd2 100644
--- a/frontend/src/lib/components/AutheliaSetting.svelte
+++ b/frontend/src/lib/components/AutheliaSetting.svelte
@@ -1,21 +1,20 @@
 <script lang="ts">
-	import { run } from 'svelte/legacy';
+	import { run } from 'svelte/legacy'
 
 	import IconedResourceType from './IconedResourceType.svelte'
 	import TextInput from './text_input/TextInput.svelte'
+	import Password from './Password.svelte'
 	import Toggle from './Toggle.svelte'
 	import SettingCard from './instanceSettings/SettingCard.svelte'
 
 	interface Props {
-		value: any;
+		value: any
 	}
 
-	let { value = $bindable() }: Props = $props();
-
+	let { value = $bindable() }: Props = $props()
 
 	let org = $state('')
 
-
 	function changeOrg(org) {
 		if (value) {
 			value = {
@@ -37,7 +36,7 @@
 	let enabled = $derived(value != undefined)
 	run(() => {
 		changeOrg(org)
-	});
+	})
 </script>
 
 <div class="flex flex-col gap-1">
@@ -77,11 +76,12 @@
 					bind:value={value['id']}
 				/>
 			</label>
-			<label class="flex flex-col gap-1">
+			<label for="authelia_client_secret" class="flex flex-col gap-1">
 				<span class="text-emphasis font-semibold text-xs">Client Secret </span>
-				<TextInput
-					inputProps={{ type: 'text', placeholder: 'Client Secret' }}
-					bind:value={value['secret']}
+				<Password
+					id="authelia_client_secret"
+					placeholder="Client Secret"
+					bind:password={value['secret']}
 				/>
 			</label>
 		</SettingCard>
diff --git a/frontend/src/lib/components/AuthentikSetting.svelte b/frontend/src/lib/components/AuthentikSetting.svelte
index e672970c08..117c2798e1 100644
--- a/frontend/src/lib/components/AuthentikSetting.svelte
+++ b/frontend/src/lib/components/AuthentikSetting.svelte
@@ -1,18 +1,16 @@
 <script lang="ts">
-	import { run } from 'svelte/legacy';
+	import { run } from 'svelte/legacy'
 
 	import IconedResourceType from './IconedResourceType.svelte'
+	import Password from './Password.svelte'
 	import Toggle from './Toggle.svelte'
 	import SettingCard from './instanceSettings/SettingCard.svelte'
 
 	interface Props {
-		value: any;
+		value: any
 	}
 
-	let { value = $bindable() }: Props = $props();
-
-
-
+	let { value = $bindable() }: Props = $props()
 
 	function changeOrg(org) {
 		if (value && org) {
@@ -34,10 +32,12 @@
 	}
 	let enabled = $derived(value != undefined)
 	// Initialize org from existing auth_url
-	let org = $derived(value?.connect_config?.auth_url?.replace('/application/o/authorize/', '') ?? '')
+	let org = $derived(
+		value?.connect_config?.auth_url?.replace('/application/o/authorize/', '') ?? ''
+	)
 	run(() => {
 		changeOrg(org)
-	});
+	})
 </script>
 
 <div class="flex flex-col gap-1">
@@ -71,9 +71,13 @@
 				<span class="text-emphasis font-semibold text-xs">Client Id</span>
 				<input type="text" placeholder="Client Id" bind:value={value['id']} />
 			</label>
-			<label>
+			<label for="authentik_client_secret">
 				<span class="text-emphasis font-semibold text-xs">Client Secret </span>
-				<input type="text" placeholder="Client Secret" bind:value={value['secret']} />
+				<Password
+					id="authentik_client_secret"
+					placeholder="Client Secret"
+					bind:password={value['secret']}
+				/>
 			</label>
 		</SettingCard>
 	{/if}
diff --git a/frontend/src/lib/components/BreadcrumbSegment.svelte b/frontend/src/lib/components/BreadcrumbSegment.svelte
new file mode 100644
index 0000000000..8b18503f75
--- /dev/null
+++ b/frontend/src/lib/components/BreadcrumbSegment.svelte
@@ -0,0 +1,76 @@
+<!--
+@component
+One clickable segment of the editor breadcrumb. The segment opens a popover
+containing a `WorkspaceItemDrillPicker`. Each instance owns its own `isOpen`
+state — switching popovers relies on melt-ui's `closeOnOtherPopoverOpen` to
+close siblings.
+-->
+<script lang="ts">
+	import { ChevronRight } from 'lucide-svelte'
+	import Popover from '$lib/components/meltComponents/Popover.svelte'
+	import WorkspaceItemDrillPicker, {
+		type Scope
+	} from '$lib/components/WorkspaceItemDrillPicker.svelte'
+	import type { WorkspaceItem } from '$lib/components/workspacePicker'
+
+	interface Props {
+		label: string
+		withChevron?: boolean
+		extraClass?: string
+		disabled?: boolean
+		/** Where the picker lands when this segment is clicked. */
+		initialScope?: Scope
+		/** Composite key of the row to highlight (e.g. `dir:flow:f/demo`). */
+		initialHighlight?: string
+		/** Mark this segment as the current page (leaf of the breadcrumb). */
+		isCurrent?: boolean
+		currentItem?: WorkspaceItem & { savedPath?: string }
+		onPick: (item: WorkspaceItem) => void
+	}
+
+	let {
+		label,
+		withChevron = false,
+		extraClass = '',
+		disabled = false,
+		initialScope,
+		initialHighlight,
+		isCurrent = false,
+		currentItem,
+		onPick
+	}: Props = $props()
+
+	let isOpen = $state(false)
+
+	const SEGMENT_BASE_CLASS =
+		'font-normal inline-flex items-center px-1 rounded hover:bg-surface-hover hover:text-primary transition-colors'
+
+	function handlePick(item: WorkspaceItem) {
+		isOpen = false
+		onPick(item)
+	}
+</script>
+
+<Popover
+	placement="bottom-start"
+	usePointerDownOutside
+	excludeSelectors=".drawer"
+	disableFocusTrap
+	closeOnOtherPopoverOpen
+	class="{SEGMENT_BASE_CLASS} {extraClass} {disabled ? 'cursor-default' : 'cursor-pointer'}"
+	bind:isOpen
+	openFocus="[data-workspace-picker-search]"
+	triggerAttrs={{
+		'aria-label': label,
+		...(isCurrent ? { 'aria-current': 'page' } : {})
+	}}
+	{disabled}
+>
+	{#snippet trigger()}
+		{#if withChevron}<ChevronRight size={10} class="shrink-0" /><span class="truncate">{label}</span
+			>{:else}{label}{/if}
+	{/snippet}
+	{#snippet content()}
+		<WorkspaceItemDrillPicker {initialScope} {initialHighlight} {currentItem} onPick={handlePick} />
+	{/snippet}
+</Popover>
diff --git a/frontend/src/lib/components/DisplayResult.svelte b/frontend/src/lib/components/DisplayResult.svelte
index 4e2b07b1c5..8ac06662d8 100644
--- a/frontend/src/lib/components/DisplayResult.svelte
+++ b/frontend/src/lib/components/DisplayResult.svelte
@@ -5,6 +5,7 @@
 	import { json } from 'svelte-highlight/languages'
 	import { copyToClipboard, parseS3Object, roughSizeOfObject } from '$lib/utils'
 	import { base } from '$lib/base'
+	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import { Button, Drawer, DrawerContent } from './common'
 	import {
 		ClipboardCopy,
@@ -173,6 +174,20 @@
 
 	let largeObject: boolean | undefined = $state(undefined)
 
+	let resultApiPath = $derived(
+		workspaceId && jobId
+			? nodeId
+				? `/w/${workspaceId}/jobs/result_by_id/${jobId}/${nodeId}`
+				: `/w/${workspaceId}/jobs_u/completed/get_result/${jobId}`
+			: undefined
+	)
+	let resultDownloadHref = $derived(
+		resultApiPath
+			? `${base}/api${resultApiPath}`
+			: `data:text/json;charset=utf-8,${encodeURIComponent(toJsonStr(result))}`
+	)
+	let resultDownloadName = $derived(`${filename ?? 'result'}.json`)
+
 	function checkIfS3(result: any, keys: string[]) {
 		return keys.includes('s3') && typeof result.s3 === 'string'
 	}
@@ -1000,16 +1015,17 @@
 					{:else}
 						{#if largeObject}
 							<div class="text-xs text-emphasis"
-								><a
-									download="{filename ?? 'result'}.json"
-									href={workspaceId && jobId
-										? nodeId
-											? `${base}/api/w/${workspaceId}/jobs/result_by_id/${jobId}/${nodeId}`
-											: `${base}/api/w/${workspaceId}/jobs_u/completed/get_result/${jobId}`
-										: `data:text/json;charset=utf-8,${encodeURIComponent(toJsonStr(result))}`}
-								>
-									Download {filename ? '' : 'as JSON'}
-								</a>
+								>{#if resultApiPath && shouldDownloadViaClient()}
+									<button
+										onclick={() => downloadViaClient(resultApiPath!, resultDownloadName)}
+									>
+										Download {filename ? '' : 'as JSON'}
+									</button>
+								{:else}
+									<a download={resultDownloadName} href={resultDownloadHref}>
+										Download {filename ? '' : 'as JSON'}
+									</a>
+								{/if}
 								{#if download_as_csv}
 									<DownloadCsv
 										getContent={() => convertJsonToCsv(result)}
@@ -1074,19 +1090,26 @@
 			<DrawerContent title="Expanded Result" on:close={jsonViewer.closeDrawer}>
 				{#snippet actions()}
 					{#if customUi?.disableDownload !== true}
-						<Button
-							download="{filename ?? 'result'}.json"
-							href={workspaceId && jobId
-								? nodeId
-									? `${base}/api/w/${workspaceId}/jobs/result_by_id/${jobId}/${nodeId}`
-									: `${base}/api/w/${workspaceId}/jobs_u/completed/get_result/${jobId}`
-								: `data:text/json;charset=utf-8,${encodeURIComponent(toJsonStr(result))}`}
-							startIcon={{ icon: Download }}
-							variant="subtle"
-							unifiedSize="md"
-						>
-							Download
-						</Button>
+						{#if resultApiPath && shouldDownloadViaClient()}
+							<Button
+								on:click={() => downloadViaClient(resultApiPath!, resultDownloadName)}
+								startIcon={{ icon: Download }}
+								variant="subtle"
+								unifiedSize="md"
+							>
+								Download
+							</Button>
+						{:else}
+							<Button
+								download={resultDownloadName}
+								href={resultDownloadHref}
+								startIcon={{ icon: Download }}
+								variant="subtle"
+								unifiedSize="md"
+							>
+								Download
+							</Button>
+						{/if}
 					{/if}
 					<Button
 						on:click={() => copyToClipboard(toJsonStr(result))}
diff --git a/frontend/src/lib/components/DisplayResultControlBar.svelte b/frontend/src/lib/components/DisplayResultControlBar.svelte
index 95d0a3414e..d45ca3f92d 100644
--- a/frontend/src/lib/components/DisplayResultControlBar.svelte
+++ b/frontend/src/lib/components/DisplayResultControlBar.svelte
@@ -3,6 +3,7 @@
 	import { Download, InfoIcon, ClipboardCopy, Expand } from 'lucide-svelte'
 	import Popover from './Popover.svelte'
 	import { copyToClipboard } from '$lib/utils'
+	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import type { DisplayResultUi } from './custom_ui'
 	import { createEventDispatcher } from 'svelte'
 
@@ -37,21 +38,38 @@
 			return 'error stringifying object: ' + e.toString()
 		}
 	}
+
+	let resultApiPath = $derived(
+		workspaceId && jobId
+			? nodeId
+				? `/w/${workspaceId}/jobs/result_by_id/${jobId}/${nodeId}`
+				: `/w/${workspaceId}/jobs_u/completed/get_result/${jobId}`
+			: undefined
+	)
+	let downloadName = $derived(`${filename ?? 'result'}.json`)
 </script>
 
 <div class={twMerge('flex flex-row gap-2.5 z-10 text-primary -mt-1 items-center')}>
 	{#if customUi?.disableDownload !== true}
-		<a
-			download="{filename ?? 'result'}.json"
-			class="text-current"
-			href={workspaceId && jobId
-				? nodeId
-					? `${base}/api/w/${workspaceId}/jobs/result_by_id/${jobId}/${nodeId}`
-					: `${base}/api/w/${workspaceId}/jobs_u/completed/get_result/${jobId}`
-				: `data:text/json;charset=utf-8,${encodeURIComponent(toJsonStr(result))}`}
-		>
-			<Download size={14} />
-		</a>
+		{#if resultApiPath && shouldDownloadViaClient()}
+			<button
+				class="text-current"
+				onclick={() => downloadViaClient(resultApiPath!, downloadName)}
+				aria-label="Download result"
+			>
+				<Download size={14} />
+			</button>
+		{:else}
+			<a
+				download={downloadName}
+				class="text-current"
+				href={resultApiPath
+					? `${base}/api${resultApiPath}`
+					: `data:text/json;charset=utf-8,${encodeURIComponent(toJsonStr(result))}`}
+			>
+				<Download size={14} />
+			</a>
+		{/if}
 	{/if}
 	{#if disableTooltips !== true}
 		<Popover documentationLink="https://www.windmill.dev/docs/core_concepts/rich_display_rendering">
diff --git a/frontend/src/lib/components/EditorHeader.svelte b/frontend/src/lib/components/EditorHeader.svelte
new file mode 100644
index 0000000000..e52210bb06
--- /dev/null
+++ b/frontend/src/lib/components/EditorHeader.svelte
@@ -0,0 +1,247 @@
+<script lang="ts">
+	import { Pencil } from 'lucide-svelte'
+	import { Alert, Button } from '$lib/components/common'
+	import EditableInput from '$lib/components/common/EditableInput.svelte'
+	import Popover from '$lib/components/meltComponents/Popover.svelte'
+	import Path from '$lib/components/Path.svelte'
+	import Label from '$lib/components/Label.svelte'
+	import {
+		dirKey,
+		KIND_LABEL_LOWER,
+		kindKey,
+		leafKeyFor,
+		type WorkspaceItem,
+		type WorkspaceItemKind
+	} from '$lib/components/workspacePicker'
+	import BreadcrumbSegment from '$lib/components/BreadcrumbSegment.svelte'
+	import { isOwner } from '$lib/utils'
+	import { userStore, workspaceStore } from '$lib/stores'
+
+	interface Props {
+		summary?: string
+		path?: string
+		/** The item's *saved* path on the server. Used so the picker knows to
+		 * replace the saved entry with a virtual one at the live `path` while
+		 * the user is mid-rename — keeps the breadcrumb and picker tree coherent
+		 * (the breadcrumb shows the user's draft path, and the picker shows the
+		 * item at that same path even though the rename hasn't been deployed). */
+		savedPath?: string
+		/** Kind of the item being edited; used to label the first breadcrumb segment. */
+		kind?: WorkspaceItemKind
+		/** True when editing a raw app — forwarded into the virtual `currentItem`
+		 * so the picker / `editPathFor` can route to `/apps_raw/...`. */
+		raw_app?: boolean
+		onNavigate?: (item: WorkspaceItem) => void
+		/** When set, shows a "redeployed on behalf of" warning in the path-edit
+		 * popover. Parents already know this from their loaded item — no API call. */
+		onBehalfOfEmail?: string | undefined
+		penVisibility?: 'hover' | 'always'
+		/** When false, the summary input becomes read-only. Breadcrumb
+		 * navigation and the pen popover are unaffected. */
+		summaryEditable?: boolean
+		/** When false, the pen popover is hidden so the path can't be edited
+		 * inline. Breadcrumb navigation still works — only the rename UI is
+		 * gated. */
+		pathEditable?: boolean
+	}
+
+	let {
+		summary = $bindable(),
+		path = $bindable(),
+		savedPath,
+		kind = 'flow',
+		raw_app = false,
+		onNavigate,
+		onBehalfOfEmail,
+		penVisibility = 'hover',
+		summaryEditable = true,
+		pathEditable = true
+	}: Props = $props()
+
+	let pathPopoverOpen = $state(false)
+	/** Snapshot of `path` taken when the pen popover opens; cleared on close.
+	 * While set, the breadcrumb derives from it instead of `path` so the pen
+	 * anchor doesn't reflow as the user types in the popover (which would drag
+	 * the popover with it via floating-ui's auto-update). */
+	let snapshotPath = $state<string | undefined>(undefined)
+
+	function setPathPopoverOpen(open: boolean) {
+		pathPopoverOpen = open
+		// Only snapshot when there's a path to freeze. New flows / scripts open
+		// the popover with `path === ''` and rely on `Path.reset()` to seed a
+		// path; if we snapshot the empty value the breadcrumb stays blank for
+		// the whole popover lifetime. Leaving `snapshotPath` undefined lets
+		// `displayPath` track the live seeded path instead.
+		snapshotPath = open && path ? path : undefined
+	}
+
+	// Path segments. e.g. "f/demo/weather_report" → scope "f/demo", slug "weather_report".
+	// `snapshotPath` keeps the breadcrumb frozen while the pen popover is open
+	// so the trigger doesn't drift mid-edit. Outside of that, the breadcrumb
+	// follows the live `path` — coherent with the picker because we inject a
+	// virtual current-item entry at that same live path (see `currentItem`).
+	let displayPath = $derived(snapshotPath ?? path ?? '')
+	/** Breakdown for breadcrumb rendering. Top-level dirs (scopes) come first
+	 * — `f/<folder>` or `u/<user>` — then any number of subfolders, then the
+	 * item name. Each dir entry's `fullPath` is the cumulative path up to
+	 * that level, used to key the picker's `initialOpen` / `initialHighlight`. */
+	let segments = $derived.by(() => {
+		const parts = displayPath.split('/')
+		if (parts.length < 3) return null
+		const scope = parts.slice(0, 2).join('/')
+		const slug = parts.slice(2)
+		const dirs: { name: string; fullPath: string }[] = []
+		// Top-level scope is a dir.
+		dirs.push({ name: scope, fullPath: scope })
+		// Intermediate slug parts (everything except the last one).
+		let acc = scope
+		for (let i = 0; i < slug.length - 1; i++) {
+			acc = `${acc}/${slug[i]}`
+			dirs.push({ name: slug[i], fullPath: acc })
+		}
+		const leaf = { name: slug[slug.length - 1], fullPath: displayPath }
+		return { dirs, leaf }
+	})
+
+	// Treat an empty path as ownable so the pen popover lets a user pick the
+	// path for a brand-new item. `Path.reset()` then synthesizes a default
+	// under their own user/folder scope.
+	let own = $derived(!path || isOwner(path, $userStore, $workspaceStore))
+
+	// Virtual entry for the picker: surfaces the currently-edited item at its
+	// live path (which may differ from `savedPath` mid-rename, so the picker
+	// otherwise has no leaf to expand).
+	let currentItem = $derived<WorkspaceItem & { savedPath?: string }>({
+		path: path ?? '',
+		summary: summary ?? '',
+		kind,
+		raw_app,
+		savedPath
+	})
+
+	function handleSummarySave(newValue: string) {
+		summary = newValue.trim()
+	}
+
+	function handlePickerSelect(item: WorkspaceItem) {
+		onNavigate?.(item)
+	}
+</script>
+
+<div class="inline-block max-w-full align-top group px-2 py-0.5 leading-tight">
+	<!-- Path row -->
+	<div class="flex items-center max-w-full text-2xs text-secondary font-mono">
+		<nav aria-label="Breadcrumb" class="contents">
+			<BreadcrumbSegment
+				label={KIND_LABEL_LOWER[kind]}
+				initialScope={undefined}
+				initialHighlight={kindKey(kind)}
+				isCurrent={!segments}
+				{currentItem}
+				onPick={handlePickerSelect}
+			/>
+			{#if segments}
+				{#each segments.dirs as dir, i (dir.fullPath)}
+					{@const dKey = dirKey('all', dir.fullPath)}
+					<BreadcrumbSegment
+						label={dir.name}
+						withChevron
+						extraClass={i === 0 ? 'gap-0.5 min-w-0 max-w-[40%]' : 'gap-0.5 min-w-0'}
+						initialScope={i === 0
+							? { kind: 'all' }
+							: { kind: 'all', dir: segments.dirs[i - 1].fullPath }}
+						initialHighlight={dKey}
+						{currentItem}
+						onPick={handlePickerSelect}
+					/>
+				{/each}
+				{@const leafKey = leafKeyFor(kind, segments.leaf.fullPath)}
+				{@const leafParent = segments.dirs[segments.dirs.length - 1]?.fullPath}
+				<BreadcrumbSegment
+					label={segments.leaf.name}
+					withChevron
+					extraClass="gap-0.5 min-w-0"
+					initialScope={leafParent ? { kind: 'all', dir: leafParent } : { kind: 'all' }}
+					initialHighlight={leafKey}
+					isCurrent
+					{currentItem}
+					onPick={handlePickerSelect}
+				/>
+			{/if}
+		</nav>
+
+		<!-- Pen → path-edit popover. Skipped entirely when path editing is
+		     disabled so the user doesn't see an inert button. -->
+		{#if pathEditable}
+			<Popover
+				placement="bottom-start"
+				contentClasses="p-4"
+				usePointerDownOutside
+				excludeSelectors=".drawer"
+				disableFocusTrap
+				closeOnOtherPopoverOpen
+				bind:isOpen={() => pathPopoverOpen, setPathPopoverOpen}
+			>
+				{#snippet trigger()}
+					<Button
+						variant="subtle"
+						unifiedSize="xs"
+						iconOnly
+						startIcon={{ icon: Pencil }}
+						title="Edit path"
+						aria-label="Edit path"
+						btnClasses={penVisibility === 'hover' && !pathPopoverOpen
+							? 'opacity-0 transition-opacity group-hover:opacity-100 focus-visible:opacity-100'
+							: ''}
+					/>
+				{/snippet}
+				{#snippet content()}
+					<div class="flex flex-col gap-6 w-[480px]">
+						{#if own}
+							<Path
+								autofocus
+								bind:path
+								initialPath={snapshotPath ?? path ?? ''}
+								namePlaceholder={kind}
+								{kind}
+								hideFullPath
+								size="sm"
+								drawerOffset={4000}
+							/>
+							{#if savedPath && path && path !== savedPath}
+								<Alert
+									type="info"
+									size="xs"
+									title="Deploy the {kind} to make the path change effective."
+								/>
+							{/if}
+							{#if onBehalfOfEmail}
+								<Alert type="info" title="Run on behalf of" size="xs">
+									This flow will be redeployed on behalf of you ({$userStore?.email}) instead of {onBehalfOfEmail}
+								</Alert>
+							{/if}
+						{:else}
+							<Label label="Path">
+								<span class="text-xs font-mono text-secondary">{path}</span>
+								<p class="text-2xs text-tertiary mt-1">Only the owner can change the path</p>
+							</Label>
+						{/if}
+					</div>
+				{/snippet}
+			</Popover>
+		{/if}
+	</div>
+
+	<!-- Summary -->
+	<div class="max-w-full -mt-[2px]" title={summary}>
+		<EditableInput
+			value={summary ?? ''}
+			placeholder="Add a summary..."
+			editable={summaryEditable}
+			size="sm"
+			onSave={handleSummarySave}
+			textClass="text-xs font-semibold text-emphasis leading-tight"
+			class="max-w-full"
+		/>
+	</div>
+</div>
diff --git a/frontend/src/lib/components/FlowBuilder.svelte b/frontend/src/lib/components/FlowBuilder.svelte
index a824547071..a3f4e8752a 100644
--- a/frontend/src/lib/components/FlowBuilder.svelte
+++ b/frontend/src/lib/components/FlowBuilder.svelte
@@ -19,6 +19,7 @@
 		readFieldsRecursively,
 		replaceFalseWithUndefined,
 		isMac,
+		userPathPrefix,
 		type Item,
 		type StateStore,
 		type Value
@@ -45,7 +46,6 @@
 	import { GroupEditor, setGroupEditorContext } from './graph/groupEditor.svelte'
 	import { cleanFlow } from './flows/utils.svelte'
 	import {
-		Calendar,
 		Save,
 		DiffIcon,
 		HistoryIcon,
@@ -70,7 +70,7 @@
 	import { resetAllTodos, skipAllTodos } from '$lib/tutorialUtils'
 	import { tutorialsToDo } from '$lib/stores'
 	import { getTutorialIndex } from '$lib/tutorials/config'
-	import SummaryPathDisplay from './SummaryPathDisplay.svelte'
+	import EditorHeader from './EditorHeader.svelte'
 	import type { FlowBuilderWhitelabelCustomUi } from './custom_ui'
 	import FlowYamlEditor from './flows/header/FlowYamlEditor.svelte'
 	import { type TriggerContext, type ScheduleTrigger } from './triggers'
@@ -129,7 +129,8 @@
 		onDetails,
 		onSaveDraftError,
 		onSaveDraftOnlyAtNewPath,
-		onHistoryRestore
+		onHistoryRestore,
+		onNavigate
 	}: FlowBuilderProps = $props()
 
 	let initialPathStore = writable(initialPath)
@@ -146,13 +147,7 @@
 	})
 
 	// used for new flows for captures
-	let fakeInitialPath =
-		'u/' +
-		($userStore?.username?.includes('@')
-			? $userStore!.username.split('@')[0].replace(/[^a-zA-Z0-9_]/g, '')
-			: $userStore?.username) +
-		'/' +
-		generateRandomString(12)
+	let fakeInitialPath = userPathPrefix($userStore?.username) + generateRandomString(12)
 
 	// Used by multiplayer deploy collision warning
 	let deployedValue: Value | undefined = $state(undefined) // Value to diff against
@@ -202,6 +197,11 @@
 			savedValue: savedFlow,
 			modifiedValue: {
 				...flowStore.val,
+				// `$pathStore` is the live-edited path (the pen popover binds it).
+				// `flowStore.val.path` doesn't track those edits, so without this the
+				// rename wouldn't show up in the diff and the unsaved-changes warning
+				// wouldn't fire when leaving with a pending rename.
+				path: $pathStore,
 				draft_triggers: structuredClone(triggersState.getDraftTriggersSnapshot())
 			}
 		}
@@ -714,16 +714,13 @@
 			return
 		}
 
-		switch (event.key) {
-			case 'Z':
-				if (event.ctrlKey || event.metaKey) {
-					handleRedo()
-					event.preventDefault()
-				}
-				break
+		// Only lowercase single-char keys — named keys like `ArrowDown` must
+		// stay PascalCase to match their switch cases.
+		switch (event.key.length === 1 ? event.key.toLowerCase() : event.key) {
 			case 'z':
 				if (event.ctrlKey || event.metaKey) {
-					handleUndo()
+					if (event.shiftKey) handleRedo()
+					else handleUndo()
 					event.preventDefault()
 				}
 				break
@@ -776,7 +773,10 @@
 		if (savedFlow?.draft_only === false || savedFlow?.draft_only === undefined) {
 			dropdownItems.push({
 				label: 'Exit & see details',
-				onClick: () => onDetails?.({ path: $pathStore })
+				// Use the deployed path, not the live `$pathStore` — the latter
+				// reflects local rename edits that haven't been deployed yet,
+				// which would land the user on a 404 details page.
+				onClick: () => onDetails?.({ path: initialPath })
 			})
 		}
 
@@ -978,9 +978,20 @@
 			readFieldsRecursively(flowStore.val)
 		}
 	})
+	// Sync `$pathStore` from `flowStore.val.path` (which `initFlow` populates
+	// from the loaded flow — including the draft's rename, when there is one).
+	// This effect only tracks `flowStore.val.path`, so popover edits that go
+	// straight to `$pathStore` don't trigger it and aren't overwritten.
+	// Replaces the previous `$pathStore = initialPath` push (added in #2536 for
+	// the VSCode extension), which silently dropped any draft-renamed path
+	// because `initialPath` is the URL, not the loaded path.
 	$effect.pre(() => {
-		initialPath && ($pathStore = initialPath)
+		// `flowStore.val` is typed `OpenFlow` here but `initFlow` actually puts a
+		// `Flow` (with `path`) in it.
+		const p = (flowStore.val as Flow | undefined)?.path
+		if (p) untrack(() => ($pathStore = p))
 	})
+
 	$effect.pre(() => {
 		selectedId && untrack(() => select(selectedId))
 	})
@@ -1103,38 +1114,15 @@
 			<div
 				class="justify-between flex flex-row items-center pl-2 pr-4 space-x-4 scrollbar-hidden overflow-x-auto max-h-12 h-full relative"
 			>
-				<div class="flex w-full gap-8 items-center min-w-0">
-					<SummaryPathDisplay
+				<div class="min-w-0 max-w-full">
+					<EditorHeader
 						bind:summary={flowStore.val.summary}
 						bind:path={$pathStore}
-						kind="flow"
-						editable
+						savedPath={initialPath}
+						onBehalfOfEmail={$savedOnBehalfOfEmail}
+						onNavigate={(item) => onNavigate?.(item)}
 					/>
 				</div>
-
-				<div class="gap-4 flex-row hidden md:flex whitespace-nowrap">
-					{#if triggersState.triggers?.some((t) => t.type === 'schedule')}
-						{@const primaryScheduleIndex = triggersState.triggers.findIndex((t) => t.isPrimary)}
-						{@const scheduleIndex = triggersState.triggers.findIndex((t) => t.type === 'schedule')}
-						<Button
-							btnClasses="hidden lg:inline-flex"
-							startIcon={{ icon: Calendar }}
-							variant="subtle"
-							size="xs"
-							on:click={async () => {
-								select('Trigger')
-								const selected = primaryScheduleIndex ?? scheduleIndex
-								if (selected) {
-									triggersState.selectedTriggerIndex = selected
-								}
-							}}
-						>
-							{triggersState.triggers[primaryScheduleIndex]?.draftConfig?.schedule ??
-								triggersState.triggers[primaryScheduleIndex]?.lightConfig?.schedule ??
-								''}
-						</Button>
-					{/if}
-				</div>
 				<div class="flex flex-row gap-2 items-center">
 					{#if $enterpriseLicense && !newFlow}
 						<Awareness />
diff --git a/frontend/src/lib/components/FlowStatusViewerInner.svelte b/frontend/src/lib/components/FlowStatusViewerInner.svelte
index e9288ca4aa..809eff58d9 100644
--- a/frontend/src/lib/components/FlowStatusViewerInner.svelte
+++ b/frontend/src/lib/components/FlowStatusViewerInner.svelte
@@ -27,6 +27,7 @@
 	import { type DurationStatus, type FlowStatusViewerContext, type GraphModuleState } from './graph'
 	import ModuleStatus from './ModuleStatus.svelte'
 	import { clone, isScriptPreview, msToSec, readFieldsRecursively, truncateRev } from '$lib/utils'
+	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import JobArgs from './JobArgs.svelte'
 	import { ChevronDown, Download, ExternalLink, Hourglass } from 'lucide-svelte'
 	import { deepEqual } from 'fast-equals'
@@ -1838,16 +1839,29 @@
 				style="min-height: {minTabHeight}px"
 			>
 				{#if !hideDownloadLogs && !isReplay && job?.id}
+					{@const logsApiPath = `/w/${workspace}/jobs_u/get_flow_all_logs/${job.id}`}
+					{@const logsName = `windmill_flow_logs_${job.id}.txt`}
 					<div class="flex justify-end p-1">
-						<Button
-							href="{base}/api/w/{workspace}/jobs_u/get_flow_all_logs/{job.id}"
-							download="windmill_flow_logs_{job.id}.txt"
-							color="light"
-							size="xs"
-							startIcon={{ icon: Download }}
-						>
-							Download all logs
-						</Button>
+						{#if shouldDownloadViaClient()}
+							<Button
+								on:click={() => downloadViaClient(logsApiPath, logsName)}
+								color="light"
+								size="xs"
+								startIcon={{ icon: Download }}
+							>
+								Download all logs
+							</Button>
+						{:else}
+							<Button
+								href="{base}/api{logsApiPath}"
+								download={logsName}
+								color="light"
+								size="xs"
+								startIcon={{ icon: Download }}
+							>
+								Download all logs
+							</Button>
+						{/if}
 					</div>
 				{/if}
 				<FlowLogViewerWrapper
diff --git a/frontend/src/lib/components/HistoricInputs.svelte b/frontend/src/lib/components/HistoricInputs.svelte
index ca01013e0a..3c784f354f 100644
--- a/frontend/src/lib/components/HistoricInputs.svelte
+++ b/frontend/src/lib/components/HistoricInputs.svelte
@@ -112,7 +112,8 @@
 				syncQueuedRunsCount: false,
 				refreshRate: 10000,
 				currentWorkspace: $workspaceStore ?? '',
-				skip: !runnableId
+				skip: !runnableId,
+				excludesEntrypointOverride: true
 			}) satisfies UseJobLoaderArgs
 	)
 	let jobs = $derived(jobsLoader?.jobs ?? [])
diff --git a/frontend/src/lib/components/InputError.svelte b/frontend/src/lib/components/InputError.svelte
index f075521740..a431140afa 100644
--- a/frontend/src/lib/components/InputError.svelte
+++ b/frontend/src/lib/components/InputError.svelte
@@ -2,7 +2,7 @@
 	import { slide } from 'svelte/transition'
 
 	interface Props {
-		error: string
+		error?: string | undefined
 	}
 
 	let { error }: Props = $props()
diff --git a/frontend/src/lib/components/InstanceSetting.svelte b/frontend/src/lib/components/InstanceSetting.svelte
index f0097b877a..4964fb9c1d 100644
--- a/frontend/src/lib/components/InstanceSetting.svelte
+++ b/frontend/src/lib/components/InstanceSetting.svelte
@@ -56,6 +56,16 @@
 		attempted_at: string
 	} | null = $state(null)
 
+	let offlineCapStatus: {
+		seats_used: number
+		seats_cap: number
+		author_count: number
+		operator_count: number
+		current_cu: number
+		cu_cap: number
+		cu_over_cap: boolean
+	} | null = $state(null)
+
 	function showSetting(setting: string, values: Record<string, any>) {
 		if (setting == 'dev_instance') {
 			if (values['license_key'] == undefined) {
@@ -72,6 +82,14 @@
 		latestKeyRenewalAttempt = await SettingService.getLatestKeyRenewalAttempt()
 	}
 
+	async function reloadLicenseStatus() {
+		try {
+			offlineCapStatus = (await SettingService.getOfflineLicenseStatus()) as any
+		} catch {
+			offlineCapStatus = null
+		}
+	}
+
 	async function reloadLicenseKey() {
 		$values['license_key'] = await SettingService.getGlobal({
 			key: 'license_key'
@@ -80,7 +98,10 @@
 
 	$effect(() => {
 		if (setting.key == 'license_key') {
-			untrack(() => reloadKeyrenewalAttemptInfo())
+			untrack(() => {
+				reloadKeyrenewalAttemptInfo()
+				reloadLicenseStatus()
+			})
 		}
 	})
 
@@ -430,7 +451,7 @@
 								</div>
 							{/if}
 						{/if}
-						{#if latestKeyRenewalAttempt}
+						{#if latestKeyRenewalAttempt && !offlineCapStatus}
 							{@const attemptedAt = new Date(latestKeyRenewalAttempt.attempted_at).toLocaleString()}
 							{@const isTrial = latestKeyRenewalAttempt.result.startsWith('error: trial:')}
 							<div class="relative">
@@ -500,11 +521,41 @@
 							</div>
 						{/if}
 
+						{#if offlineCapStatus}
+							{@const cap = offlineCapStatus}
+							{@const seatsOver = cap.seats_used > cap.seats_cap}
+							{@const cuOver = cap.cu_over_cap}
+							<div class="mt-1 flex flex-row items-center gap-2 text-xs">
+								<div class="flex flex-row items-center gap-1">
+									{#if seatsOver}
+										<BadgeX class="text-red-600" size={12} />
+									{:else}
+										<BadgeCheck class="text-green-600" size={12} />
+									{/if}
+									<span class={seatsOver ? 'text-red-600' : 'text-green-600'}>
+										Seats: {cap.seats_used.toFixed(1)} / {cap.seats_cap}
+									</span>
+								</div>
+								<div class="flex flex-row items-center gap-1">
+									{#if cuOver}
+										<BadgeX class="text-red-600" size={12} />
+									{:else}
+										<BadgeCheck class="text-green-600" size={12} />
+									{/if}
+									<span class={cuOver ? 'text-red-600' : 'text-green-600'}>
+										CUs: {cap.current_cu.toFixed(2)} / {cap.cu_cap.toFixed(2)}
+									</span>
+								</div>
+							</div>
+						{/if}
+
 						{#if valid || expiration}
 							<div class="flex flex-row gap-2 mt-1">
-								<Button on:click={renewLicenseKey} loading={renewing} size="xs" variant="accent"
-									>Renew key
-								</Button>
+								{#if !offlineCapStatus}
+									<Button on:click={renewLicenseKey} loading={renewing} size="xs" variant="accent"
+										>Renew key
+									</Button>
+								{/if}
 								<Button variant="accent" size="xs" loading={opening} on:click={openCustomerPortal}>
 									Open customer portal
 								</Button>
diff --git a/frontend/src/lib/components/JobArgs.svelte b/frontend/src/lib/components/JobArgs.svelte
index 68ca3c078f..77c94de11e 100644
--- a/frontend/src/lib/components/JobArgs.svelte
+++ b/frontend/src/lib/components/JobArgs.svelte
@@ -13,6 +13,7 @@
 	import HighlightTheme from './HighlightTheme.svelte'
 	import { deepEqual } from 'fast-equals'
 	import { isWindmillTooBigObject } from './job_args'
+	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 
 	interface Props {
 		id?: string | undefined
@@ -27,6 +28,10 @@
 	let runLocally: Drawer | undefined = $state()
 	let jsonStr = $state('')
 
+	const argsDownloadName = 'windmill-args.json'
+	let argsApiPath = $derived(id && workspace ? `/w/${workspace}/jobs_u/get_args/${id}` : undefined)
+	let argsDataHref = $derived(`data:text/json;charset=utf-8,${encodeURIComponent(jsonStr)}`)
+
 	function pythonCode() {
 		return `
 if __name__ == "__main__":
@@ -60,10 +65,12 @@ ${Object.entries(args)
 {#if args && typeof args === 'object' && deepEqual( Object.keys(args ?? {}), ['reason'] ) && args['reason'] == 'PREPROCESSOR_ARGS_ARE_DISCARDED'}
 	Preprocessor args are discarded
 {:else if id && workspace && args && typeof args === 'object' && deepEqual( Object.keys(args ?? {}), ['reason'] ) && args['reason'] == 'WINDMILL_TOO_BIG'}
-	The args are too big in size to be able to fetch alongside job. Please <a
-		href="/api/w/{workspace}/jobs_u/get_args/{id}"
-		target="_blank">download the JSON file to view them</a
-	>.
+	The args are too big in size to be able to fetch alongside job. Please {#if shouldDownloadViaClient()}<button
+			class="text-blue-500 hover:underline"
+			onclick={() => downloadViaClient(argsApiPath!, argsDownloadName)}
+			>download the JSON file to view them</button
+		>{:else}<a href="/api{argsApiPath}" target="_blank">download the JSON file to view them</a
+		>{/if}.
 {:else}
 	<div class="relative">
 		<DataTable size="sm" containerClass="bg-surface-tertiary">
@@ -120,17 +127,26 @@ ${Object.entries(args)
 <Drawer bind:this={jsonViewer} size="900px">
 	<DrawerContent title="Expanded Args" on:close={jsonViewer.closeDrawer}>
 		{#snippet actions()}
-			<Button
-				download="windmill-args.json"
-				href={id && workspace
-					? `/api/w/${workspace}/jobs_u/get_args/${id}`
-					: `data:text/json;charset=utf-8,${encodeURIComponent(jsonStr)}`}
-				startIcon={{ icon: Download }}
-				size="xs"
-				color="light"
-			>
-				Download
-			</Button>
+			{#if argsApiPath && shouldDownloadViaClient()}
+				<Button
+					on:click={() => downloadViaClient(argsApiPath!, argsDownloadName)}
+					startIcon={{ icon: Download }}
+					size="xs"
+					color="light"
+				>
+					Download
+				</Button>
+			{:else}
+				<Button
+					download={argsDownloadName}
+					href={argsApiPath ? `/api${argsApiPath}` : argsDataHref}
+					startIcon={{ icon: Download }}
+					size="xs"
+					color="light"
+				>
+					Download
+				</Button>
+			{/if}
 			<Button
 				on:click={() => runLocally?.openDrawer()}
 				color="light"
@@ -150,15 +166,19 @@ ${Object.entries(args)
 		{/snippet}
 		{#if jsonStr.length > 100000 || (id && workspace && args && isWindmillTooBigObject(args))}
 			<div class="text-sm mb-2 text-primary">
-				<a
-					download="windmill-args.json"
-					href={id && workspace
-						? `/api/w/${workspace}/jobs_u/get_args/${id}`
-						: `data:text/json;charset=utf-8,${encodeURIComponent(jsonStr)}`}
-				>
-					JSON is too large to be displayed in full.
-				</a></div
-			>
+				{#if argsApiPath && shouldDownloadViaClient()}
+					<button
+						class="underline"
+						onclick={() => downloadViaClient(argsApiPath!, argsDownloadName)}
+					>
+						JSON is too large to be displayed in full.
+					</button>
+				{:else}
+					<a download={argsDownloadName} href={argsApiPath ? `/api${argsApiPath}` : argsDataHref}>
+						JSON is too large to be displayed in full.
+					</a>
+				{/if}
+			</div>
 		{:else}
 			<Highlight language={json} code={jsonStr.replace(/\\n/g, '\n')} />
 		{/if}
diff --git a/frontend/src/lib/components/KanidmSetting.svelte b/frontend/src/lib/components/KanidmSetting.svelte
index 199c4bc672..8c696fb155 100644
--- a/frontend/src/lib/components/KanidmSetting.svelte
+++ b/frontend/src/lib/components/KanidmSetting.svelte
@@ -1,23 +1,22 @@
 <script lang="ts">
-	import { run } from 'svelte/legacy';
+	import { run } from 'svelte/legacy'
 
 	import IconedResourceType from './IconedResourceType.svelte'
 	import TextInput from './text_input/TextInput.svelte'
+	import Password from './Password.svelte'
 	import Toggle from './Toggle.svelte'
 	import SettingCard from './instanceSettings/SettingCard.svelte'
 
 	interface Props {
-		value: any;
+		value: any
 	}
 
-	let { value = $bindable() }: Props = $props();
+	let { value = $bindable() }: Props = $props()
 
 	const AUTH_URL_SUFFIX = '/ui/oauth2'
 
-
 	let proxyUrlValue = $state(undefined)
 
-
 	function changeValues({ baseUrl, id }) {
 		if (value) {
 			value = {
@@ -47,7 +46,7 @@
 	let baseUrl = $derived(proxyUrlValue ?? derivedBaseUrl ?? '')
 	run(() => {
 		changeValues({ baseUrl, id: value?.id ?? '' })
-	});
+	})
 </script>
 
 <div class="flex flex-col gap-1">
@@ -85,11 +84,12 @@
 					bind:value={value['id']}
 				/>
 			</label>
-			<label class="flex flex-col gap-1">
+			<label for="kanidm_client_secret" class="flex flex-col gap-1">
 				<span class="text-emphasis font-semibold text-xs">Client Secret </span>
-				<TextInput
-					inputProps={{ type: 'text', placeholder: 'Client Secret' }}
-					bind:value={value['secret']}
+				<Password
+					id="kanidm_client_secret"
+					placeholder="Client Secret"
+					bind:password={value['secret']}
 				/>
 			</label>
 		</SettingCard>
diff --git a/frontend/src/lib/components/KeycloakSetting.svelte b/frontend/src/lib/components/KeycloakSetting.svelte
index 52f335b0b9..d475403d29 100644
--- a/frontend/src/lib/components/KeycloakSetting.svelte
+++ b/frontend/src/lib/components/KeycloakSetting.svelte
@@ -2,6 +2,7 @@
 	import { untrack } from 'svelte'
 	import IconedResourceType from './IconedResourceType.svelte'
 	import TextInput from './text_input/TextInput.svelte'
+	import Password from './Password.svelte'
 	import Toggle from './Toggle.svelte'
 	import SettingCard from './instanceSettings/SettingCard.svelte'
 
@@ -82,11 +83,12 @@
 					bind:value={value['id']}
 				/>
 			</label>
-			<label class="flex flex-col gap-1">
+			<label for="keycloak_client_secret" class="flex flex-col gap-1">
 				<span class="text-emphasis font-semibold text-xs">Client Secret </span>
-				<TextInput
-					inputProps={{ type: 'text', placeholder: 'Client Secret' }}
-					bind:value={value['secret']}
+				<Password
+					id="keycloak_client_secret"
+					placeholder="Client Secret"
+					bind:password={value['secret']}
 				/>
 			</label>
 		</SettingCard>
diff --git a/frontend/src/lib/components/LabelsInput.svelte b/frontend/src/lib/components/LabelsInput.svelte
index e357f62895..933fe38ea1 100644
--- a/frontend/src/lib/components/LabelsInput.svelte
+++ b/frontend/src/lib/components/LabelsInput.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import Badge from './common/badge/Badge.svelte'
+	import Button from './common/button/Button.svelte'
 	import { Plus, Tag, X } from 'lucide-svelte'
 	import { workspaceStore } from '$lib/stores'
 
@@ -155,11 +156,14 @@
 			{/if}
 		</div>
 	{:else}
-		<button
-			class="text-tertiary hover:text-secondary text-2xs flex items-center gap-0.5"
+		<Button
+			variant="subtle"
+			unifiedSize="xs"
+			startIcon={{ icon: Tag }}
+			endIcon={{ icon: Plus, props: { size: 8 } }}
+			btnClasses="!gap-0.5"
+			aria-label="Add label"
 			onclick={startAdding}
-		>
-			<Tag size={12} /><Plus size={8} />
-		</button>
+		/>
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/LogViewer.svelte b/frontend/src/lib/components/LogViewer.svelte
index 9f06f90eec..39089dec8b 100644
--- a/frontend/src/lib/components/LogViewer.svelte
+++ b/frontend/src/lib/components/LogViewer.svelte
@@ -11,11 +11,12 @@
 </script>
 
 <script lang="ts">
-	import { ClipboardCopy, Download, Expand, Loader2 } from 'lucide-svelte'
+	import { ClipboardCopy, Download, Expand, Loader2, Timer, Cpu } from 'lucide-svelte'
 	import { Button, Drawer, DrawerContent } from './common'
 	import { copyToClipboard } from '$lib/utils'
 	import { base } from '$lib/base'
 	import { withExternalDomain } from '$lib/externalDomain'
+	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import { workspaceStore } from '$lib/stores'
 	import { AnsiUp } from 'ansi_up'
 	import NoWorkerWithTagWarning from './runs/NoWorkerWithTagWarning.svelte'
@@ -166,8 +167,7 @@
 	}
 
 	export function scrollToBottom() {
-		scroll &&
-			setTimeout(() => preEl?.scroll({ top: preEl?.scrollHeight, behavior: 'smooth' }), 100)
+		scroll && setTimeout(() => preEl?.scroll({ top: preEl?.scrollHeight, behavior: 'smooth' }), 100)
 	}
 
 	let logViewer: Drawer | undefined = $state()
@@ -205,9 +205,9 @@
 			scroll = true
 		}
 	})
-	let downloadHref = $derived(
-		withExternalDomain(`${base}/api/w/${$workspaceStore}/jobs_u/get_logs/${jobId}`)
-	)
+	let logsApiPath = $derived(`/w/${$workspaceStore}/jobs_u/get_logs/${jobId}`)
+	let downloadHref = $derived(withExternalDomain(`${base}/api${logsApiPath}`))
+	let downloadName = $derived(`windmill_logs_${jobId}.txt`)
 	let truncatedContent = $derived(truncateContent(content, loadedFromObjectStore, LOG_LIMIT))
 	let prefixInfo = $derived(findPrefixInfo(truncatedContent))
 	let downloadStartUrl = $derived(findStartUrl(truncatedContent, prefixInfo))
@@ -247,17 +247,30 @@
 	<DrawerContent title="Expanded Logs" on:close={logViewer.closeDrawer}>
 		{#snippet actions()}
 			{#if jobId && download}
-				<Button
-					href={downloadHref}
-					download="windmill_logs_{jobId}.txt"
-					color="light"
-					size="xs"
-					startIcon={{
-						icon: Download
-					}}
-				>
-					Download
-				</Button>
+				{#if shouldDownloadViaClient()}
+					<Button
+						on:click={() => downloadViaClient(logsApiPath, downloadName)}
+						color="light"
+						size="xs"
+						startIcon={{
+							icon: Download
+						}}
+					>
+						Download
+					</Button>
+				{:else}
+					<Button
+						href={downloadHref}
+						download={downloadName}
+						color="light"
+						size="xs"
+						startIcon={{
+							icon: Download
+						}}
+					>
+						Download
+					</Button>
+				{/if}
 			{/if}
 
 			<Button
@@ -296,7 +309,9 @@
 			class="w-full h-full bg-surface-secondary flex flex-col {noMaxH ? '' : 'max-h-screen'}"
 			data-nav-id={navigationId}
 		>
-			<div class="flex gap-2 ml-2 {small ? 'py-1' : 'py-2'} border-b">
+			<div
+				class="flex gap-2 ml-2 {small ? 'py-1' : 'py-2'} border-b overflow-x-auto overflow-y-hidden"
+			>
 				{#if isLoading}
 					<div class="flex gap-2 items-center">
 						<Loader2 class="animate-spin" />
@@ -312,31 +327,54 @@
 					</div>
 				{:else if duration}
 					<span
-						class={twMerge('text-secondary dark:text-gray-400', small ? '!text-2xs' : '!text-xs')}
-						>took {duration}ms</span
+						class={twMerge(
+							'flex items-center gap-1 text-secondary dark:text-gray-400',
+							small ? '!text-2xs' : '!text-xs'
+						)}
+						title="Duration"
 					>
+						<Timer size={small ? 10 : 12} />
+						{duration}ms
+					</span>
 				{/if}
 				{#if mem}
-					<span class="{small ? '!text-2xs' : '!text-xs'} text-secondary dark:text-gray-400"
-						>mem peak: {(mem / 1024).toPrecision(4)}MB</span
+					<span
+						class={twMerge(
+							'flex items-center gap-1 text-secondary dark:text-gray-400',
+							small ? '!text-2xs' : '!text-xs'
+						)}
+						title="Memory peak"
 					>
+						<Cpu size={small ? 10 : 12} />
+						{(mem / 1024).toPrecision(4)}MB
+					</span>
 				{/if}
 				<div class="flex gap-2 justify-end flex-1">
 					{#if jobId && download}
 						<div class="flex items-center">
-							<a
-								class="text-primary pb-0.5"
-								target="_blank"
-								href={downloadHref}
-								download="windmill_logs_{jobId}.txt"
-								><Download size="14" />
-							</a>
+							{#if shouldDownloadViaClient()}
+								<button
+									class="text-primary pb-0.5"
+									onclick={() => downloadViaClient(logsApiPath, downloadName)}
+									><Download size="14" />
+								</button>
+							{:else}
+								<a
+									class="text-primary pb-0.5"
+									target="_blank"
+									href={downloadHref}
+									download={downloadName}
+									><Download size="14" />
+								</a>
+							{/if}
 						</div>
 					{/if}
 					<button onclick={logViewer.openDrawer}><Expand size="12" /></button>
 					{#if !noAutoScroll}
-						<label class="pr-2 text-2xs flex gap-2 font-normal text-primary items-center">
-							Auto scroll
+						<label
+							class="pr-2 text-2xs flex gap-2 font-normal text-primary items-center whitespace-nowrap"
+						>
+							auto-scroll
 							<input class="windmillapp" type="checkbox" bind:checked={scroll} />
 						</label>
 					{/if}
diff --git a/frontend/src/lib/components/NextcloudSetting.svelte b/frontend/src/lib/components/NextcloudSetting.svelte
index f52ffec7ae..44904b2811 100644
--- a/frontend/src/lib/components/NextcloudSetting.svelte
+++ b/frontend/src/lib/components/NextcloudSetting.svelte
@@ -2,6 +2,7 @@
 	import CollapseLink from './CollapseLink.svelte'
 	import IconedResourceType from './IconedResourceType.svelte'
 	import TextInput from './text_input/TextInput.svelte'
+	import Password from './Password.svelte'
 	import Toggle from './Toggle.svelte'
 	import SettingCard from './instanceSettings/SettingCard.svelte'
 
@@ -85,14 +86,15 @@
 					bind:value={value['id']}
 				/>
 			</label>
-			<label class="flex flex-col gap-1">
+			<label for="nextcloud_client_secret" class="flex flex-col gap-1">
 				<span class="text-emphasis font-semibold text-xs">Client Secret </span>
 				<span class="text-secondary font-normal text-xs"
 					>Client Secret from your Nextcloud OAuth2 app configuration</span
 				>
-				<TextInput
-					inputProps={{ type: 'password', placeholder: 'Client Secret' }}
-					bind:value={value['secret']}
+				<Password
+					id="nextcloud_client_secret"
+					placeholder="Client Secret"
+					bind:password={value['secret']}
 				/>
 			</label>
 			<CollapseLink text="Instructions">
diff --git a/frontend/src/lib/components/OAuthSetting.svelte b/frontend/src/lib/components/OAuthSetting.svelte
index 8b16310877..60f8e8ef5f 100644
--- a/frontend/src/lib/components/OAuthSetting.svelte
+++ b/frontend/src/lib/components/OAuthSetting.svelte
@@ -7,6 +7,7 @@
 	import { enterpriseLicense } from '$lib/stores'
 	import Button from './common/button/Button.svelte'
 	import TextInput from './text_input/TextInput.svelte'
+	import Password from './Password.svelte'
 	import SettingCard from './instanceSettings/SettingCard.svelte'
 
 	interface Props {
@@ -121,11 +122,12 @@
 					bind:value={value['id']}
 				/>
 			</label>
-			<label class="flex flex-col gap-1">
+			<label for="{name}_client_secret" class="flex flex-col gap-1">
 				<span class="text-emphasis font-semibold text-xs">Client Secret</span>
-				<TextInput
-					inputProps={{ type: 'text', placeholder: 'Client Secret' }}
-					bind:value={value['secret']}
+				<Password
+					id="{name}_client_secret"
+					placeholder="Client Secret"
+					bind:password={value['secret']}
 				/>
 			</label>
 			{#if name == 'microsoft' || name == 'teams'}
diff --git a/frontend/src/lib/components/OktaSetting.svelte b/frontend/src/lib/components/OktaSetting.svelte
index 495ed5794c..644b707204 100644
--- a/frontend/src/lib/components/OktaSetting.svelte
+++ b/frontend/src/lib/components/OktaSetting.svelte
@@ -5,6 +5,7 @@
 	import Toggle from './Toggle.svelte'
 	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
 	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import Password from './Password.svelte'
 	import SettingCard from './instanceSettings/SettingCard.svelte'
 
 	interface Props {
@@ -95,12 +96,16 @@
 				>
 				<input type="text" placeholder="Client Id" bind:value={value['id']} />
 			</label>
-			<label class="flex flex-col gap-1">
+			<label for="okta_client_secret" class="flex flex-col gap-1">
 				<span class="text-emphasis font-semibold text-xs">Client Secret </span>
 				<span class="text-secondary font-normal text-xs"
 					>from the CLIENT SECRETS section of the okta service configuration</span
 				>
-				<input type="text" placeholder="Client Secret" bind:value={value['secret']} />
+				<Password
+					id="okta_client_secret"
+					placeholder="Client Secret"
+					bind:password={value['secret']}
+				/>
 			</label>
 			<CollapseLink text="Instructions">
 				<div class="text-xs text-primary border rounded-md p-4 space-y-3">
diff --git a/frontend/src/lib/components/ParqetCsvTableRenderer.svelte b/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
index 262be32363..fd08eb64be 100644
--- a/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
+++ b/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
@@ -9,6 +9,7 @@
 	import DarkModeObserver from './DarkModeObserver.svelte'
 	import { HelpersService } from '$lib/gen'
 	import { base } from '$lib/base'
+	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import { enterpriseLicense, workspaceStore } from '$lib/stores'
 	import { Download } from 'lucide-svelte'
 	import { Loader2 } from 'lucide-svelte'
@@ -200,14 +201,26 @@
 		</div>
 	{/if}
 	{#if !disable_download && !s3resource.endsWith('.csv')}
-		<a
-			target="_blank"
-			href="{base}/api/w/{workspaceId}/job_helpers/download_s3_parquet_file_as_csv?file_key={encodeURIComponent(
-				s3resource
-			)}{storage ? `&storage=${storage}` : ''}"
-			class="text-secondary w-full text-right underline text-2xs whitespace-nowrap"
-			><div class="flex flex-row-reverse gap-2 items-center"><Download size={12} /> CSV</div></a
-		>
+		{@const csvApiPath = `/w/${workspaceId}/job_helpers/download_s3_parquet_file_as_csv?file_key=${encodeURIComponent(s3resource)}${storage ? `&storage=${storage}` : ''}`}
+		{@const csvName = (s3resource.split('/').pop() ?? 'download') + '.csv'}
+		{#if shouldDownloadViaClient()}
+			<button
+				class="text-secondary w-full text-right underline text-2xs whitespace-nowrap"
+				onclick={() => downloadViaClient(csvApiPath, csvName)}
+				><div class="flex flex-row-reverse gap-2 items-center"
+					><Download size={12} /> CSV</div
+				></button
+			>
+		{:else}
+			<a
+				target="_blank"
+				href="{base}/api{csvApiPath}"
+				class="text-secondary w-full text-right underline text-2xs whitespace-nowrap"
+				><div class="flex flex-row-reverse gap-2 items-center"
+					><Download size={12} /> CSV</div
+				></a
+			>
+		{/if}
 	{/if}
 
 	{#if nbRows != undefined}
diff --git a/frontend/src/lib/components/Path.svelte b/frontend/src/lib/components/Path.svelte
index 6e1244b05f..44b76e17e7 100644
--- a/frontend/src/lib/components/Path.svelte
+++ b/frontend/src/lib/components/Path.svelte
@@ -33,12 +33,13 @@
 	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
 	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import { random_adj } from './random_positive_adjetive'
-	import { Folder, Loader2, SearchCode, User } from 'lucide-svelte'
+	import { Folder, SearchCode, User } from 'lucide-svelte'
 	import Tooltip from './Tooltip.svelte'
 	import { tick } from 'svelte'
 	import FolderPicker from './FolderPicker.svelte'
 	import PathNameAutocomplete from './PathNameAutocomplete.svelte'
 	import TextInput from './text_input/TextInput.svelte'
+	import InputError from './InputError.svelte'
 
 	type PathKind =
 		| 'resource'
@@ -355,6 +356,19 @@
 		!dirty && (dirty = true)
 	}
 
+	$effect(() => {
+		if (
+			path !== undefined &&
+			path !== '' &&
+			initialPath &&
+			!initialPath.startsWith('tmp/') &&
+			path !== initialPath &&
+			!dirty
+		) {
+			dirty = true
+		}
+	})
+
 	const openSearchWithPrefilledText: (t?: string) => void = getContext(
 		'openSearchWithPrefilledText'
 	)
@@ -524,14 +538,13 @@
 				/>
 				<!-- <span class="font-mono text-sm break-all">{path}</span> -->
 			</div>
-			<div class="text-red-600 dark:text-red-400 text-2xs mt-1.5">{error}</div>
 		</div>
 	{/if}
 
+	<InputError {error} />
+
 	{#if pathUsageInFlowsPromise || pathUsageInAppsPromise || pathUsageInScriptsPromise}
-		{#await Promise.all( [pathUsageInAppsPromise, pathUsageInFlowsPromise, pathUsageInScriptsPromise] )}
-			<Loader2 class="animate-spin" size={16} />
-		{:then [apps, flows, scripts]}
+		{#await Promise.all( [pathUsageInAppsPromise, pathUsageInFlowsPromise, pathUsageInScriptsPromise] ) then [apps, flows, scripts]}
 			{#if (apps && apps.length) || (flows && flows.length) || (scripts && scripts.length)}
 				<p class="text-xs">
 					Used by {localeConcatAnd([
diff --git a/frontend/src/lib/components/PocketIdSetting.svelte b/frontend/src/lib/components/PocketIdSetting.svelte
index 812bc6c734..62dec08349 100644
--- a/frontend/src/lib/components/PocketIdSetting.svelte
+++ b/frontend/src/lib/components/PocketIdSetting.svelte
@@ -2,6 +2,7 @@
 	import { untrack } from 'svelte'
 	import IconedResourceType from './IconedResourceType.svelte'
 	import TextInput from './text_input/TextInput.svelte'
+	import Password from './Password.svelte'
 	import Toggle from './Toggle.svelte'
 	import SettingCard from './instanceSettings/SettingCard.svelte'
 
@@ -76,11 +77,12 @@
 					bind:value={value['id']}
 				/>
 			</label>
-			<label class="flex flex-col gap-1">
+			<label for="pocketid_client_secret" class="flex flex-col gap-1">
 				<span class="text-emphasis font-semibold text-xs">Client Secret</span>
-				<TextInput
-					inputProps={{ type: 'text', placeholder: 'Client Secret' }}
-					bind:value={value['secret']}
+				<Password
+					id="pocketid_client_secret"
+					placeholder="Client Secret"
+					bind:password={value['secret']}
 				/>
 			</label>
 		</SettingCard>
diff --git a/frontend/src/lib/components/S3FilePickerInner.svelte b/frontend/src/lib/components/S3FilePickerInner.svelte
index f07ccbccaf..24b8b72892 100644
--- a/frontend/src/lib/components/S3FilePickerInner.svelte
+++ b/frontend/src/lib/components/S3FilePickerInner.svelte
@@ -38,6 +38,7 @@
 		sendUserToast,
 		type S3Object
 	} from '$lib/utils'
+	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import { Alert, Button } from './common'
 	import Section from './Section.svelte'
 	import { createEventDispatcher, untrack, type Snippet } from 'svelte'
@@ -716,14 +717,27 @@
 						{#if filePreview !== undefined && (!hideS3SpecificDetails || !readOnlyMode || allowDelete)}
 							<div class="flex gap-2 shrink-0">
 								{#if !hideS3SpecificDetails}
-									<Button
-										title="Download file from S3"
-										variant="default"
-										href={`${base}/api/w/${$workspaceStore}/job_helpers/download_s3_file?file_key=${encodeURIComponent(fileMetadata?.fileKey ?? '')}${storage ? `&storage=${storage}` : ''}`}
-										download={fileMetadata?.fileKey.split('/').pop() ?? 'unnamed_download.file'}
-										startIcon={{ icon: Download }}
-										iconOnly={true}
-									/>
+									{@const downloadApiPath = `/w/${$workspaceStore}/job_helpers/download_s3_file?file_key=${encodeURIComponent(fileMetadata?.fileKey ?? '')}${storage ? `&storage=${storage}` : ''}`}
+									{@const downloadName =
+										fileMetadata?.fileKey.split('/').pop() ?? 'unnamed_download.file'}
+									{#if shouldDownloadViaClient()}
+										<Button
+											title="Download file from S3"
+											variant="default"
+											on:click={() => downloadViaClient(downloadApiPath, downloadName)}
+											startIcon={{ icon: Download }}
+											iconOnly={true}
+										/>
+									{:else}
+										<Button
+											title="Download file from S3"
+											variant="default"
+											href={`${base}/api${downloadApiPath}`}
+											download={downloadName}
+											startIcon={{ icon: Download }}
+											iconOnly={true}
+										/>
+									{/if}
 								{/if}
 								{#if !readOnlyMode}
 									<Button
diff --git a/frontend/src/lib/components/ScriptBuilder.svelte b/frontend/src/lib/components/ScriptBuilder.svelte
index 78c950e3d9..e879977c24 100644
--- a/frontend/src/lib/components/ScriptBuilder.svelte
+++ b/frontend/src/lib/components/ScriptBuilder.svelte
@@ -42,7 +42,7 @@
 	} from '$lib/utils'
 	import Path from './Path.svelte'
 	import ScriptEditor from './ScriptEditor.svelte'
-	import { Alert, Badge, Button, Drawer, SecondsInput, Tab, TabContent, Tabs } from './common'
+	import { Alert, Button, Drawer, SecondsInput, Tab, TabContent, Tabs } from './common'
 	import LanguageIcon from './common/languageIcons/LanguageIcon.svelte'
 	import type { SupportedLanguage, Schema } from '$lib/common'
 	import Tooltip from './Tooltip.svelte'
@@ -50,19 +50,7 @@
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
 	import ErrorHandlerToggleButton from '$lib/components/details/ErrorHandlerToggleButton.svelte'
-	import {
-		Bug,
-		Calendar,
-		CheckCircle,
-		Code,
-		Pen,
-		Plus,
-		Rocket,
-		Save,
-		Settings,
-		Shuffle,
-		X
-	} from 'lucide-svelte'
+	import { Bug, CheckCircle, Code, Plus, Rocket, Save, Settings, Shuffle, X } from 'lucide-svelte'
 	import { sendUserToast } from '$lib/toast'
 	import { isCloudHosted } from '$lib/cloud'
 	import Awareness from './Awareness.svelte'
@@ -79,7 +67,7 @@
 	import { defaultScriptLanguages, processLangs } from '$lib/scripts'
 	import DefaultScripts from './DefaultScripts.svelte'
 	import { onMount, setContext, untrack } from 'svelte'
-	import Summary from './Summary.svelte'
+	import EditorHeader from './EditorHeader.svelte'
 	import LabelsInput from './LabelsInput.svelte'
 
 	import DeployOverrideConfirmationModal from '$lib/components/common/confirmationModal/DeployOverrideConfirmationModal.svelte'
@@ -100,7 +88,6 @@
 	import type { ScriptBuilderProps } from './script_builder'
 	import type { DiffDrawerI } from './diff_drawer'
 	import WorkerTagSelect from './WorkerTagSelect.svelte'
-	import { inputSizeClasses } from './text_input/TextInput.svelte'
 	import type { ButtonType } from './common/button/model'
 	import DebounceLimit from './flows/DebounceLimit.svelte'
 	import { isRuleActive } from '$lib/workspaceProtectionRules.svelte'
@@ -149,6 +136,7 @@
 		onSeeDetails,
 		onSaveDraftError,
 		onSaveDraft,
+		onNavigate,
 		disableAi
 	}: ScriptBuilderProps = $props()
 
@@ -1178,6 +1166,14 @@
 													namePlaceholder="script"
 													kind="script"
 												/>
+												{#if initialPath && script.path && script.path !== initialPath}
+													<Alert
+														type="info"
+														size="xs"
+														title="Deploy the script to make the path change effective."
+														class="mt-2"
+													/>
+												{/if}
 											</Label>
 											<Label label="Description">
 												<MetadataGen
@@ -1928,78 +1924,32 @@
 	<div class="flex flex-col h-screen">
 		<div class="flex h-12 items-center px-4">
 			<div class="flex gap-2 lg:gap-2 w-full items-center">
-				<div class="flex flex-row gap-2 grow max-w-md">
-					<div class="center-center">
-						<button
-							disabled={customUi?.topBar?.settings == false}
-							onclick={async () => {
-								metadataOpen = true
-							}}
-						>
-							<LanguageIcon lang={script.language} size={24} />
-						</button>
-					</div>
-					<Summary
-						disabled={customUi?.topBar?.editableSummary == false}
-						bind:value={script.summary}
-					/>
+				<div class="flex flex-row items-center gap-2 min-w-0 max-w-full">
+					<button
+						disabled={customUi?.topBar?.settings == false}
+						class="shrink-0"
+						onclick={async () => {
+							metadataOpen = true
+						}}
+					>
+						<LanguageIcon lang={script.language} size={24} />
+					</button>
+					{#if customUi?.topBar?.path != false}
+						<EditorHeader
+							bind:summary={script.summary}
+							bind:path={script.path}
+							savedPath={initialPath}
+							kind="script"
+							summaryEditable={customUi?.topBar?.editableSummary != false}
+							pathEditable={customUi?.topBar?.editablePath != false}
+							onNavigate={(item) => onNavigate?.(item)}
+						/>
+					{/if}
 				</div>
 
 				<!-- Separator -->
 				<div class="flex-1"></div>
 
-				<div class="gap-4 flex whitespace-nowrap">
-					{#if triggersState.triggers?.some((t) => t.type === 'schedule')}
-						{@const primarySchedule = triggersState.triggers.findIndex((t) => t.isPrimary)}
-						{@const schedule = triggersState.triggers.findIndex((t) => t.type === 'schedule')}
-
-						<Button
-							btnClasses="hidden lg:inline-flex"
-							startIcon={{ icon: Calendar }}
-							variant="contained"
-							color="light"
-							size="xs"
-							on:click={async () => {
-								metadataOpen = true
-								selectedTab = 'triggers'
-								triggersState.selectedTriggerIndex = primarySchedule ?? schedule
-							}}
-						>
-							{triggersState.triggers[primarySchedule]?.draftConfig?.schedule ??
-								triggersState.triggers[primarySchedule]?.lightConfig?.schedule ??
-								''}
-						</Button>
-					{/if}
-					{#if customUi?.topBar?.path != false}
-						<div class="flex justify-start w-full items-center">
-							{#if customUi?.topBar?.editablePath != false}
-								<button
-									onclick={async () => {
-										metadataOpen = true
-									}}
-								>
-									<Badge
-										color="gray"
-										class="center-center !bg-surface-secondary !text-primary {inputSizeClasses.md}  !w-[70px] rounded-r-none hover:!bg-surface-hover transition-all border border-r-0"
-									>
-										<Pen size={12} class="mr-2 shrink-0" /> Path
-									</Badge>
-								</button>
-							{/if}
-							<input
-								type="text"
-								readonly
-								value={script.path}
-								size={script.path?.length || 50}
-								class="font-mono !text-xs !min-w-[96px] !max-w-[300px] !w-full {inputSizeClasses.md} !my-0 !py-0 !rounded-l-none border border-l-0 !shadow-none"
-								onfocus={({ currentTarget }) => {
-									currentTarget.select()
-								}}
-							/>
-						</div>
-					{/if}
-				</div>
-
 				{#if $enterpriseLicense && initialPath != ''}
 					<Awareness />
 				{/if}
diff --git a/frontend/src/lib/components/ScriptEditor.svelte b/frontend/src/lib/components/ScriptEditor.svelte
index c676fc0e19..15f71162cb 100644
--- a/frontend/src/lib/components/ScriptEditor.svelte
+++ b/frontend/src/lib/components/ScriptEditor.svelte
@@ -561,6 +561,8 @@
 	let testIsLoading = $state(false)
 	let testJob: Job | undefined = $state()
 	let pastPreviews: CompletedJob[] = $state([])
+	let historyTabActive = false
+	let pastPreviewsRequest: ReturnType<typeof JobService.listCompletedJobs> | undefined
 	let validCode = $state(true)
 
 	// Recording
@@ -691,7 +693,9 @@
 						lastRecording = scriptRecording.stop()
 						setActiveRecording(undefined)
 					}
-					loadPastTests()
+					if (historyTabActive) {
+						loadPastTests()
+					}
 				},
 				doneError({ error }) {
 					if (scriptRecording.active) {
@@ -722,12 +726,29 @@
 	}
 
 	async function loadPastTests(): Promise<void> {
-		pastPreviews = await JobService.listCompletedJobs({
+		pastPreviewsRequest?.cancel()
+		const req = JobService.listCompletedJobs({
 			workspace: $workspaceStore!,
 			jobKinds: 'preview',
 			createdBy: $userStore?.username,
-			scriptPathExact: path
+			scriptPathExact: path,
+			hasNullParent: true
 		})
+		pastPreviewsRequest = req
+		try {
+			const result = await req
+			if (pastPreviewsRequest === req) {
+				pastPreviews = result
+			}
+		} catch (err) {
+			if (!(err instanceof Error) || err.name !== 'CancelError') {
+				throw err
+			}
+		} finally {
+			if (pastPreviewsRequest === req) {
+				pastPreviewsRequest = undefined
+			}
+		}
 	}
 
 	export async function inferSchema(
@@ -1128,7 +1149,6 @@
 		if (!validCode && code && lang) {
 			await inferSchema(code, { applyInitialArgs: true })
 		}
-		loadPastTests()
 		aiChatManager.saveAndClear()
 		aiChatManager.changeMode(AIMode.SCRIPT)
 	})
@@ -1209,6 +1229,8 @@
 	}
 
 	onDestroy(() => {
+		pastPreviewsRequest?.cancel()
+		pastPreviewsRequest = undefined
 		disableCollaboration()
 		aiChatManager.scriptEditorApplyCode = undefined
 		aiChatManager.scriptEditorShowDiffMode = undefined
@@ -1676,6 +1698,12 @@
 										} as any)
 									: testJob}
 								{pastPreviews}
+								onTabChange={(tab) => {
+									historyTabActive = tab === 'history'
+									if (historyTabActive) {
+										loadPastTests()
+									}
+								}}
 								previewIsLoading={debugMode
 									? $debugState.running && !$debugState.stopped
 									: testIsLoading}
diff --git a/frontend/src/lib/components/VariableForm.svelte b/frontend/src/lib/components/VariableForm.svelte
index 167172450e..0ffa4d8ba6 100644
--- a/frontend/src/lib/components/VariableForm.svelte
+++ b/frontend/src/lib/components/VariableForm.svelte
@@ -86,7 +86,7 @@
 {#if deployTo}
 	<Label
 		label="Workspace specific"
-		tooltip="Prevents this variable from being deployed to prod/staging"
+		tooltip="Prevents this variable from being deployed to prod/staging. May have been enabled automatically because a workspace-specific resource references this variable via $var:. Disabling this toggle does not retroactively un-mark the resource that referenced it."
 	>
 		<Toggle bind:checked={wsSpecific} />
 	</Label>
diff --git a/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte b/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte
new file mode 100644
index 0000000000..abee584afa
--- /dev/null
+++ b/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte
@@ -0,0 +1,699 @@
+<!--
+@component
+Drill-through workspace item picker. One level is shown at a time:
+
+  - **Root** (no scope): All + kinds (Flows / Scripts / Apps). "All" is a
+    cross-kind row — drilling in shows folders/items merged across every kind.
+  - **Kind** (`{ kind }`): top-level scopes for that kind (e.g. `f/demo`, `u/alice`).
+    `kind: 'all'` is the cross-kind variant — folders contain items from
+    every kind, leaves still belong to a real kind.
+  - **Dir** (`{ kind, dir }`): immediate children of `dir` — subdirs + leaves.
+
+Clicking a row drills *down*; the chevron-left in the header walks one level
+*up*. Search is global across all kinds and ignores the current scope.
+-->
+<script lang="ts">
+	import { workspaceStore } from '$lib/stores'
+	import { ChevronLeft, ChevronRight, Folder, Layers, Loader2, User } from 'lucide-svelte'
+	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
+	import SearchItems from '$lib/components/SearchItems.svelte'
+	import { onMount, untrack } from 'svelte'
+	import {
+		dirKey,
+		getCachedItems,
+		KIND_LABEL,
+		KIND_LABEL_LOWER,
+		kindKey,
+		leafKeyFor,
+		loadKind,
+		type WorkspaceItem,
+		type WorkspaceItemKind
+	} from './workspacePicker'
+
+	type Kind = WorkspaceItemKind
+	type Item = WorkspaceItem
+	/** `'all'` is a virtual cross-kind scope — items still belong to a real
+	 * kind, but folders and the root row group items from every kind. */
+	type ScopeKind = Kind | 'all'
+
+	export type Scope = { kind: ScopeKind; dir?: string } | undefined
+
+	interface Props {
+		onPick: (item: WorkspaceItem) => void
+		kinds?: Kind[]
+		/** Where the picker lands when first opened. `undefined` = root (kinds list). */
+		initialScope?: Scope
+		/** Composite key of the row to highlight (e.g. `dir:flow:f/demo`). */
+		initialHighlight?: string
+		/** Currently-edited item — gets `aria-current` and a no-op click. If
+		 * `savedPath` differs from `path` (draft rename), the saved entry is
+		 * suppressed so only the live one shows. */
+		currentItem?: WorkspaceItem & { savedPath?: string }
+	}
+
+	let {
+		onPick,
+		kinds = ['flow', 'script', 'app'],
+		initialScope,
+		initialHighlight,
+		currentItem
+	}: Props = $props()
+
+	let searchInput: TextInput | undefined = $state()
+	let pickerRoot: HTMLElement | undefined = $state()
+	const instanceId = crypto.randomUUID()
+	const listboxId = `pkr-list-${instanceId}`
+	const idFor = (key: string) => `pkr-${instanceId}-${key.replace(/[^a-zA-Z0-9-]/g, '_')}`
+
+	export function focus() {
+		searchInput?.focus()
+	}
+
+	// Sibling-popover open: melt-ui's `openFocus` runs once during the close→open
+	// transition; the picker may not be mounted yet. Retry after settle.
+	onMount(() => {
+		const t = setTimeout(focus, 50)
+		return () => clearTimeout(t)
+	})
+
+	const leafKey = (it: Item) => leafKeyFor(it.kind, it.path)
+
+	let scope = $state<Scope>(untrack(() => initialScope))
+	let filter = $state('')
+
+	/** Tracks whether the last user action was mouse movement (true) or
+	 * keyboard nav (false). When false, row `mouseenter` events are ignored
+	 * — prevents the cursor from stealing the keyboard-driven highlight as
+	 * rows shift under it during scope changes. Re-enabled on `mousemove`.
+	 * Starts `false` so the synthetic `mouseenter` fired when the popover
+	 * mounts under a stationary cursor doesn't clobber `initialHighlight`. */
+	let mouseActive = $state(false)
+
+	// Seed from cache so kinds already fetched in this session render on the
+	// first frame. Read once at mount: melt-ui mounts a fresh picker per
+	// popover open, so workspace changes are picked up at the next open
+	// without needing this seed to be reactive.
+	let loaded = $state<Partial<Record<Kind, Item[]>>>(
+		(() => {
+			if (!$workspaceStore) return {}
+			const out: Partial<Record<Kind, Item[]>> = {}
+			for (const k of kinds) {
+				const cached = getCachedItems($workspaceStore, k)
+				if (cached) out[k] = cached
+			}
+			return out
+		})()
+	)
+	let loadingKind = $state<Partial<Record<Kind, boolean>>>({})
+
+	async function ensureLoaded(kind: Kind) {
+		if (!$workspaceStore) return
+		if (loaded[kind]) return
+		loadingKind[kind] = true
+		try {
+			const items = await loadKind($workspaceStore, kind)
+			loaded[kind] = items
+		} finally {
+			loadingKind[kind] = false
+		}
+	}
+
+	// Fetch the scope's kind on entry to a non-root level. The `'all'` scope
+	// needs every kind loaded since it merges items across them.
+	$effect(() => {
+		if (!scope) return
+		if (scope.kind === 'all') for (const k of kinds) ensureLoaded(k)
+		else ensureLoaded(scope.kind)
+	})
+
+	// Searching is global → load every kind.
+	$effect(() => {
+		if (filter.trim() !== '') for (const k of kinds) ensureLoaded(k)
+	})
+
+	type DirNode = {
+		fullPath: string
+		name: string
+		isScope: boolean
+		children: DirNode[]
+		leaves: Item[]
+	}
+
+	/** Inject the currently-edited item into a kind's list at its live path,
+	 * dropping the saved entry when a draft rename is in progress. Other kinds
+	 * pass through untouched. */
+	function withCurrent(items: Item[], k: Kind): Item[] {
+		if (!currentItem || currentItem.kind !== k) return items
+		const drafted =
+			currentItem.savedPath && currentItem.savedPath !== currentItem.path
+				? items.filter((it) => it.path !== currentItem.savedPath)
+				: items
+		if (drafted.some((it) => it.path === currentItem.path)) return drafted
+		return [
+			...drafted,
+			{
+				path: currentItem.path,
+				summary: currentItem.summary,
+				kind: k,
+				raw_app: currentItem.raw_app
+			}
+		]
+	}
+
+	function buildTreeFromItems(items: Item[]): DirNode[] {
+		const scopeRoots = new Map<string, DirNode>()
+		for (const it of items) {
+			const parts = it.path.split('/')
+			if (parts.length < 3) continue
+			const scopeFp = parts.slice(0, 2).join('/')
+			let node = scopeRoots.get(scopeFp)
+			if (!node) {
+				node = { fullPath: scopeFp, name: scopeFp, isScope: true, children: [], leaves: [] }
+				scopeRoots.set(scopeFp, node)
+			}
+			const slug = parts.slice(2)
+			let cur = node
+			for (let i = 0; i < slug.length - 1; i++) {
+				const seg = slug[i]
+				const fullPath = cur.fullPath + '/' + seg
+				let next = cur.children.find((c) => c.name === seg)
+				if (!next) {
+					next = { fullPath, name: seg, isScope: false, children: [], leaves: [] }
+					cur.children.push(next)
+				}
+				cur = next
+			}
+			cur.leaves.push(it)
+		}
+		const scopes = Array.from(scopeRoots.values()).sort((a, b) => {
+			const af = a.fullPath.startsWith('f/') ? 0 : 1
+			const bf = b.fullPath.startsWith('f/') ? 0 : 1
+			if (af !== bf) return af - bf
+			return a.fullPath.localeCompare(b.fullPath)
+		})
+		const sortNode = (n: DirNode) => {
+			n.children.sort((a, b) => a.name.localeCompare(b.name))
+			n.leaves.sort((a, b) => a.path.localeCompare(b.path))
+			n.children.forEach(sortNode)
+		}
+		scopes.forEach(sortNode)
+		return scopes
+	}
+
+	/** Per-kind tree deriveds. Each only re-evaluates `buildTreeFromItems`
+	 * when its own `loaded[k]` changes or when the user is mid-rename on
+	 * that kind — typing in a flow's path edit leaves script/app trees
+	 * cached. */
+	function buildIfActive(k: Kind, list: Item[] | undefined): DirNode[] {
+		if (!kinds.includes(k)) return []
+		const items = withCurrent(list ?? [], k)
+		if (items.length === 0) return []
+		return buildTreeFromItems(items)
+	}
+
+	const flowTree = $derived(buildIfActive('flow', loaded.flow))
+	const scriptTree = $derived(buildIfActive('script', loaded.script))
+	const appTree = $derived(buildIfActive('app', loaded.app))
+	/** Cross-kind tree: every loaded item from every active kind, merged into
+	 * one folder hierarchy. Each leaf still carries its real kind, so the row
+	 * icon and `editPathFor` routing still work; folders contain a mix. */
+	const allTree = $derived.by(() => {
+		const merged = kinds.flatMap((k) => withCurrent(loaded[k] ?? [], k))
+		return merged.length === 0 ? [] : buildTreeFromItems(merged)
+	})
+
+	function treeFor(k: ScopeKind): DirNode[] {
+		if (k === 'all') return allTree
+		if (k === 'flow') return flowTree
+		if (k === 'script') return scriptTree
+		return appTree
+	}
+
+	function findDirInList(list: DirNode[], fullPath: string): DirNode | undefined {
+		for (const n of list) {
+			if (n.fullPath === fullPath) return n
+			const sub = findDirInList(n.children, fullPath)
+			if (sub) return sub
+		}
+		return undefined
+	}
+
+	function parentDirPath(p: string): string | undefined {
+		const parts = p.split('/')
+		if (parts.length <= 2) return undefined
+		return parts.slice(0, -1).join('/')
+	}
+
+	type Entry =
+		| { type: 'kind'; key: string; kind: ScopeKind }
+		| { type: 'dir'; key: string; kind: ScopeKind; node: DirNode }
+		| { type: 'leaf'; key: string; item: Item }
+
+	type DisplayItem = Item & { marked?: string }
+	type SearchInput = Item & { _key: string }
+
+	let allItems = $derived<SearchInput[]>(
+		kinds.flatMap((k) =>
+			withCurrent(loaded[k] ?? [], k).map((it) => ({ ...it, _key: `${k}:${it.path}` }))
+		)
+	)
+
+	let searchedItems: DisplayItem[] | undefined = $state(undefined)
+
+	let isSearching = $derived(filter.trim() !== '')
+
+	let searchResultsByKind = $derived.by(() => {
+		const out: Record<Kind, DisplayItem[]> = { flow: [], script: [], app: [] }
+		if (!searchedItems) return out
+		for (const it of searchedItems) out[it.kind].push(it)
+		return out
+	})
+
+	/** Rows currently shown — drives both rendering and keyboard nav. Not used
+	 * while `isSearching` (search renders its own grouped layout). */
+	let entries = $derived.by<Entry[]>(() => {
+		const s = scope
+		if (!s) {
+			const kindEntries = kinds.map((k) => ({
+				type: 'kind' as const,
+				key: kindKey(k),
+				kind: k
+			}))
+			// "All" only makes sense across multiple kinds — with a single kind
+			// it would duplicate that kind's own root row.
+			if (kinds.length <= 1) return kindEntries
+			return [
+				{ type: 'kind' as const, key: kindKey('all'), kind: 'all' as ScopeKind },
+				...kindEntries
+			]
+		}
+		const tree = treeFor(s.kind)
+		if (!s.dir) {
+			return tree.map((node) => ({
+				type: 'dir',
+				key: dirKey(s.kind, node.fullPath),
+				kind: s.kind,
+				node
+			}))
+		}
+		const node = findDirInList(tree, s.dir)
+		if (!node) return []
+		return [
+			...node.children.map(
+				(c): Entry => ({
+					type: 'dir',
+					key: dirKey(s.kind, c.fullPath),
+					kind: s.kind,
+					node: c
+				})
+			),
+			...node.leaves.map((l): Entry => ({ type: 'leaf', key: leafKey(l), item: l }))
+		]
+	})
+
+	let navKeys = $derived.by(() => {
+		if (isSearching) {
+			return kinds.flatMap((k) => searchResultsByKind[k].map((it) => leafKey(it)))
+		}
+		return entries.map((e) => e.key)
+	})
+
+	let highlightedKey = $state<string | undefined>(untrack(() => initialHighlight))
+	let highlightedId = $derived(highlightedKey ? idFor(highlightedKey) : undefined)
+
+	$effect(() => {
+		if (navKeys.length === 0) return
+		if (!highlightedKey || !navKeys.includes(highlightedKey)) {
+			highlightedKey = navKeys[0]
+		}
+	})
+
+	$effect(() => {
+		if (highlightedKey && navKeys.includes(highlightedKey)) {
+			requestAnimationFrame(scrollHighlightIntoView)
+		}
+	})
+
+	function scrollHighlightIntoView() {
+		if (!pickerRoot || !highlightedKey) return
+		const el = pickerRoot.querySelector<HTMLElement>(
+			`[data-nav-key="${CSS.escape(highlightedKey)}"]`
+		)
+		el?.scrollIntoView({ block: 'nearest', behavior: 'smooth' })
+	}
+
+	function moveHighlight(delta: 1 | -1) {
+		if (navKeys.length === 0) return
+		const cur = navKeys.indexOf(highlightedKey ?? '')
+		const next = cur < 0 ? 0 : (cur + delta + navKeys.length) % navKeys.length
+		highlightedKey = navKeys[next]
+		mouseActive = false
+		requestAnimationFrame(scrollHighlightIntoView)
+	}
+
+	function setHoverHighlight(key: string) {
+		// Ignored until the user actually moves the mouse. Prevents the cursor
+		// (parked over a row) from clobbering keyboard-driven selection when
+		// the layout shifts beneath it.
+		if (mouseActive) highlightedKey = key
+	}
+
+	function isCurrent(it: Item): boolean {
+		return !!currentItem && currentItem.kind === it.kind && currentItem.path === it.path
+	}
+
+	function pick(it: Item) {
+		if (isCurrent(it)) return
+		onPick({ path: it.path, summary: it.summary, kind: it.kind, raw_app: it.raw_app })
+	}
+
+	function activate(key: string | undefined) {
+		if (!key) return
+		if (isSearching) {
+			const flat = kinds.flatMap((k) => searchResultsByKind[k])
+			const it = flat.find((x) => leafKey(x) === key)
+			if (it) pick(it)
+			return
+		}
+		const entry = entries.find((e) => e.key === key)
+		if (!entry) return
+		drill(entry)
+	}
+
+	function drill(entry: Entry) {
+		if (entry.type === 'kind') {
+			scope = { kind: entry.kind }
+		} else if (entry.type === 'dir') {
+			scope = { kind: entry.kind, dir: entry.node.fullPath }
+		} else {
+			pick(entry.item)
+		}
+	}
+
+	function goUp() {
+		if (!scope) return
+		// Highlight the row in the parent view that represents the scope we
+		// just left, so the user sees where they came from.
+		if (!scope.dir) {
+			const leaving = kindKey(scope.kind)
+			scope = undefined
+			highlightedKey = leaving
+			return
+		}
+		const leaving = dirKey(scope.kind, scope.dir)
+		const parent = parentDirPath(scope.dir)
+		scope = parent ? { kind: scope.kind, dir: parent } : { kind: scope.kind }
+		highlightedKey = leaving
+	}
+
+	function handleSearchKeydown(e: KeyboardEvent) {
+		if (e.key === 'ArrowDown') {
+			e.preventDefault()
+			e.stopPropagation()
+			moveHighlight(1)
+		} else if (e.key === 'ArrowUp') {
+			e.preventDefault()
+			e.stopPropagation()
+			moveHighlight(-1)
+		} else if (e.key === 'Enter') {
+			e.preventDefault()
+			e.stopPropagation()
+			mouseActive = false
+			activate(highlightedKey)
+		} else if ((e.key === 'ArrowLeft' || e.key === 'Backspace') && filter === '' && scope) {
+			// Walk up the tree. Only when search is empty — otherwise these
+			// keys would hijack cursor movement / character deletion.
+			e.preventDefault()
+			e.stopPropagation()
+			mouseActive = false
+			goUp()
+		} else if (e.key === 'ArrowRight' && filter === '' && !isSearching) {
+			// Drill into the highlighted folder/kind. Leaves are reserved for
+			// Enter (more deliberate, since picking navigates away).
+			const entry = entries.find((en) => en.key === highlightedKey)
+			if (entry && entry.type !== 'leaf') {
+				e.preventDefault()
+				e.stopPropagation()
+				mouseActive = false
+				drill(entry)
+			}
+		}
+	}
+
+	/** Breadcrumb segments for the header — kind name first, then the scope
+	 * (`f/<folder>` or `u/<user>`) as one chunk, then any nested subdirs. */
+	let headerSegments = $derived.by<string[]>(() => {
+		if (!scope) return []
+		const out = [scope.kind === 'all' ? 'all' : KIND_LABEL_LOWER[scope.kind]]
+		if (scope.dir) {
+			const parts = scope.dir.split('/')
+			out.push(parts.slice(0, 2).join('/'))
+			for (let i = 2; i < parts.length; i++) out.push(parts[i])
+		}
+		return out
+	})
+
+	/** Full breadcrumb (used for the hover tooltip). */
+	let headerLabel = $derived(headerSegments.join(' › '))
+
+	/** Number of intermediate segments to hide behind a `…`. The collapsed
+	 * window is segments[2 .. 2 + hiddenCount); we always keep the first
+	 * two (kind, top-level scope) and the deepest segment. Bumped up by an
+	 * effect that measures actual overflow — see below. */
+	let hiddenCount = $state(0)
+
+	/** Breadcrumb shown to the user. Hides intermediate segments first, then
+	 * relies on `truncate-start` for any remaining overflow on the deepest
+	 * segment. Hover reveals the full path via `title`. */
+	let headerLabelDisplay = $derived.by(() => {
+		if (headerSegments.length <= 3 || hiddenCount === 0) return headerLabel
+		return [
+			headerSegments[0],
+			headerSegments[1],
+			'…',
+			...headerSegments.slice(2 + hiddenCount)
+		].join(' › ')
+	})
+
+	let breadcrumbSpan: HTMLElement | undefined = $state()
+	let lastSegmentsKey = ''
+
+	/** Measurement loop: each pass reads `scrollWidth > clientWidth` on the
+	 * truncated span; if overflowing and there's still an intermediate segment
+	 * to drop, increment `hiddenCount`. Mutating `hiddenCount` re-renders and
+	 * re-fires this effect, so the loop self-terminates either when the text
+	 * fits or when only [kind, scope, …, leaf] remain (`truncate-start` then
+	 * polishes any final overflow). When the breadcrumb itself changes (new
+	 * scope), reset to 0 first so a shorter path can re-expand. */
+	$effect(() => {
+		const key = headerSegments.join('|')
+		const segmentsChanged = key !== lastSegmentsKey
+		if (segmentsChanged) {
+			lastSegmentsKey = key
+			if (hiddenCount !== 0) {
+				hiddenCount = 0
+				return
+			}
+		}
+		// Track hiddenCount so each collapse step re-measures.
+		void hiddenCount
+		if (!breadcrumbSpan) return
+		const maxHide = Math.max(0, headerSegments.length - 3)
+		if (hiddenCount >= maxHide) return
+		queueMicrotask(() => {
+			if (!breadcrumbSpan) return
+			if (breadcrumbSpan.scrollWidth > breadcrumbSpan.clientWidth + 1) {
+				hiddenCount = hiddenCount + 1
+			}
+		})
+	})
+
+	let scopeLoading = $derived.by(() => {
+		if (!scope) return false
+		if (scope.kind === 'all') {
+			return kinds.some((k) => !loaded[k] && !!loadingKind[k])
+		}
+		return !loaded[scope.kind] && !!loadingKind[scope.kind]
+	})
+</script>
+
+<SearchItems
+	{filter}
+	items={isSearching ? allItems : []}
+	bind:filteredItems={searchedItems}
+	f={(x: SearchInput) => (x.summary ? `${x.summary} (${x.path})` : x.path)}
+	opts={{}}
+/>
+
+{#snippet leafRow(it: Item, secondary: string, baseClass: string)}
+	{@const key = leafKey(it)}
+	{@const isHl = key === highlightedKey}
+	{@const isCur = isCurrent(it)}
+	<button
+		type="button"
+		id={idFor(key)}
+		role="option"
+		aria-selected={isHl}
+		data-nav-key={key}
+		aria-current={isCur ? 'true' : undefined}
+		class="w-full text-left flex items-center gap-2 px-3 transition-colors {baseClass} {isHl
+			? 'bg-surface-hover'
+			: ''} {isCur ? 'cursor-default text-emphasis font-medium' : ''}"
+		onmousedown={(e) => e.preventDefault()}
+		onclick={() => pick(it)}
+		onmouseenter={() => setHoverHighlight(key)}
+	>
+		<RowIcon kind={it.kind} size={12} />
+		<div class="min-w-0 flex-1">
+			{#if it.summary}
+				<div class="text-xs text-primary truncate">{it.summary}</div>
+				<div class="text-2xs text-secondary font-normal font-mono truncate">{secondary}</div>
+			{:else}
+				<div class="text-xs text-primary font-mono truncate">{secondary}</div>
+			{/if}
+		</div>
+	</button>
+{/snippet}
+
+<!-- svelte-ignore a11y_no_static_element_interactions -->
+<div
+	bind:this={pickerRoot}
+	class="flex flex-col w-[420px] max-h-[60vh]"
+	onkeydown={handleSearchKeydown}
+	onmousemove={() => (mouseActive = true)}
+>
+	<div class="px-3 py-2 border-b border-gray-200 dark:border-gray-700">
+		<TextInput
+			bind:this={searchInput}
+			bind:value={filter}
+			size="sm"
+			inputProps={{
+				placeholder: 'Search by name or summary...',
+				'data-workspace-picker-search': '',
+				role: 'combobox',
+				'aria-controls': listboxId,
+				'aria-expanded': 'true',
+				'aria-autocomplete': 'list',
+				'aria-activedescendant': highlightedId
+			}}
+		/>
+	</div>
+
+	{#if scope}
+		{@const s = scope}
+		<button
+			type="button"
+			class="flex items-center gap-1.5 w-full text-left px-3 py-1 text-xs font-medium font-mono text-secondary bg-surface-secondary/20 hover:bg-surface-hover transition-colors"
+			onmousedown={(e) => e.preventDefault()}
+			onclick={goUp}
+			title={headerLabel}
+		>
+			<ChevronLeft size={12} class="shrink-0 text-secondary" />
+			{#if s.kind === 'all'}
+				<Layers size={12} class="shrink-0 text-tertiary" />
+			{:else}
+				<RowIcon kind={s.kind} size={12} />
+			{/if}
+			<span bind:this={breadcrumbSpan} class="flex-1 min-w-0 truncate truncate-start"
+				>{headerLabelDisplay}</span
+			>
+		</button>
+	{/if}
+
+	<div class="flex-1 overflow-y-auto" role="listbox" id={listboxId}>
+		{#if isSearching}
+			{@const total = (searchedItems ?? []).length}
+			{@const anyKindLoading = kinds.some((k) => loadingKind[k])}
+			{#if !searchedItems || anyKindLoading}
+				<!-- "Searching…" while any active kind is still loading, otherwise
+				     `SearchItems` would briefly write `filteredItems=[]` from the
+				     partial set and flash "No matches" before results trickle in. -->
+				<div role="status" class="px-3 py-2 text-xs text-tertiary flex items-center gap-2">
+					<Loader2 size={14} class="animate-spin" /> Searching…
+				</div>
+			{:else if total === 0}
+				<div role="status" class="px-3 py-2 text-xs text-tertiary">No matches</div>
+			{:else}
+				{#each kinds as k (k)}
+					{@const results = searchResultsByKind[k]}
+					{#if results.length > 0}
+						<div class="px-3 pt-3 pb-1 text-2xs uppercase tracking-wide text-tertiary font-medium">
+							{KIND_LABEL[k]}
+						</div>
+						<ul class="pb-1">
+							{#each results as it (leafKey(it))}
+								<li>{@render leafRow(it, it.path, 'py-1.5')}</li>
+							{/each}
+						</ul>
+					{/if}
+				{/each}
+			{/if}
+		{:else if scopeLoading && entries.length === 0}
+			<div role="status" class="px-3 py-2 text-xs text-tertiary flex items-center gap-2">
+				<Loader2 size={14} class="animate-spin" /> Loading…
+			</div>
+		{:else if entries.length === 0}
+			<div role="status" class="px-3 py-2 text-xs text-tertiary">Empty</div>
+		{:else}
+			<div class="flex flex-col py-1">
+				{#each entries as entry (entry.key)}
+					{@const isHl = entry.key === highlightedKey}
+					{#if entry.type === 'leaf'}
+						{@render leafRow(
+							entry.item,
+							scope?.dir ? entry.item.path.slice(scope.dir.length + 1) : entry.item.path,
+							'py-1.5'
+						)}
+					{:else}
+						<button
+							type="button"
+							id={idFor(entry.key)}
+							role="option"
+							aria-selected={isHl}
+							data-nav-key={entry.key}
+							class="flex items-center gap-1.5 w-full text-left px-3 py-1.5 text-xs font-medium font-mono text-emphasis transition-colors {isHl
+								? 'bg-surface-hover'
+								: ''}"
+							onmousedown={(e) => e.preventDefault()}
+							onclick={() => drill(entry)}
+							onmouseenter={() => setHoverHighlight(entry.key)}
+						>
+							{#if entry.type === 'kind'}
+								{#if entry.kind === 'all'}
+									<Layers size={12} class="shrink-0 text-tertiary" />
+									<span class="flex-1">All</span>
+								{:else}
+									<RowIcon kind={entry.kind} size={12} />
+									<span class="flex-1">{KIND_LABEL[entry.kind]}</span>
+								{/if}
+							{:else if entry.node.isScope && entry.node.fullPath.startsWith('u/')}
+								<User size={12} class="shrink-0 text-tertiary" />
+								<span class="flex-1 truncate">{entry.node.name}</span>
+							{:else}
+								<Folder size={12} class="shrink-0 text-tertiary" />
+								<span class="flex-1 truncate">{entry.node.name}</span>
+							{/if}
+							{#if entry.type === 'kind' && entry.kind !== 'all' && loadingKind[entry.kind]}
+								<Loader2 size={12} class="animate-spin text-tertiary" />
+							{/if}
+							<ChevronRight size={10} class="shrink-0 text-secondary" />
+						</button>
+					{/if}
+				{/each}
+			</div>
+		{/if}
+	</div>
+</div>
+
+<style>
+	/* Path truncates from the start (left ellipsis) so the deepest (rightmost)
+	 * folder stays visible. `unicode-bidi: plaintext` keeps each path segment
+	 * laid out per its own direction — defends against any future RTL char
+	 * appearing in a workspace path. */
+	.truncate-start {
+		direction: rtl;
+		text-align: left;
+		unicode-bidi: plaintext;
+	}
+</style>
diff --git a/frontend/src/lib/components/ZitadelSetting.svelte b/frontend/src/lib/components/ZitadelSetting.svelte
index 430c4c588c..63247bf1de 100644
--- a/frontend/src/lib/components/ZitadelSetting.svelte
+++ b/frontend/src/lib/components/ZitadelSetting.svelte
@@ -1,21 +1,20 @@
 <script lang="ts">
-	import { run } from 'svelte/legacy';
+	import { run } from 'svelte/legacy'
 
 	import IconedResourceType from './IconedResourceType.svelte'
 	import TextInput from './text_input/TextInput.svelte'
+	import Password from './Password.svelte'
 	import Toggle from './Toggle.svelte'
 	import SettingCard from './instanceSettings/SettingCard.svelte'
 
 	interface Props {
-		value: any;
+		value: any
 	}
 
-	let { value = $bindable() }: Props = $props();
-
+	let { value = $bindable() }: Props = $props()
 
 	let org = $state('')
 
-
 	function changeOrg(org) {
 		if (value) {
 			value = {
@@ -37,7 +36,7 @@
 	let enabled = $derived(value != undefined)
 	run(() => {
 		changeOrg(org)
-	});
+	})
 </script>
 
 <div class="flex flex-col gap-1">
@@ -75,11 +74,12 @@
 					bind:value={value['id']}
 				/>
 			</label>
-			<label>
+			<label for="zitadel_client_secret">
 				<span class="text-emphasis font-semibold text-xs">Client Secret </span>
-				<TextInput
-					inputProps={{ type: 'text', placeholder: 'Client Secret' }}
-					bind:value={value['secret']}
+				<Password
+					id="zitadel_client_secret"
+					placeholder="Client Secret"
+					bind:password={value['secret']}
 				/>
 			</label>
 		</SettingCard>
diff --git a/frontend/src/lib/components/apps/editor/AppEditor.svelte b/frontend/src/lib/components/apps/editor/AppEditor.svelte
index 0f8f55a5c4..e39b858d67 100644
--- a/frontend/src/lib/components/apps/editor/AppEditor.svelte
+++ b/frontend/src/lib/components/apps/editor/AppEditor.svelte
@@ -873,7 +873,7 @@
 			{/snippet}
 		</AppEditorHeader>
 		{#if $mode === 'preview'}
-			<SplitPanesWrapper>
+			<SplitPanesWrapper class="border-t">
 				<div
 					class={twMerge(
 						'h-full w-full relative',
@@ -918,7 +918,7 @@
 				</div>
 			{/if}
 
-			<SplitPanesWrapper>
+			<SplitPanesWrapper class="border-t">
 				<Splitpanes id="o1" class="max-w-full overflow-hidden">
 					<Pane bind:size={leftPanelSize} minSize={5} maxSize={33}>
 						<div
diff --git a/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte b/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
index 3afd90a378..d519b91e8c 100644
--- a/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
+++ b/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { Drawer, DrawerContent, UndoRedo } from '$lib/components/common'
+	import { Drawer, DrawerContent } from '$lib/components/common'
 	import Button from '$lib/components/common/button/Button.svelte'
 
 	import Toggle from '$lib/components/Toggle.svelte'
@@ -7,7 +7,8 @@
 	import { redo, undo } from '$lib/history.svelte'
 	import { UserDraft } from '$lib/userDraft.svelte'
 	import { enterpriseLicense, userStore, workspaceStore } from '$lib/stores'
-	import type { Item } from '$lib/utils'
+	import { isMac, type Item, userPathPrefix } from '$lib/utils'
+	import { random_adj } from '$lib/components/random_positive_adjetive'
 	import {
 		AlignHorizontalSpaceAround,
 		BellOff,
@@ -25,6 +26,8 @@
 		Sun,
 		Moon,
 		SunMoon,
+		Undo,
+		Redo,
 		Zap,
 		Globe
 	} from 'lucide-svelte'
@@ -53,7 +56,9 @@
 	import AppReportsDrawer from './AppReportsDrawer.svelte'
 	import DebugPanel from './contextPanel/DebugPanel.svelte'
 
-	import Summary from '$lib/components/Summary.svelte'
+	import EditorHeader from '$lib/components/EditorHeader.svelte'
+	import { editPathFor, invalidate as invalidatePicker } from '$lib/components/workspacePicker'
+	import { goto } from '$app/navigation'
 	import HideButton from './settingsPanel/HideButton.svelte'
 	import DeployOverrideConfirmationModal from '$lib/components/common/confirmationModal/DeployOverrideConfirmationModal.svelte'
 
@@ -120,7 +125,20 @@
 		onHideBottomPanel
 	}: Props = $props()
 
-	let newEditedPath = $state('')
+	/** Mirror of the path the user is editing in the pen popover. Initialized
+	 * once from `newPath` (or a synthesized path for new apps) and only
+	 * updated by user input from then on — we deliberately do NOT sync from
+	 * `newPath` afterwards so the user's in-flight rename isn't clobbered by
+	 * a parent reload that re-supplies the saved path. The fallback chain at
+	 * read sites (`newEditedPath || savedApp?.draft?.path || savedApp?.path`)
+	 * handles the case where `newEditedPath` is briefly empty before the
+	 * synthesized initialization runs — falls through to the saved path so
+	 * rename detection still works. */
+	let newEditedPath = $state(
+		untrack(() =>
+			newApp ? userPathPrefix($userStore?.username) + random_adj() + '_app' : (newPath ?? '')
+		)
+	)
 	let deployedValue: Value | undefined = $state(undefined) // Value to diff against
 	let deployedBy: string | undefined = $state(undefined) // Author
 	let confirmCallback: () => void = $state(() => {}) // What happens when user clicks `override` in warning
@@ -280,6 +298,7 @@
 				preserve_on_behalf_of: preserveOnBehalfOf || undefined
 			}
 		})
+		invalidatePicker($workspaceStore!, 'app')
 		savedApp = {
 			summary: $summary,
 			value: structuredClone($state.snapshot($app)),
@@ -504,19 +523,12 @@
 
 		lock = true
 
-		switch (event.key) {
-			case 'Z':
-				if (event.ctrlKey || event.metaKey) {
-					const napp = redo(history)
-					for (const key in napp) {
-						$app[key] = napp[key]
-					}
-					event.preventDefault()
-				}
-				break
+		// Only lowercase single-char keys — named keys (`ArrowDown`, etc.) must
+		// stay PascalCase to match their switch cases.
+		switch (event.key.length === 1 ? event.key.toLowerCase() : event.key) {
 			case 'z':
 				if (event.ctrlKey || event.metaKey) {
-					const napp = undo(history, $app)
+					const napp = event.shiftKey ? redo(history) : undo(history, $app)
 					for (const key in napp) {
 						$app[key] = napp[key]
 					}
@@ -551,7 +563,37 @@
 		lock = false
 	}
 
+	const mod = isMac() ? '⌘' : 'Ctrl+'
+
+	function handleUndo() {
+		const napp = undo(history, $app)
+		for (const key in napp) {
+			$app[key] = napp[key]
+		}
+	}
+	function handleRedo() {
+		const napp = redo(history)
+		for (const key in napp) {
+			$app[key] = napp[key]
+		}
+	}
+
 	let moreItems = $derived([
+		{
+			displayName: 'Undo',
+			icon: Undo,
+			action: () => handleUndo(),
+			disabled: $history?.index === 0,
+			shortcut: `${mod}Z`
+		},
+		{
+			displayName: 'Redo',
+			icon: Redo,
+			action: () => handleRedo(),
+			disabled: $history && $history?.index === $history.history.length - 1,
+			shortcut: `${mod}⇧Z`,
+			separatorBottom: true
+		},
 		{
 			displayName: 'Deployment history',
 			icon: History,
@@ -883,28 +925,17 @@
 <AppReportsDrawer bind:open={appReportingDrawerOpen} appPath={$appPath ?? ''} />
 
 <div
-	class="border-b flex flex-row justify-between py-1 gap-2 gap-y-2 px-2 items-center overflow-y-visible overflow-x-auto"
+	class="flex flex-row justify-between gap-2 gap-y-2 px-2 items-center overflow-y-visible overflow-x-auto max-h-12 h-12 shrink-0"
 >
 	<div class="flex flex-row gap-2 items-center">
-		<Summary bind:value={$summary} />
+		<EditorHeader
+			bind:summary={$summary}
+			bind:path={newEditedPath}
+			savedPath={$appPath || newPath || undefined}
+			kind="app"
+			onNavigate={(item) => goto(editPathFor(item))}
+		/>
 		<div class="flex gap-2">
-			<UndoRedo
-				undoProps={{ disabled: $history?.index === 0 }}
-				redoProps={{ disabled: $history && $history?.index === $history.history.length - 1 }}
-				on:undo={() => {
-					const napp = undo(history, $app)
-					for (const key in napp) {
-						$app[key] = napp[key]
-					}
-				}}
-				on:redo={() => {
-					const napp = redo(history)
-					for (const key in napp) {
-						$app[key] = napp[key]
-					}
-				}}
-			/>
-
 			{#if $app}
 				<ToggleButtonGroup
 					selected={$app.fullscreen ? 'true' : 'false'}
diff --git a/frontend/src/lib/components/common/EditableInput.svelte b/frontend/src/lib/components/common/EditableInput.svelte
new file mode 100644
index 0000000000..e772247c0a
--- /dev/null
+++ b/frontend/src/lib/components/common/EditableInput.svelte
@@ -0,0 +1,143 @@
+<!--
+@component
+Inline-editable text. Renders as a static button in idle mode; clicking it
+swaps to a `TextInput` whose width tracks the content (no layout shift on
+toggle). `Enter` or `blur` commits via `onSave`; `Escape` discards.
+
+Use it for header titles, summaries, list-item names — anywhere the user
+should be able to edit a label in place without opening a modal or popover.
+
+```svelte
+<EditableInput
+  value={summary}
+  placeholder="Add a summary..."
+  onSave={(v) => (summary = v)}
+  textClass="text-xs font-semibold text-emphasis"
+/>
+```
+
+The current value isn't bound — `onSave` is fired with the trimmed draft
+whenever it differs from the prior `value`, including with `''` when the
+user clears the field. Callers that want to reject empty commits should
+guard inside their `onSave` handler. The parent owns the canonical state;
+this component just proposes new values.
+-->
+<script lang="ts">
+	import TextInput from '$lib/components/text_input/TextInput.svelte'
+
+	interface Props {
+		/** Current value displayed in idle mode and pre-filled when entering edit mode. */
+		value: string
+		/** Shown when `value` is empty, in both idle and editing modes. */
+		placeholder?: string
+		/**
+		 * Called when the user commits a changed value (Enter or blur). Fires
+		 * with the trimmed draft, including `''` if the user cleared the field.
+		 * Not called on Escape, or on blur when the trimmed draft matches the
+		 * prior `value`. Guard against empty in your handler if needed.
+		 */
+		onSave?: (newValue: string) => void
+		/** When false, the component renders as plain text (not clickable). Default true. */
+		editable?: boolean
+		/** TextInput size in editing mode. Idle mode is unaffected (text only). */
+		size?: 'xs' | 'sm' | 'md' | 'lg'
+		/** Wrapper classes. Use for layout (margin, max-width, alignment) only — not text styling. */
+		class?: string
+		/** Extra classes on the inner `<input>` in editing mode. Background/border/shadow are reset on top of these. */
+		inputClass?: string
+		/**
+		 * Text styling (font-size, weight, color, line-height...) applied to *both*
+		 * the idle button and the editing input so the two render identically and
+		 * the toggle doesn't visually shift.
+		 */
+		textClass?: string
+	}
+
+	let {
+		value,
+		placeholder = '',
+		onSave,
+		editable = true,
+		size = 'sm',
+		class: className = '',
+		inputClass = '',
+		textClass = ''
+	}: Props = $props()
+
+	let editing = $state(false)
+	let draft = $state('')
+	let textInputComponent: TextInput | undefined = $state(undefined)
+
+	function startEditing() {
+		if (!editable) return
+		editing = true
+		draft = value ?? ''
+		requestAnimationFrame(() => {
+			textInputComponent?.focus()
+			textInputComponent?.select()
+		})
+	}
+
+	function save() {
+		// Re-entry guard: Enter calls `save()` and sets `editing = false`,
+		// which unmounts the `<input>` and synchronously fires its `blur`
+		// handler — also `save()`. Without this guard, `onSave` would fire
+		// twice for the same edit.
+		if (!editing) return
+		editing = false
+		const trimmed = draft.trim()
+		if (trimmed !== (value ?? '')) {
+			onSave?.(trimmed)
+		}
+	}
+
+	function handleKeydown(e: KeyboardEvent) {
+		if (e.key === 'Enter') save()
+		else if (e.key === 'Escape') editing = false
+	}
+</script>
+
+{#if editing}
+	<span
+		class="input-sizer inline-grid items-center {textClass} {className}"
+		data-value={draft || placeholder}
+	>
+		<TextInput
+			bind:this={textInputComponent}
+			bind:value={draft}
+			{size}
+			class="!bg-transparent !border-0 !shadow-none -p-0 !m-0 !min-w-0 !min-h-0 !h-auto {textClass} {inputClass}"
+			inputProps={{
+				placeholder,
+				onblur: save,
+				onkeydown: handleKeydown,
+				spellcheck: false,
+				size: 1,
+				style: 'padding: 2px !important; grid-area: 1 / 1'
+			}}
+		/>
+	</span>
+{:else}
+	<button
+		type="button"
+		onclick={startEditing}
+		disabled={!editable}
+		aria-label={editable ? `Edit ${placeholder.toLowerCase() || 'value'}` : undefined}
+		class="text-left truncate rounded p-0.5 {editable
+			? 'cursor-text hover:bg-surface-hover'
+			: 'cursor-default'} {textClass} {className}"
+	>
+		{value || placeholder}
+	</button>
+{/if}
+
+<style>
+	.input-sizer::after {
+		content: attr(data-value) ' ';
+		visibility: hidden;
+		white-space: pre;
+		grid-area: 1 / 1;
+		font: inherit;
+		padding: 2px;
+	}
+</style>
diff --git a/frontend/src/lib/components/common/button/Button.svelte b/frontend/src/lib/components/common/button/Button.svelte
index 077994d842..b739076cee 100644
--- a/frontend/src/lib/components/common/button/Button.svelte
+++ b/frontend/src/lib/components/common/button/Button.svelte
@@ -385,7 +385,11 @@
 				{@render children?.()}
 			{/if}
 			{#if endIcon?.icon}
-				<endIcon.icon class={twMerge('shrink-0', endIcon?.classes)} size={lucideIconSize} />
+				<endIcon.icon
+					class={twMerge('shrink-0', endIcon?.classes)}
+					size={lucideIconSize}
+					{...endIcon.props}
+				/>
 			{/if}
 			{#if shortCut && !shortCut.hide}
 				<div
@@ -434,7 +438,11 @@
 				{@render children?.()}
 			{/if}
 			{#if endIcon?.icon}
-				<endIcon.icon class={twMerge('shrink-0', endIcon?.classes)} size={lucideIconSize} />
+				<endIcon.icon
+					class={twMerge('shrink-0', endIcon?.classes)}
+					size={lucideIconSize}
+					{...endIcon.props}
+				/>
 			{/if}
 			{#if shortCut && !shortCut.hide}
 				{@const Icon = shortCut.Icon}
diff --git a/frontend/src/lib/components/common/confirmationModal/UnsavedConfirmationModal.svelte b/frontend/src/lib/components/common/confirmationModal/UnsavedConfirmationModal.svelte
index 20ebe04c85..1305d611c1 100644
--- a/frontend/src/lib/components/common/confirmationModal/UnsavedConfirmationModal.svelte
+++ b/frontend/src/lib/components/common/confirmationModal/UnsavedConfirmationModal.svelte
@@ -58,11 +58,8 @@
 				open = true
 			}
 			if (savedValue && modifiedValue) {
-				const draftOrDeployed = cleanValueProperties({
-					...((savedValue.draft || savedValue) ?? {}),
-					path: undefined
-				})
-				const current = cleanValueProperties({ ...(modifiedValue ?? {}), path: undefined })
+				const draftOrDeployed = cleanValueProperties((savedValue.draft || savedValue) ?? {})
+				const current = cleanValueProperties(modifiedValue ?? {})
 
 				if (
 					orderedJsonStringify(replaceFalseWithUndefined(draftOrDeployed)) ===
diff --git a/frontend/src/lib/components/common/fileDownload/FileDownload.svelte b/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
index 0062c171aa..8d6529764b 100644
--- a/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
+++ b/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
@@ -2,6 +2,7 @@
 	import { workspaceStore } from '$lib/stores'
 	import { Download } from 'lucide-svelte'
 	import { base } from '$lib/base'
+	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 
 	interface Props {
 		s3object: any
@@ -10,24 +11,41 @@
 	}
 
 	let { s3object, workspaceId = undefined, appPath = undefined }: Props = $props()
+
+	let workspace = $derived(workspaceId ?? $workspaceStore)
+	let filename = $derived(s3object?.s3?.split?.('/')?.pop() ?? 'unnamed_download.file')
+
+	let apiPath = $derived(
+		`${
+			appPath
+				? `/w/${workspace}/apps_u/download_s3_file/${appPath}`
+				: `/w/${workspace}/job_helpers/download_s3_file`
+		}?${appPath ? 's3' : 'file_key'}=${encodeURIComponent(s3object?.s3 ?? '')}${
+			s3object?.storage ? `&storage=${s3object.storage}` : ''
+		}${appPath && s3object?.presigned ? `&${s3object?.presigned}` : ''}`
+	)
+	let href = $derived(`${base}/api${apiPath}`)
+
+	const sharedClass = `relative center-center flex w-full text-center font-normal text-primary text-sm
+border border-dashed border-gray-400 hover:border-blue-500
+focus-within:border-blue-500 hover:bg-blue-50 dark:hover:bg-frost-900 focus-within:bg-blue-50
+duration-200 rounded-lg p-1 gap-2`
 </script>
 
 {#if s3object && s3object?.s3}
-	<a
-		class="relative center-center flex w-full text-center font-normal text-primary text-sm
-border border-dashed border-gray-400 hover:border-blue-500
-focus-within:border-blue-500 hover:bg-blue-50 dark:hover:bg-frost-900 focus-within:bg-blue-50
-duration-200 rounded-lg p-1 gap-2"
-		href={`${base}/api/w/${workspaceId ?? $workspaceStore}${
-			appPath ? `/apps_u/download_s3_file/${appPath}` : '/job_helpers/download_s3_file'
-		}?${appPath ? 's3' : 'file_key'}=${encodeURIComponent(s3object?.s3 ?? '')}${
-			s3object?.storage ? `&storage=${s3object.storage}` : ''
-		}${appPath && s3object?.presigned ? `&${s3object?.presigned}` : ''}`}
-		download={s3object?.s3?.split?.('/')?.pop() ?? 'unnamed_download.file'}
-	>
-		<Download />
-		<span>
-			{s3object?.storage ? `s3://${s3object.storage}/${s3object.s3}` : `s3:///${s3object.s3}`}
-		</span>
-	</a>
+	{#if shouldDownloadViaClient()}
+		<button class={sharedClass} onclick={() => downloadViaClient(apiPath, filename)}>
+			<Download />
+			<span>
+				{s3object?.storage ? `s3://${s3object.storage}/${s3object.s3}` : `s3:///${s3object.s3}`}
+			</span>
+		</button>
+	{:else}
+		<a class={sharedClass} {href} download={filename}>
+			<Download />
+			<span>
+				{s3object?.storage ? `s3://${s3object.storage}/${s3object.s3}` : `s3:///${s3object.s3}`}
+			</span>
+		</a>
+	{/if}
 {/if}
diff --git a/frontend/src/lib/components/common/table/RowIcon.svelte b/frontend/src/lib/components/common/table/RowIcon.svelte
index 7906b01d33..67a707ff1e 100644
--- a/frontend/src/lib/components/common/table/RowIcon.svelte
+++ b/frontend/src/lib/components/common/table/RowIcon.svelte
@@ -53,9 +53,10 @@
 			| 'email_trigger'
 		/** For 'trigger' kind, specifies the specific trigger type (routes, schedules, etc.) */
 		triggerKind?: string | undefined
+		size?: number
 	}
 
-	let { kind, triggerKind = undefined }: Props = $props()
+	let { kind, triggerKind = undefined, size = 16 }: Props = $props()
 
 	// Map per-kind backend names (e.g. `kafka_trigger`) to the legacy short
 	// names the icon switch already handles, so we don't have to duplicate cases.
@@ -79,44 +80,44 @@
 
 <div class="flex justify-center items-center" title={effectiveKind}>
 	{#if effectiveKind === 'flow'}
-		<BarsStaggered size={16} class="text-teal-500" />
+		<BarsStaggered {size} class="text-teal-500" />
 	{:else if effectiveKind === 'app' || effectiveKind === 'raw_app'}
-		<LayoutDashboard size={16} class="text-orange-500" />
+		<LayoutDashboard {size} class="text-orange-500" />
 	{:else if effectiveKind === 'script'}
-		<Code2 size={16} class="text-blue-500" />
+		<Code2 {size} class="text-blue-500" />
 	{:else if effectiveKind === 'variable'}
-		<DollarSign size={16} class="text-gray-400" />
+		<DollarSign {size} class="text-gray-400" />
 	{:else if effectiveKind === 'resource'}
-		<Boxes size={16} class="text-gray-400" />
+		<Boxes {size} class="text-gray-400" />
 	{:else if effectiveKind === 'resource_type'}
-		<div style="width: 16px; height: 16px;" class="bg-gray-100 rounded-full"></div>
+		<div style="width: {size}px; height: {size}px;" class="bg-gray-100 rounded-full"></div>
 	{:else if effectiveKind === 'folder'}
-		<Folder size={16} class="text-gray-400" />
+		<Folder {size} class="text-gray-400" />
 	{:else if effectiveKind === 'schedule' || effectiveKind === 'schedules'}
-		<Calendar size={16} class="text-gray-400" />
+		<Calendar {size} class="text-gray-400" />
 	{:else if effectiveKind === 'routes'}
-		<Route size={16} class="text-gray-400" />
+		<Route {size} class="text-gray-400" />
 	{:else if effectiveKind === 'websockets'}
-		<Unplug size={16} class="text-gray-400" />
+		<Unplug {size} class="text-gray-400" />
 	{:else if effectiveKind === 'postgres'}
-		<Database size={16} class="text-gray-400" />
+		<Database {size} class="text-gray-400" />
 	{:else if effectiveKind === 'kafka'}
-		<KafkaIcon size={16} class="text-gray-400" />
+		<KafkaIcon {size} class="text-gray-400" />
 	{:else if effectiveKind === 'nats'}
-		<NatsIcon size={16} class="text-gray-400" />
+		<NatsIcon {size} class="text-gray-400" />
 	{:else if effectiveKind === 'mqtt'}
-		<MqttIcon size={16} class="text-gray-400" />
+		<MqttIcon {size} class="text-gray-400" />
 	{:else if effectiveKind === 'sqs'}
-		<AwsIcon size={16} class="text-gray-400" />
+		<AwsIcon {size} class="text-gray-400" />
 	{:else if effectiveKind === 'gcp'}
-		<GoogleCloudIcon size={16} />
+		<GoogleCloudIcon {size} />
 	{:else if effectiveKind === 'azure'}
-		<AzureIcon size={16} />
+		<AzureIcon {size} />
 	{:else if effectiveKind === 'emails'}
-		<Mail size={16} class="text-gray-400" />
+		<Mail {size} class="text-gray-400" />
 	{:else if effectiveKind === 'trigger'}
-		<Calendar size={16} class="text-gray-400" />
+		<Calendar {size} class="text-gray-400" />
 	{:else}
-		<div class="w-[16px]"></div>
+		<div style="width: {size}px;"></div>
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/copilot/CustomAIPrompts.svelte b/frontend/src/lib/components/copilot/CustomAIPrompts.svelte
index eb4685a4d1..4c7cfbe47b 100644
--- a/frontend/src/lib/components/copilot/CustomAIPrompts.svelte
+++ b/frontend/src/lib/components/copilot/CustomAIPrompts.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { AIMode } from './chat/AIChatManager.svelte'
+	import { AIMode, getVisibleAIModes } from './chat/AIChatManager.svelte'
 	import ToggleButtonGroup from '../common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '../common/toggleButton-v2/ToggleButton.svelte'
 	import Label from '../Label.svelte'
@@ -18,6 +18,7 @@
 	} = $props()
 
 	let selectedAiMode = $state<AIMode>(AIMode.ASK)
+	let visibleModes = $derived(getVisibleAIModes())
 </script>
 
 <div class="flex flex-col gap-2">
@@ -29,7 +30,7 @@
 		<Label label="AI Mode">
 			<ToggleButtonGroup bind:selected={selectedAiMode}>
 				{#snippet children({ item })}
-					{#each Object.values(AIMode) as mode}
+					{#each visibleModes as mode (mode)}
 						<div class="relative">
 							<ToggleButton
 								value={mode}
diff --git a/frontend/src/lib/components/copilot/chat/AIChatInput.svelte b/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
index 1a4169f677..833649e9b6 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
@@ -69,6 +69,8 @@
 				return 'Navigate Windmill UI...'
 			case AIMode.API:
 				return 'Make API calls...'
+			case AIMode.GLOBAL:
+				return 'Work across workspace items...'
 			case AIMode.ASK:
 				return 'Ask questions about Windmill...'
 			default:
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index 0d3ca62fd0..a4b873795b 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -60,6 +60,8 @@ import { runChatLoop } from './chatLoop'
 import type { ReviewChangesOpts } from './monaco-adapter'
 import { getCurrentModel, tryGetCurrentModel, getCombinedCustomPrompt } from '$lib/aiStore'
 import type { WorkspaceMutationTarget } from './workspaceTools'
+import { globalTools, prepareGlobalSystemMessage, prepareGlobalUserMessage } from './global/core'
+import { isGlobalAiEnabled } from './global/gate'
 
 // If the estimated token usage is greater than the model context window - the threshold, we delete the oldest message
 const MAX_TOKENS_THRESHOLD_PERCENTAGE = 0.05
@@ -71,9 +73,24 @@ export enum AIMode {
 	APP = 'app',
 	NAVIGATOR = 'navigator',
 	API = 'API',
+	GLOBAL = 'global',
 	ASK = 'ask'
 }
 
+const ALL_AI_MODES = Object.values(AIMode)
+
+export function isAIMode(mode: unknown): mode is AIMode {
+	return ALL_AI_MODES.includes(mode as AIMode)
+}
+
+export function isAIModeVisible(mode: AIMode): boolean {
+	return mode !== AIMode.GLOBAL || isGlobalAiEnabled()
+}
+
+export function getVisibleAIModes(): AIMode[] {
+	return ALL_AI_MODES.filter(isAIModeVisible)
+}
+
 function isWorkspacePath(path: string | undefined): path is string {
 	return path?.startsWith('f/') === true || path?.startsWith('u/') === true
 }
@@ -133,7 +150,9 @@ class AIChatManager {
 		app: this.appAiChatHelpers !== undefined,
 		navigator: true,
 		ask: true,
-		API: true
+		API: true,
+		// Dev-only gate. See `./global/gate.ts` for how to enable.
+		global: isAIModeVisible(AIMode.GLOBAL)
 	})
 
 	open = $derived(chatState.size > 0)
@@ -235,7 +254,8 @@ class AIChatManager {
 		return {
 			kind: 'script',
 			path: workspacePath,
-			deployed: workspacePath !== undefined && this.scriptEditorOptions?.lastDeployedCode !== undefined
+			deployed:
+				workspacePath !== undefined && this.scriptEditorOptions?.lastDeployedCode !== undefined
 		}
 	}
 
@@ -260,6 +280,7 @@ class AIChatManager {
 			workflowAsCode?: boolean
 		}
 	) {
+		if (!isAIModeVisible(mode)) return
 		if (mode === AIMode.SCRIPT && !tryGetCurrentModel()) return
 		this.mode = mode
 		this.pendingPrompt = pendingPrompt ?? ''
@@ -329,6 +350,11 @@ class AIChatManager {
 			this.systemMessage = prepareApiSystemMessage(customPrompt)
 			this.tools = [...this.apiTools]
 			this.helpers = {}
+		} else if (mode === AIMode.GLOBAL) {
+			const customPrompt = getCombinedCustomPrompt(mode)
+			this.systemMessage = prepareGlobalSystemMessage(customPrompt)
+			this.tools = [...globalTools]
+			this.helpers = {}
 		} else if (mode === AIMode.APP) {
 			const customPrompt = getCombinedCustomPrompt(mode)
 			this.systemMessage = prepareAppSystemMessage(customPrompt)
@@ -345,14 +371,24 @@ class AIChatManager {
 			function: {
 				name: 'change_mode',
 				description:
-					'Change the AI mode to the one specified. Script mode is used to create scripts. Flow mode is used to create flows. Navigator mode is used to navigate the application and help the user find what they are looking for. API mode is used to make API calls to the Windmill backend.',
+					'Change the AI mode to the one specified. Script mode is used to create scripts. Flow mode is used to create flows.' +
+					(isGlobalAiEnabled()
+						? ' Global mode is used to inspect workspace scripts and flows and create draft changes.'
+						: '') +
+					' Navigator mode is used to navigate the application and help the user find what they are looking for. API mode is used to make API calls to the Windmill backend.',
 				parameters: {
 					type: 'object',
 					properties: {
 						mode: {
 							type: 'string',
 							description: 'The mode to change to',
-							enum: ['script', 'flow', 'navigator', 'API']
+							enum: [
+								'script',
+								'flow',
+								...(isGlobalAiEnabled() ? ['global'] : []),
+								'navigator',
+								'API'
+							]
 						},
 						pendingPrompt: {
 							type: 'string',
@@ -365,8 +401,11 @@ class AIChatManager {
 			}
 		},
 		fn: async ({ args, toolId, toolCallbacks }) => {
+			if (!isAIMode(args.mode) || !isAIModeVisible(args.mode)) {
+				throw new Error(`AI mode "${args.mode}" is not enabled`)
+			}
 			toolCallbacks.setToolStatus(toolId, { content: 'Switching to ' + args.mode + ' mode...' })
-			this.changeMode(args.mode as AIMode, args.pendingPrompt, {
+			this.changeMode(args.mode, args.pendingPrompt, {
 				closeScriptSettings: true
 			})
 			toolCallbacks.setToolStatus(toolId, { content: 'Switched to ' + args.mode + ' mode' })
@@ -498,6 +537,8 @@ class AIChatManager {
 						)
 					} else if (this.mode === AIMode.NAVIGATOR) {
 						return prepareNavigatorUserMessage(pendingPrompt)
+					} else if (this.mode === AIMode.GLOBAL) {
+						return prepareGlobalUserMessage(pendingPrompt)
 					}
 					return undefined
 				},
@@ -617,17 +658,14 @@ class AIChatManager {
 			isPreprocessor?: boolean
 		} = {}
 	) => {
-		if (options.mode) {
-			this.changeMode(options.mode, undefined, {
-				lang: options.lang,
-				isPreprocessor: options.isPreprocessor
-			})
-		} else {
-			this.changeMode(this.mode, undefined, {
-				lang: options.lang,
-				isPreprocessor: options.isPreprocessor
-			})
+		const requestedMode = options.mode ?? this.mode
+		if (!isAIModeVisible(requestedMode)) {
+			return
 		}
+		this.changeMode(requestedMode, undefined, {
+			lang: options.lang,
+			isPreprocessor: options.isPreprocessor
+		})
 		if (options.instructions) {
 			this.instructions = options.instructions
 		}
@@ -716,6 +754,9 @@ class AIChatManager {
 				case AIMode.API:
 					userMessage = prepareApiUserMessage(oldInstructions)
 					break
+				case AIMode.GLOBAL:
+					userMessage = prepareGlobalUserMessage(oldInstructions)
+					break
 				case AIMode.APP:
 					userMessage = prepareAppUserMessage(
 						oldInstructions,
diff --git a/frontend/src/lib/components/copilot/chat/CreatedResourceActionDrawers.svelte b/frontend/src/lib/components/copilot/chat/CreatedResourceActionDrawers.svelte
index 59c018c39e..7d3b8a950c 100644
--- a/frontend/src/lib/components/copilot/chat/CreatedResourceActionDrawers.svelte
+++ b/frontend/src/lib/components/copilot/chat/CreatedResourceActionDrawers.svelte
@@ -4,6 +4,8 @@
 	import { Drawer } from '$lib/components/common'
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import { Loader2 } from 'lucide-svelte'
+	import ResourceEditorDrawer from '$lib/components/ResourceEditorDrawer.svelte'
+	import VariableEditor from '$lib/components/VariableEditor.svelte'
 	import { registerToolDisplayActionHandler } from './createdResourceActions.svelte'
 	import type { CreatedResourceTriggerKind, ToolDisplayAction } from './shared'
 
@@ -36,6 +38,8 @@
 	let editor: EditorHandle | undefined = $state(undefined)
 	let activeDrawer: ActiveDrawerState | undefined = $state(undefined)
 	let nextActiveDrawerId = 0
+	let resourceEditorDrawer: ResourceEditorDrawer | undefined = $state(undefined)
+	let variableEditor: VariableEditor | undefined = $state(undefined)
 
 	const drawerConfigs: Record<DrawerKey, DrawerConfig> = {
 		schedule: {
@@ -120,6 +124,16 @@
 			return
 		}
 
+		if (action.resource === 'resource') {
+			await resourceEditorDrawer?.initEdit(action.path)
+			return
+		}
+
+		if (action.resource === 'variable') {
+			await variableEditor?.editVariable(action.path)
+			return
+		}
+
 		const key = action.resource === 'schedule' ? 'schedule' : action.triggerKind
 		if (!key) {
 			throw new Error('Missing trigger kind')
@@ -172,3 +186,6 @@
 		{/if}
 	</DrawerContent>
 </Drawer>
+
+<ResourceEditorDrawer bind:this={resourceEditorDrawer} />
+<VariableEditor bind:this={variableEditor} />
diff --git a/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte b/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
index 6770498ffd..00eff03b89 100644
--- a/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
+++ b/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
@@ -1,6 +1,15 @@
 <script lang="ts">
 	import { Button } from '$lib/components/common'
-	import { Calendar, Database, Route, SquarePen, Unplug, Webhook } from 'lucide-svelte'
+	import {
+		Calendar,
+		Database,
+		KeyRound,
+		Package,
+		Route,
+		SquarePen,
+		Unplug,
+		Webhook
+	} from 'lucide-svelte'
 	import AwsIcon from '$lib/components/icons/AwsIcon.svelte'
 	import AzureIcon from '$lib/components/icons/AzureIcon.svelte'
 	import GoogleCloudIcon from '$lib/components/icons/GoogleCloudIcon.svelte'
@@ -14,7 +23,7 @@
 		actions: ToolDisplayAction[]
 	}
 
-	type ActionCardKey = 'schedule' | CreatedResourceTriggerKind
+	type ActionCardKey = 'schedule' | 'resource' | 'variable' | CreatedResourceTriggerKind
 	type ActionCardConfig = {
 		title: string
 		icon: any
@@ -25,6 +34,8 @@
 
 	const actionCardConfigs: Record<ActionCardKey, ActionCardConfig> = {
 		schedule: { title: 'Schedule', icon: Calendar },
+		resource: { title: 'Resource', icon: Package },
+		variable: { title: 'Variable', icon: KeyRound },
 		http: { title: 'HTTP trigger', icon: Route },
 		websocket: { title: 'WebSocket trigger', icon: Unplug },
 		postgres: { title: 'Postgres trigger', icon: Database },
@@ -37,7 +48,8 @@
 	}
 
 	function getActionCardConfig(action: ToolDisplayAction): ActionCardConfig {
-		const key = action.resource === 'schedule' ? 'schedule' : action.triggerKind
+		const key: ActionCardKey | undefined =
+			action.resource === 'trigger' ? action.triggerKind : action.resource
 		return key
 			? actionCardConfigs[key]
 			: { title: action.label.replace(/^Open\s+/i, ''), icon: Webhook }
diff --git a/frontend/src/lib/components/copilot/chat/app/core.ts b/frontend/src/lib/components/copilot/chat/app/core.ts
index 4cd0110a91..cbfdcc5616 100644
--- a/frontend/src/lib/components/copilot/chat/app/core.ts
+++ b/frontend/src/lib/components/copilot/chat/app/core.ts
@@ -8,6 +8,7 @@ import {
 	createToolDef,
 	createSearchWorkspaceTool,
 	createGetRunnableDetailsTool,
+	findAndReplace,
 	type Tool
 } from '../shared'
 import { aiChatManager } from '../AIChatManager.svelte'
@@ -162,31 +163,6 @@ const memo = <T>(factory: () => T): (() => T) => {
 	return () => (cached ??= factory())
 }
 
-function countExactMatches(content: string, search: string): number {
-	if (search.length === 0) {
-		return 0
-	}
-
-	let count = 0
-	let index = 0
-
-	while ((index = content.indexOf(search, index)) !== -1) {
-		count += 1
-		index += search.length
-	}
-
-	return count
-}
-
-function replaceFirstExactMatch(content: string, search: string, replace: string): string {
-	const index = content.indexOf(search)
-	if (index === -1) {
-		return content
-	}
-
-	return content.slice(0, index) + replace + content.slice(index + search.length)
-}
-
 type AppPatchTarget =
 	| { type: 'frontend'; path: string }
 	| { type: 'backend'; path: string; key: string; extension: 'ts' | 'py' }
@@ -658,19 +634,13 @@ export const getAppTools = memo((): Tool<AppAIChatHelpers>[] => [
 				currentContent = backendRunnable.inlineScript.content ?? ''
 			}
 
-			const matchCount = countExactMatches(currentContent, oldString)
-			if (matchCount === 0) {
-				throw new Error('old_string was not found in the current file content.')
-			}
-			if (!replaceAll && matchCount !== 1) {
-				throw new Error(
-					`old_string matched ${matchCount} locations. Make it more specific or set replace_all to true.`
-				)
-			}
-
-			const updatedContent = replaceAll
-				? currentContent.split(oldString).join(newString)
-				: replaceFirstExactMatch(currentContent, oldString, newString)
+			const updatedContent = findAndReplace(
+				currentContent,
+				oldString,
+				newString,
+				replaceAll,
+				'current file content'
+			)
 
 			toolCallbacks.setToolStatus(toolId, {
 				content: `Patching '${target.path}'...`
diff --git a/frontend/src/lib/components/copilot/chat/flow/core.ts b/frontend/src/lib/components/copilot/chat/flow/core.ts
index 0c1750b563..c54c652247 100644
--- a/frontend/src/lib/components/copilot/chat/flow/core.ts
+++ b/frontend/src/lib/components/copilot/chat/flow/core.ts
@@ -19,6 +19,7 @@ import {
 import {
 	createSearchHubScriptsTool,
 	createToolDef,
+	findAndReplace,
 	type Tool,
 	executeTestRun,
 	buildSchemaForTool,
@@ -37,233 +38,17 @@ import type { ExtendedOpenFlow } from '$lib/components/flows/types'
 import { findModuleInFlow, findModuleInModules } from '$lib/components/flows/flowTree'
 import { createInlineScriptSession, type InlineScriptSession } from './inlineScriptsUtils'
 import { validateFlowGroups, type FlowGroup, type FlowJsonUpdateResult } from './helperUtils'
-import { flowModuleSchema, flowModulesSchema } from './openFlowZod.gen'
+import { flowModuleSchema } from './openFlowZod.gen'
 import { collectAllFlowModuleIdsFromModules } from '$lib/components/flows/flowTree'
+import {
+	buildEditableFlowJson as buildEditableFlowJsonBase,
+	validateEditableFlowJson,
+	validateFlowModules,
+	validateFlowSchema,
+	type EditableFlowJson
+} from './editableFlowJson'
 import { FLOW_CHAT_SPECIAL_MODULES, getFlowPrompt } from '$system_prompts'
 
-/**
- * Navigate to a schema at a given path, handling arrays, objects, unions, and wrappers.
- * Uses Zod 4 internal structure.
- * @param schema The Zod schema to navigate
- * @param path The path to navigate
- * @param data Optional actual data to help resolve discriminated unions
- */
-function getSchemaAtPath(
-	schema: z.ZodType,
-	path: (string | number)[],
-	data?: any
-): z.ZodType | null {
-	let current: z.ZodType = schema
-	let currentData = data
-
-	for (let i = 0; i < path.length; i++) {
-		const segment = path[i]
-
-		if (!current || !(current as any)._def) return null
-
-		let type = (current as any)._def.type
-
-		// Unwrap optional/nullable/default/catch
-		while (['optional', 'nullable', 'default', 'catch'].includes(type)) {
-			current = (current as any)._def.innerType
-			if (!current || !(current as any)._def) return null
-			type = (current as any)._def.type
-		}
-
-		// Handle arrays
-		if (type === 'array') {
-			if (typeof segment === 'number') {
-				current = (current as any)._def.element
-				if (currentData && Array.isArray(currentData)) {
-					currentData = currentData[segment]
-				}
-				continue
-			}
-			// If segment is not a number, continue into element type
-			current = (current as any)._def.element
-			i--
-			continue
-		}
-
-		// Handle objects
-		if (type === 'object') {
-			const shape = (current as any)._def.shape
-			const key = String(segment)
-			if (shape && key in shape) {
-				current = shape[key]
-				if (currentData && typeof currentData === 'object') {
-					currentData = currentData[key]
-				}
-				continue
-			}
-			return null
-		}
-
-		// Handle discriminated unions (shows as 'union' in Zod 4)
-		if (type === 'union') {
-			const options = (current as any)._def.options
-			if (options) {
-				// If we have data, try to find the correct union option based on discriminator
-				if (currentData && typeof currentData === 'object') {
-					// Check for common discriminator fields
-					const typeValue = currentData.type
-					if (typeValue) {
-						// Find option that matches this type
-						for (const option of options) {
-							const optionShape = (option as any)._def?.shape
-							const optionType = optionShape?.type?._def?.values?.[0]
-							if (optionType === typeValue) {
-								const remainingPath = path.slice(i)
-								const result = getSchemaAtPath(option, remainingPath, currentData)
-								if (result) return result
-							}
-						}
-					}
-				}
-
-				// Fallback: try to find a matching schema in any of the options
-				for (const option of options) {
-					const remainingPath = path.slice(i)
-					const result = getSchemaAtPath(option, remainingPath, currentData)
-					if (result) return result
-				}
-			}
-			return null
-		}
-
-		// Handle record - any string key accesses the value type
-		if (type === 'record') {
-			current = (current as any)._def.valueType
-			if (!current) return null
-			if (currentData && typeof currentData === 'object') {
-				currentData = currentData[segment]
-			}
-			continue
-		}
-
-		return null
-	}
-
-	return current
-}
-
-/**
- * Format a JSON Schema object into a concise human-readable string for error messages.
- * Prioritizes structural information (object shapes, enums) over descriptions.
- */
-function formatJsonSchemaForError(jsonSchema: any): string {
-	// For objects, show structure (more actionable than description)
-	if (jsonSchema.type === 'object' && jsonSchema.properties) {
-		const props = Object.entries(jsonSchema.properties)
-			.slice(0, 5) // Limit to 5 properties
-			.map(([k, v]: [string, any]) => {
-				// Include enum values for string properties if available
-				if (v.enum) {
-					return `${k}: ${v.enum.map((e: any) => JSON.stringify(e)).join('|')}`
-				}
-				return `${k}: ${v.type || 'any'}`
-			})
-			.join(', ')
-		const moreProps =
-			Object.keys(jsonSchema.properties).length > 5
-				? `, ... (${Object.keys(jsonSchema.properties).length - 5} more)`
-				: ''
-		const required = jsonSchema.required?.length
-			? ` (required: ${jsonSchema.required.join(', ')})`
-			: ''
-		return `{ ${props}${moreProps} }${required}`
-	}
-
-	if (jsonSchema.const !== undefined) {
-		return JSON.stringify(jsonSchema.const)
-	}
-
-	if (jsonSchema.enum) {
-		return `one of: ${jsonSchema.enum.map((v: any) => JSON.stringify(v)).join(', ')}`
-	}
-
-	if (jsonSchema.oneOf) {
-		return jsonSchema.oneOf.map((s: any) => formatJsonSchemaForError(s)).join(' | ')
-	}
-
-	if (jsonSchema.anyOf) {
-		return jsonSchema.anyOf.map((s: any) => formatJsonSchemaForError(s)).join(' | ')
-	}
-
-	// Fall back to description for non-structural types
-	if (jsonSchema.description) {
-		return jsonSchema.description
-	}
-
-	return jsonSchema.type || JSON.stringify(jsonSchema)
-}
-
-/**
- * Extract a human-readable description of what a schema expects.
- * For objects, prefers showing the actual structure over descriptions.
- * For simpler types, uses description if available.
- */
-function getExpectedFormat(schema: z.ZodType): string | null {
-	if (!schema || !(schema as any)._def) return null
-
-	let current = schema
-
-	// Unwrap optional/nullable to get inner type
-	while ((current as any)._def.type === 'optional' || (current as any)._def.type === 'nullable') {
-		current = (current as any)._def.innerType
-		if (!current || !(current as any)._def) break
-	}
-
-	// Try JSON Schema representation first for objects (more actionable than descriptions)
-	try {
-		const jsonSchema = z.toJSONSchema(schema)
-		// Skip if it's just a schema with no useful info
-		if (
-			Object.keys(jsonSchema).length <= 1 ||
-			(Object.keys(jsonSchema).length === 1 && jsonSchema.$schema)
-		) {
-			return null
-		}
-		const formatted = formatJsonSchemaForError(jsonSchema)
-		if (formatted && formatted !== 'unknown' && !formatted.startsWith('{')) {
-			return formatted
-		}
-		// For objects, only return if it has meaningful properties
-		if (formatted && formatted.startsWith('{') && formatted !== '{ }') {
-			return formatted
-		}
-	} catch {
-		// Ignore errors from toJSONSchema
-	}
-
-	return null
-}
-
-function countExactMatches(content: string, search: string): number {
-	if (search.length === 0) {
-		return 0
-	}
-
-	let count = 0
-	let index = 0
-
-	while ((index = content.indexOf(search, index)) !== -1) {
-		count++
-		index += search.length
-	}
-
-	return count
-}
-
-function replaceFirstExactMatch(content: string, search: string, replace: string): string {
-	const index = content.indexOf(search)
-	if (index === -1) {
-		return content
-	}
-
-	return content.slice(0, index) + replace + content.slice(index + search.length)
-}
-
 type FlowJsonUpdate = {
 	modules?: FlowModule[]
 	schema?: Record<string, any> | null
@@ -272,220 +57,35 @@ type FlowJsonUpdate = {
 	groups?: FlowGroup[] | null
 }
 
-type EditableFlowJson = {
-	modules: FlowModule[]
-	schema: Record<string, any> | null
-	preprocessor_module: FlowModule | null
-	failure_module: FlowModule | null
-	groups: FlowGroup[] | null
-}
-
 function formatEmptyInlineScriptWarning({
 	emptyInlineScriptModuleIds
 }: FlowJsonUpdateResult): string {
 	if (emptyInlineScriptModuleIds.length === 0) {
 		return ''
 	}
-
 	const moduleList = emptyInlineScriptModuleIds.map((id) => `'${id}'`).join(', ')
 	return ` Warning: inline scripts ${moduleList} are empty for now. Use set_module_code to fill them in.`
 }
 
-function validateFlowModules(rawModules: unknown): FlowModule[] {
-	if (!Array.isArray(rawModules)) {
-		throw new Error('Flow modules must be an array')
-	}
-
-	const parsedModules = rawModules as FlowModule[]
-	const result = flowModulesSchema.safeParse(parsedModules)
-	if (!result.success) {
-		const errors = result.error.issues.slice(0, 5).map((e) => {
-			const path = e.path
-			// Try to find module id for better context
-			const moduleIndex = typeof path[0] === 'number' ? path[0] : undefined
-			const moduleId = moduleIndex !== undefined ? parsedModules[moduleIndex]?.id : undefined
-			const fieldPath = path.slice(1).join('.')
-
-			let message = e.message
-			if (e.code === 'invalid_type') {
-				// Zod 4 message already contains "expected X, received Y"
-				// Try to extract expected format from schema, passing actual data
-				// to help resolve discriminated unions correctly
-				const targetSchema = getSchemaAtPath(
-					flowModulesSchema,
-					path as (string | number)[],
-					parsedModules
-				)
-				if (targetSchema) {
-					const expectedFormat = getExpectedFormat(targetSchema)
-					if (expectedFormat) {
-						message += `\n    Expected format: ${expectedFormat}`
-					}
-				}
-			}
-
-			if (moduleId) {
-				return `Module "${moduleId}" -> ${fieldPath}: ${message}`
-			}
-			return `${path.join('.')}: ${message}`
-		})
-
-		throw new Error(`Invalid flow modules:\n${errors.join('\n')}`)
-	}
-
-	const ids = collectAllFlowModuleIdsFromModules(parsedModules)
-	if (ids.length !== new Set(ids).size) {
-		throw new Error('Duplicate module IDs found in flow')
-	}
-
-	const reservedIds = ids.filter(
-		(id) => id === SPECIAL_MODULE_IDS.PREPROCESSOR || id === SPECIAL_MODULE_IDS.FAILURE
-	)
-	if (reservedIds.length > 0) {
-		throw new Error(
-			'Special modules must be provided via preprocessor_module and failure_module, not inside modules'
-		)
-	}
-
-	return parsedModules
-}
-
-function validateFlowSchema(rawSchema: unknown): Record<string, any> | null {
-	if (rawSchema == null) {
-		return null
-	}
-
-	if (typeof rawSchema !== 'object' || Array.isArray(rawSchema)) {
-		throw new Error('Flow schema must be an object or null')
-	}
-
-	return rawSchema as Record<string, any>
-}
-
-function validateOptionalFlowModule(rawModule: unknown, fieldName: string): FlowModule | null {
-	if (rawModule == null) {
-		return null
-	}
-
-	const result = flowModuleSchema.safeParse(rawModule)
-	if (!result.success) {
-		const error = result.error.issues[0]
-		throw new Error(`Invalid ${fieldName}: ${error?.message ?? 'unknown error'}`)
-	}
-
-	return result.data
-}
-
-function validateEditableFlowJson(rawFlow: unknown): EditableFlowJson {
-	if (!rawFlow || typeof rawFlow !== 'object' || Array.isArray(rawFlow)) {
-		throw new Error('Flow JSON must be an object')
-	}
-
-	const flow = rawFlow as Record<string, unknown>
-	const modules = validateFlowModules(flow.modules)
-	const schema = validateFlowSchema(flow.schema)
-	const preprocessorModule = validateOptionalFlowModule(
-		flow.preprocessor_module,
-		'preprocessor_module'
-	)
-	const failureModule = validateOptionalFlowModule(flow.failure_module, 'failure_module')
-	const groupModuleIds = new Set(collectAllFlowModuleIdsFromModules(modules))
-	const groups = validateFlowGroups(flow.groups, groupModuleIds)
-
-	if (preprocessorModule) {
-		if (preprocessorModule.id !== SPECIAL_MODULE_IDS.PREPROCESSOR) {
-			throw new Error(
-				`Invalid preprocessor_module: id must be "${SPECIAL_MODULE_IDS.PREPROCESSOR}"`
-			)
-		}
-		if (
-			preprocessorModule.value.type !== 'rawscript' &&
-			preprocessorModule.value.type !== 'script'
-		) {
-			throw new Error(
-				'Invalid preprocessor_module: only "rawscript" and "script" modules are supported'
-			)
-		}
-	}
-	if (failureModule) {
-		if (failureModule.id !== SPECIAL_MODULE_IDS.FAILURE) {
-			throw new Error(`Invalid failure_module: id must be "${SPECIAL_MODULE_IDS.FAILURE}"`)
-		}
-		if (failureModule.value.type !== 'rawscript' && failureModule.value.type !== 'script') {
-			throw new Error('Invalid failure_module: only "rawscript" and "script" modules are supported')
-		}
-	}
-
-	const ids = new Set(collectAllFlowModuleIdsFromModules(modules))
-	if (preprocessorModule) {
-		if (ids.has(preprocessorModule.id)) {
-			throw new Error(`Duplicate module ID found in preprocessor_module: ${preprocessorModule.id}`)
-		}
-		ids.add(preprocessorModule.id)
-	}
-	if (failureModule && ids.has(failureModule.id)) {
-		throw new Error(`Duplicate module ID found in failure_module: ${failureModule.id}`)
-	}
-
-	return {
-		modules,
-		schema,
-		preprocessor_module: preprocessorModule,
-		failure_module: failureModule,
-		groups
-	}
-}
-
+/**
+ * Build the agent-facing compact view of a flow, with editor-only post-processing
+ * (insert `[#START]` / `[#END]` markers around code pieces selected as context).
+ * Delegates to the shared `buildEditableFlowJson` for the rest.
+ */
 function buildEditableFlowJson(
 	flow: ExtendedOpenFlow,
 	inlineScriptSession?: InlineScriptSession,
 	selectedContext: ContextElement[] = []
 ): EditableFlowJson {
+	const json = buildEditableFlowJsonBase(
+		{ value: flow.value, schema: flow.schema },
+		inlineScriptSession
+	)
 	const codePieces = selectedContext.filter((c) => c.type === 'flow_module_code_piece')
-	const optimizedModules = inlineScriptSession
-		? inlineScriptSession.extractAndReplaceInlineScripts(flow.value.modules)
-		: flow.value.modules
-	const modules = applyCodePiecesToFlowModules(codePieces, optimizedModules)
-
-	let preprocessorModule = flow.value.preprocessor_module
-	if (
-		preprocessorModule?.value?.type === 'rawscript' &&
-		preprocessorModule.value.content &&
-		inlineScriptSession
-	) {
-		inlineScriptSession.set(preprocessorModule.id, preprocessorModule.value.content)
-		preprocessorModule = {
-			...preprocessorModule,
-			value: {
-				...preprocessorModule.value,
-				content: `inline_script.${preprocessorModule.id}`
-			}
-		}
-	}
-
-	let failureModule = flow.value.failure_module
-	if (
-		failureModule?.value?.type === 'rawscript' &&
-		failureModule.value.content &&
-		inlineScriptSession
-	) {
-		inlineScriptSession.set(failureModule.id, failureModule.value.content)
-		failureModule = {
-			...failureModule,
-			value: {
-				...failureModule.value,
-				content: `inline_script.${failureModule.id}`
-			}
-		}
-	}
-
-	return {
-		modules,
-		schema: flow.schema ?? null,
-		preprocessor_module: preprocessorModule ?? null,
-		failure_module: failureModule ?? null,
-		groups: flow.value.groups ?? null
+	if (codePieces.length === 0) {
+		return json
 	}
+	return { ...json, modules: applyCodePiecesToFlowModules(codePieces, json.modules) }
 }
 
 /**
@@ -1006,25 +606,18 @@ export const flowTools: Tool<FlowAIChatHelpers>[] = [
 			// then copy extracted inline scripts back into the helper session before applying the patch.
 			const inlineScriptSession = createInlineScriptSession()
 			const currentFlowJson = JSON.stringify(buildEditableFlowJson(flow, inlineScriptSession))
-			const matchCount = countExactMatches(currentFlowJson, oldString)
-
-			if (matchCount === 0) {
-				throw new Error('old_string was not found in the current flow JSON.')
-			}
-
-			if (!replaceAll && matchCount !== 1) {
-				throw new Error(
-					`old_string matched ${matchCount} locations. Make it more specific or set replace_all to true.`
-				)
-			}
 
 			toolCallbacks.setToolStatus(toolId, {
 				content: 'Applying JSON patch...'
 			})
 
-			const updatedFlowJson = replaceAll
-				? currentFlowJson.split(oldString).join(newString)
-				: replaceFirstExactMatch(currentFlowJson, oldString, newString)
+			const updatedFlowJson = findAndReplace(
+				currentFlowJson,
+				oldString,
+				newString,
+				replaceAll,
+				'current flow JSON'
+			)
 
 			let parsedFlow: EditableFlowJson
 			try {
diff --git a/frontend/src/lib/components/copilot/chat/flow/editableFlowJson.ts b/frontend/src/lib/components/copilot/chat/flow/editableFlowJson.ts
new file mode 100644
index 0000000000..a4b0ea72d5
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/flow/editableFlowJson.ts
@@ -0,0 +1,412 @@
+import { z } from 'zod'
+import type { FlowModule, FlowValue } from '$lib/gen'
+import { collectAllFlowModuleIdsFromModules } from '$lib/components/flows/flowTree'
+import { SPECIAL_MODULE_IDS } from '../shared'
+import type { InlineScriptSession } from './inlineScriptsUtils'
+import { validateFlowGroups, type FlowGroup } from './helperUtils'
+import { flowModuleSchema, flowModulesSchema } from './openFlowZod.gen'
+
+/**
+ * Compact, agent-friendly representation of a flow.
+ *
+ * Inline rawscript content is replaced with `inline_script.<moduleId>` placeholders
+ * by `buildEditableFlowJson` so flows stay short in tool I/O. Use the matching
+ * InlineScriptSession to recover the actual content.
+ */
+export type EditableFlowJson = {
+	modules: FlowModule[]
+	schema: Record<string, any> | null
+	preprocessor_module: FlowModule | null
+	failure_module: FlowModule | null
+	groups: FlowGroup[] | null
+}
+
+/** Optional input to the rich-error path of `validateEditableFlowJson`. */
+type SchemaErrorContext = {
+	/** Custom modules schema to validate against (defaults to flowModulesSchema). */
+	modulesSchema?: z.ZodTypeAny
+}
+
+/**
+ * Navigate to a schema at a given path, handling arrays, objects, unions, and wrappers.
+ * Uses Zod 4 internal structure.
+ */
+function getSchemaAtPath(
+	schema: z.ZodType,
+	path: (string | number)[],
+	data?: any
+): z.ZodType | null {
+	let current: z.ZodType = schema
+	let currentData = data
+
+	for (let i = 0; i < path.length; i++) {
+		const segment = path[i]
+
+		if (!current || !(current as any)._def) return null
+
+		let type = (current as any)._def.type
+
+		// Unwrap optional/nullable/default/catch
+		while (['optional', 'nullable', 'default', 'catch'].includes(type)) {
+			current = (current as any)._def.innerType
+			if (!current || !(current as any)._def) return null
+			type = (current as any)._def.type
+		}
+
+		if (type === 'array') {
+			if (typeof segment === 'number') {
+				current = (current as any)._def.element
+				if (currentData && Array.isArray(currentData)) {
+					currentData = currentData[segment]
+				}
+				continue
+			}
+			current = (current as any)._def.element
+			i--
+			continue
+		}
+
+		if (type === 'object') {
+			const shape = (current as any)._def.shape
+			const key = String(segment)
+			if (shape && key in shape) {
+				current = shape[key]
+				if (currentData && typeof currentData === 'object') {
+					currentData = currentData[key]
+				}
+				continue
+			}
+			return null
+		}
+
+		if (type === 'union') {
+			const options = (current as any)._def.options
+			if (options) {
+				if (currentData && typeof currentData === 'object') {
+					const typeValue = currentData.type
+					if (typeValue) {
+						for (const option of options) {
+							const optionShape = (option as any)._def?.shape
+							const optionType = optionShape?.type?._def?.values?.[0]
+							if (optionType === typeValue) {
+								const remainingPath = path.slice(i)
+								const result = getSchemaAtPath(option, remainingPath, currentData)
+								if (result) return result
+							}
+						}
+					}
+				}
+				for (const option of options) {
+					const remainingPath = path.slice(i)
+					const result = getSchemaAtPath(option, remainingPath, currentData)
+					if (result) return result
+				}
+			}
+			return null
+		}
+
+		if (type === 'record') {
+			current = (current as any)._def.valueType
+			if (!current) return null
+			if (currentData && typeof currentData === 'object') {
+				currentData = currentData[segment]
+			}
+			continue
+		}
+
+		return null
+	}
+
+	return current
+}
+
+function formatJsonSchemaForError(jsonSchema: any): string {
+	if (jsonSchema.type === 'object' && jsonSchema.properties) {
+		const props = Object.entries(jsonSchema.properties)
+			.slice(0, 5)
+			.map(([k, v]: [string, any]) => {
+				if (v.enum) {
+					return `${k}: ${v.enum.map((e: any) => JSON.stringify(e)).join('|')}`
+				}
+				return `${k}: ${v.type || 'any'}`
+			})
+			.join(', ')
+		const moreProps =
+			Object.keys(jsonSchema.properties).length > 5
+				? `, ... (${Object.keys(jsonSchema.properties).length - 5} more)`
+				: ''
+		const required = jsonSchema.required?.length
+			? ` (required: ${jsonSchema.required.join(', ')})`
+			: ''
+		return `{ ${props}${moreProps} }${required}`
+	}
+
+	if (jsonSchema.const !== undefined) return JSON.stringify(jsonSchema.const)
+	if (jsonSchema.enum) {
+		return `one of: ${jsonSchema.enum.map((v: any) => JSON.stringify(v)).join(', ')}`
+	}
+	if (jsonSchema.oneOf) return jsonSchema.oneOf.map((s: any) => formatJsonSchemaForError(s)).join(' | ')
+	if (jsonSchema.anyOf) return jsonSchema.anyOf.map((s: any) => formatJsonSchemaForError(s)).join(' | ')
+	if (jsonSchema.description) return jsonSchema.description
+	return jsonSchema.type || JSON.stringify(jsonSchema)
+}
+
+function getExpectedFormat(schema: z.ZodType): string | null {
+	if (!schema || !(schema as any)._def) return null
+
+	let current = schema
+	while ((current as any)._def.type === 'optional' || (current as any)._def.type === 'nullable') {
+		current = (current as any)._def.innerType
+		if (!current || !(current as any)._def) break
+	}
+
+	try {
+		const jsonSchema = z.toJSONSchema(schema)
+		if (
+			Object.keys(jsonSchema).length <= 1 ||
+			(Object.keys(jsonSchema).length === 1 && jsonSchema.$schema)
+		) {
+			return null
+		}
+		const formatted = formatJsonSchemaForError(jsonSchema)
+		if (formatted && formatted !== 'unknown' && !formatted.startsWith('{')) return formatted
+		if (formatted && formatted.startsWith('{') && formatted !== '{ }') return formatted
+	} catch {
+		// Ignore errors from toJSONSchema
+	}
+	return null
+}
+
+export function validateFlowModules(rawModules: unknown, ctx: SchemaErrorContext = {}): FlowModule[] {
+	if (!Array.isArray(rawModules)) {
+		throw new Error('Flow modules must be an array')
+	}
+
+	const parsedModules = rawModules as FlowModule[]
+	const modulesSchema = ctx.modulesSchema ?? flowModulesSchema
+	const result = modulesSchema.safeParse(parsedModules)
+	if (!result.success) {
+		const errors = result.error.issues.slice(0, 5).map((e) => {
+			const path = e.path
+			const moduleIndex = typeof path[0] === 'number' ? path[0] : undefined
+			const moduleId = moduleIndex !== undefined ? parsedModules[moduleIndex]?.id : undefined
+			const fieldPath = path.slice(1).join('.')
+
+			let message = e.message
+			if (e.code === 'invalid_type') {
+				const targetSchema = getSchemaAtPath(
+					modulesSchema,
+					path as (string | number)[],
+					parsedModules
+				)
+				if (targetSchema) {
+					const expectedFormat = getExpectedFormat(targetSchema)
+					if (expectedFormat) {
+						message += `\n    Expected format: ${expectedFormat}`
+					}
+				}
+			}
+
+			if (moduleId) {
+				return `Module "${moduleId}" -> ${fieldPath}: ${message}`
+			}
+			return `${path.join('.')}: ${message}`
+		})
+
+		throw new Error(`Invalid flow modules:\n${errors.join('\n')}`)
+	}
+
+	const ids = collectAllFlowModuleIdsFromModules(parsedModules)
+	if (ids.length !== new Set(ids).size) {
+		throw new Error('Duplicate module IDs found in flow')
+	}
+
+	const reservedIds = ids.filter(
+		(id) => id === SPECIAL_MODULE_IDS.PREPROCESSOR || id === SPECIAL_MODULE_IDS.FAILURE
+	)
+	if (reservedIds.length > 0) {
+		throw new Error(
+			'Special modules must be provided via preprocessor_module and failure_module, not inside modules'
+		)
+	}
+
+	return parsedModules
+}
+
+export function validateFlowSchema(rawSchema: unknown): Record<string, any> | null {
+	if (rawSchema == null) return null
+	if (typeof rawSchema !== 'object' || Array.isArray(rawSchema)) {
+		throw new Error('Flow schema must be an object or null')
+	}
+	return rawSchema as Record<string, any>
+}
+
+function validateOptionalFlowModule(rawModule: unknown, fieldName: string): FlowModule | null {
+	if (rawModule == null) return null
+
+	const result = flowModuleSchema.safeParse(rawModule)
+	if (!result.success) {
+		const error = result.error.issues[0]
+		throw new Error(`Invalid ${fieldName}: ${error?.message ?? 'unknown error'}`)
+	}
+	return result.data
+}
+
+/**
+ * Parse and validate a raw object as an `EditableFlowJson`. Validates module
+ * shape, schema shape, optional special modules (with their reserved ids),
+ * groups, and that no module ids collide.
+ */
+export function validateEditableFlowJson(
+	rawFlow: unknown,
+	ctx: SchemaErrorContext = {}
+): EditableFlowJson {
+	if (!rawFlow || typeof rawFlow !== 'object' || Array.isArray(rawFlow)) {
+		throw new Error('Flow JSON must be an object')
+	}
+
+	const flow = rawFlow as Record<string, unknown>
+	const modules = validateFlowModules(flow.modules, ctx)
+	const schema = validateFlowSchema(flow.schema)
+	const preprocessorModule = validateOptionalFlowModule(
+		flow.preprocessor_module,
+		'preprocessor_module'
+	)
+	const failureModule = validateOptionalFlowModule(flow.failure_module, 'failure_module')
+	const groupModuleIds = new Set(collectAllFlowModuleIdsFromModules(modules))
+	const groups = validateFlowGroups(flow.groups, groupModuleIds)
+
+	if (preprocessorModule) {
+		if (preprocessorModule.id !== SPECIAL_MODULE_IDS.PREPROCESSOR) {
+			throw new Error(
+				`Invalid preprocessor_module: id must be "${SPECIAL_MODULE_IDS.PREPROCESSOR}"`
+			)
+		}
+		if (
+			preprocessorModule.value.type !== 'rawscript' &&
+			preprocessorModule.value.type !== 'script'
+		) {
+			throw new Error(
+				'Invalid preprocessor_module: only "rawscript" and "script" modules are supported'
+			)
+		}
+	}
+	if (failureModule) {
+		if (failureModule.id !== SPECIAL_MODULE_IDS.FAILURE) {
+			throw new Error(`Invalid failure_module: id must be "${SPECIAL_MODULE_IDS.FAILURE}"`)
+		}
+		if (failureModule.value.type !== 'rawscript' && failureModule.value.type !== 'script') {
+			throw new Error('Invalid failure_module: only "rawscript" and "script" modules are supported')
+		}
+	}
+
+	const ids = new Set(collectAllFlowModuleIdsFromModules(modules))
+	if (preprocessorModule) {
+		if (ids.has(preprocessorModule.id)) {
+			throw new Error(`Duplicate module ID found in preprocessor_module: ${preprocessorModule.id}`)
+		}
+		ids.add(preprocessorModule.id)
+	}
+	if (failureModule && ids.has(failureModule.id)) {
+		throw new Error(`Duplicate module ID found in failure_module: ${failureModule.id}`)
+	}
+
+	return {
+		modules,
+		schema,
+		preprocessor_module: preprocessorModule,
+		failure_module: failureModule,
+		groups
+	}
+}
+
+/**
+ * Build the agent-facing compact view of a flow. When an `InlineScriptSession`
+ * is provided, every rawscript module's `content` is moved into the session
+ * and replaced with the placeholder `inline_script.<moduleId>` (preprocessor
+ * and failure modules included).
+ */
+export function buildEditableFlowJson(
+	flow: { value: FlowValue; schema?: Record<string, any> | null | undefined },
+	inlineScriptSession?: InlineScriptSession
+): EditableFlowJson {
+	const modules = inlineScriptSession
+		? inlineScriptSession.extractAndReplaceInlineScripts(flow.value.modules)
+		: flow.value.modules
+
+	let preprocessorModule = flow.value.preprocessor_module
+	if (
+		preprocessorModule?.value?.type === 'rawscript' &&
+		typeof preprocessorModule.value.content === 'string' &&
+		inlineScriptSession
+	) {
+		inlineScriptSession.set(preprocessorModule.id, preprocessorModule.value.content)
+		preprocessorModule = {
+			...preprocessorModule,
+			value: {
+				...preprocessorModule.value,
+				content: `inline_script.${preprocessorModule.id}`
+			}
+		}
+	}
+
+	let failureModule = flow.value.failure_module
+	if (
+		failureModule?.value?.type === 'rawscript' &&
+		typeof failureModule.value.content === 'string' &&
+		inlineScriptSession
+	) {
+		inlineScriptSession.set(failureModule.id, failureModule.value.content)
+		failureModule = {
+			...failureModule,
+			value: {
+				...failureModule.value,
+				content: `inline_script.${failureModule.id}`
+			}
+		}
+	}
+
+	return {
+		modules,
+		schema: flow.schema ?? null,
+		preprocessor_module: preprocessorModule ?? null,
+		failure_module: failureModule ?? null,
+		groups: flow.value.groups ?? null
+	}
+}
+
+function restoreSpecialRawscriptModule(
+	module: FlowModule | null,
+	session: InlineScriptSession
+): FlowModule | null {
+	if (!module || module.value.type !== 'rawscript' || !module.value.content) return module
+	const match = module.value.content.match(/^inline_script\.(.+)$/)
+	if (!match) return module
+	const content = session.get(match[1])
+	if (content === undefined) return module
+	return { ...module, value: { ...module.value, content } }
+}
+
+/**
+ * Inverse of `buildEditableFlowJson`. Replaces `inline_script.<moduleId>`
+ * placeholders in `editable.modules` and the special modules with the content
+ * stored in `session`. Other fields on the original FlowValue (`same_worker`,
+ * `concurrent_limit`, etc.) are preserved.
+ *
+ * Pair with `buildEditableFlowJson` for round-trip patches: extract → patch
+ * the compact view → restore.
+ */
+export function applyEditableFlowJsonToFlow(
+	originalValue: FlowValue,
+	editable: EditableFlowJson,
+	session: InlineScriptSession
+): FlowValue {
+	return {
+		...originalValue,
+		modules: session.restoreInlineScriptReferences(editable.modules),
+		preprocessor_module:
+			restoreSpecialRawscriptModule(editable.preprocessor_module, session) ?? undefined,
+		failure_module: restoreSpecialRawscriptModule(editable.failure_module, session) ?? undefined,
+		groups: editable.groups ?? undefined
+	}
+}
diff --git a/frontend/src/lib/components/copilot/chat/flow/inlineScriptsUtils.ts b/frontend/src/lib/components/copilot/chat/flow/inlineScriptsUtils.ts
index 4180b7e36b..e63965e52a 100644
--- a/frontend/src/lib/components/copilot/chat/flow/inlineScriptsUtils.ts
+++ b/frontend/src/lib/components/copilot/chat/flow/inlineScriptsUtils.ts
@@ -62,7 +62,7 @@ function extractAndReplaceInlineScripts(
 	return modules.map((module) => {
 		const newModule = { ...module }
 
-		if (newModule.value.type === 'rawscript' && newModule.value.content) {
+		if (newModule.value.type === 'rawscript' && typeof newModule.value.content === 'string') {
 			session.set(module.id, newModule.value.content)
 			newModule.value = {
 				...newModule.value,
@@ -113,7 +113,7 @@ function extractAndReplaceInlineScripts(
 							'type' in tool.value &&
 							tool.value.type === 'rawscript' &&
 							'content' in tool.value &&
-							tool.value.content
+							typeof tool.value.content === 'string'
 						) {
 							session.set(tool.id, tool.value.content as string)
 							return {
diff --git a/frontend/src/lib/components/copilot/chat/global/core.test.ts b/frontend/src/lib/components/copilot/chat/global/core.test.ts
new file mode 100644
index 0000000000..2664c1495d
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/core.test.ts
@@ -0,0 +1,148 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('monaco-editor', () => ({
+	editor: {},
+	languages: {},
+	KeyCode: {},
+	Uri: {
+		parse: (value: string) => ({ toString: () => value })
+	},
+	MarkerSeverity: {
+		Error: 8,
+		Warning: 4,
+		Info: 2,
+		Hint: 1
+	}
+}))
+
+vi.mock('@codingame/monaco-vscode-standalone-typescript-language-features', () => ({
+	getTypeScriptWorker: async () => async () => ({}),
+	typescriptVersion: 'test'
+}))
+
+vi.mock('@codingame/monaco-vscode-languages-service-override', () => ({
+	default: () => ({})
+}))
+
+vi.mock('$lib/components/vscode', () => ({}))
+
+vi.mock('$lib/gen', async () => {
+	const actual = await vi.importActual<any>('$lib/gen')
+
+	function wrapService<T extends object>(target: T, overrides: Record<string, unknown>): T {
+		return new Proxy(target, {
+			get(source, property, receiver) {
+				if (typeof property === 'string' && property in overrides) {
+					return overrides[property]
+				}
+				return Reflect.get(source, property, receiver)
+			}
+		})
+	}
+
+	return {
+		...actual,
+		FlowService: wrapService(actual.FlowService, {
+			existsFlowByPath: vi.fn(async () => false)
+		}),
+		VariableService: wrapService(actual.VariableService, {
+			existsVariable: vi.fn(async () => false)
+		})
+	}
+})
+
+import { globalTools } from './core'
+import { globalDraftStore } from './draftStore.svelte'
+import type { Tool, ToolCallbacks } from '../shared'
+
+const WORKSPACE = 'global-core-test'
+
+const toolCallbacks: ToolCallbacks = {
+	setToolStatus: vi.fn(),
+	removeToolStatus: vi.fn()
+}
+
+function getGlobalTool(name: string): Tool<{}> {
+	const tool = globalTools.find((candidate) => candidate.def.function.name === name)
+	if (!tool) {
+		throw new Error(`Missing global tool "${name}"`)
+	}
+	return tool
+}
+
+async function callGlobalTool(name: string, args: Record<string, unknown>): Promise<string> {
+	return getGlobalTool(name).fn({
+		args,
+		workspace: WORKSPACE,
+		helpers: {},
+		toolCallbacks,
+		toolId: `test-${name}`
+	})
+}
+
+describe('global AI tools', () => {
+	beforeEach(() => {
+		globalDraftStore.clearDrafts(WORKSPACE)
+		vi.clearAllMocks()
+	})
+
+	it('redacts variable draft values when reading workspace items', async () => {
+		await callGlobalTool('write_variable', {
+			path: 'f/secrets/api_key',
+			value: 'super-secret-token',
+			is_secret: true,
+			description: 'API key'
+		})
+
+		const raw = await callGlobalTool('read_workspace_item', {
+			type: 'variable',
+			path: 'f/secrets/api_key'
+		})
+		const item = JSON.parse(raw)
+
+		expect(raw).not.toContain('super-secret-token')
+		expect(item).toEqual({
+			type: 'variable',
+			path: 'f/secrets/api_key',
+			summary: 'API key',
+			isDraft: true
+		})
+	})
+
+	it('fills an empty rawscript module through set_flow_module_code', async () => {
+		await callGlobalTool('write_flow', {
+			path: 'f/flows/empty-module',
+			summary: 'Flow with empty module',
+			value: JSON.stringify({
+				modules: [
+					{
+						id: 'empty_step',
+						value: {
+							type: 'rawscript',
+							language: 'bun',
+							content: '',
+							input_transforms: {}
+						}
+					}
+				]
+			})
+		})
+
+		const code = 'export async function main() {\n\treturn 42\n}'
+
+		await expect(
+			callGlobalTool('set_flow_module_code', {
+				path: 'f/flows/empty-module',
+				module_id: 'empty_step',
+				code
+			})
+		).resolves.toContain('Updated AI draft flow')
+
+		await expect(
+			callGlobalTool('read_flow_module_code', {
+				path: 'f/flows/empty-module',
+				module_id: 'empty_step'
+			})
+		).resolves.toBe(code)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
new file mode 100644
index 0000000000..de18426a3c
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -0,0 +1,2381 @@
+import {
+	AppService,
+	AzureTriggerService,
+	FlowService,
+	GcpTriggerService,
+	HttpTriggerService,
+	KafkaTriggerService,
+	MqttTriggerService,
+	NatsTriggerService,
+	PostgresTriggerService,
+	ResourceService,
+	ScheduleService,
+	ScriptService,
+	SqsTriggerService,
+	VariableService,
+	WebsocketTriggerService
+} from '$lib/gen'
+import { $ScriptLang } from '$lib/gen/schemas.gen'
+import type {
+	AppWithLastVersion,
+	Flow,
+	FlowValue,
+	ListableApp,
+	ListableResource,
+	ListableVariable,
+	Schedule,
+	Script,
+	ScriptLang
+} from '$lib/gen/types.gen'
+import { updateRawAppPolicy } from '$lib/components/raw_apps/rawAppPolicy'
+import {
+	FRAMEWORK_TEMPLATES,
+	STARTER_RUNNABLE,
+	STARTER_RUNNABLE_KEY,
+	type FrameworkKey
+} from '$lib/components/raw_apps/templates'
+import {
+	applyEditableFlowJsonToFlow,
+	buildEditableFlowJson,
+	validateEditableFlowJson
+} from '../flow/editableFlowJson'
+import { createInlineScriptSession } from '../flow/inlineScriptsUtils'
+import {
+	getFlowPrompt,
+	getRawAppPrompt,
+	getResourcePrompt,
+	getScriptPrompt
+} from '$system_prompts'
+import type {
+	ChatCompletionSystemMessageParam,
+	ChatCompletionUserMessageParam
+} from 'openai/resources/chat/completions.mjs'
+import { z } from 'zod'
+import {
+	createToolDef,
+	findAndReplace,
+	type CreatedResourceTriggerKind,
+	type Tool,
+	type ToolCallbacks,
+	type ToolDisplayAction
+} from '../shared'
+import { flowModuleSchema, flowModulesSchema } from '../flow/openFlowZod.gen'
+import {
+	resourceRequestSchema,
+	scheduleRequestSchema,
+	triggerRequestSchemas,
+	variableRequestSchema
+} from '../workspaceToolsZod.gen'
+import {
+	getWorkspaceItemKey,
+	globalDraftStore,
+	TRIGGER_KINDS,
+	type AppDraftValue,
+	type FlowDraftValue,
+	type TriggerKind,
+	type WorkspaceItem,
+	type WorkspaceItemType
+} from './draftStore.svelte'
+import { buildFlowDeployRequestBody, buildScriptDeployRequestBody } from './deployRequests'
+
+const ITEM_TYPES = [
+	'script',
+	'flow',
+	'schedule',
+	'trigger',
+	'resource',
+	'variable',
+	'app'
+] as const satisfies readonly WorkspaceItemType[]
+const INSTRUCTION_SUBJECTS = [
+	'script',
+	'flow',
+	'resource',
+	'app'
+] as const satisfies readonly WorkspaceItemType[]
+const MAX_LIST_LIMIT = 100
+
+const itemTypeSchema = z.enum(ITEM_TYPES)
+const instructionSubjectSchema = z.enum(INSTRUCTION_SUBJECTS)
+const triggerKindSchema = z.enum(TRIGGER_KINDS)
+const scriptLangSchema = z.enum($ScriptLang.enum)
+
+const getInstructionsSchema = z.object({
+	subject: instructionSubjectSchema.describe(
+		"The workspace item type to get authoring instructions for (script, flow, resource, app). Schedules, triggers, and variables don't need instructions — their tool schemas describe everything."
+	),
+	language: scriptLangSchema
+		.optional()
+		.describe(
+			'Required when subject is script. Use the existing script language when modifying, or the requested target language when creating.'
+		)
+})
+
+const listWorkspaceItemsSchema = z.object({
+	types: z
+		.array(itemTypeSchema)
+		.optional()
+		.describe(
+			'Optional item types to list. Defaults to scripts and flows. Pass schedule or trigger explicitly when needed (listing triggers spans 9 kinds and is heavier).'
+		),
+	query: z.string().optional().describe('Optional case-insensitive path or summary search string.'),
+	path_prefix: z
+		.string()
+		.optional()
+		.describe('Optional path prefix filter, such as f/ or u/user/.'),
+	limit: z
+		.number()
+		.int()
+		.min(1)
+		.max(MAX_LIST_LIMIT)
+		.optional()
+		.describe('Maximum number of items to return. Defaults to 50 and is capped at 100.')
+})
+
+const readWorkspaceItemSchema = z.object({
+	type: itemTypeSchema,
+	path: z.string().describe('Workspace path of the item to read.'),
+	trigger_kind: triggerKindSchema
+		.optional()
+		.describe('Required when type is trigger. Identifies which trigger service to call.')
+})
+
+const writeScriptSchema = z.object({
+	path: z
+		.string()
+		.describe('Workspace path of the script, e.g. f/folder/name or u/user/name.'),
+	summary: z.string().optional().describe('Short human-readable summary.'),
+	language: scriptLangSchema.describe('Script language.'),
+	content: z.string().describe('Full script source code.')
+})
+
+const flowValueSchema = z
+	.looseObject({
+		modules: flowModulesSchema.describe('Sequential flow modules.'),
+		preprocessor_module: flowModuleSchema
+			.nullable()
+			.optional()
+			.describe(
+				"Optional preprocessor module with id 'preprocessor'. Runs before normal modules; cannot reference results.*."
+			),
+		failure_module: flowModuleSchema
+			.nullable()
+			.optional()
+			.describe("Optional failure handler module with id 'failure'.")
+	})
+	.describe('OpenFlow value: modules plus optional preprocessor_module and failure_module.')
+
+const readFlowModuleCodeSchema = z.object({
+	path: z.string().describe('Workspace path of the flow.'),
+	module_id: z
+		.string()
+		.describe(
+			'Module id whose inline rawscript content to read. Must reference a module whose value.type is "rawscript".'
+		)
+})
+
+const setFlowModuleCodeSchema = z.object({
+	path: z.string().describe('Workspace path of the flow.'),
+	module_id: z
+		.string()
+		.describe(
+			'Module id whose inline rawscript content to overwrite. Must reference a module whose value.type is "rawscript". Use patch_flow_json for structural changes.'
+		),
+	code: z.string().describe('New script source. Replaces the module\'s value.content entirely.')
+})
+
+// `value` is taken as a JSON string rather than a typed object because the
+// underlying flowValueSchema is recursive (modules can contain modules), which
+// makes z.toJSONSchema emit $defs/$ref. Gemini's tools API rejects those
+// keywords ("Unknown name $ref/$defs"). The string is parsed and validated
+// against flowValueSchema inside the handler. Same trick as set_flow_json in
+// chat/flow/core.ts (see comment on its schema).
+const writeFlowSchema = z.object({
+	path: z
+		.string()
+		.describe('Workspace path of the flow, e.g. f/folder/name or u/user/name.'),
+	summary: z.string().optional().describe('Short human-readable summary.'),
+	value: z
+		.string()
+		.describe(
+			'JSON string of the OpenFlow value object: { modules, preprocessor_module?, failure_module? }. Pass it as a JSON-encoded string, not a nested object.'
+		)
+})
+
+const writeScheduleSchema = scheduleRequestSchema
+
+const writeTriggerSchema = z.object({
+	kind: triggerKindSchema.describe('Trigger kind. Determines which fields are valid in config.'),
+	config: z
+		.union([
+			triggerRequestSchemas.http,
+			triggerRequestSchemas.websocket,
+			triggerRequestSchemas.kafka,
+			triggerRequestSchemas.nats,
+			triggerRequestSchemas.postgres,
+			triggerRequestSchemas.mqtt,
+			triggerRequestSchemas.sqs,
+			triggerRequestSchemas.gcp,
+			triggerRequestSchemas.azure
+		])
+		.describe(
+			'Full trigger configuration. Must include path, script_path, is_flow plus the kind-specific fields.'
+		)
+})
+
+const writeResourceSchema = resourceRequestSchema
+
+const writeVariableSchema = variableRequestSchema
+
+const searchResourceTypesSchema = z.object({
+	query: z.string().describe('Substring to match against resource type names.'),
+	limit: z
+		.number()
+		.int()
+		.min(1)
+		.max(20)
+		.optional()
+		.describe('Max number of resource types to return. Defaults to 5.')
+})
+
+const deleteWorkspaceItemSchema = z.object({
+	type: itemTypeSchema,
+	path: z.string().describe('Workspace path of the item to delete.'),
+	trigger_kind: triggerKindSchema
+		.optional()
+		.describe('Required when type is trigger. Identifies which trigger service to call.')
+})
+
+const deployWorkspaceItemSchema = z.object({
+	type: itemTypeSchema,
+	path: z.string().describe('Workspace path of the draft to deploy.'),
+	trigger_kind: triggerKindSchema
+		.optional()
+		.describe('Required when type is trigger. Must match the draft trigger kind.'),
+	deployment_message: z
+		.string()
+		.optional()
+		.describe('Optional deployment message recorded with the change.')
+})
+
+const editScriptSchema = z.object({
+	path: z.string().describe('Workspace path of the script to edit.'),
+	old_string: z.string().min(1).describe('Exact text to find in the script source.'),
+	new_string: z.string().describe('Replacement text.'),
+	replace_all: z
+		.boolean()
+		.optional()
+		.default(false)
+		.describe(
+			'When true, replace every exact match. When false, old_string must match exactly once.'
+		)
+})
+
+const patchFlowJsonSchema = z.object({
+	path: z.string().describe('Workspace path of the flow to edit.'),
+	old_string: z
+		.string()
+		.min(1)
+		.describe('Exact text to find in the flow value, serialized as compact JSON (no indent).'),
+	new_string: z.string().describe('Replacement JSON text.'),
+	replace_all: z
+		.boolean()
+		.optional()
+		.default(false)
+		.describe(
+			'When true, replace every exact match. When false, old_string must match exactly once.'
+		)
+})
+
+// ============= App tools (raw apps) =============
+
+const backendRunnableSchema = z
+	.object({
+		name: z.string().describe('Short summary/description of what the runnable does.'),
+		type: z
+			.enum(['inline', 'script', 'flow', 'hubscript'])
+			.describe(
+				'Runnable kind: "inline" for custom code stored on the app; "script"/"flow" for a workspace runnable; "hubscript" for a hub script.'
+			),
+		staticInputs: z
+			.record(z.string(), z.any())
+			.optional()
+			.describe(
+				'Static inputs that are not overridable by the frontend caller. Useful for workspace/hub scripts to pre-fill arguments.'
+			),
+		inlineScript: z
+			.object({
+				language: z.enum(['bun', 'python3']).describe('Inline script language.'),
+				content: z.string().describe('Inline script source. Must export a main function.')
+			})
+			.optional()
+			.describe('Required when type is "inline".'),
+		path: z
+			.string()
+			.optional()
+			.describe(
+				'Required when type is "script", "flow", or "hubscript". Workspace path of the runnable.'
+			)
+	})
+	.describe(
+		'Backend runnable shape: same as in app mode. Inline runnables carry their script content; path runnables reference an existing workspace/hub item.'
+	)
+
+const readAppFileSchema = z.object({
+	path: z.string().describe('Workspace path of the app, e.g. f/folder/name.'),
+	file_path: z
+		.string()
+		.describe(
+			'Frontend file path like /index.tsx, or backend inline runnable path like backend/<key>/main.ts (or main.py).'
+		)
+})
+
+const writeAppFileSchema = z.object({
+	path: z.string().describe('Workspace path of the app.'),
+	file_path: z
+		.string()
+		.describe(
+			'Frontend file path (must start with /). Use write_app_runnable to set inline backend script content.'
+		),
+	content: z.string().describe('Full file content.')
+})
+
+const deleteAppFileSchema = z.object({
+	path: z.string().describe('Workspace path of the app.'),
+	file_path: z
+		.string()
+		.describe(
+			'Frontend file path to remove from the draft. Use delete_app_runnable for backend runnables.'
+		)
+})
+
+const patchAppFileSchema = z.object({
+	path: z.string().describe('Workspace path of the app.'),
+	file_path: z
+		.string()
+		.describe(
+			'Frontend file path like /index.tsx, or backend inline runnable path like backend/<key>/main.ts.'
+		),
+	old_string: z.string().min(1).describe('Exact text to find.'),
+	new_string: z.string().describe('Replacement text.'),
+	replace_all: z
+		.boolean()
+		.optional()
+		.default(false)
+		.describe(
+			'When true, replace every exact match. When false, old_string must match exactly once.'
+		)
+})
+
+const writeAppRunnableSchema = z.object({
+	path: z.string().describe('Workspace path of the app.'),
+	key: z
+		.string()
+		.describe(
+			'Unique key for the backend runnable (called from frontend as backend.<key>()). Becomes the file id at backend/<key>/main.{ts|py}.'
+		),
+	runnable: backendRunnableSchema
+})
+
+const deleteAppRunnableSchema = z.object({
+	path: z.string().describe('Workspace path of the app.'),
+	key: z.string().describe('Key of the backend runnable to remove.')
+})
+
+const FRAMEWORK_KEYS = ['react19', 'react18', 'svelte5', 'vue'] as const satisfies readonly FrameworkKey[]
+
+const initAppSchema = z.object({
+	path: z
+		.string()
+		.describe(
+			'Workspace path for the new app, e.g. f/folder/my_app or u/username/my_app. Errors if an app already exists at this path or a draft is already in flight.'
+		),
+	summary: z.string().optional().describe('Short human-readable summary of the app.'),
+	framework: z
+		.enum(FRAMEWORK_KEYS)
+		.describe(
+			'Frontend framework template. Confirm with the user before calling — never default silently. react19 is recommended for new apps.'
+		),
+	data: z
+		.object({
+			datatable: z.string().optional().describe('Default datatable name (e.g. "main").'),
+			schema: z.string().optional().describe('Default schema (PostgreSQL schema, optional).'),
+			tables: z
+				.array(z.string())
+				.optional()
+				.describe(
+					'Initially-whitelisted tables, in the format "<datatable>/<table>" or "<datatable>/<schema>:<table>".'
+				)
+		})
+		.optional()
+		.describe('Optional datatable configuration. Omit unless the user asked to wire one up.')
+})
+
+const GLOBAL_SYSTEM_PROMPT = `You are Windmill's global workspace assistant.
+
+You can inspect workspace scripts, flows, schedules, triggers, resources, variables, and apps, then create draft changes in the frontend AI draft store.
+
+Important rules:
+- write_{script,flow,schedule,trigger,resource,variable} create or overwrite drafts. They do not save, deploy, or mutate workspace items.
+- edit_script and patch_flow_json apply small exact-text edits and save the result as a draft. Prefer them for localized changes; use write_* for large rewrites.
+- For flows specifically: read_workspace_item and patch_flow_json work on a COMPACT view where rawscript module bodies are replaced with the placeholder "inline_script.<moduleId>". Use read_flow_module_code / set_flow_module_code to inspect or overwrite an inline script body; use patch_flow_json for structural edits.
+- deploy_workspace_item persists a draft to the workspace via the real backend create/update API and removes the draft. Requires user confirmation. Only call after the user has reviewed the draft and explicitly asked to deploy.
+- delete_workspace_item permanently removes a workspace item (and any matching draft). Irreversible. Requires user confirmation. Only call when the user has explicitly asked to delete.
+- Use list_workspace_items before broad reads.
+- Use read_workspace_item before overwriting an existing item, unless the user already provided the complete current item. For triggers, pass trigger_kind.
+- Variable values are NEVER returned by read_workspace_item or list_workspace_items — only metadata (path, description, is_secret). The model cannot read secret values, by design.
+- For resources that need secrets, write a Variable first (with is_secret: true), then in the resource value reference it as "$var:path/to/variable". When deploying both, deploy the variable before the resource.
+- Use search_resource_types before write_resource to discover the resource_type name and the JSON Schema its value must match.
+- Use get_instructions before writing a script, flow, resource, or app. For scripts, pass the target language; when modifying, use the language from the item you read.
+- Schedules, triggers, and variables do not need get_instructions — their tool schemas describe every field.
+- A workspace item is { type, path, summary?, language?, triggerKind?, value, isDraft }. For scripts, value is the source code string. For flows, value is { value: <OpenFlow value>, schema, groups } so the inputs schema and groups round-trip through deploy. For schedules/triggers/resources/variables, value is the full request body for that type. For apps, value is { files, runnables, data?, policy?, custom_path? } with frontend file contents and backend runnable definitions.
+- Apps (raw apps): use list_workspace_items with types: ['app'] to find them, read_workspace_item with type 'app' for a metadata summary (file paths + runnable list, no contents), then read_app_file to read individual files. Edit with write_app_file / patch_app_file / delete_app_file for frontend files and write_app_runnable / delete_app_runnable for backend runnables. Frontend file paths start with "/" (e.g. /index.tsx). Backend inline runnables are addressed as "backend/<key>/main.{ts|py}". /wmill.d.ts is generated and cannot be written.
+- To create a new raw app, use init_app. Before calling it, confirm framework (react19 / react18 / svelte5 / vue), path, and summary with the user — do not silently default to react19, even though it is the recommended choice.
+- Apps cannot be deployed from chat. The app editor bundles JS/CSS before save; tell the user to open the app editor to deploy app drafts.
+- Keep context targeted. Do not read unrelated items.
+- Be explicit with the user when you create or update a draft.`
+
+const DEFAULT_LIST_TYPES = ['script', 'flow'] as const satisfies readonly WorkspaceItemType[]
+
+function getRequestedTypes(types: WorkspaceItemType[] | undefined): WorkspaceItemType[] {
+	return types && types.length > 0 ? types : [...DEFAULT_LIST_TYPES]
+}
+
+function itemMatches(
+	item: Pick<WorkspaceItem, 'path' | 'summary'>,
+	query: string | undefined
+): boolean {
+	const normalized = query?.trim().toLowerCase()
+	if (!normalized) return true
+	return (
+		item.path.toLowerCase().includes(normalized) ||
+		(item.summary?.toLowerCase().includes(normalized) ?? false)
+	)
+}
+
+function scriptToItem(script: Script, includeValue: boolean): WorkspaceItem {
+	return {
+		type: 'script',
+		path: script.path,
+		summary: script.summary,
+		language: script.language,
+		value: includeValue ? script.content : undefined,
+		isDraft: false
+	}
+}
+
+function flowToItem(flow: Flow, includeValue: boolean): WorkspaceItem {
+	return {
+		type: 'flow',
+		path: flow.path,
+		summary: flow.summary,
+		value: includeValue
+			? { value: flow.value, schema: flow.schema, groups: flow.value.groups ?? null }
+			: undefined,
+		isDraft: false
+	}
+}
+
+/**
+ * Turn a flow workspace item into the compact response we send to the model:
+ * rawscript content is replaced with `inline_script.<moduleId>` placeholders.
+ * The model retrieves real content via `read_flow_module_code` and edits it via
+ * `set_flow_module_code`. `patch_flow_json` operates on this compact view too,
+ * so structural edits never have to traverse inline script bodies.
+ */
+function serializeWorkspaceItemForRead(item: WorkspaceItem): unknown {
+	if (item.type === 'variable') {
+		return {
+			type: 'variable',
+			path: item.path,
+			summary: item.summary,
+			isDraft: item.isDraft
+		}
+	}
+
+	if (item.type !== 'flow' || !item.value) return item
+	const flowDraft = item.value as FlowDraftValue
+	const session = createInlineScriptSession()
+	const editable = buildEditableFlowJson(flowDraft, session)
+	return {
+		type: 'flow',
+		path: item.path,
+		summary: item.summary,
+		value: editable,
+		isDraft: item.isDraft
+	}
+}
+
+function scheduleToItem(schedule: Schedule, includeValue: boolean): WorkspaceItem {
+	return {
+		type: 'schedule',
+		path: schedule.path,
+		summary: schedule.summary ?? undefined,
+		value: includeValue ? (schedule as unknown as WorkspaceItem['value']) : undefined,
+		isDraft: false
+	}
+}
+
+function resourceToItem(resource: ListableResource, includeValue: boolean): WorkspaceItem {
+	return {
+		type: 'resource',
+		path: resource.path,
+		summary: resource.description,
+		value: includeValue ? (resource as unknown as WorkspaceItem['value']) : undefined,
+		isDraft: false
+	}
+}
+
+function variableToItem(variable: ListableVariable): WorkspaceItem {
+	// Variables NEVER expose value (secret risk). Returns metadata only.
+	return {
+		type: 'variable',
+		path: variable.path,
+		summary: variable.description,
+		isDraft: false
+	}
+}
+
+// ============= App helpers =============
+
+type BackendRunnableInput = z.infer<typeof backendRunnableSchema>
+
+type PersistedRunnable = {
+	name: string
+	type: 'inline' | 'path' | 'runnableByName' | 'runnableByPath'
+	runType?: 'script' | 'flow' | 'hubscript'
+	path?: string
+	inlineScript?: { language: string; content: string }
+	fields?: Record<string, any>
+	schema?: any
+	[key: string]: any
+}
+
+function convertPersistedToBackendRunnable(
+	persisted: PersistedRunnable | undefined,
+	key: string
+): BackendRunnableInput | undefined {
+	if (!persisted) return undefined
+
+	const out: BackendRunnableInput = {
+		name: persisted.name ?? key,
+		type: 'inline'
+	}
+
+	if (persisted.type === 'inline' || persisted.type === 'runnableByName') {
+		out.type = 'inline'
+		if (persisted.inlineScript) {
+			let language = persisted.inlineScript.language
+			if (language === 'nativets' || language === 'deno') language = 'bun'
+			out.inlineScript = {
+				language: language as 'bun' | 'python3',
+				content: persisted.inlineScript.content ?? ''
+			}
+		}
+	} else if (persisted.type === 'path' || persisted.type === 'runnableByPath') {
+		if (persisted.runType === 'flow') out.type = 'flow'
+		else if (persisted.runType === 'hubscript') out.type = 'hubscript'
+		else out.type = 'script'
+		out.path = persisted.path
+	}
+
+	if (persisted.fields) {
+		const staticInputs: Record<string, any> = {}
+		for (const [k, v] of Object.entries(persisted.fields)) {
+			if (v && typeof v === 'object' && (v as any).type === 'static') {
+				staticInputs[k] = (v as any).value
+			}
+		}
+		if (Object.keys(staticInputs).length > 0) out.staticInputs = staticInputs
+	}
+
+	return out
+}
+
+function buildPersistedRunnable(
+	input: BackendRunnableInput,
+	existing: PersistedRunnable | undefined
+): PersistedRunnable {
+	const fields = input.staticInputs
+		? Object.fromEntries(
+				Object.entries(input.staticInputs).map(([k, v]) => [
+					k,
+					{ type: 'static', value: v, fieldType: 'object' }
+				])
+			)
+		: existing?.fields ?? {}
+
+	if (input.type === 'inline') {
+		if (!input.inlineScript) {
+			throw new Error('inlineScript is required when runnable type is "inline".')
+		}
+		return {
+			...(existing ?? {}),
+			name: input.name,
+			type: 'inline',
+			inlineScript: {
+				content: input.inlineScript.content,
+				language: input.inlineScript.language
+			},
+			fields
+		}
+	}
+
+	if (!input.path) {
+		throw new Error('path is required when runnable type is "script", "flow", or "hubscript".')
+	}
+	return {
+		...(existing ?? {}),
+		name: input.name,
+		type: 'path',
+		runType: input.type,
+		path: input.path,
+		fields,
+		schema: existing?.schema ?? {}
+	}
+}
+
+type AppFrontendFileMetadata = {
+	path: string
+	size: number
+}
+
+type AppBackendRunnableMetadata = {
+	key: string
+	name: string
+	type: BackendRunnableInput['type']
+	path?: string
+	language?: 'bun' | 'python3'
+	contentSize?: number
+	staticInputKeys?: string[]
+}
+
+type AppMetadata = {
+	frontend: AppFrontendFileMetadata[]
+	backend: AppBackendRunnableMetadata[]
+	data?: any
+}
+
+function summarizeAppValue(value: AppDraftValue): AppMetadata {
+	const frontend: AppFrontendFileMetadata[] = Object.entries(value.files).map(([path, content]) => ({
+		path,
+		size: typeof content === 'string' ? content.length : 0
+	}))
+	const backend: AppBackendRunnableMetadata[] = Object.entries(value.runnables).map(
+		([key, runnable]) => {
+			const converted = convertPersistedToBackendRunnable(runnable as PersistedRunnable, key)
+			const staticInputKeys = converted?.staticInputs
+				? Object.keys(converted.staticInputs)
+				: undefined
+			return {
+				key,
+				name: converted?.name ?? key,
+				type: converted?.type ?? 'inline',
+				...(converted?.path && { path: converted.path }),
+				...(converted?.inlineScript && {
+					language: converted.inlineScript.language,
+					contentSize: converted.inlineScript.content.length
+				}),
+				...(staticInputKeys && staticInputKeys.length > 0 && { staticInputKeys })
+			}
+		}
+	)
+	return {
+		frontend,
+		backend,
+		...(value.data && { data: value.data })
+	}
+}
+
+function appToItem(app: ListableApp | AppWithLastVersion, includeValue: boolean): WorkspaceItem {
+	return {
+		type: 'app',
+		path: app.path,
+		summary: app.summary,
+		value: includeValue ? ((app as AppWithLastVersion).value as AppDraftValue) : undefined,
+		isDraft: false
+	}
+}
+
+const GENERATED_APP_FILE_PATHS = new Set(['/wmill.d.ts'])
+
+function assertNotGeneratedAppFile(filePath: string): void {
+	if (GENERATED_APP_FILE_PATHS.has(filePath)) {
+		throw new Error(
+			`"${filePath}" is generated automatically from backend runnables and cannot be modified directly.`
+		)
+	}
+}
+
+type AppFileTarget =
+	| { kind: 'frontend'; filePath: string }
+	| { kind: 'backend'; filePath: string; key: string; extension: 'ts' | 'py' }
+
+function resolveAppFileTarget(rawPath: string): AppFileTarget {
+	const trimmed = rawPath.trim()
+	const backendMatch = trimmed.match(/^backend\/([^/]+)\/main\.(ts|py)$/)
+	if (backendMatch) {
+		return {
+			kind: 'backend',
+			filePath: trimmed,
+			key: backendMatch[1],
+			extension: backendMatch[2] as 'ts' | 'py'
+		}
+	}
+	return {
+		kind: 'frontend',
+		filePath: trimmed.startsWith('/') ? trimmed : `/${trimmed}`
+	}
+}
+
+function getInlineScriptExtension(runnable: PersistedRunnable | undefined): 'ts' | 'py' {
+	return runnable?.inlineScript?.language === 'python3' ? 'py' : 'ts'
+}
+
+/**
+ * Resolve a backend file target to its inline script body, validating that the
+ * runnable exists, is inline, and matches the requested file extension. Throws
+ * with a clear message otherwise.
+ */
+function getInlineRunnableContent(
+	value: AppDraftValue,
+	target: { kind: 'backend'; filePath: string; key: string; extension: 'ts' | 'py' },
+	appPath: string
+): { content: string; runnable: PersistedRunnable } {
+	const runnable = value.runnables[target.key] as PersistedRunnable | undefined
+	if (!runnable) {
+		throw new Error(`Backend runnable "${target.key}" not found in app "${appPath}".`)
+	}
+	if (runnable.type !== 'inline' && runnable.type !== 'runnableByName') {
+		throw new Error(
+			`Runnable "${target.key}" is not inline. Use read_workspace_item on the referenced ${runnable.runType ?? 'item'} instead.`
+		)
+	}
+	const expected = getInlineScriptExtension(runnable)
+	if (target.extension !== expected) {
+		throw new Error(
+			`Runnable "${target.key}" language is ${expected}. Use backend/${target.key}/main.${expected}.`
+		)
+	}
+	return { content: runnable.inlineScript?.content ?? '', runnable }
+}
+
+async function loadAppDraftValue(path: string, workspace: string): Promise<AppDraftValue> {
+	const draft = globalDraftStore.getDraft(workspace, 'app', path)
+	if (draft && draft.value && typeof draft.value === 'object' && 'files' in draft.value) {
+		return draft.value as AppDraftValue
+	}
+
+	const app = await AppService.getAppByPath({ workspace, path })
+	const value = (app.value ?? {}) as Partial<AppDraftValue>
+	return {
+		summary: app.summary,
+		files: { ...(value.files ?? {}) },
+		runnables: { ...(value.runnables ?? {}) },
+		data: value.data,
+		policy: app.policy as any,
+		custom_path: app.custom_path
+	}
+}
+
+function saveAppDraft(workspace: string, path: string, value: AppDraftValue): WorkspaceItem {
+	return globalDraftStore.setDraft(workspace, {
+		type: 'app',
+		path,
+		summary: value.summary,
+		value,
+		isDraft: true
+	})
+}
+
+type TriggerLike = { path: string; summary?: string | null }
+
+function triggerToItem(
+	kind: TriggerKind,
+	trigger: TriggerLike,
+	includeValue: boolean
+): WorkspaceItem {
+	return {
+		type: 'trigger',
+		triggerKind: kind,
+		path: trigger.path,
+		summary: trigger.summary ?? undefined,
+		value: includeValue ? (trigger as unknown as WorkspaceItem['value']) : undefined,
+		isDraft: false
+	}
+}
+
+type TriggerService = {
+	exists(args: { workspace: string; path: string }): Promise<boolean>
+	get(args: { workspace: string; path: string }): Promise<TriggerLike>
+	list(args: {
+		workspace: string
+		pathStart?: string
+		perPage?: number
+	}): Promise<TriggerLike[]>
+	create(args: { workspace: string; requestBody: any }): Promise<string>
+	update(args: { workspace: string; path: string; requestBody: any }): Promise<string>
+	delete(args: { workspace: string; path: string }): Promise<string>
+}
+
+const triggerServices: Record<TriggerKind, TriggerService> = {
+	http: {
+		exists: (a) => HttpTriggerService.existsHttpTrigger(a),
+		get: (a) => HttpTriggerService.getHttpTrigger(a),
+		list: (a) => HttpTriggerService.listHttpTriggers(a),
+		create: (a) => HttpTriggerService.createHttpTrigger(a),
+		update: (a) => HttpTriggerService.updateHttpTrigger(a),
+		delete: (a) => HttpTriggerService.deleteHttpTrigger(a)
+	},
+	websocket: {
+		exists: (a) => WebsocketTriggerService.existsWebsocketTrigger(a),
+		get: (a) => WebsocketTriggerService.getWebsocketTrigger(a),
+		list: (a) => WebsocketTriggerService.listWebsocketTriggers(a),
+		create: (a) => WebsocketTriggerService.createWebsocketTrigger(a),
+		update: (a) => WebsocketTriggerService.updateWebsocketTrigger(a),
+		delete: (a) => WebsocketTriggerService.deleteWebsocketTrigger(a)
+	},
+	kafka: {
+		exists: (a) => KafkaTriggerService.existsKafkaTrigger(a),
+		get: (a) => KafkaTriggerService.getKafkaTrigger(a),
+		list: (a) => KafkaTriggerService.listKafkaTriggers(a),
+		create: (a) => KafkaTriggerService.createKafkaTrigger(a),
+		update: (a) => KafkaTriggerService.updateKafkaTrigger(a),
+		delete: (a) => KafkaTriggerService.deleteKafkaTrigger(a)
+	},
+	nats: {
+		exists: (a) => NatsTriggerService.existsNatsTrigger(a),
+		get: (a) => NatsTriggerService.getNatsTrigger(a),
+		list: (a) => NatsTriggerService.listNatsTriggers(a),
+		create: (a) => NatsTriggerService.createNatsTrigger(a),
+		update: (a) => NatsTriggerService.updateNatsTrigger(a),
+		delete: (a) => NatsTriggerService.deleteNatsTrigger(a)
+	},
+	postgres: {
+		exists: (a) => PostgresTriggerService.existsPostgresTrigger(a),
+		get: (a) => PostgresTriggerService.getPostgresTrigger(a),
+		list: (a) => PostgresTriggerService.listPostgresTriggers(a),
+		create: (a) => PostgresTriggerService.createPostgresTrigger(a),
+		update: (a) => PostgresTriggerService.updatePostgresTrigger(a),
+		delete: (a) => PostgresTriggerService.deletePostgresTrigger(a)
+	},
+	mqtt: {
+		exists: (a) => MqttTriggerService.existsMqttTrigger(a),
+		get: (a) => MqttTriggerService.getMqttTrigger(a),
+		list: (a) => MqttTriggerService.listMqttTriggers(a),
+		create: (a) => MqttTriggerService.createMqttTrigger(a),
+		update: (a) => MqttTriggerService.updateMqttTrigger(a),
+		delete: (a) => MqttTriggerService.deleteMqttTrigger(a)
+	},
+	sqs: {
+		exists: (a) => SqsTriggerService.existsSqsTrigger(a),
+		get: (a) => SqsTriggerService.getSqsTrigger(a),
+		list: (a) => SqsTriggerService.listSqsTriggers(a),
+		create: (a) => SqsTriggerService.createSqsTrigger(a),
+		update: (a) => SqsTriggerService.updateSqsTrigger(a),
+		delete: (a) => SqsTriggerService.deleteSqsTrigger(a)
+	},
+	gcp: {
+		exists: (a) => GcpTriggerService.existsGcpTrigger(a),
+		get: (a) => GcpTriggerService.getGcpTrigger(a),
+		list: (a) => GcpTriggerService.listGcpTriggers(a),
+		create: (a) => GcpTriggerService.createGcpTrigger(a),
+		update: (a) => GcpTriggerService.updateGcpTrigger(a),
+		delete: (a) => GcpTriggerService.deleteGcpTrigger(a)
+	},
+	azure: {
+		exists: (a) => AzureTriggerService.existsAzureTrigger(a),
+		get: (a) => AzureTriggerService.getAzureTrigger(a),
+		list: (a) => AzureTriggerService.listAzureTriggers(a),
+		create: (a) => AzureTriggerService.createAzureTrigger(a),
+		update: (a) => AzureTriggerService.updateAzureTrigger(a),
+		delete: (a) => AzureTriggerService.deleteAzureTrigger(a)
+	}
+}
+
+async function workspaceItemExists(
+	type: WorkspaceItemType,
+	path: string,
+	workspace: string,
+	triggerKind?: TriggerKind
+): Promise<boolean> {
+	switch (type) {
+		case 'script':
+			return ScriptService.existsScriptByPath({ workspace, path })
+		case 'flow':
+			return FlowService.existsFlowByPath({ workspace, path })
+		case 'schedule':
+			return ScheduleService.existsSchedule({ workspace, path })
+		case 'trigger':
+			if (!triggerKind) return false
+			return triggerServices[triggerKind].exists({ workspace, path })
+		case 'resource':
+			return ResourceService.existsResource({ workspace, path })
+		case 'variable':
+			return VariableService.existsVariable({ workspace, path })
+		case 'app':
+			return AppService.existsApp({ workspace, path })
+	}
+}
+
+async function readWorkspaceItem(
+	type: WorkspaceItemType,
+	path: string,
+	workspace: string,
+	triggerKind?: TriggerKind
+): Promise<WorkspaceItem> {
+	switch (type) {
+		case 'script':
+			return scriptToItem(await ScriptService.getScriptByPath({ workspace, path }), true)
+		case 'flow':
+			return flowToItem(await FlowService.getFlowByPath({ workspace, path }), true)
+		case 'schedule':
+			return scheduleToItem(await ScheduleService.getSchedule({ workspace, path }), true)
+		case 'trigger':
+			if (!triggerKind) {
+				throw new Error('trigger_kind is required when type is trigger.')
+			}
+			return triggerToItem(
+				triggerKind,
+				await triggerServices[triggerKind].get({ workspace, path }),
+				true
+			)
+		case 'resource':
+			return resourceToItem(
+				await ResourceService.getResource({ workspace, path }) as ListableResource,
+				true
+			)
+		case 'variable':
+			// Never expose the value, even when read directly. Pass decryptSecret=false
+			// to avoid materializing secret values server-side.
+			return variableToItem(
+				await VariableService.getVariable({ workspace, path, decryptSecret: false })
+			)
+		case 'app': {
+			// Returns lightweight metadata only — file/runnable contents come via read_app_file.
+			const app = await AppService.getAppByPath({ workspace, path })
+			const value = (app.value ?? {}) as Partial<AppDraftValue>
+			const metadata = summarizeAppValue({
+				summary: app.summary,
+				files: value.files ?? {},
+				runnables: value.runnables ?? {},
+				data: value.data
+			})
+			return {
+				type: 'app',
+				path: app.path,
+				summary: app.summary,
+				value: metadata as unknown as AppDraftValue,
+				isDraft: false
+			}
+		}
+	}
+}
+
+async function listWorkspaceItems(
+	types: WorkspaceItemType[],
+	workspace: string,
+	pathPrefix: string | undefined,
+	perPage: number
+): Promise<WorkspaceItem[]> {
+	const items: WorkspaceItem[] = []
+
+	if (types.includes('script')) {
+		const scripts = await ScriptService.listScripts({
+			workspace,
+			pathStart: pathPrefix,
+			perPage,
+			includeDraftOnly: true,
+			withoutDescription: true
+		})
+		for (const script of scripts) items.push(scriptToItem(script, false))
+	}
+
+	if (types.includes('flow')) {
+		const flows = await FlowService.listFlows({
+			workspace,
+			pathStart: pathPrefix,
+			perPage,
+			includeDraftOnly: true,
+			withoutDescription: true
+		})
+		for (const flow of flows) items.push(flowToItem(flow, false))
+	}
+
+	if (types.includes('schedule')) {
+		const schedules = await ScheduleService.listSchedules({
+			workspace,
+			pathStart: pathPrefix,
+			perPage
+		})
+		for (const schedule of schedules) items.push(scheduleToItem(schedule, false))
+	}
+
+	if (types.includes('trigger')) {
+		for (const kind of TRIGGER_KINDS) {
+			const triggers = await triggerServices[kind].list({
+				workspace,
+				pathStart: pathPrefix,
+				perPage
+			})
+			for (const trigger of triggers) items.push(triggerToItem(kind, trigger, false))
+		}
+	}
+
+	if (types.includes('resource')) {
+		const resources = await ResourceService.listResource({
+			workspace,
+			pathStart: pathPrefix,
+			perPage
+		})
+		for (const resource of resources) items.push(resourceToItem(resource, false))
+	}
+
+	if (types.includes('variable')) {
+		const variables = await VariableService.listVariable({
+			workspace,
+			pathStart: pathPrefix,
+			perPage
+		})
+		for (const variable of variables) items.push(variableToItem(variable))
+	}
+
+	if (types.includes('app')) {
+		const apps = await AppService.listApps({
+			workspace,
+			pathStart: pathPrefix,
+			perPage
+		})
+		for (const app of apps) items.push(appToItem(app, false))
+	}
+
+	return items
+}
+
+function getScriptInstructions(language: ScriptLang | undefined): string {
+	const selected = language ?? 'bun'
+	const note = language
+		? ''
+		: `\n- No script language was provided. Default to \`bun\` only for new TypeScript scripts; if the user requested another language or you read an existing script, call get_instructions again with that language.`
+
+	return `# Global draft script instructions
+
+- Global mode writes complete draft payloads only; it does not save, deploy, run, or generate metadata.
+- A script draft is a workspace item: \`{ type: 'script', path, summary?, language, value, isDraft }\` where \`value\` is the source code string.
+- Use workspace paths such as \`f/folder/name\` or \`u/username/name\`. Preserve the current path/language when modifying unless the user asked to change them.
+- Use \`edit_script\` for small localized changes (provide \`old_string\`/\`new_string\`); use \`write_script\` for full rewrites.${note}
+
+# Windmill script authoring reference (${selected})
+
+${getScriptPrompt(selected)}`
+}
+
+function getFlowInstructions(): string {
+	return `# Global draft flow instructions
+
+- Global mode writes complete draft payloads only; it does not save, deploy, run, scaffold local files, or generate metadata.
+- A flow draft is a workspace item: \`{ type: 'flow', path, summary?, value, isDraft }\` where \`value\` is \`{ value: <OpenFlow value object>, schema, groups }\`. The inputs schema and groups are kept alongside the OpenFlow value so deploy round-trips them.
+- \`value.modules\` contains normal sequential modules. Use top-level \`value.preprocessor_module\` and \`value.failure_module\` for special modules; do not put \`preprocessor\` or \`failure\` in \`value.modules\`.
+- Every module needs a stable unique \`id\` and a useful \`summary\` when the schema supports it.
+- Prefer path/script/flow modules when composing existing workspace logic. Use rawscript modules only when new inline code is needed.
+- When writing rawscript module code, call \`get_instructions\` with \`subject: "script"\` and the rawscript language first.
+
+## Compact view: how rawscript bodies surface in tool I/O
+
+- \`read_workspace_item\` and \`patch_flow_json\` operate on a **compact view** of the flow: every rawscript module's \`value.content\` is replaced with the placeholder \`"inline_script.<moduleId>"\` so inline script bodies don't bloat tool I/O. Schema, groups, preprocessor_module and failure_module are all shown in this view.
+- Inline rawscript content is **not** part of the JSON \`patch_flow_json\` sees. Edits to inline bodies happen via dedicated tools:
+  - \`read_flow_module_code(path, module_id)\` — returns the raw inline script content for one module.
+  - \`set_flow_module_code(path, module_id, code)\` — overwrites that module's inline script content; saves to the AI draft.
+- Use \`patch_flow_json\` for *structural* edits: module ids, paths, input_transforms, branch arrangement, summaries, preprocessor/failure swaps, schema/groups. Use \`set_flow_module_code\` for changes inside a specific rawscript body.
+- \`write_flow\` is for full overwrites / create-from-scratch. Its \`value\` argument is the **non-compact** OpenFlow value (rawscript content is the actual code, not a placeholder).
+
+# Windmill flow authoring reference
+
+${getFlowPrompt()}`
+}
+
+type InstructionSubject = (typeof INSTRUCTION_SUBJECTS)[number]
+
+function getAppInstructions(): string {
+	return `# Global draft app instructions
+
+- Global mode edits raw app drafts only; it does not save, deploy, or bundle.
+- App drafts are addressed by workspace path (e.g. \`f/folder/my_app\`). The first write tool snapshots the workspace app onto the draft, and subsequent writes accumulate.
+- To create a new app, use \`init_app\` with a path, optional summary, and a framework (\`react19\` / \`react18\` / \`svelte5\` / \`vue\`). Confirm framework + path + summary with the user before calling — do not silently default to \`react19\` even though it is the recommended choice. \`init_app\` errors if an app already exists at the path or a draft is already in flight; in that case, edit the existing one rather than re-initializing.
+- \`init_app\` seeds a starter inline runnable named \`a\` (bun, \`main(x: string) => string\`) so the React/Svelte demo button works on first render. Replace or remove it once you start building real backend runnables.
+- Frontend file paths start with \`/\` (e.g. \`/index.tsx\`, \`/App.tsx\`, \`/styles.css\`). Use \`write_app_file\` / \`patch_app_file\` / \`delete_app_file\`.
+- Backend inline runnables are addressed as \`backend/<key>/main.{ts|py}\` from the file tools, but you create or update them via \`write_app_runnable\` / \`delete_app_runnable\` (which take the runnable shape directly: \`{ name, type, inlineScript?, path?, staticInputs? }\`).
+- \`/wmill.d.ts\` (or \`wmill.ts\`) is generated automatically from the backend runnables — never write it directly.
+- Inline runnables only support \`bun\` or \`python3\` in chat. Path runnables (\`script\`/\`flow\`/\`hubscript\`) reference an existing item.
+- Apps cannot be deployed from chat. The app editor bundles JS/CSS before save; tell the user to open the app editor to deploy app drafts.
+- Use \`read_workspace_item\` with \`type: 'app'\` for a metadata summary (file paths and runnable list, no contents). Use \`read_app_file\` to read an individual file.
+- Note: the authoring reference below mentions the CLI on-disk layout (\`backend/<id>.<ext>\`, \`raw_app.yaml\`, \`sql_to_apply/\`). That layout is only relevant for the terminal workflow — in chat, apps are addressed via the tool surface above.
+
+# Windmill raw app authoring reference
+
+${getRawAppPrompt()}`
+}
+
+function getResourceInstructions(): string {
+	return `# Global draft resource & variable instructions
+
+- Global mode writes complete draft payloads only; it does not save, deploy, run, scaffold local files, or generate metadata.
+- A resource draft is a workspace item: \`{ type: 'resource', path, summary?, value, isDraft }\`. \`value\` is a CreateResource body: \`{ path, value, description?, resource_type, labels? }\` where the inner \`value\` is the resource type's data shape.
+- A variable draft is a workspace item: \`{ type: 'variable', path, summary?, value, isDraft }\`. \`value\` is a CreateVariable body: \`{ path, value, is_secret, description, account?, is_oauth?, expires_at?, labels? }\`.
+- For secret fields in a resource value, do NOT inline the raw secret. Create a Variable first with \`is_secret: true\`, then in the resource value reference it as \`"$var:path/to/variable"\`.
+- Reference formats inside resource values: \`$var:g/all/name\` (global), \`$var:u/user/name\` (user), \`$var:f/folder/name\` (folder). Reference another resource with \`$res:path/to/resource\`.
+- When deploying drafts that depend on each other (e.g., a resource and the variables it references), deploy the variables first.
+- Use \`search_resource_types\` to discover valid \`resource_type\` names and their JSON Schemas. Match the resource value to that schema.
+- For OAuth resources, the \`is_oauth: true\` flag is managed by Windmill's OAuth flow; global mode generally creates manual resources, not OAuth ones.
+
+# Windmill resource & variable reference
+
+${getResourcePrompt()}`
+}
+
+function getInstructions(subject: InstructionSubject, language?: ScriptLang): string {
+	switch (subject) {
+		case 'script':
+			return getScriptInstructions(language)
+		case 'flow':
+			return getFlowInstructions()
+		case 'resource':
+			return getResourceInstructions()
+		case 'app':
+			return getAppInstructions()
+	}
+}
+
+export const globalTools: Tool<{}>[] = [
+	{
+		def: createToolDef(
+			getInstructionsSchema,
+			'get_instructions',
+			'Get Windmill authoring instructions for scripts, flows, resources, or apps. For scripts, pass the target language.'
+		),
+		fn: async ({ args, toolId, toolCallbacks }) => {
+			const parsed = getInstructionsSchema.parse(args)
+			const label =
+				parsed.subject === 'script' && parsed.language
+					? `${parsed.subject} (${parsed.language})`
+					: parsed.subject
+			toolCallbacks.setToolStatus(toolId, { content: `Loaded ${label} instructions` })
+			return getInstructions(parsed.subject, parsed.language)
+		}
+	},
+	{
+		def: createToolDef(
+			listWorkspaceItemsSchema,
+			'list_workspace_items',
+			'List workspace items (scripts, flows, schedules, triggers, resources, variables, apps) and AI drafts. Returns metadata only (no value). Defaults to scripts and flows.'
+		),
+		fn: async ({ args, workspace, toolId, toolCallbacks }) => {
+			const parsed = listWorkspaceItemsSchema.parse(args)
+			const types = getRequestedTypes(parsed.types)
+			const limit = parsed.limit ?? 50
+			toolCallbacks.setToolStatus(toolId, { content: 'Listing workspace items...' })
+
+			const byKey = new Map<string, WorkspaceItem>()
+			const workspaceItems = await listWorkspaceItems(
+				types,
+				workspace,
+				parsed.path_prefix,
+				Math.min(limit, MAX_LIST_LIMIT)
+			)
+			for (const item of workspaceItems) {
+				byKey.set(getWorkspaceItemKey(item.type, item.path, item.triggerKind), item)
+			}
+
+			for (const draft of globalDraftStore.listDrafts(workspace)) {
+				if (!types.includes(draft.type)) continue
+				byKey.set(getWorkspaceItemKey(draft.type, draft.path, draft.triggerKind), {
+					...draft,
+					value: undefined
+				})
+			}
+
+			const results = Array.from(byKey.values())
+				.filter((item) => itemMatches(item, parsed.query))
+				.slice(0, limit)
+
+			toolCallbacks.setToolStatus(toolId, {
+				content: `Listed ${results.length} workspace item(s)`
+			})
+			return JSON.stringify(results, null, 2)
+		}
+	},
+	{
+		def: createToolDef(
+			readWorkspaceItemSchema,
+			'read_workspace_item',
+			'Read one workspace item or AI draft by type and path. Returns the full workspace item including value.'
+		),
+		fn: async ({ args, workspace, toolId, toolCallbacks }) => {
+			const parsed = readWorkspaceItemSchema.parse(args)
+			if (parsed.type === 'trigger' && !parsed.trigger_kind) {
+				const message = 'trigger_kind is required when type is trigger.'
+				toolCallbacks.setToolStatus(toolId, { content: message, error: message })
+				return JSON.stringify({ success: false, error: message })
+			}
+			const draft = globalDraftStore.getDraft(
+				workspace,
+				parsed.type,
+				parsed.path,
+				parsed.trigger_kind
+			)
+			if (draft) {
+				toolCallbacks.setToolStatus(toolId, {
+					content: `Read AI draft ${parsed.type} "${parsed.path}"`
+				})
+				return JSON.stringify(serializeWorkspaceItemForRead(draft), null, 2)
+			}
+
+			toolCallbacks.setToolStatus(toolId, {
+				content: `Reading ${parsed.type} "${parsed.path}"...`
+			})
+			const item = await readWorkspaceItem(
+				parsed.type,
+				parsed.path,
+				workspace,
+				parsed.trigger_kind
+			)
+			toolCallbacks.setToolStatus(toolId, { content: `Read ${parsed.type} "${parsed.path}"` })
+			return JSON.stringify(serializeWorkspaceItemForRead(item), null, 2)
+		}
+	},
+	{
+		def: createToolDef(
+			writeScriptSchema,
+			'write_script',
+			'Create or overwrite an AI draft script. Does not save or deploy. Read the existing script first when overwriting.'
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = writeScriptSchema.parse(ctx.args)
+			return writeDraft(
+				{
+					type: 'script',
+					path: parsed.path,
+					summary: parsed.summary,
+					language: parsed.language,
+					value: parsed.content,
+					isDraft: true
+				},
+				ctx
+			)
+		}
+	},
+	{
+		def: createToolDef(
+			writeFlowSchema,
+			'write_flow',
+			'Create or overwrite an AI draft flow. Does not save or deploy. Read the existing flow first when overwriting. value must be a JSON-encoded string of the OpenFlow value object.'
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = writeFlowSchema.parse(ctx.args)
+			let value: unknown
+			try {
+				value = JSON.parse(parsed.value)
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error)
+				throw new Error(`Invalid JSON for value: ${message}`)
+			}
+			const validated = flowValueSchema.safeParse(value)
+			if (!validated.success) {
+				throw new Error(
+					`Invalid flow value: ${validated.error.issues
+						.slice(0, 5)
+						.map((i) => `${i.path.join('.')}: ${i.message}`)
+						.join('; ')}`
+				)
+			}
+			return writeDraft(
+				{
+					type: 'flow',
+					path: parsed.path,
+					summary: parsed.summary,
+					value: { value: validated.data as FlowValue, schema: null, groups: null },
+					isDraft: true
+				},
+				ctx
+			)
+		}
+	},
+	{
+		def: createToolDef(
+			writeScheduleSchema,
+			'write_schedule',
+			'Create or overwrite an AI draft schedule. Does not save or deploy. Provide script_path and is_flow to point to the runnable.',
+			{ strict: false }
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = writeScheduleSchema.parse(ctx.args)
+			return writeDraft(
+				{
+					type: 'schedule',
+					path: parsed.path,
+					summary: parsed.summary ?? undefined,
+					value: parsed,
+					isDraft: true
+				},
+				ctx
+			)
+		}
+	},
+	{
+		def: createToolDef(
+			writeTriggerSchema,
+			'write_trigger',
+			'Create or overwrite an AI draft trigger. Does not save or deploy. Provide kind plus the kind-specific config (including path, script_path, is_flow).',
+			{ strict: false }
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = writeTriggerSchema.parse(ctx.args)
+			const config = parsed.config as { path: string; summary?: string | null }
+			return writeDraft(
+				{
+					type: 'trigger',
+					triggerKind: parsed.kind,
+					path: config.path,
+					summary: config.summary ?? undefined,
+					value: parsed.config,
+					isDraft: true
+				},
+				ctx
+			)
+		}
+	},
+	{
+		def: createToolDef(
+			editScriptSchema,
+			'edit_script',
+			'Find/replace exact text in a script. Edits the existing draft if one exists, otherwise reads the workspace script and saves the result as a new draft.'
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = editScriptSchema.parse(ctx.args)
+			return editScript(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			patchFlowJsonSchema,
+			'patch_flow_json',
+			'Find/replace exact text in a flow value (compact JSON). Edits the existing draft if one exists, otherwise reads the workspace flow and saves the result as a new draft. Use write_flow for larger structural rewrites.'
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = patchFlowJsonSchema.parse(ctx.args)
+			return patchFlowJson(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			deployWorkspaceItemSchema,
+			'deploy_workspace_item',
+			'Persist an AI draft to the workspace by calling the real backend create/update API. This MUTATES the workspace. Requires user confirmation.',
+			{ strict: false }
+		),
+		showDetails: true,
+		showFade: true,
+		requiresConfirmation: true,
+		confirmationMessage: 'Deploy AI draft to workspace',
+		fn: async (ctx) => {
+			const parsed = deployWorkspaceItemSchema.parse(ctx.args)
+			return deployDraft(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			deleteWorkspaceItemSchema,
+			'delete_workspace_item',
+			'Permanently delete a workspace item by path. This MUTATES the workspace and is irreversible. Also clears any matching AI draft. Requires user confirmation.'
+		),
+		showDetails: true,
+		showFade: true,
+		requiresConfirmation: true,
+		confirmationMessage: 'Delete workspace item',
+		fn: async (ctx) => {
+			const parsed = deleteWorkspaceItemSchema.parse(ctx.args)
+			return deleteWorkspaceItem(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			writeResourceSchema,
+			'write_resource',
+			'Create or overwrite an AI draft resource. Does not save or deploy. Reference secret values via $var:path/to/variable; create the variable separately with write_variable.',
+			{ strict: false }
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = writeResourceSchema.parse(ctx.args)
+			return writeDraft(
+				{
+					type: 'resource',
+					path: parsed.path,
+					summary: parsed.description,
+					value: parsed,
+					isDraft: true
+				},
+				ctx
+			)
+		}
+	},
+	{
+		def: createToolDef(
+			writeVariableSchema,
+			'write_variable',
+			'Create or overwrite an AI draft variable. Does not save or deploy. Use is_secret: true for secret values. After deploy, reference from a resource as $var:path/to/variable.',
+			{ strict: false }
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = writeVariableSchema.parse(ctx.args)
+			return writeDraft(
+				{
+					type: 'variable',
+					path: parsed.path,
+					summary: parsed.description,
+					value: parsed,
+					isDraft: true
+				},
+				ctx
+			)
+		}
+	},
+	{
+		def: createToolDef(
+			searchResourceTypesSchema,
+			'search_resource_types',
+			'Search for resource types in the workspace by substring. Returns names, descriptions, and JSON Schemas — use this before write_resource to know what shape value should have.'
+		),
+		fn: async ({ args, workspace, toolId, toolCallbacks }) => {
+			const parsed = searchResourceTypesSchema.parse(args)
+			toolCallbacks.setToolStatus(toolId, {
+				content: `Searching resource types for "${parsed.query}"...`
+			})
+			const results = await ResourceService.queryResourceTypes({
+				workspace,
+				text: parsed.query,
+				limit: parsed.limit ?? 5
+			})
+			toolCallbacks.setToolStatus(toolId, {
+				content: `Found ${results.length} resource type(s) for "${parsed.query}"`
+			})
+			return JSON.stringify(
+				results.map((rt) => ({
+					name: rt.name,
+					schema: rt.schema
+				})),
+				null,
+				2
+			)
+		}
+	},
+	{
+		def: createToolDef(
+			readFlowModuleCodeSchema,
+			'read_flow_module_code',
+			'Read the inline rawscript content of one flow module by id. Reads from the AI draft when one exists, otherwise from the workspace flow. Use this instead of patch_flow_json when you only need to inspect an inline script body.'
+		),
+		fn: async (ctx) => {
+			const parsed = readFlowModuleCodeSchema.parse(ctx.args)
+			return readFlowModuleCode(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			setFlowModuleCodeSchema,
+			'set_flow_module_code',
+			'Overwrite the inline rawscript content of one flow module by id. Saves to the AI draft only — does not deploy. Use this for inline script body changes; structural changes (module ids, paths, input_transforms, branches) go through patch_flow_json.'
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = setFlowModuleCodeSchema.parse(ctx.args)
+			return setFlowModuleCode(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			initAppSchema,
+			'init_app',
+			'Initialize a new raw app draft from a framework template. Errors if an app already exists at the path or a draft is already in flight. Confirm framework, path, and summary with the user before calling — do not silently default to react19.',
+			{ strict: false }
+		),
+		showDetails: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = initAppSchema.parse(ctx.args)
+			return initApp(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			readAppFileSchema,
+			'read_app_file',
+			'Read one frontend file or inline backend runnable script from a raw app. Use file_path "/foo.tsx" for frontend files and "backend/<key>/main.{ts|py}" for inline runnables. Prefers the AI draft when one exists.'
+		),
+		fn: async (ctx) => {
+			const parsed = readAppFileSchema.parse(ctx.args)
+			return readAppFile(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			writeAppFileSchema,
+			'write_app_file',
+			'Create or overwrite a frontend file in an app draft. Saves to the AI draft only — does not deploy. First write snapshots the workspace app onto the draft.'
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = writeAppFileSchema.parse(ctx.args)
+			return writeAppFile(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			deleteAppFileSchema,
+			'delete_app_file',
+			'Remove a frontend file from an app draft. Saves to the AI draft only — does not deploy.'
+		),
+		fn: async (ctx) => {
+			const parsed = deleteAppFileSchema.parse(ctx.args)
+			return deleteAppFile(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			patchAppFileSchema,
+			'patch_app_file',
+			'Find/replace exact text in a frontend file or inline backend runnable script. Saves the result to the AI draft.'
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = patchAppFileSchema.parse(ctx.args)
+			return patchAppFile(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			writeAppRunnableSchema,
+			'write_app_runnable',
+			'Create or overwrite a backend runnable in an app draft. Saves to the AI draft only — does not deploy. Re-derives the app policy after the change.',
+			{ strict: false }
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = writeAppRunnableSchema.parse(ctx.args)
+			return writeAppRunnable(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			deleteAppRunnableSchema,
+			'delete_app_runnable',
+			'Remove a backend runnable from an app draft. Saves to the AI draft only — does not deploy. Re-derives the app policy after the change.'
+		),
+		fn: async (ctx) => {
+			const parsed = deleteAppRunnableSchema.parse(ctx.args)
+			return deleteAppRunnable(parsed, ctx)
+		}
+	}
+]
+
+type WriteDraftCtx = {
+	workspace: string
+	toolId: string
+	toolCallbacks: ToolCallbacks
+}
+
+async function loadScriptForEdit(
+	path: string,
+	workspace: string
+): Promise<{ content: string; language: ScriptLang; summary?: string }> {
+	const draft = globalDraftStore.getDraft(workspace, 'script', path)
+	if (draft) {
+		if (typeof draft.value !== 'string' || !draft.language) {
+			throw new Error(`Draft script "${path}" is missing content or language.`)
+		}
+		return { content: draft.value, language: draft.language, summary: draft.summary }
+	}
+	const script = await ScriptService.getScriptByPath({ workspace, path })
+	return { content: script.content, language: script.language, summary: script.summary }
+}
+
+async function editScript(
+	args: { path: string; old_string: string; new_string: string; replace_all: boolean },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { path, old_string: oldString, new_string: newString, replace_all: replaceAll } = args
+	ctx.toolCallbacks.setToolStatus(ctx.toolId, { content: `Editing script "${path}"...` })
+
+	const base = await loadScriptForEdit(path, ctx.workspace)
+	const updated = findAndReplace(base.content, oldString, newString, replaceAll, 'script source')
+	return writeDraft(
+		{
+			type: 'script',
+			path,
+			summary: base.summary,
+			language: base.language,
+			value: updated,
+			isDraft: true
+		},
+		ctx
+	)
+}
+
+async function loadFlowDraftValue(
+	path: string,
+	workspace: string
+): Promise<{ flow: FlowDraftValue; summary?: string }> {
+	const draft = globalDraftStore.getDraft(workspace, 'flow', path)
+	if (draft) {
+		if (draft.value === undefined || typeof draft.value === 'string') {
+			throw new Error(`Draft flow "${path}" has no value.`)
+		}
+		return { flow: draft.value as FlowDraftValue, summary: draft.summary }
+	}
+	const flow = await FlowService.getFlowByPath({ workspace, path })
+	return {
+		flow: { value: flow.value, schema: flow.schema, groups: flow.value.groups ?? null },
+		summary: flow.summary
+	}
+}
+
+async function patchFlowJson(
+	args: { path: string; old_string: string; new_string: string; replace_all: boolean },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { path, old_string: oldString, new_string: newString, replace_all: replaceAll } = args
+	ctx.toolCallbacks.setToolStatus(ctx.toolId, { content: `Patching flow "${path}"...` })
+
+	// Operate on the compact (placeholders-for-rawscript) view so inline script
+	// bodies don't appear in the JSON the model sees or patches. Real script
+	// content is preserved through the patch via the InlineScriptSession; the
+	// model uses set_flow_module_code to change inline script bodies.
+	const base = await loadFlowDraftValue(path, ctx.workspace)
+	const session = createInlineScriptSession()
+	const editable = buildEditableFlowJson(base.flow, session)
+	const currentJson = JSON.stringify(editable)
+	const updatedJson = findAndReplace(
+		currentJson,
+		oldString,
+		newString,
+		replaceAll,
+		'compact flow JSON'
+	)
+	let parsedValue: unknown
+	try {
+		parsedValue = JSON.parse(updatedJson)
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error)
+		throw new Error(`Invalid JSON after replacement: ${message}`)
+	}
+
+	const patchedEditable = validateEditableFlowJson(parsedValue)
+	const newFlowValue = applyEditableFlowJsonToFlow(base.flow.value, patchedEditable, session)
+
+	return writeDraft(
+		{
+			type: 'flow',
+			path,
+			summary: base.summary,
+			value: {
+				...base.flow,
+				value: newFlowValue,
+				schema: patchedEditable.schema,
+				groups: patchedEditable.groups
+			},
+			isDraft: true
+		},
+		ctx
+	)
+}
+
+async function readFlowModuleCode(
+	args: { path: string; module_id: string },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Reading inline script for module "${args.module_id}" from flow "${args.path}"...`
+	})
+	const base = await loadFlowDraftValue(args.path, workspace)
+	const session = createInlineScriptSession()
+	buildEditableFlowJson(base.flow, session)
+	const content = session.get(args.module_id)
+	if (content === undefined) {
+		throw new Error(
+			`Module "${args.module_id}" is not an inline rawscript in flow "${args.path}". (Path runnables, branches, and loops have no inline script content; use patch_flow_json to inspect them.)`
+		)
+	}
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Read inline script for "${args.module_id}"`
+	})
+	return content
+}
+
+async function setFlowModuleCode(
+	args: { path: string; module_id: string; code: string },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Updating inline script for module "${args.module_id}" in flow "${args.path}"...`
+	})
+	const base = await loadFlowDraftValue(args.path, workspace)
+	const session = createInlineScriptSession()
+	const editable = buildEditableFlowJson(base.flow, session)
+	if (!session.has(args.module_id)) {
+		throw new Error(
+			`Module "${args.module_id}" is not an inline rawscript in flow "${args.path}". Use patch_flow_json or write_flow for structural changes.`
+		)
+	}
+	session.set(args.module_id, args.code)
+	const newFlowValue = applyEditableFlowJsonToFlow(base.flow.value, editable, session)
+	return writeDraft(
+		{
+			type: 'flow',
+			path: args.path,
+			summary: base.summary,
+			value: { ...base.flow, value: newFlowValue },
+			isDraft: true
+		},
+		ctx
+	)
+}
+
+async function initApp(
+	args: {
+		path: string
+		summary?: string
+		framework: FrameworkKey
+		data?: { datatable?: string; schema?: string; tables?: string[] }
+	},
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const { path, summary, framework, data } = args
+
+	if (globalDraftStore.getDraft(workspace, 'app', path)) {
+		throw new Error(
+			`An AI draft for app "${path}" already exists. Use write_app_file / write_app_runnable to modify it, or delete the existing draft first.`
+		)
+	}
+	if (await AppService.existsApp({ workspace, path })) {
+		throw new Error(
+			`An app already exists at "${path}". Use read_workspace_item + write_app_file / write_app_runnable to modify it.`
+		)
+	}
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Initializing app draft "${path}" with ${framework} template...`
+	})
+
+	const template = FRAMEWORK_TEMPLATES[framework]
+	const value: AppDraftValue = {
+		summary,
+		files: { ...template },
+		runnables: { [STARTER_RUNNABLE_KEY]: { ...STARTER_RUNNABLE } },
+		...(data && {
+			data: {
+				tables: data.tables ?? [],
+				datatable: data.datatable,
+				schema: data.schema
+			}
+		})
+	}
+	await recomputeAppPolicy(value)
+	const stored = saveAppDraft(workspace, path, value)
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Initialized app draft "${path}" (${framework})`,
+		result: 'Draft initialized'
+	})
+	return JSON.stringify(
+		{
+			success: true,
+			message: `Initialized AI draft app "${path}" from the ${framework} template with a starter runnable "${STARTER_RUNNABLE_KEY}". Use write_app_file / write_app_runnable to evolve the draft.`,
+			item: stored
+		},
+		null,
+		2
+	)
+}
+
+async function readAppFile(
+	args: { path: string; file_path: string },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const target = resolveAppFileTarget(args.file_path)
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Reading ${target.filePath} from app "${args.path}"...`
+	})
+
+	const value = await loadAppDraftValue(args.path, workspace)
+
+	if (target.kind === 'frontend') {
+		const content = value.files[target.filePath]
+		if (content === undefined) {
+			throw new Error(`Frontend file "${target.filePath}" not found in app "${args.path}".`)
+		}
+		toolCallbacks.setToolStatus(toolId, { content: `Read ${target.filePath}` })
+		return content
+	}
+
+	const { content } = getInlineRunnableContent(value, target, args.path)
+	toolCallbacks.setToolStatus(toolId, { content: `Read ${target.filePath}` })
+	return content
+}
+
+async function writeAppFile(
+	args: { path: string; file_path: string; content: string },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const target = resolveAppFileTarget(args.file_path)
+	if (target.kind !== 'frontend') {
+		throw new Error(
+			`write_app_file only writes frontend files. Use write_app_runnable to set inline backend script content.`
+		)
+	}
+	assertNotGeneratedAppFile(target.filePath)
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Writing ${target.filePath} to app "${args.path}"...`
+	})
+
+	const value = await loadAppDraftValue(args.path, workspace)
+	value.files = { ...value.files, [target.filePath]: args.content }
+	const stored = saveAppDraft(workspace, args.path, value)
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Updated ${target.filePath} in app "${args.path}"`,
+		result: 'Draft updated'
+	})
+	return JSON.stringify(
+		{
+			success: true,
+			message: `Updated AI draft app "${args.path}" with frontend file "${target.filePath}".`,
+			item: stored
+		},
+		null,
+		2
+	)
+}
+
+async function deleteAppFile(
+	args: { path: string; file_path: string },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const target = resolveAppFileTarget(args.file_path)
+	if (target.kind !== 'frontend') {
+		throw new Error(
+			`delete_app_file only deletes frontend files. Use delete_app_runnable for backend runnables.`
+		)
+	}
+	assertNotGeneratedAppFile(target.filePath)
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Deleting ${target.filePath} from app "${args.path}"...`
+	})
+
+	const value = await loadAppDraftValue(args.path, workspace)
+	if (!(target.filePath in value.files)) {
+		throw new Error(`Frontend file "${target.filePath}" not found in app "${args.path}".`)
+	}
+	const { [target.filePath]: _removed, ...remaining } = value.files
+	value.files = remaining
+	const stored = saveAppDraft(workspace, args.path, value)
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Removed ${target.filePath} from app "${args.path}"`,
+		result: 'Draft updated'
+	})
+	return JSON.stringify(
+		{
+			success: true,
+			message: `Removed "${target.filePath}" from AI draft app "${args.path}".`,
+			item: stored
+		},
+		null,
+		2
+	)
+}
+
+async function patchAppFile(
+	args: {
+		path: string
+		file_path: string
+		old_string: string
+		new_string: string
+		replace_all: boolean
+	},
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const { path, file_path: filePath, old_string: oldString, new_string: newString, replace_all: replaceAll } = args
+	const target = resolveAppFileTarget(filePath)
+	if (target.kind === 'frontend') {
+		assertNotGeneratedAppFile(target.filePath)
+	}
+
+	toolCallbacks.setToolStatus(toolId, { content: `Patching ${target.filePath} in app "${path}"...` })
+
+	const value = await loadAppDraftValue(path, workspace)
+	let currentContent: string
+	let runnable: PersistedRunnable | undefined
+
+	if (target.kind === 'frontend') {
+		const existing = value.files[target.filePath]
+		if (existing === undefined) {
+			throw new Error(`Frontend file "${target.filePath}" not found in app "${path}".`)
+		}
+		currentContent = existing
+	} else {
+		const resolved = getInlineRunnableContent(value, target, path)
+		currentContent = resolved.content
+		runnable = resolved.runnable
+	}
+
+	const updated = findAndReplace(
+		currentContent,
+		oldString,
+		newString,
+		replaceAll,
+		`${target.filePath} content`
+	)
+
+	if (target.kind === 'frontend') {
+		value.files = { ...value.files, [target.filePath]: updated }
+	} else {
+		value.runnables = {
+			...value.runnables,
+			[target.key]: {
+				...runnable!,
+				inlineScript: {
+					language: runnable!.inlineScript?.language ?? (target.extension === 'py' ? 'python3' : 'bun'),
+					content: updated
+				}
+			}
+		}
+	}
+
+	const stored = saveAppDraft(workspace, path, value)
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Patched ${target.filePath} in app "${path}"`,
+		result: 'Draft updated'
+	})
+	return JSON.stringify(
+		{
+			success: true,
+			message: `Patched "${target.filePath}" in AI draft app "${path}".`,
+			item: stored
+		},
+		null,
+		2
+	)
+}
+
+async function recomputeAppPolicy(value: AppDraftValue): Promise<void> {
+	value.policy = (await updateRawAppPolicy(
+		value.runnables as any,
+		value.policy as any
+	)) as any
+}
+
+async function writeAppRunnable(
+	args: { path: string; key: string; runnable: BackendRunnableInput },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const { path, key, runnable: input } = args
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Writing runnable "${key}" to app "${path}"...`
+	})
+
+	const value = await loadAppDraftValue(path, workspace)
+	const existing = value.runnables[key] as PersistedRunnable | undefined
+	const persisted = buildPersistedRunnable(input, existing)
+	value.runnables = { ...value.runnables, [key]: persisted }
+	await recomputeAppPolicy(value)
+	const stored = saveAppDraft(workspace, path, value)
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Updated runnable "${key}" in app "${path}"`,
+		result: 'Draft updated'
+	})
+	return JSON.stringify(
+		{
+			success: true,
+			message: `Updated AI draft app "${path}" with runnable "${key}".`,
+			item: stored
+		},
+		null,
+		2
+	)
+}
+
+async function deleteAppRunnable(
+	args: { path: string; key: string },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const { path, key } = args
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Removing runnable "${key}" from app "${path}"...`
+	})
+
+	const value = await loadAppDraftValue(path, workspace)
+	if (!(key in value.runnables)) {
+		throw new Error(`Backend runnable "${key}" not found in app "${path}".`)
+	}
+	const { [key]: _removed, ...remaining } = value.runnables
+	value.runnables = remaining
+	await recomputeAppPolicy(value)
+	const stored = saveAppDraft(workspace, path, value)
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Removed runnable "${key}" from app "${path}"`,
+		result: 'Draft updated'
+	})
+	return JSON.stringify(
+		{
+			success: true,
+			message: `Removed runnable "${key}" from AI draft app "${path}".`,
+			item: stored
+		},
+		null,
+		2
+	)
+}
+
+const triggerLabels: Record<TriggerKind, string> = {
+	http: 'HTTP trigger',
+	websocket: 'WebSocket trigger',
+	kafka: 'Kafka trigger',
+	nats: 'NATS trigger',
+	postgres: 'Postgres trigger',
+	mqtt: 'MQTT trigger',
+	sqs: 'SQS trigger',
+	gcp: 'GCP Pub/Sub trigger',
+	azure: 'Azure Event Grid trigger'
+}
+
+function createOpenScheduleAction(
+	path: string,
+	targetKind: 'script' | 'flow'
+): ToolDisplayAction {
+	return {
+		id: `open-deployed-schedule:${path}`,
+		type: 'open_created_resource',
+		label: 'Open schedule',
+		resource: 'schedule',
+		path,
+		targetKind
+	}
+}
+
+function createOpenTriggerAction(
+	kind: TriggerKind,
+	path: string,
+	targetKind: 'script' | 'flow'
+): ToolDisplayAction {
+	return {
+		id: `open-deployed-trigger:${kind}:${path}`,
+		type: 'open_created_resource',
+		label: `Open ${triggerLabels[kind]}`,
+		resource: 'trigger',
+		triggerKind: kind as CreatedResourceTriggerKind,
+		path,
+		targetKind
+	}
+}
+
+function createOpenResourceAction(path: string): ToolDisplayAction {
+	return {
+		id: `open-deployed-resource:${path}`,
+		type: 'open_created_resource',
+		label: 'Open resource',
+		resource: 'resource',
+		path
+	}
+}
+
+function createOpenVariableAction(path: string): ToolDisplayAction {
+	return {
+		id: `open-deployed-variable:${path}`,
+		type: 'open_created_resource',
+		label: 'Open variable',
+		resource: 'variable',
+		path
+	}
+}
+
+async function deployDraft(
+	args: {
+		type: WorkspaceItemType
+		path: string
+		trigger_kind?: TriggerKind
+		deployment_message?: string
+	},
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const { type, path, trigger_kind: triggerKind, deployment_message: deploymentMessage } = args
+
+	if (type === 'app') {
+		throw new Error(
+			'Apps cannot be deployed from chat. Open the app editor to deploy (the editor bundles JS/CSS before save).'
+		)
+	}
+
+	if (type === 'trigger' && !triggerKind) {
+		throw new Error('trigger_kind is required when deploying a trigger.')
+	}
+
+	const draft = globalDraftStore.getDraft(workspace, type, path, triggerKind)
+	if (!draft) {
+		throw new Error(`No AI draft found for ${type} "${path}".`)
+	}
+	if (draft.value === undefined) {
+		throw new Error(`Draft ${type} "${path}" has no value to deploy.`)
+	}
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Deploying ${type} "${path}"...`
+	})
+
+	let actions: ToolDisplayAction[] | undefined
+
+	switch (type) {
+		case 'script': {
+			const existing = (await ScriptService.existsScriptByPath({ workspace, path }))
+				? await ScriptService.getScriptByPath({ workspace, path })
+				: undefined
+			await ScriptService.createScript({
+				workspace,
+				requestBody: buildScriptDeployRequestBody(path, draft, existing, deploymentMessage)
+			})
+			break
+		}
+		case 'flow': {
+			const flowDraft = draft.value as FlowDraftValue
+			const existing = (await FlowService.existsFlowByPath({ workspace, path }))
+				? await FlowService.getFlowByPath({ workspace, path })
+				: undefined
+			const requestBody = buildFlowDeployRequestBody(
+				path,
+				draft.summary,
+				flowDraft,
+				existing,
+				deploymentMessage
+			)
+			if (existing) {
+				await FlowService.updateFlow({ workspace, path, requestBody })
+			} else {
+				await FlowService.createFlow({ workspace, requestBody })
+			}
+			break
+		}
+		case 'schedule': {
+			const requestBody = draft.value as any
+			if (await ScheduleService.existsSchedule({ workspace, path })) {
+				await ScheduleService.updateSchedule({ workspace, path, requestBody })
+			} else {
+				await ScheduleService.createSchedule({ workspace, requestBody })
+			}
+			actions = [createOpenScheduleAction(path, requestBody.is_flow ? 'flow' : 'script')]
+			break
+		}
+		case 'trigger': {
+			const service = triggerServices[triggerKind!]
+			const requestBody = draft.value as { is_flow?: boolean }
+			if (await service.exists({ workspace, path })) {
+				await service.update({ workspace, path, requestBody })
+			} else {
+				await service.create({ workspace, requestBody })
+			}
+			actions = [
+				createOpenTriggerAction(triggerKind!, path, requestBody.is_flow ? 'flow' : 'script')
+			]
+			break
+		}
+		case 'resource': {
+			const requestBody = draft.value as any
+			if (await ResourceService.existsResource({ workspace, path })) {
+				await ResourceService.updateResource({ workspace, path, requestBody })
+			} else {
+				await ResourceService.createResource({ workspace, requestBody })
+			}
+			actions = [createOpenResourceAction(path)]
+			break
+		}
+		case 'variable': {
+			const requestBody = draft.value as any
+			if (await VariableService.existsVariable({ workspace, path })) {
+				await VariableService.updateVariable({ workspace, path, requestBody })
+			} else {
+				await VariableService.createVariable({ workspace, requestBody })
+			}
+			actions = [createOpenVariableAction(path)]
+			break
+		}
+	}
+
+	globalDraftStore.deleteDraft(workspace, type, path, triggerKind)
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Deployed ${type} "${path}"`,
+		result: 'Deployed',
+		actions
+	})
+	return JSON.stringify(
+		{
+			success: true,
+			message: `Deployed AI draft ${type} "${path}" to the workspace. Draft removed from the AI draft store.`,
+			type,
+			path,
+			triggerKind
+		},
+		null,
+		2
+	)
+}
+
+async function deleteWorkspaceItem(
+	args: { type: WorkspaceItemType; path: string; trigger_kind?: TriggerKind },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const { type, path, trigger_kind: triggerKind } = args
+
+	if (type === 'trigger' && !triggerKind) {
+		throw new Error('trigger_kind is required when deleting a trigger.')
+	}
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Deleting ${type} "${path}"...`
+	})
+
+	switch (type) {
+		case 'script':
+			await ScriptService.deleteScriptByPath({ workspace, path })
+			break
+		case 'flow':
+			await FlowService.deleteFlowByPath({ workspace, path })
+			break
+		case 'schedule':
+			await ScheduleService.deleteSchedule({ workspace, path })
+			break
+		case 'trigger':
+			await triggerServices[triggerKind!].delete({ workspace, path })
+			break
+		case 'resource':
+			await ResourceService.deleteResource({ workspace, path })
+			break
+		case 'variable':
+			await VariableService.deleteVariable({ workspace, path })
+			break
+		case 'app':
+			await AppService.deleteApp({ workspace, path })
+			break
+	}
+
+	globalDraftStore.deleteDraft(workspace, type, path, triggerKind)
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Deleted ${type} "${path}"`,
+		result: 'Deleted'
+	})
+	return JSON.stringify(
+		{
+			success: true,
+			message: `Deleted ${type} "${path}" from the workspace. Any matching AI draft was also cleared.`,
+			type,
+			path,
+			triggerKind
+		},
+		null,
+		2
+	)
+}
+
+async function writeDraft(item: WorkspaceItem, ctx: WriteDraftCtx): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Writing draft ${item.type} "${item.path}"...`
+	})
+
+	const exists =
+		globalDraftStore.getDraft(workspace, item.type, item.path, item.triggerKind) !== undefined ||
+		(await workspaceItemExists(item.type, item.path, workspace, item.triggerKind))
+
+	const stored = globalDraftStore.setDraft(workspace, item)
+
+	const verb = exists ? 'Updated' : 'Created'
+	toolCallbacks.setToolStatus(toolId, {
+		content: `${verb} AI draft ${item.type} "${item.path}"`,
+		result: `Draft ${verb.toLowerCase()}`
+	})
+	return JSON.stringify(
+		{
+			success: true,
+			message: `${verb} AI draft ${item.type} "${item.path}". The workspace was not saved or deployed.`,
+			item: stored.type === 'variable' ? serializeWorkspaceItemForRead(stored) : stored
+		},
+		null,
+		2
+	)
+}
+
+export function prepareGlobalSystemMessage(
+	customPrompt?: string
+): ChatCompletionSystemMessageParam {
+	let content = GLOBAL_SYSTEM_PROMPT
+	if (customPrompt?.trim()) {
+		content = `${content}\n\nUSER GIVEN INSTRUCTIONS:\n${customPrompt.trim()}`
+	}
+
+	return {
+		role: 'system',
+		content
+	}
+}
+
+export function prepareGlobalUserMessage(instructions: string): ChatCompletionUserMessageParam {
+	return {
+		role: 'user',
+		content: instructions
+	}
+}
diff --git a/frontend/src/lib/components/copilot/chat/global/deployRequests.test.ts b/frontend/src/lib/components/copilot/chat/global/deployRequests.test.ts
new file mode 100644
index 0000000000..f79bbd2a4e
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/deployRequests.test.ts
@@ -0,0 +1,165 @@
+import { describe, expect, it } from 'vitest'
+import type { Flow, NewScript, Script } from '$lib/gen/types.gen'
+import { buildFlowDeployRequestBody, buildScriptDeployRequestBody } from './deployRequests'
+import type { WorkspaceItem } from './draftStore.svelte'
+
+describe('global AI deploy request builders', () => {
+	it('preserves existing script metadata while replacing draft-controlled fields', () => {
+		const existing = {
+			hash: 'parent-hash',
+			path: 'f/demo/script',
+			summary: 'existing summary',
+			description: 'existing description',
+			content: 'old content',
+			schema: { properties: { name: { type: 'string' } } },
+			is_template: true,
+			language: 'bun',
+			kind: 'script',
+			tag: 'node',
+			envs: ['ENV_A'],
+			concurrent_limit: 3,
+			concurrency_time_window_s: 60,
+			concurrency_key: 'key',
+			debounce_key: 'debounce',
+			debounce_delay_s: 5,
+			debounce_args_to_accumulate: ['ids'],
+			max_total_debouncing_time: 120,
+			max_total_debounces_amount: 4,
+			cache_ttl: 30,
+			cache_ignore_s3_path: true,
+			dedicated_worker: true,
+			ws_error_handler_muted: true,
+			priority: 9,
+			restart_unless_cancelled: true,
+			timeout: 300,
+			delete_after_secs: 600,
+			visible_to_runner_only: true,
+			auto_kind: 'script',
+			codebase: 'repo',
+			has_preprocessor: true,
+			on_behalf_of_email: 'deployer@example.com',
+			assets: [{ path: 's3://bucket/key', kind: 's3object' }],
+			modules: { 'helper.ts': { content: 'export const helper = 1', language: 'bun' } },
+			labels: ['prod'],
+			lock: 'stale lock'
+		} as unknown as Script & Partial<NewScript>
+		const draft: WorkspaceItem = {
+			type: 'script',
+			path: 'f/demo/script',
+			summary: 'draft summary',
+			language: 'bun',
+			value: 'new content',
+			isDraft: true
+		}
+
+		const requestBody = buildScriptDeployRequestBody('f/demo/script', draft, existing, 'ai deploy')
+
+		expect(requestBody).toMatchObject({
+			path: 'f/demo/script',
+			parent_hash: 'parent-hash',
+			summary: 'draft summary',
+			description: 'existing description',
+			content: 'new content',
+			schema: existing.schema,
+			tag: 'node',
+			envs: ['ENV_A'],
+			concurrent_limit: 3,
+			concurrency_time_window_s: 60,
+			concurrency_key: 'key',
+			debounce_key: 'debounce',
+			debounce_delay_s: 5,
+			debounce_args_to_accumulate: ['ids'],
+			max_total_debouncing_time: 120,
+			max_total_debounces_amount: 4,
+			cache_ttl: 30,
+			cache_ignore_s3_path: true,
+			dedicated_worker: true,
+			ws_error_handler_muted: true,
+			priority: 9,
+			restart_unless_cancelled: true,
+			timeout: 300,
+			delete_after_secs: 600,
+			visible_to_runner_only: true,
+			auto_kind: 'script',
+			codebase: 'repo',
+			has_preprocessor: true,
+			on_behalf_of_email: 'deployer@example.com',
+			preserve_on_behalf_of: true,
+			assets: existing.assets,
+			modules: existing.modules,
+			labels: ['prod'],
+			deployment_message: 'ai deploy'
+		})
+		expect(requestBody.lock).toBeUndefined()
+	})
+
+	it('preserves existing flow metadata and uses draft value/schema overrides', () => {
+		const existing = {
+			path: 'f/demo/flow',
+			summary: 'existing summary',
+			description: 'existing description',
+			value: { modules: [] },
+			schema: { required: ['name'] },
+			tag: 'python',
+			ws_error_handler_muted: true,
+			priority: 7,
+			dedicated_worker: true,
+			timeout: 60,
+			visible_to_runner_only: true,
+			on_behalf_of_email: 'deployer@example.com',
+			labels: ['critical']
+		} as unknown as Flow
+		const draftValue = {
+			value: { modules: [{ id: 'step', value: { type: 'identity' } }] },
+			schema: { properties: { name: { type: 'string' } } },
+			groups: [{ start_id: 'step', end_id: 'step', summary: 'Group' }]
+		}
+
+		const requestBody = buildFlowDeployRequestBody(
+			'f/demo/flow',
+			undefined,
+			draftValue as any,
+			existing,
+			'ai deploy'
+		)
+
+		expect(requestBody).toMatchObject({
+			path: 'f/demo/flow',
+			summary: 'existing summary',
+			description: 'existing description',
+			schema: draftValue.schema,
+			tag: 'python',
+			ws_error_handler_muted: true,
+			priority: 7,
+			dedicated_worker: true,
+			timeout: 60,
+			visible_to_runner_only: true,
+			on_behalf_of_email: 'deployer@example.com',
+			preserve_on_behalf_of: true,
+			labels: ['critical'],
+			deployment_message: 'ai deploy'
+		})
+		expect(requestBody.value.modules).toHaveLength(1)
+		expect(requestBody.value.groups).toEqual(draftValue.groups)
+	})
+
+	it('falls back to existing flow schema when the draft has no schema', () => {
+		const existing = {
+			path: 'f/demo/flow',
+			summary: 'existing summary',
+			value: { modules: [] },
+			schema: { properties: { existing: { type: 'boolean' } } }
+		} as unknown as Flow
+
+		const requestBody = buildFlowDeployRequestBody(
+			'f/demo/flow',
+			'draft summary',
+			{ value: { modules: [] }, schema: null, groups: null },
+			existing,
+			undefined
+		)
+
+		expect(requestBody.summary).toBe('draft summary')
+		expect(requestBody.schema).toBe(existing.schema)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/global/deployRequests.ts b/frontend/src/lib/components/copilot/chat/global/deployRequests.ts
new file mode 100644
index 0000000000..c9b2630c51
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/deployRequests.ts
@@ -0,0 +1,101 @@
+import type { Flow, NewScript, OpenFlowWPath, Script } from '$lib/gen/types.gen'
+import type { FlowDraftValue, WorkspaceItem } from './draftStore.svelte'
+
+type ScriptWithDeployMetadata = Script & Partial<Pick<NewScript, 'assets' | 'cache_ignore_s3_path'>>
+
+export type FlowDeployRequestBody = OpenFlowWPath & {
+	deployment_message?: string
+}
+
+function preserveOnBehalfOf(email: string | undefined): true | undefined {
+	return email ? true : undefined
+}
+
+export function buildScriptDeployRequestBody(
+	path: string,
+	draft: WorkspaceItem,
+	existing: Script | undefined,
+	deploymentMessage: string | undefined
+): NewScript {
+	if (typeof draft.value !== 'string' || !draft.language) {
+		throw new Error(`Draft script "${path}" is missing content or language.`)
+	}
+
+	const existingWithMetadata = existing as ScriptWithDeployMetadata | undefined
+
+	return {
+		path,
+		summary: draft.summary ?? existing?.summary ?? '',
+		description: existing?.description ?? '',
+		content: draft.value,
+		parent_hash: existing?.hash,
+		schema: existing?.schema,
+		is_template: existing?.is_template,
+		language: draft.language,
+		kind: existing?.kind,
+		tag: existing?.tag,
+		envs: existing?.envs,
+		concurrent_limit: existing?.concurrent_limit,
+		concurrency_time_window_s: existing?.concurrency_time_window_s,
+		debounce_key: existing?.debounce_key,
+		debounce_delay_s: existing?.debounce_delay_s,
+		debounce_args_to_accumulate: existing?.debounce_args_to_accumulate,
+		max_total_debouncing_time: existing?.max_total_debouncing_time,
+		max_total_debounces_amount: existing?.max_total_debounces_amount,
+		cache_ttl: existing?.cache_ttl,
+		cache_ignore_s3_path: existingWithMetadata?.cache_ignore_s3_path,
+		dedicated_worker: existing?.dedicated_worker,
+		ws_error_handler_muted: existing?.ws_error_handler_muted,
+		priority: existing?.priority,
+		restart_unless_cancelled: existing?.restart_unless_cancelled,
+		timeout: existing?.timeout,
+		delete_after_secs: existing?.delete_after_secs,
+		deployment_message: deploymentMessage,
+		concurrency_key: existing?.concurrency_key,
+		visible_to_runner_only: existing?.visible_to_runner_only,
+		auto_kind: existing?.auto_kind,
+		codebase: existing?.codebase,
+		has_preprocessor: existing?.has_preprocessor,
+		on_behalf_of_email: existing?.on_behalf_of_email,
+		preserve_on_behalf_of: preserveOnBehalfOf(existing?.on_behalf_of_email),
+		assets: existingWithMetadata?.assets,
+		modules: existing?.modules,
+		labels: existing?.labels
+	}
+}
+
+function flowValueWithDraftGroups(flowDraft: FlowDraftValue): FlowDraftValue['value'] {
+	if (flowDraft.groups === undefined) {
+		return flowDraft.value
+	}
+	return {
+		...flowDraft.value,
+		groups: flowDraft.groups ?? undefined
+	}
+}
+
+export function buildFlowDeployRequestBody(
+	path: string,
+	draftSummary: string | undefined,
+	flowDraft: FlowDraftValue,
+	existing: Flow | undefined,
+	deploymentMessage: string | undefined
+): FlowDeployRequestBody {
+	return {
+		path,
+		summary: draftSummary ?? existing?.summary ?? '',
+		description: existing?.description ?? '',
+		value: flowValueWithDraftGroups(flowDraft),
+		schema: flowDraft.schema ?? existing?.schema ?? {},
+		tag: existing?.tag,
+		ws_error_handler_muted: existing?.ws_error_handler_muted,
+		priority: existing?.priority,
+		dedicated_worker: existing?.dedicated_worker,
+		timeout: existing?.timeout,
+		visible_to_runner_only: existing?.visible_to_runner_only,
+		on_behalf_of_email: existing?.on_behalf_of_email,
+		preserve_on_behalf_of: preserveOnBehalfOf(existing?.on_behalf_of_email),
+		labels: existing?.labels,
+		deployment_message: deploymentMessage
+	}
+}
diff --git a/frontend/src/lib/components/copilot/chat/global/draftStore.svelte.ts b/frontend/src/lib/components/copilot/chat/global/draftStore.svelte.ts
new file mode 100644
index 0000000000..c0fb8985f5
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/draftStore.svelte.ts
@@ -0,0 +1,192 @@
+import type {
+	AzureTriggerData,
+	CreateResource,
+	CreateVariable,
+	FlowValue,
+	GcpTriggerData,
+	NewHttpTrigger,
+	NewKafkaTrigger,
+	NewMqttTrigger,
+	NewNatsTrigger,
+	NewPostgresTrigger,
+	NewSchedule,
+	NewSqsTrigger,
+	NewWebsocketTrigger,
+	Policy,
+	ScriptLang
+} from '$lib/gen/types.gen'
+
+/**
+ * Flow draft value. Mirrors what the backend's create/update flow API expects
+ * — the OpenFlow value, plus the inputs schema and (optional) groups.
+ *
+ * Schema and groups are split out from FlowValue intentionally so that
+ * deploy_workspace_item can preserve them through the draft → workspace
+ * round-trip; an earlier version dropped them on every deploy.
+ */
+export type FlowDraftValue = {
+	value: FlowValue
+	schema?: Record<string, any> | null
+	groups?: NonNullable<FlowValue['groups']> | null
+}
+
+export const TRIGGER_KINDS = [
+	'http',
+	'websocket',
+	'kafka',
+	'nats',
+	'postgres',
+	'mqtt',
+	'sqs',
+	'gcp',
+	'azure'
+] as const
+
+export type TriggerKind = (typeof TRIGGER_KINDS)[number]
+
+export type TriggerRequestBody =
+	| NewHttpTrigger
+	| NewWebsocketTrigger
+	| NewKafkaTrigger
+	| NewNatsTrigger
+	| NewPostgresTrigger
+	| NewMqttTrigger
+	| NewSqsTrigger
+	| GcpTriggerData
+	| AzureTriggerData
+
+export type WorkspaceItemType =
+	| 'script'
+	| 'flow'
+	| 'schedule'
+	| 'trigger'
+	| 'resource'
+	| 'variable'
+	| 'app'
+
+export type AppDraftValue = {
+	summary?: string
+	files: Record<string, string>
+	runnables: Record<string, any>
+	data?: any
+	policy?: Policy
+	custom_path?: string
+}
+
+export type WorkspaceItem = {
+	type: WorkspaceItemType
+	path: string
+	summary?: string
+	language?: ScriptLang
+	triggerKind?: TriggerKind
+	value?:
+		| string
+		| FlowDraftValue
+		| NewSchedule
+		| TriggerRequestBody
+		| CreateResource
+		| CreateVariable
+		| AppDraftValue
+	isDraft: boolean
+}
+
+export function getWorkspaceItemKey(
+	type: WorkspaceItemType,
+	path: string,
+	triggerKind?: TriggerKind
+): string {
+	if (type === 'trigger') {
+		return `trigger:${triggerKind ?? ''}:${path}`
+	}
+	return `${type}:${path}`
+}
+
+function clone<T>(value: T): T {
+	return structuredClone($state.snapshot(value)) as T
+}
+
+class GlobalDraftStore {
+	private drafts = $state<Record<string, Record<string, WorkspaceItem>>>({})
+
+	private getWorkspaceDrafts(workspace: string): Record<string, WorkspaceItem> {
+		return this.drafts[workspace] ?? {}
+	}
+
+	private ensureWorkspaceDrafts(workspace: string): Record<string, WorkspaceItem> {
+		if (!this.drafts[workspace]) {
+			this.drafts[workspace] = {}
+		}
+		return this.drafts[workspace]
+	}
+
+	listDrafts(workspace: string): WorkspaceItem[] {
+		return Object.values(this.getWorkspaceDrafts(workspace)).map(clone)
+	}
+
+	getDraft(
+		workspace: string,
+		type: WorkspaceItemType,
+		path: string,
+		triggerKind?: TriggerKind
+	): WorkspaceItem | undefined {
+		const draft = this.getWorkspaceDrafts(workspace)[getWorkspaceItemKey(type, path, triggerKind)]
+		return draft ? clone(draft) : undefined
+	}
+
+	setDraft(workspace: string, item: WorkspaceItem): WorkspaceItem {
+		const stored: WorkspaceItem = { ...clone(item), isDraft: true }
+		this.ensureWorkspaceDrafts(workspace)[
+			getWorkspaceItemKey(item.type, item.path, item.triggerKind)
+		] = stored
+		return clone(stored)
+	}
+
+	deleteDraft(
+		workspace: string,
+		type: WorkspaceItemType,
+		path: string,
+		triggerKind?: TriggerKind
+	): void {
+		const drafts = this.drafts[workspace]
+		if (!drafts) return
+
+		delete drafts[getWorkspaceItemKey(type, path, triggerKind)]
+		if (Object.keys(drafts).length === 0) {
+			delete this.drafts[workspace]
+		}
+	}
+
+	clearDrafts(workspace: string): void {
+		delete this.drafts[workspace]
+	}
+
+	getScriptDraft(workspace: string, path: string): WorkspaceItem | undefined {
+		return this.getDraft(workspace, 'script', path)
+	}
+
+	getFlowDraft(workspace: string, path: string): WorkspaceItem | undefined {
+		return this.getDraft(workspace, 'flow', path)
+	}
+
+	getScheduleDraft(workspace: string, path: string): WorkspaceItem | undefined {
+		return this.getDraft(workspace, 'schedule', path)
+	}
+
+	getTriggerDraft(workspace: string, kind: TriggerKind, path: string): WorkspaceItem | undefined {
+		return this.getDraft(workspace, 'trigger', path, kind)
+	}
+
+	getResourceDraft(workspace: string, path: string): WorkspaceItem | undefined {
+		return this.getDraft(workspace, 'resource', path)
+	}
+
+	getVariableDraft(workspace: string, path: string): WorkspaceItem | undefined {
+		return this.getDraft(workspace, 'variable', path)
+	}
+
+	getAppDraft(workspace: string, path: string): WorkspaceItem | undefined {
+		return this.getDraft(workspace, 'app', path)
+	}
+}
+
+export const globalDraftStore = new GlobalDraftStore()
diff --git a/frontend/src/lib/components/copilot/chat/global/draftStore.test.ts b/frontend/src/lib/components/copilot/chat/global/draftStore.test.ts
new file mode 100644
index 0000000000..a05126a568
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/draftStore.test.ts
@@ -0,0 +1,56 @@
+import { beforeEach, describe, expect, it } from 'vitest'
+import { globalDraftStore } from './draftStore.svelte'
+
+const WORKSPACE_A = 'draft-store-test-a'
+const WORKSPACE_B = 'draft-store-test-b'
+
+function clearTestDrafts() {
+	globalDraftStore.clearDrafts(WORKSPACE_A)
+	globalDraftStore.clearDrafts(WORKSPACE_B)
+}
+
+describe('globalDraftStore', () => {
+	beforeEach(clearTestDrafts)
+
+	it('lists and reads drafts only from the requested workspace', () => {
+		globalDraftStore.setDraft(WORKSPACE_A, {
+			type: 'script',
+			path: 'f/shared/path',
+			language: 'bun',
+			value: 'export async function main() {}',
+			isDraft: true
+		})
+
+		expect(globalDraftStore.getDraft(WORKSPACE_A, 'script', 'f/shared/path')?.value).toBe(
+			'export async function main() {}'
+		)
+		expect(globalDraftStore.getDraft(WORKSPACE_B, 'script', 'f/shared/path')).toBeUndefined()
+		expect(globalDraftStore.listDrafts(WORKSPACE_A)).toHaveLength(1)
+		expect(globalDraftStore.listDrafts(WORKSPACE_B)).toHaveLength(0)
+	})
+
+	it('deletes and clears drafts only from the requested workspace', () => {
+		globalDraftStore.setDraft(WORKSPACE_A, {
+			type: 'flow',
+			path: 'f/shared/path',
+			value: { value: { modules: [] }, schema: null, groups: null },
+			isDraft: true
+		})
+		globalDraftStore.setDraft(WORKSPACE_B, {
+			type: 'flow',
+			path: 'f/shared/path',
+			value: { value: { modules: [] }, schema: { workspace: WORKSPACE_B }, groups: null },
+			isDraft: true
+		})
+
+		globalDraftStore.deleteDraft(WORKSPACE_A, 'flow', 'f/shared/path')
+
+		expect(globalDraftStore.getDraft(WORKSPACE_A, 'flow', 'f/shared/path')).toBeUndefined()
+		expect(globalDraftStore.getDraft(WORKSPACE_B, 'flow', 'f/shared/path')).toBeDefined()
+
+		globalDraftStore.clearDrafts(WORKSPACE_B)
+
+		expect(globalDraftStore.listDrafts(WORKSPACE_A)).toHaveLength(0)
+		expect(globalDraftStore.listDrafts(WORKSPACE_B)).toHaveLength(0)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/global/gate.ts b/frontend/src/lib/components/copilot/chat/global/gate.ts
new file mode 100644
index 0000000000..664f06ff39
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/gate.ts
@@ -0,0 +1,26 @@
+/**
+ * Dev-only gate for the Global AI chat mode.
+ *
+ * While the mode is being iterated on, it should not be visible to regular
+ * users. Developers/QA enable it in their browser with:
+ *
+ *     localStorage.setItem('wm_dev_global_ai', '1')
+ *
+ * and reload the page. To disable, remove the key or set it to anything else.
+ *
+ * When the mode is ready to ship to everyone, replace every call to
+ * `isGlobalAiEnabled()` with `true` and delete this file. The references are
+ * intentionally narrow (chat mode visibility, custom prompt settings, the
+ * `change_mode` tool enum, and the `/global_drafts` dev route) so the rip-out
+ * is a small grep.
+ */
+const STORAGE_KEY = 'wm_dev_global_ai'
+
+export function isGlobalAiEnabled(): boolean {
+	if (typeof localStorage === 'undefined') return false
+	try {
+		return localStorage.getItem(STORAGE_KEY) === '1'
+	} catch {
+		return false
+	}
+}
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index 59eba6a834..d29f9fc0ee 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -239,6 +239,59 @@ export interface ContextStringResult {
 	hasFlowModule: boolean
 }
 
+/** Count exact occurrences of `search` in `content`. */
+export function countExactMatches(content: string, search: string): number {
+	if (search.length === 0) return 0
+	let count = 0
+	let index = 0
+	while ((index = content.indexOf(search, index)) !== -1) {
+		count++
+		index += search.length
+	}
+	return count
+}
+
+/**
+ * Replace exact occurrences of `oldString` with `newString` in `content`.
+ * When `replaceAll` is false, only the first match is replaced. Returns the
+ * original string unchanged when no match is found.
+ */
+export function applyExactReplace(
+	content: string,
+	oldString: string,
+	newString: string,
+	replaceAll: boolean
+): string {
+	if (replaceAll) return content.split(oldString).join(newString)
+	const index = content.indexOf(oldString)
+	if (index === -1) return content
+	return content.slice(0, index) + newString + content.slice(index + oldString.length)
+}
+
+/**
+ * Match-count-validated exact text replacement. Throws when `oldString` is
+ * missing, and (unless `replaceAll`) when it appears more than once.
+ * `contextLabel` flows into the error message ("not found in the <label>.").
+ */
+export function findAndReplace(
+	content: string,
+	oldString: string,
+	newString: string,
+	replaceAll: boolean,
+	contextLabel: string
+): string {
+	const matchCount = countExactMatches(content, oldString)
+	if (matchCount === 0) {
+		throw new Error(`old_string was not found in the ${contextLabel}.`)
+	}
+	if (!replaceAll && matchCount !== 1) {
+		throw new Error(
+			`old_string matched ${matchCount} locations. Make it more specific or set replace_all to true.`
+		)
+	}
+	return applyExactReplace(content, oldString, newString, replaceAll)
+}
+
 export const extractAllModules = (modules: FlowModule[]): FlowModule[] => {
 	return modules.flatMap((m) => {
 		if (m.value.type === 'forloopflow' || m.value.type === 'whileloopflow') {
@@ -424,9 +477,9 @@ export type CreatedResourceAction = {
 	id: string
 	type: 'open_created_resource'
 	label: string
-	resource: 'schedule' | 'trigger'
+	resource: 'schedule' | 'trigger' | 'resource' | 'variable'
 	path: string
-	targetKind: 'script' | 'flow'
+	targetKind?: 'script' | 'flow'
 	triggerKind?: CreatedResourceTriggerKind
 }
 
diff --git a/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts b/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
index 8d8cce2482..d989412bb1 100644
--- a/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
+++ b/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
@@ -397,6 +397,27 @@ export const azureTriggerRequestSchema = z.object({
 	"labels": z.array(z.string()).optional()
 }).describe("Data for creating or updating an Azure Event Grid trigger.")
 
+export const variableRequestSchema = z.object({
+	"path": z.string().describe("The path to the variable"),
+	"value": z.string().describe("The value of the variable"),
+	"is_secret": z.boolean().describe("Whether the variable is a secret"),
+	"description": z.string().describe("The description of the variable"),
+	"account": z.number().int().describe("The account identifier").optional(),
+	"is_oauth": z.boolean().describe("Whether the variable is an OAuth variable").optional(),
+	"expires_at": z.string().datetime({ offset: true }).describe("The expiration date of the variable").optional(),
+	"labels": z.array(z.string()).optional(),
+	"ws_specific": z.boolean().optional()
+})
+
+export const resourceRequestSchema = z.object({
+	"path": z.string().describe("The path to the resource"),
+	"value": z.any(),
+	"description": z.string().describe("The description of the resource").optional(),
+	"resource_type": z.string().describe("The resource_type associated with the resource"),
+	"labels": z.array(z.string()).optional(),
+	"ws_specific": z.boolean().optional()
+})
+
 export const triggerRequestSchemas = {
 	http: httpTriggerRequestSchema,
 	websocket: websocketTriggerRequestSchema,
diff --git a/frontend/src/lib/components/flow_builder.ts b/frontend/src/lib/components/flow_builder.ts
index d847664fa7..427fb9a9fd 100644
--- a/frontend/src/lib/components/flow_builder.ts
+++ b/frontend/src/lib/components/flow_builder.ts
@@ -6,46 +6,48 @@ import type { DiffDrawerI } from './diff_drawer'
 import type { FlowBuilderWhitelabelCustomUi } from './custom_ui'
 import type { ScheduleTrigger } from './triggers'
 import type { stepState } from './stepHistoryLoader.svelte'
+import type { WorkspaceItem } from './workspacePicker'
 
 export type FlowBuilderProps = {
-    initialPath?: string
-    pathStoreInit?: string | undefined
-    newFlow: boolean
-    selectedId: string | undefined
-    initialArgs?: Record<string, any>
-    loading?: boolean
-    flowStore: StateStore<OpenFlow>
-    flowStateStore: StateStore<FlowState>
-    savedFlow?: FlowWithDraftAndDraftTriggers | undefined
-    diffDrawer?: DiffDrawerI | undefined
-    customUi?: FlowBuilderWhitelabelCustomUi
-    disableAi?: boolean
-    disabledFlowInputs?: boolean
-    savedPrimarySchedule?: ScheduleTrigger | undefined // used to set the primary schedule in the legacy primaryScheduleStore
-    version?: number | undefined
-    setSavedraftCb?: ((cb: () => void) => void) | undefined
-    draftTriggersFromUrl?: Trigger[] | undefined
-    selectedTriggerIndexFromUrl?: number | undefined
-    children?: import('svelte').Snippet
-    loadedFromHistoryFromUrl?: {
-        flowJobInitial: boolean | undefined
-        stepsState: Record<string, stepState>
-    }
-    noInitial?: boolean
-    onSaveInitial?: ({ path, id }: { path: string; id: string }) => void
-    onSaveDraft?: ({
-        path,
-        savedAtNewPath,
-        newFlow
-    }: {
-        path: string
-        savedAtNewPath: boolean
-        newFlow: boolean
-    }) => void
-    onSaveDraftError?: ({ error }: { error: any }) => void
-    onSaveDraftOnlyAtNewPath?: ({ path, selectedId }: { path: string; selectedId: string }) => void
-    onDeploy?: ({ path }: { path: string }) => void
-    onDeployError?: ({ error }: { error: any }) => void
-    onDetails?: ({ path }: { path: string }) => void
-    onHistoryRestore?: () => void
+	initialPath?: string
+	pathStoreInit?: string | undefined
+	newFlow: boolean
+	selectedId: string | undefined
+	initialArgs?: Record<string, any>
+	loading?: boolean
+	flowStore: StateStore<OpenFlow>
+	flowStateStore: StateStore<FlowState>
+	savedFlow?: FlowWithDraftAndDraftTriggers | undefined
+	diffDrawer?: DiffDrawerI | undefined
+	customUi?: FlowBuilderWhitelabelCustomUi
+	disableAi?: boolean
+	disabledFlowInputs?: boolean
+	savedPrimarySchedule?: ScheduleTrigger | undefined // used to set the primary schedule in the legacy primaryScheduleStore
+	version?: number | undefined
+	setSavedraftCb?: ((cb: () => void) => void) | undefined
+	draftTriggersFromUrl?: Trigger[] | undefined
+	selectedTriggerIndexFromUrl?: number | undefined
+	children?: import('svelte').Snippet
+	loadedFromHistoryFromUrl?: {
+		flowJobInitial: boolean | undefined
+		stepsState: Record<string, stepState>
+	}
+	noInitial?: boolean
+	onSaveInitial?: ({ path, id }: { path: string; id: string }) => void
+	onSaveDraft?: ({
+		path,
+		savedAtNewPath,
+		newFlow
+	}: {
+		path: string
+		savedAtNewPath: boolean
+		newFlow: boolean
+	}) => void
+	onSaveDraftError?: ({ error }: { error: any }) => void
+	onSaveDraftOnlyAtNewPath?: ({ path, selectedId }: { path: string; selectedId: string }) => void
+	onDeploy?: ({ path }: { path: string }) => void
+	onDeployError?: ({ error }: { error: any }) => void
+	onDetails?: ({ path }: { path: string }) => void
+	onHistoryRestore?: () => void
+	onNavigate?: (item: WorkspaceItem) => void
 }
diff --git a/frontend/src/lib/components/flows/content/FlowSettings.svelte b/frontend/src/lib/components/flows/content/FlowSettings.svelte
index 353c9ba563..3c6b268e00 100644
--- a/frontend/src/lib/components/flows/content/FlowSettings.svelte
+++ b/frontend/src/lib/components/flows/content/FlowSettings.svelte
@@ -139,6 +139,14 @@
 							namePlaceholder="flow"
 							kind="flow"
 						/>
+						{#if $initialPathStore && $pathStore && $pathStore !== $initialPathStore}
+							<Alert
+								type="info"
+								size="xs"
+								title="Deploy the flow to make the path change effective."
+								class="mt-2"
+							/>
+						{/if}
 					</Label>
 				{/if}
 
diff --git a/frontend/src/lib/components/flows/idUtils.ts b/frontend/src/lib/components/flows/idUtils.ts
index bb82c278a1..db3e496c54 100644
--- a/frontend/src/lib/components/flows/idUtils.ts
+++ b/frontend/src/lib/components/flows/idUtils.ts
@@ -14,7 +14,10 @@ export const forbiddenIds: string[] = [
 	'in',
 	'failure',
 	'preprocessor',
-	'as'
+	'as',
+	'Input',
+	'Result',
+	'Trigger'
 ]
 
 export function numberToChars(n: number) {
diff --git a/frontend/src/lib/components/flows/stepsInputArgs.svelte.ts b/frontend/src/lib/components/flows/stepsInputArgs.svelte.ts
index 025bca1bfe..06a4972ee5 100644
--- a/frontend/src/lib/components/flows/stepsInputArgs.svelte.ts
+++ b/frontend/src/lib/components/flows/stepsInputArgs.svelte.ts
@@ -4,10 +4,10 @@ import {
 	dfs,
 	getPreviousModule,
 	getStepPropPicker,
-	type PickableProperties
+	type PickableProperties,
+	getFailureStepPropPicker
 } from './previousResults'
 import { evalValue } from './utils.svelte'
-
 export class StepsInputArgs {
 	#stepsEvaluated = $state<Record<string, Record<string, any>>>({})
 	#steps = $state<Record<string, Record<string, any>>>({})
@@ -158,6 +158,15 @@ export class StepsInputArgs {
 		flow: OpenFlow | undefined,
 		previewArgs: Record<string, any> | undefined
 	) {
+		if (id === 'failure' && flow && flow.value.failure_module && flowState) {
+			const picker = getFailureStepPropPicker(flowState, flow, previewArgs)
+			this.initializeFromSchema(
+				flow.value.failure_module,
+				flowState['failure']?.schema ?? {},
+				picker.pickableProperties
+			)
+			return
+		}
 		if (!flowState || !flow) {
 			return
 		}
diff --git a/frontend/src/lib/components/icons/BarsStaggered.svelte b/frontend/src/lib/components/icons/BarsStaggered.svelte
index dbfebdeb1d..eedc72de8a 100644
--- a/frontend/src/lib/components/icons/BarsStaggered.svelte
+++ b/frontend/src/lib/components/icons/BarsStaggered.svelte
@@ -1,18 +1,18 @@
 <script lang="ts">
 	interface Props {
-		size?: number;
-		style?: string;
-		class?: string;
+		size?: number
+		style?: string
+		class?: string
 	}
 
-	let { size = 16, style = 'fill: white;', class: clazz = '' }: Props = $props();
-	
+	let { size = 16, style = 'fill: white;', class: clazz = '' }: Props = $props()
 </script>
 
 <svg
 	xmlns="http://www.w3.org/2000/svg"
 	height={`${size}px`}
-	viewBox="0 0 512 512"
+	width={`${size}px`}
+	viewBox="-64 -64 640 640"
 	class={clazz}
 	{style}
 >
diff --git a/frontend/src/lib/components/instanceSettings/SecretBackendConfig.svelte b/frontend/src/lib/components/instanceSettings/SecretBackendConfig.svelte
index 15db633264..a313a0fbc4 100644
--- a/frontend/src/lib/components/instanceSettings/SecretBackendConfig.svelte
+++ b/frontend/src/lib/components/instanceSettings/SecretBackendConfig.svelte
@@ -70,6 +70,7 @@
 				address: $values['secret_backend']?.address ?? '',
 				mount_path: $values['secret_backend']?.mount_path ?? 'windmill',
 				jwt_role: $values['secret_backend']?.jwt_role ?? 'windmill-secrets',
+				jwt_mount_path: $values['secret_backend']?.jwt_mount_path ?? null,
 				namespace: $values['secret_backend']?.namespace ?? null,
 				token: $values['secret_backend']?.token ?? null,
 				skip_ssl_verify: $values['secret_backend']?.skip_ssl_verify ?? false
@@ -122,6 +123,7 @@
 			address: $values['secret_backend'].address,
 			mount_path: $values['secret_backend'].mount_path,
 			jwt_role: $values['secret_backend'].jwt_role,
+			jwt_mount_path: $values['secret_backend'].jwt_mount_path || undefined,
 			namespace: $values['secret_backend'].namespace || undefined,
 			token: $values['secret_backend'].token || undefined,
 			skip_ssl_verify: $values['secret_backend'].skip_ssl_verify || undefined
@@ -352,6 +354,10 @@
 	}
 
 	let baseUrl = $derived($values['base_url'] ?? 'https://your-windmill-instance.com')
+	let jwtMount = $derived(($values['secret_backend']?.jwt_mount_path?.trim() || 'jwt') as string)
+	let vaultAudience = $derived(
+		($values['secret_backend']?.address?.trim() || 'https://vault.example.com:8200') as string
+	)
 </script>
 
 <div class="space-y-6">
@@ -500,6 +506,24 @@
 							}}
 							bind:value={$values['secret_backend'].jwt_role}
 						/>
+						<label for="vault_jwt_mount_path" class="block text-xs font-semibold text-emphasis"
+							>JWT Auth Mount Path (optional)</label
+						>
+						<span class="text-2xs text-secondary"
+							>Mount path of the JWT auth method in Vault. Defaults to <code>jwt</code>. Set this
+							only if you mounted the JWT auth method at a non-default path (<code
+								>vault auth enable -path=&lt;mount&gt; jwt</code
+							>).</span
+						>
+						<TextInput
+							inputProps={{
+								type: 'text',
+								id: 'vault_jwt_mount_path',
+								placeholder: 'jwt',
+								disabled
+							}}
+							bind:value={$values['secret_backend'].jwt_mount_path}
+						/>
 						<details class="mt-2">
 							<summary class="text-xs font-medium text-secondary cursor-pointer hover:text-primary"
 								>Vault JWT Setup Instructions</summary
@@ -510,29 +534,32 @@
 									class="bg-gray-100 dark:bg-gray-800 p-2 rounded font-mono text-2xs overflow-x-auto"
 								>
 									<pre
-										># Enable JWT auth method
-vault auth enable jwt
+										># Enable JWT auth method{jwtMount === 'jwt'
+											? ''
+											: ` at custom mount '${jwtMount}'`}
+vault auth enable {jwtMount === 'jwt' ? 'jwt' : `-path=${jwtMount} jwt`}
 
 # Configure JWT auth with Windmill's JWKS endpoint
-vault write auth/jwt/config \
-  jwks_url="{baseUrl}/.well-known/jwks.json" \
-  bound_issuer="{baseUrl}"
+vault write auth/{jwtMount}/config \
+  jwks_url="{baseUrl}/api/oidc/jwks" \
+  bound_issuer="{baseUrl}/api/oidc/"
 
 # Create a policy for Windmill secrets
 vault policy write windmill-secrets - &lt;&lt;EOF
-path "windmill/data/*" &#123;
+path "{$values['secret_backend']?.mount_path ?? 'windmill'}/data/*" &#123;
   capabilities = ["create", "read", "update", "delete"]
 &#125;
-path "windmill/metadata/*" &#123;
+path "{$values['secret_backend']?.mount_path ?? 'windmill'}/metadata/*" &#123;
   capabilities = ["list", "delete"]
 &#125;
 EOF
 
-# Create the JWT role
-vault write auth/jwt/role/windmill-secrets \
+# Create the JWT role. bound_audiences must match the Vault server
+# address — Windmill signs the JWT with `aud` = your Vault address.
+vault write auth/{jwtMount}/role/{$values['secret_backend']?.jwt_role || 'windmill-secrets'} \
   role_type="jwt" \
-  bound_audiences="{baseUrl}" \
-  user_claim="email" \
+  bound_audiences="{vaultAudience}" \
+  user_claim="sub" \
   policies="windmill-secrets" \
   ttl="1h"</pre
 									>
diff --git a/frontend/src/lib/components/meltComponents/Popover.svelte b/frontend/src/lib/components/meltComponents/Popover.svelte
index a88d90c7ff..87d5ff3f83 100644
--- a/frontend/src/lib/components/meltComponents/Popover.svelte
+++ b/frontend/src/lib/components/meltComponents/Popover.svelte
@@ -52,6 +52,9 @@
 		closeOnOtherPopoverOpen?: boolean
 		allowFullScreen?: boolean
 		extraProps?: Record<string, any>
+		/** Attributes spread onto the trigger button. Use for `aria-label`,
+		 * `aria-current`, etc. — overrides the default `aria-label="Popup button"`. */
+		triggerAttrs?: Record<string, any>
 		disabled?: boolean
 		documentationLink?: string | undefined
 		disableFocusTrap?: boolean
@@ -90,6 +93,7 @@
 		closeOnOtherPopoverOpen = false,
 		allowFullScreen = false,
 		extraProps = {},
+		triggerAttrs = {},
 		disabled = false,
 		documentationLink = undefined,
 		disableFocusTrap = false,
@@ -219,6 +223,7 @@
 	class={className}
 	use:melt={$_trigger}
 	aria-label="Popup button"
+	{...triggerAttrs}
 	disabled={disablePopup || disabled}
 	onmouseenter={() => {
 		if (openOnHover) {
diff --git a/frontend/src/lib/components/propertyPicker/ObjectViewer.svelte b/frontend/src/lib/components/propertyPicker/ObjectViewer.svelte
index f024b73eda..9746991d6b 100644
--- a/frontend/src/lib/components/propertyPicker/ObjectViewer.svelte
+++ b/frontend/src/lib/components/propertyPicker/ObjectViewer.svelte
@@ -2,6 +2,7 @@
 	import ObjectViewer from './ObjectViewer.svelte'
 
 	import { copyToClipboard, truncate } from '$lib/utils'
+	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 
 	import {
 		createEventDispatcher,
@@ -407,15 +408,28 @@
 					<div class="flex">
 						<span class="text-primary">{closeBracket}</span>
 						{#if getTypeAsString(jsonFiltered) === 's3object'}
-							<a
-								class="text-secondary underline font-semibold text-2xs whitespace-nowrap ml-1 w-fit"
-								href={`/api/w/${$workspaceStore}/job_helpers/download_s3_file?file_key=${encodeURIComponent(
-									jsonFiltered?.s3 ?? ''
-								)}${jsonFiltered?.storage ? `&storage=${jsonFiltered.storage}` : ''}`}
-								download={jsonFiltered?.s3.split('/').pop() ?? 'unnamed_download.file'}
-							>
-								<span class="flex items-center gap-1"><Download size={12} />download</span>
-							</a>
+							{@const s3DownloadApiPath = `/w/${$workspaceStore}/job_helpers/download_s3_file?file_key=${encodeURIComponent(jsonFiltered?.s3 ?? '')}${jsonFiltered?.storage ? `&storage=${jsonFiltered.storage}` : ''}`}
+							{@const s3DownloadName = jsonFiltered?.s3.split('/').pop() ?? 'unnamed_download.file'}
+							{#if shouldDownloadViaClient()}
+								<button
+									class="text-secondary underline font-semibold text-2xs whitespace-nowrap ml-1 w-fit"
+									onclick={() => downloadViaClient(s3DownloadApiPath, s3DownloadName)}
+								>
+									<span class="flex items-center gap-1"
+										><Download size={12} />download</span
+									>
+								</button>
+							{:else}
+								<a
+									class="text-secondary underline font-semibold text-2xs whitespace-nowrap ml-1 w-fit"
+									href={`/api${s3DownloadApiPath}`}
+									download={s3DownloadName}
+								>
+									<span class="flex items-center gap-1"
+										><Download size={12} />download</span
+									>
+								</a>
+							{/if}
 							<button
 								class="text-secondary underline text-2xs whitespace-nowrap ml-1"
 								onclick={() => {
diff --git a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
index 8a8334bbd6..3239e313f1 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
@@ -917,7 +917,7 @@
 		onApply={handleYamlApply}
 	/>
 
-	<Splitpanes id="o2" class="grow min-h-0">
+	<Splitpanes id="o2" class="grow min-h-0 border-t">
 		<Pane bind:size={sidebarPanelSize} maxSize={20} class="h-full overflow-y-auto">
 			<RawAppSidebar
 				bind:files={
diff --git a/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte b/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
index b0a441d6d9..7a880dbfa4 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
@@ -1,7 +1,8 @@
 <script lang="ts">
-	import { Badge, Drawer, DrawerContent } from '$lib/components/common'
+	import { Drawer, DrawerContent } from '$lib/components/common'
 	import Button from '$lib/components/common/button/Button.svelte'
-	import UndoRedo from '$lib/components/common/button/UndoRedo.svelte'
+	import { isMac, userPathPrefix } from '$lib/utils'
+	import { editPathFor, invalidate as invalidatePicker } from '$lib/components/workspacePicker'
 
 	import { AppService, DraftService, type Policy } from '$lib/gen'
 	import { UserDraft } from '$lib/userDraft.svelte'
@@ -16,18 +17,19 @@
 		FileJson,
 		Globe,
 		History,
-		Pen,
+		Redo,
 		Save,
+		Undo,
 		WandSparkles
 	} from 'lucide-svelte'
-	import { createEventDispatcher } from 'svelte'
+	import { createEventDispatcher, untrack } from 'svelte'
 	import {
 		cleanValueProperties,
 		orderedJsonStringify,
 		type Value,
-		replaceFalseWithUndefined,
-		defaultIfEmptyString
+		replaceFalseWithUndefined
 	} from '../../utils'
+	import { random_adj } from '$lib/components/random_positive_adjetive'
 
 	// import {  allItems, toStatic } from '../apps/editor/settingsPanel/utils'
 	import AppExportButton from '../apps/editor/AppExportButton.svelte'
@@ -38,7 +40,8 @@
 	import Awareness from '$lib/components/Awareness.svelte'
 	import type DiffDrawer from '$lib/components/DiffDrawer.svelte'
 
-	import Summary from '$lib/components/Summary.svelte'
+	import EditorHeader from '$lib/components/EditorHeader.svelte'
+	import { goto } from '$app/navigation'
 	import DeployOverrideConfirmationModal from '$lib/components/common/confirmationModal/DeployOverrideConfirmationModal.svelte'
 
 	import AppJobsDrawer from '../apps/editor/AppJobsDrawer.svelte'
@@ -131,7 +134,13 @@
 		onOpenYamlEditor = undefined
 	}: Props = $props()
 
-	let newEditedPath = $state('')
+	let newEditedPath = $state(
+		untrack(() =>
+			newApp
+				? userPathPrefix($userStore?.username) + random_adj() + '_app'
+				: newPath || appPath || ''
+		)
+	)
 
 	let deployedValue: Value | undefined = $state(undefined) // Value to diff against
 	let deployedBy: string | undefined = $state(undefined) // Author
@@ -329,6 +338,7 @@
 				css
 			}
 		})
+		invalidatePicker($workspaceStore!, 'app')
 		savedApp = {
 			summary: summary,
 			value: structuredClone(stateSnapshot(app)),
@@ -554,7 +564,24 @@
 		}
 	}
 
-	let moreItems = [
+	const mod = isMac() ? '⌘' : 'Ctrl+'
+
+	let moreItems = $derived([
+		{
+			displayName: 'Undo',
+			icon: Undo,
+			action: () => onUndo?.(),
+			disabled: !canUndo,
+			shortcut: `${mod}Z`
+		},
+		{
+			displayName: 'Redo',
+			icon: Redo,
+			action: () => onRedo?.(),
+			disabled: !canRedo,
+			shortcut: `${mod}⇧Z`,
+			separatorBottom: true
+		},
 		{
 			displayName: 'Deployment history',
 			icon: History,
@@ -609,7 +636,7 @@
 			},
 			disabled: !savedApp
 		}
-	]
+	])
 
 	const dispatch = createEventDispatcher()
 
@@ -816,52 +843,20 @@
 />
 
 <div
-	class="border-b flex flex-row justify-between py-1 gap-2 gap-y-2 px-2 items-center overflow-y-visible overflow-x-auto min-h-10 shrink-0"
+	class="flex flex-row justify-between gap-2 gap-y-2 px-2 items-center overflow-y-visible overflow-x-auto max-h-12 h-12 shrink-0"
 >
 	<div class="flex flex-row gap-2 items-center">
-		<Summary bind:value={summary} />
-		<div></div>
-		<UndoRedo
-			undoProps={{ disabled: !canUndo }}
-			redoProps={{ disabled: !canRedo }}
-			on:undo={() => onUndo?.()}
-			on:redo={() => onRedo?.()}
+		<EditorHeader
+			bind:summary
+			bind:path={newEditedPath}
+			savedPath={appPath || newPath || undefined}
+			kind="app"
+			raw_app
+			onNavigate={(item) => goto(editPathFor(item))}
 		/>
+		<div></div>
 	</div>
 
-	<div class=" flex">
-		{#if newPath || newEditedPath}
-			<div class="flex justify-start w-full border rounded-md overflow-hidden">
-				<div>
-					<button
-						onclick={async () => {
-							saveDrawerOpen = true
-							setTimeout(() => {
-								document.getElementById('path')?.focus()
-							}, 100)
-						}}
-					>
-						<Badge
-							color="gray"
-							class="center-center !bg-surface-secondary !text-primary !h-[28px]  !w-[70px] rounded-none hover:!bg-surface-hover transition-all flex gap-1"
-						>
-							<Pen size={14} />Path
-						</Badge>
-					</button>
-				</div>
-				<input
-					type="text"
-					readonly
-					value={defaultIfEmptyString(newEditedPath, newPath)}
-					size={defaultIfEmptyString(newEditedPath, newPath)?.length || 50}
-					class="font-mono !text-xs !min-w-[96px] !max-w-[300px] !w-full !h-[28px] !my-0 !py-0 !border-l-0 !rounded-l-none !border-0 !shadow-none"
-					onfocus={({ currentTarget }) => {
-						currentTarget.select()
-					}}
-				/>
-			</div>
-		{/if}
-	</div>
 	{#if $enterpriseLicense && appPath != ''}
 		<Awareness />
 	{/if}
diff --git a/frontend/src/routes/(root)/(logged)/apps_raw/add/templates.ts b/frontend/src/lib/components/raw_apps/templates.ts
similarity index 93%
rename from frontend/src/routes/(root)/(logged)/apps_raw/add/templates.ts
rename to frontend/src/lib/components/raw_apps/templates.ts
index 71225f9ce1..335ae4d8e8 100644
--- a/frontend/src/routes/(root)/(logged)/apps_raw/add/templates.ts
+++ b/frontend/src/lib/components/raw_apps/templates.ts
@@ -136,7 +136,7 @@ export const svelte5Template = {
 	'/index.css': indexCss,
 	'/package.json': `{
     "dependencies": {
-        "svelte": "5.45.2",
+        "svelte": "^5.55.5",
         "windmill-client": "^1"
     }
 }`
@@ -154,6 +154,43 @@ export const vueTemplate = {
 }`
 }
 
+export const FRAMEWORK_TEMPLATES = {
+	react19: react19Template,
+	react18: react18Template,
+	svelte5: svelte5Template,
+	vue: vueTemplate
+}
+
+export type FrameworkKey = keyof typeof FRAMEWORK_TEMPLATES
+
+export const STARTER_RUNNABLE_KEY = 'a'
+
+// Matches the starter runnable that the apps_raw/add page seeds, so the
+// React/Svelte demo button (`backend.a({ x: 42 })`) works on first render.
+export const STARTER_RUNNABLE = {
+	name: 'a',
+	fields: {},
+	type: 'inline',
+	inlineScript: {
+		content:
+			'// import * as wmill from "windmill-client"\n\nexport async function main(x: string) {\n  return x\n}\n',
+		language: 'bun',
+		schema: {
+			$schema: 'https://json-schema.org/draft/2020-12/schema',
+			properties: {
+				x: {
+					default: null,
+					description: '',
+					originalType: 'string',
+					type: 'string'
+				}
+			},
+			required: ['x'],
+			type: 'object'
+		}
+	}
+}
+
 export const appVueRouter = `
 <template>
   <div class="container">
diff --git a/frontend/src/lib/components/runs/useJobsLoader.svelte.ts b/frontend/src/lib/components/runs/useJobsLoader.svelte.ts
index b75355a6cb..e7d8337708 100644
--- a/frontend/src/lib/components/runs/useJobsLoader.svelte.ts
+++ b/frontend/src/lib/components/runs/useJobsLoader.svelte.ts
@@ -53,6 +53,7 @@ export interface UseJobLoaderArgs {
 	skip?: boolean
 	lookback?: number
 	perPage?: number
+	excludesEntrypointOverride?: boolean
 }
 
 export function useJobsLoader(args: () => UseJobLoaderArgs) {
@@ -69,6 +70,7 @@ export function useJobsLoader(args: () => UseJobLoaderArgs) {
 	let lookback = $derived(_args.lookback ?? 0)
 	let timeframe = $derived(_args?.timeframe)
 	let perPage = $derived(_args?.perPage ?? 1000)
+	let excludesEntrypointOverride = $derived(_args.excludesEntrypointOverride ?? false)
 
 	let label = $derived(filters?.label ?? null)
 	let worker = $derived(filters?.worker ?? null)
@@ -274,7 +276,8 @@ export function useJobsLoader(args: () => UseJobLoaderArgs) {
 			allWorkspaces: allWorkspaces ? true : undefined,
 			perPage: perPageOverride ?? perPage,
 			allowWildcards: allowWildcards ? true : undefined,
-			broadFilter
+			broadFilter,
+			excludesEntrypointOverride: excludesEntrypointOverride ? true : undefined
 		})
 		promise = CancelablePromiseUtils.catchErr(promise, (e) => {
 			if (e instanceof CancelError) return CancelablePromiseUtils.err(e)
diff --git a/frontend/src/lib/components/scriptEditor/LogPanel.svelte b/frontend/src/lib/components/scriptEditor/LogPanel.svelte
index 82845c4a88..1f31d7f12d 100644
--- a/frontend/src/lib/components/scriptEditor/LogPanel.svelte
+++ b/frontend/src/lib/components/scriptEditor/LogPanel.svelte
@@ -49,6 +49,7 @@
 		capturesTab?: import('svelte').Snippet
 		customResultPanel?: import('svelte').Snippet
 		showCustomResultPanel?: boolean
+		onTabChange?: (tab: string) => void
 	}
 
 	let {
@@ -65,7 +66,8 @@
 		children,
 		capturesTab,
 		customResultPanel,
-		showCustomResultPanel = false
+		showCustomResultPanel = false,
+		onTabChange
 	}: Props = $props()
 
 	type DContent = {
@@ -78,6 +80,10 @@
 	let drawerOpen: boolean = $state(false)
 	let drawerContent: DContent | undefined = $state(undefined)
 
+	$effect(() => {
+		onTabChange?.(selectedTab)
+	})
+
 	export function setFocusToLogs() {
 		selectedTab = 'logs'
 	}
diff --git a/frontend/src/lib/components/script_builder.ts b/frontend/src/lib/components/script_builder.ts
index 6c71dbddbf..c810003b38 100644
--- a/frontend/src/lib/components/script_builder.ts
+++ b/frontend/src/lib/components/script_builder.ts
@@ -5,6 +5,7 @@ import type { DiffDrawerI } from './diff_drawer'
 import type { ScriptBuilderFunctionExports } from './scriptBuilder'
 import type { ScheduleTrigger } from './triggers'
 import type { NewScriptWithDraftAndDraftTriggers, Trigger } from './triggers/utils'
+import type { WorkspaceItem } from './workspacePicker'
 
 export interface ScriptBuilderProps {
 	script: NewScript & {
@@ -43,4 +44,5 @@ export interface ScriptBuilderProps {
 	onSaveDraft?: (e: { path: string; savedAtNewPath: boolean; script: NewScript }) => void
 	onSeeDetails?: (e: { path: string }) => void
 	onSaveDraftError?: (e: { path: string; error: any }) => void
+	onNavigate?: (item: WorkspaceItem) => void
 }
diff --git a/frontend/src/lib/components/settings/AIPromptsModal.svelte b/frontend/src/lib/components/settings/AIPromptsModal.svelte
index b9c126d19c..a6630b89b1 100644
--- a/frontend/src/lib/components/settings/AIPromptsModal.svelte
+++ b/frontend/src/lib/components/settings/AIPromptsModal.svelte
@@ -3,7 +3,7 @@
 	import Button from '../common/button/Button.svelte'
 	import Label from '../Label.svelte'
 	import TextInput from '../text_input/TextInput.svelte'
-	import { AIMode } from '../copilot/chat/AIChatManager.svelte'
+	import { AIMode, getVisibleAIModes } from '../copilot/chat/AIChatManager.svelte'
 
 	const MAX_CUSTOM_PROMPT_LENGTH = 5000
 
@@ -31,6 +31,7 @@
 		[AIMode.APP]: 'Enter custom instructions for UI and app development',
 		[AIMode.NAVIGATOR]: 'Enter custom instructions for navigation and guidance',
 		[AIMode.API]: 'Enter custom instructions for API interactions and integrations',
+		[AIMode.GLOBAL]: 'Enter custom instructions for workspace-wide draft assistance',
 		[AIMode.ASK]: 'Enter custom instructions for general questions and assistance'
 	}
 
@@ -40,9 +41,12 @@
 		[AIMode.APP]: 'App Mode',
 		[AIMode.NAVIGATOR]: 'Navigator Mode',
 		[AIMode.API]: 'API Mode',
+		[AIMode.GLOBAL]: 'Global Mode',
 		[AIMode.ASK]: 'Ask Mode'
 	}
 
+	let visibleModes = $derived(getVisibleAIModes())
+
 	function handleSave() {
 		onSave?.()
 		open = false
@@ -75,7 +79,7 @@
 				{/if}
 			</div>
 
-			{#each Object.values(AIMode) as mode}
+			{#each visibleModes as mode (mode)}
 				<div class="flex flex-col gap-2 pb-4 last:border-b-0">
 					<Label label={modeLabels[mode]} for={`custom-prompt-${mode}`}>
 						<TextInput
diff --git a/frontend/src/lib/components/settings/WorkspaceOperatorSettings.svelte b/frontend/src/lib/components/settings/WorkspaceOperatorSettings.svelte
index 6aaa69cc53..ba8f42cba7 100644
--- a/frontend/src/lib/components/settings/WorkspaceOperatorSettings.svelte
+++ b/frontend/src/lib/components/settings/WorkspaceOperatorSettings.svelte
@@ -17,7 +17,7 @@
 		schedules: true,
 		resources: true,
 		variables: true,
-		assets: false,
+		assets: true,
 		triggers: true,
 		audit_logs: true,
 		groups: true,
diff --git a/frontend/src/lib/components/sidebar/SidebarContent.svelte b/frontend/src/lib/components/sidebar/SidebarContent.svelte
index 24817571c8..f95d242657 100644
--- a/frontend/src/lib/components/sidebar/SidebarContent.svelte
+++ b/frontend/src/lib/components/sidebar/SidebarContent.svelte
@@ -4,6 +4,7 @@
 		superadmin,
 		usedTriggerKinds,
 		userStore,
+		userWorkspaces,
 		workspaceStore,
 		isCriticalAlertsUIOpen,
 		enterpriseLicense,
@@ -11,6 +12,7 @@
 		tutorialsToDo,
 		skippedAll
 	} from '$lib/stores'
+	import { findWorkspaceDescendants } from '$lib/utils/workspaceHierarchy'
 	import { syncTutorialsTodos } from '$lib/tutorialUtils'
 	import { SIDEBAR_SHOW_SCHEDULES } from '$lib/consts'
 	import {
@@ -123,12 +125,28 @@
 			}
 		}
 
+		if (deleteForkedChildren && forkedDescendants.length > 0) {
+			for (const child of forkedDescendants) {
+				try {
+					await WorkspaceService.deleteWorkspace({ workspace: child.id })
+				} catch (err) {
+					sendUserToast(`Failed to delete forked child ${child.id}: ${err}`, true)
+					return
+				}
+			}
+		}
+
 		await WorkspaceService.deleteWorkspace({ workspace })
 		sendUserToast('You deleted the workspace')
 		clearStores()
 		goto('/user/workspaces')
 	}
 
+	let deleteForkedChildren = $state(false)
+	const forkedDescendants = $derived(
+		$workspaceStore ? findWorkspaceDescendants($workspaceStore, $userWorkspaces ?? []) : []
+	)
+
 	let hasNewChangelogs = $state(false)
 	let recentChangelogs: Changelog[] = $state([])
 	let lastOpened = localStorage.getItem('changelogsLastOpened')
@@ -285,7 +303,6 @@
 			label: 'Assets',
 			href: `${base}/assets`,
 			icon: Pyramid,
-			disabled: $userStore?.operator,
 			aiId: 'sidebar-menu-link-assets',
 			aiDescription: 'Button to navigate to assets'
 		},
@@ -492,6 +509,7 @@
 								label: 'Delete Forked Workspace',
 								action: async () => {
 									await loadForkedDatatables()
+									deleteForkedChildren = false
 									deleteWorkspaceForkModal = true
 								},
 								icon: Trash2,
@@ -807,6 +825,30 @@
 	>
 		<div class="flex flex-col w-full space-y-4">
 			<span>Are you sure you want to delete this workspace fork? (deleting {$workspaceStore})</span>
+			{#if forkedDescendants.length > 0}
+				<div class="border rounded-md divide-y">
+					<div class="px-4 py-2 flex items-center justify-between gap-2">
+						<div class="flex flex-col min-w-0">
+							<span class="text-xs font-semibold text-secondary">Forked children</span>
+							<span class="text-3xs text-hint">
+								This fork has {forkedDescendants.length} forked
+								{forkedDescendants.length === 1 ? 'child' : 'children'} (transitively).
+							</span>
+						</div>
+						<Toggle
+							class="shrink-0"
+							size="xs"
+							bind:checked={deleteForkedChildren}
+							options={{ right: 'Also delete children' }}
+						/>
+					</div>
+					<ul class="px-4 py-2 text-3xs text-hint max-h-32 overflow-y-auto">
+						{#each forkedDescendants as child}
+							<li class="font-mono truncate" title={child.id}>{child.id}</li>
+						{/each}
+					</ul>
+				</div>
+			{/if}
 			{#if forkedDatatables.length > 0}
 				<div class="border rounded-md divide-y">
 					<div class="px-4 py-2 text-xs font-semibold text-secondary"> Forked databases </div>
diff --git a/frontend/src/lib/components/workspacePicker.ts b/frontend/src/lib/components/workspacePicker.ts
new file mode 100644
index 0000000000..ba2985ecbb
--- /dev/null
+++ b/frontend/src/lib/components/workspacePicker.ts
@@ -0,0 +1,151 @@
+import type { Flow, ListableApp, Script } from '$lib/gen'
+
+export type WorkspaceItemKind = 'flow' | 'script' | 'app'
+
+export type WorkspaceItem = {
+	path: string
+	summary: string
+	kind: WorkspaceItemKind
+	raw_app?: boolean
+}
+
+/** Display label for kinds — used in the picker rows and search section headers. */
+export const KIND_LABEL: Record<WorkspaceItemKind, string> = {
+	flow: 'Flows',
+	script: 'Scripts',
+	app: 'Apps'
+}
+
+/** Lowercase variant — matches the editor breadcrumb style. */
+export const KIND_LABEL_LOWER: Record<WorkspaceItemKind, string> = {
+	flow: 'flows',
+	script: 'scripts',
+	app: 'apps'
+}
+
+/** Composite keys used for keyboard nav and `initialHighlight`. The picker and
+ * its callers must agree on these — keep them all here. `'all'` is a virtual
+ * kind for the cross-kind root view; only valid for `kindKey` / `dirKey`
+ * (leaves always belong to a real kind). */
+export const kindKey = (k: WorkspaceItemKind | 'all') => `kind:${k}`
+export const dirKey = (k: WorkspaceItemKind | 'all', fullPath: string) => `dir:${k}:${fullPath}`
+export const leafKeyFor = (k: WorkspaceItemKind, path: string) => `leaf:${k}:${path}`
+
+export function editPathFor(item: WorkspaceItem): string {
+	if (item.kind === 'flow') return `/flows/edit/${item.path}`
+	if (item.kind === 'script') return `/scripts/edit/${item.path}`
+	return item.raw_app ? `/apps_raw/edit/${item.path}` : `/apps/edit/${item.path}`
+}
+
+type WorkspaceCache = {
+	flow?: WorkspaceItem[]
+	script?: WorkspaceItem[]
+	app?: WorkspaceItem[]
+}
+
+/** Module-level session cache. Persists across picker mounts within a single
+ * page session. NOT invalidated automatically — call `invalidate()` after
+ * creating/deleting an item if the picker may be opened again before a full
+ * reload. */
+const cache = new Map<string, WorkspaceCache>()
+const inflight = new Map<string, Promise<WorkspaceItem[]>>()
+/** Bumped by `invalidate()`. Each in-flight `loadKind` captures the version
+ * at start and only writes back to the cache if it still matches — so a
+ * deploy mid-fetch can't have its stale predecessor repopulate the cache. */
+const cacheVersion = new Map<string, number>()
+
+const cacheKey = (workspace: string, kind: WorkspaceItemKind) => `${workspace}:${kind}`
+
+const KINDS: WorkspaceItemKind[] = ['flow', 'script', 'app']
+
+function bumpVersion(workspace: string, kind: WorkspaceItemKind) {
+	const k = cacheKey(workspace, kind)
+	cacheVersion.set(k, (cacheVersion.get(k) ?? 0) + 1)
+}
+
+export function getCachedItems(
+	workspace: string,
+	kind: WorkspaceItemKind
+): WorkspaceItem[] | undefined {
+	return cache.get(workspace)?.[kind]
+}
+
+/** Drop a workspace+kind (or a whole workspace) from the cache so the next
+ * picker open re-fetches. Use after creating/deleting items. Also bumps the
+ * version so any in-flight `loadKind` started before the invalidate won't
+ * write its (now-stale) result back to the cache. */
+export function invalidate(workspace: string, kind?: WorkspaceItemKind) {
+	if (!kind) {
+		cache.delete(workspace)
+		for (const k of KINDS) bumpVersion(workspace, k)
+		return
+	}
+	const bucket = cache.get(workspace)
+	if (bucket) delete bucket[kind]
+	bumpVersion(workspace, kind)
+}
+
+export async function loadKind(
+	workspace: string,
+	kind: WorkspaceItemKind
+): Promise<WorkspaceItem[]> {
+	const existing = cache.get(workspace)?.[kind]
+	if (existing) return existing
+	const key = cacheKey(workspace, kind)
+	const flying = inflight.get(key)
+	if (flying) return flying
+
+	const startVersion = cacheVersion.get(key) ?? 0
+	const promise = (async () => {
+		const { ScriptService, FlowService, AppService } = await import('$lib/gen')
+		let items: WorkspaceItem[]
+		if (kind === 'flow') {
+			const flows = await FlowService.listFlows({
+				workspace,
+				includeDraftOnly: true,
+				withoutDescription: true
+			})
+			items = flows.map((f: Flow) => ({
+				path: f.path,
+				summary: f.summary ?? '',
+				kind: 'flow' as const
+			}))
+		} else if (kind === 'script') {
+			const scripts = await ScriptService.listScripts({
+				workspace,
+				includeDraftOnly: true,
+				withoutDescription: true
+			})
+			items = scripts.map((s: Script) => ({
+				path: s.path,
+				summary: s.summary ?? '',
+				kind: 'script' as const
+			}))
+		} else {
+			const apps = await AppService.listApps({
+				workspace,
+				includeDraftOnly: true
+			})
+			items = apps.map((a: ListableApp) => ({
+				path: a.path,
+				summary: a.summary ?? '',
+				kind: 'app' as const,
+				raw_app: a.raw_app ?? false
+			}))
+		}
+		// Only commit if the cache version hasn't changed since we started —
+		// otherwise we'd overwrite a deliberate `invalidate()` with stale data.
+		if ((cacheVersion.get(key) ?? 0) === startVersion) {
+			const bucket = cache.get(workspace) ?? {}
+			bucket[kind] = items
+			cache.set(workspace, bucket)
+		}
+		return items
+	})()
+	inflight.set(key, promise)
+	try {
+		return await promise
+	} finally {
+		inflight.delete(key)
+	}
+}
diff --git a/frontend/src/lib/utils.ts b/frontend/src/lib/utils.ts
index 0911fe44e1..20d1e496ff 100644
--- a/frontend/src/lib/utils.ts
+++ b/frontend/src/lib/utils.ts
@@ -1022,6 +1022,16 @@ export function generateRandomString(len: number = 24): string {
 	return result
 }
 
+/** `u/<sanitized-username>/` — the default scope prefix for items owned by the
+ * current user. The username is normalized so emails and special characters
+ * don't leak into paths. */
+export function userPathPrefix(username: string | undefined): string {
+	const u = username?.includes('@')
+		? username.split('@')[0].replace(/[^a-zA-Z0-9_]/g, '')
+		: (username ?? '')
+	return `u/${u}/`
+}
+
 export function deepMergeWithPriority<T>(target: T, source: T): T {
 	if (typeof target !== 'object' || typeof source !== 'object') {
 		return source
diff --git a/frontend/src/lib/utils/downloadFile.ts b/frontend/src/lib/utils/downloadFile.ts
new file mode 100644
index 0000000000..fe37ee5f2c
--- /dev/null
+++ b/frontend/src/lib/utils/downloadFile.ts
@@ -0,0 +1,43 @@
+import { OpenAPI } from '$lib/gen'
+import { getHeaders } from '$lib/gen/core/request'
+import { sendUserToast } from '$lib/toast'
+
+/**
+ * When OpenAPI is configured to authenticate via headers (TOKEN, basic auth,
+ * or arbitrary HEADERS) we cannot rely on a plain `<a href>` browser
+ * navigation because the browser does not attach those headers. In that case
+ * fetch the file via the OpenAPI client (which carries the configured auth)
+ * and trigger a download from a blob URL. Cookie-only auth still works with
+ * a plain link.
+ *
+ * `apiPath` should be the path relative to OpenAPI.BASE, starting with `/`
+ * (e.g. `/w/foo/job_helpers/download_s3_file?file_key=...`).
+ */
+export function shouldDownloadViaClient(): boolean {
+	return Boolean(OpenAPI.TOKEN || OpenAPI.HEADERS || OpenAPI.USERNAME)
+}
+
+export async function downloadViaClient(apiPath: string, filename: string): Promise<void> {
+	const url = `${OpenAPI.BASE}${apiPath}`
+	let response: Response
+	try {
+		const headers = await getHeaders(OpenAPI, { method: 'GET', url: apiPath })
+		response = await fetch(url, { headers, credentials: OpenAPI.CREDENTIALS })
+	} catch (e) {
+		sendUserToast(`Download failed: ${e}`, true)
+		return
+	}
+	if (!response.ok) {
+		sendUserToast(`Download failed: ${response.status} ${response.statusText}`, true)
+		return
+	}
+	const blob = await response.blob()
+	const blobUrl = URL.createObjectURL(blob)
+	const a = document.createElement('a')
+	a.href = blobUrl
+	a.download = filename
+	document.body.appendChild(a)
+	a.click()
+	a.remove()
+	URL.revokeObjectURL(blobUrl)
+}
diff --git a/frontend/src/routes/(root)/(logged)/apps/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/apps/edit/[...path]/+page.svelte
index 5ed09bbbd3..d3d7ab5613 100644
--- a/frontend/src/routes/(root)/(logged)/apps/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/apps/edit/[...path]/+page.svelte
@@ -45,11 +45,18 @@
 			replaceState(url.toString(), page.state)
 		}
 	})
+
+	/** Increments per `loadApp` call. Stale loads (e.g. when picker
+	 * navigation races a draft-discard reload) bail at the next checkpoint
+	 * after their captured token no longer matches. */
+	let loadAppToken = 0
 	async function loadApp(): Promise<void> {
+		const tok = ++loadAppToken
 		const app_w_draft = await AppService.getAppByPathWithDraft({
-			path,
+			path: page.params.path ?? '',
 			workspace: $workspaceStore!
 		})
+		if (tok !== loadAppToken) return
 		const app_w_draft_: AppWithLastVersionWDraft = structuredClone(stateSnapshot(app_w_draft))
 		savedApp = {
 			summary: app_w_draft_.summary,
@@ -157,8 +164,15 @@
 	}
 
 	$effect(() => {
-		if ($workspaceStore) {
+		// Re-run on workspace OR path change so navigating from one app editor
+		// to another (e.g. via the workspace picker) reloads the new app.
+		const currentPath = page.params.path
+		if ($workspaceStore && currentPath !== undefined) {
 			untrack(() => {
+				// Clear the app so AppEditor unmounts; it will remount once loadApp
+				// completes with fresh data, re-initializing its internal stores.
+				app = undefined
+				path = currentPath
 				loadApp()
 			})
 		}
diff --git a/frontend/src/routes/(root)/(logged)/apps_raw/add/+page.svelte b/frontend/src/routes/(root)/(logged)/apps_raw/add/+page.svelte
index 12eae5c2eb..4dd39ba488 100644
--- a/frontend/src/routes/(root)/(logged)/apps_raw/add/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/apps_raw/add/+page.svelte
@@ -13,7 +13,11 @@
 	import FileEditorIcon from '$lib/components/raw_apps/FileEditorIcon.svelte'
 	import { UserDraft } from '$lib/userDraft.svelte'
 	import { readFieldsRecursively } from '$lib/utils'
-	import { react18Template, react19Template, svelte5Template } from './templates'
+	import {
+		react18Template,
+		react19Template,
+		svelte5Template
+	} from '$lib/components/raw_apps/templates'
 	import type { Runnable } from '$lib/components/raw_apps/rawAppPolicy'
 	import { type RawAppData, DEFAULT_DATA } from '$lib/components/raw_apps/dataTableRefUtils'
 	import {
diff --git a/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte
index 70a2acfaba..0203dab2fe 100644
--- a/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte
@@ -100,11 +100,17 @@
 		newPath = app.path
 	}
 
+	/** Increments per `loadApp` call. Stale loads (e.g. when picker
+	 * navigation races a draft-discard reload) bail at the next checkpoint
+	 * after their captured token no longer matches. */
+	let loadAppToken = 0
 	async function loadApp(): Promise<void> {
+		const tok = ++loadAppToken
 		const app_w_draft = await AppService.getAppByPathWithDraft({
-			path,
+			path: page.params.path ?? '',
 			workspace: $workspaceStore!
 		})
+		if (tok !== loadAppToken) return
 		const app_w_draft_ = structuredClone(stateSnapshot(app_w_draft))
 		savedApp = {
 			summary: app_w_draft_.summary,
@@ -202,7 +208,14 @@
 	}
 
 	run(() => {
-		if ($workspaceStore) {
+		// Re-run on workspace OR path change so navigating from one raw app editor
+		// to another (e.g. via the workspace picker) reloads the new app.
+		const currentPath = page.params.path
+		if ($workspaceStore && currentPath !== undefined) {
+			// Clear files so RawAppEditor unmounts; it will remount when loadApp
+			// completes with fresh data, re-initializing its internal stores.
+			files = undefined
+			path = currentPath
 			loadApp()
 		}
 	})
diff --git a/frontend/src/routes/(root)/(logged)/assets/+page.svelte b/frontend/src/routes/(root)/(logged)/assets/+page.svelte
index 50ed6f041b..2873140fea 100644
--- a/frontend/src/routes/(root)/(logged)/assets/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/assets/+page.svelte
@@ -12,7 +12,13 @@
 		type AssetKind,
 		type ListAssetsResponse
 	} from '$lib/gen'
-	import { userStore, workspaceStore, userWorkspaces, globalDbManagerDrawer } from '$lib/stores'
+	import {
+		userStore,
+		workspaceStore,
+		userWorkspaces,
+		globalDbManagerDrawer,
+		superadmin
+	} from '$lib/stores'
 	import { parseDbInputFromAssetSyntax, pluralize, truncate } from '$lib/utils'
 	import ExploreAssetButton, {
 		assetCanBeExplored
@@ -182,15 +188,17 @@
 								>
 									See documentation
 								</Button>
-								<Button
-									wrapperClasses="h-fit"
-									variant={props.data.current?.length === 0 && !props.data.loading
-										? 'accent'
-										: 'subtle'}
-									iconOnly
-									endIcon={{ icon: SettingsIcon }}
-									href={props.settingsHref}
-								/>
+								{#if !($userStore?.operator || (!$userStore?.is_admin && !$superadmin))}
+									<Button
+										wrapperClasses="h-fit"
+										variant={props.data.current?.length === 0 && !props.data.loading
+											? 'accent'
+											: 'subtle'}
+										iconOnly
+										endIcon={{ icon: SettingsIcon }}
+										href={props.settingsHref}
+									/>
+								{/if}
 							</div>
 						</div>
 						{#if props.data.current?.length}
diff --git a/frontend/src/routes/(root)/(logged)/flows/add/+page.svelte b/frontend/src/routes/(root)/(logged)/flows/add/+page.svelte
index cca44fef67..93533509d0 100644
--- a/frontend/src/routes/(root)/(logged)/flows/add/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/flows/add/+page.svelte
@@ -4,6 +4,7 @@
 	import { page } from '$app/state'
 
 	import FlowBuilder from '$lib/components/FlowBuilder.svelte'
+	import { editPathFor, invalidate } from '$lib/components/workspacePicker'
 	import UnsavedConfirmationModal from '$lib/components/common/confirmationModal/UnsavedConfirmationModal.svelte'
 	import { importFlowStore, initFlow } from '$lib/components/flows/flowStore.svelte'
 	import { FlowService, type Flow } from '$lib/gen'
@@ -175,15 +176,18 @@
 <FlowBuilder
 	onSaveInitial={(e) => {
 		UserDraft.remove('flow', '')
+		if ($workspaceStore) invalidate($workspaceStore, 'flow')
 		goto(`/flows/edit/${e.path}?selected=${e.id}`)
 	}}
 	onDeploy={(e) => {
 		UserDraft.remove('flow', '')
+		if ($workspaceStore) invalidate($workspaceStore, 'flow')
 		goto(`/flows/get/${e.path}?workspace=${$workspaceStore}`)
 	}}
 	onDetails={(e) => {
 		goto(`/flows/get/${e.path}?workspace=${$workspaceStore}`)
 	}}
+	onNavigate={(item) => goto(editPathFor(item))}
 	{initialPath}
 	{pathStoreInit}
 	bind:this={flowBuilder}
diff --git a/frontend/src/routes/(root)/(logged)/flows/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/flows/edit/[...path]/+page.svelte
index bcae4935e6..d91f369a07 100644
--- a/frontend/src/routes/(root)/(logged)/flows/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/flows/edit/[...path]/+page.svelte
@@ -2,6 +2,7 @@
 	import { FlowService, type Flow, DraftService } from '$lib/gen'
 
 	import FlowBuilder from '$lib/components/FlowBuilder.svelte'
+	import { editPathFor, invalidate } from '$lib/components/workspacePicker'
 	import { initialArgsStore, workspaceStore } from '$lib/stores'
 	import {
 		cleanValueProperties,
@@ -25,8 +26,11 @@
 	import { UserDraft } from '$lib/userDraft.svelte'
 
 	let version: undefined | number = $state(undefined)
-	let nodraft = page.url.searchParams.get('nodraft')
 
+	// `initialArgs` is captured once at mount — it's the session's initial
+	// argument set. The flow draft itself lives in UserDraft and is re-read
+	// per loadFlow() so picker navigation doesn't reuse the original path's
+	// state.
 	const urlArgs = page.url.searchParams.get('initial_args')
 
 	let initialArgs = $state({})
@@ -44,7 +48,7 @@
 		| undefined = $state(undefined)
 
 	afterNavigate(() => {
-		if (nodraft) {
+		if (page.url.searchParams.get('nodraft')) {
 			let url = new URL(page.url.href)
 			url.search = ''
 			replaceState(url.toString(), page.state)
@@ -93,23 +97,31 @@
 
 	let flowBuilder: FlowBuilder | undefined = $state(undefined)
 	let notFound = $state(false)
+	/** Increments per `loadFlow` call. Each in-flight load checks its captured
+	 * token against this before writing shared state — if a newer load started
+	 * (e.g. picker navigation while a draft-discard reload is in flight),
+	 * the older promise no-ops at the next checkpoint. */
+	let loadFlowToken = 0
 	async function loadFlow(): Promise<void> {
-		console.log('loadFlow')
+		const tok = ++loadFlowToken
 		loading = true
 		let flow: Flow
 		// Currently there is no way to get version of flow with flow.
 		// So we have to request it here
-		version = (
+		const v = (
 			await FlowService.getFlowLatestVersion({
 				workspace: $workspaceStore!,
 				path: page.params.path ?? ''
 			})
 		).id
+		if (tok !== loadFlowToken) return
+		version = v
 
 		const flowWithDraft = await FlowService.getFlowByPathWithDraft({
 			workspace: $workspaceStore!,
 			path: page.params.path ?? ''
 		})
+		if (tok !== loadFlowToken) return
 		savedFlow = {
 			...structuredClone($state.snapshot(flowWithDraft)),
 			draft: flowWithDraft.draft
@@ -216,12 +228,16 @@
 		}
 
 		await initFlow(flow, flowStore, flowStateStore)
+		if (tok !== loadFlowToken) return
 		loading = false
 		selectedId = page.url.searchParams.get('selected') ?? 'settings-metadata'
 		flowBuilder?.loadFlowState()
 	}
 
 	$effect(() => {
+		// Re-run on workspace OR path change so navigating from one flow editor
+		// to another (e.g. via the workspace picker) reloads the new flow.
+		page.params.path
 		if ($workspaceStore) {
 			untrack(() => loadFlow())
 		}
@@ -271,6 +287,7 @@
 	<FlowBuilder
 		onDeploy={(e) => {
 			UserDraft.remove('flow', flowDraftPath)
+			if ($workspaceStore) invalidate($workspaceStore, 'flow')
 			goto(`/flows/get/${e.path}?workspace=${$workspaceStore}`)
 		}}
 		onDetails={(e) => {
@@ -282,6 +299,7 @@
 		onHistoryRestore={() => {
 			loadFlow()
 		}}
+		onNavigate={(item) => goto(editPathFor(item))}
 		{flowStore}
 		{flowStateStore}
 		initialPath={page.params.path ?? ''}
diff --git a/frontend/src/routes/(root)/(logged)/global_drafts/+page.js b/frontend/src/routes/(root)/(logged)/global_drafts/+page.js
new file mode 100644
index 0000000000..d62178ddb3
--- /dev/null
+++ b/frontend/src/routes/(root)/(logged)/global_drafts/+page.js
@@ -0,0 +1,5 @@
+export function load() {
+	return {
+		stuff: { title: 'Global AI drafts' }
+	}
+}
diff --git a/frontend/src/routes/(root)/(logged)/global_drafts/+page.svelte b/frontend/src/routes/(root)/(logged)/global_drafts/+page.svelte
new file mode 100644
index 0000000000..4b7f8e8d0c
--- /dev/null
+++ b/frontend/src/routes/(root)/(logged)/global_drafts/+page.svelte
@@ -0,0 +1,98 @@
+<script lang="ts">
+	import { Button } from '$lib/components/common'
+	import {
+		globalDraftStore,
+		type WorkspaceItem
+	} from '$lib/components/copilot/chat/global/draftStore.svelte'
+	import { isGlobalAiEnabled } from '$lib/components/copilot/chat/global/gate'
+	import { goto } from '$lib/navigation'
+	import { workspaceStore } from '$lib/stores'
+	import { Trash2 } from 'lucide-svelte'
+	import { onMount } from 'svelte'
+
+	let enabled = $state(false)
+
+	onMount(() => {
+		// Dev-only route. Bounce to home when the global mode gate is closed.
+		enabled = isGlobalAiEnabled()
+		if (!enabled) {
+			goto('/')
+		}
+	})
+
+	let drafts = $derived($workspaceStore ? globalDraftStore.listDrafts($workspaceStore) : [])
+
+	function draftKey(item: WorkspaceItem): string {
+		return `${item.type}:${item.triggerKind ?? '-'}:${item.path}`
+	}
+
+	function deleteDraft(item: WorkspaceItem) {
+		if (!$workspaceStore) return
+		globalDraftStore.deleteDraft($workspaceStore, item.type, item.path, item.triggerKind)
+	}
+
+	function clearAll() {
+		if (!$workspaceStore) return
+		globalDraftStore.clearDrafts($workspaceStore)
+	}
+</script>
+
+{#if enabled}
+	<div class="p-6 max-w-5xl mx-auto">
+		<div class="flex items-center justify-between mb-6">
+			<div>
+				<h1 class="text-2xl font-semibold">Global AI drafts</h1>
+				<p class="text-sm text-tertiary">
+					Dev-only inspector for the in-memory global draft store.
+				</p>
+			</div>
+			<Button
+				variant="default"
+				startIcon={{ icon: Trash2 }}
+				disabled={drafts.length === 0}
+				onclick={clearAll}
+			>
+				Clear all
+			</Button>
+		</div>
+
+		{#if drafts.length === 0}
+			<p class="text-sm text-tertiary">No drafts.</p>
+		{:else}
+			<ul class="space-y-4">
+				{#each drafts as draft (draftKey(draft))}
+					<li class="border rounded p-4">
+						<div class="flex items-start justify-between gap-2 mb-2">
+							<div>
+								<div class="font-mono text-sm">
+									<span class="font-semibold">{draft.type}</span>
+									{#if draft.triggerKind}
+										<span class="text-tertiary">({draft.triggerKind})</span>
+									{/if}
+									<span class="text-tertiary">·</span>
+									<span>{draft.path}</span>
+								</div>
+								{#if draft.summary}
+									<div class="text-sm text-tertiary mt-1">{draft.summary}</div>
+								{/if}
+								{#if draft.language}
+									<div class="text-xs text-tertiary mt-1">language: {draft.language}</div>
+								{/if}
+							</div>
+							<Button
+								variant="default"
+								startIcon={{ icon: Trash2 }}
+								iconOnly
+								onclick={() => deleteDraft(draft)}
+							/>
+						</div>
+						<pre
+							class="text-xs bg-surface-secondary p-3 rounded overflow-auto max-h-96 whitespace-pre-wrap"
+							>{JSON.stringify(draft.value, null, 2)}</pre
+						>
+					</li>
+				{/each}
+			</ul>
+		{/if}
+	</div>
+{/if}
diff --git a/frontend/src/routes/(root)/(logged)/scripts/add/+page.svelte b/frontend/src/routes/(root)/(logged)/scripts/add/+page.svelte
index 6483becf5b..43f401d8e9 100644
--- a/frontend/src/routes/(root)/(logged)/scripts/add/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/scripts/add/+page.svelte
@@ -4,6 +4,7 @@
 	import { page } from '$app/state'
 	import { defaultScripts, initialArgsStore, workspaceStore } from '$lib/stores'
 	import ScriptBuilder from '$lib/components/ScriptBuilder.svelte'
+	import { editPathFor, invalidate } from '$lib/components/workspacePicker'
 	import type { Schema } from '$lib/common'
 	import { decodeState, emptySchema, emptyString, sendUserToast } from '$lib/utils'
 	import { goto } from '$lib/navigation'
@@ -155,11 +156,14 @@
 					? 'wac_typescript'
 					: 'script')}
 		onDeploy={(e) => {
+			if ($workspaceStore) invalidate($workspaceStore, 'script')
 			goto(`/scripts/get/${e.hash}?workspace=${$workspaceStore}`)
 		}}
 		onSaveInitial={(e) => {
+			if ($workspaceStore) invalidate($workspaceStore, 'script')
 			goto(`/scripts/edit/${e.path}`)
 		}}
+		onNavigate={(item) => goto(editPathFor(item))}
 		searchParams={page.url.searchParams}
 		bind:script={scriptHandle.draft}
 		{showMeta}
diff --git a/frontend/src/routes/(root)/(logged)/scripts/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/scripts/edit/[...path]/+page.svelte
index 2b314eb819..5fb30187d3 100644
--- a/frontend/src/routes/(root)/(logged)/scripts/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/scripts/edit/[...path]/+page.svelte
@@ -3,6 +3,7 @@
 
 	import { initialArgsStore, workspaceStore } from '$lib/stores'
 	import ScriptBuilder from '$lib/components/ScriptBuilder.svelte'
+	import { editPathFor, invalidate } from '$lib/components/workspacePicker'
 	import { cleanValueProperties, orderedJsonStringify } from '$lib/utils'
 	import { goto } from '$lib/navigation'
 	import { sendUserToast } from '$lib/toast'
@@ -17,6 +18,8 @@
 
 	type EditableScript = NewScript & { draft_triggers?: Trigger[] }
 
+	// `initialArgs` is intentionally captured once at mount — it's the
+	// session's initial argument set, not per-script.
 	let initialArgs = get(initialArgsStore) ?? {}
 	if (get(initialArgsStore)) $initialArgsStore = undefined
 
@@ -38,13 +41,19 @@
 
 	let savedPrimarySchedule: ScheduleTrigger | undefined = $state(undefined)
 
+	/** Increments per `loadScript` call. Stale loads (e.g. when picker
+	 * navigation races a draft-discard reload) bail at the next checkpoint
+	 * after their captured token no longer matches. */
+	let loadScriptToken = 0
 	async function loadScript(): Promise<void> {
+		const tok = ++loadScriptToken
 		fullyLoaded = false
 		if (hash) {
 			const scriptByHash = await ScriptService.getScriptByHash({
 				workspace: $workspaceStore!,
 				hash
 			})
+			if (tok !== loadScriptToken) return
 			savedScript = structuredClone($state.snapshot(scriptByHash)) as NewScriptWithDraft
 			scriptHandle.draft = { ...scriptByHash, parent_hash: hash, lock: undefined }
 		} else {
@@ -52,6 +61,7 @@
 				workspace: $workspaceStore!,
 				path: page.params.path ?? ''
 			})
+			if (tok !== loadScriptToken) return
 			savedScript = structuredClone($state.snapshot(scriptWithDraft))
 
 			const localDraft = scriptHandle.draft
@@ -163,6 +173,9 @@
 	}
 
 	$effect(() => {
+		// Re-run on workspace OR path change so navigating from one script editor
+		// to another (e.g. via the workspace picker) reloads the new script.
+		page.params.path
 		if ($workspaceStore) {
 			untrack(() => loadScript())
 		}
@@ -214,14 +227,17 @@
 		searchParams={page.url.searchParams}
 		onDeploy={(e) => {
 			UserDraft.remove('script', draftPath)
+			if ($workspaceStore) invalidate($workspaceStore, 'script')
 			goto(`/scripts/get/${e.hash}?workspace=${$workspaceStore}`)
 		}}
 		onSaveInitial={(e) => {
+			if ($workspaceStore) invalidate($workspaceStore, 'script')
 			goto(`/scripts/edit/${e.path}`)
 		}}
 		onSeeDetails={(e) => {
 			goto(`/scripts/get/${e.path}?workspace=${$workspaceStore}`)
 		}}
+		onNavigate={(item) => goto(editPathFor(item))}
 	>
 		<UnsavedConfirmationModal
 			{diffDrawer}
diff --git a/frontend/src/routes/(root)/(logged)/workers/+page.svelte b/frontend/src/routes/(root)/(logged)/workers/+page.svelte
index 9bc4d1d710..c2de0b81d8 100644
--- a/frontend/src/routes/(root)/(logged)/workers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/workers/+page.svelte
@@ -194,19 +194,6 @@
 		}
 	}
 
-	let defaultTagPerWorkspace: boolean | undefined = $state(undefined)
-	let defaultTagWorkspaces: string[] = $state([])
-	async function loadDefaultTagsPerWorkspace() {
-		try {
-			defaultTagPerWorkspace = await WorkerService.isDefaultTagsPerWorkspace()
-			defaultTagWorkspaces = (await SettingService.getGlobal({
-				key: DEFAULT_TAGS_WORKSPACES_SETTING
-			})) as any
-		} catch (err) {
-			sendUserToast(`Could not load default tag per workspace setting: ${err}`, true)
-		}
-	}
-
 	function parseLicenseKey(key: string): {
 		valid: boolean
 		expiration?: Date
@@ -247,13 +234,11 @@
 			const { valid, expiration } = parseLicenseKey(licenseKey)
 
 			if (!valid && expiration) {
-				// License is expired
 				sendUserToast(
 					`Enterprise license key expired on ${expiration.toLocaleDateString()}. Please renew your license key to continue using Windmill.`,
 					true
 				)
 			} else if (expiration) {
-				// Check if expires within 7 days
 				const daysUntilExpiration = Math.floor(
 					(expiration.getTime() - Date.now()) / (1000 * 60 * 60 * 24)
 				)
@@ -266,11 +251,23 @@
 				}
 			}
 		} catch (err) {
-			// Silently fail - don't show errors for license check
 			console.error('Failed to check license expiration:', err)
 		}
 	}
 
+	let defaultTagPerWorkspace: boolean | undefined = $state(undefined)
+	let defaultTagWorkspaces: string[] = $state([])
+	async function loadDefaultTagsPerWorkspace() {
+		try {
+			defaultTagPerWorkspace = await WorkerService.isDefaultTagsPerWorkspace()
+			defaultTagWorkspaces = (await SettingService.getGlobal({
+				key: DEFAULT_TAGS_WORKSPACES_SETTING
+			})) as any
+		} catch (err) {
+			sendUserToast(`Could not load default tag per workspace setting: ${err}`, true)
+		}
+	}
+
 	onMount(() => {
 		intervalId = setInterval(() => {
 			loadWorkers()
diff --git a/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte b/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
index 6b61b71242..aa873f83a9 100644
--- a/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
@@ -36,6 +36,7 @@
 	} from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { clone, emptyString, encodeState, hasUnsavedChanges } from '$lib/utils'
+	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import { Slack } from 'lucide-svelte'
 	import SidebarNavigation from '$lib/components/common/sidebar/SidebarNavigation.svelte'
 
@@ -1499,13 +1500,26 @@
 
 							<div class="text-xs font-semibold text-emphasis mt-6 mb-1">Export workspace</div>
 							<div class="flex justify-start">
-								<Button
-									size="sm"
-									href="{base}/api/w/{$workspaceStore ?? ''}/workspaces/tarball?archive_type=zip"
-									target="_blank"
-								>
-									Export workspace as zip file
-								</Button>
+								{#if shouldDownloadViaClient()}
+									<Button
+										size="sm"
+										on:click={() =>
+											downloadViaClient(
+												`/w/${$workspaceStore ?? ''}/workspaces/tarball?archive_type=zip`,
+												`${$workspaceStore ?? 'workspace'}.zip`
+											)}
+									>
+										Export workspace as zip file
+									</Button>
+								{:else}
+									<Button
+										size="sm"
+										href="{base}/api/w/{$workspaceStore ?? ''}/workspaces/tarball?archive_type=zip"
+										target="_blank"
+									>
+										Export workspace as zip file
+									</Button>
+								{/if}
 							</div>
 
 							<div class="mt-12"></div>
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 24a854d8e2..9425a21af9 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.697.0"
+wmill = ">=1.700.2"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index b4cd99fb13..7769f50a1c 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.697.0
+  version: 1.700.2
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
@@ -1053,6 +1053,12 @@ components:
                 - 0.0 = deterministic, focused responses
                 - 0.7 = balanced (common default)
                 - 1.0+ = more creative/random
+            max_iterations:
+              allOf:
+                - $ref: '#/components/schemas/InputTransform'
+              description: |
+                Number. Limits how many times the agent can loop through reasoning and tool use.
+                Range: 1-1000.
           required:
             - provider
             - user_message
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 5626e3544d..586ece80a7 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.697.0'
+    ModuleVersion     = '1.700.2'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 868da1a79c..1699abaebf 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.697.0"
+version = "1.700.2"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/system_prompts/auto-generated/cli/cli-commands.md b/system_prompts/auto-generated/cli/cli-commands.md
index e541df9198..dc0eb66640 100644
--- a/system_prompts/auto-generated/cli/cli-commands.md
+++ b/system_prompts/auto-generated/cli/cli-commands.md
@@ -26,7 +26,7 @@ app related commands
   - `--json` - Output as JSON (for piping to jq)
 - `app get <path:string>` - get an app's details
   - `--json` - Output as JSON (for piping to jq)
-- `app push <file_path:string> <remote_path:string>` - push a local app 
+- `app push [file_path:string] [remote_path:string]` - push a local app. With no args, infers the app from the current directory and the remote path from its location relative to wmill.yaml.
 - `app dev [app_folder:string]` - Start a development server for building apps with live reload and hot module replacement
   - `--port <port:number>` - Port to run the dev server on (will find next available port if occupied)
   - `--host <host:string>` - Host to bind the dev server to
@@ -168,6 +168,7 @@ Generate metadata (locks, schemas) for all scripts, flows, and apps
 - `--skip-flows` - Skip processing flows
 - `--skip-apps` - Skip processing apps
 - `--strict-folder-boundaries` - Only update items inside the specified folder (requires folder argument)
+- `--parallel <n:number>` - Number of items to process in parallel
 - `-i --includes <patterns:file[]>` - Comma separated patterns to specify which files to include
 - `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which files to exclude
 
@@ -177,6 +178,7 @@ Generate metadata (locks, schemas) for all scripts, flows, and apps
   - `--skip-scripts` - Skip processing scripts
   - `--skip-flows` - Skip processing flows
   - `--skip-apps` - Skip processing apps
+  - `--parallel <n:number>` - Number of items to process in parallel
   - `-i --includes <patterns:file[]>` - Comma separated patterns to specify which files to include
   - `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which files to exclude
 
diff --git a/system_prompts/auto-generated/flow.md b/system_prompts/auto-generated/flow.md
index 88f1aa8301..806e279767 100644
--- a/system_prompts/auto-generated/flow.md
+++ b/system_prompts/auto-generated/flow.md
@@ -295,4 +295,4 @@ Reference a specific resource using `$res:` prefix:
 
 ## OpenFlow Schema
 
-{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \"yellow\", \"#ffff00\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside loops, use 'flow_input.iter.value' for the current iteration value","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly while a condition is true. The loop checks the condition after each iteration. Use stop_after_if on modules to control loop termination","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration. Use stop_after_if to control when the loop ends","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"}},"required":["provider","user_message","output_type"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["tools","type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
\ No newline at end of file
+{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \"yellow\", \"#ffff00\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside loops, use 'flow_input.iter.value' for the current iteration value","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly while a condition is true. The loop checks the condition after each iteration. Use stop_after_if on modules to control loop termination","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration. Use stop_after_if to control when the loop ends","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}},"required":["provider","user_message","output_type"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["tools","type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
\ No newline at end of file
diff --git a/system_prompts/auto-generated/index.d.ts b/system_prompts/auto-generated/index.d.ts
index 2ff02ece06..6018d7ef92 100644
--- a/system_prompts/auto-generated/index.d.ts
+++ b/system_prompts/auto-generated/index.d.ts
@@ -1,5 +1,7 @@
 export * from './prompts';
 export declare function getScriptPrompt(language: string): string;
 export declare function getFlowPrompt(): string;
+export declare function getResourcePrompt(): string;
+export declare function getRawAppPrompt(): string;
 export declare function getDatatableSdkReference(): string;
 export declare function getWorkflowAsCodePrompt(language?: string): string;
diff --git a/system_prompts/auto-generated/index.ts b/system_prompts/auto-generated/index.ts
index 1d880184a7..bbd90e1066 100644
--- a/system_prompts/auto-generated/index.ts
+++ b/system_prompts/auto-generated/index.ts
@@ -44,6 +44,16 @@ export function getFlowPrompt(): string {
   ].filter(Boolean).join('\n\n');
 }
 
+// Helper for resource & variable authoring
+export function getResourcePrompt(): string {
+  return prompts.RESOURCES_BASE;
+}
+
+// Helper for raw app authoring (chat consumers)
+export function getRawAppPrompt(): string {
+  return prompts.RAW_APP_BASE;
+}
+
 // Helper to get datatable SDK reference for app mode
 export function getDatatableSdkReference(): string {
   return [
diff --git a/system_prompts/auto-generated/prompts.d.ts b/system_prompts/auto-generated/prompts.d.ts
index e9e6136470..fe4156afd4 100644
--- a/system_prompts/auto-generated/prompts.d.ts
+++ b/system_prompts/auto-generated/prompts.d.ts
@@ -1,6 +1,6 @@
 export declare const SCRIPT_BASE = "# Windmill Script Writing Guide\n\n## General Principles\n\n- Scripts must export a main function (do not call it)\n- Libraries are installed automatically - do not show installation instructions\n- Credentials and configuration are stored in resources and passed as parameters\n- The windmill client (`wmill`) provides APIs for interacting with the platform\n\n## Function Naming\n\n- Main function: `main` (or `preprocessor` for preprocessor scripts)\n- Must be async for TypeScript variants\n\n## Return Values\n\n- Scripts can return any JSON-serializable value\n- Return values become available to subsequent flow steps via `results.step_id`\n\n## Preprocessor Scripts\n\nPreprocessor scripts process raw trigger data from various sources (webhook, custom HTTP route, SQS, WebSocket, Kafka, NATS, MQTT, Postgres, or email) before passing it to the flow. This separates the trigger logic from the flow logic and keeps the auto-generated UI clean.\n\nThe returned object determines the parameter values passed to the flow.\ne.g., `{ b: 1, a: 2 }` calls the flow with `a = 2` and `b = 1`, assuming the flow has two inputs called `a` and `b`.\n\nThe preprocessor receives a single parameter called `event`.\n";
-export declare const FLOW_BASE = "# Windmill Flow Building Guide\n\n## Creating a Flow\n\n**You \u2014 the AI agent \u2014 scaffold the flow yourself by running `wmill flow new <path>` with the right flags. Do NOT hand-create the folder + `flow.yaml`, and do NOT tell the user to \"run `wmill flow new` and follow the prompts\".**\n\n`wmill flow new` creates the folder with the correct suffix (`__flow` or `.flow` depending on the workspace's `nonDottedPaths` setting), writes a minimal `flow.yaml` shell, and prints Claude-specific next-step hints. Scaffolding by hand skips all of that and often picks the wrong suffix.\n\n### Step 1 \u2014 Gather path + summary by asking the user\n\nYou need two things:\n\n1. **path** \u2014 the windmill path, e.g. `f/folder/my_flow` or `u/username/my_flow`.\n2. **summary** \u2014 a short description of the flow.\n\nIf the user's request didn't supply both, ask for both in a single round-trip. Use whichever interactive question facility your runtime provides \u2014 a structured multi-choice tool if available, otherwise plain chat \u2014 and provide one or two example values for each (with an \"Other\" / free-form fallback). Do not guess paths or summaries.\n\n### Step 2 \u2014 Run the command yourself\n\n```bash\nwmill flow new f/folder/my_flow --summary \"Short description\"\n```\n\nAdd `--description \"...\"` when the user provided a longer explanation worth preserving separately from the summary.\n\n### Step 3 \u2014 Fill in `flow.yaml`\n\nOpen the generated `flow.yaml` (under the folder the command just created) and replace the empty `value.modules` + `schema` with the real flow definition.\n\nFor rawscript modules, use `!inline path/to/script.ts` for the content key. Inline script files should NOT include `.inline_script.` in their names (e.g. use `a.ts`, not `a.inline_script.ts`).\n\nOnce the flow has real content, **offer** to open the visual preview as a one-sentence next step (e.g. \"Want me to open the visual preview?\"). Don't auto-open \u2014 opening the dev page has side effects (browser window, possibly a `launch.json` entry) and the user should consent.\n\n### Anti-patterns to avoid\n\n- \u274C Hand-creating the `__flow` folder + `flow.yaml` instead of running `wmill flow new`. You'll miss the suffix-setting resolution, the default shape, and the Claude hints.\n- \u274C Telling the user to \"run `wmill flow new <path>`\" \u2014 you can and should run it yourself.\n- \u274C Inventing a path/summary instead of asking the user.\n\n## CLI Commands \u2014 running, previewing, deploying\n\nAfter writing, tell the user which command fits what they want to do:\n\n- `wmill flow preview <flow_path>` \u2014 **default when iterating on a local flow.** Runs the local `flow.yaml` against local inline scripts without deploying. Add `--remote` to use deployed workspace scripts for PathScript steps instead of local files.\n- `wmill flow run <path>` \u2014 runs the flow **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.\n- `wmill generate-metadata` \u2014 regenerate stale `.lock` and `.script.yaml` files. By default it scans **scripts, flows, and apps** across the workspace; pass `--skip-flows --skip-apps` (or run from a subdirectory) to limit the scope when you only care about the flow you edited.\n- `wmill sync push` \u2014 deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push \u2014 not when they say \"run\", \"try\", or \"test\".\n\n### Preview vs run \u2014 choose by intent, not habit\n\nIf the user says \"run the flow\", \"try it\", \"test it\", \"does it work\" while there are **local edits to a `flow.yaml`**, use `flow preview`. Do NOT push the flow to then `flow run` it \u2014 pushing is a deploy, and deploying just to test overwrites the workspace version with untested changes.\n\nOnly use `flow run` when:\n- The user explicitly says \"run the deployed version\" / \"run what's on the server\".\n- There is no local `flow.yaml` being edited (you're just invoking an existing flow).\n\nOnly use `sync push` when:\n- The user explicitly asks to deploy, publish, push, or ship.\n- The preview has already validated the change and the user wants it in the workspace.\n\n### After writing \u2014 offer to run, don't wait passively\n\nThis is about **programmatic execution** (`wmill flow preview -d '<args>'`), which actually runs the flow and has side effects. Visual preview (the `preview` skill) is offered separately \u2014 see \"Visual preview\" below.\n\nIf the user hasn't already told you to run/test the flow, offer it as a one-sentence next step (e.g. \"Want me to run `wmill flow preview` with sample args?\"). Do not present a multi-option menu.\n\nIf the user already asked to test/run/try the flow in their original request, skip the offer and just execute `wmill flow preview <path> -d '<args>'` directly \u2014 pick plausible args from the flow's input schema.\n\n`wmill flow preview` is safe to run yourself (it does not deploy). `wmill sync push` and `wmill generate-metadata` modify workspace state or local files \u2014 only run these when the user explicitly asks; otherwise tell them which to run.\n\n### Visual preview\n\nTo open the flow visually in the dev page (graph + live reload), use the `preview` skill. Always **offer** it as a one-sentence next step (e.g. \"Want me to open the visual preview?\") rather than opening it automatically \u2014 opening the dev page has side effects (browser window, possibly a `launch.json` entry under MCP-preview branches) the user should consent to. If the user already asked to see/preview/visualize the flow in their original request, skip the offer and just invoke the skill.\n\n## OpenFlow Schema\n\nThe OpenFlow schema (openflow.openapi.yaml) is the source of truth for flow structure. Refer to OPENFLOW_SCHEMA for the complete type definitions.\n\n## Reserved Module IDs\n\n- `failure` - Reserved for failure handler module\n- `preprocessor` - Reserved for preprocessor module\n- `Input` - Reserved for flow input reference\n\n## Hard Structural Rules\n\nThese are strict Windmill schema rules. Follow them exactly.\n\n- `value.modules` is only for normal sequential steps\n- `value.preprocessor_module` and `value.failure_module` are special top-level fields inside `value`, not entries in `value.modules`\n- If a flow needs a preprocessor, create `value.preprocessor_module` with `id: preprocessor`\n- If a flow needs a failure handler, create `value.failure_module` with `id: failure`\n- Do NOT create regular modules inside `value.modules` named `preprocessor` or `failure`\n- `preprocessor_module` and `failure_module` only support `script` or `rawscript`\n- `preprocessor_module` runs before normal modules and cannot reference `results.*`\n- `failure_module` can use the `error` object with `error.message`, `error.step_id`, `error.name`, and `error.stack`\n\nCorrect shape:\n\n```yaml\nvalue:\n  preprocessor_module:\n    id: preprocessor\n    value:\n      type: rawscript\n      ...\n  failure_module:\n    id: failure\n    value:\n      type: rawscript\n      ...\n  modules:\n    - id: process_event\n      value:\n        type: rawscript\n        ...\n```\n\nIncorrect shape:\n\n```yaml\nvalue:\n  modules:\n    - id: preprocessor\n      ...\n    - id: process_event\n      ...\n    - id: failure\n      ...\n```\n\n## Module ID Rules\n\n- Must be unique across the entire flow\n- Use underscores, not spaces (e.g., `fetch_data` not `fetch data`)\n- Use descriptive names that reflect the step's purpose\n\n## Common Mistakes to Avoid\n\n- Missing `input_transforms` - Rawscript parameters won't receive values without them\n- Referencing future steps - `results.step_id` only works for steps that execute before the current one\n- Duplicate module IDs - Each module ID must be unique in the flow\n\n## Data Flow Between Steps\n\n- `flow_input.property` - Access flow input parameters\n- `results.step_id` - Access output from a previous step only when that step result is in scope\n- `results.step_id.property` - Access specific property from a previous step output only when that step result is in scope\n- `flow_input.iter.value` - Current iteration value when inside a loop (`forloopflow` or `whileloopflow`)\n- `flow_input.iter.index` - Current loop index when inside a loop (`forloopflow` or `whileloopflow`)\n\n## Loop Structure Rules\n\n- For `whileloopflow`, use module-level `stop_after_if` on the loop module itself when the loop should stop after an iteration result\n- Do NOT put `stop_after_if` inside `value` of a `whileloopflow`\n- `stop_after_all_iters_if` is for checks after the whole loop finishes, not the normal per-iteration break condition\n- When a `whileloopflow` carries state forward between iterations, use `flow_input.iter.value` as the current loop value and provide an explicit first-iteration fallback when needed\n- Use `flow_input.iter.index` only when the loop logic is truly based on the iteration index, not as a replacement for the current loop value\n- If the user asks for a final scalar/object after a loop, add a normal step after the loop that extracts the final value from the loop result instead of returning the whole loop result array\n\nCorrect `whileloopflow` shape:\n\n```yaml\n- id: loop_until_done\n  stop_after_if:\n    expr: result.done === true\n    skip_if_stopped: false\n  value:\n    type: whileloopflow\n    skip_failures: false\n    modules:\n      - id: advance_state\n        value:\n          type: rawscript\n          input_transforms:\n            state:\n              type: javascript\n              expr: flow_input.iter && flow_input.iter.value !== undefined ? flow_input.iter.value : flow_input.initial_state\n- id: return_final_state\n  value:\n    type: rawscript\n    input_transforms:\n      final_state:\n        type: javascript\n        expr: results.loop_until_done[results.loop_until_done.length - 1]\n```\n\nIncorrect `whileloopflow` patterns:\n\n```yaml\n- id: loop_until_done\n  value:\n    type: whileloopflow\n    stop_after_if:\n      expr: result.done === true\n```\n\n```yaml\ninput_transforms:\n  state:\n    type: javascript\n    expr: flow_input.iter.index\n```\n\n```yaml\ninput_transforms:\n  final_state:\n    type: javascript\n    expr: results.loop_until_done\n```\n\n## Approval / Suspend Structure\n\n- `suspend` belongs on the flow module object itself, as a sibling of `id` and `value`\n- Never put `suspend` inside `value`\n\nCorrect shape:\n\n```yaml\n- id: request_approval\n  suspend:\n    required_events: 1\n    resume_form:\n      schema:\n        type: object\n        properties:\n          comment:\n            type: string\n        required: [comment]\n  value:\n    type: identity\n```\n\nIncorrect shape:\n\n```yaml\n- id: request_approval\n  value:\n    type: rawscript\n    suspend:\n      required_events: 1\n```\n\n## Branch Result Scope Rules\n\n- Inside a branch, you may reference earlier outer steps and earlier steps in the same branch\n- Outside a `branchone`, do NOT reference ids of steps that only exist inside its branches or default branch. Use `results.<branchone_module_id>` instead\n- Outside a `branchall`, do NOT reference ids of steps inside its branches. Use `results.<branchall_module_id>` instead\n- If downstream steps need a stable shape after a branch, make each branch return the same fields\n- When needed, add a normalization step immediately after the branch and consume `results.<branch_module_id>` there\n\nCorrect after `branchone`:\n\n```yaml\n- id: route_order\n  value:\n    type: branchone\n    ...\n- id: send_confirmation\n  value:\n    input_transforms:\n      routed:\n        type: javascript\n        expr: results.route_order\n```\n\nIncorrect after `branchone`:\n\n```yaml\nexpr: results.create_shipment\nexpr: results.create_backorder\n```\n\nCorrect after `branchall`:\n\n```yaml\n- id: enrich_parallel\n  value:\n    type: branchall\n    parallel: true\n    ...\n- id: combine_data\n  value:\n    input_transforms:\n      enrichments:\n        type: javascript\n        expr: results.enrich_parallel\n```\n\n## Input Transforms\n\nEvery rawscript module needs `input_transforms` to map function parameters to values:\n\nStatic transform (fixed value):\n{\"param_name\": {\"type\": \"static\", \"value\": \"fixed_string\"}}\n\nJavaScript transform (dynamic expression):\n{\"param_name\": {\"type\": \"javascript\", \"expr\": \"results.previous_step.data\"}}\n\n## Resource References\n\n- For flow inputs: Use type `\"object\"` with format `\"resource-{type}\"` (e.g., `\"resource-postgresql\"`)\n- For step inputs: Use static value `\"$res:path/to/resource\"`\n\n## Final Structural Self-Check\n\nBefore finalizing a flow, verify:\n\n- any preprocessor is in `value.preprocessor_module`\n- any failure handler is in `value.failure_module`\n- any approval step has module-level `suspend`\n- no downstream step references inner branch step ids from outside the branch\n\n## S3 Object Operations\n\nWindmill provides built-in support for S3-compatible storage operations.\n\nTo accept an S3 object as flow input:\n\n```json\n{\n  \"type\": \"object\",\n  \"properties\": {\n    \"file\": {\n      \"type\": \"object\",\n      \"format\": \"resource-s3_object\",\n      \"description\": \"File to process\"\n    }\n  }\n}\n```\n\n## Using Resources in Flows\n\nOn Windmill, credentials and configuration are stored in resources. Resource types define the format of the resource.\n\n### As Flow Input\n\nIn the flow schema, set the property type to `\"object\"` with format `\"resource-{type}\"`:\n\n```json\n{\n  \"type\": \"object\",\n  \"properties\": {\n    \"database\": {\n      \"type\": \"object\",\n      \"format\": \"resource-postgresql\",\n      \"description\": \"Database connection\"\n    }\n  }\n}\n```\n\n### As Step Input (Static Reference)\n\nReference a specific resource using `$res:` prefix:\n\n```json\n{\n  \"database\": {\n    \"type\": \"static\",\n    \"value\": \"$res:f/folder/my_database\"\n  }\n}\n```\n";
-export declare const WORKFLOW_AS_CODE_BASE = "# Windmill Workflow-as-Code Writing Guide\n\n## Scope\n\nUse this guide when writing or modifying Windmill Workflow-as-Code (WAC) scripts.\nWAC is authored as a Windmill script and deployed with the normal script workflow. It is not an OpenFlow YAML flow.\n\nSupported WAC authoring targets:\n- TypeScript scripts that import from `windmill-client`\n- Python 3 scripts that import from `wmill`\n\n## File Shape\n\nTypeScript:\n\n```typescript\nimport {\n  task,\n  taskScript,\n  taskFlow,\n  step,\n  sleep,\n  waitForApproval,\n  getResumeUrls,\n  parallel,\n  workflow,\n} from \"windmill-client\";\n\nconst process = task(async (x: string): Promise<string> => {\n  return `processed: ${x}`;\n});\n\nexport const main = workflow(async (x: string) => {\n  const result = await process(x);\n  return { result };\n});\n```\n\nPython:\n\n```python\nfrom wmill import task, task_script, task_flow, step, sleep, wait_for_approval, get_resume_urls, parallel, workflow\n\n@task()\nasync def process(x: str) -> str:\n    return f\"processed: {x}\"\n\n@workflow\nasync def main(x: str):\n    result = await process(x)\n    return {\"result\": result}\n```\n\nRules:\n- Do not call `main`.\n- TypeScript should export the workflow entrypoint, preferably `export const main = workflow(async (...) => { ... })`.\n- Python must use `@workflow` on an async top-level function, usually `main`.\n- Define task functions and `taskScript`/`task_script` or `taskFlow`/`task_flow` assignments at module top level with stable names.\n- Use the exact SDK names. Do not alias `workflow`, `task`, `taskScript`, `taskFlow`, `step`, `sleep`, `waitForApproval`, `task_script`, `task_flow`, or `wait_for_approval`; the WAC parser recognizes these names directly.\n\n## Checkpoint And Replay Model\n\nThe parent workflow may rerun from the top after any suspension, retry, approval, or child task completion. Completed durable steps are replayed from the checkpoint.\n\nPut every side effect or non-deterministic value behind a durable WAC boundary:\n- Use `task()` / `@task()` for substantial work that should run as its own child job.\n- Use `taskScript()` / `task_script()` for an existing script or a relative module file.\n- Use `taskFlow()` / `task_flow()` for an existing Windmill flow.\n- Use `step(name, fn)` for lightweight inline work whose result must be checkpointed.\n- Use `sleep(seconds)` for server-side sleeps that do not hold a worker.\n- Use `waitForApproval()` / `wait_for_approval()` for external approval suspension.\n\nNever put API calls, database writes, notifications, random values, timestamps, or irreversible changes directly in the top-level workflow body. The workflow body can be rerun. Put those operations in a task or in `step()`.\n\nBranching on task or step results is safe because those results are checkpointed. Branching on current time, random data, environment reads, or external state is unsafe unless the value is first captured with `step()`.\n\n## Tasks\n\nUse `task()` / `@task()` for inline functions that become workflow steps:\n\n```typescript\nconst enrich = task(async (customerId: string) => {\n  return await fetchCustomer(customerId);\n});\n```\n\n```python\n@task(timeout=600, tag=\"etl\")\nasync def enrich(customer_id: str):\n    return await fetch_customer(customer_id)\n```\n\nIn TypeScript, prefer assigning each task to a named top-level const. In Python, prefer top-level async functions decorated with `@task()` or `@task`.\n\nFor existing scripts:\n\n```typescript\nconst helper = taskScript(\"./helper.ts\");\nconst existing = taskScript(\"f/data/extract\", { timeout: 600 });\nconst value = await helper({ input: x });\n```\n\n```python\nhelper = task_script(\"./helper.py\")\nexisting = task_script(\"f/data/extract\", timeout=600)\nvalue = await helper(input=x)\n```\n\nFor existing flows:\n\n```typescript\nconst pipeline = taskFlow(\"f/etl/pipeline\");\nconst output = await pipeline({ input: data });\n```\n\n```python\npipeline = task_flow(\"f/etl/pipeline\")\noutput = await pipeline(input=data)\n```\n\n## Inline Steps\n\nUse `step()` for lightweight inline values that must not change during replay:\n\n```typescript\nconst urls = await step(\"get_urls\", () => getResumeUrls());\nconst startedAt = await step(\"started_at\", () => new Date().toISOString());\n```\n\n```python\nurls = await step(\"get_urls\", lambda: get_resume_urls())\n```\n\nUse stable, descriptive step names. Do not generate step names dynamically.\n\n## Parallelism\n\nTo run independent work in parallel, start task promises/coroutines before awaiting them together:\n\n```typescript\nconst [a, b] = await Promise.all([process(\"a\"), process(\"b\")]);\nconst many = await parallel(items, process, { concurrency: 5 });\n```\n\n```python\nimport asyncio\n\na, b = await asyncio.gather(process(\"a\"), process(\"b\"))\nmany = await parallel(items, process, concurrency=5)\n```\n\nOnly parallelize independent steps. Do not read the result of a task before it is awaited.\n\n## Approvals\n\nGenerate resume URLs inside `step()` before sending them:\n\n```typescript\nconst urls = await step(\"get_urls\", () => getResumeUrls());\nawait step(\"notify\", () => sendApprovalEmail(urls.approvalPage));\nconst approval = await waitForApproval({ timeout: 3600 });\n```\n\n```python\nurls = await step(\"get_urls\", lambda: get_resume_urls())\nawait step(\"notify\", lambda: send_approval_email(urls[\"approvalPage\"]))\napproval = await wait_for_approval(timeout=3600)\n```\n\n`selfApproval: false` and `self_approval=False` are Enterprise-only approval behavior. Do not use them unless the user asks for that behavior.\n\n## Error Handling\n\nLet task errors fail the workflow unless the user asks for recovery logic.\n\nPython: `except Exception` is safe around WAC calls because internal suspension inherits from `BaseException`. Avoid bare `except:` in workflow code. If the user asks for recovery logic around failed child work, catch `TaskError` from `wmill` for task failures.\n\nTypeScript: avoid broad `try/catch` around WAC SDK calls. The SDK uses an internal suspension error during initial dispatch; catching it can break workflow suspension. If a broad catch is unavoidable, rethrow internal suspension errors before handling business errors.\n";
+export declare const FLOW_BASE = "# Windmill Flow Building Guide\n\n## OpenFlow Schema\n\nThe OpenFlow schema (openflow.openapi.yaml) is the source of truth for flow structure. Refer to OPENFLOW_SCHEMA for the complete type definitions.\n\n## Reserved Module IDs\n\n- `failure` - Reserved for failure handler module\n- `preprocessor` - Reserved for preprocessor module\n- `Input` - Reserved for flow input reference\n\n## Hard Structural Rules\n\nThese are strict Windmill schema rules. Follow them exactly.\n\n- `value.modules` is only for normal sequential steps\n- `value.preprocessor_module` and `value.failure_module` are special top-level fields inside `value`, not entries in `value.modules`\n- If a flow needs a preprocessor, create `value.preprocessor_module` with `id: preprocessor`\n- If a flow needs a failure handler, create `value.failure_module` with `id: failure`\n- Do NOT create regular modules inside `value.modules` named `preprocessor` or `failure`\n- `preprocessor_module` and `failure_module` only support `script` or `rawscript`\n- `preprocessor_module` runs before normal modules and cannot reference `results.*`\n- `failure_module` can use the `error` object with `error.message`, `error.step_id`, `error.name`, and `error.stack`\n\nCorrect shape:\n\n```yaml\nvalue:\n  preprocessor_module:\n    id: preprocessor\n    value:\n      type: rawscript\n      ...\n  failure_module:\n    id: failure\n    value:\n      type: rawscript\n      ...\n  modules:\n    - id: process_event\n      value:\n        type: rawscript\n        ...\n```\n\nIncorrect shape:\n\n```yaml\nvalue:\n  modules:\n    - id: preprocessor\n      ...\n    - id: process_event\n      ...\n    - id: failure\n      ...\n```\n\n## Module ID Rules\n\n- Must be unique across the entire flow\n- Use underscores, not spaces (e.g., `fetch_data` not `fetch data`)\n- Use descriptive names that reflect the step's purpose\n\n## Common Mistakes to Avoid\n\n- Missing `input_transforms` - Rawscript parameters won't receive values without them\n- Referencing future steps - `results.step_id` only works for steps that execute before the current one\n- Duplicate module IDs - Each module ID must be unique in the flow\n\n## Data Flow Between Steps\n\n- `flow_input.property` - Access flow input parameters\n- `results.step_id` - Access output from a previous step only when that step result is in scope\n- `results.step_id.property` - Access specific property from a previous step output only when that step result is in scope\n- `flow_input.iter.value` - Current iteration value when inside a loop (`forloopflow` or `whileloopflow`)\n- `flow_input.iter.index` - Current loop index when inside a loop (`forloopflow` or `whileloopflow`)\n\n## Loop Structure Rules\n\n- For `whileloopflow`, use module-level `stop_after_if` on the loop module itself when the loop should stop after an iteration result\n- Do NOT put `stop_after_if` inside `value` of a `whileloopflow`\n- `stop_after_all_iters_if` is for checks after the whole loop finishes, not the normal per-iteration break condition\n- When a `whileloopflow` carries state forward between iterations, use `flow_input.iter.value` as the current loop value and provide an explicit first-iteration fallback when needed\n- Use `flow_input.iter.index` only when the loop logic is truly based on the iteration index, not as a replacement for the current loop value\n- If the user asks for a final scalar/object after a loop, add a normal step after the loop that extracts the final value from the loop result instead of returning the whole loop result array\n\nCorrect `whileloopflow` shape:\n\n```yaml\n- id: loop_until_done\n  stop_after_if:\n    expr: result.done === true\n    skip_if_stopped: false\n  value:\n    type: whileloopflow\n    skip_failures: false\n    modules:\n      - id: advance_state\n        value:\n          type: rawscript\n          input_transforms:\n            state:\n              type: javascript\n              expr: flow_input.iter && flow_input.iter.value !== undefined ? flow_input.iter.value : flow_input.initial_state\n- id: return_final_state\n  value:\n    type: rawscript\n    input_transforms:\n      final_state:\n        type: javascript\n        expr: results.loop_until_done[results.loop_until_done.length - 1]\n```\n\nIncorrect `whileloopflow` patterns:\n\n```yaml\n- id: loop_until_done\n  value:\n    type: whileloopflow\n    stop_after_if:\n      expr: result.done === true\n```\n\n```yaml\ninput_transforms:\n  state:\n    type: javascript\n    expr: flow_input.iter.index\n```\n\n```yaml\ninput_transforms:\n  final_state:\n    type: javascript\n    expr: results.loop_until_done\n```\n\n## Approval / Suspend Structure\n\n- `suspend` belongs on the flow module object itself, as a sibling of `id` and `value`\n- Never put `suspend` inside `value`\n\nCorrect shape:\n\n```yaml\n- id: request_approval\n  suspend:\n    required_events: 1\n    resume_form:\n      schema:\n        type: object\n        properties:\n          comment:\n            type: string\n        required: [comment]\n  value:\n    type: identity\n```\n\nIncorrect shape:\n\n```yaml\n- id: request_approval\n  value:\n    type: rawscript\n    suspend:\n      required_events: 1\n```\n\n## Branch Result Scope Rules\n\n- Inside a branch, you may reference earlier outer steps and earlier steps in the same branch\n- Outside a `branchone`, do NOT reference ids of steps that only exist inside its branches or default branch. Use `results.<branchone_module_id>` instead\n- Outside a `branchall`, do NOT reference ids of steps inside its branches. Use `results.<branchall_module_id>` instead\n- If downstream steps need a stable shape after a branch, make each branch return the same fields\n- When needed, add a normalization step immediately after the branch and consume `results.<branch_module_id>` there\n\nCorrect after `branchone`:\n\n```yaml\n- id: route_order\n  value:\n    type: branchone\n    ...\n- id: send_confirmation\n  value:\n    input_transforms:\n      routed:\n        type: javascript\n        expr: results.route_order\n```\n\nIncorrect after `branchone`:\n\n```yaml\nexpr: results.create_shipment\nexpr: results.create_backorder\n```\n\nCorrect after `branchall`:\n\n```yaml\n- id: enrich_parallel\n  value:\n    type: branchall\n    parallel: true\n    ...\n- id: combine_data\n  value:\n    input_transforms:\n      enrichments:\n        type: javascript\n        expr: results.enrich_parallel\n```\n\n## Input Transforms\n\nEvery rawscript module needs `input_transforms` to map function parameters to values:\n\nStatic transform (fixed value):\n{\"param_name\": {\"type\": \"static\", \"value\": \"fixed_string\"}}\n\nJavaScript transform (dynamic expression):\n{\"param_name\": {\"type\": \"javascript\", \"expr\": \"results.previous_step.data\"}}\n\n## Resource References\n\n- For flow inputs: Use type `\"object\"` with format `\"resource-{type}\"` (e.g., `\"resource-postgresql\"`)\n- For step inputs: Use static value `\"$res:path/to/resource\"`\n\n## Final Structural Self-Check\n\nBefore finalizing a flow, verify:\n\n- any preprocessor is in `value.preprocessor_module`\n- any failure handler is in `value.failure_module`\n- any approval step has module-level `suspend`\n- no downstream step references inner branch step ids from outside the branch\n\n## S3 Object Operations\n\nWindmill provides built-in support for S3-compatible storage operations.\n\nTo accept an S3 object as flow input:\n\n```json\n{\n  \"type\": \"object\",\n  \"properties\": {\n    \"file\": {\n      \"type\": \"object\",\n      \"format\": \"resource-s3_object\",\n      \"description\": \"File to process\"\n    }\n  }\n}\n```\n\n## Using Resources in Flows\n\nOn Windmill, credentials and configuration are stored in resources. Resource types define the format of the resource.\n\n### As Flow Input\n\nIn the flow schema, set the property type to `\"object\"` with format `\"resource-{type}\"`:\n\n```json\n{\n  \"type\": \"object\",\n  \"properties\": {\n    \"database\": {\n      \"type\": \"object\",\n      \"format\": \"resource-postgresql\",\n      \"description\": \"Database connection\"\n    }\n  }\n}\n```\n\n### As Step Input (Static Reference)\n\nReference a specific resource using `$res:` prefix:\n\n```json\n{\n  \"database\": {\n    \"type\": \"static\",\n    \"value\": \"$res:f/folder/my_database\"\n  }\n}\n```\n";
+export declare const WORKFLOW_AS_CODE_BASE = "# Windmill Workflow-as-Code Writing Guide\n\n## Scope\n\nUse this guide when writing or modifying Windmill Workflow-as-Code (WAC) scripts.\nWAC is authored as a Windmill script and deployed with the normal script workflow. It is not an OpenFlow YAML flow.\n\nSupported WAC authoring targets:\n- Bun TypeScript scripts that import from `windmill-client`\n- Python 3 scripts that import from `wmill`\n\n## File Shape\n\nBun TypeScript:\n\n```typescript\nimport {\n  task,\n  taskScript,\n  taskFlow,\n  step,\n  sleep,\n  waitForApproval,\n  getResumeUrls,\n  parallel,\n  workflow,\n} from \"windmill-client\";\n\nconst process = task(async (x: string): Promise<string> => {\n  return `processed: ${x}`;\n});\n\nexport const main = workflow(async (x: string) => {\n  const result = await process(x);\n  return { result };\n});\n```\n\nPython:\n\n```python\nfrom wmill import task, task_script, task_flow, step, sleep, wait_for_approval, get_resume_urls, parallel, workflow\n\n@task()\nasync def process(x: str) -> str:\n    return f\"processed: {x}\"\n\n@workflow\nasync def main(x: str):\n    result = await process(x)\n    return {\"result\": result}\n```\n\nRules:\n- Do not call `main`.\n- Bun TypeScript should export the workflow entrypoint, preferably `export const main = workflow(async (...) => { ... })`.\n- Python must use `@workflow` on an async top-level function, usually `main`.\n- Define task functions and `taskScript`/`task_script` or `taskFlow`/`task_flow` assignments at module top level with stable names.\n- Use the exact SDK names. Do not alias `workflow`, `task`, `taskScript`, `taskFlow`, `step`, `sleep`, `waitForApproval`, `task_script`, `task_flow`, or `wait_for_approval`; the WAC parser recognizes these names directly.\n\n## Checkpoint And Replay Model\n\nThe parent workflow may rerun from the top after any suspension, retry, approval, or child task completion. Completed durable steps are replayed from the checkpoint.\n\nPut every side effect or non-deterministic value behind a durable WAC boundary:\n- Use `task()` / `@task()` for substantial work that should run as its own child job.\n- Use `taskScript()` / `task_script()` for an existing script or a relative module file.\n- Use `taskFlow()` / `task_flow()` for an existing Windmill flow.\n- Use `step(name, fn)` for lightweight inline work whose result must be checkpointed.\n- Use `sleep(seconds)` for server-side sleeps that do not hold a worker.\n- Use `waitForApproval()` / `wait_for_approval()` for external approval suspension.\n\nNever put API calls, database writes, notifications, random values, timestamps, or irreversible changes directly in the top-level workflow body. The workflow body can be rerun. Put those operations in a task or in `step()`.\n\nBranching on task or step results is safe because those results are checkpointed. Branching on current time, random data, environment reads, or external state is unsafe unless the value is first captured with `step()`.\n\n## Tasks\n\nUse `task()` / `@task()` for inline functions that become workflow steps:\n\n```typescript\nconst enrich = task(async (customerId: string) => {\n  return await fetchCustomer(customerId);\n});\n```\n\n```python\n@task(timeout=600, tag=\"etl\")\nasync def enrich(customer_id: str):\n    return await fetch_customer(customer_id)\n```\n\nIn TypeScript, prefer assigning each task to a named top-level const. In Python, prefer top-level async functions decorated with `@task()` or `@task`.\n\nFor existing scripts:\n\n```typescript\nconst helper = taskScript(\"./helper.ts\");\nconst existing = taskScript(\"f/data/extract\", { timeout: 600 });\nconst value = await helper({ input: x });\n```\n\n```python\nhelper = task_script(\"./helper.py\")\nexisting = task_script(\"f/data/extract\", timeout=600)\nvalue = await helper(input=x)\n```\n\nFor existing flows:\n\n```typescript\nconst pipeline = taskFlow(\"f/etl/pipeline\");\nconst output = await pipeline({ input: data });\n```\n\n```python\npipeline = task_flow(\"f/etl/pipeline\")\noutput = await pipeline(input=data)\n```\n\n## Inline Steps\n\nUse `step()` for lightweight inline values that must not change during replay:\n\n```typescript\nconst urls = await step(\"get_urls\", () => getResumeUrls());\nconst startedAt = await step(\"started_at\", () => new Date().toISOString());\n```\n\n```python\nurls = await step(\"get_urls\", lambda: get_resume_urls())\n```\n\nUse stable, descriptive step names. Do not generate step names dynamically.\n\n## Parallelism\n\nTo run independent work in parallel, start task promises/coroutines before awaiting them together:\n\n```typescript\nconst [a, b] = await Promise.all([process(\"a\"), process(\"b\")]);\nconst many = await parallel(items, process, { concurrency: 5 });\n```\n\n```python\nimport asyncio\n\na, b = await asyncio.gather(process(\"a\"), process(\"b\"))\nmany = await parallel(items, process, concurrency=5)\n```\n\nOnly parallelize independent steps. Do not read the result of a task before it is awaited.\n\n## Approvals\n\nGenerate resume URLs inside `step()` before sending them:\n\n```typescript\nconst urls = await step(\"get_urls\", () => getResumeUrls());\nawait step(\"notify\", () => sendApprovalEmail(urls.approvalPage));\nconst approval = await waitForApproval({ timeout: 3600 });\n```\n\n```python\nurls = await step(\"get_urls\", lambda: get_resume_urls())\nawait step(\"notify\", lambda: send_approval_email(urls[\"approvalPage\"]))\napproval = await wait_for_approval(timeout=3600)\n```\n\n`selfApproval: false` and `self_approval=False` are Enterprise-only approval behavior. Do not use them unless the user asks for that behavior.\n\n## Error Handling\n\nLet task errors fail the workflow unless the user asks for recovery logic.\n\nPython: `except Exception` is safe around WAC calls because internal suspension inherits from `BaseException`. Avoid bare `except:` in workflow code. If the user asks for recovery logic around failed child work, catch `TaskError` from `wmill` for task failures.\n\nTypeScript: avoid broad `try/catch` around WAC SDK calls. The SDK uses an internal suspension error during initial dispatch; catching it can break workflow suspension. If a broad catch is unavoidable, rethrow internal suspension errors before handling business errors.\n";
 export declare const FLOW_CHAT_SPECIAL_MODULES = "## Special Modules\n\n- Use `set_preprocessor_module` to add, replace, or remove the top-level `value.preprocessor_module`\n- Use `set_failure_module` to add, replace, or remove the top-level `value.failure_module`\n- Use `set_flow_json` only when you are replacing the whole flow, including normal modules and optional special modules\n\n**Example - Update only the special modules:**\n```javascript\nset_preprocessor_module({\n  module: JSON.stringify({\n    id: \"preprocessor\",\n    value: {\n      type: \"rawscript\",\n      language: \"bun\",\n      content: \"export async function preprocessor(payload: string) { const trimmed = payload.trim(); if (!trimmed) { throw new Error('payload must not be empty'); } return { payload: trimmed }; }\",\n      input_transforms: {\n        payload: { type: \"javascript\", expr: \"flow_input.payload\" }\n      }\n    }\n  })\n})\n\nset_failure_module({\n  module: JSON.stringify({\n    id: \"failure\",\n    value: {\n      type: \"rawscript\",\n      language: \"bun\",\n      content: \"export async function main(message: string, name: string, step_id: string) { return { message, name, step_id }; }\",\n      input_transforms: {\n        message: { type: \"javascript\", expr: \"error.message\" },\n        name: { type: \"javascript\", expr: \"error.name\" },\n        step_id: { type: \"javascript\", expr: \"error.step_id\" }\n      }\n    }\n  })\n})\n```\n";
 export declare const SDK_TYPESCRIPT = "# TypeScript SDK (windmill-client)\n\nImport: import * as wmill from 'windmill-client'\n\nworkerHasInternalServer(): boolean\n\n/**\n * Initialize the Windmill client with authentication token and base URL\n * @param token - Authentication token (defaults to WM_TOKEN env variable)\n * @param baseUrl - API base URL (defaults to BASE_INTERNAL_URL or BASE_URL env variable)\n */\nsetClient(token?: string, baseUrl?: string): void\n\n/**\n * Create a client configuration from env variables\n * @returns client configuration\n */\ngetWorkspace(): string\n\n/**\n * Get a resource value by path\n * @param path path of the resource,  default to internal state path\n * @param undefinedIfEmpty if the resource does not exist, return undefined instead of throwing an error\n * @returns resource value\n */\nasync getResource(path?: string, undefinedIfEmpty?: boolean): Promise<any>\n\n/**\n * Get the true root job id\n * @param jobId job id to get the root job id from (default to current job)\n * @returns root job id\n */\nasync getRootJobId(jobId?: string): Promise<string>\n\n/**\n * @deprecated Use runScriptByPath or runScriptByHash instead\n */\nasync runScript(path: string | null = null, hash_: string | null = null, args: Record<string, any> | null = null, verbose: boolean = false): Promise<any>\n\n/**\n * Run a script synchronously by its path and wait for the result\n * @param path - Script path in Windmill\n * @param args - Arguments to pass to the script\n * @param verbose - Enable verbose logging\n * @returns Script execution result\n */\nasync runScriptByPath(path: string, args: Record<string, any> | null = null, verbose: boolean = false): Promise<any>\n\n/**\n * Run a script synchronously by its hash and wait for the result\n * @param hash_ - Script hash in Windmill\n * @param args - Arguments to pass to the script\n * @param verbose - Enable verbose logging\n * @returns Script execution result\n */\nasync runScriptByHash(hash_: string, args: Record<string, any> | null = null, verbose: boolean = false): Promise<any>\n\n/**\n * Append a text to the result stream\n * @param text text to append to the result stream\n */\nappendToResultStream(text: string): void\n\n/**\n * Stream to the result stream\n * @param stream stream to stream to the result stream\n */\nasync streamResult(stream: AsyncIterable<string>): Promise<void>\n\n/**\n * Run a flow synchronously by its path and wait for the result\n * @param path - Flow path in Windmill\n * @param args - Arguments to pass to the flow\n * @param verbose - Enable verbose logging\n * @returns Flow execution result\n */\nasync runFlow(path: string | null = null, args: Record<string, any> | null = null, verbose: boolean = false): Promise<any>\n\n/**\n * Wait for a job to complete and return its result\n * @param jobId - ID of the job to wait for\n * @param verbose - Enable verbose logging\n * @returns Job result when completed\n */\nasync waitJob(jobId: string, verbose: boolean = false): Promise<any>\n\n/**\n * Get the result of a completed job\n * @param jobId - ID of the completed job\n * @returns Job result\n */\nasync getResult(jobId: string): Promise<any>\n\n/**\n * Get the result of a job if completed, or its current status\n * @param jobId - ID of the job\n * @returns Object with started, completed, success, and result properties\n */\nasync getResultMaybe(jobId: string): Promise<any>\n\n/**\n * @deprecated Use runScriptByPathAsync or runScriptByHashAsync instead\n */\nasync runScriptAsync(path: string | null, hash_: string | null, args: Record<string, any> | null, scheduledInSeconds: number | null = null): Promise<string>\n\n/**\n * Run a script asynchronously by its path\n * @param path - Script path in Windmill\n * @param args - Arguments to pass to the script\n * @param scheduledInSeconds - Schedule execution for a future time (in seconds)\n * @returns Job ID of the created job\n */\nasync runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null): Promise<string>\n\n/**\n * Run a script asynchronously by its hash\n * @param hash_ - Script hash in Windmill\n * @param args - Arguments to pass to the script\n * @param scheduledInSeconds - Schedule execution for a future time (in seconds)\n * @returns Job ID of the created job\n */\nasync runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null): Promise<string>\n\n/**\n * Run a flow asynchronously by its path\n * @param path - Flow path in Windmill\n * @param args - Arguments to pass to the flow\n * @param scheduledInSeconds - Schedule execution for a future time (in seconds)\n * @param doNotTrackInParent - If false, tracks state in parent job (only use when fully awaiting the job)\n * @returns Job ID of the created job\n */\nasync runFlowAsync(path: string | null, args: Record<string, any> | null, scheduledInSeconds: number | null = null, // can only be set to false if this the job will be fully await and not concurrent with any other job // as otherwise the child flow and its own child will store their state in the parent job which will // lead to incorrectness and failures doNotTrackInParent: boolean = true): Promise<string>\n\n/**\n * Resolve a resource value in case the default value was picked because the input payload was undefined\n * @param obj resource value or path of the resource under the format `$res:path`\n * @returns resource value\n */\nasync resolveDefaultResource(obj: any): Promise<any>\n\n/**\n * Get the state file path from environment variables\n * @returns State path string\n */\ngetStatePath(): string\n\n/**\n * Set a resource value by path\n * @param path path of the resource to set, default to state path\n * @param value new value of the resource to set\n * @param initializeToTypeIfNotExist if the resource does not exist, initialize it with this type\n */\nasync setResource(value: any, path?: string, initializeToTypeIfNotExist?: string): Promise<void>\n\n/**\n * Set the state\n * @param state state to set\n * @deprecated use setState instead\n */\nasync setInternalState(state: any): Promise<void>\n\n/**\n * Set the state\n * @param state state to set\n * @param path Optional state resource path override. Defaults to `getStatePath()`.\n */\nasync setState(state: any, path?: string): Promise<void>\n\n/**\n * Set the progress\n * Progress cannot go back and limited to 0% to 99% range\n * @param percent Progress to set in %\n * @param jobId? Job to set progress for\n */\nasync setProgress(percent: number, jobId?: any): Promise<void>\n\n/**\n * Get the progress\n * @param jobId? Job to get progress from\n * @returns Optional clamped between 0 and 100 progress value\n */\nasync getProgress(jobId?: any): Promise<number | null>\n\n/**\n * Set a flow user state\n * @param key key of the state\n * @param value value of the state\n */\nasync setFlowUserState(key: string, value: any, errorIfNotPossible?: boolean): Promise<void>\n\n/**\n * Get a flow user state\n * @param path path of the variable\n */\nasync getFlowUserState(key: string, errorIfNotPossible?: boolean): Promise<any>\n\n/**\n * Get the internal state\n * @deprecated use getState instead\n */\nasync getInternalState(): Promise<any>\n\n/**\n * Get the state shared across executions\n * @param path Optional state resource path override. Defaults to `getStatePath()`.\n */\nasync getState(path?: string): Promise<any>\n\n/**\n * Get a variable by path\n * @param path path of the variable\n * @returns variable value\n */\nasync getVariable(path: string): Promise<string>\n\n/**\n * Set a variable by path, create if not exist\n * @param path path of the variable\n * @param value value of the variable\n * @param isSecretIfNotExist if the variable does not exist, create it as secret or not (default: false)\n * @param descriptionIfNotExist if the variable does not exist, create it with this description (default: \"\")\n */\nasync setVariable(path: string, value: string, isSecretIfNotExist?: boolean, descriptionIfNotExist?: string): Promise<void>\n\n/**\n * Build a PostgreSQL connection URL from a database resource\n * @param path - Path to the database resource\n * @returns PostgreSQL connection URL string\n */\nasync databaseUrlFromResource(path: string): Promise<string>\n\nasync polarsConnectionSettings(s3_resource_path: string | undefined): Promise<any>\n\nasync duckdbConnectionSettings(s3_resource_path: string | undefined): Promise<any>\n\n/**\n * Get S3 client settings from a resource or workspace default\n * @param s3_resource_path - Path to S3 resource (uses workspace default if undefined)\n * @returns S3 client configuration settings\n */\nasync denoS3LightClientSettings(s3_resource_path: string | undefined): Promise<DenoS3LightClientSettings>\n\n/**\n * Load the content of a file stored in S3. If the s3ResourcePath is undefined, it will default to the workspace S3 resource.\n * \n * ```typescript\n * let fileContent = await wmill.loadS3FileContent(inputFile)\n * // if the file is a raw text file, it can be decoded and printed directly:\n * const text = new TextDecoder().decode(fileContentStream)\n * console.log(text);\n * ```\n */\nasync loadS3File(s3object: S3Object, s3ResourcePath: string | undefined = undefined): Promise<Uint8Array | undefined>\n\n/**\n * Load the content of a file stored in S3 as a stream. If the s3ResourcePath is undefined, it will default to the workspace S3 resource.\n * \n * ```typescript\n * let fileContentBlob = await wmill.loadS3FileStream(inputFile)\n * // if the content is plain text, the blob can be read directly:\n * console.log(await fileContentBlob.text());\n * ```\n */\nasync loadS3FileStream(s3object: S3Object, s3ResourcePath: string | undefined = undefined): Promise<Blob | undefined>\n\n/**\n * Persist a file to the S3 bucket. If the s3ResourcePath is undefined, it will default to the workspace S3 resource.\n * \n * ```typescript\n * const s3object = await writeS3File(s3Object, \"Hello Windmill!\")\n * const fileContentAsUtf8Str = (await s3object.toArray()).toString('utf-8')\n * console.log(fileContentAsUtf8Str)\n * ```\n */\nasync writeS3File(s3object: S3Object | undefined, fileContent: string | Blob, s3ResourcePath: string | undefined = undefined, contentType: string | undefined = undefined, contentDisposition: string | undefined = undefined): Promise<S3Object>\n\n/**\n * Sign S3 objects to be used by anonymous users in public apps\n * @param s3objects s3 objects to sign\n * @returns signed s3 objects\n */\nasync signS3Objects(s3objects: S3Object[]): Promise<S3Object[]>\n\n/**\n * Sign S3 object to be used by anonymous users in public apps\n * @param s3object s3 object to sign\n * @returns signed s3 object\n */\nasync signS3Object(s3object: S3Object): Promise<S3Object>\n\n/**\n * Generate a presigned public URL for an array of S3 objects.\n * If an S3 object is not signed yet, it will be signed first.\n * @param s3Objects s3 objects to sign\n * @returns list of signed public URLs\n */\nasync getPresignedS3PublicUrls(s3Objects: S3Object[], { baseUrl }: { baseUrl?: string } = {}): Promise<string[]>\n\n/**\n * Generate a presigned public URL for an S3 object. If the S3 object is not signed yet, it will be signed first.\n * @param s3Object s3 object to sign\n * @returns signed public URL\n */\nasync getPresignedS3PublicUrl(s3Objects: S3Object, { baseUrl }: { baseUrl?: string } = {}): Promise<string>\n\n/**\n * Get URLs needed for resuming a flow after this step\n * @param approver approver name\n * @param flowLevel if true, generate resume URLs for the parent flow instead of the specific step.\n *                  This allows pre-approvals that can be consumed by any later suspend step in the same flow.\n * @returns approval page UI URL, resume and cancel API URLs for resuming the flow\n */\nasync getResumeUrls(approver?: string, flowLevel?: boolean): Promise<{\n  approvalPage: string;\n  resume: string;\n  cancel: string;\n}>\n\n/**\n * @deprecated use getResumeUrls instead\n */\ngetResumeEndpoints(approver?: string): Promise<{\n  approvalPage: string;\n  resume: string;\n  cancel: string;\n}>\n\n/**\n * Get an OIDC jwt token for auth to external services (e.g: Vault, AWS) (ee only)\n * @param audience audience of the token\n * @param expiresIn Optional number of seconds until the token expires\n * @returns jwt token\n */\nasync getIdToken(audience: string, expiresIn?: number): Promise<string>\n\n/**\n * Convert a base64-encoded string to Uint8Array\n * @param data - Base64-encoded string\n * @returns Decoded Uint8Array\n */\nbase64ToUint8Array(data: string): Uint8Array\n\n/**\n * Convert a Uint8Array to base64-encoded string\n * @param arrayBuffer - Uint8Array to encode\n * @returns Base64-encoded string\n */\nuint8ArrayToBase64(arrayBuffer: Uint8Array): string\n\n/**\n * Get email from workspace username\n * This method is particularly useful for apps that require the email address of the viewer.\n * Indeed, in the viewer context, WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.\n * @param username\n * @returns email address\n */\nasync usernameToEmail(username: string): Promise<string>\n\n/**\n * Sends an interactive approval request via Slack, allowing optional customization of the message, approver, and form fields.\n * \n * **[Enterprise Edition Only]** To include form fields in the Slack approval request, go to **Advanced -> Suspend -> Form**\n * and define a form. Learn more at [Windmill Documentation](https://www.windmill.dev/docs/flows/flow_approval#form).\n * \n * @param {Object} options - The configuration options for the Slack approval request.\n * @param {string} options.slackResourcePath - The path to the Slack resource in Windmill.\n * @param {string} options.channelId - The Slack channel ID where the approval request will be sent.\n * @param {string} [options.message] - Optional custom message to include in the Slack approval request.\n * @param {string} [options.approver] - Optional user ID or name of the approver for the request.\n * @param {DefaultArgs} [options.defaultArgsJson] - Optional object defining or overriding the default arguments to a form field.\n * @param {Enums} [options.dynamicEnumsJson] - Optional object overriding the enum default values of an enum form field.\n * @param {string} [options.resumeButtonText] - Optional text for the resume button.\n * @param {string} [options.cancelButtonText] - Optional text for the cancel button.\n * \n * @returns {Promise<void>} Resolves when the Slack approval request is successfully sent.\n * \n * @throws {Error} If the function is not called within a flow or flow preview.\n * @throws {Error} If the `JobService.getSlackApprovalPayload` call fails.\n * \n * **Usage Example:**\n * ```typescript\n * await requestInteractiveSlackApproval({\n *   slackResourcePath: \"/u/alex/my_slack_resource\",\n *   channelId: \"admins-slack-channel\",\n *   message: \"Please approve this request\",\n *   approver: \"approver123\",\n *   defaultArgsJson: { key1: \"value1\", key2: 42 },\n *   dynamicEnumsJson: { foo: [\"choice1\", \"choice2\"], bar: [\"optionA\", \"optionB\"] },\n *   resumeButtonText: \"Resume\",\n *   cancelButtonText: \"Cancel\",\n * });\n * ```\n * \n * **Note:** This function requires execution within a Windmill flow or flow preview.\n */\nasync requestInteractiveSlackApproval({ slackResourcePath, channelId, message, approver, defaultArgsJson, dynamicEnumsJson, resumeButtonText, cancelButtonText, }: SlackApprovalOptions): Promise<void>\n\n/**\n * Sends an interactive approval request via Teams, allowing optional customization of the message, approver, and form fields.\n * \n * **[Enterprise Edition Only]** To include form fields in the Teams approval request, go to **Advanced -> Suspend -> Form**\n * and define a form. Learn more at [Windmill Documentation](https://www.windmill.dev/docs/flows/flow_approval#form).\n * \n * @param {Object} options - The configuration options for the Teams approval request.\n * @param {string} options.teamName - The Teams team name where the approval request will be sent.\n * @param {string} options.channelName - The Teams channel name where the approval request will be sent.\n * @param {string} [options.message] - Optional custom message to include in the Teams approval request.\n * @param {string} [options.approver] - Optional user ID or name of the approver for the request.\n * @param {DefaultArgs} [options.defaultArgsJson] - Optional object defining or overriding the default arguments to a form field.\n * @param {Enums} [options.dynamicEnumsJson] - Optional object overriding the enum default values of an enum form field.\n * \n * @returns {Promise<void>} Resolves when the Teams approval request is successfully sent.\n * \n * @throws {Error} If the function is not called within a flow or flow preview.\n * @throws {Error} If the `JobService.getTeamsApprovalPayload` call fails.\n * \n * **Usage Example:**\n * ```typescript\n * await requestInteractiveTeamsApproval({\n *   teamName: \"admins-teams\",\n *   channelName: \"admins-teams-channel\",\n *   message: \"Please approve this request\",\n *   approver: \"approver123\",\n *   defaultArgsJson: { key1: \"value1\", key2: 42 },\n *   dynamicEnumsJson: { foo: [\"choice1\", \"choice2\"], bar: [\"optionA\", \"optionB\"] },\n * });\n * ```\n * \n * **Note:** This function requires execution within a Windmill flow or flow preview.\n */\nasync requestInteractiveTeamsApproval({ teamName, channelName, message, approver, defaultArgsJson, dynamicEnumsJson, }: TeamsApprovalOptions): Promise<void>\n\n/**\n * Parse an S3 object from URI string or record format\n * @param s3Object - S3 object as URI string (s3://storage/key) or record\n * @returns S3 object record with storage and s3 key\n */\nparseS3Object(s3Object: S3Object): S3ObjectRecord\n\nsetWorkflowCtx(ctx: WorkflowCtx | null): void\n\nasync sleep(seconds: number): Promise<void>\n\nasync step<T>(name: string, fn: () => T | Promise<T>): Promise<T>\n\n/**\n * Create a task that dispatches to a separate Windmill script.\n * \n * @example\n * const extract = taskScript(\"f/data/extract\");\n * // inside workflow: await extract({ url: \"https://...\" })\n */\ntaskScript(path: string, options?: TaskOptions): (...args: any[]) => PromiseLike<any>\n\n/**\n * Create a task that dispatches to a separate Windmill flow.\n * \n * @example\n * const pipeline = taskFlow(\"f/etl/pipeline\");\n * // inside workflow: await pipeline({ input: data })\n */\ntaskFlow(path: string, options?: TaskOptions): (...args: any[]) => PromiseLike<any>\n\n/**\n * Mark an async function as a workflow-as-code entry point.\n * \n * The function must be **deterministic**: given the same inputs it must call\n * tasks in the same order on every replay. Branching on task results is fine\n * (results are replayed from checkpoint), but branching on external state\n * (current time, random values, external API calls) must use `step()` to\n * checkpoint the value so replays see the same result.\n */\nworkflow<T>(fn: (...args: any[]) => Promise<T>): void\n\n/**\n * Suspend the workflow and wait for an external approval.\n * \n * Use `getResumeUrls()` (wrapped in `step()`) to obtain resume/cancel/approvalPage\n * URLs before calling this function.\n * \n * @example\n * const urls = await step(\"urls\", () => getResumeUrls());\n * await step(\"notify\", () => sendEmail(urls.approvalPage));\n * const { value, approver } = await waitForApproval({ timeout: 3600 });\n */\nwaitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; }): PromiseLike<{ value: any; approver: string; approved: boolean }>\n\n/**\n * Process items in parallel with optional concurrency control.\n * \n * Each item is processed by calling `fn(item)`, which should be a task().\n * Items are dispatched in batches of `concurrency` (default: all at once).\n * \n * @example\n * const process = task(async (item: string) => { ... });\n * const results = await parallel(items, process, { concurrency: 5 });\n */\nasync parallel<T, R>(items: T[], fn: (item: T) => PromiseLike<R> | R, options?: { concurrency?: number },): Promise<R[]>\n\n/**\n * Commit Kafka offsets for a trigger with auto_commit disabled.\n * @param triggerPath - Path to the Kafka trigger (from event.wm_trigger.trigger_path)\n * @param topic - Kafka topic name (from event.topic)\n * @param partition - Partition number (from event.partition)\n * @param offset - Message offset to commit (from event.offset)\n */\nasync commitKafkaOffsets(triggerPath: string, topic: string, partition: number, offset: number,): Promise<void>\n\n/**\n * Create a SQL template function for PostgreSQL/datatable queries\n * @param name - Database/datatable name (default: \"main\")\n * @returns SQL template function for building parameterized queries\n * @example\n * let sql = wmill.datatable()\n * let name = 'Robin'\n * let age = 21\n * await sql`\n *   SELECT * FROM friends\n *     WHERE name = ${name} AND age = ${age}::int\n * `.fetch()\n */\ndatatable(name: string = \"main\"): DatatableSqlTemplateFunction\n\n/**\n * Create a SQL template function for DuckDB/ducklake queries\n * @param name - DuckDB database name (default: \"main\")\n * @returns SQL template function for building parameterized queries\n * @example\n * let sql = wmill.ducklake()\n * let name = 'Robin'\n * let age = 21\n * await sql`\n *   SELECT * FROM friends\n *     WHERE name = ${name} AND age = ${age}\n * `.fetch()\n */\nducklake(name: string = \"main\"): SqlTemplateFunction\n";
 export declare const SDK_PYTHON = "# Python SDK (wmill)\n\nImport: import wmill\n\ndef worker_has_internal_server() -> bool\n\ndef get_mocked_api() -> Optional[dict]\n\n# Get the HTTP client instance.\n# \n# Returns:\n#     Configured httpx.Client for API requests\ndef get_client() -> httpx.Client\n\n# Make an HTTP GET request to the Windmill API.\n# \n# Args:\n#     endpoint: API endpoint path\n#     raise_for_status: Whether to raise an exception on HTTP errors\n#     **kwargs: Additional arguments passed to httpx.get\n# \n# Returns:\n#     HTTP response object\ndef get(endpoint, raise_for_status = True, **kwargs) -> httpx.Response\n\n# Make an HTTP POST request to the Windmill API.\n# \n# Args:\n#     endpoint: API endpoint path\n#     raise_for_status: Whether to raise an exception on HTTP errors\n#     **kwargs: Additional arguments passed to httpx.post\n# \n# Returns:\n#     HTTP response object\ndef post(endpoint, raise_for_status = True, **kwargs) -> httpx.Response\n\n# Create a new authentication token.\n# \n# Args:\n#     duration: Token validity duration (default: 1 day)\n# \n# Returns:\n#     New authentication token string\ndef create_token(duration = dt.timedelta(days=1)) -> str\n\n# Create a script job and return its job id.\n# \n# .. deprecated:: Use run_script_by_path_async or run_script_by_hash_async instead.\ndef run_script_async(path: str = None, hash_: str = None, args: dict = None, scheduled_in_secs: int = None) -> str\n\n# Create a script job by path and return its job id.\ndef run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None) -> str\n\n# Create a script job by hash and return its job id.\ndef run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None) -> str\n\n# Create a flow job and return its job id.\ndef run_flow_async(path: str, args: dict = None, scheduled_in_secs: int = None, do_not_track_in_parent: bool = True) -> str\n\n# Run script synchronously and return its result.\n# \n# .. deprecated:: Use run_script_by_path or run_script_by_hash instead.\ndef run_script(path: str = None, hash_: str = None, args: dict = None, timeout: dt.timedelta | int | float | None = None, verbose: bool = False, cleanup: bool = True, assert_result_is_not_none: bool = False) -> Any\n\n# Run script by path synchronously and return its result.\ndef run_script_by_path(path: str, args: dict = None, timeout: dt.timedelta | int | float | None = None, verbose: bool = False, cleanup: bool = True, assert_result_is_not_none: bool = False) -> Any\n\n# Run script by hash synchronously and return its result.\ndef run_script_by_hash(hash_: str, args: dict = None, timeout: dt.timedelta | int | float | None = None, verbose: bool = False, cleanup: bool = True, assert_result_is_not_none: bool = False) -> Any\n\n# Run a script on the current worker without creating a job.\n# \n# On agent workers (no internal server), falls back to running a normal\n# preview job and waiting for the result.\ndef run_inline_script_preview(content: str, language: str, args: dict = None) -> Any\n\n# Wait for a job to complete and return its result.\n# \n# Args:\n#     job_id: ID of the job to wait for\n#     timeout: Maximum time to wait (seconds or timedelta)\n#     verbose: Enable verbose logging\n#     cleanup: Register cleanup handler to cancel job on exit\n#     assert_result_is_not_none: Raise exception if result is None\n# \n# Returns:\n#     Job result when completed\n# \n# Raises:\n#     TimeoutError: If timeout is reached\n#     Exception: If job fails\ndef wait_job(job_id, timeout: dt.timedelta | int | float | None = None, verbose: bool = False, cleanup: bool = True, assert_result_is_not_none: bool = False)\n\n# Cancel a specific job by ID.\n# \n# Args:\n#     job_id: UUID of the job to cancel\n#     reason: Optional reason for cancellation\n# \n# Returns:\n#     Response message from the cancel endpoint\ndef cancel_job(job_id: str, reason: str = None) -> str\n\n# Cancel currently running executions of the same script.\ndef cancel_running() -> dict\n\n# Get job details by ID.\n# \n# Args:\n#     job_id: UUID of the job\n# \n# Returns:\n#     Job details dictionary\ndef get_job(job_id: str) -> dict\n\n# Get the root job ID for a flow hierarchy.\n# \n# Args:\n#     job_id: Job ID (defaults to current WM_JOB_ID)\n# \n# Returns:\n#     Root job ID\ndef get_root_job_id(job_id: str | None = None) -> dict\n\n# Get an OIDC JWT token for authentication to external services.\n# \n# Args:\n#     audience: Token audience (e.g., \"vault\", \"aws\")\n#     expires_in: Optional expiration time in seconds\n# \n# Returns:\n#     JWT token string\ndef get_id_token(audience: str, expires_in: int | None = None) -> str\n\n# Get the status of a job.\n# \n# Args:\n#     job_id: UUID of the job\n# \n# Returns:\n#     Job status: \"RUNNING\", \"WAITING\", or \"COMPLETED\"\ndef get_job_status(job_id: str) -> JobStatus\n\n# Get the result of a completed job.\n# \n# Args:\n#     job_id: UUID of the completed job\n#     assert_result_is_not_none: Raise exception if result is None\n# \n# Returns:\n#     Job result\ndef get_result(job_id: str, assert_result_is_not_none: bool = True) -> Any\n\n# Get a variable value by path.\n# \n# Args:\n#     path: Variable path in Windmill\n# \n# Returns:\n#     Variable value as string\ndef get_variable(path: str) -> str\n\n# Set a variable value by path, creating it if it doesn't exist.\n# \n# Args:\n#     path: Variable path in Windmill\n#     value: Variable value to set\n#     is_secret: Whether the variable should be secret (default: False)\ndef set_variable(path: str, value: str, is_secret: bool = False) -> None\n\n# Get a resource value by path.\n# \n# Args:\n#     path: Resource path in Windmill\n#     none_if_undefined: Return None instead of raising if not found\n#     interpolated: if variables and resources are fully unrolled\n# \n# Returns:\n#     Resource value dictionary or None\ndef get_resource(path: str, none_if_undefined: bool = False, interpolated: bool = True) -> dict | None\n\n# Set a resource value by path, creating it if it doesn't exist.\n# \n# Args:\n#     value: Resource value to set\n#     path: Resource path in Windmill\n#     resource_type: Resource type for creation\ndef set_resource(value: Any, path: str, resource_type: str)\n\n# List resources from Windmill workspace.\n# \n# Args:\n#     resource_type: Optional resource type to filter by (e.g., \"postgresql\", \"mysql\", \"s3\")\n#     page: Optional page number for pagination\n#     per_page: Optional number of results per page\n#     \n# Returns:\n#     List of resource dictionaries\ndef list_resources(resource_type: str = None, page: int = None, per_page: int = None) -> list[dict]\n\n# Set the workflow state.\n# \n# Args:\n#     value: State value to set\n#     path: Optional state resource path override.\ndef set_state(value: Any, path: str | None = None) -> None\n\n# Get the workflow state.\n# \n# Args:\n#     path: Optional state resource path override.\n# \n# Returns:\n#     State value or None if not set\ndef get_state(path: str | None = None) -> Any\n\n# Set job progress percentage (0-99).\n# \n# Args:\n#     value: Progress percentage\n#     job_id: Job ID (defaults to current WM_JOB_ID)\ndef set_progress(value: int, job_id: Optional[str] = None)\n\n# Get job progress percentage.\n# \n# Args:\n#     job_id: Job ID (defaults to current WM_JOB_ID)\n# \n# Returns:\n#     Progress value (0-100) or None if not set\ndef get_progress(job_id: Optional[str] = None) -> Any\n\n# Set the user state of a flow at a given key\ndef set_flow_user_state(key: str, value: Any) -> None\n\n# Get the user state of a flow at a given key\ndef get_flow_user_state(key: str) -> Any\n\n# Get the Windmill server version.\n# \n# Returns:\n#     Version string\ndef version()\n\n# Convenient helpers that takes an S3 resource as input and returns the settings necessary to\n# initiate an S3 connection from DuckDB\ndef get_duckdb_connection_settings(s3_resource_path: str = '') -> DuckDbConnectionSettings | None\n\n# Convenient helpers that takes an S3 resource as input and returns the settings necessary to\n# initiate an S3 connection from Polars\ndef get_polars_connection_settings(s3_resource_path: str = '') -> PolarsConnectionSettings\n\n# Convenient helpers that takes an S3 resource as input and returns the settings necessary to\n# initiate an S3 connection using boto3\ndef get_boto3_connection_settings(s3_resource_path: str = '') -> Boto3ConnectionSettings\n\n# Load a file from the workspace s3 bucket and returns its content as bytes.\n# \n# '''python\n# from wmill import S3Object\n# \n# s3_obj = S3Object(s3=\"/path/to/my_file.txt\")\n# my_obj_content = client.load_s3_file(s3_obj)\n# file_content = my_obj_content.decode(\"utf-8\")\n# '''\ndef load_s3_file(s3object: S3Object | str, s3_resource_path: str | None) -> bytes\n\n# Load a file from the workspace s3 bucket and returns the bytes stream.\n# \n# '''python\n# from wmill import S3Object\n# \n# s3_obj = S3Object(s3=\"/path/to/my_file.txt\")\n# with wmill.load_s3_file_reader(s3object, s3_resource_path) as file_reader:\n#     print(file_reader.read())\n# '''\ndef load_s3_file_reader(s3object: S3Object | str, s3_resource_path: str | None) -> BufferedReader\n\n# Write a file to the workspace S3 bucket\n# \n# '''python\n# from wmill import S3Object\n# \n# s3_obj = S3Object(s3=\"/path/to/my_file.txt\")\n# \n# # for an in memory bytes array:\n# file_content = b'Hello Windmill!'\n# client.write_s3_file(s3_obj, file_content)\n# \n# # for a file:\n# with open(\"my_file.txt\", \"rb\") as my_file:\n#     client.write_s3_file(s3_obj, my_file)\n# '''\ndef write_s3_file(s3object: S3Object | str | None, file_content: BufferedReader | bytes, s3_resource_path: str | None, content_type: str | None = None, content_disposition: str | None = None) -> S3Object\n\n# Permanently delete a file from the workspace S3 bucket.\n# \n# '''python\n# from wmill import S3Object\n# \n# s3_obj = S3Object(s3=\"/path/to/my_file.txt\")\n# client.delete_s3_object(s3_obj)\n# '''\ndef delete_s3_object(s3object: S3Object | str, s3_resource_path: str | None = None) -> None\n\n# Sign S3 objects for use by anonymous users in public apps.\n# \n# Args:\n#     s3_objects: List of S3 objects to sign\n# \n# Returns:\n#     List of signed S3 objects\ndef sign_s3_objects(s3_objects: list[S3Object | str]) -> list[S3Object]\n\n# Sign a single S3 object for use by anonymous users in public apps.\n# \n# Args:\n#     s3_object: S3 object to sign\n# \n# Returns:\n#     Signed S3 object\ndef sign_s3_object(s3_object: S3Object | str) -> S3Object\n\n# Generate presigned public URLs for an array of S3 objects.\n# If an S3 object is not signed yet, it will be signed first.\n# \n# Args:\n#     s3_objects: List of S3 objects to sign\n#     base_url: Optional base URL for the presigned URLs (defaults to WM_BASE_URL)\n# \n# Returns:\n#     List of signed public URLs\n# \n# Example:\n#     >>> s3_objs = [S3Object(s3=\"/path/to/file1.txt\"), S3Object(s3=\"/path/to/file2.txt\")]\n#     >>> urls = client.get_presigned_s3_public_urls(s3_objs)\ndef get_presigned_s3_public_urls(s3_objects: list[S3Object | str], base_url: str | None = None) -> list[str]\n\n# Generate a presigned public URL for an S3 object.\n# If the S3 object is not signed yet, it will be signed first.\n# \n# Args:\n#     s3_object: S3 object to sign\n#     base_url: Optional base URL for the presigned URL (defaults to WM_BASE_URL)\n# \n# Returns:\n#     Signed public URL\n# \n# Example:\n#     >>> s3_obj = S3Object(s3=\"/path/to/file.txt\")\n#     >>> url = client.get_presigned_s3_public_url(s3_obj)\ndef get_presigned_s3_public_url(s3_object: S3Object | str, base_url: str | None = None) -> str\n\n# Get the current user information.\n# \n# Returns:\n#     User details dictionary\ndef whoami() -> dict\n\n# Get the current user information (alias for whoami).\n# \n# Returns:\n#     User details dictionary\ndef user() -> dict\n\n# Get the state resource path from environment.\n# \n# Returns:\n#     State path string\ndef state_path() -> str\n\n# Get the workflow state.\n# \n# Returns:\n#     State value or None if not set\ndef state() -> Any\n\n# Set the state in the shared folder using pickle\ndef set_shared_state_pickle(value: Any, path: str = 'state.pickle') -> None\n\n# Get the state in the shared folder using pickle\ndef get_shared_state_pickle(path: str = 'state.pickle') -> Any\n\n# Set the state in the shared folder using pickle\ndef set_shared_state(value: Any, path: str = 'state.json') -> None\n\n# Get the state in the shared folder using pickle\ndef get_shared_state(path: str = 'state.json') -> None\n\n# Get URLs needed for resuming a flow after suspension.\n# \n# Args:\n#     approver: Optional approver name\n#     flow_level: If True, generate resume URLs for the parent flow instead of the\n#         specific step. This allows pre-approvals that can be consumed by any later\n#         suspend step in the same flow.\n# \n# Returns:\n#     Dictionary with approvalPage, resume, and cancel URLs\ndef get_resume_urls(approver: str = None, flow_level: bool = None) -> dict\n\n# Sends an interactive approval request via Slack, allowing optional customization of the message, approver, and form fields.\n# \n# **[Enterprise Edition Only]** To include form fields in the Slack approval request, use the \"Advanced -> Suspend -> Form\" functionality.\n# Learn more at: https://www.windmill.dev/docs/flows/flow_approval#form\n# \n# :param slack_resource_path: The path to the Slack resource in Windmill.\n# :type slack_resource_path: str\n# :param channel_id: The Slack channel ID where the approval request will be sent.\n# :type channel_id: str\n# :param message: Optional custom message to include in the Slack approval request.\n# :type message: str, optional\n# :param approver: Optional user ID or name of the approver for the request.\n# :type approver: str, optional\n# :param default_args_json: Optional dictionary defining or overriding the default arguments for form fields.\n# :type default_args_json: dict, optional\n# :param dynamic_enums_json: Optional dictionary overriding the enum default values of enum form fields.\n# :type dynamic_enums_json: dict, optional\n# \n# :raises Exception: If the function is not called within a flow or flow preview.\n# :raises Exception: If the required flow job or flow step environment variables are not set.\n# \n# :return: None\n# \n# **Usage Example:**\n#     >>> client.request_interactive_slack_approval(\n#     ...     slack_resource_path=\"/u/alex/my_slack_resource\",\n#     ...     channel_id=\"admins-slack-channel\",\n#     ...     message=\"Please approve this request\",\n#     ...     approver=\"approver123\",\n#     ...     default_args_json={\"key1\": \"value1\", \"key2\": 42},\n#     ...     dynamic_enums_json={\"foo\": [\"choice1\", \"choice2\"], \"bar\": [\"optionA\", \"optionB\"]},\n#     ... )\n# \n# **Notes:**\n# - This function must be executed within a Windmill flow or flow preview.\n# - The function checks for required environment variables (`WM_FLOW_JOB_ID`, `WM_FLOW_STEP_ID`) to ensure it is run in the appropriate context.\ndef request_interactive_slack_approval(slack_resource_path: str, channel_id: str, message: str = None, approver: str = None, default_args_json: dict = None, dynamic_enums_json: dict = None) -> None\n\n# Get email from workspace username\n# This method is particularly useful for apps that require the email address of the viewer.\n# Indeed, in the viewer context WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.\ndef username_to_email(username: str) -> str\n\n# Send a message to a Microsoft Teams conversation with conversation_id, where success is used to style the message\ndef send_teams_message(conversation_id: str, text: str, success: bool = True, card_block: dict = None)\n\n# Get a DataTable client for SQL queries.\n# \n# Args:\n#     name: Database name (default: \"main\")\n# \n# Returns:\n#     DataTableClient instance\ndef datatable(name: str = 'main')\n\n# Get a DuckLake client for DuckDB queries.\n# \n# Args:\n#     name: Database name (default: \"main\")\n# \n# Returns:\n#     DucklakeClient instance\ndef ducklake(name: str = 'main')\n\ndef init_global_client(f)\n\ndef deprecate(in_favor_of: str)\n\n# Get the current workspace ID.\n# \n# Returns:\n#     Workspace ID string\ndef get_workspace() -> str\n\ndef get_version() -> str\n\n# Run a script synchronously by hash and return its result.\n# \n# Args:\n#     hash: Script hash\n#     args: Script arguments\n#     verbose: Enable verbose logging\n#     assert_result_is_not_none: Raise exception if result is None\n#     cleanup: Register cleanup handler to cancel job on exit\n#     timeout: Maximum time to wait\n# \n# Returns:\n#     Script result\ndef run_script_sync(hash: str, args: Dict[str, Any] = None, verbose: bool = False, assert_result_is_not_none: bool = True, cleanup: bool = True, timeout: dt.timedelta = None) -> Any\n\n# Run a script synchronously by path and return its result.\n# \n# Args:\n#     path: Script path\n#     args: Script arguments\n#     verbose: Enable verbose logging\n#     assert_result_is_not_none: Raise exception if result is None\n#     cleanup: Register cleanup handler to cancel job on exit\n#     timeout: Maximum time to wait\n# \n# Returns:\n#     Script result\ndef run_script_by_path_sync(path: str, args: Dict[str, Any] = None, verbose: bool = False, assert_result_is_not_none: bool = True, cleanup: bool = True, timeout: dt.timedelta = None) -> Any\n\n# Convenient helpers that takes an S3 resource as input and returns the settings necessary to\n# initiate an S3 connection from DuckDB\ndef duckdb_connection_settings(s3_resource_path: str = '') -> DuckDbConnectionSettings\n\n# Convenient helpers that takes an S3 resource as input and returns the settings necessary to\n# initiate an S3 connection from Polars\ndef polars_connection_settings(s3_resource_path: str = '') -> PolarsConnectionSettings\n\n# Convenient helpers that takes an S3 resource as input and returns the settings necessary to\n# initiate an S3 connection using boto3\ndef boto3_connection_settings(s3_resource_path: str = '') -> Boto3ConnectionSettings\n\n# Get the state resource path from environment.\n# \n# Returns:\n#     State path string\ndef get_state_path() -> str\n\n# Parse resource syntax from string.\ndef parse_resource_syntax(s: str) -> Optional[str]\n\n# Parse S3 object from string or S3Object format.\ndef parse_s3_object(s3_object: S3Object | str) -> S3Object\n\n# Parse variable syntax from string.\ndef parse_variable_syntax(s: str) -> Optional[str]\n\n# Append a text to the result stream.\n# \n# Args:\n#     text: text to append to the result stream\ndef append_to_result_stream(text: str) -> None\n\n# Stream to the result stream.\n# \n# Args:\n#     stream: stream to stream to the result stream\ndef stream_result(stream) -> None\n\n# Execute a SQL query against the DataTable.\n# \n# Args:\n#     sql: SQL query string with $1, $2, etc. placeholders\n#     *args: Positional arguments to bind to query placeholders\n# \n# Returns:\n#     SqlQuery instance for fetching results\ndef query(sql: str, *args) -> SqlQuery\n\n# Execute query and fetch results.\n# \n# Args:\n#     result_collection: Optional result collection mode\n# \n# Returns:\n#     Query results\ndef fetch(result_collection: str | None = None)\n\n# Execute query and fetch first row of results.\n# \n# Returns:\n#     First row of query results\ndef fetch_one()\n\n# Execute query and fetch first row of results. Return result as a scalar value.\n# \n# Returns:\n#     First row of query result as a scalar value\ndef fetch_one_scalar()\n\n# Execute query and don't return any results.\n#         \ndef execute()\n\n# DuckDB executor requires explicit argument types at declaration\n# These types exist in both DuckDB and Postgres\n# Check that the types exist if you plan to extend this function for other SQL engines.\ndef infer_sql_type(value) -> str\n\ndef parse_sql_client_name(name: str) -> tuple[str, Optional[str]]\n\n# Decorator that marks a function as a workflow task.\n# \n# Works in both WAC v1 (sync, HTTP-based dispatch) and WAC v2\n# (async, checkpoint/replay) modes:\n# \n# - **v2 (inside @workflow)**: dispatches as a checkpoint step.\n# - **v1 (WM_JOB_ID set, no @workflow)**: dispatches via HTTP API.\n# - **Standalone**: executes the function body directly.\n# \n# Usage::\n# \n#     @task\n#     async def extract_data(url: str): ...\n# \n#     @task(path=\"f/external_script\", timeout=600, tag=\"gpu\")\n#     async def run_external(x: int): ...\ndef task(_func = None, path: Optional[str] = None, tag: Optional[str] = None, timeout: Optional[int] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None)\n\n# Create a task that dispatches to a separate Windmill script.\n# \n# Usage::\n# \n#     extract = task_script(\"f/data/extract\", timeout=600)\n# \n#     @workflow\n#     async def main():\n#         data = await extract(url=\"https://...\")\ndef task_script(path: str, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None)\n\n# Create a task that dispatches to a separate Windmill flow.\n# \n# Usage::\n# \n#     pipeline = task_flow(\"f/etl/pipeline\", priority=10)\n# \n#     @workflow\n#     async def main():\n#         result = await pipeline(input=data)\ndef task_flow(path: str, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None)\n\n# Decorator marking an async function as a workflow-as-code entry point.\n# \n# The function must be **deterministic**: given the same inputs it must call\n# tasks in the same order on every replay. Branching on task results is fine\n# (results are replayed from checkpoint), but branching on external state\n# (current time, random values, external API calls) must use ``step()`` to\n# checkpoint the value so replays see the same result.\ndef workflow(func)\n\n# Execute ``fn`` inline and checkpoint the result.\n# \n# On replay the cached value is returned without re-executing ``fn``.\n# Use for lightweight deterministic operations (timestamps, random IDs,\n# config reads) that should not incur the overhead of a child job.\nasync def step(name: str, fn)\n\n# Server-side sleep \u2014 suspend the workflow for the given duration without holding a worker.\n# \n# Inside a @workflow, the parent job suspends and auto-resumes after ``seconds``.\n# Outside a workflow, falls back to ``asyncio.sleep``.\nasync def sleep(seconds: int)\n\n# Suspend the workflow and wait for an external approval.\n# \n# Use ``get_resume_urls()`` (wrapped in ``step()``) to obtain\n# resume/cancel/approval URLs before calling this function.\n# \n# Returns a dict with ``value`` (form data), ``approver``, and ``approved``.\n# \n# Args:\n#     timeout: Approval timeout in seconds (default 1800).\n#     form: Optional form schema for the approval page.\n#     self_approval: Whether the user who triggered the flow can approve it (default True).\n# \n# Example::\n# \n#     urls = await step(\"urls\", lambda: get_resume_urls())\n#     await step(\"notify\", lambda: send_email(urls[\"approvalPage\"]))\n#     result = await wait_for_approval(timeout=3600)\nasync def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True) -> dict\n\n# Process items in parallel with optional concurrency control.\n# \n# Each item is processed by calling ``fn(item)``, which should be a @task.\n# Items are dispatched in batches of ``concurrency`` (default: all at once).\n# \n# Example::\n# \n#     @task\n#     async def process(item: str):\n#         ...\n# \n#     results = await parallel(items, process, concurrency=5)\nasync def parallel(items, fn, concurrency: Optional[int] = None)\n\n# Commit Kafka offsets for a trigger with auto_commit disabled.\n# \n# Args:\n#     trigger_path: Path to the Kafka trigger (from event['wm_trigger']['trigger_path'])\n#     topic: Kafka topic name (from event['topic'])\n#     partition: Partition number (from event['partition'])\n#     offset: Message offset to commit (from event['offset'])\ndef commit_kafka_offsets(trigger_path: str, topic: str, partition: int, offset: int) -> None\n\n";
@@ -9,24 +9,24 @@ export declare const WAC_SDK_PYTHON = "## Python Workflow-as-Code API (wmill)\n\
 export declare const DATATABLE_SDK_TYPESCRIPT = "## TypeScript Datatable API (windmill-client)\n\nImport: `import * as wmill from 'windmill-client'`\n\nSQL statement object with query content, arguments, and execution methods\n```typescript\ntype SqlStatement<T> = {\n  /** Raw SQL content with formatted arguments */\n  content: string;\n\n  /** Argument values keyed by parameter name */\n  args: Record<string, any>;\n\n  /**\n  * Execute the SQL query and return results\n  * @param params - Optional parameters including result collection mode\n  * @returns Query results based on the result collection mode\n  */\n  fetch<ResultCollectionT extends ResultCollection = \"last_statement_all_rows\">(\n  params?: FetchParams<ResultCollectionT | ResultCollection> // The union is for auto-completion\n  ): Promise<SqlResult<T, ResultCollectionT>>;\n\n  /**\n  * Execute the SQL query and return only the first row\n  * @param params - Optional parameters\n  * @returns First row of the query result\n  */\n  fetchOne(\n  params?: Omit<FetchParams<\"last_statement_first_row\">, \"resultCollection\">\n  ): Promise<SqlResult<T, \"last_statement_first_row\">>;\n\n  /**\n  * Execute the SQL query and return only the first row as a scalar value\n  * @param params - Optional parameters\n  * @returns First row of the query result\n  */\n  fetchOneScalar(\n  params?: Omit<\n  FetchParams<\"last_statement_first_row_scalar\">,\n  \"resultCollection\"\n  >\n  ): Promise<SqlResult<T, \"last_statement_first_row_scalar\">>;\n\n  /**\n  * Execute the SQL query without fetching rows\n  * @param params - Optional parameters\n  */\n  execute(\n  params?: Omit<FetchParams<\"last_statement_first_row\">, \"resultCollection\">\n  ): Promise<void>;\n};\n```\n\n```typescript\n// Template tag function: sql`SELECT * FROM table WHERE id = ${id}`.fetch()\ninterface DatatableSqlTemplateFunction {\n  // Tagged template usage:\n  <T = any>(strings: TemplateStringsArray, ...values: any[]): SqlStatement<T>;\n  query<T = any>(sql: string, ...params: any[]): SqlStatement<T>;\n};\n```\n\nCreate a SQL template function for PostgreSQL/datatable queries\n@param name - Database/datatable name (default: \"main\")\n@returns SQL template function for building parameterized queries\n@example\nlet sql = wmill.datatable()\nlet name = 'Robin'\nlet age = 21\nawait sql`\n  SELECT * FROM friends\n    WHERE name = ${name} AND age = ${age}::int\n`.fetch()\n```typescript\nfunction datatable(name: string = \"main\"): DatatableSqlTemplateFunction\n```\n";
 export declare const DATATABLE_SDK_PYTHON = "## Python Datatable API (wmill)\n\nImport: `import wmill`\n\n# Get a DataTable client for SQL queries.\n# \n# Args:\n#     name: Database name (default: \"main\")\n# \n# Returns:\n#     DataTableClient instance\ndef datatable(name: str = 'main') -> DataTableClient\n\n# Client for executing SQL queries against Windmill DataTables.\nclass DataTableClient:\n    # Initialize DataTableClient.\n    # \n    # Args:\n    #     client: Windmill client instance\n    #     name: DataTable name\n    def __init__(client: Windmill, name: str)\n\n    # Execute a SQL query against the DataTable.\n    # \n    # Args:\n    #     sql: SQL query string with $1, $2, etc. placeholders\n    #     *args: Positional arguments to bind to query placeholders\n    # \n    # Returns:\n    #     SqlQuery instance for fetching results\n    def query(sql: str, *args) -> SqlQuery\n\n\n# Query result handler for DataTable and DuckLake queries.\nclass SqlQuery:\n    # Initialize SqlQuery.\n    # \n    # Args:\n    #     sql: SQL query string\n    #     fetch_fn: Function to execute the query\n    def __init__(sql: str, fetch_fn)\n\n    # Execute query and fetch results.\n    # \n    # Args:\n    #     result_collection: Optional result collection mode\n    # \n    # Returns:\n    #     Query results\n    def fetch(result_collection: str | None = None)\n\n    # Execute query and fetch first row of results.\n    # \n    # Returns:\n    #     First row of query results\n    def fetch_one()\n\n    # Execute query and fetch first row of results. Return result as a scalar value.\n    # \n    # Returns:\n    #     First row of query result as a scalar value\n    def fetch_one_scalar()\n\n    # Execute query and don't return any results.\n    #         \n    def execute()\n\n\n";
 export declare const OPENFLOW_SCHEMA = "## OpenFlow Schema\n\n{\"OpenFlow\":{\"type\":\"object\",\"description\":\"Top-level flow definition containing metadata, configuration, and the flow structure\",\"properties\":{\"summary\":{\"type\":\"string\",\"description\":\"Short description of what this flow does\"},\"description\":{\"type\":\"string\",\"description\":\"Detailed documentation for this flow\"},\"value\":{\"$ref\":\"#/components/schemas/FlowValue\"},\"schema\":{\"type\":\"object\",\"description\":\"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')\"},\"on_behalf_of_email\":{\"type\":\"string\",\"description\":\"The flow will be run with the permissions of the user with this email.\"}},\"required\":[\"summary\",\"value\"]},\"FlowValue\":{\"type\":\"object\",\"description\":\"The flow structure containing modules and optional preprocessor/failure handlers\",\"properties\":{\"modules\":{\"type\":\"array\",\"description\":\"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch\",\"items\":{\"$ref\":\"#/components/schemas/FlowModule\"}},\"failure_module\":{\"description\":\"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types\",\"$ref\":\"#/components/schemas/FlowModule\"},\"preprocessor_module\":{\"description\":\"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results\",\"$ref\":\"#/components/schemas/FlowModule\"},\"same_worker\":{\"type\":\"boolean\",\"description\":\"If true, all steps run on the same worker for better performance\"},\"concurrent_limit\":{\"type\":\"number\",\"description\":\"Maximum number of concurrent executions of this flow\"},\"concurrency_key\":{\"type\":\"string\",\"description\":\"Expression to group concurrent executions (e.g., by user ID)\"},\"concurrency_time_window_s\":{\"type\":\"number\",\"description\":\"Time window in seconds for concurrent_limit\"},\"debounce_delay_s\":{\"type\":\"integer\",\"description\":\"Delay in seconds to debounce flow executions\"},\"debounce_key\":{\"type\":\"string\",\"description\":\"Expression to group debounced executions\"},\"debounce_args_to_accumulate\":{\"type\":\"array\",\"description\":\"Arguments to accumulate across debounced executions\",\"items\":{\"type\":\"string\"}},\"max_total_debouncing_time\":{\"type\":\"integer\",\"description\":\"Maximum total time in seconds that a job can be debounced\"},\"max_total_debounces_amount\":{\"type\":\"integer\",\"description\":\"Maximum number of times a job can be debounced\"},\"skip_expr\":{\"type\":\"string\",\"description\":\"JavaScript expression to conditionally skip the entire flow\"},\"cache_ttl\":{\"type\":\"number\",\"description\":\"Cache duration in seconds for flow results\"},\"cache_ignore_s3_path\":{\"type\":\"boolean\"},\"delete_after_secs\":{\"type\":\"integer\",\"description\":\"If set, delete the flow job's args, result and logs after this many seconds following job completion\"},\"flow_env\":{\"type\":\"object\",\"description\":\"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).\",\"additionalProperties\":{}},\"priority\":{\"type\":\"number\",\"description\":\"Execution priority (higher numbers run first)\"},\"early_return\":{\"type\":\"string\",\"description\":\"JavaScript expression to return early from the flow\"},\"chat_input_enabled\":{\"type\":\"boolean\",\"description\":\"Whether this flow accepts chat-style input\"},\"notes\":{\"type\":\"array\",\"description\":\"Sticky notes attached to the flow\",\"items\":{\"$ref\":\"#/components/schemas/FlowNote\"}},\"groups\":{\"type\":\"array\",\"description\":\"Semantic groups of modules for organizational purposes\",\"items\":{\"$ref\":\"#/components/schemas/FlowGroup\"}}},\"required\":[\"modules\"]},\"Retry\":{\"type\":\"object\",\"description\":\"Retry configuration for failed module executions\",\"properties\":{\"constant\":{\"type\":\"object\",\"description\":\"Retry with constant delay between attempts\",\"properties\":{\"attempts\":{\"type\":\"integer\",\"description\":\"Number of retry attempts\"},\"seconds\":{\"type\":\"integer\",\"description\":\"Seconds to wait between retries\"}}},\"exponential\":{\"type\":\"object\",\"description\":\"Retry with exponential backoff (delay doubles each time)\",\"properties\":{\"attempts\":{\"type\":\"integer\",\"description\":\"Number of retry attempts\"},\"multiplier\":{\"type\":\"integer\",\"description\":\"Multiplier for exponential backoff\"},\"seconds\":{\"type\":\"integer\",\"minimum\":1,\"description\":\"Initial delay in seconds\"},\"random_factor\":{\"type\":\"integer\",\"minimum\":0,\"maximum\":100,\"description\":\"Random jitter percentage (0-100) to avoid thundering herd\"}}},\"retry_if\":{\"$ref\":\"#/components/schemas/RetryIf\"}}},\"FlowNote\":{\"type\":\"object\",\"description\":\"A sticky note attached to a flow for documentation and annotation\",\"properties\":{\"id\":{\"type\":\"string\",\"description\":\"Unique identifier for the note\"},\"text\":{\"type\":\"string\",\"description\":\"Content of the note\"},\"position\":{\"type\":\"object\",\"description\":\"Position of the note in the flow editor\",\"properties\":{\"x\":{\"type\":\"number\",\"description\":\"X coordinate\"},\"y\":{\"type\":\"number\",\"description\":\"Y coordinate\"}},\"required\":[\"x\",\"y\"]},\"size\":{\"type\":\"object\",\"description\":\"Size of the note in the flow editor\",\"properties\":{\"width\":{\"type\":\"number\",\"description\":\"Width in pixels\"},\"height\":{\"type\":\"number\",\"description\":\"Height in pixels\"}},\"required\":[\"width\",\"height\"]},\"color\":{\"type\":\"string\",\"description\":\"Color of the note (e.g., \\\"yellow\\\", \\\"#ffff00\\\")\"},\"type\":{\"type\":\"string\",\"enum\":[\"free\",\"group\"],\"description\":\"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes\"},\"locked\":{\"type\":\"boolean\",\"default\":false,\"description\":\"Whether the note is locked and cannot be edited or moved\"},\"contained_node_ids\":{\"type\":\"array\",\"items\":{\"type\":\"string\"},\"description\":\"For group notes, the IDs of nodes contained within this group\"}},\"required\":[\"id\",\"text\",\"color\",\"type\"]},\"FlowGroup\":{\"type\":\"object\",\"description\":\"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.\",\"properties\":{\"summary\":{\"type\":\"string\",\"description\":\"Display name for this group\"},\"note\":{\"type\":\"string\",\"description\":\"Markdown note shown below the group header\"},\"autocollapse\":{\"type\":\"boolean\",\"default\":false,\"description\":\"If true, this group is collapsed by default in the flow editor. UI hint only.\"},\"start_id\":{\"type\":\"string\",\"description\":\"ID of the first flow module in this group (topological entry point)\"},\"end_id\":{\"type\":\"string\",\"description\":\"ID of the last flow module in this group (topological exit point)\"},\"color\":{\"type\":\"string\",\"description\":\"Color for the group in the flow editor\"}},\"required\":[\"start_id\",\"end_id\"]},\"RetryIf\":{\"type\":\"object\",\"description\":\"Conditional retry based on error or result\",\"properties\":{\"expr\":{\"type\":\"string\",\"description\":\"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables\"}},\"required\":[\"expr\"]},\"StopAfterIf\":{\"type\":\"object\",\"description\":\"Early termination condition for a module\",\"properties\":{\"skip_if_stopped\":{\"type\":\"boolean\",\"description\":\"If true, following steps are skipped when this condition triggers\"},\"expr\":{\"type\":\"string\",\"description\":\"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop\"},\"error_message\":{\"type\":\"string\",\"nullable\":true,\"description\":\"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.\"}},\"required\":[\"expr\"]},\"FlowModule\":{\"type\":\"object\",\"description\":\"A single step in a flow. Can be a script, subflow, loop, or branch\",\"properties\":{\"id\":{\"type\":\"string\",\"description\":\"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)\"},\"value\":{\"$ref\":\"#/components/schemas/FlowModuleValue\"},\"stop_after_if\":{\"description\":\"Early termination condition evaluated after this step completes\",\"$ref\":\"#/components/schemas/StopAfterIf\"},\"stop_after_all_iters_if\":{\"description\":\"For loops only - early termination condition evaluated after all iterations complete\",\"$ref\":\"#/components/schemas/StopAfterIf\"},\"skip_if\":{\"type\":\"object\",\"description\":\"Conditionally skip this step based on previous results or flow inputs\",\"properties\":{\"expr\":{\"type\":\"string\",\"description\":\"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'\"}},\"required\":[\"expr\"]},\"sleep\":{\"description\":\"Delay before executing this step (in seconds or as expression)\",\"$ref\":\"#/components/schemas/InputTransform\"},\"cache_ttl\":{\"type\":\"number\",\"description\":\"Cache duration in seconds for this step's results\"},\"cache_ignore_s3_path\":{\"type\":\"boolean\"},\"timeout\":{\"description\":\"Maximum execution time in seconds (static value or expression)\",\"$ref\":\"#/components/schemas/InputTransform\"},\"delete_after_secs\":{\"type\":\"integer\",\"description\":\"If set, delete the step's args, result and logs after this many seconds following job completion\"},\"summary\":{\"type\":\"string\",\"description\":\"Short description of what this step does\"},\"mock\":{\"type\":\"object\",\"description\":\"Mock configuration for testing without executing the actual step\",\"properties\":{\"enabled\":{\"type\":\"boolean\",\"description\":\"If true, return mock value instead of executing\"},\"return_value\":{\"description\":\"Value to return when mocked\"}}},\"suspend\":{\"type\":\"object\",\"description\":\"Configuration for approval/resume steps that wait for user input\",\"properties\":{\"required_events\":{\"type\":\"integer\",\"description\":\"Number of approvals required before continuing\"},\"timeout\":{\"type\":\"integer\",\"description\":\"Timeout in seconds before auto-continuing or canceling\"},\"resume_form\":{\"type\":\"object\",\"description\":\"Form schema for collecting input when resuming\",\"properties\":{\"schema\":{\"type\":\"object\",\"description\":\"JSON Schema for the resume form\"}}},\"user_auth_required\":{\"type\":\"boolean\",\"description\":\"If true, only authenticated users can approve\"},\"user_groups_required\":{\"description\":\"Expression or list of groups that can approve\",\"$ref\":\"#/components/schemas/InputTransform\"},\"self_approval_disabled\":{\"type\":\"boolean\",\"description\":\"If true, the user who started the flow cannot approve\"},\"hide_cancel\":{\"type\":\"boolean\",\"description\":\"If true, hide the cancel button on the approval form\"},\"continue_on_disapprove_timeout\":{\"type\":\"boolean\",\"description\":\"If true, continue flow on timeout instead of canceling\"}}},\"priority\":{\"type\":\"number\",\"description\":\"Execution priority for this step (higher numbers run first)\"},\"continue_on_error\":{\"type\":\"boolean\",\"description\":\"If true, flow continues even if this step fails\"},\"retry\":{\"description\":\"Retry configuration if this step fails\",\"$ref\":\"#/components/schemas/Retry\"},\"debouncing\":{\"description\":\"Debounce configuration for this step (EE only)\",\"type\":\"object\",\"properties\":{\"debounce_delay_s\":{\"type\":\"integer\",\"description\":\"Delay in seconds to debounce this step's executions across flow runs\"},\"debounce_key\":{\"type\":\"string\",\"description\":\"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>\"},\"debounce_args_to_accumulate\":{\"type\":\"array\",\"description\":\"Array-type arguments to accumulate across debounced executions\",\"items\":{\"type\":\"string\"}},\"max_total_debouncing_time\":{\"type\":\"integer\",\"description\":\"Maximum total time in seconds before forced execution\"},\"max_total_debounces_amount\":{\"type\":\"integer\",\"description\":\"Maximum number of debounces before forced execution\"}}}},\"required\":[\"value\",\"id\"]},\"InputTransform\":{\"description\":\"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs\",\"oneOf\":[{\"$ref\":\"#/components/schemas/StaticTransform\"},{\"$ref\":\"#/components/schemas/JavascriptTransform\"},{\"$ref\":\"#/components/schemas/AiTransform\"}],\"discriminator\":{\"propertyName\":\"type\",\"mapping\":{\"static\":\"#/components/schemas/StaticTransform\",\"javascript\":\"#/components/schemas/JavascriptTransform\",\"ai\":\"#/components/schemas/AiTransform\"}}},\"StaticTransform\":{\"type\":\"object\",\"description\":\"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'\",\"properties\":{\"value\":{\"description\":\"The static value. For resources, use format '$res:path/to/resource'\"},\"type\":{\"type\":\"string\",\"enum\":[\"static\"]}},\"required\":[\"type\"]},\"JavascriptTransform\":{\"type\":\"object\",\"description\":\"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside loops, use 'flow_input.iter.value' for the current iteration value\",\"properties\":{\"expr\":{\"type\":\"string\",\"description\":\"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)\"},\"type\":{\"type\":\"string\",\"enum\":[\"javascript\"]}},\"required\":[\"expr\",\"type\"]},\"AiTransform\":{\"type\":\"object\",\"description\":\"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.\",\"properties\":{\"type\":{\"type\":\"string\",\"enum\":[\"ai\"]}},\"required\":[\"type\"]},\"AIProviderKind\":{\"type\":\"string\",\"description\":\"Supported AI provider types\",\"enum\":[\"openai\",\"azure_openai\",\"anthropic\",\"mistral\",\"deepseek\",\"googleai\",\"groq\",\"openrouter\",\"togetherai\",\"customai\",\"aws_bedrock\"]},\"ProviderConfig\":{\"type\":\"object\",\"description\":\"Complete AI provider configuration with resource reference and model selection\",\"properties\":{\"kind\":{\"$ref\":\"#/components/schemas/AIProviderKind\"},\"resource\":{\"type\":\"string\",\"description\":\"Resource reference in format '$res:{resource_path}' pointing to provider credentials\"},\"model\":{\"type\":\"string\",\"description\":\"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')\"}},\"required\":[\"kind\",\"resource\",\"model\"]},\"StaticProviderTransform\":{\"type\":\"object\",\"description\":\"Static provider configuration passed directly to the AI agent\",\"properties\":{\"value\":{\"$ref\":\"#/components/schemas/ProviderConfig\"},\"type\":{\"type\":\"string\",\"enum\":[\"static\"]}},\"required\":[\"type\",\"value\"]},\"ProviderTransform\":{\"description\":\"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined\",\"oneOf\":[{\"$ref\":\"#/components/schemas/StaticProviderTransform\"},{\"$ref\":\"#/components/schemas/JavascriptTransform\"},{\"$ref\":\"#/components/schemas/AiTransform\"}],\"discriminator\":{\"propertyName\":\"type\",\"mapping\":{\"static\":\"#/components/schemas/StaticProviderTransform\",\"javascript\":\"#/components/schemas/JavascriptTransform\",\"ai\":\"#/components/schemas/AiTransform\"}}},\"MemoryOff\":{\"type\":\"object\",\"description\":\"No conversation memory/context\",\"properties\":{\"kind\":{\"type\":\"string\",\"enum\":[\"off\"]}},\"required\":[\"kind\"]},\"MemoryAuto\":{\"type\":\"object\",\"description\":\"Automatic context management\",\"properties\":{\"kind\":{\"type\":\"string\",\"enum\":[\"auto\"]},\"context_length\":{\"type\":\"integer\",\"description\":\"Maximum number of messages to retain in context\"},\"memory_id\":{\"type\":\"string\",\"description\":\"Identifier for persistent memory across agent invocations\"}},\"required\":[\"kind\"]},\"MemoryMessage\":{\"type\":\"object\",\"description\":\"A single message in conversation history\",\"properties\":{\"role\":{\"type\":\"string\",\"enum\":[\"user\",\"assistant\",\"system\"]},\"content\":{\"type\":\"string\"}},\"required\":[\"role\",\"content\"]},\"MemoryManual\":{\"type\":\"object\",\"description\":\"Explicit message history\",\"properties\":{\"kind\":{\"type\":\"string\",\"enum\":[\"manual\"]},\"messages\":{\"type\":\"array\",\"items\":{\"$ref\":\"#/components/schemas/MemoryMessage\"}}},\"required\":[\"kind\",\"messages\"]},\"MemoryConfig\":{\"description\":\"Conversation memory configuration\",\"oneOf\":[{\"$ref\":\"#/components/schemas/MemoryOff\"},{\"$ref\":\"#/components/schemas/MemoryAuto\"},{\"$ref\":\"#/components/schemas/MemoryManual\"}],\"discriminator\":{\"propertyName\":\"kind\",\"mapping\":{\"off\":\"#/components/schemas/MemoryOff\",\"auto\":\"#/components/schemas/MemoryAuto\",\"manual\":\"#/components/schemas/MemoryManual\"}}},\"StaticMemoryTransform\":{\"type\":\"object\",\"description\":\"Static memory configuration passed directly to the AI agent\",\"properties\":{\"value\":{\"$ref\":\"#/components/schemas/MemoryConfig\"},\"type\":{\"type\":\"string\",\"enum\":[\"static\"]}},\"required\":[\"type\",\"value\"]},\"MemoryTransform\":{\"description\":\"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined\",\"oneOf\":[{\"$ref\":\"#/components/schemas/StaticMemoryTransform\"},{\"$ref\":\"#/components/schemas/JavascriptTransform\"},{\"$ref\":\"#/components/schemas/AiTransform\"}],\"discriminator\":{\"propertyName\":\"type\",\"mapping\":{\"static\":\"#/components/schemas/StaticMemoryTransform\",\"javascript\":\"#/components/schemas/JavascriptTransform\",\"ai\":\"#/components/schemas/AiTransform\"}}},\"FlowModuleValue\":{\"description\":\"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type\",\"oneOf\":[{\"$ref\":\"#/components/schemas/RawScript\"},{\"$ref\":\"#/components/schemas/PathScript\"},{\"$ref\":\"#/components/schemas/PathFlow\"},{\"$ref\":\"#/components/schemas/ForloopFlow\"},{\"$ref\":\"#/components/schemas/WhileloopFlow\"},{\"$ref\":\"#/components/schemas/BranchOne\"},{\"$ref\":\"#/components/schemas/BranchAll\"},{\"$ref\":\"#/components/schemas/Identity\"},{\"$ref\":\"#/components/schemas/AiAgent\"}],\"discriminator\":{\"propertyName\":\"type\",\"mapping\":{\"rawscript\":\"#/components/schemas/RawScript\",\"script\":\"#/components/schemas/PathScript\",\"flow\":\"#/components/schemas/PathFlow\",\"forloopflow\":\"#/components/schemas/ForloopFlow\",\"whileloopflow\":\"#/components/schemas/WhileloopFlow\",\"branchone\":\"#/components/schemas/BranchOne\",\"branchall\":\"#/components/schemas/BranchAll\",\"identity\":\"#/components/schemas/Identity\",\"aiagent\":\"#/components/schemas/AiAgent\"}}},\"RawScript\":{\"type\":\"object\",\"description\":\"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms\",\"properties\":{\"input_transforms\":{\"type\":\"object\",\"description\":\"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments\",\"additionalProperties\":{\"$ref\":\"#/components/schemas/InputTransform\"}},\"content\":{\"type\":\"string\",\"description\":\"The script source code. Should export a 'main' function\"},\"language\":{\"type\":\"string\",\"description\":\"Programming language for this script\",\"enum\":[\"deno\",\"bun\",\"python3\",\"go\",\"bash\",\"powershell\",\"postgresql\",\"mysql\",\"bigquery\",\"snowflake\",\"mssql\",\"oracledb\",\"graphql\",\"nativets\",\"php\",\"rust\",\"ansible\",\"csharp\",\"nu\",\"java\",\"ruby\",\"rlang\",\"duckdb\"]},\"path\":{\"type\":\"string\",\"description\":\"Optional path for saving this script\"},\"lock\":{\"type\":\"string\",\"description\":\"Lock file content for dependencies\"},\"type\":{\"type\":\"string\",\"enum\":[\"rawscript\"]},\"tag\":{\"type\":\"string\",\"description\":\"Worker group tag for execution routing\"},\"concurrent_limit\":{\"type\":\"number\",\"description\":\"Maximum concurrent executions of this script\"},\"concurrency_time_window_s\":{\"type\":\"number\",\"description\":\"Time window for concurrent_limit\"},\"custom_concurrency_key\":{\"type\":\"string\",\"description\":\"Custom key for grouping concurrent executions\"},\"is_trigger\":{\"type\":\"boolean\",\"description\":\"If true, this script is a trigger that can start the flow\"},\"assets\":{\"type\":\"array\",\"description\":\"External resources this script accesses (S3 objects, resources, etc.)\",\"items\":{\"type\":\"object\",\"required\":[\"path\",\"kind\"],\"properties\":{\"path\":{\"type\":\"string\",\"description\":\"Path to the asset\"},\"kind\":{\"type\":\"string\",\"description\":\"Type of asset\",\"enum\":[\"s3object\",\"resource\",\"ducklake\",\"datatable\",\"volume\"]},\"access_type\":{\"type\":\"string\",\"nullable\":true,\"description\":\"Access level for this asset\",\"enum\":[\"r\",\"w\",\"rw\"]},\"alt_access_type\":{\"type\":\"string\",\"nullable\":true,\"description\":\"Alternative access level\",\"enum\":[\"r\",\"w\",\"rw\"]}}}}},\"required\":[\"type\",\"content\",\"language\",\"input_transforms\"]},\"PathScript\":{\"type\":\"object\",\"description\":\"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code\",\"properties\":{\"input_transforms\":{\"type\":\"object\",\"description\":\"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments\",\"additionalProperties\":{\"$ref\":\"#/components/schemas/InputTransform\"}},\"path\":{\"type\":\"string\",\"description\":\"Path to the script in the workspace (e.g., 'f/scripts/send_email')\"},\"hash\":{\"type\":\"string\",\"description\":\"Optional specific version hash of the script to use\"},\"type\":{\"type\":\"string\",\"enum\":[\"script\"]},\"tag_override\":{\"type\":\"string\",\"description\":\"Override the script's default worker group tag\"},\"is_trigger\":{\"type\":\"boolean\",\"description\":\"If true, this script is a trigger that can start the flow\"}},\"required\":[\"type\",\"path\",\"input_transforms\"]},\"PathFlow\":{\"type\":\"object\",\"description\":\"Reference to an existing flow by path. Use this to call another flow as a subflow\",\"properties\":{\"input_transforms\":{\"type\":\"object\",\"description\":\"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments\",\"additionalProperties\":{\"$ref\":\"#/components/schemas/InputTransform\"}},\"path\":{\"type\":\"string\",\"description\":\"Path to the flow in the workspace (e.g., 'f/flows/process_user')\"},\"type\":{\"type\":\"string\",\"enum\":[\"flow\"]}},\"required\":[\"type\",\"path\",\"input_transforms\"]},\"ForloopFlow\":{\"type\":\"object\",\"description\":\"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations\",\"properties\":{\"modules\":{\"type\":\"array\",\"description\":\"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'\",\"items\":{\"$ref\":\"#/components/schemas/FlowModule\"}},\"iterator\":{\"description\":\"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'\",\"$ref\":\"#/components/schemas/InputTransform\"},\"skip_failures\":{\"type\":\"boolean\",\"description\":\"If true, iteration failures don't stop the loop. Failed iterations return null\"},\"type\":{\"type\":\"string\",\"enum\":[\"forloopflow\"]},\"parallel\":{\"type\":\"boolean\",\"description\":\"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency\"},\"parallelism\":{\"description\":\"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression\",\"$ref\":\"#/components/schemas/InputTransform\"},\"squash\":{\"type\":\"boolean\"}},\"required\":[\"modules\",\"iterator\",\"skip_failures\",\"type\"]},\"WhileloopFlow\":{\"type\":\"object\",\"description\":\"Executes nested modules repeatedly while a condition is true. The loop checks the condition after each iteration. Use stop_after_if on modules to control loop termination\",\"properties\":{\"modules\":{\"type\":\"array\",\"description\":\"Steps to execute in each iteration. Use stop_after_if to control when the loop ends\",\"items\":{\"$ref\":\"#/components/schemas/FlowModule\"}},\"skip_failures\":{\"type\":\"boolean\",\"description\":\"If true, iteration failures don't stop the loop. Failed iterations return null\"},\"type\":{\"type\":\"string\",\"enum\":[\"whileloopflow\"]},\"parallel\":{\"type\":\"boolean\",\"description\":\"If true, iterations run concurrently (use with caution in while loops)\"},\"parallelism\":{\"description\":\"Maximum number of concurrent iterations when parallel=true\",\"$ref\":\"#/components/schemas/InputTransform\"},\"squash\":{\"type\":\"boolean\"}},\"required\":[\"modules\",\"skip_failures\",\"type\"]},\"BranchOne\":{\"type\":\"object\",\"description\":\"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes\",\"properties\":{\"branches\":{\"type\":\"array\",\"description\":\"Array of branches to evaluate in order. The first branch with expr evaluating to true executes\",\"items\":{\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"string\",\"description\":\"Short description of this branch condition\"},\"expr\":{\"type\":\"string\",\"description\":\"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins\"},\"modules\":{\"type\":\"array\",\"description\":\"Steps to execute if this branch's expr is true\",\"items\":{\"$ref\":\"#/components/schemas/FlowModule\"}}},\"required\":[\"modules\",\"expr\"]}},\"default\":{\"type\":\"array\",\"description\":\"Steps to execute if no branch expressions match\",\"items\":{\"$ref\":\"#/components/schemas/FlowModule\"}},\"type\":{\"type\":\"string\",\"enum\":[\"branchone\"]}},\"required\":[\"branches\",\"default\",\"type\"]},\"BranchAll\":{\"type\":\"object\",\"description\":\"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently\",\"properties\":{\"branches\":{\"type\":\"array\",\"description\":\"Array of branches that all execute (either in parallel or sequentially)\",\"items\":{\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"string\",\"description\":\"Short description of this branch's purpose\"},\"skip_failure\":{\"type\":\"boolean\",\"description\":\"If true, failure in this branch doesn't fail the entire flow\"},\"modules\":{\"type\":\"array\",\"description\":\"Steps to execute in this branch\",\"items\":{\"$ref\":\"#/components/schemas/FlowModule\"}}},\"required\":[\"modules\"]}},\"type\":{\"type\":\"string\",\"enum\":[\"branchall\"]},\"parallel\":{\"type\":\"boolean\",\"description\":\"If true, all branches execute concurrently. If false, they execute sequentially\"}},\"required\":[\"branches\",\"type\"]},\"AgentTool\":{\"type\":\"object\",\"description\":\"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool\",\"properties\":{\"id\":{\"type\":\"string\",\"description\":\"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')\"},\"summary\":{\"type\":\"string\",\"description\":\"Short description of what this tool does (shown to the AI)\"},\"value\":{\"$ref\":\"#/components/schemas/ToolValue\"}},\"required\":[\"id\",\"value\"]},\"ToolValue\":{\"description\":\"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference\",\"oneOf\":[{\"$ref\":\"#/components/schemas/FlowModuleTool\"},{\"$ref\":\"#/components/schemas/McpToolValue\"},{\"$ref\":\"#/components/schemas/WebsearchToolValue\"}],\"discriminator\":{\"propertyName\":\"tool_type\",\"mapping\":{\"flowmodule\":\"#/components/schemas/FlowModuleTool\",\"mcp\":\"#/components/schemas/McpToolValue\",\"websearch\":\"#/components/schemas/WebsearchToolValue\"}}},\"FlowModuleTool\":{\"description\":\"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module\",\"allOf\":[{\"type\":\"object\",\"properties\":{\"tool_type\":{\"type\":\"string\",\"enum\":[\"flowmodule\"]}},\"required\":[\"tool_type\"]},{\"$ref\":\"#/components/schemas/FlowModuleValue\"}]},\"WebsearchToolValue\":{\"type\":\"object\",\"description\":\"A tool implemented as a websearch tool. The AI can call this like any other websearch tool\",\"properties\":{\"tool_type\":{\"type\":\"string\",\"enum\":[\"websearch\"]}},\"required\":[\"tool_type\"]},\"McpToolValue\":{\"type\":\"object\",\"description\":\"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers\",\"properties\":{\"tool_type\":{\"type\":\"string\",\"enum\":[\"mcp\"]},\"resource_path\":{\"type\":\"string\",\"description\":\"Path to the MCP resource/server configuration\"},\"include_tools\":{\"type\":\"array\",\"description\":\"Whitelist of specific tools to include from this MCP server\",\"items\":{\"type\":\"string\"}},\"exclude_tools\":{\"type\":\"array\",\"description\":\"Blacklist of tools to exclude from this MCP server\",\"items\":{\"type\":\"string\"}}},\"required\":[\"tool_type\",\"resource_path\"]},\"AiAgent\":{\"type\":\"object\",\"description\":\"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task\",\"properties\":{\"input_transforms\":{\"type\":\"object\",\"description\":\"Input parameters for the AI agent mapped to their values\",\"properties\":{\"provider\":{\"$ref\":\"#/components/schemas/ProviderTransform\"},\"output_type\":{\"allOf\":[{\"$ref\":\"#/components/schemas/InputTransform\"}],\"description\":\"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n\"},\"user_message\":{\"allOf\":[{\"$ref\":\"#/components/schemas/InputTransform\"}],\"description\":\"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax.\"},\"system_prompt\":{\"allOf\":[{\"$ref\":\"#/components/schemas/InputTransform\"}],\"description\":\"System instructions that guide the AI's behavior, persona, and response style. Optional.\"},\"streaming\":{\"allOf\":[{\"$ref\":\"#/components/schemas/InputTransform\"}],\"description\":\"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n\"},\"memory\":{\"$ref\":\"#/components/schemas/MemoryTransform\"},\"output_schema\":{\"allOf\":[{\"$ref\":\"#/components/schemas/InputTransform\"}],\"description\":\"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n\"},\"user_attachments\":{\"allOf\":[{\"$ref\":\"#/components/schemas/InputTransform\"}],\"description\":\"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n\"},\"max_completion_tokens\":{\"allOf\":[{\"$ref\":\"#/components/schemas/InputTransform\"}],\"description\":\"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n\"},\"temperature\":{\"allOf\":[{\"$ref\":\"#/components/schemas/InputTransform\"}],\"description\":\"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n\"}},\"required\":[\"provider\",\"user_message\",\"output_type\"]},\"tools\":{\"type\":\"array\",\"description\":\"Array of tools the agent can use. The agent decides which tools to call based on the task\",\"items\":{\"$ref\":\"#/components/schemas/AgentTool\"}},\"type\":{\"type\":\"string\",\"enum\":[\"aiagent\"]},\"omit_output_from_conversation\":{\"type\":\"boolean\",\"default\":false,\"description\":\"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled.\"},\"parallel\":{\"type\":\"boolean\",\"description\":\"If true, the agent can execute multiple tool calls in parallel\"}},\"required\":[\"tools\",\"type\",\"input_transforms\"]},\"Identity\":{\"type\":\"object\",\"description\":\"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder\",\"properties\":{\"type\":{\"type\":\"string\",\"enum\":[\"identity\"]},\"flow\":{\"type\":\"boolean\",\"description\":\"If true, marks this as a flow identity (special handling)\"}},\"required\":[\"type\"]},\"FlowStatus\":{\"type\":\"object\",\"properties\":{\"step\":{\"type\":\"integer\"},\"modules\":{\"type\":\"array\",\"items\":{\"$ref\":\"#/components/schemas/FlowStatusModule\"}},\"user_states\":{\"additionalProperties\":true},\"preprocessor_module\":{\"allOf\":[{\"$ref\":\"#/components/schemas/FlowStatusModule\"}]},\"failure_module\":{\"allOf\":[{\"$ref\":\"#/components/schemas/FlowStatusModule\"},{\"type\":\"object\",\"properties\":{\"parent_module\":{\"type\":\"string\"}}}]},\"retry\":{\"type\":\"object\",\"properties\":{\"fail_count\":{\"type\":\"integer\"},\"failed_jobs\":{\"type\":\"array\",\"items\":{\"type\":\"string\",\"format\":\"uuid\"}}}}},\"required\":[\"step\",\"modules\",\"failure_module\"]},\"FlowStatusModule\":{\"type\":\"object\",\"properties\":{\"type\":{\"type\":\"string\",\"enum\":[\"WaitingForPriorSteps\",\"WaitingForEvents\",\"WaitingForExecutor\",\"InProgress\",\"Success\",\"Failure\"]},\"id\":{\"type\":\"string\"},\"job\":{\"type\":\"string\",\"format\":\"uuid\"},\"count\":{\"type\":\"integer\"},\"progress\":{\"type\":\"integer\"},\"iterator\":{\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"integer\"},\"itered\":{\"type\":\"array\",\"items\":{}},\"itered_len\":{\"type\":\"integer\"},\"args\":{}}},\"flow_jobs\":{\"type\":\"array\",\"items\":{\"type\":\"string\"}},\"flow_jobs_success\":{\"type\":\"array\",\"items\":{\"type\":\"boolean\"}},\"flow_jobs_duration\":{\"type\":\"object\",\"properties\":{\"started_at\":{\"type\":\"array\",\"items\":{\"type\":\"string\"}},\"duration_ms\":{\"type\":\"array\",\"items\":{\"type\":\"integer\"}}}},\"branch_chosen\":{\"type\":\"object\",\"properties\":{\"type\":{\"type\":\"string\",\"enum\":[\"branch\",\"default\"]},\"branch\":{\"type\":\"integer\"}},\"required\":[\"type\"]},\"branchall\":{\"type\":\"object\",\"properties\":{\"branch\":{\"type\":\"integer\"},\"len\":{\"type\":\"integer\"}},\"required\":[\"branch\",\"len\"]},\"approvers\":{\"type\":\"array\",\"items\":{\"type\":\"object\",\"properties\":{\"resume_id\":{\"type\":\"integer\"},\"approver\":{\"type\":\"string\"}},\"required\":[\"resume_id\",\"approver\"]}},\"failed_retries\":{\"type\":\"array\",\"items\":{\"type\":\"string\",\"format\":\"uuid\"}},\"skipped\":{\"type\":\"boolean\"},\"agent_actions\":{\"type\":\"array\",\"items\":{\"type\":\"object\",\"oneOf\":[{\"type\":\"object\",\"properties\":{\"job_id\":{\"type\":\"string\",\"format\":\"uuid\"},\"function_name\":{\"type\":\"string\"},\"type\":{\"type\":\"string\",\"enum\":[\"tool_call\"]},\"module_id\":{\"type\":\"string\"}},\"required\":[\"job_id\",\"function_name\",\"type\",\"module_id\"]},{\"type\":\"object\",\"properties\":{\"call_id\":{\"type\":\"string\",\"format\":\"uuid\"},\"function_name\":{\"type\":\"string\"},\"resource_path\":{\"type\":\"string\"},\"type\":{\"type\":\"string\",\"enum\":[\"mcp_tool_call\"]},\"arguments\":{\"type\":\"object\"}},\"required\":[\"call_id\",\"function_name\",\"resource_path\",\"type\"]},{\"type\":\"object\",\"properties\":{\"type\":{\"type\":\"string\",\"enum\":[\"web_search\"]}},\"required\":[\"type\"]},{\"type\":\"object\",\"properties\":{\"type\":{\"type\":\"string\",\"enum\":[\"message\"]}},\"required\":[\"content\",\"type\"]}]}},\"agent_actions_success\":{\"type\":\"array\",\"items\":{\"type\":\"boolean\"}}},\"required\":[\"type\"]}}";
-export declare const CLI_COMMANDS = "# Windmill CLI Commands\n\nThe Windmill CLI (`wmill`) provides commands for managing scripts, flows, apps, and other resources.\n\n## Global Options\n\n- `--workspace <workspace:string>` - Specify the target workspace. This overrides the default workspace.\n- `--debug --verbose` - Show debug/verbose logs\n- `--show-diffs` - Show diff informations when syncing (may show sensitive informations)\n- `--token <token:string>` - Specify an API token. This will override any stored token.\n- `--base-url <baseUrl:string>` - Specify the base URL of the API. If used, --token and --workspace are required and no local remote/workspace already set will be used.\n- `--config-dir <configDir:string>` - Specify a custom config directory. Overrides WMILL_CONFIG_DIR environment variable and default ~/.config location.\n\n## Commands\n\n### app\n\napp related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `app list` - list all apps\n  - `--json` - Output as JSON (for piping to jq)\n- `app get <path:string>` - get an app's details\n  - `--json` - Output as JSON (for piping to jq)\n- `app push <file_path:string> <remote_path:string>` - push a local app \n- `app dev [app_folder:string]` - Start a development server for building apps with live reload and hot module replacement\n  - `--port <port:number>` - Port to run the dev server on (will find next available port if occupied)\n  - `--host <host:string>` - Host to bind the dev server to\n  - `--entry <entry:string>` - Entry point file (default: index.ts for Svelte/Vue, index.tsx otherwise)\n  - `--no-open` - Don't automatically open the browser\n- `app lint [app_folder:string]` - Lint a raw app folder to validate structure and buildability\n  - `--fix` - Attempt to fix common issues (not implemented yet)\n- `app new` - create a new raw app from a template\n  - `--summary <summary:string>` - App summary (short description). Skips the prompt when provided. Triggers non-interactive mode.\n  - `--path <path:string>` - App path (e.g., f/folder/my_app or u/username/my_app). Skips the prompt when provided. Triggers non-interactive mode.\n  - `--framework <framework:string>` - Framework template: react19 | react18 | svelte5 | vue. Skips the prompt when provided. Triggers non-interactive mode.\n  - `--datatable <datatable:string>` - Datatable to wire up. Without this flag in non-interactive mode, no datatable is configured.\n  - `--schema <schema:string>` - Schema to use with --datatable. Created (CREATE SCHEMA IF NOT EXISTS) if it doesn't already exist.\n  - `--overwrite` - Overwrite the target directory if it already exists, without prompting.\n  - `--no-open-in-desktop` - Do not prompt to open the new app in Claude Desktop.\n- `app generate-agents [app_folder:string]` - regenerate AGENTS.md and DATATABLES.md from remote workspace\n- `app set-permissioned-as <path:string> <email:string>` - Set the on_behalf_of_email for an app (requires admin or wm_deployers group)\n\n### audit\n\nView audit logs (requires admin)\n\n**Subcommands:**\n\n- `audit list` - List audit log entries\n- `audit get <id:string>` - Get a specific audit log entry\n  - `--json` - Output as JSON (for piping to jq)\n\n### config\n\nShow all available wmill.yaml configuration options\n\n**Options:**\n- `--json` - Output as JSON for programmatic consumption\n\n**Subcommands:**\n\n- `config migrate` - Migrate wmill.yaml from gitBranches/environments to workspaces format\n\n### dependencies\n\nworkspace dependencies related commands\n\n**Alias:** `deps`\n\n**Subcommands:**\n\n- `dependencies push <file_path:string>` - Push workspace dependencies from a local file\n\n### dev\n\nWatch local file changes and live-reload the dev page for preview. Does NOT deploy to the remote workspace \u2014 use wmill sync push for that.\n\n**Options:**\n- `--includes <pattern...:string>` - Filter paths given a glob pattern or path\n- `--proxy-port <port:number>` - Port for a localhost reverse proxy to the remote Windmill server\n- `--path <path:string>` - Watch a specific windmill path (e.g., u/admin/my_script or f/my_flow)\n- `--no-open` - Do not open the browser automatically\n\n### docs\n\nSearch Windmill documentation.\n\n**Arguments:** `<query:string>`\n\n**Options:**\n- `--json` - Output results as JSON.\n\n### flow\n\nflow related commands\n\n**Options:**\n- `--show-archived` - Enable archived flows in output\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `flow list` - list all flows\n  - `--show-archived` - Enable archived flows in output\n  - `--json` - Output as JSON (for piping to jq)\n- `flow get <path:string>` - get a flow's details\n  - `--json` - Output as JSON (for piping to jq)\n- `flow push <file_path:string> <remote_path:string>` - push a local flow spec. This overrides any remote versions.\n  - `--message <message:string>` - Deployment message\n- `flow run <path:string>` - run a flow by path.\n  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.\n  - `-s --silent` - Do not ouput anything other then the final output. Useful for scripting.\n- `flow preview <flow_path:string>` - preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default.\n  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.\n  - `-s --silent` - Do not output anything other then the final output. Useful for scripting.\n  - `--remote` - Use deployed workspace scripts for PathScript steps instead of local files.\n- `flow new <flow_path:string>` - create a new empty flow\n  - `--summary <summary:string>` - flow summary\n  - `--description <description:string>` - flow description\n- `flow bootstrap <flow_path:string>` - create a new empty flow (alias for new)\n  - `--summary <summary:string>` - flow summary\n  - `--description <description:string>` - flow description\n- `flow history <path:string>` - Show version history for a flow\n  - `--json` - Output as JSON (for piping to jq)\n- `flow show-version <path:string> <version:string>` - Show a specific version of a flow\n  - `--json` - Output as JSON (for piping to jq)\n- `flow set-permissioned-as <path:string> <email:string>` - Set the on_behalf_of_email for a flow (requires admin or wm_deployers group)\n\n### folder\n\nfolder related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `folder list` - list all folders\n  - `--json` - Output as JSON (for piping to jq)\n- `folder get <name:string>` - get a folder's details\n  - `--json` - Output as JSON (for piping to jq)\n- `folder new <name:string>` - create a new folder locally\n  - `--summary <summary:string>` - folder summary\n- `folder push <name:string>` - push a local folder to the remote by name. This overrides any remote versions.\n- `folder add-missing` - create default folder.meta.yaml for all subdirectories of f/ that are missing one\n  - `-y, --yes` - skip confirmation prompt\n- `folder show-rules <name:string>` - Show default_permissioned_as rules for a folder. Use --test-path to see which rule matches a given item path.\n  - `--test-path <path:string>` - Test which rule matches this item path (e.g. f/prod/jobs/my_script)\n  - `--json` - Output as JSON\n\n### generate-metadata\n\nGenerate metadata (locks, schemas) for all scripts, flows, and apps\n\n**Arguments:** `[folder:string]`\n\n**Options:**\n- `--yes` - Skip confirmation prompt\n- `--dry-run` - Show what would be updated without making changes\n- `--lock-only` - Re-generate only the lock files\n- `--schema-only` - Re-generate only script schemas (skips flows and apps)\n- `--skip-scripts` - Skip processing scripts\n- `--skip-flows` - Skip processing flows\n- `--skip-apps` - Skip processing apps\n- `--strict-folder-boundaries` - Only update items inside the specified folder (requires folder argument)\n- `-i --includes <patterns:file[]>` - Comma separated patterns to specify which files to include\n- `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which files to exclude\n\n### gitsync-settings\n\nManage git-sync settings between local wmill.yaml and Windmill backend\n\n**Subcommands:**\n\n- `gitsync-settings pull` - Pull git-sync settings from Windmill backend to local wmill.yaml\n  - `--repository <repo:string>` - Specify repository path (e.g., u/user/repo)\n  - `--default` - Write settings to top-level defaults instead of overrides\n  - `--replace` - Replace existing settings (non-interactive mode)\n  - `--override` - Add branch-specific override (non-interactive mode)\n  - `--diff` - Show differences without applying changes\n  - `--json-output` - Output in JSON format\n  - `--with-backend-settings <json:string>` - Use provided JSON settings instead of querying backend (for testing)\n  - `--yes` - Skip interactive prompts and use default behavior\n  - `--promotion <branch:string>` - Use promotionOverrides from the specified branch instead of regular overrides\n- `gitsync-settings push` - Push git-sync settings from local wmill.yaml to Windmill backend\n  - `--repository <repo:string>` - Specify repository path (e.g., u/user/repo)\n  - `--diff` - Show what would be pushed without applying changes\n  - `--json-output` - Output in JSON format\n  - `--with-backend-settings <json:string>` - Use provided JSON settings instead of querying backend (for testing)\n  - `--yes` - Skip interactive prompts and use default behavior\n  - `--promotion <branch:string>` - Use promotionOverrides from the specified branch instead of regular overrides\n\n### group\n\nManage workspace groups\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `group list` - List all groups in the workspace\n  - `--json` - Output as JSON (for piping to jq)\n- `group get <name:string>` - Get group details and members\n  - `--json` - Output as JSON (for piping to jq)\n- `group create <name:string>` - Create a new group\n  - `--summary <summary:string>` - Group summary/description\n- `group delete <name:string>` - Delete a group\n- `group add-user <name:string> <username:string>` - Add a user to a group\n- `group remove-user <name:string> <username:string>` - Remove a user from a group\n\n### hub\n\nHub related commands. EXPERIMENTAL. INTERNAL USE ONLY.\n\n**Subcommands:**\n\n- `hub pull` - pull any supported definitions. EXPERIMENTAL.\n\n### init\n\nBootstrap a windmill project with a wmill.yaml file\n\n**Options:**\n- `--use-default` - Use default settings without checking backend\n- `--use-backend` - Use backend git-sync settings if available\n- `--repository <repo:string>` - Specify repository path (e.g., u/user/repo) when using backend settings\n- `--bind-profile` - Automatically bind active workspace profile to current Git branch\n- `--no-bind-profile` - Skip workspace profile binding prompt\n\n### instance\n\nsync local with a remote instance or the opposite (push or pull)\n\n**Subcommands:**\n\n- `instance add [instance_name:string] [remote:string] [token:string]` - Add a new instance\n- `instance remove <instance:string:instance>` - Remove an instance\n- `instance switch <instance:string:instance>` - Switch the current instance\n- `instance pull` - Pull instance settings, users, configs, instance groups and overwrite local\n  - `--yes` - Pull without needing confirmation\n  - `--dry-run` - Perform a dry run without making changes\n  - `--skip-users` - Skip pulling users\n  - `--skip-settings` - Skip pulling settings\n  - `--skip-configs` - Skip pulling configs (worker groups)\n  - `--skip-groups` - Skip pulling instance groups\n  - `--include-workspaces` - Also pull workspaces\n  - `--folder-per-instance` - Create a folder per instance\n  - `--instance <instance:string>` - Name of the instance to pull from, override the active instance\n  - `--prefix <prefix:string>` - Prefix of the local workspaces to pull, used to create the folders when using --include-workspaces\n  - `--prefix-settings` - Store instance yamls inside prefixed folders when using --prefix and --folder-per-instance\n- `instance push` - Push instance settings, users, configs, group and overwrite remote\n  - `--yes` - Push without needing confirmation\n  - `--dry-run` - Perform a dry run without making changes\n  - `--skip-users` - Skip pushing users\n  - `--skip-settings` - Skip pushing settings\n  - `--skip-configs` - Skip pushing configs (worker groups)\n  - `--skip-groups` - Skip pushing instance groups\n  - `--include-workspaces` - Also push workspaces\n  - `--folder-per-instance` - Create a folder per instance\n  - `--instance <instance:string>` - Name of the instance to push to, override the active instance\n  - `--prefix <prefix:string>` - Prefix of the local workspaces folders to push\n  - `--prefix-settings` - Store instance yamls inside prefixed folders when using --prefix and --folder-per-instance\n- `instance whoami` - Display information about the currently logged-in user\n- `instance get-config` - Dump the current instance config (global settings + worker configs) as YAML\n  - `-o, --output-file <file:string>` - Write YAML to a file instead of stdout\n  - `--show-secrets` - Include sensitive fields (license key, JWT secret) without prompting\n  - `--instance <instance:string>` - Name of the instance, override the active instance\n- `instance connect-slack`\n  - `--bot-token <bot_token:string>` - Slack bot token (xoxb-...)\n  - `--team-id <team_id:string>` - Slack team id\n  - `--team-name <team_name:string>` - Slack team name\n  - `--instance <instance:string>` - Instance profile to connect against (defaults to the active instance)\n\n### job\n\nManage jobs (list, inspect, cancel)\n\n**Subcommands:**\n\n- `job list` - List recent jobs\n- `job get <id:string>` - Get job details. For flows: shows step tree with sub-job IDs\n  - `--json` - Output as JSON (for piping to jq)\n- `job result <id:string>` - Get the result of a completed job (machine-friendly)\n- `job logs <id:string>` - Get job logs. For flows: aggregates all step logs\n- `job cancel <id:string>` - Cancel a running or queued job\n  - `--reason <reason:string>` - Reason for cancellation\n\n### jobs\n\nPull completed and queued jobs from workspace\n\n**Arguments:** `[workspace:string]`\n\n**Options:**\n- `-c, --completed-output <file:string>` - Completed jobs output file (default: completed_jobs.json)\n- `-q, --queued-output <file:string>` - Queued jobs output file (default: queued_jobs.json)\n- `--skip-worker-check` - Skip checking for active workers before export\n\n**Subcommands:**\n\n- `jobs pull`\n- `jobs push`\n\n### lint\n\nValidate Windmill flow, schedule, and trigger YAML files in a directory\n\n**Arguments:** `[directory:string]`\n\n**Options:**\n- `--json` - Output results in JSON format\n- `--fail-on-warn` - Exit with code 1 when warnings are emitted\n- `--locks-required` - Fail if scripts or flow inline scripts that need locks have no locks\n- `-w, --watch` - Watch for file changes and re-lint automatically\n\n### queues\n\nList all queues with their metrics\n\n**Arguments:** `[workspace:string] the optional workspace to filter by (default to all workspaces)`\n\n**Options:**\n- `--instance [instance]` - Name of the instance to push to, override the active instance\n- `--base-url [baseUrl]` - If used with --token, will be used as the base url for the instance\n\n### resource\n\nresource related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `resource list` - list all resources\n  - `--json` - Output as JSON (for piping to jq)\n- `resource get <path:string>` - get a resource's details\n  - `--json` - Output as JSON (for piping to jq)\n- `resource new <path:string>` - create a new resource locally\n- `resource push <file_path:string> <remote_path:string>` - push a local resource spec. This overrides any remote versions.\n\n### resource-type\n\nresource type related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `resource-type list` - list all resource types\n  - `--schema` - Show schema in the output\n  - `--json` - Output as JSON (for piping to jq)\n- `resource-type get <path:string>` - get a resource type's details\n  - `--json` - Output as JSON (for piping to jq)\n- `resource-type new <name:string>` - create a new resource type locally\n- `resource-type push <file_path:string> <name:string>` - push a local resource spec. This overrides any remote versions.\n- `resource-type generate-namespace` - Create a TypeScript definition file with the RT namespace generated from the resource types\n\n### schedule\n\nschedule related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `schedule list` - list all schedules\n  - `--json` - Output as JSON (for piping to jq)\n- `schedule get <path:string>` - get a schedule's details\n  - `--json` - Output as JSON (for piping to jq)\n- `schedule new <path:string>` - create a new schedule locally\n- `schedule push <file_path:string> <remote_path:string>` - push a local schedule spec. This overrides any remote versions.\n- `schedule enable <path:string>` - Enable a schedule\n- `schedule disable <path:string>` - Disable a schedule\n- `schedule set-permissioned-as <path:string> <email:string>` - Set the email (run-as user) for a schedule (requires admin or wm_deployers group)\n\n### script\n\nscript related commands\n\n**Options:**\n- `--show-archived` - Show archived scripts instead of active ones\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `script list` - list all scripts\n  - `--show-archived` - Show archived scripts instead of active ones\n  - `--json` - Output as JSON (for piping to jq)\n- `script push <path:file>` - push a local script spec. This overrides any remote versions. Use the script file (.ts, .js, .py, .sh)\n  - `--message <message:string>` - Deployment message\n- `script get <path:file>` - get a script's details\n  - `--json` - Output as JSON (for piping to jq)\n- `script show <path:file>` - show a script's content (alias for get)\n- `script run <path:file>` - run a script by path\n  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.\n  - `-s --silent` - Do not output anything other then the final output. Useful for scripting.\n- `script preview <path:file>` - preview a local script without deploying it. Supports both regular and codebase scripts.\n  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.\n  - `-s --silent` - Do not output anything other than the final output. Useful for scripting.\n- `script new <path:file> <language:string>` - create a new script\n  - `--summary <summary:string>` - script summary\n  - `--description <description:string>` - script description\n- `script bootstrap <path:file> <language:string>` - create a new script (alias for new)\n  - `--summary <summary:string>` - script summary\n  - `--description <description:string>` - script description\n- `script set-permissioned-as <path:string> <email:string>` - Set the on_behalf_of_email for a script (requires admin or wm_deployers group)\n- `script history <path:string>` - show version history for a script\n  - `--json` - Output as JSON (for piping to jq)\n\n### sync\n\nsync local with a remote workspaces or the opposite (push or pull)\n\n**Subcommands:**\n\n- `sync pull` - Pull any remote changes and apply them locally.\n  - `--yes` - Pull without needing confirmation\n  - `--dry-run` - Show changes that would be pulled without actually pushing\n  - `--plain-secrets` - Pull secrets as plain text\n  - `--json` - Use JSON instead of YAML\n  - `--skip-variables` - Skip syncing variables (including secrets)\n  - `--skip-secrets` - Skip syncing only secrets variables\n  - `--include-secrets` - Include secrets in sync (overrides skipSecrets in wmill.yaml)\n  - `--skip-resources` - Skip syncing  resources\n  - `--skip-resource-types` - Skip syncing  resource types\n  - `--skip-scripts` - Skip syncing scripts\n  - `--skip-flows` - Skip syncing flows\n  - `--skip-apps` - Skip syncing apps\n  - `--skip-folders` - Skip syncing folders\n  - `--skip-workspace-dependencies` - Skip syncing workspace dependencies\n  - `--skip-scripts-metadata` - Skip syncing scripts metadata, focus solely on logic\n  - `--include-schedules` - Include syncing  schedules\n  - `--include-triggers` - Include syncing triggers\n  - `--include-users` - Include syncing users\n  - `--include-groups` - Include syncing groups\n  - `--include-settings` - Include syncing workspace settings\n  - `--include-key` - Include workspace encryption key\n  - `--skip-branch-validation` - Skip git branch validation and prompts\n  - `--json-output` - Output results in JSON format\n  - `-i --includes <patterns:file[]>` - Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Overrides wmill.yaml includes\n  - `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which file to NOT take into account. Overrides wmill.yaml excludes\n  - `--extra-includes <patterns:file[]>` - Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy\n  - `--repository <repo:string>` - Specify repository path (e.g., u/user/repo) when multiple repositories exist\n  - `--promotion <branch:string>` - Use promotionOverrides from the specified branch instead of regular overrides\n  - `--branch, --env <branch:string>` - [Deprecated: use --workspace] Override the current git branch/environment\n- `sync push` - Push any local changes and apply them remotely.\n  - `--yes` - Push without needing confirmation\n  - `--dry-run` - Show changes that would be pushed without actually pushing\n  - `--plain-secrets` - Push secrets as plain text\n  - `--json` - Use JSON instead of YAML\n  - `--skip-variables` - Skip syncing variables (including secrets)\n  - `--skip-secrets` - Skip syncing only secrets variables\n  - `--include-secrets` - Include secrets in sync (overrides skipSecrets in wmill.yaml)\n  - `--skip-resources` - Skip syncing  resources\n  - `--skip-resource-types` - Skip syncing  resource types\n  - `--skip-scripts` - Skip syncing scripts\n  - `--skip-flows` - Skip syncing flows\n  - `--skip-apps` - Skip syncing apps\n  - `--skip-folders` - Skip syncing folders\n  - `--skip-workspace-dependencies` - Skip syncing workspace dependencies\n  - `--skip-scripts-metadata` - Skip syncing scripts metadata, focus solely on logic\n  - `--include-schedules` - Include syncing schedules\n  - `--include-triggers` - Include syncing triggers\n  - `--include-users` - Include syncing users\n  - `--include-groups` - Include syncing groups\n  - `--include-settings` - Include syncing workspace settings\n  - `--include-key` - Include workspace encryption key\n  - `--skip-branch-validation` - Skip git branch validation and prompts\n  - `--json-output` - Output results in JSON format\n  - `-i --includes <patterns:file[]>` - Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)\n  - `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which file to NOT take into account.\n  - `--extra-includes <patterns:file[]>` - Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy\n  - `--message <message:string>` - Include a message that will be added to all scripts/flows/apps updated during this push\n  - `--parallel <number>` - Number of changes to process in parallel\n  - `--repository <repo:string>` - Specify repository path (e.g., u/user/repo) when multiple repositories exist\n  - `--branch, --env <branch:string>` - [Deprecated: use --workspace] Override the current git branch/environment\n  - `--lint` - Run lint validation before pushing\n  - `--locks-required` - Fail if scripts or flow inline scripts that need locks have no locks\n  - `--auto-metadata` - Automatically regenerate stale metadata (locks and schemas) before pushing\n  - `--accept-overriding-permissioned-as-with-self` - Accept that items with a different permissioned_as will be updated with your own user\n\n### token\n\nManage API tokens\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `token list` - List API tokens\n  - `--json` - Output as JSON (for piping to jq)\n- `token create` - Create a new API token\n  - `--label <label:string>` - Token label\n  - `--expiration <expiration:string>` - Token expiration (ISO 8601 timestamp)\n- `token delete <token_prefix:string>` - Delete a token by its prefix\n\n### trigger\n\ntrigger related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `trigger list` - list all triggers\n  - `--json` - Output as JSON (for piping to jq)\n- `trigger get <path:string>` - get a trigger's details\n  - `--json` - Output as JSON (for piping to jq)\n  - `--kind <kind:string>` - Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email). Recommended for faster lookup\n- `trigger new <path:string>` - create a new trigger locally\n  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)\n- `trigger push <file_path:string> <remote_path:string>` - push a local trigger spec. This overrides any remote versions.\n- `trigger set-permissioned-as <path:string> <email:string>` - Set the email (run-as user) for a trigger (requires admin or wm_deployers group)\n  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)\n\n### user\n\nuser related commands\n\n**Subcommands:**\n\n- `user add <email:string> [password:string]` - Create a user\n  - `--superadmin` - Specify to make the new user superadmin.\n  - `--company <company:string>` - Specify to set the company of the new user.\n  - `--name <name:string>` - Specify to set the name of the new user.\n- `user remove <email:string>` - Delete a user\n- `user create-token` - Create a new API token for the authenticated user\n  - `--email <email:string>` - Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.\n  - `--password <password:string>` - Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.\n\n### variable\n\nvariable related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `variable list` - list all variables\n  - `--json` - Output as JSON (for piping to jq)\n- `variable get <path:string>` - get a variable's details\n  - `--json` - Output as JSON (for piping to jq)\n- `variable new <path:string>` - create a new variable locally\n- `variable push <file_path:string> <remote_path:string>` - Push a local variable spec. This overrides any remote versions.\n  - `--plain-secrets` - Push secrets as plain text\n- `variable add <value:string> <remote_path:string>` - Create a new variable on the remote. This will update the variable if it already exists.\n  - `--plain-secrets` - Push secrets as plain text\n  - `--public` - Legacy option, use --plain-secrets instead\n\n### version\n\nShow version information\n\n### worker-groups\n\ndisplay worker groups, pull and push worker groups configs\n\n**Subcommands:**\n\n- `worker-groups pull` - Pull worker groups (similar to `wmill instance pull --skip-users --skip-settings --skip-groups`)\n  - `--instance` - Name of the instance to push to, override the active instance\n  - `--base-url` - Base url to be passed to the instance settings instead of the local one\n  - `--yes` - Pull without needing confirmation\n- `worker-groups push` - Push worker groups (similar to `wmill instance push --skip-users --skip-settings --skip-groups`)\n  - `--instance [instance]` - Name of the instance to push to, override the active instance\n  - `--base-url [baseUrl]` - If used with --token, will be used as the base url for the instance\n  - `--yes` - Push without needing confirmation\n\n### workers\n\nList all workers grouped by worker groups\n\n**Options:**\n- `--instance [instance]` - Name of the instance to push to, override the active instance\n- `--base-url [baseUrl]` - If used with --token, will be used as the base url for the instance\n\n### workspace\n\nworkspace related commands\n\n**Alias:** `profile`\n\n**Subcommands:**\n\n- `workspace switch <workspace_name:string:workspace>` - Switch to another workspace\n- `workspace add [workspace_name:string] [workspace_id:string] [remote:string]` - Add a workspace\n  - `-c --create` - Create the workspace if it does not exist\n  - `--create-workspace-name <workspace_name:string>` - Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.\n  - `--create-username <username:string>` - Specify your own username in the newly created workspace. Ignored if --create is not specified, the workspace already exists or automatic username creation is enabled on the instance.\n- `workspace remove <workspace_name:string>` - Remove a workspace\n- `workspace whoami` - Show the currently active user\n- `workspace list` - List local workspace profiles\n- `workspace list-remote` - List workspaces on the remote server that you have access to\n- `workspace list-forks` - List forked workspaces on the remote server\n- `workspace bind` - Create or update a workspace entry in wmill.yaml from the active profile\n  - `--workspace <name:string>` - Workspace name (default: current branch or workspaceId)\n  - `--branch <branch:string>` - Git branch to associate (default: workspace name)\n- `workspace unbind` - Remove baseUrl and workspaceId from a workspace entry\n  - `--workspace <name:string>` - Workspace to unbind\n- `workspace fork [workspace_name:string] [workspace_id:string]` - Create a forked workspace\n  - `--create-workspace-name <workspace_name:string>` - Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.\n  - `--color <color:string>` - Workspace color (hex code, e.g. #ff0000)\n  - `--datatable-behavior <behavior:string>` - How to handle datatables: skip, schema_only, or schema_and_data (default: interactive prompt)\n  - `-y --yes` - Skip interactive prompts (defaults datatable behavior to 'skip')\n- `workspace delete-fork <fork_name:string>` - Delete a forked workspace and git branch\n  - `-y --yes` - Skip confirmation prompt\n- `workspace merge` - Compare and deploy changes between a fork and its parent workspace\n  - `--direction <direction:string>` - Deploy direction: to-parent or to-fork\n  - `--all` - Deploy all changed items including conflicts\n  - `--skip-conflicts` - Skip items modified in both workspaces\n  - `--include <items:string>` - Comma-separated kind:path items to include (e.g. script:f/test/main,flow:f/my/flow)\n  - `--exclude <items:string>` - Comma-separated kind:path items to exclude\n  - `--preserve-on-behalf-of` - Preserve original on_behalf_of/permissioned_as values\n  - `-y --yes` - Non-interactive mode (deploy without prompts)\n- `workspace connect-slack` - Non-interactively connect Slack to the active workspace using a pre-minted bot token (xoxb-...). Produces the same artifacts as the UI OAuth flow: workspace_settings fields, g/slack group, f/slack_bot folder, and the encrypted bot token variable + resource at f/slack_bot/bot_token.\n  - `--bot-token <bot_token:string>` - Slack bot token (xoxb-...)\n  - `--team-id <team_id:string>` - Slack team id\n  - `--team-name <team_name:string>` - Slack team name\n- `workspace disconnect-slack`\n\n";
+export declare const CLI_COMMANDS = "# Windmill CLI Commands\n\nThe Windmill CLI (`wmill`) provides commands for managing scripts, flows, apps, and other resources.\n\n## Global Options\n\n- `--workspace <workspace:string>` - Specify the target workspace. This overrides the default workspace.\n- `--debug --verbose` - Show debug/verbose logs\n- `--show-diffs` - Show diff informations when syncing (may show sensitive informations)\n- `--token <token:string>` - Specify an API token. This will override any stored token.\n- `--base-url <baseUrl:string>` - Specify the base URL of the API. If used, --token and --workspace are required and no local remote/workspace already set will be used.\n- `--config-dir <configDir:string>` - Specify a custom config directory. Overrides WMILL_CONFIG_DIR environment variable and default ~/.config location.\n\n## Commands\n\n### app\n\napp related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `app list` - list all apps\n  - `--json` - Output as JSON (for piping to jq)\n- `app get <path:string>` - get an app's details\n  - `--json` - Output as JSON (for piping to jq)\n- `app push [file_path:string] [remote_path:string]` - push a local app. With no args, infers the app from the current directory and the remote path from its location relative to wmill.yaml.\n- `app dev [app_folder:string]` - Start a development server for building apps with live reload and hot module replacement\n  - `--port <port:number>` - Port to run the dev server on (will find next available port if occupied)\n  - `--host <host:string>` - Host to bind the dev server to\n  - `--entry <entry:string>` - Entry point file (default: index.ts for Svelte/Vue, index.tsx otherwise)\n  - `--no-open` - Don't automatically open the browser\n- `app lint [app_folder:string]` - Lint a raw app folder to validate structure and buildability\n  - `--fix` - Attempt to fix common issues (not implemented yet)\n- `app new` - create a new raw app from a template\n  - `--summary <summary:string>` - App summary (short description). Skips the prompt when provided. Triggers non-interactive mode.\n  - `--path <path:string>` - App path (e.g., f/folder/my_app or u/username/my_app). Skips the prompt when provided. Triggers non-interactive mode.\n  - `--framework <framework:string>` - Framework template: react19 | react18 | svelte5 | vue. Skips the prompt when provided. Triggers non-interactive mode.\n  - `--datatable <datatable:string>` - Datatable to wire up. Without this flag in non-interactive mode, no datatable is configured.\n  - `--schema <schema:string>` - Schema to use with --datatable. Created (CREATE SCHEMA IF NOT EXISTS) if it doesn't already exist.\n  - `--overwrite` - Overwrite the target directory if it already exists, without prompting.\n  - `--no-open-in-desktop` - Do not prompt to open the new app in Claude Desktop.\n- `app generate-agents [app_folder:string]` - regenerate AGENTS.md and DATATABLES.md from remote workspace\n- `app set-permissioned-as <path:string> <email:string>` - Set the on_behalf_of_email for an app (requires admin or wm_deployers group)\n\n### audit\n\nView audit logs (requires admin)\n\n**Subcommands:**\n\n- `audit list` - List audit log entries\n- `audit get <id:string>` - Get a specific audit log entry\n  - `--json` - Output as JSON (for piping to jq)\n\n### config\n\nShow all available wmill.yaml configuration options\n\n**Options:**\n- `--json` - Output as JSON for programmatic consumption\n\n**Subcommands:**\n\n- `config migrate` - Migrate wmill.yaml from gitBranches/environments to workspaces format\n\n### dependencies\n\nworkspace dependencies related commands\n\n**Alias:** `deps`\n\n**Subcommands:**\n\n- `dependencies push <file_path:string>` - Push workspace dependencies from a local file\n\n### dev\n\nWatch local file changes and live-reload the dev page for preview. Does NOT deploy to the remote workspace \u2014 use wmill sync push for that.\n\n**Options:**\n- `--includes <pattern...:string>` - Filter paths given a glob pattern or path\n- `--proxy-port <port:number>` - Port for a localhost reverse proxy to the remote Windmill server\n- `--path <path:string>` - Watch a specific windmill path (e.g., u/admin/my_script or f/my_flow)\n- `--no-open` - Do not open the browser automatically\n\n### docs\n\nSearch Windmill documentation.\n\n**Arguments:** `<query:string>`\n\n**Options:**\n- `--json` - Output results as JSON.\n\n### flow\n\nflow related commands\n\n**Options:**\n- `--show-archived` - Enable archived flows in output\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `flow list` - list all flows\n  - `--show-archived` - Enable archived flows in output\n  - `--json` - Output as JSON (for piping to jq)\n- `flow get <path:string>` - get a flow's details\n  - `--json` - Output as JSON (for piping to jq)\n- `flow push <file_path:string> <remote_path:string>` - push a local flow spec. This overrides any remote versions.\n  - `--message <message:string>` - Deployment message\n- `flow run <path:string>` - run a flow by path.\n  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.\n  - `-s --silent` - Do not ouput anything other then the final output. Useful for scripting.\n- `flow preview <flow_path:string>` - preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default.\n  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.\n  - `-s --silent` - Do not output anything other then the final output. Useful for scripting.\n  - `--remote` - Use deployed workspace scripts for PathScript steps instead of local files.\n- `flow new <flow_path:string>` - create a new empty flow\n  - `--summary <summary:string>` - flow summary\n  - `--description <description:string>` - flow description\n- `flow bootstrap <flow_path:string>` - create a new empty flow (alias for new)\n  - `--summary <summary:string>` - flow summary\n  - `--description <description:string>` - flow description\n- `flow history <path:string>` - Show version history for a flow\n  - `--json` - Output as JSON (for piping to jq)\n- `flow show-version <path:string> <version:string>` - Show a specific version of a flow\n  - `--json` - Output as JSON (for piping to jq)\n- `flow set-permissioned-as <path:string> <email:string>` - Set the on_behalf_of_email for a flow (requires admin or wm_deployers group)\n\n### folder\n\nfolder related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `folder list` - list all folders\n  - `--json` - Output as JSON (for piping to jq)\n- `folder get <name:string>` - get a folder's details\n  - `--json` - Output as JSON (for piping to jq)\n- `folder new <name:string>` - create a new folder locally\n  - `--summary <summary:string>` - folder summary\n- `folder push <name:string>` - push a local folder to the remote by name. This overrides any remote versions.\n- `folder add-missing` - create default folder.meta.yaml for all subdirectories of f/ that are missing one\n  - `-y, --yes` - skip confirmation prompt\n- `folder show-rules <name:string>` - Show default_permissioned_as rules for a folder. Use --test-path to see which rule matches a given item path.\n  - `--test-path <path:string>` - Test which rule matches this item path (e.g. f/prod/jobs/my_script)\n  - `--json` - Output as JSON\n\n### generate-metadata\n\nGenerate metadata (locks, schemas) for all scripts, flows, and apps\n\n**Arguments:** `[folder:string]`\n\n**Options:**\n- `--yes` - Skip confirmation prompt\n- `--dry-run` - Show what would be updated without making changes\n- `--lock-only` - Re-generate only the lock files\n- `--schema-only` - Re-generate only script schemas (skips flows and apps)\n- `--skip-scripts` - Skip processing scripts\n- `--skip-flows` - Skip processing flows\n- `--skip-apps` - Skip processing apps\n- `--strict-folder-boundaries` - Only update items inside the specified folder (requires folder argument)\n- `--parallel <n:number>` - Number of items to process in parallel\n- `-i --includes <patterns:file[]>` - Comma separated patterns to specify which files to include\n- `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which files to exclude\n\n**Subcommands:**\n\n- `generate-metadata rehash [folder:string]`\n  - `--skip-scripts` - Skip processing scripts\n  - `--skip-flows` - Skip processing flows\n  - `--skip-apps` - Skip processing apps\n  - `--parallel <n:number>` - Number of items to process in parallel\n  - `-i --includes <patterns:file[]>` - Comma separated patterns to specify which files to include\n  - `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which files to exclude\n\n### gitsync-settings\n\nManage git-sync settings between local wmill.yaml and Windmill backend\n\n**Subcommands:**\n\n- `gitsync-settings pull` - Pull git-sync settings from Windmill backend to local wmill.yaml\n  - `--repository <repo:string>` - Specify repository path (e.g., u/user/repo)\n  - `--default` - Write settings to top-level defaults instead of overrides\n  - `--replace` - Replace existing settings (non-interactive mode)\n  - `--override` - Add branch-specific override (non-interactive mode)\n  - `--diff` - Show differences without applying changes\n  - `--json-output` - Output in JSON format\n  - `--with-backend-settings <json:string>` - Use provided JSON settings instead of querying backend (for testing)\n  - `--yes` - Skip interactive prompts and use default behavior\n  - `--promotion <branch:string>` - Use promotionOverrides from the specified branch instead of regular overrides\n- `gitsync-settings push` - Push git-sync settings from local wmill.yaml to Windmill backend\n  - `--repository <repo:string>` - Specify repository path (e.g., u/user/repo)\n  - `--diff` - Show what would be pushed without applying changes\n  - `--json-output` - Output in JSON format\n  - `--with-backend-settings <json:string>` - Use provided JSON settings instead of querying backend (for testing)\n  - `--yes` - Skip interactive prompts and use default behavior\n  - `--promotion <branch:string>` - Use promotionOverrides from the specified branch instead of regular overrides\n\n### group\n\nManage workspace groups\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `group list` - List all groups in the workspace\n  - `--json` - Output as JSON (for piping to jq)\n- `group get <name:string>` - Get group details and members\n  - `--json` - Output as JSON (for piping to jq)\n- `group create <name:string>` - Create a new group\n  - `--summary <summary:string>` - Group summary/description\n- `group delete <name:string>` - Delete a group\n- `group add-user <name:string> <username:string>` - Add a user to a group\n- `group remove-user <name:string> <username:string>` - Remove a user from a group\n\n### hub\n\nHub related commands. EXPERIMENTAL. INTERNAL USE ONLY.\n\n**Subcommands:**\n\n- `hub pull` - pull any supported definitions. EXPERIMENTAL.\n\n### init\n\nBootstrap a windmill project with a wmill.yaml file\n\n**Options:**\n- `--use-default` - Use default settings without checking backend\n- `--use-backend` - Use backend git-sync settings if available\n- `--repository <repo:string>` - Specify repository path (e.g., u/user/repo) when using backend settings\n- `--bind-profile` - Automatically bind active workspace profile to current Git branch\n- `--no-bind-profile` - Skip workspace profile binding prompt\n\n### instance\n\nsync local with a remote instance or the opposite (push or pull)\n\n**Subcommands:**\n\n- `instance add [instance_name:string] [remote:string] [token:string]` - Add a new instance\n- `instance remove <instance:string:instance>` - Remove an instance\n- `instance switch <instance:string:instance>` - Switch the current instance\n- `instance pull` - Pull instance settings, users, configs, instance groups and overwrite local\n  - `--yes` - Pull without needing confirmation\n  - `--dry-run` - Perform a dry run without making changes\n  - `--skip-users` - Skip pulling users\n  - `--skip-settings` - Skip pulling settings\n  - `--skip-configs` - Skip pulling configs (worker groups)\n  - `--skip-groups` - Skip pulling instance groups\n  - `--include-workspaces` - Also pull workspaces\n  - `--folder-per-instance` - Create a folder per instance\n  - `--instance <instance:string>` - Name of the instance to pull from, override the active instance\n  - `--prefix <prefix:string>` - Prefix of the local workspaces to pull, used to create the folders when using --include-workspaces\n  - `--prefix-settings` - Store instance yamls inside prefixed folders when using --prefix and --folder-per-instance\n- `instance push` - Push instance settings, users, configs, group and overwrite remote\n  - `--yes` - Push without needing confirmation\n  - `--dry-run` - Perform a dry run without making changes\n  - `--skip-users` - Skip pushing users\n  - `--skip-settings` - Skip pushing settings\n  - `--skip-configs` - Skip pushing configs (worker groups)\n  - `--skip-groups` - Skip pushing instance groups\n  - `--include-workspaces` - Also push workspaces\n  - `--folder-per-instance` - Create a folder per instance\n  - `--instance <instance:string>` - Name of the instance to push to, override the active instance\n  - `--prefix <prefix:string>` - Prefix of the local workspaces folders to push\n  - `--prefix-settings` - Store instance yamls inside prefixed folders when using --prefix and --folder-per-instance\n- `instance whoami` - Display information about the currently logged-in user\n- `instance get-config` - Dump the current instance config (global settings + worker configs) as YAML\n  - `-o, --output-file <file:string>` - Write YAML to a file instead of stdout\n  - `--show-secrets` - Include sensitive fields (license key, JWT secret) without prompting\n  - `--instance <instance:string>` - Name of the instance, override the active instance\n- `instance connect-slack`\n  - `--bot-token <bot_token:string>` - Slack bot token (xoxb-...)\n  - `--team-id <team_id:string>` - Slack team id\n  - `--team-name <team_name:string>` - Slack team name\n  - `--instance <instance:string>` - Instance profile to connect against (defaults to the active instance)\n\n### job\n\nManage jobs (list, inspect, cancel)\n\n**Subcommands:**\n\n- `job list` - List recent jobs\n- `job get <id:string>` - Get job details. For flows: shows step tree with sub-job IDs\n  - `--json` - Output as JSON (for piping to jq)\n- `job result <id:string>` - Get the result of a completed job (machine-friendly)\n- `job logs <id:string>` - Get job logs. For flows: aggregates all step logs\n- `job cancel <id:string>` - Cancel a running or queued job\n  - `--reason <reason:string>` - Reason for cancellation\n\n### jobs\n\nPull completed and queued jobs from workspace\n\n**Arguments:** `[workspace:string]`\n\n**Options:**\n- `-c, --completed-output <file:string>` - Completed jobs output file (default: completed_jobs.json)\n- `-q, --queued-output <file:string>` - Queued jobs output file (default: queued_jobs.json)\n- `--skip-worker-check` - Skip checking for active workers before export\n\n**Subcommands:**\n\n- `jobs pull`\n- `jobs push`\n\n### lint\n\nValidate Windmill flow, schedule, and trigger YAML files in a directory\n\n**Arguments:** `[directory:string]`\n\n**Options:**\n- `--json` - Output results in JSON format\n- `--fail-on-warn` - Exit with code 1 when warnings are emitted\n- `--locks-required` - Fail if scripts or flow inline scripts that need locks have no locks\n- `-w, --watch` - Watch for file changes and re-lint automatically\n\n### queues\n\nList all queues with their metrics\n\n**Arguments:** `[workspace:string] the optional workspace to filter by (default to all workspaces)`\n\n**Options:**\n- `--instance [instance]` - Name of the instance to push to, override the active instance\n- `--base-url [baseUrl]` - If used with --token, will be used as the base url for the instance\n\n### resource\n\nresource related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `resource list` - list all resources\n  - `--json` - Output as JSON (for piping to jq)\n- `resource get <path:string>` - get a resource's details\n  - `--json` - Output as JSON (for piping to jq)\n- `resource new <path:string>` - create a new resource locally\n- `resource push <file_path:string> <remote_path:string>` - push a local resource spec. This overrides any remote versions.\n\n### resource-type\n\nresource type related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `resource-type list` - list all resource types\n  - `--schema` - Show schema in the output\n  - `--json` - Output as JSON (for piping to jq)\n- `resource-type get <path:string>` - get a resource type's details\n  - `--json` - Output as JSON (for piping to jq)\n- `resource-type new <name:string>` - create a new resource type locally\n- `resource-type push <file_path:string> <name:string>` - push a local resource spec. This overrides any remote versions.\n- `resource-type generate-namespace` - Create a TypeScript definition file with the RT namespace generated from the resource types\n\n### schedule\n\nschedule related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `schedule list` - list all schedules\n  - `--json` - Output as JSON (for piping to jq)\n- `schedule get <path:string>` - get a schedule's details\n  - `--json` - Output as JSON (for piping to jq)\n- `schedule new <path:string>` - create a new schedule locally\n- `schedule push <file_path:string> <remote_path:string>` - push a local schedule spec. This overrides any remote versions.\n- `schedule enable <path:string>` - Enable a schedule\n  - `--force` - Bypass the fork-conflict warning when the parent workspace has the same schedule (acknowledges that both crons will fire)\n- `schedule disable <path:string>` - Disable a schedule\n- `schedule set-permissioned-as <path:string> <email:string>` - Set the email (run-as user) for a schedule (requires admin or wm_deployers group)\n\n### script\n\nscript related commands\n\n**Options:**\n- `--show-archived` - Show archived scripts instead of active ones\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `script list` - list all scripts\n  - `--show-archived` - Show archived scripts instead of active ones\n  - `--json` - Output as JSON (for piping to jq)\n- `script push <path:file>` - push a local script spec. This overrides any remote versions. Use the script file (.ts, .js, .py, .sh)\n  - `--message <message:string>` - Deployment message\n- `script get <path:file>` - get a script's details\n  - `--json` - Output as JSON (for piping to jq)\n- `script show <path:file>` - show a script's content (alias for get)\n- `script run <path:file>` - run a script by path\n  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.\n  - `-s --silent` - Do not output anything other then the final output. Useful for scripting.\n- `script preview <path:file>` - preview a local script without deploying it. Supports both regular and codebase scripts.\n  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.\n  - `-s --silent` - Do not output anything other than the final output. Useful for scripting.\n- `script new <path:file> <language:string>` - create a new script\n  - `--summary <summary:string>` - script summary\n  - `--description <description:string>` - script description\n- `script bootstrap <path:file> <language:string>` - create a new script (alias for new)\n  - `--summary <summary:string>` - script summary\n  - `--description <description:string>` - script description\n- `script set-permissioned-as <path:string> <email:string>` - Set the on_behalf_of_email for a script (requires admin or wm_deployers group)\n- `script history <path:string>` - show version history for a script\n  - `--json` - Output as JSON (for piping to jq)\n\n### sync\n\nsync local with a remote workspaces or the opposite (push or pull)\n\n**Subcommands:**\n\n- `sync pull` - Pull any remote changes and apply them locally.\n  - `--yes` - Pull without needing confirmation\n  - `--dry-run` - Show changes that would be pulled without actually pushing\n  - `--plain-secrets` - Pull secrets as plain text\n  - `--json` - Use JSON instead of YAML\n  - `--skip-variables` - Skip syncing variables (including secrets)\n  - `--skip-secrets` - Skip syncing only secrets variables\n  - `--include-secrets` - Include secrets in sync (overrides skipSecrets in wmill.yaml)\n  - `--skip-resources` - Skip syncing  resources\n  - `--skip-resource-types` - Skip syncing  resource types\n  - `--skip-scripts` - Skip syncing scripts\n  - `--skip-flows` - Skip syncing flows\n  - `--skip-apps` - Skip syncing apps\n  - `--skip-folders` - Skip syncing folders\n  - `--skip-workspace-dependencies` - Skip syncing workspace dependencies\n  - `--skip-scripts-metadata` - Skip syncing scripts metadata, focus solely on logic\n  - `--include-schedules` - Include syncing  schedules\n  - `--include-triggers` - Include syncing triggers\n  - `--include-users` - Include syncing users\n  - `--include-groups` - Include syncing groups\n  - `--include-settings` - Include syncing workspace settings\n  - `--include-key` - Include workspace encryption key\n  - `--skip-branch-validation` - Skip git branch validation and prompts\n  - `--json-output` - Output results in JSON format\n  - `-i --includes <patterns:file[]>` - Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Overrides wmill.yaml includes\n  - `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which file to NOT take into account. Overrides wmill.yaml excludes\n  - `--extra-includes <patterns:file[]>` - Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy\n  - `--repository <repo:string>` - Specify repository path (e.g., u/user/repo) when multiple repositories exist\n  - `--promotion <branch:string>` - Use promotionOverrides from the specified branch instead of regular overrides\n  - `--branch, --env <branch:string>` - [Deprecated: use --workspace] Override the current git branch/environment\n- `sync push` - Push any local changes and apply them remotely.\n  - `--yes` - Push without needing confirmation\n  - `--dry-run` - Show changes that would be pushed without actually pushing\n  - `--plain-secrets` - Push secrets as plain text\n  - `--json` - Use JSON instead of YAML\n  - `--skip-variables` - Skip syncing variables (including secrets)\n  - `--skip-secrets` - Skip syncing only secrets variables\n  - `--include-secrets` - Include secrets in sync (overrides skipSecrets in wmill.yaml)\n  - `--skip-resources` - Skip syncing  resources\n  - `--skip-resource-types` - Skip syncing  resource types\n  - `--skip-scripts` - Skip syncing scripts\n  - `--skip-flows` - Skip syncing flows\n  - `--skip-apps` - Skip syncing apps\n  - `--skip-folders` - Skip syncing folders\n  - `--skip-workspace-dependencies` - Skip syncing workspace dependencies\n  - `--skip-scripts-metadata` - Skip syncing scripts metadata, focus solely on logic\n  - `--include-schedules` - Include syncing schedules\n  - `--include-triggers` - Include syncing triggers\n  - `--include-users` - Include syncing users\n  - `--include-groups` - Include syncing groups\n  - `--include-settings` - Include syncing workspace settings\n  - `--include-key` - Include workspace encryption key\n  - `--skip-branch-validation` - Skip git branch validation and prompts\n  - `--json-output` - Output results in JSON format\n  - `-i --includes <patterns:file[]>` - Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)\n  - `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which file to NOT take into account.\n  - `--extra-includes <patterns:file[]>` - Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy\n  - `--message <message:string>` - Include a message that will be added to all scripts/flows/apps updated during this push\n  - `--parallel <number>` - Number of changes to process in parallel\n  - `--repository <repo:string>` - Specify repository path (e.g., u/user/repo) when multiple repositories exist\n  - `--branch, --env <branch:string>` - [Deprecated: use --workspace] Override the current git branch/environment\n  - `--lint` - Run lint validation before pushing\n  - `--locks-required` - Fail if scripts or flow inline scripts that need locks have no locks\n  - `--auto-metadata` - Automatically regenerate stale metadata (locks and schemas) before pushing\n  - `--accept-overriding-permissioned-as-with-self` - Accept that items with a different permissioned_as will be updated with your own user\n\n### token\n\nManage API tokens\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `token list` - List API tokens\n  - `--json` - Output as JSON (for piping to jq)\n- `token create` - Create a new API token\n  - `--label <label:string>` - Token label\n  - `--expiration <expiration:string>` - Token expiration (ISO 8601 timestamp)\n- `token delete <token_prefix:string>` - Delete a token by its prefix\n\n### trigger\n\ntrigger related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `trigger list` - list all triggers\n  - `--json` - Output as JSON (for piping to jq)\n- `trigger get <path:string>` - get a trigger's details\n  - `--json` - Output as JSON (for piping to jq)\n  - `--kind <kind:string>` - Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email). Recommended for faster lookup\n- `trigger new <path:string>` - create a new trigger locally\n  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)\n- `trigger push <file_path:string> <remote_path:string>` - push a local trigger spec. This overrides any remote versions.\n- `trigger set-permissioned-as <path:string> <email:string>` - Set the email (run-as user) for a trigger (requires admin or wm_deployers group)\n  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)\n\n### user\n\nuser related commands\n\n**Subcommands:**\n\n- `user add <email:string> [password:string]` - Create a user\n  - `--superadmin` - Specify to make the new user superadmin.\n  - `--company <company:string>` - Specify to set the company of the new user.\n  - `--name <name:string>` - Specify to set the name of the new user.\n- `user remove <email:string>` - Delete a user\n- `user create-token` - Create a new API token for the authenticated user\n  - `--email <email:string>` - Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.\n  - `--password <password:string>` - Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.\n\n### variable\n\nvariable related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `variable list` - list all variables\n  - `--json` - Output as JSON (for piping to jq)\n- `variable get <path:string>` - get a variable's details\n  - `--json` - Output as JSON (for piping to jq)\n- `variable new <path:string>` - create a new variable locally\n- `variable push <file_path:string> <remote_path:string>` - Push a local variable spec. This overrides any remote versions.\n  - `--plain-secrets` - Push secrets as plain text\n- `variable add <value:string> <remote_path:string>` - Create a new variable on the remote. This will update the variable if it already exists.\n  - `--plain-secrets` - Push secrets as plain text\n  - `--public` - Legacy option, use --plain-secrets instead\n\n### version\n\nShow version information\n\n### worker-groups\n\ndisplay worker groups, pull and push worker groups configs\n\n**Subcommands:**\n\n- `worker-groups pull` - Pull worker groups (similar to `wmill instance pull --skip-users --skip-settings --skip-groups`)\n  - `--instance` - Name of the instance to push to, override the active instance\n  - `--base-url` - Base url to be passed to the instance settings instead of the local one\n  - `--yes` - Pull without needing confirmation\n- `worker-groups push` - Push worker groups (similar to `wmill instance push --skip-users --skip-settings --skip-groups`)\n  - `--instance [instance]` - Name of the instance to push to, override the active instance\n  - `--base-url [baseUrl]` - If used with --token, will be used as the base url for the instance\n  - `--yes` - Push without needing confirmation\n\n### workers\n\nList all workers grouped by worker groups\n\n**Options:**\n- `--instance [instance]` - Name of the instance to push to, override the active instance\n- `--base-url [baseUrl]` - If used with --token, will be used as the base url for the instance\n\n### workspace\n\nworkspace related commands\n\n**Alias:** `profile`\n\n**Subcommands:**\n\n- `workspace switch <workspace_name:string:workspace>` - Switch to another workspace\n- `workspace add [workspace_name:string] [workspace_id:string] [remote:string]` - Add a workspace\n  - `-c --create` - Create the workspace if it does not exist\n  - `--create-workspace-name <workspace_name:string>` - Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.\n  - `--create-username <username:string>` - Specify your own username in the newly created workspace. Ignored if --create is not specified, the workspace already exists or automatic username creation is enabled on the instance.\n- `workspace remove <workspace_name:string>` - Remove a workspace\n- `workspace whoami` - Show the currently active user\n- `workspace list` - List local workspace profiles\n- `workspace list-remote` - List workspaces on the remote server that you have access to\n  - `--as-superadmin` - List ALL workspaces on the instance (requires the token to belong to a superadmin/devops user)\n- `workspace list-forks` - List forked workspaces on the remote server\n- `workspace bind` - Create or update a workspace entry in wmill.yaml from the active profile\n  - `--workspace <name:string>` - Workspace name (default: current branch or workspaceId)\n  - `--branch <branch:string>` - Git branch to associate (default: workspace name)\n- `workspace unbind` - Remove baseUrl and workspaceId from a workspace entry\n  - `--workspace <name:string>` - Workspace to unbind\n- `workspace fork [workspace_name:string] [workspace_id:string]` - Create a forked workspace\n  - `--create-workspace-name <workspace_name:string>` - Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.\n  - `--color <color:string>` - Workspace color (hex code, e.g. #ff0000)\n  - `--datatable-behavior <behavior:string>` - How to handle datatables: skip, schema_only, or schema_and_data (default: interactive prompt)\n  - `-y --yes` - Skip interactive prompts (defaults datatable behavior to 'skip')\n- `workspace delete-fork <fork_name:string>` - Delete a forked workspace and git branch\n  - `-y --yes` - Skip confirmation prompt\n- `workspace merge` - Compare and deploy changes between a fork and its parent workspace\n  - `--direction <direction:string>` - Deploy direction: to-parent or to-fork\n  - `--all` - Deploy all changed items including conflicts\n  - `--skip-conflicts` - Skip items modified in both workspaces\n  - `--include <items:string>` - Comma-separated kind:path items to include (e.g. script:f/test/main,flow:f/my/flow)\n  - `--exclude <items:string>` - Comma-separated kind:path items to exclude\n  - `--preserve-on-behalf-of` - Preserve original on_behalf_of/permissioned_as values\n  - `-y --yes` - Non-interactive mode (deploy without prompts)\n- `workspace connect-slack` - Non-interactively connect Slack to the active workspace using a pre-minted bot token (xoxb-...). Produces the same artifacts as the UI OAuth flow: workspace_settings fields, g/slack group, f/slack_bot folder, and the encrypted bot token variable + resource at f/slack_bot/bot_token.\n  - `--bot-token <bot_token:string>` - Slack bot token (xoxb-...)\n  - `--team-id <team_id:string>` - Slack team id\n  - `--team-name <team_name:string>` - Slack team name\n- `workspace disconnect-slack`\n\n";
 export declare const LANG_BASH = "# Bash\n\n## Structure\n\nDo not include `#!/bin/bash`. Arguments are obtained as positional parameters:\n\n```bash\n# Get arguments\nvar1=\"$1\"\nvar2=\"$2\"\n\necho \"Processing $var1 and $var2\"\n\n# Return JSON by echoing to stdout\necho \"{\\\"result\\\": \\\"$var1\\\", \\\"count\\\": $var2}\"\n```\n\n**Important:**\n- Do not include shebang (`#!/bin/bash`)\n- Arguments are always strings\n- Access with `$1`, `$2`, etc.\n\n## Output\n\nThe script output is captured as the result. For structured data, output valid JSON:\n\n```bash\nname=\"$1\"\ncount=\"$2\"\n\n# Output JSON result\ncat << EOF\n{\n  \"name\": \"$name\",\n  \"count\": $count,\n  \"timestamp\": \"$(date -Iseconds)\"\n}\nEOF\n```\n\n## Environment Variables\n\nEnvironment variables set in Windmill are available:\n\n```bash\n# Access environment variable\necho \"Workspace: $WM_WORKSPACE\"\necho \"Job ID: $WM_JOB_ID\"\n```\n";
-export declare const LANG_BIGQUERY = "# BigQuery\n\nArguments use `@name` syntax.\n\nName the parameters by adding comments before the statement:\n\n```sql\n-- @name1 (string)\n-- @name2 (int64) = 0\nSELECT * FROM users WHERE name = @name1 AND age > @name2;\n```\n";
-export declare const LANG_BUN = "# TypeScript (Bun)\n\nBun runtime with full npm ecosystem and fastest execution.\n\n## Structure\n\nExport a single **async** function called `main`:\n\n```typescript\nexport async function main(param1: string, param2: number) {\n  // Your code here\n  return { result: param1, count: param2 };\n}\n```\n\nDo not call the main function. Libraries are installed automatically.\n\n## Resource Types\n\nOn Windmill, credentials and configuration are stored in resources and passed as parameters to main.\n\nUse the `RT` namespace for resource types:\n\n```typescript\nexport async function main(stripe: RT.Stripe) {\n  // stripe contains API key and config from the resource\n}\n```\n\nOnly use resource types if you need them to satisfy the instructions. Always use the RT namespace.\n\nBefore using a resource type, check the `rt.d.ts` file in the project root to see all available resource types and their fields. This file is generated by `wmill resource-type generate-namespace`.\n\n## Imports\n\n```typescript\nimport Stripe from \"stripe\";\nimport { someFunction } from \"some-package\";\n```\n\n## Windmill Client\n\nImport the windmill client for platform interactions:\n\n```typescript\nimport * as wmill from \"windmill-client\";\n```\n\nSee the SDK documentation for available methods.\n\n## Preprocessor Scripts\n\nFor preprocessor scripts, the function should be named `preprocessor` and receives an `event` parameter:\n\n```typescript\ntype Event = {\n  kind:\n    | \"webhook\"\n    | \"http\"\n    | \"websocket\"\n    | \"kafka\"\n    | \"email\"\n    | \"nats\"\n    | \"postgres\"\n    | \"sqs\"\n    | \"mqtt\"\n    | \"gcp\";\n  body: any;\n  headers: Record<string, string>;\n  query: Record<string, string>;\n};\n\nexport async function preprocessor(event: Event) {\n  return {\n    param1: event.body.field1,\n    param2: event.query.id,\n  };\n}\n```\n\n## S3 Object Operations\n\nWindmill provides built-in support for S3-compatible storage operations.\n\n### S3Object Type\n\nThe S3Object type represents a file in S3 storage:\n\n```typescript\ntype S3Object = {\n  s3: string; // Path within the bucket\n};\n```\n\n## TypeScript Operations\n\n```typescript\nimport * as wmill from \"windmill-client\";\n\n// Load file content from S3\nconst content: Uint8Array = await wmill.loadS3File(s3object);\n\n// Load file as stream\nconst blob: Blob = await wmill.loadS3FileStream(s3object);\n\n// Write file to S3\nconst result: S3Object = await wmill.writeS3File(\n  s3object, // Target path (or undefined to auto-generate)\n  fileContent, // string or Blob\n  s3ResourcePath // Optional: specific S3 resource to use\n);\n```\n";
-export declare const LANG_BUNNATIVE = "# TypeScript (Bun Native)\n\nNative TypeScript execution with fetch only - no external imports allowed.\n\n## Structure\n\nExport a single **async** function called `main`:\n\n```typescript\nexport async function main(param1: string, param2: number) {\n  // Your code here\n  return { result: param1, count: param2 };\n}\n```\n\nDo not call the main function.\n\n## Resource Types\n\nOn Windmill, credentials and configuration are stored in resources and passed as parameters to main.\n\nUse the `RT` namespace for resource types:\n\n```typescript\nexport async function main(stripe: RT.Stripe) {\n  // stripe contains API key and config from the resource\n}\n```\n\nOnly use resource types if you need them to satisfy the instructions. Always use the RT namespace.\n\nBefore using a resource type, check the `rt.d.ts` file in the project root to see all available resource types and their fields. This file is generated by `wmill resource-type generate-namespace`.\n\n## Imports\n\n**No imports allowed.** Use the globally available `fetch` function:\n\n```typescript\nexport async function main(url: string) {\n  const response = await fetch(url);\n  return await response.json();\n}\n```\n\n## Windmill Client\n\nThe windmill client is not available in native TypeScript mode. Use fetch to call APIs directly.\n\n## Preprocessor Scripts\n\nFor preprocessor scripts, the function should be named `preprocessor` and receives an `event` parameter:\n\n```typescript\ntype Event = {\n  kind:\n    | \"webhook\"\n    | \"http\"\n    | \"websocket\"\n    | \"kafka\"\n    | \"email\"\n    | \"nats\"\n    | \"postgres\"\n    | \"sqs\"\n    | \"mqtt\"\n    | \"gcp\";\n  body: any;\n  headers: Record<string, string>;\n  query: Record<string, string>;\n};\n\nexport async function preprocessor(event: Event) {\n  return {\n    param1: event.body.field1,\n    param2: event.query.id,\n  };\n}\n```\n\n## S3 Object Operations\n\nWindmill provides built-in support for S3-compatible storage operations.\n\n### S3Object Type\n\nThe S3Object type represents a file in S3 storage:\n\n```typescript\ntype S3Object = {\n  s3: string; // Path within the bucket\n};\n```\n\n## TypeScript Operations\n\n```typescript\nimport * as wmill from \"windmill-client\";\n\n// Load file content from S3\nconst content: Uint8Array = await wmill.loadS3File(s3object);\n\n// Load file as stream\nconst blob: Blob = await wmill.loadS3FileStream(s3object);\n\n// Write file to S3\nconst result: S3Object = await wmill.writeS3File(\n  s3object, // Target path (or undefined to auto-generate)\n  fileContent, // string or Blob\n  s3ResourcePath // Optional: specific S3 resource to use\n);\n```\n";
+export declare const LANG_BIGQUERY = "# BigQuery\n\nArguments use `@name` syntax.\n\nName the parameters by adding comments before the statement:\n\n```sql\n-- @name1 (string)\n-- @name2 (int64) = 0\nSELECT * FROM users WHERE name = @name1 AND age > @name2;\n```\n\n## Receiving an S3Object as a script parameter\n\nDeclare the arg with type `(s3object)`. Windmill renders an S3 file picker for\nit, downloads the file, and binds it as a `STRING` JSON parameter \u2014 Parquet/CSV\nfiles are decoded server-side into a JSON array of records, JSON/JSONL pass\nthrough. Consume with `JSON_EXTRACT_ARRAY` / `JSON_VALUE`:\n\n```sql\n-- @file (s3object)\nSELECT\n  CAST(JSON_VALUE(row, '$.id') AS INT64) AS id,\n  JSON_VALUE(row, '$.name') AS name\nFROM UNNEST(JSON_EXTRACT_ARRAY(@file)) AS row;\n```\n\n## Streaming query results to S3\n\nAdd a `-- s3` directive at the top of the script to stream the result set to S3\ninstead of returning rows. Windmill writes the file and returns its `S3Object`\nas the script result.\n\n```sql\n-- s3 prefix=exports/users format=parquet\nSELECT id, name FROM users;\n```\n\nAll keys are optional: `prefix` (object key prefix), `storage` (named storage \u2014\nomit to use the workspace default), `format` (`json` (default), `parquet`, or\n`csv`). Use this for large result sets \u2014 rows stream directly to S3 instead of\nbeing buffered, bypassing the 10000-row return cap.\n";
+export declare const LANG_BUN = "# TypeScript (Bun)\n\nBun runtime with full npm ecosystem and fastest execution.\n\n## Structure\n\nExport a single **async** function called `main`:\n\n```typescript\nexport async function main(param1: string, param2: number) {\n  // Your code here\n  return { result: param1, count: param2 };\n}\n```\n\nDo not call the main function. Libraries are installed automatically.\n\n## Resource Types\n\nOn Windmill, credentials and configuration are stored in resources and passed as parameters to main.\n\nUse the `RT` namespace for resource types:\n\n```typescript\nexport async function main(stripe: RT.Stripe) {\n  // stripe contains API key and config from the resource\n}\n```\n\nOnly use resource types if you need them to satisfy the instructions. Always use the RT namespace.\n\nBefore using a resource type, check the `rt.d.ts` file in the project root to see all available resource types and their fields. This file is generated by `wmill resource-type generate-namespace`.\n\n## Imports\n\n```typescript\nimport Stripe from \"stripe\";\nimport { someFunction } from \"some-package\";\n```\n\n## Windmill Client\n\nImport the windmill client for platform interactions:\n\n```typescript\nimport * as wmill from \"windmill-client\";\n```\n\nSee the SDK documentation for available methods.\n\n## Preprocessor Scripts\n\nFor preprocessor scripts, the function should be named `preprocessor` and receives an `event` parameter:\n\n```typescript\ntype Event = {\n  kind:\n    | \"webhook\"\n    | \"http\"\n    | \"websocket\"\n    | \"kafka\"\n    | \"email\"\n    | \"nats\"\n    | \"postgres\"\n    | \"sqs\"\n    | \"mqtt\"\n    | \"gcp\";\n  body: any;\n  headers: Record<string, string>;\n  query: Record<string, string>;\n};\n\nexport async function preprocessor(event: Event) {\n  return {\n    param1: event.body.field1,\n    param2: event.query.id,\n  };\n}\n```\n\n## S3 Object Operations\n\nWindmill provides built-in support for S3-compatible storage operations. The `wmill.S3Object` type covers both the `s3://storage/key` URI form (`s3:///key` for the workspace default storage) and the `{ s3, storage? }` record form \u2014 always use it instead of redefining your own.\n\n### Receiving an S3Object as a script parameter\n\n```typescript\nimport * as wmill from \"windmill-client\";\n\nexport async function main(file: wmill.S3Object) {\n  const content = await wmill.loadS3File(file);\n  // ...\n}\n```\n\n### S3 operations\n\n```typescript\nimport * as wmill from \"windmill-client\";\n\n// Load file content from S3\nconst content: Uint8Array = await wmill.loadS3File(s3object);\n\n// Load file as stream\nconst blob: Blob = await wmill.loadS3FileStream(s3object);\n\n// Write file to S3\nconst result: wmill.S3Object = await wmill.writeS3File(\n  s3object, // Target path (or undefined to auto-generate)\n  fileContent, // string or Blob\n  s3ResourcePath // Optional: specific S3 resource to use\n);\n```\n";
+export declare const LANG_BUNNATIVE = "# TypeScript (Bun Native)\n\nNative TypeScript execution with fetch only - no external imports allowed.\n\n## Structure\n\nExport a single **async** function called `main`:\n\n```typescript\nexport async function main(param1: string, param2: number) {\n  // Your code here\n  return { result: param1, count: param2 };\n}\n```\n\nDo not call the main function.\n\n## Resource Types\n\nOn Windmill, credentials and configuration are stored in resources and passed as parameters to main.\n\nUse the `RT` namespace for resource types:\n\n```typescript\nexport async function main(stripe: RT.Stripe) {\n  // stripe contains API key and config from the resource\n}\n```\n\nOnly use resource types if you need them to satisfy the instructions. Always use the RT namespace.\n\nBefore using a resource type, check the `rt.d.ts` file in the project root to see all available resource types and their fields. This file is generated by `wmill resource-type generate-namespace`.\n\n## Imports\n\n**No imports allowed.** Use the globally available `fetch` function:\n\n```typescript\nexport async function main(url: string) {\n  const response = await fetch(url);\n  return await response.json();\n}\n```\n\n## Windmill Client\n\nThe windmill client is not available in native TypeScript mode. Use fetch to call APIs directly.\n\n## Preprocessor Scripts\n\nFor preprocessor scripts, the function should be named `preprocessor` and receives an `event` parameter:\n\n```typescript\ntype Event = {\n  kind:\n    | \"webhook\"\n    | \"http\"\n    | \"websocket\"\n    | \"kafka\"\n    | \"email\"\n    | \"nats\"\n    | \"postgres\"\n    | \"sqs\"\n    | \"mqtt\"\n    | \"gcp\";\n  body: any;\n  headers: Record<string, string>;\n  query: Record<string, string>;\n};\n\nexport async function preprocessor(event: Event) {\n  return {\n    param1: event.body.field1,\n    param2: event.query.id,\n  };\n}\n```\n\n## S3 Object Operations\n\nWindmill provides built-in support for S3-compatible storage operations. The `wmill.S3Object` type covers both the `s3://storage/key` URI form (`s3:///key` for the workspace default storage) and the `{ s3, storage? }` record form \u2014 always use it instead of redefining your own.\n\n### Receiving an S3Object as a script parameter\n\n```typescript\nimport * as wmill from \"windmill-client\";\n\nexport async function main(file: wmill.S3Object) {\n  const content = await wmill.loadS3File(file);\n  // ...\n}\n```\n\n### S3 operations\n\n```typescript\nimport * as wmill from \"windmill-client\";\n\n// Load file content from S3\nconst content: Uint8Array = await wmill.loadS3File(s3object);\n\n// Load file as stream\nconst blob: Blob = await wmill.loadS3FileStream(s3object);\n\n// Write file to S3\nconst result: wmill.S3Object = await wmill.writeS3File(\n  s3object, // Target path (or undefined to auto-generate)\n  fileContent, // string or Blob\n  s3ResourcePath // Optional: specific S3 resource to use\n);\n```\n";
 export declare const LANG_CSHARP = "# C#\n\nThe script must contain a public static `Main` method inside a class:\n\n```csharp\npublic class Script\n{\n    public static object Main(string name, int count)\n    {\n        return new { Name = name, Count = count };\n    }\n}\n```\n\n**Important:**\n- Class name is irrelevant\n- Method must be `public static`\n- Return type can be `object` or specific type\n\n## NuGet Packages\n\nAdd packages using the `#r` directive at the top:\n\n```csharp\n#r \"nuget: Newtonsoft.Json, 13.0.3\"\n#r \"nuget: RestSharp, 110.2.0\"\n\nusing Newtonsoft.Json;\nusing RestSharp;\n\npublic class Script\n{\n    public static object Main(string url)\n    {\n        var client = new RestClient(url);\n        var request = new RestRequest();\n        var response = client.Get(request);\n        return JsonConvert.DeserializeObject(response.Content);\n    }\n}\n```\n";
-export declare const LANG_DENO = "# TypeScript (Deno)\n\nDeno runtime with npm support via `npm:` prefix and native Deno libraries.\n\n## Structure\n\nExport a single **async** function called `main`:\n\n```typescript\nexport async function main(param1: string, param2: number) {\n  // Your code here\n  return { result: param1, count: param2 };\n}\n```\n\nDo not call the main function. Libraries are installed automatically.\n\n## Resource Types\n\nOn Windmill, credentials and configuration are stored in resources and passed as parameters to main.\n\nUse the `RT` namespace for resource types:\n\n```typescript\nexport async function main(stripe: RT.Stripe) {\n  // stripe contains API key and config from the resource\n}\n```\n\nOnly use resource types if you need them to satisfy the instructions. Always use the RT namespace.\n\nBefore using a resource type, check the `rt.d.ts` file in the project root to see all available resource types and their fields. This file is generated by `wmill resource-type generate-namespace`.\n\n## Imports\n\n```typescript\n// npm packages use npm: prefix\nimport Stripe from \"npm:stripe\";\nimport { someFunction } from \"npm:some-package\";\n\n// Deno standard library\nimport { serve } from \"https://deno.land/std/http/server.ts\";\n```\n\n## Windmill Client\n\nImport the windmill client for platform interactions:\n\n```typescript\nimport * as wmill from \"windmill-client\";\n```\n\nSee the SDK documentation for available methods.\n\n## Preprocessor Scripts\n\nFor preprocessor scripts, the function should be named `preprocessor` and receives an `event` parameter:\n\n```typescript\ntype Event = {\n  kind:\n    | \"webhook\"\n    | \"http\"\n    | \"websocket\"\n    | \"kafka\"\n    | \"email\"\n    | \"nats\"\n    | \"postgres\"\n    | \"sqs\"\n    | \"mqtt\"\n    | \"gcp\";\n  body: any;\n  headers: Record<string, string>;\n  query: Record<string, string>;\n};\n\nexport async function preprocessor(event: Event) {\n  return {\n    param1: event.body.field1,\n    param2: event.query.id,\n  };\n}\n```\n\n## S3 Object Operations\n\nWindmill provides built-in support for S3-compatible storage operations.\n\n### S3Object Type\n\nThe S3Object type represents a file in S3 storage:\n\n```typescript\ntype S3Object = {\n  s3: string; // Path within the bucket\n};\n```\n\n## TypeScript Operations\n\n```typescript\nimport * as wmill from \"windmill-client\";\n\n// Load file content from S3\nconst content: Uint8Array = await wmill.loadS3File(s3object);\n\n// Load file as stream\nconst blob: Blob = await wmill.loadS3FileStream(s3object);\n\n// Write file to S3\nconst result: S3Object = await wmill.writeS3File(\n  s3object, // Target path (or undefined to auto-generate)\n  fileContent, // string or Blob\n  s3ResourcePath // Optional: specific S3 resource to use\n);\n```\n";
-export declare const LANG_DUCKDB = "# DuckDB\n\nArguments are defined with comments and used with `$name` syntax:\n\n```sql\n-- $name (text) = default\n-- $age (integer)\nSELECT * FROM users WHERE name = $name AND age > $age;\n```\n\n## Ducklake Integration\n\nAttach Ducklake for data lake operations:\n\n```sql\n-- Main ducklake\nATTACH 'ducklake' AS dl;\n\n-- Named ducklake\nATTACH 'ducklake://my_lake' AS dl;\n\n-- Then query\nSELECT * FROM dl.schema.table;\n```\n\n## External Database Connections\n\nConnect to external databases using resources:\n\n```sql\nATTACH '$res:path/to/resource' AS db (TYPE postgres);\nSELECT * FROM db.schema.table;\n```\n\n## S3 File Operations\n\nRead files from S3 storage:\n\n```sql\n-- Default storage\nSELECT * FROM read_csv('s3:///path/to/file.csv');\n\n-- Named storage\nSELECT * FROM read_csv('s3://storage_name/path/to/file.csv');\n\n-- Parquet files\nSELECT * FROM read_parquet('s3:///path/to/file.parquet');\n\n-- JSON files\nSELECT * FROM read_json('s3:///path/to/file.json');\n```\n";
+export declare const LANG_DENO = "# TypeScript (Deno)\n\nDeno runtime with npm support via `npm:` prefix and native Deno libraries.\n\n## Structure\n\nExport a single **async** function called `main`:\n\n```typescript\nexport async function main(param1: string, param2: number) {\n  // Your code here\n  return { result: param1, count: param2 };\n}\n```\n\nDo not call the main function. Libraries are installed automatically.\n\n## Resource Types\n\nOn Windmill, credentials and configuration are stored in resources and passed as parameters to main.\n\nUse the `RT` namespace for resource types:\n\n```typescript\nexport async function main(stripe: RT.Stripe) {\n  // stripe contains API key and config from the resource\n}\n```\n\nOnly use resource types if you need them to satisfy the instructions. Always use the RT namespace.\n\nBefore using a resource type, check the `rt.d.ts` file in the project root to see all available resource types and their fields. This file is generated by `wmill resource-type generate-namespace`.\n\n## Imports\n\n```typescript\n// npm packages use npm: prefix\nimport Stripe from \"npm:stripe\";\nimport { someFunction } from \"npm:some-package\";\n\n// Deno standard library\nimport { serve } from \"https://deno.land/std/http/server.ts\";\n```\n\n## Windmill Client\n\nImport the windmill client for platform interactions:\n\n```typescript\nimport * as wmill from \"windmill-client\";\n```\n\nSee the SDK documentation for available methods.\n\n## Preprocessor Scripts\n\nFor preprocessor scripts, the function should be named `preprocessor` and receives an `event` parameter:\n\n```typescript\ntype Event = {\n  kind:\n    | \"webhook\"\n    | \"http\"\n    | \"websocket\"\n    | \"kafka\"\n    | \"email\"\n    | \"nats\"\n    | \"postgres\"\n    | \"sqs\"\n    | \"mqtt\"\n    | \"gcp\";\n  body: any;\n  headers: Record<string, string>;\n  query: Record<string, string>;\n};\n\nexport async function preprocessor(event: Event) {\n  return {\n    param1: event.body.field1,\n    param2: event.query.id,\n  };\n}\n```\n\n## S3 Object Operations\n\nWindmill provides built-in support for S3-compatible storage operations. The `wmill.S3Object` type covers both the `s3://storage/key` URI form (`s3:///key` for the workspace default storage) and the `{ s3, storage? }` record form \u2014 always use it instead of redefining your own.\n\n### Receiving an S3Object as a script parameter\n\n```typescript\nimport * as wmill from \"windmill-client\";\n\nexport async function main(file: wmill.S3Object) {\n  const content = await wmill.loadS3File(file);\n  // ...\n}\n```\n\n### S3 operations\n\n```typescript\nimport * as wmill from \"windmill-client\";\n\n// Load file content from S3\nconst content: Uint8Array = await wmill.loadS3File(s3object);\n\n// Load file as stream\nconst blob: Blob = await wmill.loadS3FileStream(s3object);\n\n// Write file to S3\nconst result: wmill.S3Object = await wmill.writeS3File(\n  s3object, // Target path (or undefined to auto-generate)\n  fileContent, // string or Blob\n  s3ResourcePath // Optional: specific S3 resource to use\n);\n```\n";
+export declare const LANG_DUCKDB = "# DuckDB\n\nArguments are defined with comments and used with `$name` syntax:\n\n```sql\n-- $name (text) = default\n-- $age (integer)\nSELECT * FROM users WHERE name = $name AND age > $age;\n```\n\n## Ducklake Integration\n\nAttach Ducklake for data lake operations:\n\n```sql\n-- Main ducklake\nATTACH 'ducklake' AS dl;\n\n-- Named ducklake\nATTACH 'ducklake://my_lake' AS dl;\n\n-- Then query\nSELECT * FROM dl.schema.table;\n```\n\n## External Database Connections\n\nConnect to external databases using resources:\n\n```sql\nATTACH '$res:path/to/resource' AS db (TYPE postgres);\nSELECT * FROM db.schema.table;\n```\n\n## S3 File Operations\n\nRead files from S3 storage:\n\n```sql\n-- Default storage\nSELECT * FROM read_csv('s3:///path/to/file.csv');\n\n-- Named storage\nSELECT * FROM read_csv('s3://storage_name/path/to/file.csv');\n\n-- Parquet files\nSELECT * FROM read_parquet('s3:///path/to/file.parquet');\n\n-- JSON files\nSELECT * FROM read_json('s3:///path/to/file.json');\n```\n\n### Receiving an S3Object as a script parameter\n\nDeclare the arg with type `(s3object)`. Windmill renders an S3 file picker for it\nand binds the arg as the bare `s3://storage/key` URI, which DuckDB's reader\nfunctions consume directly:\n\n```sql\n-- $file (s3object)\nSELECT * FROM read_parquet($file);\n```\n\nWorks with any DuckDB reader: `read_csv($file)`, `read_json($file)`, etc.\n\n### Writing query results to S3\n\nDuckDB writes to S3 natively via `COPY ... TO`:\n\n```sql\nCOPY (SELECT * FROM users) TO 's3:///exports/users.parquet' (FORMAT PARQUET);\n```\n\nUse this instead of the `-- s3` streaming directive supported by the other SQL\ndialects \u2014 that directive is not available in DuckDB.\n";
 export declare const LANG_GO = "# Go\n\n## Structure\n\nThe file package must be `inner` and export a function called `main`:\n\n```go\npackage inner\n\nfunc main(param1 string, param2 int) (map[string]interface{}, error) {\n    return map[string]interface{}{\n        \"result\": param1,\n        \"count\":  param2,\n    }, nil\n}\n```\n\n**Important:**\n- Package must be `inner`\n- Return type must be `({return_type}, error)`\n- Function name is `main` (lowercase)\n\n## Return Types\n\nThe return type can be any Go type that can be serialized to JSON:\n\n```go\npackage inner\n\ntype Result struct {\n    Name  string `json:\"name\"`\n    Count int    `json:\"count\"`\n}\n\nfunc main(name string, count int) (Result, error) {\n    return Result{\n        Name:  name,\n        Count: count,\n    }, nil\n}\n```\n\n## Error Handling\n\nReturn errors as the second return value:\n\n```go\npackage inner\n\nimport \"errors\"\n\nfunc main(value int) (string, error) {\n    if value < 0 {\n        return \"\", errors.New(\"value must be positive\")\n    }\n    return \"success\", nil\n}\n```\n";
 export declare const LANG_GRAPHQL = "# GraphQL\n\n## Structure\n\nWrite GraphQL queries or mutations. Arguments can be added as query parameters:\n\n```graphql\nquery GetUser($id: ID!) {\n  user(id: $id) {\n    id\n    name\n    email\n  }\n}\n```\n\n## Variables\n\nVariables are passed as script arguments and automatically bound to the query:\n\n```graphql\nquery SearchProducts($query: String!, $limit: Int = 10) {\n  products(search: $query, first: $limit) {\n    edges {\n      node {\n        id\n        name\n        price\n      }\n    }\n  }\n}\n```\n\n## Mutations\n\n```graphql\nmutation CreateUser($input: CreateUserInput!) {\n  createUser(input: $input) {\n    id\n    name\n    createdAt\n  }\n}\n```\n";
 export declare const LANG_JAVA = "# Java\n\nThe script must contain a Main public class with a `public static main()` method:\n\n```java\npublic class Main {\n    public static Object main(String name, int count) {\n        java.util.Map<String, Object> result = new java.util.HashMap<>();\n        result.put(\"name\", name);\n        result.put(\"count\", count);\n        return result;\n    }\n}\n```\n\n**Important:**\n- Class must be named `Main`\n- Method must be `public static Object main(...)`\n- Return type is `Object` or `void`\n\n## Maven Dependencies\n\nAdd dependencies using comments at the top:\n\n```java\n//requirements:\n//com.google.code.gson:gson:2.10.1\n//org.apache.httpcomponents:httpclient:4.5.14\n\nimport com.google.gson.Gson;\n\npublic class Main {\n    public static Object main(String input) {\n        Gson gson = new Gson();\n        return gson.fromJson(input, Object.class);\n    }\n}\n```\n";
-export declare const LANG_MSSQL = "# Microsoft SQL Server (MSSQL)\n\nArguments use `@P1`, `@P2`, etc.\n\nName the parameters by adding comments before the statement:\n\n```sql\n-- @P1 name1 (varchar)\n-- @P2 name2 (int) = 0\nSELECT * FROM users WHERE name = @P1 AND age > @P2;\n```\n";
-export declare const LANG_MYSQL = "# MySQL\n\nArguments use `?` placeholders.\n\nName the parameters by adding comments before the statement:\n\n```sql\n-- ? name1 (text)\n-- ? name2 (int) = 0\nSELECT * FROM users WHERE name = ? AND age > ?;\n```\n";
+export declare const LANG_MSSQL = "# Microsoft SQL Server (MSSQL)\n\nArguments use `@P1`, `@P2`, etc.\n\nName the parameters by adding comments before the statement:\n\n```sql\n-- @P1 name1 (varchar)\n-- @P2 name2 (int) = 0\nSELECT * FROM users WHERE name = @P1 AND age > @P2;\n```\n\n## Receiving an S3Object as a script parameter\n\nDeclare the arg with type `(s3object)`. Windmill renders an S3 file picker for\nit, downloads the file, and binds it as `nvarchar(max)` JSON text \u2014 Parquet/CSV\nfiles are decoded server-side into a JSON array of records, JSON/JSONL pass\nthrough. Consume with `OPENJSON`:\n\n```sql\n-- @P1 file (s3object)\nSELECT id, name\nFROM OPENJSON(@P1)\nWITH (id INT, name NVARCHAR(200));\n```\n\n## Streaming query results to S3\n\nAdd a `-- s3` directive at the top of the script to stream the result set to S3\ninstead of returning rows. Windmill writes the file and returns its `S3Object`\nas the script result.\n\n```sql\n-- s3 prefix=exports/users format=parquet\nSELECT id, name FROM users;\n```\n\nAll keys are optional: `prefix` (object key prefix), `storage` (named storage \u2014\nomit to use the workspace default), `format` (`json` (default), `parquet`, or\n`csv`). Use this for large result sets \u2014 rows stream directly to S3 instead of\nbeing buffered as the script return value.\n";
+export declare const LANG_MYSQL = "# MySQL\n\nArguments use `?` placeholders.\n\nName the parameters by adding comments before the statement:\n\n```sql\n-- ? name1 (text)\n-- ? name2 (int) = 0\nSELECT * FROM users WHERE name = ? AND age > ?;\n```\n\n## Receiving an S3Object as a script parameter\n\nDeclare the arg with type `(s3object)`. Windmill renders an S3 file picker for\nit, downloads the file, and binds it as JSON text \u2014 Parquet/CSV files are\ndecoded server-side into a JSON array of records, JSON/JSONL pass through.\nConsume with `JSON_TABLE`:\n\n```sql\n-- ? file (s3object)\nSELECT id, name\nFROM JSON_TABLE(?, '$[*]'\n  COLUMNS (id INT PATH '$.id', name VARCHAR(200) PATH '$.name')\n) AS r;\n```\n\n## Streaming query results to S3\n\nAdd a `-- s3` directive at the top of the script to stream the result set to S3\ninstead of returning rows. Windmill writes the file and returns its `S3Object`\nas the script result.\n\n```sql\n-- s3 prefix=exports/users format=parquet\nSELECT id, name FROM users;\n```\n\nAll keys are optional: `prefix` (object key prefix), `storage` (named storage \u2014\nomit to use the workspace default), `format` (`json` (default), `parquet`, or\n`csv`). Use this for large result sets \u2014 rows stream directly to S3 instead of\nbeing buffered as the script return value.\n";
 export declare const LANG_NATIVETS = "# TypeScript (Native)\n\nNative TypeScript execution with fetch only - no external imports allowed.\n\n## Structure\n\nExport a single **async** function called `main`:\n\n```typescript\nexport async function main(param1: string, param2: number) {\n  // Your code here\n  return { result: param1, count: param2 };\n}\n```\n\nDo not call the main function.\n\n## Resource Types\n\nOn Windmill, credentials and configuration are stored in resources and passed as parameters to main.\n\nUse the `RT` namespace for resource types:\n\n```typescript\nexport async function main(stripe: RT.Stripe) {\n  // stripe contains API key and config from the resource\n}\n```\n\nOnly use resource types if you need them to satisfy the instructions. Always use the RT namespace.\n\nBefore using a resource type, check the `rt.d.ts` file in the project root to see all available resource types and their fields. This file is generated by `wmill resource-type generate-namespace`.\n\n## Imports\n\n**No imports allowed.** Use the globally available `fetch` function:\n\n```typescript\nexport async function main(url: string) {\n  const response = await fetch(url);\n  return await response.json();\n}\n```\n\n## Windmill Client\n\nThe windmill client is not available in native TypeScript mode. Use fetch to call APIs directly.\n\n## Preprocessor Scripts\n\nFor preprocessor scripts, the function should be named `preprocessor` and receives an `event` parameter:\n\n```typescript\ntype Event = {\n  kind:\n    | \"webhook\"\n    | \"http\"\n    | \"websocket\"\n    | \"kafka\"\n    | \"email\"\n    | \"nats\"\n    | \"postgres\"\n    | \"sqs\"\n    | \"mqtt\"\n    | \"gcp\";\n  body: any;\n  headers: Record<string, string>;\n  query: Record<string, string>;\n};\n\nexport async function preprocessor(event: Event) {\n  return {\n    param1: event.body.field1,\n    param2: event.query.id\n  };\n}\n```\n";
 export declare const LANG_PHP = "# PHP\n\n## Structure\n\nThe script must start with `<?php` and contain at least one function called `main`:\n\n```php\n<?php\n\nfunction main(string $param1, int $param2) {\n    return [\"result\" => $param1, \"count\" => $param2];\n}\n```\n\n## Resource Types\n\nOn Windmill, credentials and configuration are stored in resources and passed as parameters to main.\n\nYou need to **redefine** the type of the resources that are needed before the main function. Always check if the class already exists using `class_exists`:\n\n```php\n<?php\n\nif (!class_exists('Postgresql')) {\n    class Postgresql {\n        public string $host;\n        public int $port;\n        public string $user;\n        public string $password;\n        public string $dbname;\n    }\n}\n\nfunction main(Postgresql $db) {\n    // $db contains the database connection details\n}\n```\n\nThe resource type name has to be exactly as specified.\n\n## Library Dependencies\n\nSpecify library dependencies as comments before the main function:\n\n```php\n<?php\n\n// require:\n// guzzlehttp/guzzle\n// stripe/stripe-php@^10.0\n\nfunction main() {\n    // Libraries are available\n}\n```\n\nOne dependency per line. No need to require autoload, it is already done.\n";
-export declare const LANG_POSTGRESQL = "# PostgreSQL\n\nArguments are obtained directly in the statement with `$1::{type}`, `$2::{type}`, etc.\n\nName the parameters by adding comments at the beginning of the script (without specifying the type):\n\n```sql\n-- $1 name1\n-- $2 name2 = default_value\nSELECT * FROM users WHERE name = $1::TEXT AND age > $2::INT;\n```\n";
+export declare const LANG_POSTGRESQL = "# PostgreSQL\n\nArguments are obtained directly in the statement with `$1::{type}`, `$2::{type}`, etc.\n\nName the parameters by adding comments at the beginning of the script (without specifying the type):\n\n```sql\n-- $1 name1\n-- $2 name2 = default_value\nSELECT * FROM users WHERE name = $1::TEXT AND age > $2::INT;\n```\n\n## Receiving an S3Object as a script parameter\n\nDeclare the arg with type `(s3object)`. Windmill renders an S3 file picker for\nit, downloads the file, and binds it as a `jsonb` parameter \u2014 Parquet/CSV files\nare decoded server-side into a JSON array of records, JSON/JSONL pass through.\nConsume with `jsonb_to_recordset` (or any `jsonb` API):\n\n```sql\n-- $1 file (s3object)\nSELECT *\nFROM jsonb_to_recordset($1::jsonb) AS r(id INT, name TEXT);\n```\n\n## Streaming query results to S3\n\nAdd a `-- s3` directive at the top of the script to stream the result set to S3\ninstead of returning rows. Windmill writes the file and returns its `S3Object`\nas the script result.\n\n```sql\n-- s3 prefix=exports/users format=parquet\nSELECT id, name FROM users;\n```\n\nAll keys are optional: `prefix` (object key prefix), `storage` (named storage \u2014\nomit to use the workspace default), `format` (`json` (default), `parquet`, or\n`csv`). Use this for large result sets \u2014 rows stream directly to S3 instead of\nbeing buffered as the script return value.\n";
 export declare const LANG_POWERSHELL = "# PowerShell\n\n## Structure\n\nArguments are obtained by calling the `param` function on the first line:\n\n```powershell\nparam($Name, $Count = 0, [int]$Age)\n\n# Your code here\nWrite-Output \"Processing $Name, count: $Count, age: $Age\"\n\n# Return object\n@{\n    name = $Name\n    count = $Count\n    age = $Age\n}\n```\n\n## Parameter Types\n\nYou can specify types for parameters:\n\n```powershell\nparam(\n    [string]$Name,\n    [int]$Count = 0,\n    [bool]$Enabled = $true,\n    [array]$Items\n)\n\n@{\n    name = $Name\n    count = $Count\n    enabled = $Enabled\n    items = $Items\n}\n```\n\n## Return Values\n\nReturn values by outputting them at the end of the script:\n\n```powershell\nparam($Input)\n\n$result = @{\n    processed = $true\n    data = $Input\n    timestamp = Get-Date -Format \"o\"\n}\n\n$result\n```\n";
-export declare const LANG_PYTHON3 = "# Python\n\n## Structure\n\nThe script must contain at least one function called `main`:\n\n```python\ndef main(param1: str, param2: int):\n    # Your code here\n    return {\"result\": param1, \"count\": param2}\n```\n\nDo not call the main function. Libraries are installed automatically.\n\n## Resource Types\n\nOn Windmill, credentials and configuration are stored in resources and passed as parameters to main.\n\nYou need to **redefine** the type of the resources that are needed before the main function as TypedDict:\n\n```python\nfrom typing import TypedDict\n\nclass postgresql(TypedDict):\n    host: str\n    port: int\n    user: str\n    password: str\n    dbname: str\n\ndef main(db: postgresql):\n    # db contains the database connection details\n    pass\n```\n\n**Important rules:**\n\n- The resource type name must be **IN LOWERCASE**\n- Only include resource types if they are actually needed\n- If an import conflicts with a resource type name, **rename the imported object, not the type name**\n- Make sure to import TypedDict from typing **if you're using it**\n\n## Imports\n\nLibraries are installed automatically. Do not show installation instructions.\n\n```python\nimport requests\nimport pandas as pd\nfrom datetime import datetime\n```\n\nIf an import name conflicts with a resource type:\n\n```python\n# Wrong - don't rename the type\nimport stripe as stripe_lib\nclass stripe_type(TypedDict): ...\n\n# Correct - rename the import\nimport stripe as stripe_sdk\nclass stripe(TypedDict):\n    api_key: str\n```\n\n## Windmill Client\n\nImport the windmill client for platform interactions:\n\n```python\nimport wmill\n```\n\nSee the SDK documentation for available methods.\n\n## Preprocessor Scripts\n\nFor preprocessor scripts, the function should be named `preprocessor` and receives an `event` parameter:\n\n```python\nfrom typing import TypedDict, Literal, Any\n\nclass Event(TypedDict):\n    kind: Literal[\"webhook\", \"http\", \"websocket\", \"kafka\", \"email\", \"nats\", \"postgres\", \"sqs\", \"mqtt\", \"gcp\"]\n    body: Any\n    headers: dict[str, str]\n    query: dict[str, str]\n\ndef preprocessor(event: Event):\n    # Transform the event into flow input parameters\n    return {\n        \"param1\": event[\"body\"][\"field1\"],\n        \"param2\": event[\"query\"][\"id\"]\n    }\n```\n\n## S3 Object Operations\n\nWindmill provides built-in support for S3-compatible storage operations.\n\n```python\nimport wmill\n\n# Load file content from S3\ncontent: bytes = wmill.load_s3_file(s3object)\n\n# Load file as stream reader\nreader: BufferedReader = wmill.load_s3_file_reader(s3object)\n\n# Write file to S3\nresult: S3Object = wmill.write_s3_file(\n    s3object,           # Target path (or None to auto-generate)\n    file_content,       # bytes or BufferedReader\n    s3_resource_path,   # Optional: specific S3 resource\n    content_type,       # Optional: MIME type\n    content_disposition # Optional: Content-Disposition header\n)\n```\n";
+export declare const LANG_PYTHON3 = "# Python\n\n## Structure\n\nThe script must contain at least one function called `main`:\n\n```python\ndef main(param1: str, param2: int):\n    # Your code here\n    return {\"result\": param1, \"count\": param2}\n```\n\nDo not call the main function. Libraries are installed automatically.\n\n## Resource Types\n\nOn Windmill, credentials and configuration are stored in resources and passed as parameters to main.\n\nYou need to **redefine** the type of the resources that are needed before the main function as TypedDict:\n\n```python\nfrom typing import TypedDict\n\nclass postgresql(TypedDict):\n    host: str\n    port: int\n    user: str\n    password: str\n    dbname: str\n\ndef main(db: postgresql):\n    # db contains the database connection details\n    pass\n```\n\n**Important rules:**\n\n- The resource type name must be **IN LOWERCASE**\n- Only include resource types if they are actually needed\n- If an import conflicts with a resource type name, **rename the imported object, not the type name**\n- Make sure to import TypedDict from typing **if you're using it**\n\n## Imports\n\nLibraries are installed automatically. Do not show installation instructions.\n\n```python\nimport requests\nimport pandas as pd\nfrom datetime import datetime\n```\n\nIf an import name conflicts with a resource type:\n\n```python\n# Wrong - don't rename the type\nimport stripe as stripe_lib\nclass stripe_type(TypedDict): ...\n\n# Correct - rename the import\nimport stripe as stripe_sdk\nclass stripe(TypedDict):\n    api_key: str\n```\n\n## Windmill Client\n\nImport the windmill client for platform interactions:\n\n```python\nimport wmill\n```\n\nSee the SDK documentation for available methods.\n\n## Preprocessor Scripts\n\nFor preprocessor scripts, the function should be named `preprocessor` and receives an `event` parameter:\n\n```python\nfrom typing import TypedDict, Literal, Any\n\nclass Event(TypedDict):\n    kind: Literal[\"webhook\", \"http\", \"websocket\", \"kafka\", \"email\", \"nats\", \"postgres\", \"sqs\", \"mqtt\", \"gcp\"]\n    body: Any\n    headers: dict[str, str]\n    query: dict[str, str]\n\ndef preprocessor(event: Event):\n    # Transform the event into flow input parameters\n    return {\n        \"param1\": event[\"body\"][\"field1\"],\n        \"param2\": event[\"query\"][\"id\"]\n    }\n```\n\n## S3 Object Operations\n\nWindmill provides built-in support for S3-compatible storage operations.\n\n### Receiving an S3Object as a script parameter\n\nTo accept a file from S3 as input to a script, type the parameter with `S3Object` (imported from `wmill`):\n\n```python\nimport wmill\nfrom wmill import S3Object\n\ndef main(file: S3Object):\n    content = wmill.load_s3_file(file)\n    # ...\n```\n\n### S3 operations\n\n```python\nimport wmill\n\n# Load file content from S3\ncontent: bytes = wmill.load_s3_file(s3object)\n\n# Load file as stream reader\nreader: BufferedReader = wmill.load_s3_file_reader(s3object)\n\n# Write file to S3\nresult: S3Object = wmill.write_s3_file(\n    s3object,           # Target path (or None to auto-generate)\n    file_content,       # bytes or BufferedReader\n    s3_resource_path,   # Optional: specific S3 resource\n    content_type,       # Optional: MIME type\n    content_disposition # Optional: Content-Disposition header\n)\n```\n";
 export declare const LANG_RLANG = "# R\n\n## Structure\n\nDefine a `main` function using `<-` or `=` assignment. Parameters become the script inputs:\n\n```r\nlibrary(dplyr)\nlibrary(jsonlite)\n\nmain <- function(x, name = \"default\", flag = TRUE) {\n    df <- tibble(x = x, name = name)\n    result <- df %>% mutate(greeting = paste(\"Hello\", name))\n    return(toJSON(result, auto_unbox = TRUE))\n}\n```\n\n**Important:**\n- The `main` function is required\n- Use `library()` to load packages \u2014 they are resolved and installed automatically\n- `jsonlite` is always available (used internally for argument parsing)\n- Return values must be JSON-serializable\n\n## Parameters\n\nR types map to Windmill types:\n- `numeric` \u2192 float/int\n- `character` \u2192 string\n- `logical` \u2192 bool (use `TRUE`/`FALSE`)\n- `list` \u2192 object/dict\n- `NULL` \u2192 null\n\nDefault values are inferred from the function signature:\n\n```r\nmain <- function(\n    name,              # required string\n    count = 10,        # optional int, default 10\n    verbose = FALSE    # optional bool, default FALSE\n) {\n    # ...\n}\n```\n\n## Resources and Variables\n\nUse the built-in Windmill helpers (no import needed):\n\n```r\nmain <- function() {\n    # Get a variable\n    api_key <- get_variable(\"f/my_folder/api_key\")\n\n    # Get a resource (returns a list)\n    db <- get_resource(\"f/my_folder/postgres_config\")\n    host <- db$host\n    port <- db$port\n\n    return(list(host = host, port = port))\n}\n```\n\n## Output\n\nReturn any JSON-serializable value from `main`. The return value becomes the step result:\n\n```r\nmain <- function(x) {\n    # Return a scalar\n    return(x + 1)\n\n    # Or a list (becomes JSON object)\n    return(list(result = x + 1, status = \"ok\"))\n}\n```\n\n## Annotations\n\nControl execution behavior with comment annotations:\n\n```r\n#renv_verbose = true        # Show verbose renv output during resolution\n#renv_install_verbose = true # Show verbose output during package installation\n#sandbox = true              # Run in nsjail sandbox (requires nsjail)\n```\n";
 export declare const LANG_RUST = "# Rust\n\n## Structure\n\nThe script must contain a function called `main` with proper return type:\n\n```rust\nuse anyhow::anyhow;\nuse serde::Serialize;\n\n#[derive(Serialize, Debug)]\nstruct ReturnType {\n    result: String,\n    count: i32,\n}\n\nfn main(param1: String, param2: i32) -> anyhow::Result<ReturnType> {\n    Ok(ReturnType {\n        result: param1,\n        count: param2,\n    })\n}\n```\n\n**Important:**\n- Arguments should be owned types\n- Return type must be serializable (`#[derive(Serialize)]`)\n- Return type is `anyhow::Result<T>`\n\n## Dependencies\n\nPackages must be specified with a partial cargo.toml at the beginning of the script:\n\n```rust\n//! ```cargo\n//! [dependencies]\n//! anyhow = \"1.0.86\"\n//! reqwest = { version = \"0.11\", features = [\"json\"] }\n//! tokio = { version = \"1\", features = [\"full\"] }\n//! ```\n\nuse anyhow::anyhow;\n// ... rest of the code\n```\n\n**Note:** Serde is already included, no need to add it again.\n\n## Async Functions\n\nIf you need to handle async functions (e.g., using tokio), keep the main function sync and create the runtime inside:\n\n```rust\n//! ```cargo\n//! [dependencies]\n//! anyhow = \"1.0.86\"\n//! tokio = { version = \"1\", features = [\"full\"] }\n//! reqwest = { version = \"0.11\", features = [\"json\"] }\n//! ```\n\nuse anyhow::anyhow;\nuse serde::Serialize;\n\n#[derive(Serialize, Debug)]\nstruct Response {\n    data: String,\n}\n\nfn main(url: String) -> anyhow::Result<Response> {\n    let rt = tokio::runtime::Runtime::new()?;\n    rt.block_on(async {\n        let resp = reqwest::get(&url).await?.text().await?;\n        Ok(Response { data: resp })\n    })\n}\n```\n";
-export declare const LANG_SNOWFLAKE = "# Snowflake\n\nArguments use `?` placeholders.\n\nName the parameters by adding comments before the statement:\n\n```sql\n-- ? name1 (text)\n-- ? name2 (number) = 0\nSELECT * FROM users WHERE name = ? AND age > ?;\n```\n";
+export declare const LANG_SNOWFLAKE = "# Snowflake\n\nArguments use `?` placeholders.\n\nName the parameters by adding comments before the statement:\n\n```sql\n-- ? name1 (text)\n-- ? name2 (number) = 0\nSELECT * FROM users WHERE name = ? AND age > ?;\n```\n\n## Receiving an S3Object as a script parameter\n\nDeclare the arg with type `(s3object)`. Windmill renders an S3 file picker for\nit, downloads the file, and binds it as JSON text \u2014 Parquet/CSV files are\ndecoded server-side into a JSON array of records, JSON/JSONL pass through.\nWrap the bind with `PARSE_JSON(?)` and walk it with `LATERAL FLATTEN`:\n\n```sql\n-- ? file (s3object)\nSELECT\n  v.value:id::NUMBER AS id,\n  v.value:name::STRING AS name\nFROM LATERAL FLATTEN(input => PARSE_JSON(?)) v;\n```\n\n## Streaming query results to S3\n\nAdd a `-- s3` directive at the top of the script to stream the result set to S3\ninstead of returning rows. Windmill writes the file and returns its `S3Object`\nas the script result.\n\n```sql\n-- s3 prefix=exports/users format=parquet\nSELECT id, name FROM users;\n```\n\nAll keys are optional: `prefix` (object key prefix), `storage` (named storage \u2014\nomit to use the workspace default), `format` (`json` (default), `parquet`, or\n`csv`). Use this for large result sets \u2014 rows stream directly to S3 instead of\nbeing buffered, bypassing the 10000-row return cap.\n";
diff --git a/system_prompts/auto-generated/prompts.ts b/system_prompts/auto-generated/prompts.ts
index aeb39bb6b7..f1c00d5763 100644
--- a/system_prompts/auto-generated/prompts.ts
+++ b/system_prompts/auto-generated/prompts.ts
@@ -324,6 +324,389 @@ Reference a specific resource using \`$res:\` prefix:
 \`\`\`
 `;
 
+export const RESOURCES_BASE = `# Windmill Resources
+
+Resources store credentials and configuration for external services.
+
+## File Format
+
+Resource files use the pattern: \`{path}.resource.json\`
+
+Example: \`f/databases/postgres_prod.resource.json\`
+
+## Resource Structure
+
+\`\`\`json
+{
+  "value": {
+    "host": "db.example.com",
+    "port": 5432,
+    "user": "admin",
+    "password": "$var:g/all/db_password",
+    "dbname": "production"
+  },
+  "description": "Production PostgreSQL database",
+  "resource_type": "postgresql"
+}
+\`\`\`
+
+## Required Fields
+
+- \`value\` - Object containing the resource configuration
+- \`resource_type\` - Name of the resource type (e.g., "postgresql", "slack")
+
+## Variable References
+
+Reference variables in resource values:
+
+\`\`\`json
+{
+  "value": {
+    "api_key": "$var:g/all/api_key",
+    "secret": "$var:u/admin/secret"
+  }
+}
+\`\`\`
+
+**Reference formats:**
+- \`$var:g/all/name\` - Global variable
+- \`$var:u/username/name\` - User variable
+- \`$var:f/folder/name\` - Folder variable
+
+## Resource References
+
+Reference other resources:
+
+\`\`\`json
+{
+  "value": {
+    "database": "$res:f/databases/postgres"
+  }
+}
+\`\`\`
+
+## Common Resource Types
+
+### PostgreSQL
+\`\`\`json
+{
+  "resource_type": "postgresql",
+  "value": {
+    "host": "localhost",
+    "port": 5432,
+    "user": "postgres",
+    "password": "$var:g/all/pg_password",
+    "dbname": "windmill",
+    "sslmode": "prefer"
+  }
+}
+\`\`\`
+
+### MySQL
+\`\`\`json
+{
+  "resource_type": "mysql",
+  "value": {
+    "host": "localhost",
+    "port": 3306,
+    "user": "root",
+    "password": "$var:g/all/mysql_password",
+    "database": "myapp"
+  }
+}
+\`\`\`
+
+### Slack
+\`\`\`json
+{
+  "resource_type": "slack",
+  "value": {
+    "token": "$var:g/all/slack_token"
+  }
+}
+\`\`\`
+
+### AWS S3
+\`\`\`json
+{
+  "resource_type": "s3",
+  "value": {
+    "bucket": "my-bucket",
+    "region": "us-east-1",
+    "accessKeyId": "$var:g/all/aws_access_key",
+    "secretAccessKey": "$var:g/all/aws_secret_key"
+  }
+}
+\`\`\`
+
+### HTTP/API
+\`\`\`json
+{
+  "resource_type": "http",
+  "value": {
+    "baseUrl": "https://api.example.com",
+    "headers": {
+      "Authorization": "Bearer $var:g/all/api_token"
+    }
+  }
+}
+\`\`\`
+
+### Kafka
+\`\`\`json
+{
+  "resource_type": "kafka",
+  "value": {
+    "brokers": "broker1:9092,broker2:9092",
+    "sasl_mechanism": "PLAIN",
+    "security_protocol": "SASL_SSL",
+    "username": "$var:g/all/kafka_user",
+    "password": "$var:g/all/kafka_password"
+  }
+}
+\`\`\`
+
+### NATS
+\`\`\`json
+{
+  "resource_type": "nats",
+  "value": {
+    "servers": ["nats://localhost:4222"],
+    "user": "$var:g/all/nats_user",
+    "password": "$var:g/all/nats_password"
+  }
+}
+\`\`\`
+
+### MQTT
+\`\`\`json
+{
+  "resource_type": "mqtt",
+  "value": {
+    "host": "mqtt.example.com",
+    "port": 8883,
+    "username": "$var:g/all/mqtt_user",
+    "password": "$var:g/all/mqtt_password",
+    "tls": true
+  }
+}
+\`\`\`
+
+## Custom Resource Types
+
+Create custom resource types with JSON Schema:
+
+\`\`\`json
+{
+  "name": "custom_api",
+  "schema": {
+    "type": "object",
+    "properties": {
+      "base_url": {"type": "string", "format": "uri"},
+      "api_key": {"type": "string"},
+      "timeout": {"type": "integer", "default": 30}
+    },
+    "required": ["base_url", "api_key"]
+  },
+  "description": "Custom API connection"
+}
+\`\`\`
+
+Save as: \`custom_api.resource-type.json\`
+
+## OAuth Resources
+
+OAuth resources are managed through the Windmill UI and marked:
+
+\`\`\`json
+{
+  "is_oauth": true,
+  "account": 123
+}
+\`\`\`
+
+OAuth tokens are automatically refreshed by Windmill.
+
+## Using Resources in Scripts
+
+### TypeScript (Bun/Deno)
+\`\`\`typescript
+export async function main(db: RT.Postgresql) {
+  // db contains the resource values
+  const { host, port, user, password, dbname } = db;
+}
+\`\`\`
+
+### Python
+\`\`\`python
+class postgresql(TypedDict):
+    host: str
+    port: int
+    user: str
+    password: str
+    dbname: str
+
+def main(db: postgresql):
+    # db contains the resource values
+    pass
+\`\`\`
+
+## CLI Commands
+
+\`\`\`bash
+# List resources
+wmill resource list
+
+# List resource types with schemas
+wmill resource-type list --schema
+
+# Get specific resource type schema
+wmill resource-type get postgresql
+
+# Push resources (tell the user to run this, do NOT run it yourself)
+wmill sync push
+\`\`\`
+`;
+
+export const RAW_APP_BASE = `# Windmill Raw Apps
+
+Raw apps let you build custom frontends with React, Svelte, or Vue that connect to Windmill backend runnables and datatables.
+
+## App shape
+
+A raw app has three logical parts:
+
+- **Frontend** — bundled with esbuild from \`index.tsx\` as the entrypoint. Files include the entrypoint, components (\`App.tsx\`), styles, etc.
+- **Backend runnables** — server-side scripts the frontend calls, each addressed by a unique key.
+- **Data** — optional whitelisted datatables (managed PostgreSQL) that the backend runnables can query. The frontend never queries the database directly; backend runnables are the only bridge.
+
+## Frontend
+
+### Entrypoint
+
+\`index.tsx\` is the bundling entrypoint. It typically renders a top-level \`App\` component. The bundler is esbuild.
+
+### Generated bindings (\`wmill.d.ts\` / \`wmill.ts\`)
+
+The frontend imports a generated module that mirrors the backend runnables. **Never write to it directly** — it gets regenerated whenever backend runnables change. Modifying it by hand will be overwritten.
+
+### Calling backend runnables
+
+Import the generated bindings and call the runnable like a function:
+
+\`\`\`typescript
+import { backend } from './wmill';
+
+// Call a backend runnable
+const user = await backend.get_user({ user_id: '123' });
+\`\`\`
+
+The frontend cannot reach datatables, workspace items, or external services on its own — it goes through \`backend.<key>(args)\` for everything server-side.
+
+## Backend runnables
+
+Each runnable has a unique key (used to call it from the frontend) and one of four types:
+
+| Type | What it is |
+|---|---|
+| \`inline\` | Custom code stored on the app itself. Most common for app-specific logic. |
+| \`script\` | Reference to an existing workspace script by path. |
+| \`flow\` | Reference to an existing workspace flow by path. |
+| \`hubscript\` | Reference to a hub script by path. |
+
+### Inline runnables
+
+Inline runnables carry their own source code. For file-based raw apps, the runnable language is determined by the backend file extension. The script must expose a \`main\` function as its entrypoint.
+
+**TypeScript example** (\`backend/get_user.ts\`):
+
+\`\`\`typescript
+import * as wmill from 'windmill-client';
+
+export async function main(user_id: string) {
+  const sql = wmill.datatable();
+  const user = await sql\`SELECT * FROM users WHERE id = \${user_id}\`.fetchOne();
+  return user;
+}
+\`\`\`
+
+**Python example** (\`backend/get_user.py\`):
+
+\`\`\`python
+import wmill
+
+def main(user_id: str):
+    db = wmill.datatable()
+    user = db.query('SELECT * FROM users WHERE id = $1', user_id).fetch_one()
+    return user
+\`\`\`
+
+### Path runnables (script / flow / hubscript)
+
+When \`type\` is \`script\`, \`flow\`, or \`hubscript\`, the runnable just stores a \`path\` to an existing workspace or hub item — no inline code. The referenced item's input/output schema becomes the runnable's surface.
+
+### Static inputs
+
+\`staticInputs\` is an optional \`Record<string, any>\` for arguments not overridable from the frontend. Useful with path runnables to pre-fill some args while leaving the rest to the frontend caller.
+
+## Data Tables
+
+Data tables are PostgreSQL databases managed by Windmill. Backend runnables query them via the \`wmill\` client; the frontend never queries them directly.
+
+### Critical rules
+
+1. **Whitelisted tables only**: a runnable can only query tables listed in the app's \`data.tables\` config. Tables not in this list are not accessible.
+2. **Add tables before using**: queries against unlisted tables fail at runtime. When you introduce a new table, register it in \`data.tables\` first.
+3. **Use the configured datatable/schema**: the app's \`data\` config sets the default datatable and schema; reference them consistently across runnables.
+
+### Querying in TypeScript (Bun/Deno)
+
+\`\`\`typescript
+import * as wmill from 'windmill-client';
+
+export async function main(user_id: string) {
+  const sql = wmill.datatable();  // Or: wmill.datatable('other_datatable')
+
+  // Parameterized queries (safe from SQL injection)
+  const user = await sql\`SELECT * FROM users WHERE id = \${user_id}\`.fetchOne();
+  const users = await sql\`SELECT * FROM users WHERE active = \${true}\`.fetch();
+
+  // Insert/Update
+  await sql\`INSERT INTO users (name, email) VALUES (\${name}, \${email})\`;
+  await sql\`UPDATE users SET name = \${newName} WHERE id = \${user_id}\`;
+
+  return user;
+}
+\`\`\`
+
+### Querying in Python
+
+\`\`\`python
+import wmill
+
+def main(user_id: str):
+    db = wmill.datatable()  # Or: wmill.datatable('other_datatable')
+
+    # Use $1, $2, etc. for parameters
+    user = db.query('SELECT * FROM users WHERE id = $1', user_id).fetch_one()
+    users = db.query('SELECT * FROM users WHERE active = $1', True).fetch()
+
+    # Insert/Update
+    db.query('INSERT INTO users (name, email) VALUES ($1, $2)', name, email)
+    db.query('UPDATE users SET name = $1 WHERE id = $2', new_name, user_id)
+
+    return user
+\`\`\`
+
+## Best Practices
+
+1. **Check existing tables** before creating new ones — reuse beats schema growth.
+2. **Use parameterized queries** — never concatenate user input into SQL.
+3. **Keep runnables focused** — one function per runnable; small surface area.
+4. **Use descriptive keys** — \`get_user\`, not \`a\`.
+5. **Always whitelist tables** — adding a runnable that queries a new table requires the table to be in \`data.tables\` first.
+`;
+
 export const WORKFLOW_AS_CODE_BASE = `# Windmill Workflow-as-Code Writing Guide
 
 ## Scope
@@ -2144,7 +2527,7 @@ class SqlQuery:
 
 export const OPENFLOW_SCHEMA = `## OpenFlow Schema
 
-{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \\"yellow\\", \\"#ffff00\\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside loops, use 'flow_input.iter.value' for the current iteration value","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly while a condition is true. The loop checks the condition after each iteration. Use stop_after_if on modules to control loop termination","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration. Use stop_after_if to control when the loop ends","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n"}},"required":["provider","user_message","output_type"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["tools","type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}`;
+{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \\"yellow\\", \\"#ffff00\\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside loops, use 'flow_input.iter.value' for the current iteration value","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly while a condition is true. The loop checks the condition after each iteration. Use stop_after_if on modules to control loop termination","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration. Use stop_after_if to control when the loop ends","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\\nRange: 1-1000.\\n"}},"required":["provider","user_message","output_type"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["tools","type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}`;
 
 export const CLI_COMMANDS = `# Windmill CLI Commands
 
@@ -2174,7 +2557,7 @@ app related commands
   - \`--json\` - Output as JSON (for piping to jq)
 - \`app get <path:string>\` - get an app's details
   - \`--json\` - Output as JSON (for piping to jq)
-- \`app push <file_path:string> <remote_path:string>\` - push a local app 
+- \`app push [file_path:string] [remote_path:string]\` - push a local app. With no args, infers the app from the current directory and the remote path from its location relative to wmill.yaml.
 - \`app dev [app_folder:string]\` - Start a development server for building apps with live reload and hot module replacement
   - \`--port <port:number>\` - Port to run the dev server on (will find next available port if occupied)
   - \`--host <host:string>\` - Host to bind the dev server to
@@ -2316,6 +2699,7 @@ Generate metadata (locks, schemas) for all scripts, flows, and apps
 - \`--skip-flows\` - Skip processing flows
 - \`--skip-apps\` - Skip processing apps
 - \`--strict-folder-boundaries\` - Only update items inside the specified folder (requires folder argument)
+- \`--parallel <n:number>\` - Number of items to process in parallel
 - \`-i --includes <patterns:file[]>\` - Comma separated patterns to specify which files to include
 - \`-e --excludes <patterns:file[]>\` - Comma separated patterns to specify which files to exclude
 
@@ -2325,6 +2709,7 @@ Generate metadata (locks, schemas) for all scripts, flows, and apps
   - \`--skip-scripts\` - Skip processing scripts
   - \`--skip-flows\` - Skip processing flows
   - \`--skip-apps\` - Skip processing apps
+  - \`--parallel <n:number>\` - Number of items to process in parallel
   - \`-i --includes <patterns:file[]>\` - Comma separated patterns to specify which files to include
   - \`-e --excludes <patterns:file[]>\` - Comma separated patterns to specify which files to exclude
 
diff --git a/system_prompts/auto-generated/skills/cli-commands/SKILL.md b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
index 66efee7a68..98ce52efde 100644
--- a/system_prompts/auto-generated/skills/cli-commands/SKILL.md
+++ b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
@@ -31,7 +31,7 @@ app related commands
   - `--json` - Output as JSON (for piping to jq)
 - `app get <path:string>` - get an app's details
   - `--json` - Output as JSON (for piping to jq)
-- `app push <file_path:string> <remote_path:string>` - push a local app 
+- `app push [file_path:string] [remote_path:string]` - push a local app. With no args, infers the app from the current directory and the remote path from its location relative to wmill.yaml.
 - `app dev [app_folder:string]` - Start a development server for building apps with live reload and hot module replacement
   - `--port <port:number>` - Port to run the dev server on (will find next available port if occupied)
   - `--host <host:string>` - Host to bind the dev server to
@@ -173,6 +173,7 @@ Generate metadata (locks, schemas) for all scripts, flows, and apps
 - `--skip-flows` - Skip processing flows
 - `--skip-apps` - Skip processing apps
 - `--strict-folder-boundaries` - Only update items inside the specified folder (requires folder argument)
+- `--parallel <n:number>` - Number of items to process in parallel
 - `-i --includes <patterns:file[]>` - Comma separated patterns to specify which files to include
 - `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which files to exclude
 
@@ -182,6 +183,7 @@ Generate metadata (locks, schemas) for all scripts, flows, and apps
   - `--skip-scripts` - Skip processing scripts
   - `--skip-flows` - Skip processing flows
   - `--skip-apps` - Skip processing apps
+  - `--parallel <n:number>` - Number of items to process in parallel
   - `-i --includes <patterns:file[]>` - Comma separated patterns to specify which files to include
   - `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which files to exclude
 
diff --git a/system_prompts/auto-generated/skills/raw-app/SKILL.md b/system_prompts/auto-generated/skills/raw-app/SKILL.md
index 5ac3a69cff..937a18e1c9 100644
--- a/system_prompts/auto-generated/skills/raw-app/SKILL.md
+++ b/system_prompts/auto-generated/skills/raw-app/SKILL.md
@@ -3,9 +3,9 @@ name: raw-app
 description: MUST use when creating raw apps.
 ---
 
-# Windmill Raw Apps
+# Windmill Raw Apps — CLI workflow
 
-Raw apps let you build custom frontends with React, Svelte, or Vue that connect to Windmill backend runnables and datatables.
+This guide covers raw apps from the terminal: scaffolding via `wmill app new`, the on-disk layout, and the file-based conventions the CLI uses to represent backend runnables and data table configuration. The platform shape (how a raw app behaves at runtime — frontend bundling, runnable types, datatable SDK calls) is covered in the companion authoring guide.
 
 ## Creating a Raw App
 
@@ -74,7 +74,7 @@ wmill app new
 
 This is the wizard. It only works when run by a human in a real terminal. Don't call it this way from an agent.
 
-## App Structure
+## On-disk app layout
 
 ```
 my_app__raw_app/
@@ -94,11 +94,7 @@ my_app__raw_app/
     └── *.sql              # SQL files to apply via dev server
 ```
 
-## Backend Runnables
-
-Backend runnables are server-side scripts that your frontend can call. They live in the `backend/` folder.
-
-### Creating a Backend Runnable
+## Backend runnables on disk
 
 Add a code file to the `backend/` folder:
 
@@ -108,7 +104,7 @@ backend/<id>.<ext>
 
 The runnable ID is the filename without extension. For example, `get_user.ts` creates a runnable with ID `get_user`.
 
-### Supported Languages
+### Supported languages (extension-driven)
 
 | Language         | Extension    | Example          |
 |------------------|--------------|------------------|
@@ -130,27 +126,14 @@ The runnable ID is the filename without extension. For example, `get_user.ts` cr
 | C#               | `.cs`        | `myFunc.cs`      |
 | Java             | `.java`      | `myFunc.java`    |
 
-### Example Backend Runnable
-
-**backend/get_user.ts:**
-```typescript
-import * as wmill from 'windmill-client';
-
-export async function main(user_id: string) {
-  const sql = wmill.datatable();
-  const user = await sql`SELECT * FROM users WHERE id = ${user_id}`.fetchOne();
-  return user;
-}
-```
-
-After creating, tell the user they can generate lock files by running:
+After creating a runnable, tell the user they can generate lock files by running:
 ```bash
 wmill generate-metadata
 ```
 
-### Optional YAML Configuration
+### Optional YAML configuration
 
-Add a `<id>.yaml` file to configure fields or static values:
+Add a `<id>.yaml` file alongside the code to configure fields or static values:
 
 **backend/get_user.yaml:**
 ```yaml
@@ -161,7 +144,7 @@ fields:
     value: "default_user"
 ```
 
-### Referencing Existing Scripts
+### Referencing existing scripts
 
 To use an existing Windmill script instead of inline code:
 
@@ -177,32 +160,9 @@ type: flow
 path: f/my_folder/my_flow
 ```
 
-### Calling Backend from Frontend
+## Data tables — `raw_app.yaml` config
 
-Import from the auto-generated `wmill.ts`:
-
-```typescript
-import { backend } from './wmill';
-
-// Call a backend runnable
-const user = await backend.get_user({ user_id: '123' });
-```
-
-The `wmill.ts` file provides type-safe access to all backend runnables.
-
-## Data Tables
-
-Raw apps can query Windmill datatables (PostgreSQL databases managed by Windmill).
-
-### Critical Rules
-
-1. **ONLY USE WHITELISTED TABLES**: You can ONLY query tables listed in `raw_app.yaml` → `data.tables`. Tables not in this list are NOT accessible.
-
-2. **ADD TABLES BEFORE USING**: To use a new table, first add it to `data.tables` in `raw_app.yaml`.
-
-3. **USE CONFIGURED DATATABLE/SCHEMA**: Check the app's `raw_app.yaml` for the default datatable and schema.
-
-### Configuration in raw_app.yaml
+The `data` block in `raw_app.yaml` controls which tables the app can query.
 
 ```yaml
 data:
@@ -214,9 +174,153 @@ data:
 ```
 
 **Table reference formats:**
-- `<datatable>` - All tables in the datatable
-- `<datatable>/<table>` - Specific table in public schema
-- `<datatable>/<schema>:<table>` - Table in specific schema
+- `<datatable>` — All tables in the datatable
+- `<datatable>/<table>` — Specific table in public schema
+- `<datatable>/<schema>:<table>` — Table in specific schema
+
+## SQL Migrations (sql_to_apply/)
+
+The `sql_to_apply/` folder is for creating/modifying database tables during development.
+
+### Workflow
+
+1. Create `.sql` files in `sql_to_apply/`
+2. Run `wmill app dev` — the dev server watches this folder
+3. When SQL files change, a modal appears in the browser to confirm execution
+4. After creating tables, **add them to `data.tables`** in `raw_app.yaml`
+
+### Example migration
+
+**sql_to_apply/001_create_users.sql:**
+```sql
+CREATE TABLE IF NOT EXISTS users (
+    id SERIAL PRIMARY KEY,
+    email TEXT NOT NULL UNIQUE,
+    name TEXT,
+    created_at TIMESTAMP DEFAULT NOW()
+);
+```
+
+After applying, add to `raw_app.yaml`:
+```yaml
+data:
+  tables:
+    - main/users
+```
+
+### Migration best practices
+
+- **Use idempotent SQL**: `CREATE TABLE IF NOT EXISTS`, etc.
+- **Number files**: `001_`, `002_` for ordering
+- **Always whitelist tables** after creation
+- This folder is NOT synced — it's for local development only
+
+## CLI Commands
+
+`wmill app new` is the exception: you run it yourself, with flags, per the "Creating a Raw App" section above.
+
+For everything else, tell the user which command fits their intent and let them run it — these touch the workspace or local lock files, and the user should consent each time:
+
+| Command | Description |
+|---------|-------------|
+| `wmill app dev` | Start dev server with live reload (see the `preview` skill for the full open-the-app-in-the-IDE-pane procedure). |
+| `wmill app generate-agents` | Refresh AGENTS.md and DATATABLES.md |
+| `wmill generate-metadata` | Generate lock files for backend runnables |
+| `wmill sync push` | Deploy app to Windmill |
+| `wmill sync pull` | Pull latest from Windmill |
+
+
+
+# Windmill Raw Apps
+
+Raw apps let you build custom frontends with React, Svelte, or Vue that connect to Windmill backend runnables and datatables.
+
+## App shape
+
+A raw app has three logical parts:
+
+- **Frontend** — bundled with esbuild from `index.tsx` as the entrypoint. Files include the entrypoint, components (`App.tsx`), styles, etc.
+- **Backend runnables** — server-side scripts the frontend calls, each addressed by a unique key.
+- **Data** — optional whitelisted datatables (managed PostgreSQL) that the backend runnables can query. The frontend never queries the database directly; backend runnables are the only bridge.
+
+## Frontend
+
+### Entrypoint
+
+`index.tsx` is the bundling entrypoint. It typically renders a top-level `App` component. The bundler is esbuild.
+
+### Generated bindings (`wmill.d.ts` / `wmill.ts`)
+
+The frontend imports a generated module that mirrors the backend runnables. **Never write to it directly** — it gets regenerated whenever backend runnables change. Modifying it by hand will be overwritten.
+
+### Calling backend runnables
+
+Import the generated bindings and call the runnable like a function:
+
+```typescript
+import { backend } from './wmill';
+
+// Call a backend runnable
+const user = await backend.get_user({ user_id: '123' });
+```
+
+The frontend cannot reach datatables, workspace items, or external services on its own — it goes through `backend.<key>(args)` for everything server-side.
+
+## Backend runnables
+
+Each runnable has a unique key (used to call it from the frontend) and one of four types:
+
+| Type | What it is |
+|---|---|
+| `inline` | Custom code stored on the app itself. Most common for app-specific logic. |
+| `script` | Reference to an existing workspace script by path. |
+| `flow` | Reference to an existing workspace flow by path. |
+| `hubscript` | Reference to a hub script by path. |
+
+### Inline runnables
+
+Inline runnables carry their own source code. For file-based raw apps, the runnable language is determined by the backend file extension. The script must expose a `main` function as its entrypoint.
+
+**TypeScript example** (`backend/get_user.ts`):
+
+```typescript
+import * as wmill from 'windmill-client';
+
+export async function main(user_id: string) {
+  const sql = wmill.datatable();
+  const user = await sql`SELECT * FROM users WHERE id = ${user_id}`.fetchOne();
+  return user;
+}
+```
+
+**Python example** (`backend/get_user.py`):
+
+```python
+import wmill
+
+def main(user_id: str):
+    db = wmill.datatable()
+    user = db.query('SELECT * FROM users WHERE id = $1', user_id).fetch_one()
+    return user
+```
+
+### Path runnables (script / flow / hubscript)
+
+When `type` is `script`, `flow`, or `hubscript`, the runnable just stores a `path` to an existing workspace or hub item — no inline code. The referenced item's input/output schema becomes the runnable's surface.
+
+### Static inputs
+
+`staticInputs` is an optional `Record<string, any>` for arguments not overridable from the frontend. Useful with path runnables to pre-fill some args while leaving the rest to the frontend caller.
+
+## Data Tables
+
+Data tables are PostgreSQL databases managed by Windmill. Backend runnables query them via the `wmill` client; the frontend never queries them directly.
+
+### Critical rules
+
+1. **Whitelisted tables only**: a runnable can only query tables listed in the app's `data.tables` config. Tables not in this list are not accessible.
+2. **Add tables before using**: queries against unlisted tables fail at runtime. When you introduce a new table, register it in `data.tables` first.
+3. **Use the configured datatable/schema**: the app's `data` config sets the default datatable and schema; reference them consistently across runnables.
 
 ### Querying in TypeScript (Bun/Deno)
 
@@ -257,62 +361,10 @@ def main(user_id: str):
     return user
 ```
 
-## SQL Migrations (sql_to_apply/)
-
-The `sql_to_apply/` folder is for creating/modifying database tables during development.
-
-### Workflow
-
-1. Create `.sql` files in `sql_to_apply/`
-2. Run `wmill app dev` - the dev server watches this folder
-3. When SQL files change, a modal appears in the browser to confirm execution
-4. After creating tables, **add them to `data.tables`** in `raw_app.yaml`
-
-### Example Migration
-
-**sql_to_apply/001_create_users.sql:**
-```sql
-CREATE TABLE IF NOT EXISTS users (
-    id SERIAL PRIMARY KEY,
-    email TEXT NOT NULL UNIQUE,
-    name TEXT,
-    created_at TIMESTAMP DEFAULT NOW()
-);
-```
-
-After applying, add to `raw_app.yaml`:
-```yaml
-data:
-  tables:
-    - main/users
-```
-
-### Migration Best Practices
-
-- **Use idempotent SQL**: `CREATE TABLE IF NOT EXISTS`, etc.
-- **Number files**: `001_`, `002_` for ordering
-- **Always whitelist tables** after creation
-- This folder is NOT synced - it's for local development only
-
-## CLI Commands
-
-`wmill app new` is the exception: you run it yourself, with flags, per the "Creating a Raw App" section above.
-
-For everything else, tell the user which command fits their intent and let them run it — these touch the workspace or local lock files, and the user should consent each time:
-
-| Command | Description |
-|---------|-------------|
-| `wmill app dev` | Start dev server with live reload (see the `preview` skill for the full open-the-app-in-the-IDE-pane procedure). |
-| `wmill app generate-agents` | Refresh AGENTS.md and DATATABLES.md |
-| `wmill generate-metadata` | Generate lock files for backend runnables |
-| `wmill sync push` | Deploy app to Windmill |
-| `wmill sync pull` | Pull latest from Windmill |
-
 ## Best Practices
 
-1. **Check DATATABLES.md** for existing tables before creating new ones
-2. **Use parameterized queries** - never concatenate user input into SQL
-3. **Keep runnables focused** - one function per file
-4. **Use descriptive IDs** - `get_user.ts` not `a.ts`
-5. **Always whitelist tables** - add to `data.tables` before querying
-6. **Generate locks** - tell the user to run `wmill generate-metadata` after adding/modifying backend runnables
+1. **Check existing tables** before creating new ones — reuse beats schema growth.
+2. **Use parameterized queries** — never concatenate user input into SQL.
+3. **Keep runnables focused** — one function per runnable; small surface area.
+4. **Use descriptive keys** — `get_user`, not `a`.
+5. **Always whitelist tables** — adding a runnable that queries a new table requires the table to be in `data.tables` first.
diff --git a/system_prompts/auto-generated/skills/write-flow/SKILL.md b/system_prompts/auto-generated/skills/write-flow/SKILL.md
index 402838d97e..3938d2a30f 100644
--- a/system_prompts/auto-generated/skills/write-flow/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-flow/SKILL.md
@@ -375,4 +375,4 @@ Reference a specific resource using `$res:` prefix:
 
 ## OpenFlow Schema
 
-{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \"yellow\", \"#ffff00\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside loops, use 'flow_input.iter.value' for the current iteration value","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly while a condition is true. The loop checks the condition after each iteration. Use stop_after_if on modules to control loop termination","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration. Use stop_after_if to control when the loop ends","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"}},"required":["provider","user_message","output_type"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["tools","type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
\ No newline at end of file
+{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \"yellow\", \"#ffff00\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside loops, use 'flow_input.iter.value' for the current iteration value","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly while a condition is true. The loop checks the condition after each iteration. Use stop_after_if on modules to control loop termination","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration. Use stop_after_if to control when the loop ends","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}},"required":["provider","user_message","output_type"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["tools","type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
\ No newline at end of file
diff --git a/system_prompts/base/raw-app-cli.md b/system_prompts/base/raw-app-cli.md
new file mode 100644
index 0000000000..e7e8fe9881
--- /dev/null
+++ b/system_prompts/base/raw-app-cli.md
@@ -0,0 +1,226 @@
+# Windmill Raw Apps — CLI workflow
+
+This guide covers raw apps from the terminal: scaffolding via `wmill app new`, the on-disk layout, and the file-based conventions the CLI uses to represent backend runnables and data table configuration. The platform shape (how a raw app behaves at runtime — frontend bundling, runnable types, datatable SDK calls) is covered in the companion authoring guide.
+
+## Creating a Raw App
+
+**You — the AI agent — create the app yourself by running `wmill app new` with the right flags. Do NOT tell the user to "run `wmill app new` and follow the prompts" or wait for them to do it.** The bare `wmill app new` is an interactive wizard that hangs waiting for stdin in any non-TTY context (which includes you). Always pass flags.
+
+### Step 1 — Gather the three required values by asking the user
+
+You need three things to run the command:
+
+1. **summary** — a short description of the app
+2. **path** — the windmill path, e.g. `f/folder/my_app` or `u/username/my_app`
+3. **framework** — one of `react19` (recommended), `react18`, `svelte5`, `vue`
+
+If the user's request did not supply *every* one of these explicitly, ask. Do not guess values, do not invent paths, do not pick a framework on the user's behalf, do not "just use react19 because it's the default".
+
+Use whichever interactive question facility your runtime provides — a structured multi-choice tool if available, otherwise plain chat — and group all missing fields into a single round-trip so the user answers them at once:
+
+- For `framework` — multiple-choice with the four allowed values; mark `react19` as `(Recommended)` and put it first.
+- For `summary` and `path` — provide one or two example values as multiple-choice options (the user can pick "Other" to type a free-form answer).
+
+Only proceed once you have concrete values for all three. If the user replies with something ambiguous, ask again rather than guessing.
+
+### Step 2 — Run the command yourself
+
+Once you have summary + path + framework, run it:
+
+```bash
+wmill app new \
+  --summary "Customer dashboard" \
+  --path f/sales/dashboard \
+  --framework react19
+```
+
+That's the minimum. The datatable wizard and the "Open in Claude Desktop?" prompt are skipped silently because passing any of `--summary`/`--path`/`--framework` puts the command in non-interactive mode.
+
+### Optional flags
+
+Layer these in only when the user asked for them:
+
+| Flag | When to add it |
+|---|---|
+| `--datatable <name>` | The user wants this app wired to a specific Windmill datatable. Without it, the app is created with no datatable. |
+| `--schema <name>` | Together with `--datatable`. Creates the schema with `CREATE SCHEMA IF NOT EXISTS` if it doesn't already exist. |
+| `--overwrite` | The target directory already exists and the user said it's OK to replace. Without it, non-interactive mode aborts with an error so you don't clobber existing work. |
+| `--no-open-in-desktop` | Already implied in non-interactive mode; only needed if you're somehow running interactively. |
+
+### Step 3 — Offer the visual preview
+
+After `wmill app new` and any initial edits to `App.tsx` / `index.tsx`, **offer** to open the visual preview as a one-sentence next step (e.g. "Want me to open the visual preview?"). Don't auto-open — opening the dev page has side effects (browser window, possibly a `launch.json` entry when an embedded preview tool is in play) the user should consent to.
+
+For apps the preview command runs from the app folder (`cd <app_path>__raw_app && wmill app dev …`); the `preview` skill picks the proxy vs direct branch based on whether the runtime exposes a tool that can embed a localhost URL. If the user already asked to see/preview/visualize the app in their original request, skip the offer and just invoke the skill.
+
+### Anti-patterns to avoid
+
+- ❌ Running `wmill app new` with no flags (the prompt will hang).
+- ❌ Telling the user to "run `wmill app new` and follow the prompts" — that's a step backwards from what you can do directly.
+- ❌ Inventing a path/summary/framework instead of asking the user.
+- ❌ Defaulting to `react19` because the user didn't say — even sensible defaults must be confirmed.
+- ❌ Passing `--overwrite` automatically when the directory exists — confirm with the user first.
+
+### Interactive (only when a human is at the terminal)
+
+```bash
+wmill app new
+```
+
+This is the wizard. It only works when run by a human in a real terminal. Don't call it this way from an agent.
+
+## On-disk app layout
+
+```
+my_app__raw_app/
+├── AGENTS.md              # AI agent instructions (auto-generated)
+├── DATATABLES.md          # Database schemas (run 'wmill app generate-agents' to refresh)
+├── raw_app.yaml           # App configuration (summary, path, data settings)
+├── index.tsx              # Frontend entry point
+├── App.tsx                # Main React/Svelte/Vue component
+├── index.css              # Styles
+├── package.json           # Frontend dependencies
+├── wmill.ts               # Auto-generated backend type definitions (DO NOT EDIT)
+├── backend/               # Backend runnables (server-side scripts)
+│   ├── <id>.<ext>         # Code file (e.g., get_user.ts)
+│   ├── <id>.yaml          # Optional: config for fields, or to reference existing scripts
+│   └── <id>.lock          # Lock file (run 'wmill generate-metadata' to create/update)
+└── sql_to_apply/          # SQL migrations (dev only, not synced)
+    └── *.sql              # SQL files to apply via dev server
+```
+
+## Backend runnables on disk
+
+Add a code file to the `backend/` folder:
+
+```
+backend/<id>.<ext>
+```
+
+The runnable ID is the filename without extension. For example, `get_user.ts` creates a runnable with ID `get_user`.
+
+### Supported languages (extension-driven)
+
+| Language         | Extension    | Example          |
+|------------------|--------------|------------------|
+| TypeScript       | `.ts`        | `myFunc.ts`      |
+| TypeScript (Bun) | `.bun.ts`    | `myFunc.bun.ts`  |
+| TypeScript (Deno)| `.deno.ts`   | `myFunc.deno.ts` |
+| Python           | `.py`        | `myFunc.py`      |
+| Go               | `.go`        | `myFunc.go`      |
+| Bash             | `.sh`        | `myFunc.sh`      |
+| PowerShell       | `.ps1`       | `myFunc.ps1`     |
+| PostgreSQL       | `.pg.sql`    | `myFunc.pg.sql`  |
+| MySQL            | `.my.sql`    | `myFunc.my.sql`  |
+| BigQuery         | `.bq.sql`    | `myFunc.bq.sql`  |
+| Snowflake        | `.sf.sql`    | `myFunc.sf.sql`  |
+| MS SQL           | `.ms.sql`    | `myFunc.ms.sql`  |
+| GraphQL          | `.gql`       | `myFunc.gql`     |
+| PHP              | `.php`       | `myFunc.php`     |
+| Rust             | `.rs`        | `myFunc.rs`      |
+| C#               | `.cs`        | `myFunc.cs`      |
+| Java             | `.java`      | `myFunc.java`    |
+
+After creating a runnable, tell the user they can generate lock files by running:
+```bash
+wmill generate-metadata
+```
+
+### Optional YAML configuration
+
+Add a `<id>.yaml` file alongside the code to configure fields or static values:
+
+**backend/get_user.yaml:**
+```yaml
+type: inline
+fields:
+  user_id:
+    type: static
+    value: "default_user"
+```
+
+### Referencing existing scripts
+
+To use an existing Windmill script instead of inline code:
+
+**backend/existing_script.yaml:**
+```yaml
+type: script
+path: f/my_folder/existing_script
+```
+
+For flows:
+```yaml
+type: flow
+path: f/my_folder/my_flow
+```
+
+## Data tables — `raw_app.yaml` config
+
+The `data` block in `raw_app.yaml` controls which tables the app can query.
+
+```yaml
+data:
+  datatable: main           # Default datatable
+  schema: app_schema        # Default schema (optional)
+  tables:
+    - main/users            # Table in public schema
+    - main/app_schema:items # Table in specific schema
+```
+
+**Table reference formats:**
+- `<datatable>` — All tables in the datatable
+- `<datatable>/<table>` — Specific table in public schema
+- `<datatable>/<schema>:<table>` — Table in specific schema
+
+## SQL Migrations (sql_to_apply/)
+
+The `sql_to_apply/` folder is for creating/modifying database tables during development.
+
+### Workflow
+
+1. Create `.sql` files in `sql_to_apply/`
+2. Run `wmill app dev` — the dev server watches this folder
+3. When SQL files change, a modal appears in the browser to confirm execution
+4. After creating tables, **add them to `data.tables`** in `raw_app.yaml`
+
+### Example migration
+
+**sql_to_apply/001_create_users.sql:**
+```sql
+CREATE TABLE IF NOT EXISTS users (
+    id SERIAL PRIMARY KEY,
+    email TEXT NOT NULL UNIQUE,
+    name TEXT,
+    created_at TIMESTAMP DEFAULT NOW()
+);
+```
+
+After applying, add to `raw_app.yaml`:
+```yaml
+data:
+  tables:
+    - main/users
+```
+
+### Migration best practices
+
+- **Use idempotent SQL**: `CREATE TABLE IF NOT EXISTS`, etc.
+- **Number files**: `001_`, `002_` for ordering
+- **Always whitelist tables** after creation
+- This folder is NOT synced — it's for local development only
+
+## CLI Commands
+
+`wmill app new` is the exception: you run it yourself, with flags, per the "Creating a Raw App" section above.
+
+For everything else, tell the user which command fits their intent and let them run it — these touch the workspace or local lock files, and the user should consent each time:
+
+| Command | Description |
+|---------|-------------|
+| `wmill app dev` | Start dev server with live reload (see the `preview` skill for the full open-the-app-in-the-IDE-pane procedure). |
+| `wmill app generate-agents` | Refresh AGENTS.md and DATATABLES.md |
+| `wmill generate-metadata` | Generate lock files for backend runnables |
+| `wmill sync push` | Deploy app to Windmill |
+| `wmill sync pull` | Pull latest from Windmill |
+
diff --git a/system_prompts/base/raw-app.md b/system_prompts/base/raw-app.md
index 4114c55a60..04103e434b 100644
--- a/system_prompts/base/raw-app.md
+++ b/system_prompts/base/raw-app.md
@@ -2,132 +2,54 @@
 
 Raw apps let you build custom frontends with React, Svelte, or Vue that connect to Windmill backend runnables and datatables.
 
-## Creating a Raw App
+## App shape
 
-**You — the AI agent — create the app yourself by running `wmill app new` with the right flags. Do NOT tell the user to "run `wmill app new` and follow the prompts" or wait for them to do it.** The bare `wmill app new` is an interactive wizard that hangs waiting for stdin in any non-TTY context (which includes you). Always pass flags.
+A raw app has three logical parts:
 
-### Step 1 — Gather the three required values by asking the user
+- **Frontend** — bundled with esbuild from `index.tsx` as the entrypoint. Files include the entrypoint, components (`App.tsx`), styles, etc.
+- **Backend runnables** — server-side scripts the frontend calls, each addressed by a unique key.
+- **Data** — optional whitelisted datatables (managed PostgreSQL) that the backend runnables can query. The frontend never queries the database directly; backend runnables are the only bridge.
 
-You need three things to run the command:
+## Frontend
 
-1. **summary** — a short description of the app
-2. **path** — the windmill path, e.g. `f/folder/my_app` or `u/username/my_app`
-3. **framework** — one of `react19` (recommended), `react18`, `svelte5`, `vue`
+### Entrypoint
 
-If the user's request did not supply *every* one of these explicitly, ask. Do not guess values, do not invent paths, do not pick a framework on the user's behalf, do not "just use react19 because it's the default".
+`index.tsx` is the bundling entrypoint. It typically renders a top-level `App` component. The bundler is esbuild.
 
-Use whichever interactive question facility your runtime provides — a structured multi-choice tool if available, otherwise plain chat — and group all missing fields into a single round-trip so the user answers them at once:
+### Generated bindings (`wmill.d.ts` / `wmill.ts`)
 
-- For `framework` — multiple-choice with the four allowed values; mark `react19` as `(Recommended)` and put it first.
-- For `summary` and `path` — provide one or two example values as multiple-choice options (the user can pick "Other" to type a free-form answer).
+The frontend imports a generated module that mirrors the backend runnables. **Never write to it directly** — it gets regenerated whenever backend runnables change. Modifying it by hand will be overwritten.
 
-Only proceed once you have concrete values for all three. If the user replies with something ambiguous, ask again rather than guessing.
+### Calling backend runnables
 
-### Step 2 — Run the command yourself
+Import the generated bindings and call the runnable like a function:
 
-Once you have summary + path + framework, run it:
+```typescript
+import { backend } from './wmill';
 
-```bash
-wmill app new \
-  --summary "Customer dashboard" \
-  --path f/sales/dashboard \
-  --framework react19
+// Call a backend runnable
+const user = await backend.get_user({ user_id: '123' });
 ```
 
-That's the minimum. The datatable wizard and the "Open in Claude Desktop?" prompt are skipped silently because passing any of `--summary`/`--path`/`--framework` puts the command in non-interactive mode.
+The frontend cannot reach datatables, workspace items, or external services on its own — it goes through `backend.<key>(args)` for everything server-side.
 
-### Optional flags
+## Backend runnables
 
-Layer these in only when the user asked for them:
+Each runnable has a unique key (used to call it from the frontend) and one of four types:
 
-| Flag | When to add it |
+| Type | What it is |
 |---|---|
-| `--datatable <name>` | The user wants this app wired to a specific Windmill datatable. Without it, the app is created with no datatable. |
-| `--schema <name>` | Together with `--datatable`. Creates the schema with `CREATE SCHEMA IF NOT EXISTS` if it doesn't already exist. |
-| `--overwrite` | The target directory already exists and the user said it's OK to replace. Without it, non-interactive mode aborts with an error so you don't clobber existing work. |
-| `--no-open-in-desktop` | Already implied in non-interactive mode; only needed if you're somehow running interactively. |
+| `inline` | Custom code stored on the app itself. Most common for app-specific logic. |
+| `script` | Reference to an existing workspace script by path. |
+| `flow` | Reference to an existing workspace flow by path. |
+| `hubscript` | Reference to a hub script by path. |
 
-### Step 3 — Offer the visual preview
+### Inline runnables
 
-After `wmill app new` and any initial edits to `App.tsx` / `index.tsx`, **offer** to open the visual preview as a one-sentence next step (e.g. "Want me to open the visual preview?"). Don't auto-open — opening the dev page has side effects (browser window, possibly a `launch.json` entry when an embedded preview tool is in play) the user should consent to.
+Inline runnables carry their own source code. For file-based raw apps, the runnable language is determined by the backend file extension. The script must expose a `main` function as its entrypoint.
 
-For apps the preview command runs from the app folder (`cd <app_path>__raw_app && wmill app dev …`); the `preview` skill picks the proxy vs direct branch based on whether the runtime exposes a tool that can embed a localhost URL. If the user already asked to see/preview/visualize the app in their original request, skip the offer and just invoke the skill.
+**TypeScript example** (`backend/get_user.ts`):
 
-### Anti-patterns to avoid
-
-- ❌ Running `wmill app new` with no flags (the prompt will hang).
-- ❌ Telling the user to "run `wmill app new` and follow the prompts" — that's a step backwards from what you can do directly.
-- ❌ Inventing a path/summary/framework instead of asking the user.
-- ❌ Defaulting to `react19` because the user didn't say — even sensible defaults must be confirmed.
-- ❌ Passing `--overwrite` automatically when the directory exists — confirm with the user first.
-
-### Interactive (only when a human is at the terminal)
-
-```bash
-wmill app new
-```
-
-This is the wizard. It only works when run by a human in a real terminal. Don't call it this way from an agent.
-
-## App Structure
-
-```
-my_app__raw_app/
-├── AGENTS.md              # AI agent instructions (auto-generated)
-├── DATATABLES.md          # Database schemas (run 'wmill app generate-agents' to refresh)
-├── raw_app.yaml           # App configuration (summary, path, data settings)
-├── index.tsx              # Frontend entry point
-├── App.tsx                # Main React/Svelte/Vue component
-├── index.css              # Styles
-├── package.json           # Frontend dependencies
-├── wmill.ts               # Auto-generated backend type definitions (DO NOT EDIT)
-├── backend/               # Backend runnables (server-side scripts)
-│   ├── <id>.<ext>         # Code file (e.g., get_user.ts)
-│   ├── <id>.yaml          # Optional: config for fields, or to reference existing scripts
-│   └── <id>.lock          # Lock file (run 'wmill generate-metadata' to create/update)
-└── sql_to_apply/          # SQL migrations (dev only, not synced)
-    └── *.sql              # SQL files to apply via dev server
-```
-
-## Backend Runnables
-
-Backend runnables are server-side scripts that your frontend can call. They live in the `backend/` folder.
-
-### Creating a Backend Runnable
-
-Add a code file to the `backend/` folder:
-
-```
-backend/<id>.<ext>
-```
-
-The runnable ID is the filename without extension. For example, `get_user.ts` creates a runnable with ID `get_user`.
-
-### Supported Languages
-
-| Language         | Extension    | Example          |
-|------------------|--------------|------------------|
-| TypeScript       | `.ts`        | `myFunc.ts`      |
-| TypeScript (Bun) | `.bun.ts`    | `myFunc.bun.ts`  |
-| TypeScript (Deno)| `.deno.ts`   | `myFunc.deno.ts` |
-| Python           | `.py`        | `myFunc.py`      |
-| Go               | `.go`        | `myFunc.go`      |
-| Bash             | `.sh`        | `myFunc.sh`      |
-| PowerShell       | `.ps1`       | `myFunc.ps1`     |
-| PostgreSQL       | `.pg.sql`    | `myFunc.pg.sql`  |
-| MySQL            | `.my.sql`    | `myFunc.my.sql`  |
-| BigQuery         | `.bq.sql`    | `myFunc.bq.sql`  |
-| Snowflake        | `.sf.sql`    | `myFunc.sf.sql`  |
-| MS SQL           | `.ms.sql`    | `myFunc.ms.sql`  |
-| GraphQL          | `.gql`       | `myFunc.gql`     |
-| PHP              | `.php`       | `myFunc.php`     |
-| Rust             | `.rs`        | `myFunc.rs`      |
-| C#               | `.cs`        | `myFunc.cs`      |
-| Java             | `.java`      | `myFunc.java`    |
-
-### Example Backend Runnable
-
-**backend/get_user.ts:**
 ```typescript
 import * as wmill from 'windmill-client';
 
@@ -138,80 +60,34 @@ export async function main(user_id: string) {
 }
 ```
 
-After creating, tell the user they can generate lock files by running:
-```bash
-wmill generate-metadata
+**Python example** (`backend/get_user.py`):
+
+```python
+import wmill
+
+def main(user_id: str):
+    db = wmill.datatable()
+    user = db.query('SELECT * FROM users WHERE id = $1', user_id).fetch_one()
+    return user
 ```
 
-### Optional YAML Configuration
+### Path runnables (script / flow / hubscript)
 
-Add a `<id>.yaml` file to configure fields or static values:
+When `type` is `script`, `flow`, or `hubscript`, the runnable just stores a `path` to an existing workspace or hub item — no inline code. The referenced item's input/output schema becomes the runnable's surface.
 
-**backend/get_user.yaml:**
-```yaml
-type: inline
-fields:
-  user_id:
-    type: static
-    value: "default_user"
-```
+### Static inputs
 
-### Referencing Existing Scripts
-
-To use an existing Windmill script instead of inline code:
-
-**backend/existing_script.yaml:**
-```yaml
-type: script
-path: f/my_folder/existing_script
-```
-
-For flows:
-```yaml
-type: flow
-path: f/my_folder/my_flow
-```
-
-### Calling Backend from Frontend
-
-Import from the auto-generated `wmill.ts`:
-
-```typescript
-import { backend } from './wmill';
-
-// Call a backend runnable
-const user = await backend.get_user({ user_id: '123' });
-```
-
-The `wmill.ts` file provides type-safe access to all backend runnables.
+`staticInputs` is an optional `Record<string, any>` for arguments not overridable from the frontend. Useful with path runnables to pre-fill some args while leaving the rest to the frontend caller.
 
 ## Data Tables
 
-Raw apps can query Windmill datatables (PostgreSQL databases managed by Windmill).
+Data tables are PostgreSQL databases managed by Windmill. Backend runnables query them via the `wmill` client; the frontend never queries them directly.
 
-### Critical Rules
+### Critical rules
 
-1. **ONLY USE WHITELISTED TABLES**: You can ONLY query tables listed in `raw_app.yaml` → `data.tables`. Tables not in this list are NOT accessible.
-
-2. **ADD TABLES BEFORE USING**: To use a new table, first add it to `data.tables` in `raw_app.yaml`.
-
-3. **USE CONFIGURED DATATABLE/SCHEMA**: Check the app's `raw_app.yaml` for the default datatable and schema.
-
-### Configuration in raw_app.yaml
-
-```yaml
-data:
-  datatable: main           # Default datatable
-  schema: app_schema        # Default schema (optional)
-  tables:
-    - main/users            # Table in public schema
-    - main/app_schema:items # Table in specific schema
-```
-
-**Table reference formats:**
-- `<datatable>` - All tables in the datatable
-- `<datatable>/<table>` - Specific table in public schema
-- `<datatable>/<schema>:<table>` - Table in specific schema
+1. **Whitelisted tables only**: a runnable can only query tables listed in the app's `data.tables` config. Tables not in this list are not accessible.
+2. **Add tables before using**: queries against unlisted tables fail at runtime. When you introduce a new table, register it in `data.tables` first.
+3. **Use the configured datatable/schema**: the app's `data` config sets the default datatable and schema; reference them consistently across runnables.
 
 ### Querying in TypeScript (Bun/Deno)
 
@@ -252,62 +128,10 @@ def main(user_id: str):
     return user
 ```
 
-## SQL Migrations (sql_to_apply/)
-
-The `sql_to_apply/` folder is for creating/modifying database tables during development.
-
-### Workflow
-
-1. Create `.sql` files in `sql_to_apply/`
-2. Run `wmill app dev` - the dev server watches this folder
-3. When SQL files change, a modal appears in the browser to confirm execution
-4. After creating tables, **add them to `data.tables`** in `raw_app.yaml`
-
-### Example Migration
-
-**sql_to_apply/001_create_users.sql:**
-```sql
-CREATE TABLE IF NOT EXISTS users (
-    id SERIAL PRIMARY KEY,
-    email TEXT NOT NULL UNIQUE,
-    name TEXT,
-    created_at TIMESTAMP DEFAULT NOW()
-);
-```
-
-After applying, add to `raw_app.yaml`:
-```yaml
-data:
-  tables:
-    - main/users
-```
-
-### Migration Best Practices
-
-- **Use idempotent SQL**: `CREATE TABLE IF NOT EXISTS`, etc.
-- **Number files**: `001_`, `002_` for ordering
-- **Always whitelist tables** after creation
-- This folder is NOT synced - it's for local development only
-
-## CLI Commands
-
-`wmill app new` is the exception: you run it yourself, with flags, per the "Creating a Raw App" section above.
-
-For everything else, tell the user which command fits their intent and let them run it — these touch the workspace or local lock files, and the user should consent each time:
-
-| Command | Description |
-|---------|-------------|
-| `wmill app dev` | Start dev server with live reload (see the `preview` skill for the full open-the-app-in-the-IDE-pane procedure). |
-| `wmill app generate-agents` | Refresh AGENTS.md and DATATABLES.md |
-| `wmill generate-metadata` | Generate lock files for backend runnables |
-| `wmill sync push` | Deploy app to Windmill |
-| `wmill sync pull` | Pull latest from Windmill |
-
 ## Best Practices
 
-1. **Check DATATABLES.md** for existing tables before creating new ones
-2. **Use parameterized queries** - never concatenate user input into SQL
-3. **Keep runnables focused** - one function per file
-4. **Use descriptive IDs** - `get_user.ts` not `a.ts`
-5. **Always whitelist tables** - add to `data.tables` before querying
-6. **Generate locks** - tell the user to run `wmill generate-metadata` after adding/modifying backend runnables
+1. **Check existing tables** before creating new ones — reuse beats schema growth.
+2. **Use parameterized queries** — never concatenate user input into SQL.
+3. **Keep runnables focused** — one function per runnable; small surface area.
+4. **Use descriptive keys** — `get_user`, not `a`.
+5. **Always whitelist tables** — adding a runnable that queries a new table requires the table to be in `data.tables` first.
diff --git a/system_prompts/generate.py b/system_prompts/generate.py
index f291995b88..87f0b63576 100644
--- a/system_prompts/generate.py
+++ b/system_prompts/generate.py
@@ -680,6 +680,8 @@ WORKSPACE_TOOL_ZOD_SCHEMAS = [
     ('NewSqsTrigger', 'sqsTriggerRequestSchema'),
     ('GcpTriggerData', 'gcpTriggerRequestSchema'),
     ('AzureTriggerData', 'azureTriggerRequestSchema'),
+    ('CreateVariable', 'variableRequestSchema'),
+    ('CreateResource', 'resourceRequestSchema'),
 ]
 
 WORKSPACE_TOOL_TRIGGER_SCHEMAS = [
@@ -1486,11 +1488,17 @@ def generate_skills(
     # Ensure skills directory exists
     OUTPUT_SKILLS_DIR.mkdir(parents=True, exist_ok=True)
 
-    # Read base files for additional skills
+    # Read base files for additional skills.
+    # Note: raw-app.md is the chat-relevant authoring guide. The CLI workflow
+    # (wmill app new wizard, on-disk layout, sql_to_apply/, CLI commands) lives
+    # in raw-app-cli.md. Concatenated here for the skill so CLI users see CLI
+    # guidance first, then the platform shape.
     base_dir = SCRIPT_DIR / "base"
+    raw_app_cli_md = read_markdown_file(base_dir / "raw-app-cli.md")
+    raw_app_authoring_md = read_markdown_file(base_dir / "raw-app.md")
     base_content = {
         'flow': f"{flow_cli}\n\n{flow_base}\n\n{openflow_content}",
-        'raw_app': read_markdown_file(base_dir / "raw-app.md"),
+        'raw_app': f"{raw_app_cli_md}\n\n{raw_app_authoring_md}",
         'triggers': read_markdown_file(base_dir / "triggers.md"),
         'schedules': read_markdown_file(base_dir / "schedules.md"),
         'resources': read_markdown_file(base_dir / "resources.md"),
@@ -1856,6 +1864,8 @@ def main():
 
     script_base = read_markdown_file(base_dir / "script-base.md")
     flow_base = read_markdown_file(base_dir / "flow-base.md")
+    resources_base = read_markdown_file(base_dir / "resources.md")
+    raw_app_base = read_markdown_file(base_dir / "raw-app.md")
     workflow_as_code_base = read_markdown_file(base_dir / "workflow-as-code.md")
     flow_cli = read_markdown_file(base_dir / "flow-cli.md")
     flow_chat_special_modules = read_markdown_file(base_dir / "flow-chat-special-modules.md")
@@ -1913,6 +1923,8 @@ def main():
         # Base prompts
         'SCRIPT_BASE': script_base,
         'FLOW_BASE': flow_base,
+        'RESOURCES_BASE': resources_base,
+        'RAW_APP_BASE': raw_app_base,
         'WORKFLOW_AS_CODE_BASE': workflow_as_code_base,
         'FLOW_CHAT_SPECIAL_MODULES': flow_chat_special_modules,
 
@@ -2001,6 +2013,16 @@ export function getFlowPrompt(): string {
   ].filter(Boolean).join('\\n\\n');
 }
 
+// Helper for resource & variable authoring
+export function getResourcePrompt(): string {
+  return prompts.RESOURCES_BASE;
+}
+
+// Helper for raw app authoring (chat consumers)
+export function getRawAppPrompt(): string {
+  return prompts.RAW_APP_BASE;
+}
+
 // Helper to get datatable SDK reference for app mode
 export function getDatatableSdkReference(): string {
   return [
@@ -2037,6 +2059,8 @@ export function getWorkflowAsCodePrompt(language?: string): string {
     index_dts_content = """export * from './prompts';
 export declare function getScriptPrompt(language: string): string;
 export declare function getFlowPrompt(): string;
+export declare function getResourcePrompt(): string;
+export declare function getRawAppPrompt(): string;
 export declare function getDatatableSdkReference(): string;
 export declare function getWorkflowAsCodePrompt(language?: string): string;
 """
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 135c0c7be3..251f481322 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.697.0",
+  "version": "1.700.2",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index bbb6083085..53005f6120 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.697.0",
+  "version": "1.700.2",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "sideEffects": false,
diff --git a/version.txt b/version.txt
index 20b63a5ebc..cfabbb8494 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.697.0
+1.700.2